@hublo/sentinel 1.5.0-alpha.8 → 1.5.0

package/docs/typescript-adoption.md

@@ -147,7 +147,7 @@ $ sentinel --run --typescript --json --max-diagnostics 1
 | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | `target(s) not available yet: --test`                               | only wired types run; `--help` lists what is available now vs planned                                                                                                                                                                                        |
 | `preset is ambiguous, detected "react" ... also found sails`        | a mixed stack; pass `--preset` to be explicit                                                                                                                                                                                                                |
-| `sentinel requires Node >= 20.12`                                   | run sentinel with a modern Node via `fnm`/`nvm`; the project's own Node is untouched                                                                                                                                                                         |
+| `sentinel requires Node >= 24.15`                                   | run sentinel with a modern Node via `fnm`/`nvm`; the project's own Node is untouched                                                                                                                                                                         |
 | fresh version will not install (`minimumReleaseAge`)                | `--init` allow-lists sentinel automatically when the root uses the gate; if you adopted by hand, add the package to `minimumReleaseAgeExclude` (or `--config.minimumReleaseAge=0`) until it ages                                                             |
 | a translation-singleton test goes red after adopting a front module | `--init` handles this automatically when the root runs more than one TypeScript: adopting re-resolves pnpm and can duplicate a package with an optional, type-only `typescript` peer (e.g. i18next); `--init` pins that peer so it collapses to one instance |
 

package/docs/typescript-traces.md

@@ -1072,7 +1072,7 @@ $ sentinel --report --typescript --max-diagnostics 3.9 --module bff-admin
 $ sentinel --init --dry-run
   dry run: no files written
   wrote .oxlintrc.json extending ./node_modules/@hublo/sentinel/lint/nest.json (@hublo/sentinel@<version>)
-  2 rule(s) not enforced by this preset (1 no-barrel-files, 1 core). Run --inspect --lint for each rule and why.
+  20 rule(s) not enforced by this preset (17 jest, 1 no-barrel-files, 1 core, 1 vitest). Run --inspect --lint for each rule and why.
   run `pnpm install`, then `pnpm run lint`
 
   create .oxlintrc.json
@@ -1156,7 +1156,7 @@ $ sentinel --init --dry-run
   build: no Vite config in this module, so there is nothing to point at sentinel. This role moves an existing config's imports; it does not introduce a bundler. If this module builds another way (38 services here build through `@nx/webpack`), the build role does not apply to it.
   test: this module has no test and no jest leftovers, so there is nothing to do here.
   dry run: no files written
-  added the three `static-analysis` scripts and static-analysis.config.mjs; declare this module's entry points and journeys there, everything else comes from the role
+  added the three `static-analysis` scripts and static-analysis.config.mjs; declare this module's entry points there, everything else comes from the role
 
   create static-analysis.config.mjs
     + import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'
@@ -1168,17 +1168,32 @@ $ sentinel --init --dry-run
     +   // the patterns sentinel ships, never replacing them.
     +   entry: [],
     + 
-    +   // Named product journeys, as { 'the name product uses': ['src/some/path/**'] }. Paths are
-    +   // relative to this module, because one run measures one module.
-    +   journeys: {},
-    + 
-    +   // Everything else comes from the role, and this is the door when a module must move one of its
-    +   // values. Anything set here is printed under "measured with" and marked `(module)`, so nobody
-    +   // compares this module's figures with its neighbour's without seeing that they differ:
+    +   // ---------------------------------------------------------------------------------------------
+    +   // What this module can move, with the role's value today. A setting you leave out keeps that
+    +   // value; a setting you write REPLACES it, including inside a list. Anything you set is printed
+    +   // under "measured with" in the report and marked `(module)`, because two modules measured with
+    +   // different settings can no longer be compared.
+    +   //
+    +   //   ignore                  19 patterns
+    +   //   languages               javascript, typescript, jsx, tsx, css, scss
+    +   //   duplication.minTokens   50
+    +   //   duplication.minLines    5
+    +   //   duplication.tests       3 patterns
+    +   //   deadCode.minConfidence  60
+    +   //   deadCode.categories     unused-file, unused-export, unused-symbol, unused-import
+    +   //   graph.resolution        1
+    +   //
+    +   // A list shown as a count is not copyable, and replacing one means writing back what you keep,
+    +   // so read the values in full with:
+    +   //
+    +   //   pnpm exec sentinel --inspect --static-analysis --json
+    +   //
+    +   //   duplication.kinds: only `exact` is supported: any other kind overlaps it and double-counts
+    +   //   tools: sentinel's own passthrough to the tool underneath; a module never names the vendor
     +   //
-    +   //   overrides: {
-    +   //     duplication: { minTokens: 100 },
-    +   //   },
+    +   // overrides: {
+    +   //   duplication: { minTokens: 100 },
+    +   // },
     + })
 
