@hublo/sentinel 1.5.0-alpha.35 → 1.5.0-alpha.36

package/dist/bin/sentinel.js

@@ -15,10 +15,10 @@ import {
   palette,
   registerAdapters,
   resolve
-} from "../chunk-JWOLL5JK.js";
+} from "../chunk-5HM2TYYC.js";
 import {
   resolveContext
-} from "../chunk-ZFNBW6S3.js";
+} from "../chunk-43HQ6BVJ.js";
 import {
   ensureWorkspacePrep,
   findWorkspaceRoot,
@@ -148,7 +148,7 @@ async function runValidate(ctx) {
     );
   }
   if (!ctx.targets.includes("test")) return 1;
-  const { validateModuleTests } = await import("../validate-7G2ORUZD.js");
+  const { validateModuleTests } = await import("../validate-FRMENKHM.js");
   const outcomes = modules.flatMap(
     (module) => validateModuleTests(module.name, module.root)
   );

package/dist/{chunk-ZFNBW6S3.js → chunk-43HQ6BVJ.js}

@@ -2160,13 +2160,26 @@ function namespaceBindings(program) {
 import { readFileSync as readFileSync9, statSync } from "node:fs";
 import { dirname as dirname2, join as join10, resolve as resolve4 } from "node:path";
 import { parseSync as parseSync4 } from "oxc-parser";
-var EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+
+// src/shared/module-resolution.ts
+var RESOLVABLE_EXTENSIONS = [
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs"
+];
+
+// src/roles/test/codemod/static-import-for-require.ts
 function resolveRelative(fromFile, specifier) {
   const base = resolve4(dirname2(fromFile), specifier);
   const candidates = [
     base,
-    ...EXTENSIONS.map((extension) => `${base}${extension}`),
-    ...EXTENSIONS.map((extension) => join10(base, `index${extension}`))
+    ...RESOLVABLE_EXTENSIONS.map((extension) => `${base}${extension}`),
+    ...RESOLVABLE_EXTENSIONS.map((extension) => join10(base, `index${extension}`))
   ];
   for (const candidate of candidates) {
     try {
@@ -3537,7 +3550,7 @@ function resolveContext(cwd, opts) {
 // src/roles/test/codemod/workspace-specifier.ts
 import { existsSync as existsSync13, readFileSync as readFileSync13 } from "node:fs";
 import { join as join15, relative as relative2, resolve as resolve6 } from "node:path";
-var EXTENSIONS2 = ["", ".ts", ".tsx", ".js", ".jsx", ".mts", ".cts", "/index.ts", "/index.js"];
+var EXTENSIONS = ["", ".ts", ".tsx", ".js", ".jsx", ".mts", ".cts", "/index.ts", "/index.js"];
 function pathEntries(workspaceRoot) {
   const file = join15(workspaceRoot, "tsconfig.base.json");
   if (!existsSync13(file)) return [];
@@ -3567,7 +3580,7 @@ function workspaceSpecifier(workspaceRoot, file) {
   const absolute = resolve6(file);
   for (const entry of pathEntries(workspaceRoot)) {
     if (!entry.wildcard) {
-      if (EXTENSIONS2.some((extension) => `${entry.target}${extension}` === absolute)) {
+      if (EXTENSIONS.some((extension) => `${entry.target}${extension}` === absolute)) {
         return entry.key;
       }
       continue;
@@ -3712,14 +3725,13 @@ function rewriteMockFactoryGenerics(source, program) {
 import { readFileSync as readFileSync14, statSync as statSync3 } from "node:fs";
 import { dirname as dirname7, join as join16, relative as relative3, resolve as resolve8 } from "node:path";
 import { parseSync as parseSync7 } from "oxc-parser";
-var EXTENSIONS3 = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 function resolveRelative2(fromFile, specifier) {
   if (!specifier.startsWith(".")) return void 0;
   const base = resolve8(dirname7(fromFile), specifier);
   const candidates = [
     base,
-    ...EXTENSIONS3.map((extension) => `${base}${extension}`),
-    ...EXTENSIONS3.map((extension) => join16(base, `index${extension}`))
+    ...RESOLVABLE_EXTENSIONS.map((extension) => `${base}${extension}`),
+    ...RESOLVABLE_EXTENSIONS.map((extension) => join16(base, `index${extension}`))
   ];
   for (const candidate of candidates) {
     try {
@@ -4309,7 +4321,7 @@ var THE_SHIM_CANNOT_ANSWER = [/\brequire\s*\(/, /\bjest\.(?:fn|Mock|SpyInstance)
 var SKIPPED = /* @__PURE__ */ new Set(["node_modules", "dist", "coverage", ".git", ".vite"]);
 var TEST_FILE2 = /[.-](spec|test)\.[cm]?[jt]sx?$/;
 var SOURCE_FILE = /\.[cm]?[jt]sx?$/;
-var EXTENSIONS4 = [".ts", ".tsx", ".js", ".jsx", ".mts", ".cts"];
+var EXTENSIONS2 = [".ts", ".tsx", ".js", ".jsx", ".mts", ".cts"];
 function relativeSpecifiers2(source) {
   const found = [];
   const patterns = [
@@ -4326,10 +4338,10 @@ function relativeSpecifiers2(source) {
 function resolveSpecifier(fromFile, specifier) {
   const base = resolve9(dirname9(fromFile), specifier);
   if (existsSync14(base) && statSync4(base).isFile()) return base;
-  for (const extension of EXTENSIONS4) {
+  for (const extension of EXTENSIONS2) {
     if (existsSync14(`${base}${extension}`)) return `${base}${extension}`;
   }
-  for (const extension of EXTENSIONS4) {
+  for (const extension of EXTENSIONS2) {
     const index = join17(base, `index${extension}`);
     if (existsSync14(index)) return index;
   }
@@ -6574,6 +6586,7 @@ export {
   oxlintSearchPath,
   walk,
   writtenFileFormatter,
+  RESOLVABLE_EXTENSIONS,
   readTestAdoption,
   resolveContext,
   moduleEnvironment,

