@hublo/sentinel 1.5.1-alpha.0 → 1.5.1-alpha.2

package/dist/{chunk-CL7HOHTU.js → chunk-JHLNNIZC.js}

@@ -10,6 +10,7 @@ import {
   LINT_CONFIG_FILE,
   LINT_MEASURE_FILE,
   LINT_SCRIPT_NAME,
+  OWNED_WHEN_SET_KEYS,
   PERMITTED_LOCAL_KEYS,
   PRETTIER_CONFIG_FILES,
   PROVENANCE_KEY,
@@ -19,7 +20,9 @@ import {
   binFromOwnInstall,
   binSearchPath,
   canRunTypeAware,
+  canonicalRuleName,
   describeHolds,
+  describeRuleKey,
   extendsWithBaseline,
   extendsWithPreset,
   formatPresetFor,
@@ -51,11 +54,12 @@ import {
   resolveOxfmt,
   resolveOxlint,
   rewriteToolchainImports,
+  scriptPath,
   selfCommand,
   splitToolArgs,
   walk,
   writtenFileFormatter
-} from "./chunk-I2WDZNPR.js";
+} from "./chunk-P7NYSMLS.js";
 import {
   DEFAULT_MAX_DIAGNOSTICS,
   WORKSPACE_ROOT_MARKER,
@@ -77,6 +81,9 @@ import {
   isPlainObject,
   overridableSettings
 } from "./chunk-WBDBRGLV.js";
+import {
+  globToRegExp
+} from "./chunk-O7REVMOC.js";
 import {
   parseJsonc
 } from "./chunk-QXFCZON7.js";
@@ -153,7 +160,7 @@ function resolve(target, preset, runner) {
 // src/shared/color.ts
 import { styleText } from "node:util";
 function palette(stream) {
-  const paint = (format, text) => styleText(format, text, { stream });
+  const paint = (format2, text) => styleText(format2, text, { stream });
   return {
     ok: (text) => paint(["green", "bold"], text),
     fail: (text) => paint(["red", "bold"], text),
@@ -581,6 +588,19 @@ function composeToolScript(existing, options) {
 function keepsOtherCommands(script, sentinelCommand) {
   return script.split(SEGMENT_SEPARATOR).filter((_, index) => !isSeparatorAt(index)).some((segment) => segment.trim() !== "" && segment.trim() !== sentinelCommand);
 }
+function leadingCommands(script) {
+  if (script === void 0) return void 0;
+  const parts = script.split(SEGMENT_SEPARATOR);
+  const leading = [];
+  for (let index = 0; index < parts.length; index += 2) {
+    const segment = (parts[index] ?? "").trim();
+    if (invokes(segment, "sentinel") || segment.includes("bin/sentinel.js")) break;
+    if (index + 1 >= parts.length) return void 0;
+    if ((parts[index + 1] ?? "").trim() !== "&&") return void 0;
+    leading.push(segment);
+  }
+  return leading.length > 0 ? leading.join(" && ") : void 0;
+}
 
 // src/roles/build/dev-script.ts
 var CHAIN = " -- ";
@@ -819,8 +839,10 @@ function planReactApp(context2, configFile) {
       skipped: `${configFile} could not be pointed at sentinel, so nothing was written: ${rewrite.why}. Nothing here is broken; this needs a look before the role applies.`
     };
   }
+  const rewritten = [];
   if (rewrite.kind === "rewritten") {
     operations.push({ kind: "write", path: configFile, contents: rewrite.source });
+    rewritten.push(configFile);
   }
   for (const name of COMPANION_CONFIG_FILES) {
     const source = readConfigSource(context2.cwd, name);
@@ -828,6 +850,7 @@ function planReactApp(context2, configFile) {
     const companion = rewriteBuildImports(source, name);
     if (companion.kind === "rewritten") {
       operations.push({ kind: "write", path: name, contents: companion.source });
+      rewritten.push(name);
       notes.push(`${name} now imports ${companion.moved.join(", ")} from sentinel too.`);
     } else if (companion.kind === "blocked") {
       notes.push(
@@ -861,10 +884,12 @@ function planReactApp(context2, configFile) {
       `removed ${owned.map(([, name]) => name).join(", ")} from this module: sentinel owns them now, and two copies of Vite in one build give the plugins a different Vite than the one running them.`
     );
   }
-  const formatted = readFormatAdoption(context2.cwd).adopted;
-  notes.push(
-    formatted ? `run \`sentinel --run --format --fix\` on this module: adoption rewrote ${configFile}, and a rewritten import can be longer than your formatter wraps at.` : `this module is formatted by the workspace, not by sentinel, so format ${configFile} with whatever owns it before committing: a rewritten import can be longer than that formatter wraps at, and the check would fail on a file nobody typed.`
-  );
+  if (rewritten.length > 0) {
+    const files = rewritten.join(", ");
+    notes.push(
+      readFormatAdoption(context2.cwd).adopted ? `run \`sentinel --run --format --fix\` on this module: adoption rewrote ${files}, and a rewritten import can be longer than your formatter wraps at.` : `this module is formatted by the workspace, not by sentinel, so format ${files} with whatever owns it before committing: a rewritten import can be longer than that formatter wraps at, and the check would fail on a file nobody typed.`
+    );
+  }
   notes.push(
     `this config is code, and it runs before the build does: any environment variable it reads has to be present wherever you build, including a fresh clone, another CI job or an image. Adoption does not change what it reads, but a failure there arrives early and names this role rather than the variable.`
   );
@@ -1266,8 +1291,9 @@ function registerBuild() {
 
 // src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync9 } from "node:fs";
+import { join as join11 } from "node:path";
+import { isDeepStrictEqual } from "node:util";
 