   update package.json

package/docs/using-sentinel.md

@@ -4,9 +4,10 @@ The commands, what an adopted module ends up looking like, and how versions move
 migrating a module see [`lint-adoption.md`](lint-adoption.md),
 [`format-adoption.md`](format-adoption.md),
 [`typescript-adoption.md`](typescript-adoption.md),
-[`build-adoption.md`](build-adoption.md) and
-[`test-adoption.md`](test-adoption.md), which also carries the reference gate `--test` runs a
-migration against.
+[`build-adoption.md`](build-adoption.md),
+[`test-adoption.md`](test-adoption.md) and
+[`static-analysis-adoption.md`](static-analysis-adoption.md). The reference gate `--test` runs a
+migration against is in `test-adoption.md`, not the static-analysis page.
 
 ## The grid
 
@@ -22,18 +23,25 @@ sentinel --run                             # no target        -> every wired tar
 Read it by target, since that is what you pick first. `--report` and `--status` are deprecated
 everywhere (`--run --json` and `--inspect` answer them), and `--migrate` is refused everywhere.
 
-| Target         | `--init` writes                                                                                           | `--run` does                                                   | `--inspect` shows                                                |
-| -------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | ---------------------------------------------------------------- |
-| `--lint`       | stub + scripts + nx metadata, removes the ESLint config and the module's ESLint deps, then autofixes once | lints; `--fix` autofixes in the same pass                      | rule count, what is disabled or downgraded and **why**, drift    |
-| `--format`     | materializes the preset + scripts + nx metadata, removes the Prettier config and deps, then formats once  | **checks**; `--fix` writes                                     | effective options, every departure from the standard and why     |
-| `--typescript` | writes/extends the tsconfig + `typecheck` script                                                          | typechecks                                                     | resolved options, what is deferred, drift                        |
-| `--build`      | points the module's Vite config at sentinel's toolchain + scripts + nx metadata                           | builds                                                         | runner, config file, whose Vite, how many overrides, adoption    |
-| `--dev`        | adopts the BUILD too: one plan writes both `build` and `serve`                                            | serves; long-running, so never swept by an unqualified `--run` | refuses, and sends you to `--inspect --build`: it is that config |
-| `--test`       | the Vitest config + scripts + nx metadata, and migrates every spec file                                   | runs Vitest                                                    | runner, which configs were found, adoption state, drift          |
+| Target              | `--init` writes                                                                                           | `--run` does                                                   | `--inspect` shows                                                |
+| ------------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | ---------------------------------------------------------------- |
+| `--lint`            | stub + scripts + nx metadata, removes the ESLint config and the module's ESLint deps, then autofixes once | lints; `--fix` autofixes in the same pass                      | rule count, what is disabled or downgraded and **why**, drift    |
+| `--format`          | materializes the preset + scripts + nx metadata, removes the Prettier config and deps, then formats once  | **checks**; `--fix` writes                                     | effective options, every departure from the standard and why     |
+| `--typescript`      | writes/extends the tsconfig + `typecheck` script                                                          | typechecks                                                     | resolved options, what is deferred, drift                        |
+| `--build`           | points the module's Vite config at sentinel's toolchain + scripts + nx metadata                           | builds                                                         | runner, config file, whose Vite, how many overrides, adoption    |
+| `--dev`             | adopts the BUILD too: one plan writes both `build` and `serve`                                            | serves; long-running, so never swept by an unqualified `--run` | refuses, and sends you to `--inspect --build`: it is that config |
+| `--test`            | the Vitest config + scripts + nx metadata, and migrates every spec file                                   | runs Vitest                                                    | runner, which configs were found, adoption state, drift          |
+| `--static-analysis` | the config stub + three scripts + nx metadata, and ignores the report directory at the repository root    | measures and reports; never exits non-zero on a finding        | runner, config file, resolved settings, what this module moved   |
 