package/dist/{chunk-JWOLL5JK.js → chunk-5HM2TYYC.js}

@@ -13,6 +13,7 @@ import {
   PERMITTED_LOCAL_KEYS,
   PRETTIER_CONFIG_FILES,
   PROVENANCE_KEY,
+  RESOLVABLE_EXTENSIONS,
   VitestAdapter,
   adoptedPackageName,
   binFromOwnInstall,
@@ -54,7 +55,7 @@ import {
   splitToolArgs,
   walk,
   writtenFileFormatter
-} from "./chunk-ZFNBW6S3.js";
+} from "./chunk-43HQ6BVJ.js";
 import {
   DEFAULT_MAX_DIAGNOSTICS,
   WORKSPACE_ROOT_MARKER,
@@ -6018,7 +6019,137 @@ function unreadableNote(coverage) {
 import { readFileSync as readFileSync17 } from "node:fs";
 import { join as join23 } from "node:path";
 
-// src/roles/static-analysis/help/bundle.ts
+// src/roles/static-analysis/maintainability/size-rules.ts
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join22 } from "node:path";
+var GAUGE_THRESHOLDS = {
+  // McCabe 1976 says 10, our p90 says 11. The only indicator where two independent candidates agree
+  // within one unit, and 94.8% of our functions already sit in the 1-10 band SEI calls low risk.
+  complexity: 10,
+  // IfSQ SP-2, "few people can understand nesting to more than 3 levels". Our p90 agrees at 3.
+  "max-depth": 3,
+  // No research anywhere for a FILE's length: IfSQ's three citations (500, 100-150, 143) are all
+  // about routines. So our p90 of 157, rounded down.
+  "max-lines": 150,
+  // Our p90. IfSQ SP-1 says 150 and is discarded for being more permissive than our own code.
+  "max-lines-per-function": 109,
+  // No research. Our p90 is 15, the rule's default is 10, so the default stays as the stricter one.
+  "max-statements": 10,
+  // No research, and none needed: beyond three parameters the fix is an object or currying, so this
+  // is a design boundary and not a dial. Our p90 of 4 is the looser candidate and loses.
+  "max-params": 3,
+  // Same nesting family as `max-depth`, no citation of its own. Our p90 agrees at 3.
+  "max-nested-callbacks": 3,
+  // 1 is the rule's floor, there is no stricter value to pick.
+  "max-classes-per-file": 1,
+  // Cognitive complexity, Campbell 2018, measured by Sonar's own rule, loaded
+  // through `plugins/sonar-cognitive.js`.
+  // Sonar publishes 15 for S3776, and that is a vendor default rather than a research value: one of
+  // their own engineers has said publicly that no formula supports it. Our p90 is 7, so 7 wins, and
+  // it reports 342 of 8 083 files, 4.2%, which sits inside the band the eight above occupy.
+  "cognitive-complexity": 7
+};
+var COGNITIVE = "cognitive-complexity";
+var cognitivePlugin = () => join22(ownPackageDir(), "plugins", "sonar-cognitive.js");
+var CATEGORIES = [
+  "correctness",
+  "suspicious",
+  "pedantic",
+  "perf",
+  "style",
+  "restriction",
+  "nursery"
+];
+function sizeRulesConfig() {
+  return {
+    plugins: [],
+    categories: Object.fromEntries(CATEGORIES.map((category) => [category, "off"])),
+    // Sonar's cognitive complexity, in the SAME run as the eight above rather than a second
+    // invocation: the parse is the expensive part and it is already paid here. Measured over the
+    // whole bench, 8 083 files, the rule adds 2.4 s to a pass that was going to read them anyway.
+    jsPlugins: [cognitivePlugin()],
+    // ⛔ `warn` and not `error`, for the reason `tool-config.ts` gives about jscpd's `threshold`:
+    // at `error` oxlint exits 1 as soon as one file breaches, which is indistinguishable from the
+    // binary failing to run. Measured on `libs/nest/auth`, same config otherwise: `error` exits 1,
+    // `warn` exits 0, and both report the same 18 diagnostics. So the tool measures, this role
+    // judges, and a non-zero exit means the tool failed.
+    rules: Object.fromEntries(
+      Object.entries(GAUGE_THRESHOLDS).map(([rule, threshold]) => [
+        rule === COGNITIVE ? `sonar/${rule}` : rule,
+        ["warn", threshold]
+      ])
+    )
+  };
+}
+function sizeRulesRun(paths, ignore) {
+  const dir = mkdtempSync2(join22(tmpdir2(), "sentinel-size-"));
+  const configPath = join22(dir, "oxlintrc.json");
+  writeFileSync4(configPath, `${JSON.stringify(sizeRulesConfig(), null, 2)}
+`, "utf8");
+  return {
+    // `--format json` because the console shape is rendered by this role from the figures: a
+    // per-pass table from the tool would be a second voice saying the same numbers differently.
+    // The exclusions are the SAME list the duplication product pass is given, so "the module's
+    // code" means one thing across the whole report.
+    args: [
+      "-c",
+      configPath,
+      ...ignore.flatMap((pattern) => ["--ignore-pattern", pattern]),
+      "--format",
+      "json",
+      ...paths
+    ],
+    dispose: () => rmSync4(dir, { force: true, recursive: true })
+  };
+}
+function ruleOf(code) {
+  return /\(([^)]+)\)\s*$/.exec(code)?.[1];
+}
+function valueOf(message) {
+  const match = /\((\d+)\)/.exec(message) ?? /complexity of (\d+)/.exec(message) ?? // Sonar's own wording, a third shape again: "reduce its Cognitive Complexity from 7 to the 0
+  // allowed". It parenthesises nothing, and the `0` after it is the threshold, not the value.
+  /Complexity from (\d+) to/.exec(message);
+  return Number(match?.[1] ?? 0);
+}
+function breachesOf(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { breaches: [], diagnostics: 0, files: 0 };
+  }
+  const diagnostics = parsed.diagnostics ?? [];
+  const worst = /* @__PURE__ */ new Map();
+  for (const diagnostic of diagnostics) {
+    const rule = ruleOf(diagnostic.code ?? "");
+    const file = diagnostic.filename;
+    if (!rule || !file || !(rule in GAUGE_THRESHOLDS)) continue;
+    const value = valueOf(diagnostic.message ?? "");
+    const line = diagnostic.labels?.[0]?.span?.line ?? 0;
+    const key = `${file}\0${rule}`;
+    const seen = worst.get(key);
+    if (!seen || value > seen.value) worst.set(key, { file, rule, value, line });
+  }
+  return {
+    breaches: [...worst.values()],
+    diagnostics: diagnostics.length,
+    files: parsed.number_of_files ?? 0
+  };
+}
+function scanSizeRules(cwd, roots, ignore, binary, spawn) {
+  if (!binary) return void 0;
+  const run = sizeRulesRun(roots, ignore);
+  try {
+    const result = spawn(binary, run.args, cwd);
+    if (result.status !== 0) return void 0;
+    return breachesOf(result.stdout);
+  } finally {
+    run.dispose();
+  }
+}
+
+// src/roles/static-analysis/bundle/help.ts
 var WEB_DEV_TREE_SHAKING = "https://web.dev/articles/reduce-javascript-payloads-with-tree-shaking";
 var WEB_DEV_SCRIPT_EVALUATION = "https://web.dev/articles/script-evaluation-and-long-tasks";
 var V8_COST_2019 = "https://v8.dev/blog/cost-of-javascript-2019";
@@ -6121,7 +6252,7 @@ var context = {
 };
 var bundleHelp = { ...actionable, ...context };
 