 // src/core/config/has-source.ts
 import { readdirSync } from "node:fs";
@@ -1361,6 +1387,160 @@ function scopeFlags(paths, options = []) {
   return [TOLERATE_EMPTY_FLAG];
 }
 
+// src/roles/format/deliberate-import-order.ts
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join8 } from "node:path";
+import { parseSync } from "oxc-parser";
+import { format } from "oxfmt";
+
+// src/roles/format/presets/deliberate-import-order.json
+var deliberate_import_order_default = {
+  rules: [
+    "import/order",
+    "import/first",
+    "import-x/order",
+    "import-x/first",
+    "simple-import-sort/imports",
+    "simple-import-sort/exports"
+  ],
+  modules: [
+    "dd-trace",
+    "dd-trace/**",
+    "reflect-metadata",
+    "source-map-support/register",
+    "@opentelemetry/sdk-**",
+    "@opentelemetry/auto-instrumentations-**",
+    "core-js",
+    "core-js/**",
+    "regenerator-runtime",
+    "regenerator-runtime/**"
+  ]
+};
+
+// src/roles/format/deliberate-import-order.ts
+var PIN_COMMENT = "// oxfmt-ignore";
+var CODE_EXTENSIONS = [".js", ".mjs", ".cjs", ".jsx", ".ts", ".mts", ".cts", ".tsx"];
+var ORDER_RULES = deliberate_import_order_default.rules;
+var LOAD_ORDER_MODULES = deliberate_import_order_default.modules.map((glob) => globToRegExp(glob));
+var MODULE_NAMES = [
+  ...new Set(deliberate_import_order_default.modules.map((glob) => glob.split("*")[0] ?? glob))
+];
+function disabledRules(comment, directive) {
+  const match = new RegExp(String.raw`^\s*${directive}(?:\s+(.*?))?\s*(?:--.*)?$`).exec(comment);
+  if (match === null) return void 0;
+  return (match[1] ?? "").split(/[\s,]+/).filter(Boolean);
+}
+function namesOrderRule(rules) {
+  return rules !== void 0 && rules.some((rule) => ORDER_RULES.includes(rule));
+}
+function lineOf(starts, offset) {
+  let low = 0;
+  let high = starts.length - 1;
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if ((starts[middle] ?? 0) <= offset) low = middle;
+    else high = middle - 1;
+  }
+  return low;
+}
+function readImports(fileName, text) {
+  const { program, comments, errors } = parseSync(fileName, text, { sourceType: "module" });
+  if (errors.length > 0) return [];
+  const starts = [0];
+  for (let index = 0; index < text.length; index++) if (text[index] === "\n") starts.push(index + 1);
+  const nextLine = /* @__PURE__ */ new Set();
+  const sameLine = /* @__PURE__ */ new Set();
+  const regions = [];
+  let regionStart;
+  for (const comment of comments) {
+    const line = lineOf(starts, comment.start);
+    if (comment.type === "Line") {
+      if (namesOrderRule(disabledRules(comment.value, "eslint-disable-next-line"))) {
+        nextLine.add(lineOf(starts, comment.end) + 1);
+      }
+      if (namesOrderRule(disabledRules(comment.value, "eslint-disable-line"))) sameLine.add(line);
+      continue;
+    }
+    if (regionStart === void 0 && namesOrderRule(disabledRules(comment.value, "eslint-disable"))) {
+      regionStart = comment.end;
+      continue;
+    }
+    const enabled = disabledRules(comment.value, "eslint-enable");
+    if (regionStart !== void 0 && enabled !== void 0) {
+      if (enabled.length === 0 || namesOrderRule(enabled)) {
+        regions.push([regionStart, comment.start]);
+        regionStart = void 0;
+      }
+    }
+  }
+  if (regionStart !== void 0) regions.push([regionStart, text.length]);
+  const imports = [];
+  for (const node of program.body) {
+    if (node.type !== "ImportDeclaration") continue;
+    const line = lineOf(starts, node.start);
+    const source = node.source.value;
+    const typeOnly = node.importKind === "type";
+    const signalled = !typeOnly && (LOAD_ORDER_MODULES.some((pattern) => pattern.test(source)) || nextLine.has(line) || sameLine.has(line) || regions.some(([from, to]) => node.start >= from && node.start < to));
+    imports.push({ line, source, signalled });
+  }
+  return imports;
+}
+function wouldMove(before, after) {
+  const order = (list) => list.map((entry) => entry.source);
+  const was = order(before);
+  const now = order(after);
+  return before.some((entry, at) => {
+    if (!entry.signalled) return false;
+    const earlier = new Set(was.slice(0, at));
+    const index = now.indexOf(entry.source);
+    const nowEarlier = new Set(now.slice(0, index));
+    return earlier.size !== nowEarlier.size || [...earlier].some((name) => !nowEarlier.has(name));
+  });
+}
+function pin(text, imports) {
+  const lines = text.split("\n");
+  const insertAt = [];
+  for (const { line, signalled } of imports) {
+    if (!signalled) continue;
+    let top = line;
+    while (top > 0 && /^\s*\/\//.test(lines[top - 1] ?? "")) top -= 1;
+    if (lines.slice(top, line).some((above) => above.trim() === PIN_COMMENT)) continue;
+    insertAt.push(top);
+  }
+  for (const at of [...new Set(insertAt)].sort((a, b) => b - a)) {
+    const indent = /^\s*/.exec(lines[at] ?? "")?.[0] ?? "";
+    lines.splice(at, 0, `${indent}${PIN_COMMENT}`);
+  }
+  return lines.join("\n");
+}
+function formatOptions(config) {
+  const {
+    $sentinel: _provenance,
+    ignorePatterns: _ignored,
+    overrides: _overrides,
+    ...options
+  } = config;
+  return options;
+}