 `--json` works for every verb, and stdout carries **only** the envelope, so `| jq` always
 parses. `--dry-run` applies to `--init` and writes nothing.
 
+`--output <shape>` is different, and only a role that WRITES a report reads it: `console` is the
+default and writes no file, `html` is the page you open and send, `json` is for CI and for a
+script, `markdown` is the six lines a workflow posts on a pull request. Today `--static-analysis`
+is the role that has them. ⚠️ `--output html` pays a graph layout the other three skip, which is
+fine for a page somebody opens and wrong for a commit hook.
+
 **`--validate` is a verb of its own**, and the proof of a migration lives there rather than on
 `--init` or `--run`. Run before a migration it records what the module does today; run after, it
 compares by test NAME and refuses a run that lost one or invented one. What separates it from
@@ -100,7 +108,9 @@ These options can weaken a check as easily as strengthen it, and `--run` is what
 
 ## What a fully adopted module looks like
 
-Four files, and none of them holds a rule.
+Five files once a module has adopted every role, and none of them holds a rule. The fifth is
+`static-analysis.config.mjs`, which holds the only thing that role asks a team to declare: the files
+that run although nothing imports them.
 
 ```jsonc
 // .oxlintrc.json — the rules come from the preset; the ignores must be here, because oxlint

package/docs/validating-a-change.md

@@ -132,3 +132,188 @@ package that looks missing.
 what a module looks like once you have thought about it. Measured on the real monorepo: 22 of 37
 Nest services have none at all. A change that looked complete against 64 test files refused the
 majority of the migration, and only a sweep over every real module found it.
+
+---
+
+## The static analysis role's validation matrix, 19 October 2026
+
+Re-run from scratch because **53 commits landed on the role since 13 October**, and three of them
+added an AXIS the earlier matrix has no column for: the `markdown` recap, `--output` taking a list,
+and a front whose build produced no files. A matrix that does not grow with the tool is a claim of
+coverage that stopped being true.
+
+39 cells, six real modules, one log per cell.
+
+### output shape × module, from the module's own directory
+
+|                                   | console | json | html | markdown |
+| --------------------------------- | ------- | ---- | ---- | -------- |
+| `console`, react with a build     | 0       | 0    | 0    | 0        |
+| `host-admin`, react with NO build | 0       | 0    | 0    | 0        |
+| `institution`, nest               | 0       | 0    | 0    | 0        |
+| `hr-management`, svelte           | 0       | 0    | 0    | 0        |
+| `libs/front/components`, library  | 0       | 0    | 0    | 0        |
+| `libs/nest/auth`, nest library    | 0       | 0    | 0    | 0        |
+
+⭐ The second row is new and it earned its place: the two defects found this week both live there.
+A front that declares a build and produced no files is not a front without a bundle, and the role
+said the same sentence to both until it was pointed at one.
+
+### `--output` taking a LIST, which did not exist on 13 October
+
+|                      | exit | files written                      |
+| -------------------- | ---: | ---------------------------------- |
+| `html,json`          |    0 | html, json, svg                    |
+| `json,html`          |    0 | html, json, svg, same as above     |
+| `json,json`          |    0 | **json only**, the duplicate drops |
+| `markdown,html,json` |    0 | html, json, md, svg                |
+
+### from the workspace ROOT rather than the module
+
+|                                                | exit |
+| ---------------------------------------------- | ---: |
+| `--run --static-analysis --module console`     |    0 |
+| `--run --static-analysis --module institution` |    0 |
+| `--inspect --static-analysis --json`           |    0 |
+
+### the forms that must REFUSE
+
+|                     |  exit | what it says                                                       |
+| ------------------- | ----: | ------------------------------------------------------------------ |