-// src/roles/static-analysis/help/metrics.ts
+// src/roles/static-analysis/report-help.ts
 var metricsHelp = {
   duplicatedLinesPercent: {
     label: "Duplicated lines",
@@ -6379,136 +6510,6 @@ function helpFor(key) {
   return metricsHelp[key];
 }
 
-// src/roles/static-analysis/maintainability/size-rules.ts
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import { join as join22 } from "node:path";
-var GAUGE_THRESHOLDS = {
-  // McCabe 1976 says 10, our p90 says 11. The only indicator where two independent candidates agree
-  // within one unit, and 94.8% of our functions already sit in the 1-10 band SEI calls low risk.
-  complexity: 10,
-  // IfSQ SP-2, "few people can understand nesting to more than 3 levels". Our p90 agrees at 3.
-  "max-depth": 3,
-  // No research anywhere for a FILE's length: IfSQ's three citations (500, 100-150, 143) are all
-  // about routines. So our p90 of 157, rounded down.
-  "max-lines": 150,
-  // Our p90. IfSQ SP-1 says 150 and is discarded for being more permissive than our own code.
-  "max-lines-per-function": 109,
-  // No research. Our p90 is 15, the rule's default is 10, so the default stays as the stricter one.
-  "max-statements": 10,
-  // No research, and none needed: beyond three parameters the fix is an object or currying, so this
-  // is a design boundary and not a dial. Our p90 of 4 is the looser candidate and loses.
-  "max-params": 3,
-  // Same nesting family as `max-depth`, no citation of its own. Our p90 agrees at 3.
-  "max-nested-callbacks": 3,
-  // 1 is the rule's floor, there is no stricter value to pick.
-  "max-classes-per-file": 1,
-  // Cognitive complexity, Campbell 2018, measured by Sonar's own rule, loaded
-  // through `plugins/sonar-cognitive.js`.
-  // Sonar publishes 15 for S3776, and that is a vendor default rather than a research value: one of
-  // their own engineers has said publicly that no formula supports it. Our p90 is 7, so 7 wins, and
-  // it reports 342 of 8 083 files, 4.2%, which sits inside the band the eight above occupy.
-  "cognitive-complexity": 7
-};
-var COGNITIVE = "cognitive-complexity";
-var cognitivePlugin = () => join22(ownPackageDir(), "plugins", "sonar-cognitive.js");
-var CATEGORIES = [
-  "correctness",
-  "suspicious",
-  "pedantic",
-  "perf",
-  "style",
-  "restriction",
-  "nursery"
-];
-function sizeRulesConfig() {
-  return {
-    plugins: [],
-    categories: Object.fromEntries(CATEGORIES.map((category) => [category, "off"])),
-    // Sonar's cognitive complexity, in the SAME run as the eight above rather than a second
-    // invocation: the parse is the expensive part and it is already paid here. Measured over the
-    // whole bench, 8 083 files, the rule adds 2.4 s to a pass that was going to read them anyway.
-    jsPlugins: [cognitivePlugin()],
-    // ⛔ `warn` and not `error`, for the reason `tool-config.ts` gives about jscpd's `threshold`:
-    // at `error` oxlint exits 1 as soon as one file breaches, which is indistinguishable from the
-    // binary failing to run. Measured on `libs/nest/auth`, same config otherwise: `error` exits 1,
-    // `warn` exits 0, and both report the same 18 diagnostics. So the tool measures, this role
-    // judges, and a non-zero exit means the tool failed.
-    rules: Object.fromEntries(
-      Object.entries(GAUGE_THRESHOLDS).map(([rule, threshold]) => [
-        rule === COGNITIVE ? `sonar/${rule}` : rule,
-        ["warn", threshold]
-      ])
-    )
-  };
-}
-function sizeRulesRun(paths, ignore) {
-  const dir = mkdtempSync2(join22(tmpdir2(), "sentinel-size-"));
-  const configPath = join22(dir, "oxlintrc.json");
-  writeFileSync4(configPath, `${JSON.stringify(sizeRulesConfig(), null, 2)}
-`, "utf8");
-  return {
-    // `--format json` because the console shape is rendered by this role from the figures: a
-    // per-pass table from the tool would be a second voice saying the same numbers differently.
-    // The exclusions are the SAME list the duplication product pass is given, so "the module's
-    // code" means one thing across the whole report.
-    args: [
-      "-c",
-      configPath,
-      ...ignore.flatMap((pattern) => ["--ignore-pattern", pattern]),
-      "--format",
-      "json",
-      ...paths
-    ],
-    dispose: () => rmSync4(dir, { force: true, recursive: true })
-  };
-}
-function ruleOf(code) {
-  return /\(([^)]+)\)\s*$/.exec(code)?.[1];
-}
-function valueOf(message) {
-  const match = /\((\d+)\)/.exec(message) ?? /complexity of (\d+)/.exec(message) ?? // Sonar's own wording, a third shape again: "reduce its Cognitive Complexity from 7 to the 0
-  // allowed". It parenthesises nothing, and the `0` after it is the threshold, not the value.
-  /Complexity from (\d+) to/.exec(message);
-  return Number(match?.[1] ?? 0);
-}
-function breachesOf(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return { breaches: [], diagnostics: 0, files: 0 };
-  }
-  const diagnostics = parsed.diagnostics ?? [];
-  const worst = /* @__PURE__ */ new Map();
-  for (const diagnostic of diagnostics) {
-    const rule = ruleOf(diagnostic.code ?? "");
-    const file = diagnostic.filename;
-    if (!rule || !file || !(rule in GAUGE_THRESHOLDS)) continue;
-    const value = valueOf(diagnostic.message ?? "");
-    const line = diagnostic.labels?.[0]?.span?.line ?? 0;
-    const key = `${file}\0${rule}`;
-    const seen = worst.get(key);
-    if (!seen || value > seen.value) worst.set(key, { file, rule, value, line });
-  }
-  return {
-    breaches: [...worst.values()],
-    diagnostics: diagnostics.length,
-    files: parsed.number_of_files ?? 0
-  };
-}
-function scanSizeRules(cwd, roots, ignore, binary, spawn) {
-  if (!binary) return void 0;
-  const run = sizeRulesRun(roots, ignore);
-  try {
-    const result = spawn(binary, run.args, cwd);
-    if (result.status !== 0) return void 0;
-    return breachesOf(result.stdout);
-  } finally {
-    run.dispose();
-  }
-}
-
 // src/roles/static-analysis/report.ts
 var FAMILIES = [
   {
@@ -7774,7 +7775,6 @@ var SCRIPT = `(function(){
 