+async function pinDeliberateImportOrder(cwd, options) {
+  if (!options.sortImports) return [];
+  const pinned = [];
+  for (const file of listSourceFiles(cwd, CODE_EXTENSIONS).sort()) {
+    const path2 = join8(cwd, file);
+    const text = readFileSync6(path2, "utf8");
+    if (!text.includes("eslint-disable") && !MODULE_NAMES.some((name) => text.includes(name)))
+      continue;
+    const before = readImports(file, text);
+    if (!before.some((entry) => entry.signalled)) continue;
+    const sorted = await format(file, text, options);
+    if (sorted.errors.length > 0) continue;
+    if (!wouldMove(before, readImports(file, sorted.code))) continue;
+    writeFileSync2(path2, pin(text, before));
+    pinned.push(file);
+  }
+  return pinned;
+}
+
 // src/roles/format/format-script.ts
 var SENTINEL_FORMAT_COMMAND = "sentinel --run --format";
 function isPrettierSegment(segment) {
@@ -1389,8 +1569,8 @@ function writesWhenRewritten(name, command) {
 var CHECK_SCRIPT_NAMES = /* @__PURE__ */ new Set(["lint", "format", "check", "test", "typecheck", "verify"]);
 
 // src/roles/format/inherited-ignores.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "node:fs";
+import { join as join9 } from "node:path";
 var ROOT_IGNORE_FILE = ".prettierignore";
 function isPattern(line) {
   const trimmed = line.trim();
@@ -1406,11 +1586,11 @@ function toModulePattern(pattern) {
 }
 function inheritedIgnorePatterns(workspaceRoot) {
   if (!workspaceRoot) return [];
-  const path2 = join8(workspaceRoot, ROOT_IGNORE_FILE);
+  const path2 = join9(workspaceRoot, ROOT_IGNORE_FILE);
   if (!existsSync6(path2)) return [];
   let contents;
   try {
-    contents = readFileSync6(path2, "utf8");
+    contents = readFileSync7(path2, "utf8");
   } catch {
     return [];
   }
@@ -1455,8 +1635,8 @@ function needsSvelteCompiler(output) {
 }
 
 // src/roles/format/prettier-config.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "node:fs";
+import { join as join10 } from "node:path";
 var UNSUPPORTED = /* @__PURE__ */ new Set(["plugins", "parser", "filepath", "rangeStart", "rangeEnd"]);
 function toOxfmtOverrides(value) {
   if (!Array.isArray(value)) return { overrides: [], unresolved: [] };
@@ -1481,14 +1661,14 @@ function toOxfmtOverrides(value) {
   return { overrides, unresolved };
 }
 function readPrettierSettings(cwd) {
-  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync7(join9(cwd, name)));
+  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync7(join10(cwd, name)));
   if (!file) return { options: {}, unresolved: [] };
   if (/\.(js|cjs|mjs)$/.test(file)) {
     return { options: {}, file, unresolved: [`${file} is JavaScript, so it was not executed`] };
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync7(join9(cwd, file), "utf8"), file);
+    parsed = parseJsonc(readFileSync8(join10(cwd, file), "utf8"), file);
   } catch {
     return { options: {}, file, unresolved: [`${file} could not be parsed`] };
   }
@@ -1570,6 +1750,11 @@ var OxfmtAdapter = class extends BaseAdapter {
     const existing = readFormatAdoption(context2.cwd);
     const prettier = readPrettierSettings(context2.cwd);
     const local = existing.adopted ? { ...existing.local } : { ...prettier.options };
+    const recorded = existing.preset === null ? void 0 : formatPresetFor(existing.preset);
+    const ownedWhenSet = existing.adopted ? OWNED_WHEN_SET_KEYS.filter(
+      (key) => !(key in local) && key in existing.effective && !isDeepStrictEqual(existing.effective[key], preset[key]) && !isDeepStrictEqual(existing.effective[key], recorded?.[key])
+    ) : [];
+    for (const key of ownedWhenSet) local[key] = existing.effective[key];
     for (const [key, value] of Object.entries(local)) {
       if (ALWAYS_LOCAL_KEYS.includes(key)) continue;
       if (key in preset && JSON.stringify(preset[key]) === JSON.stringify(value)) delete local[key];
@@ -1581,17 +1766,19 @@ var OxfmtAdapter = class extends BaseAdapter {
       .../* @__PURE__ */ new Set([...declaredIgnores, ...inherited, ...FORMAT_DEFAULT_IGNORES])
     ].sort();
     if (ignorePatterns.length > 0) local.ignorePatterns = ignorePatterns;
-    const unchanged = existing.adopted && existing.conformant;
-    const version = unchanged && existing.presetVersion ? existing.presetVersion : own.version;
-    const config = {
-      [PROVENANCE_KEY]: { preset: presetName, version, local: localKeys },
+    const configStamped = (version2) => ({
+      [PROVENANCE_KEY]: { preset: presetName, version: version2, local: localKeys },
       ...preset,
       ...Object.fromEntries(
         [...localKeys, ...ALWAYS_LOCAL_KEYS].flatMap(
           (key) => key in local ? [[key, local[key]]] : []
         )
       )
-    };
+    });
+    const previous = existing.adopted ? existing.presetVersion : null;
+    const unchanged = previous !== null && isDeepStrictEqual(configStamped(previous), existing.effective);
+    const version = unchanged ? previous : own.version;
+    const config = configStamped(version);
     const operations = [
       // Written pre-formatted (2-space, trailing newline): oxfmt formats JSON too, and until
       // the format pass runs this file is the one config nothing has formatted yet.