+| `--output pdf`      | **1** | `unknown --output "pdf" (known: console, json, html, markdown; …)` |
+| `--output html,pdf` | **1** | the same, naming the whole list it was given                       |
+| `--output ,`        | **1** | an empty list refuses rather than falling back to the console      |
+| `--module <absent>` | **1** | `sentinel: module "…" not found in the workspace`                  |
+
+⚠️ The first cell is where the earlier matrix had gone stale: it answered `known: console, json,
+html`, and `markdown` had been shippable for days.
+
+### ⭐ What the matrix proves, beyond an exit code
+
+| invariant                                                 | result                                                                                  |
+| --------------------------------------------------------- | --------------------------------------------------------------------------------------- |
+| json, markdown and html report the SAME figures           | **174 figures compared, 0 disagreement**                                                |
+| a list writes one file per shape, and a repeat writes one | held on both modules                                                                    |
+| a list costs ONE measurement, not one per shape           | `console` 6.4 s in three runs, **2.6 s** in one; `institution` 10.9 s against **6.3 s** |
+
+The third one is why `--output` learned to take a list: the measurement is the whole cost of this
+role and rendering is under a second, so asking for the page and the recap used to pay for the
+analysis twice.
+
+### ⚠️ The bench lied twice before it told the truth
+
+Both times it would have been reported as a defect of the role:
+
+| what the bench did                                            | what it would have claimed |
+| ------------------------------------------------------------- | -------------------------- |
+| a character class that swallowed the newline, reading `0\n>`  | one figure disagreeing     |
+| comparing `29 entries` from the recap with `29` from the page | **150 disagreements**      |
+
+Comparing the NUMBER rather than the string is what made the invariant mean something. An
+instrument is validated before its measurement is believed, and a matrix that reports a defect of
+itself is the most expensive kind.
+
+### What this matrix does NOT cover, said so nobody assumes it does
+
+- `--init --static-analysis`: it WRITES, and this matrix runs against a shared tree. Covered by the
+  adoption pull requests and the e2e suite.
+- a module that has ADOPTED the role, for the same reason: no module on this branch carries a
+  `static-analysis.config.mjs`. The four adoption pull requests are where that axis lives.
+- `--ci`, which needs a diff against a base to mean anything. The pull-request recap covers it, on
+  three probe pull requests of 1, 2 and 5 modules.
+- the `node` and `tools` presets: no module of either carries the evidence the branches react to.
+
+## The static analysis role's validation matrix, 13 October 2026
+
+A matrix is a claim of coverage, so a partial one is worse than none: everyone then believes the
+thing was checked. The axes are the tool's, not a sample of them.
+
+**Run on real modules, never on fixtures.** The branches that break are reached by what a real
+module carries, a `.svelte` file, a module with no `src/`, a library whose reachability is decided
+outside it. A synthetic temp module cannot reach them, so running it a thousand times proves
+nothing. Logs: one per cell.
+
+### verb × output shape × preset, from the module's own directory
+
+|                         | console | json | html | `--inspect` | `--inspect --json` |
+| ----------------------- | ------- | ---- | ---- | ----------- | ------------------ |
+| `console`, react        | 0       | 0    | 0    | 0           | 0                  |
+| `contract`, nest        | 0       | 0    | 0    | 0           | 0                  |
+| `hr-management`, svelte | 0       | 0    | 0    | 0           | 0                  |
+
+### the module states that take a different path
+
+|                  |                                                          | exit |