 // src/roles/static-analysis/graph/imports.ts
 import { dirname, join as join24 } from "node:path";
-var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
 var TS_BEHIND_JS = {
   ".js": [".ts", ".tsx"],
   ".mjs": [".mts"],
@@ -7829,38 +7829,43 @@ function resolveSpecifier(from, specifier, known) {
   if (!specifier.startsWith(".")) return void 0;
   const base = join24(dirname(from), specifier);
   if (known.has(base)) return base;
-  for (const extension of EXTENSIONS) {
+  for (const extension of RESOLVABLE_EXTENSIONS) {
     if (known.has(base + extension)) return base + extension;
   }
-  const written = EXTENSIONS.find((extension) => base.endsWith(extension));
+  const written = RESOLVABLE_EXTENSIONS.find((extension) => base.endsWith(extension));
   for (const extension of TS_BEHIND_JS[written ?? ""] ?? []) {
     const swapped = base.slice(0, -(written ?? "").length) + extension;
     if (known.has(swapped)) return swapped;
   }
-  for (const extension of EXTENSIONS) {
+  for (const extension of RESOLVABLE_EXTENSIONS) {
     const index = join24(base, `index${extension}`);
     if (known.has(index)) return index;
   }
   return void 0;
 }
 function collectImports(known) {
-  const all2 = {};
-  const value = {};
+  const all2 = /* @__PURE__ */ new Map();
+  const value = /* @__PURE__ */ new Map();
+  const edgesOf = (tree, path2) => {
+    const found = tree.get(path2);
+    if (found !== void 0) return found;
+    const created = /* @__PURE__ */ new Set();
+    tree.set(path2, created);
+    return created;
+  };
   return {
     read: ({ path: path2, program }) => {
       for (const { specifier, typeOnly } of specifiersOf(program)) {
         const target = resolveSpecifier(path2, specifier, known);
         if (!target || target === path2) continue;
-        all2[path2] = all2[path2] ?? [];
-        value[path2] = value[path2] ?? [];
-        if (!all2[path2].includes(target)) all2[path2].push(target);
-        if (!typeOnly && !value[path2].includes(target)) value[path2].push(target);
+        edgesOf(all2, path2).add(target);
+        if (!typeOnly) edgesOf(value, path2).add(target);
       }
     },
     finish: (files) => {
       const ordered = (tree) => {
         const out = {};
-        for (const file of files) out[file] = tree[file] ?? [];
+        for (const file of files) out[file] = [...tree.get(file) ?? []];
         return out;
       };
       return { all: ordered(all2), value: ordered(value) };
@@ -7951,7 +7956,6 @@ import { dirname as dirname2, join as join25, relative as relative4, resolve as
 var CACHE_DIR = join25("node_modules", ".cache", "sentinel");
 var CACHE_FILE = "consumer-index.json";
 var SHAPE = 4;
-var EXTENSIONS2 = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
 function workspaceRootFrom(cwd) {
   let dir = resolve3(cwd);
   for (; ; ) {
@@ -7991,10 +7995,10 @@ function resolveSpecifier2(specifier, table, workspaceRoot) {
   };
   const exists = (candidate) => {
     if (isFile(candidate)) return candidate;
-    for (const extension of EXTENSIONS2) {
+    for (const extension of RESOLVABLE_EXTENSIONS) {
       if (isFile(candidate + extension)) return candidate + extension;
     }
-    for (const extension of EXTENSIONS2) {
+    for (const extension of RESOLVABLE_EXTENSIONS) {
       const index = `${candidate}/index${extension}`;
       if (isFile(index)) return index;
     }
@@ -8031,8 +8035,9 @@ function resolveRelative(importer, specifier, workspaceRoot) {
     }
   };
   if (isFile(base)) return base;
-  for (const extension of EXTENSIONS2) if (isFile(base + extension)) return base + extension;
-  for (const extension of EXTENSIONS2) {
+  for (const extension of RESOLVABLE_EXTENSIONS)
+    if (isFile(base + extension)) return base + extension;
+  for (const extension of RESOLVABLE_EXTENSIONS) {
     const index = `${base}/index${extension}`;
     if (isFile(index)) return index;
   }
@@ -8174,7 +8179,7 @@ function resolveJscpd(cwd) {
 }
 