@@ -1599,7 +1786,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       manifestOperation(context2.cwd, this.formatScripts(context2.cwd))
     ];
     const prettierConfigs = PRETTIER_CONFIG_FILES.filter(
-      (name) => existsSync8(join10(context2.cwd, name))
+      (name) => existsSync8(join11(context2.cwd, name))
     );
     for (const name of prettierConfigs) operations.push({ kind: "delete", path: name });
     const removableDeps = this.modulePrettierDependencies(context2.cwd);
@@ -1608,8 +1795,13 @@ var OxfmtAdapter = class extends BaseAdapter {
     }
     operations.push(...nxTargetOperations({ cwd: context2.cwd, targets: formatTargets() }));
     const notes = [
-      `materialized the ${presetName} format preset into ${FORMAT_CONFIG_FILE} (${own.name}@${own.version}). oxfmt has no \`extends\`, so the values live here; \`sentinel --status --format\` reports modules left behind by a preset change`
+      `materialized the ${presetName} format preset into ${FORMAT_CONFIG_FILE} (${own.name}@${version}${unchanged && version !== own.version ? ", unchanged since" : ""}). oxfmt has no \`extends\`, so the values live here; \`sentinel --status --format\` reports modules left behind by a preset change`
     ];
+    if (ownedWhenSet.length > 0) {
+      notes.push(
+        `kept this module's own ${ownedWhenSet.join(", ")} and declared it in \`${PROVENANCE_KEY}.local\`: the module set it, so a re-init does not take it back`
+      );
+    }
     if (localKeys.length > 0) {
       notes.push(
         `kept this module's own formatting (${localKeys.join(", ")})${existing.adopted ? "" : ` from ${prettier.file}`}: the preset is the repo's, these are yours`
@@ -1667,13 +1859,29 @@ var OxfmtAdapter = class extends BaseAdapter {
   async rehearseAfterInit(ctx, origin) {
     const oxfmt = resolveOxfmt(origin);
     if (!oxfmt) return "oxfmt is not installed in this module yet";
+    await this.keepDeliberateImportOrder(ctx.cwd);
     const pass = spawnSync3(oxfmt, ["--write", "."], { cwd: ctx.cwd, encoding: "utf8" });
     if (pass.error) return pass.error.message;
     return pass.status === 0 ? void 0 : oxfmtSaid(`${pass.stdout ?? ""}${pass.stderr ?? ""}`);
   }
+  /**
+   * Pin, before the formatter sorts, the imports whose order is deliberate. See
+   * `deliberate-import-order.ts`. Returns the line to print, or undefined when nothing was pinned.