+| ---------------- | -------------------------------------------------------- | ---: |
+| `network`        | a module that has NOT adopted                            |    0 |
+| `libs/nest/auth` | a library, whose dead code is decided outside the module |    0 |
+| `libs/nest/auth` | `--inspect` on the same                                  |    0 |
+
+### from the workspace ROOT rather than the module
+
+|                                             | exit |
+| ------------------------------------------- | ---: |
+| `--run --static-analysis --module console`  |    0 |
+| `--run --static-analysis --module contract` |    0 |
+| `--inspect --static-analysis --json`        |    0 |
+
+### the forms that must REFUSE, and what they say
+
+|                                   |  exit | message                                               |
+| --------------------------------- | ----: | ----------------------------------------------------- |
+| `--output pdf`                    | **1** | `unknown --output "pdf" (known: console, json, html)` |
+| `--module ce-module-n-existe-pas` | **1** | `sentinel: module "…" not found in the workspace`     |
+
+### ⭐ What the matrix actually proves, beyond an exit code
+
+An exit code is a smoke test. Two invariants were checked by comparing the sorted figure lines of
+each run, as a hash:
+
+| invariant                                                                  | result                              |
+| -------------------------------------------------------------------------- | ----------------------------------- |
+| the three output shapes report the SAME figures                            | identical on react, nest and svelte |
+| a module measured from its own directory and from the root with `--module` | **identical**                       |
+
+The second one matters because the two paths resolve the module differently, and a report that
+changed with the caller's working directory would make every figure uncomparable.
+
+### Two timings the cells show, neither of them a defect
+
+|                                         | first run of a session |     run again |
+| --------------------------------------- | ---------------------: | ------------: |
+| `console` from its own directory        |              22 188 ms |  **2 648 ms** |
+| `console` from the root with `--module` |              45 046 ms | **18 374 ms** |
+
+**The first cell of a session pays for the consumer index**, the one scan of the workspace that
+decides a library's reachability; every cell after it reads the cache. Reading the first number as
+the role's cost is the mistake this table exists to prevent.
+
+**From the root costs about 16 seconds more, whatever the module**, warm: 18.4 s against 2.6 s on
+react, 17.9 s on nest. The root form resolves the workspace before it can target one module. It is
+the right form for CI and the wrong one for a developer in a loop, and the adoption guide says to
+run the script from the module.
+
+### What this matrix does NOT cover, said so nobody assumes it does
+
+- `--init --static-analysis` on a module that has never adopted. Covered by the adoption branch and
+  by the e2e suite, not re-run here, because it WRITES and this matrix runs against a shared tree.
+- `--ci` (affected only), which needs a diff against a base to mean anything.
+- the `node` and `tools` presets: no module of either carries the evidence the branches react to,
+  so the cells would be green without proving anything.
+- a module whose oxlint binary cannot be resolved. The role reports "not measured" there rather than
+  zero, and that path is covered by a unit test instead.
+
+### Beside it: the whole-repository sweep, same day
+
+|                            | modules |  exit 0 | defects |
+| -------------------------- | ------: | ------: | ------: |
+| `apps/front`               |       5 |       5 |       0 |
+| `apps/nest` + `apps/cloud` |     241 |     241 |       0 |
+| `libs`                     |     150 |     150 |       0 |
+| **total**                  | **396** | **396** |   **0** |
+
+⚠️ The sweep found no defect in the role and two in what the role was SAYING: a help line claiming