 // src/roles/static-analysis/adapters/jscpd/jscpd.adapter.ts
-var EXTENSIONS3 = extensionsOf(defaults.languages);
+var EXTENSIONS = extensionsOf(defaults.languages);
 var scripts = () => ({
   [SCRIPTS.console]: `sentinel --run --${TARGET}`,
   [SCRIPTS.json]: `sentinel --run --${TARGET} --output json`,
@@ -8233,10 +8238,10 @@ var JscpdAdapter = class extends BaseAdapter {
     return true;
   }
   plan(context2) {
-    if (!hasSourceFiles(context2.cwd, EXTENSIONS3)) {
+    if (!hasSourceFiles(context2.cwd, EXTENSIONS)) {
       return {
         operations: [],
-        skipped: `no file ${this.runner} can read (looked for ${EXTENSIONS3.join(", ")}).`
+        skipped: `no file ${this.runner} can read (looked for ${EXTENSIONS.join(", ")}).`
       };
     }
     return {
@@ -8274,9 +8279,9 @@ var JscpdAdapter = class extends BaseAdapter {
       );
       return { ok: false, code: 1 };
     }
-    if (!hasSourceFiles(ctx.cwd, EXTENSIONS3)) {
+    if (!hasSourceFiles(ctx.cwd, EXTENSIONS)) {
       process.stderr.write(
-        `sentinel static-analysis(jscpd): no file to measure in this module (looked for ${EXTENSIONS3.join(", ")}).
+        `sentinel static-analysis(jscpd): no file to measure in this module (looked for ${EXTENSIONS.join(", ")}).
 `
       );
       return { ok: true, code: 0 };

package/dist/index.js

@@ -6,10 +6,10 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-JWOLL5JK.js";
+} from "./chunk-5HM2TYYC.js";
 import {
   BaseAdapter
-} from "./chunk-ZFNBW6S3.js";
+} from "./chunk-43HQ6BVJ.js";
 import "./chunk-IL5PPLXE.js";
 import "./chunk-V3NHPRLJ.js";
 import "./chunk-O7REVMOC.js";

package/dist/{validate-7G2ORUZD.js → validate-FRMENKHM.js}

@@ -7,7 +7,7 @@ import {
   readTestAdoption,
   resolveVitest,
   suiteOf
-} from "./chunk-ZFNBW6S3.js";
+} from "./chunk-43HQ6BVJ.js";
 import "./chunk-IL5PPLXE.js";
 import "./chunk-O7REVMOC.js";
 import "./chunk-QXFCZON7.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.5.0-alpha.35",
+  "version": "1.5.0-alpha.36",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",

package/plugins/hublo/no-palette-common.js

@@ -0,0 +1,76 @@
+/**
+ * Ban `palette.common` and `common.*` colour paths in product code.
+ *
+ * oxlint has no `no-restricted-syntax`, so the eight AST selectors that used to live in
+ * `restricted-syntax.cjs` cannot be carried across as configuration. They are expressed as a real
+ * rule instead, which is what oxlint's JS plugin API is for. The originals, and where each is
+ * handled below:
+ *
+ *   1-2  MemberExpression[object.property.name='palette'][property.name='common']       theme.palette.common
+ *        …[computed=true][property.value='common']                                      theme.palette['common']
+ *   3-4  MemberExpression[object.name='palette']…                                        palette.common
+ *   5-6  Property[key.name|key.value=/<colour props>/] > Literal[value=/^common\./]      { color: 'common.white' }
+ *   7-8  JSXAttribute[name.name=/<colour props>/] > Literal | JSXExpressionContainer     color="common.white"
+ */
+
+const MESSAGE =
+  'Do not use palette.common or common.* color paths in product code. Use semantic palette tokens instead.'
+
+/** The MUI props that take a colour path, so `common.*` in them is the same mistake. */
+const COLOUR_PROPS =
+  /^(color|bgcolor|background|backgroundColor|borderColor|borderTopColor|borderRightColor|borderBottomColor|borderLeftColor|outlineColor|fill|stroke|textDecorationColor|caretColor|accentColor)$/
+
+/** `common.something` as a string value, e.g. `{ color: 'common.white' }`. */
+const isCommonPath = (node) =>
+  node?.type === 'Literal' && typeof node.value === 'string' && /^common\./.test(node.value)
+
+/** @type {import("oxlint").Rule} */
+export const rule = {
+  meta: {
+    docs: {
+      description: 'Ban palette.common and common.* colour paths in product code.',
+    },
+  },
+  create(context) {
+    const report = (node) => context.report({ node, message: MESSAGE })
+
+    return {
+      // 1-4: reaching `common` off a palette, by property or by computed key.
+      MemberExpression(node) {
+        const onPalette =
+          node.object?.property?.name === 'palette' || node.object?.name === 'palette'
+        if (!onPalette) {
+          return
+        }
+        const reachesCommon =
+          node.property?.name === 'common' || (node.computed && node.property?.value === 'common')
+        if (reachesCommon) {
+          report(node)
+        }
+      },
+
+      // 5-6: `{ color: 'common.white' }` in an object literal, key written either way.
+      Property(node) {
+        const key = node.key?.name ?? node.key?.value
+        if (typeof key === 'string' && COLOUR_PROPS.test(key) && isCommonPath(node.value)) {
+          report(node.value)
+        }
+      },
+
+      // 7-8: `color="common.white"` and `color={'common.white'}` on a JSX element.
+      JSXAttribute(node) {
+        const name = node.name?.name
+        if (typeof name !== 'string' || !COLOUR_PROPS.test(name)) {
+          return
+        }
+        const value = node.value
+        if (isCommonPath(value)) {
+          return report(value)
+        }
+        if (value?.type === 'JSXExpressionContainer' && isCommonPath(value.expression)) {
+          report(value.expression)
+        }
+      },
+    }
+  },
+}