+   */
+  async keepDeliberateImportOrder(cwd) {
+    const pinned = await pinDeliberateImportOrder(
+      cwd,
+      formatOptions(readFormatAdoption(cwd).effective)
+    );
+    if (pinned.length === 0) return void 0;
+    return `kept the import order of ${pinned.length} file(s) where it is deliberate (an eslint-disable naming an import-order rule, or an import that has to load first, such as dd-trace): ${pinned.join(", ")}. Each such import now carries \`${PIN_COMMENT}\`, so the import sort leaves it where it is`;
+  }
   async afterInit(ctx) {
     const oxfmt = resolveOxfmt(ctx.cwd);
     if (!oxfmt) return;
+    const kept = await this.keepDeliberateImportOrder(ctx.cwd);
+    if (kept !== void 0) process.stderr.write(`  ${palette(process.stderr).warn(kept)}
+`);
     const pass = spawnSync3(oxfmt, ["--write", "."], { cwd: ctx.cwd, encoding: "utf8" });
     process.stderr.write(`  ${palette(process.stderr).dim(FORMATTER_DIFFERENCES)}
 `);
@@ -1855,7 +2063,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   modulePrettierDependencies(cwd) {
     const isPrettierPackage = (name) => name === "prettier" || name.startsWith("prettier-plugin-") || name.startsWith("@prettier/");
     try {
-      const manifest = JSON.parse(readFileSync8(join10(cwd, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync9(join11(cwd, "package.json"), "utf8"));
       return Object.keys(manifest.devDependencies ?? {}).filter(isPrettierPackage).map((name) => ["devDependencies", name]);
     } catch {
       return [];
@@ -1937,8 +2145,8 @@ function registerFormat() {
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync13, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync14, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join17 } from "node:path";
 
 // src/core/config/deferred-rules.ts
 function deferredRuleNames(rules) {
@@ -1947,7 +2155,7 @@ function deferredRuleNames(rules) {
 
 // src/core/fix-report.ts
 import { statSync as statSync2 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var CONFIG_REFUSED = /failed to parse .*config|invalid config file/i;
 function readFailure(output) {
   const lines = output.split("\n").map((line2) => line2.trim());
@@ -1967,7 +2175,7 @@ function fingerprint(path2) {
 function snapshotFiles(cwd, extensions) {
   const snapshot = /* @__PURE__ */ new Map();
   for (const file of listSourceFiles(cwd, extensions)) {
-    const mark = fingerprint(join11(cwd, file));
+    const mark = fingerprint(join12(cwd, file));
     if (mark !== void 0) snapshot.set(file, mark);
   }
   return snapshot;
@@ -1975,7 +2183,7 @@ function snapshotFiles(cwd, extensions) {
 function changedSince(cwd, before, extensions) {
   const changed = [];
   for (const file of listSourceFiles(cwd, extensions)) {
-    const now = fingerprint(join11(cwd, file));
+    const now = fingerprint(join12(cwd, file));
     if (now === void 0) continue;
     if (before.get(file) !== now) changed.push(file);
   }
@@ -4381,6 +4589,19 @@ function validate(preset, rules) {
     }
   }
 }
+function rejectTwoSpellings(label, rules) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const rule of Object.keys(rules)) {
+    const canonical = canonicalRuleName(rule);
+    const other = seen.get(canonical);
+    if (other !== void 0) {
+      throw new Error(
+        `${label}: "${other}" and "${rule}" are the same rule to oxlint (${canonical}). Configure it once, under one name: oxlint keeps both and picks one by hash order.`
+      );
+    }
+    seen.set(canonical, rule);
+  }
+}
 function layered(preset) {
   const base = sharedRules();
   const layer = presetRules(preset);
@@ -4390,6 +4611,7 @@ function layered(preset) {
 }
 function toRuleMap(label, rules) {
   validate(label, rules);
+  rejectTwoSpellings(label, rules);
   const entries = Object.entries(rules).map(([rule, value]) => {
     if (!isDecision(value)) return [rule, value];
     const options = value.options ?? [];
@@ -4421,14 +4643,14 @@ function downgradedRulesFor(preset) {
 }
 
 // src/roles/lint/extra-layers.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "node:fs";
-import { isAbsolute, join as join12, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync10 } from "node:fs";
+import { isAbsolute, join as join13, resolve as resolve2 } from "node:path";
 function ruleCount(cwd, specifier) {
   const path2 = isAbsolute(specifier) ? specifier : resolve2(cwd, specifier);
   if (!existsSync9(path2)) return void 0;
   try {
     const parsed = parseJsonc(
-      readFileSync9(path2, "utf8"),
+      readFileSync10(path2, "utf8"),
       specifier
     );
     return Object.keys(parsed.rules ?? {}).length;
@@ -4448,7 +4670,7 @@ function extraLayers(cwd, extendsList) {
 function committedExtendsList(cwd, configFile) {
   try {
     const parsed = parseJsonc(
-      readFileSync9(join12(cwd, configFile), "utf8"),
+      readFileSync10(join13(cwd, configFile), "utf8"),
       configFile
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4457,6 +4679,110 @@ function committedExtendsList(cwd, configFile) {
   }
 }
 
+// src/roles/lint/module-own-config.ts
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function pluginKey(entry) {
+  if (typeof entry === "string") return entry;
+  if (isRecord(entry) && typeof entry.name === "string") return entry.name;
+  if (isRecord(entry) && typeof entry.specifier === "string") return entry.specifier;
+  return void 0;
+}
+function governedRuleNames(preset) {
+  return /* @__PURE__ */ new Set([
+    ...Object.keys(preset.rules),
+    ...(preset.overrides ?? []).flatMap((override) => Object.keys(override.rules))
+  ]);
+}
+function governedRules(preset) {
+  const governed = /* @__PURE__ */ new Map();
+  for (const name of governedRuleNames(preset)) {
+    const canonical = canonicalRuleName(name);
+    if (!governed.has(canonical)) governed.set(canonical, name);
+  }
+  return governed;