+the gauge and the graph read the same population, false for any module with a stylesheet, and the
+same line again on `apps/cloud/interop`, where a bare `staffea` in the repository's `.gitignore`
+hides 34 tracked files from every tool that consumes gitignore patterns. Both are corrected; the
+second is monorepo #22358.

package/lint/nest.json

@@ -3,6 +3,7 @@
   "plugins": [
     "typescript",
     "jest",
+    "vitest",
     "import",
     "unicorn",
     "oxc",
@@ -93,27 +94,27 @@
         "prefer-inline": true
       }
     ],
-    "jest/expect-expect": "warn",
-    "jest/no-alias-methods": "error",
-    "jest/no-commented-out-tests": "warn",
+    "jest/expect-expect": "off",
+    "jest/no-alias-methods": "off",
+    "jest/no-commented-out-tests": "off",
     "jest/no-deprecated-functions": "error",
-    "jest/no-disabled-tests": "warn",
+    "jest/no-disabled-tests": "off",
     "jest/no-done-callback": "error",
     "jest/no-export": "error",
-    "jest/no-focused-tests": "error",
-    "jest/no-identical-title": "error",
-    "jest/no-interpolation-in-snapshots": "error",
+    "jest/no-focused-tests": "off",
+    "jest/no-identical-title": "off",
+    "jest/no-interpolation-in-snapshots": "off",
     "jest/no-jasmine-globals": "error",
-    "jest/no-mocks-import": "error",
-    "jest/no-standalone-expect": "error",
-    "jest/no-test-prefixes": "error",
-    "jest/prefer-to-be": "error",
-    "jest/prefer-to-contain": "error",
-    "jest/prefer-to-have-length": "error",
-    "jest/valid-describe-callback": "error",
-    "jest/valid-expect": "warn",
-    "jest/valid-expect-in-promise": "error",
-    "jest/valid-title": "error",
+    "jest/no-mocks-import": "off",
+    "jest/no-standalone-expect": "off",
+    "jest/no-test-prefixes": "off",
+    "jest/prefer-to-be": "off",
+    "jest/prefer-to-contain": "off",
+    "jest/prefer-to-have-length": "off",
+    "jest/valid-describe-callback": "off",
+    "jest/valid-expect": "off",
+    "jest/valid-expect-in-promise": "off",
+    "jest/valid-title": "off",
     "no-async-promise-executor": "error",
     "no-case-declarations": "error",
     "no-compare-neg-zero": "error",
@@ -347,12 +348,91 @@
       {
         "requireStringLiterals": false
       }
-    ]
+    ],
+    "vitest/expect-expect": "warn",
+    "vitest/no-alias-methods": "error",
+    "vitest/no-commented-out-tests": "warn",
+    "vitest/no-conditional-expect": "warn",
+    "vitest/no-disabled-tests": "warn",
+    "vitest/no-focused-tests": "error",
+    "vitest/no-identical-title": "error",
+    "vitest/no-interpolation-in-snapshots": "error",
+    "vitest/no-mocks-import": "error",
+    "vitest/no-standalone-expect": "error",
+    "vitest/no-test-prefixes": "error",
+    "vitest/prefer-to-be": "error",
+    "vitest/prefer-to-contain": "error",
+    "vitest/prefer-to-have-length": "error",
+    "vitest/require-mock-type-parameters": "off",
+    "vitest/require-to-throw-message": "warn",
+    "vitest/valid-describe-callback": "error",
+    "vitest/valid-expect": "warn",
+    "vitest/valid-expect-in-promise": "error",
+    "vitest/valid-title": "error",
+    "vitest/warn-todo": "warn"
   },
   "jsPlugins": [
     {
       "name": "nx",
       "specifier": "@nx/eslint-plugin"
     }
+  ],
+  "overrides": [
+    {
+      "files": [
+        "**/*.test.ts",
+        "**/*.test.tsx",
+        "**/*.spec.ts",
+        "**/*.spec.tsx",
+        "**/*.integration-spec.ts",
+        "**/*.e2e-spec.ts"
+      ],
+      "rules": {
+        "no-restricted-properties": [
+          "warn",
+          {
+            "object": "Math",
+            "property": "random",
+            "message": "No Math.random() in a test: use a deterministic fixture, or stub the random source."
+          },
+          {
+            "object": "Date",
+            "property": "now",
+            "message": "No Date.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+          },
+          {
+            "object": "performance",
+            "property": "now",
+            "message": "No performance.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+          },
+          {
+            "object": "process",