package/plugins/hublo/no-regex-lookbehind.js

@@ -0,0 +1,70 @@
+/**
+ * Ban regex lookbehind, which Safari below 16.4 cannot parse.
+ *
+ * ⛔ Not a style rule and not a carried-over selector: a browser-support rule. Unlike everything
+ * else a preset controls, lookbehind can be neither transpiled nor polyfilled, because no bundler
+ * rewrites the contents of a regex literal. Lint is the only layer left that can catch it.
+ */
+
+/**
+ * Lookbehind, positive or negative. NOT named groups `(?<name>)`, which Safari has had since
+ * 11.3: the class is exactly `(?<` followed by `=` or `!`.
+ */
+const LOOKBEHIND = /\(\?<[=!]/
+
+const LOOKBEHIND_MESSAGE =
+  'Regex lookbehind ((?<=) / (?<!)) is Safari 16.4+ and can be neither transpiled nor polyfilled: on older iOS the literal is a parse-time SyntaxError that takes the whole chunk with it. Rewrite the pattern. Named groups (?<name>) are fine.'
+
+/** @type {import("oxlint").Rule} */
+export const rule = {
+  meta: {
+    docs: {
+      description: 'Ban regex lookbehind, unsupported by Safari below 16.4.',
+    },
+  },
+  create(context) {
+    const report = (node) => context.report({ node, message: LOOKBEHIND_MESSAGE })
+
+    /**
+     * `new RegExp(...)` and `RegExp(...)`, when the pattern is readable statically: a
+     * string, or a template whose fixed parts carry the lookbehind.
+     *
+     * Each template chunk is tested on its own rather than joined. Joining invents a
+     * `(?<=` that the runtime string never has, across an interpolation boundary:
+     * `` `(?<${op}=x)` `` would read as one.
+     */
+    const isStaticLookbehind = (pattern) => {
+      if (pattern?.type === 'Literal') {
+        return typeof pattern.value === 'string' && LOOKBEHIND.test(pattern.value)
+      }
+      if (pattern?.type === 'TemplateLiteral') {
+        return (pattern.quasis ?? []).some((quasi) =>
+          LOOKBEHIND.test(quasi.value?.cooked ?? quasi.value?.raw ?? ''),
+        )
+      }
+      return false
+    }
+
+    const checkRegExpCall = (node) => {
+      if (node.callee?.name !== 'RegExp') {
+        return
+      }
+      const pattern = node.arguments?.[0]
+      if (isStaticLookbehind(pattern)) {
+        report(pattern)
+      }
+    }
+
+    return {
+      // The case that actually breaks a page: a literal is an EARLY error, so the whole
+      // chunk fails to parse rather than the one call site failing.
+      Literal(node) {
+        if (node.regex && LOOKBEHIND.test(node.regex.pattern)) {
+          report(node)
+        }
+      },
+      NewExpression: checkRegExpCall,
+      CallExpression: checkRegExpCall,
+    }
+  },
+}

package/plugins/hublo/require-reload-document.js

@@ -0,0 +1,70 @@
+/**
+ * Ban a TanStack Router `redirect({ href })` that does not say whether it reloads the document.
+ *
+ * Carried from an ESLint selector in monorepo #22043, for the same reason as its neighbours: a
+ * house rule is code, not configuration.
+ */
+
+/** @type {import("oxlint").Rule} */
+export const rule = {
+  meta: {
+    docs: {
+      description:
+        'Ban a TanStack Router redirect({ href }) that does not say whether it reloads the document.',
+    },
+  },
+  create(context) {
+    /**
+     * A `redirect({ href })` that declares no `reloadDocument`.
+     *
+     * ⛔ The failure this exists for ships GREEN and 404s only in production. Since the
+     * router-core bump, `redirect({ href })` no longer reloads the document for an absolute
+     * URL on the app's own origin: router-core turns it into an in-app navigation. Apps under
+     * a basepath share their origin with the app they point at, so the redirect lands on the
+     * SOURCE app's 404 instead of loading the target. Tests run on jsdom's localhost, where
+     * the same href is cross-origin and does reload, so nothing catches it before production.
+     *
+     * ⚠️ What this rule enforces is "declare the intent", NOT "do not 404". A call that says
+     * `reloadDocument: false` passes, and that is the exact in-app navigation which caused the
+     * incident; the rule cannot tell an internal path from a cross-app one, because the href is
+     * usually computed. It shrinks the target from any `redirect({ href })` to one that opted
+     * out explicitly, and that is all it does.
+     *
+     * ⚠️ An `href` arriving through a spread is invisible to it. Measured when the rule was
+     * written: zero occurrences of `redirect({ ...opts })` in the whole front end.
+     *
+     * It is application-agnostic on purpose: every app on TanStack Router under a basepath has
+     * the same exposure, so the message names no application.
+     */
+    const SPREAD_SAFE_MESSAGE =
+      'redirect({ href }) must say whether it reloads the document. Under a basepath the app ' +
+      'shares its origin with the app you are pointing at, so the router turns a same-origin ' +
+      'href into an in-app navigation and the redirect lands on this app’s 404. Use a ' +
+      'helper that sets reloadDocument: true to leave for another app, or set ' +
+      'reloadDocument: false to say you mean an in-app navigation.'
+
+    /** The call is `redirect(...)`, written bare or as a member. */
+    const isRedirect = (node) =>
+      node.callee?.name === 'redirect' || node.callee?.property?.name === 'redirect'
+
+    /** A plain `key:` property, which a spread element does not have. */
+    const named = (property, name) =>
+      property?.type === 'Property' && (property.key?.name === name || property.key?.value === name)
+
+    return {
+      CallExpression(node) {
+        if (!isRedirect(node)) return
+        const options = node.arguments?.[0]
+        if (options?.type !== 'ObjectExpression') return
+
+        const properties = options.properties ?? []
+        const hasHref = properties.some((property) => named(property, 'href'))
+        if (!hasHref) return
+        const declaresReload = properties.some((property) => named(property, 'reloadDocument'))
+        if (declaresReload) return
+
+        context.report({ node: options, message: SPREAD_SAFE_MESSAGE })
+      },
+    }
+  },
+}