+}
+function moduleOwnBlocks(committed, preset) {
+  const blocks = {};
+  const kept = [];
+  const dropped = [];
+  if (Array.isArray(committed.plugins)) {
+    const own = committed.plugins.filter(
+      (name) => typeof name === "string" && !preset.plugins.includes(name)
+    );
+    if (own.length > 0) {
+      blocks.plugins = own;
+      kept.push(
+        `kept this module's own plugins (${own.join(", ")}): the preset does not enable them`
+      );
+    }
+  }
+  if (Array.isArray(committed.jsPlugins)) {
+    const presetKeys = new Set(preset.jsPlugins.map((entry) => pluginKey(entry)));
+    const own = [];
+    for (const entry of committed.jsPlugins) {
+      const key = pluginKey(entry);
+      if (key !== void 0 && presetKeys.has(key)) dropped.push(`jsPlugins ${key}`);
+      else own.push(entry);
+    }
+    if (own.length > 0) {
+      blocks.jsPlugins = own;
+      kept.push(
+        `kept ${own.length} jsPlugin(s) this module added (${own.map((entry) => pluginKey(entry) ?? "?").join(", ")})`
+      );
+    }
+  }
+  if (isRecord(committed.settings)) {
+    const presetSettings = preset.settings ?? {};
+    const own = {};
+    for (const [key, value] of Object.entries(committed.settings)) {
+      if (key in presetSettings) dropped.push(`settings.${key}`);
+      else own[key] = value;
+    }
+    if (Object.keys(own).length > 0) {
+      blocks.settings = own;
+      kept.push(`kept this module's own settings (${Object.keys(own).join(", ")})`);
+    }
+  }
+  if (Array.isArray(committed.overrides)) {
+    const governed = governedRules(preset);
+    const byFiles = /* @__PURE__ */ new Map();
+    for (const block of committed.overrides) {
+      if (!isRecord(block) || !Array.isArray(block.files)) continue;
+      const files = JSON.stringify([...block.files].map(String).sort());
+      const rules = {};
+      for (const [rule, value] of Object.entries(isRecord(block.rules) ? block.rules : {})) {
+        const presetSpelling = governed.get(canonicalRuleName(rule));
+        if (presetSpelling === void 0) rules[rule] = value;
+        else
+          dropped.push(
+            `overrides[${block.files.join(", ")}] ${describeRuleKey(rule, presetSpelling)}`
+          );
+      }
+      const { rules: _rules, ...rest } = block;
+      const merged = byFiles.get(files);
+      if (merged === void 0) {
+        byFiles.set(files, { ...rest, ...Object.keys(rules).length > 0 ? { rules } : {} });
+        continue;
+      }
+      const { files: _sameFiles, ...others } = rest;
+      const mergedRules = { ...isRecord(merged.rules) ? merged.rules : {}, ...rules };
+      Object.assign(
+        merged,
+        others,
+        Object.keys(mergedRules).length > 0 ? { rules: mergedRules } : {}
+      );
+    }
+    const own = [...byFiles.values()].filter((block) => Object.keys(block).length > 1);
+    if (own.length > 0) {
+      blocks.overrides = own;
+      kept.push(
+        `kept ${own.length} override block(s) this module set (${own.map((block) => block.files.join(", ")).join("; ")})`
+      );
+    }
+  }
+  return { blocks, kept, dropped };
+}
+
 // src/roles/lint/parse-diagnostics.ts
 function ruleId(code) {
   const inner = /\(([^)]+)\)/.exec(code);
@@ -4506,14 +4832,34 @@ function errorCountsByConfigRule(stdout) {
   return counts;
 }
 
+// src/roles/lint/presets.ts
+var hasRuleData = (name) => GENERATED_LINT_PRESETS.includes(name);
+function lintPresetFor(preset) {
+  const file = presetFile(preset);
+  const resolved = hasRuleData(preset) ? preset : "node";
+  return {
+    plugins: file.plugins,
+    jsPlugins: file.jsPlugins,
+    ...file.settings === null ? {} : { settings: file.settings },
+    ...file.renames ? { renames: file.renames } : {},
+    ...file.overrides ? {
+      overrides: file.overrides.map((override, index) => ({
+        files: override.files,
+        rules: toRuleMap(`${preset} override ${index}`, override.rules)
+      }))
+    } : {},
+    rules: rulesFor(resolved)
+  };
+}
+
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync11, readFileSync as readFileSync12 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync13 } from "node:fs";
+import { join as join16 } from "node:path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync10, readFileSync as readFileSync10 } from "node:fs";
-import { join as join13 } from "node:path";
-import { parseSync } from "oxc-parser";
+import { existsSync as existsSync10, readFileSync as readFileSync11 } from "node:fs";
+import { join as join14 } from "node:path";
+import { parseSync as parseSync2 } from "oxc-parser";
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
 function toOxlintPattern(pattern) {
   return pattern.replace(/^\.\//, "");
@@ -4524,17 +4870,17 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join13(cwd, name)).find((path2) => existsSync10(path2));
+  const config = ESLINT_CONFIG_FILES.map((name) => join14(cwd, name)).find((path2) => existsSync10(path2));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync10(config, "utf8");
+    source = readFileSync11(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
   const patterns = /* @__PURE__ */ new Set();
   const unresolved = new Set([...source.matchAll(OPAQUE_SOURCE)].map((match) => match[0]));
-  const { program, errors } = parseSync(config, source, { sourceType: "module" });
+  const { program, errors } = parseSync2(config, source, { sourceType: "module" });
   if (errors.length > 0) {
     return { patterns: [], unresolved: [`${config} could not be parsed`] };
   }
@@ -4598,29 +4944,9 @@ function keepsOtherCommands3(script) {
   return keepsOtherCommands(script, SENTINEL_LINT_COMMAND);
 }
 
-// src/roles/lint/presets.ts
-var hasRuleData = (name) => GENERATED_LINT_PRESETS.includes(name);
-function lintPresetFor(preset) {
-  const file = presetFile(preset);
-  const resolved = hasRuleData(preset) ? preset : "node";