+            "property": "hrtime",
+            "message": "No process.hrtime in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+          },
+          {
+            "object": "crypto",
+            "property": "randomUUID",
+            "message": "No crypto.randomUUID() in a test: use a fixed id, or stub the random source."
+          },
+          {
+            "object": "crypto",
+            "property": "getRandomValues",
+            "message": "No crypto.getRandomValues() in a test: use a fixed buffer, or stub the random source."
+          }
+        ],
+        "no-restricted-globals": [
+          "warn",
+          {
+            "name": "setTimeout",
+            "message": "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+          },
+          {
+            "name": "setInterval",
+            "message": "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+          }
+        ]
+      }
+    }
   ]
 }

package/lint/node.json

@@ -2,7 +2,8 @@
   "$schema": "./node_modules/oxlint/configuration_schema.json",
   "plugins": [
     "typescript",
-    "oxc"
+    "oxc",
+    "vitest"
   ],
   "categories": {
     "correctness": "off",
@@ -47,6 +48,85 @@
     "typescript/no-wrapper-object-types": "error",
     "typescript/prefer-as-const": "error",
     "typescript/prefer-namespace-keyword": "error",
-    "typescript/triple-slash-reference": "error"
-  }
+    "typescript/triple-slash-reference": "error",
+    "vitest/expect-expect": "warn",
+    "vitest/no-alias-methods": "warn",
+    "vitest/no-commented-out-tests": "warn",
+    "vitest/no-conditional-expect": "warn",
+    "vitest/no-disabled-tests": "warn",
+    "vitest/no-focused-tests": "warn",
+    "vitest/no-identical-title": "warn",
+    "vitest/no-interpolation-in-snapshots": "warn",
+    "vitest/no-mocks-import": "warn",
+    "vitest/no-standalone-expect": "warn",
+    "vitest/no-test-prefixes": "warn",
+    "vitest/prefer-to-be": "warn",
+    "vitest/prefer-to-contain": "warn",
+    "vitest/prefer-to-have-length": "warn",
+    "vitest/require-mock-type-parameters": "off",
+    "vitest/require-to-throw-message": "warn",
+    "vitest/valid-describe-callback": "warn",
+    "vitest/valid-expect": "warn",
+    "vitest/valid-expect-in-promise": "warn",
+    "vitest/valid-title": "warn",
+    "vitest/warn-todo": "warn"
+  },
+  "overrides": [
+    {
+      "files": [
+        "**/*.test.ts",
+        "**/*.test.tsx",
+        "**/*.spec.ts",
+        "**/*.spec.tsx",
+        "**/*.integration-spec.ts",
+        "**/*.e2e-spec.ts"
+      ],
+      "rules": {
+        "no-restricted-properties": [
+          "warn",
+          {
+            "object": "Math",
+            "property": "random",
+            "message": "No Math.random() in a test: use a deterministic fixture, or stub the random source."
+          },
+          {
+            "object": "Date",
+            "property": "now",
+            "message": "No Date.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+          },
+          {
+            "object": "performance",
+            "property": "now",
+            "message": "No performance.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+          },
+          {
+            "object": "process",
+            "property": "hrtime",
+            "message": "No process.hrtime in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+          },
+          {
+            "object": "crypto",
+            "property": "randomUUID",
+            "message": "No crypto.randomUUID() in a test: use a fixed id, or stub the random source."
+          },
+          {
+            "object": "crypto",
+            "property": "getRandomValues",
+            "message": "No crypto.getRandomValues() in a test: use a fixed buffer, or stub the random source."
+          }
+        ],
+        "no-restricted-globals": [
+          "warn",
+          {
+            "name": "setTimeout",
+            "message": "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+          },
+          {
+            "name": "setInterval",
+            "message": "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+          }
+        ]
+      }
+    }
+  ]
 }