package/plugins/hublo.js

@@ -1,220 +1,31 @@
 /**
  * Local oxlint plugin: Hublo house rules that have no equivalent anywhere else.
  *
- * oxlint has no `no-restricted-syntax`, so the eight AST selectors that used to live in
- * `restricted-syntax.cjs` cannot be carried across as configuration. They are expressed
- * here as a real rule instead, which is what oxlint's JS plugin API is for.
+ * It ships INSIDE sentinel rather than being copied into each module. A house rule is code, not
+ * configuration: a per-module copy drifts, and drifting house rules are the problem sentinel
+ * exists to remove. The cost is that `@hublo/sentinel` carries a rule about Hublo's colour
+ * palette, which is honest for a package named after the company.
  *
- * It ships INSIDE sentinel rather than being copied into each module. A house rule is code,
- * not configuration: a per-module copy drifts, and drifting house rules are the problem
- * sentinel exists to remove. The cost is that `@hublo/sentinel` carries a rule about Hublo's
- * colour palette, which is honest for a package named after the company.
+ * ⛔ One file per rule, assembled here, and this file holds NO rule logic. It was one 220-line
+ * object with three rules inside it, which is the shape that invites a fourth: the rules share
+ * nothing, each carries its own constants and its own reasoning, and a reader looking for one of
+ * them had to scroll past the other two. Composition is the point here rather than speed: this
+ * plugin has no dependencies and loads in about 1 ms, so there is no sonarjs-style cost to cut.
  *
- * It now hosts a SECOND, unrelated rule. `no-regex-lookbehind` is not a carried-over selector
- * but a browser-support rule: regex lookbehind is Safari 16.4+, and unlike everything else a
- * preset controls it can be neither transpiled nor polyfilled, because no bundler rewrites the
- * contents of a regex literal. It is here for the same reason as the palette rule — a house
- * rule is code, not configuration — and because lint is the only layer left that can catch it.
- *
- * The original selectors, and where each is handled below:
- *   1-2  MemberExpression[object.property.name='palette'][property.name='common']       theme.palette.common
- *        …[computed=true][property.value='common']                                      theme.palette['common']
- *   3-4  MemberExpression[object.name='palette']…                                        palette.common
- *   5-6  Property[key.name|key.value=/<colour props>/] > Literal[value=/^common\./]      { color: 'common.white' }
- *   7-8  JSXAttribute[name.name=/<colour props>/] > Literal | JSXExpressionContainer     color="common.white"
- */
-
-const MESSAGE =
-  'Do not use palette.common or common.* color paths in product code. Use semantic palette tokens instead.'
-
-/** The MUI props that take a colour path, so `common.*` in them is the same mistake. */
-const COLOUR_PROPS =
-  /^(color|bgcolor|background|backgroundColor|borderColor|borderTopColor|borderRightColor|borderBottomColor|borderLeftColor|outlineColor|fill|stroke|textDecorationColor|caretColor|accentColor)$/
-
-/**
- * Lookbehind, positive or negative. NOT named groups `(?<name>)`, which Safari has had since
- * 11.3: the class is exactly `(?<` followed by `=` or `!`.
+ * ⚠️ The build copies a role's whole `plugins/` DIRECTORY, so `plugins/hublo/` ships beside
+ * `plugins/hublo.js` and the relative imports below resolve the same way in this repository and
+ * in the published package. The generated preset still names `../plugins/hublo.js`, so nothing an
+ * adopted module extends has moved.
  */
-const LOOKBEHIND = /\(\?<[=!]/
+import { rule as noPaletteCommon } from './hublo/no-palette-common.js'
+import { rule as noRegexLookbehind } from './hublo/no-regex-lookbehind.js'
+import { rule as requireReloadDocument } from './hublo/require-reload-document.js'
 