-  return {
-    plugins: file.plugins,
-    jsPlugins: file.jsPlugins,
-    ...file.settings === null ? {} : { settings: file.settings },
-    ...file.renames ? { renames: file.renames } : {},
-    ...file.overrides ? {
-      overrides: file.overrides.map((override, index) => ({
-        files: override.files,
-        rules: toRuleMap(`${preset} override ${index}`, override.rules)
-      }))
-    } : {},
-    rules: rulesFor(resolved)
-  };
-}
-
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync11, statSync as statSync3 } from "node:fs";
-import { join as join14, relative as relative3 } from "node:path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync12, statSync as statSync3 } from "node:fs";
+import { join as join15, relative as relative3 } from "node:path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -4667,7 +4993,7 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join14(dir, entry);
+    const full = join15(dir, entry);
     let isDirectory;
     try {
       isDirectory = statSync3(full).isDirectory();
@@ -4687,7 +5013,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync11(file, "utf8");
+      content = readFileSync12(file, "utf8");
     } catch {
       continue;
     }
@@ -4807,13 +5133,18 @@ function plan2(context2) {
     ...rootIgnores.patterns
   ].filter((pattern) => !defaults2.has(bare(pattern)));
   const carried = [.../* @__PURE__ */ new Set([...DEFAULT_IGNORE_PATTERNS, ...moduleOwn])];
+  const committed = committedConfig(context2.cwd);
   const { kept: teamRules, governed: droppedRules } = moduleOwnRules(
-    committedRules(context2.cwd),
+    isRecord2(committed.rules) ? committed.rules : {},
     lintPresetFor(variant)
   );
+  const teamBlocks = moduleOwnBlocks(committed, lintPresetFor(variant));
+  const { overrides: teamOverrides, ...teamTopLevel } = teamBlocks.blocks;
   const stub = {
     extends: extendsWithPreset(committedExtends(context2.cwd), variant),
+    ...teamTopLevel,
     ...Object.keys(teamRules).length > 0 ? { rules: teamRules } : {},
+    ...teamOverrides !== void 0 ? { overrides: teamOverrides } : {},
     ...carried.length > 0 ? { ignorePatterns: carried } : {}
   };
   const operations = [
@@ -4828,7 +5159,7 @@ function plan2(context2) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync11(join15(context2.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync11(join16(context2.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -4869,7 +5200,13 @@ function plan2(context2) {
   }
   if (droppedRules.length > 0) {
     notes.push(
-      `dropped ${droppedRules.length} rule(s) this module set over the preset (${droppedRules.join(", ")}): the preset governs them`
+      `dropped ${droppedRules.length} rule(s) this module set over the preset (${droppedRules.map((rule) => describeGoverned(rule, variant)).join(", ")}): the preset governs them`
+    );
+  }
+  notes.push(...teamBlocks.kept);
+  if (teamBlocks.dropped.length > 0) {
+    notes.push(
+      `dropped ${teamBlocks.dropped.length} entr(ies) this module set over the preset (${teamBlocks.dropped.join(", ")}): the preset governs them`
     );
   }
   if (rootIgnores.patterns.length > 0) {
@@ -4936,7 +5273,7 @@ function lintScripts(cwd) {
 function committedExtends(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync12(join15(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync13(join16(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4944,35 +5281,35 @@ function committedExtends(cwd) {
     return [];
   }
 }
-function committedRules(cwd) {
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function committedConfig(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync12(join15(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync13(join16(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
-    const rules = parsed.rules;
-    return typeof rules === "object" && rules !== null && !Array.isArray(rules) ? rules : {};
+    return isRecord2(parsed) ? parsed : {};
   } catch {
     return {};
   }
 }
 function moduleOwnRules(committed, preset) {
-  const governedNames = /* @__PURE__ */ new Set([
-    ...Object.keys(preset.rules),
-    ...(preset.overrides ?? []).flatMap((override) => Object.keys(override.rules))
-  ]);
+  const governedNames = governedRules(preset);
   const kept = {};
   const governed = [];
   for (const [rule, value] of Object.entries(committed)) {
-    if (governedNames.has(rule)) governed.push(rule);
+    if (governedNames.has(canonicalRuleName(rule))) governed.push(rule);
     else kept[rule] = value;
   }
   return { kept, governed };
 }
+function describeGoverned(rule, variant) {
+  return describeRuleKey(rule, governedRules(lintPresetFor(variant)).get(canonicalRuleName(rule)));
+}
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync12(join15(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync13(join16(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -4984,7 +5321,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync12(join15(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync13(join16(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -5098,7 +5435,44 @@ ${result.stderr ?? ""}`);
     const env = { ...process.env, PATH: oxlintPath(ctx.cwd, process.env) };
     process.stderr.write(`  ${describeFixOutcome(this.fixPass(ctx, oxlint, env), "lint")}
 `);
-    this.writeModuleBaseline(ctx, oxlint, env);
+    if (this.runLeadingCommands(ctx, env)) this.writeModuleBaseline(ctx, oxlint, env);
+  }
+  /**
+   * Run what the module's `lint` script runs before sentinel, so the baseline measures the module
+   * `pnpm run lint` lints. See `leadingCommands`: on hr-management that is `svelte-kit sync`, and
+   * without it the measurement met a tsconfig extending a file that did not exist yet and held
+   * `typescript/tsconfig-error`, a hold a fresh clone would commit.