-const LOOKBEHIND_MESSAGE =
-  'Regex lookbehind ((?<=) / (?<!)) is Safari 16.4+ and can be neither transpiled nor polyfilled: on older iOS the literal is a parse-time SyntaxError that takes the whole chunk with it. Rewrite the pattern. Named groups (?<name>) are fine.'
-
-/** `common.something` as a string value, e.g. `{ color: 'common.white' }`. */
-const isCommonPath = (node) =>
-  node?.type === 'Literal' && typeof node.value === 'string' && /^common\./.test(node.value)
-
-const plugin = {
+export default {
   meta: { name: 'hublo' },
   rules: {
-    'no-palette-common': {
-      meta: {
-        docs: {
-          description: 'Ban palette.common and common.* colour paths in product code.',
-        },
-      },
-      create(context) {
-        const report = (node) => context.report({ node, message: MESSAGE })
-
-        return {
-          // 1-4: reaching `common` off a palette, by property or by computed key.
-          MemberExpression(node) {
-            const onPalette =
-              node.object?.property?.name === 'palette' || node.object?.name === 'palette'
-            if (!onPalette) {
-              return
-            }
-            const reachesCommon =
-              node.property?.name === 'common' ||
-              (node.computed && node.property?.value === 'common')
-            if (reachesCommon) {
-              report(node)
-            }
-          },
-
-          // 5-6: `{ color: 'common.white' }` in an object literal, key written either way.
-          Property(node) {
-            const key = node.key?.name ?? node.key?.value
-            if (typeof key === 'string' && COLOUR_PROPS.test(key) && isCommonPath(node.value)) {
-              report(node.value)
-            }
-          },
-
-          // 7-8: `color="common.white"` and `color={'common.white'}` on a JSX element.
-          JSXAttribute(node) {
-            const name = node.name?.name
-            if (typeof name !== 'string' || !COLOUR_PROPS.test(name)) {
-              return
-            }
-            const value = node.value
-            if (isCommonPath(value)) {
-              return report(value)
-            }
-            if (value?.type === 'JSXExpressionContainer' && isCommonPath(value.expression)) {
-              report(value.expression)
-            }
-          },
-        }
-      },
-    },
-
-    'no-regex-lookbehind': {
-      meta: {
-        docs: {
-          description: 'Ban regex lookbehind, unsupported by Safari below 16.4.',
-        },
-      },
-      create(context) {
-        const report = (node) => context.report({ node, message: LOOKBEHIND_MESSAGE })
-
-        /**
-         * `new RegExp(...)` and `RegExp(...)`, when the pattern is readable statically: a
-         * string, or a template whose fixed parts carry the lookbehind.
-         *
-         * Each template chunk is tested on its own rather than joined. Joining invents a
-         * `(?<=` that the runtime string never has, across an interpolation boundary:
-         * `` `(?<${op}=x)` `` would read as one.
-         */
-        const isStaticLookbehind = (pattern) => {
-          if (pattern?.type === 'Literal') {
-            return typeof pattern.value === 'string' && LOOKBEHIND.test(pattern.value)
-          }
-          if (pattern?.type === 'TemplateLiteral') {
-            return (pattern.quasis ?? []).some((quasi) =>
-              LOOKBEHIND.test(quasi.value?.cooked ?? quasi.value?.raw ?? ''),
-            )
-          }
-          return false
-        }
-
-        const checkRegExpCall = (node) => {
-          if (node.callee?.name !== 'RegExp') {
-            return
-          }
-          const pattern = node.arguments?.[0]
-          if (isStaticLookbehind(pattern)) {
-            report(pattern)
-          }
-        }
-
-        return {
-          // The case that actually breaks a page: a literal is an EARLY error, so the whole
-          // chunk fails to parse rather than the one call site failing.
-          Literal(node) {
-            if (node.regex && LOOKBEHIND.test(node.regex.pattern)) {
-              report(node)
-            }
-          },
-          NewExpression: checkRegExpCall,
-          CallExpression: checkRegExpCall,
-        }
-      },
-    },
-
-    'require-reload-document': {
-      meta: {
-        docs: {
-          description:
-            'Ban a TanStack Router redirect({ href }) that does not say whether it reloads the document.',
-        },
-      },
-      create(context) {
-        /**
-         * A `redirect({ href })` that declares no `reloadDocument`.
-         *
-         * ⛔ The failure this exists for ships GREEN and 404s only in production. Since the
-         * router-core bump, `redirect({ href })` no longer reloads the document for an absolute
-         * URL on the app's own origin: router-core turns it into an in-app navigation. Apps under
-         * a basepath share their origin with the app they point at, so the redirect lands on the
-         * SOURCE app's 404 instead of loading the target. Tests run on jsdom's localhost, where
-         * the same href is cross-origin and does reload, so nothing catches it before production.
-         *
-         * ⚠️ What this rule enforces is "declare the intent", NOT "do not 404". A call that says
-         * `reloadDocument: false` passes, and that is the exact in-app navigation which caused the
-         * incident; the rule cannot tell an internal path from a cross-app one, because the href is
-         * usually computed. It shrinks the target from any `redirect({ href })` to one that opted
-         * out explicitly, and that is all it does.
-         *
-         * ⚠️ An `href` arriving through a spread is invisible to it. Measured when the rule was
-         * written: zero occurrences of `redirect({ ...opts })` in the whole front end.
-         *
-         * It is application-agnostic on purpose: every app on TanStack Router under a basepath has
-         * the same exposure, so the message names no application.
-         */
-        const SPREAD_SAFE_MESSAGE =
-          'redirect({ href }) must say whether it reloads the document. Under a basepath the app ' +
-          'shares its origin with the app you are pointing at, so the router turns a same-origin ' +
-          'href into an in-app navigation and the redirect lands on this app’s 404. Use a ' +
-          'helper that sets reloadDocument: true to leave for another app, or set ' +
-          'reloadDocument: false to say you mean an in-app navigation.'
-
-        /** The call is `redirect(...)`, written bare or as a member. */
-        const isRedirect = (node) =>
-          node.callee?.name === 'redirect' || node.callee?.property?.name === 'redirect'
-
-        /** A plain `key:` property, which a spread element does not have. */
-        const named = (property, name) =>
-          property?.type === 'Property' &&
-          (property.key?.name === name || property.key?.value === name)
-
-        return {
-          CallExpression(node) {
-            if (!isRedirect(node)) return
-            const options = node.arguments?.[0]
-            if (options?.type !== 'ObjectExpression') return
-
-            const properties = options.properties ?? []
-            const hasHref = properties.some((property) => named(property, 'href'))
-            if (!hasHref) return
-            const declaresReload = properties.some((property) => named(property, 'reloadDocument'))
-            if (declaresReload) return
-
-            context.report({ node: options, message: SPREAD_SAFE_MESSAGE })
-          },
-        }
-      },
-    },
+    'no-palette-common': noPaletteCommon,
+    'no-regex-lookbehind': noRegexLookbehind,
+    'require-reload-document': requireReloadDocument,
   },
 }
-
-export default plugin