+   *
+   * Shelled the way a package manager runs a script, with every `node_modules/.bin` up the tree
+   * on PATH. False when the command failed: a baseline measured without it is the wrong module,
+   * and recording that is worse than recording nothing, so the existing baseline is left alone
+   * and the developer is told what to run.
+   */
+  runLeadingCommands(ctx, env) {
+    const leading = leadingCommands(moduleScripts(ctx.cwd)[LINT_SCRIPT_NAME]);
+    if (leading === void 0) return true;
+    const result = spawnSync4(leading, {
+      cwd: ctx.cwd,
+      shell: true,
+      encoding: "utf8",
+      env: { ...env, PATH: scriptPath(ctx.cwd, env.PATH) },
+      maxBuffer: CAPTURE_MAX_BUFFER
+    });
+    if (!result.error && result.status === 0) {
+      process.stderr.write(
+        `  ran \`${leading}\` before measuring, as the lint script runs it before sentinel
+`
+      );
+      return true;
+    }
+    const said = (result.error?.message ?? `${result.stderr ?? ""}${result.stdout ?? ""}`).trim().split("\n").slice(-1)[0];
+    process.stderr.write(
+      `  ${palette(process.stderr).warn(
+        `the lint script runs \`${leading}\` before sentinel, and it ${result.error ? "could not start" : `exited ${result.status ?? 1}`} here${said ? ` (${said})` : ""}, so this module's existing violations were not measured and ${LINT_BASELINE_FILE} was left as it was. Fix that, then run \`sentinel --init --lint\` again.`
+      )}
+`
+    );
+    return false;
   }
   /**
    * The fix pass alone, in the copy `--init --dry-run` hands it, without the baseline measurement
@@ -5128,23 +5502,23 @@ ${result.stderr ?? ""}`);
    * build the developer can see, rather than a silent half-adoption they cannot.
    */
   writeModuleBaseline(ctx, oxlint, env) {
-    const configPath = join16(ctx.cwd, LINT_CONFIG_FILE);
-    const baselinePath = join16(ctx.cwd, LINT_BASELINE_FILE);
+    const configPath = join17(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join17(ctx.cwd, LINT_BASELINE_FILE);
     if (!existsSync12(configPath)) return;
     let config;
     try {
       config = parseJsonc(
-        readFileSync13(configPath, "utf8"),
+        readFileSync14(configPath, "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return;
     }
     const current = Array.isArray(config.extends) ? config.extends : [];
-    const measurePath = join16(ctx.cwd, LINT_MEASURE_FILE);
+    const measurePath = join17(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
-      writeFileSync2(
+      writeFileSync3(
         measurePath,
         `${JSON.stringify({ ...config, extends: extendsWithBaseline(current, false) }, null, 2)}
 `
@@ -5173,10 +5547,13 @@ ${result.stderr ?? ""}`);
       );
       return;
     }
-    const holds = holdsFrom(errorCountsByConfigRule(measured.stdout ?? ""));
+    const holds = holdsFrom(
+      errorCountsByConfigRule(measured.stdout ?? ""),
+      governedRules(lintPresetFor(presetVariant(ctx.preset, ctx.cwd)))
+    );
     const next = extendsWithBaseline(current, holds.length > 0);
     if (holds.length > 0) {
-      writeFileSync2(baselinePath, renderBaseline(holds, readOwnPackage().version));
+      writeFileSync3(baselinePath, renderBaseline(holds, readOwnPackage().version));
       process.stderr.write(`  ${palette(process.stderr).warn(describeHolds(holds))}
 `);
     } else {
@@ -5184,12 +5561,12 @@ ${result.stderr ?? ""}`);
     }
     if (next.length !== current.length || next.some((entry, at) => entry !== current[at])) {
       config.extends = next;
-      writeFileSync2(configPath, `${JSON.stringify(config, null, 2)}
+      writeFileSync3(configPath, `${JSON.stringify(config, null, 2)}
 `);
     }
   }
   async run(ctx) {
-    if (!existsSync12(join16(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync12(join17(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -5329,7 +5706,8 @@ ${result.stderr ?? ""}`);
    *    exactly when something is broken.
    *
    * Counted as a SET of rule names, so the baseline re-stating a preset rule at `warn` is
-   * the same rule, not a second one.
+   * the same rule, not a second one. The rule oxlint RUNS (`canonicalRuleName`), so a layer
+   * spelling it `no-unused-vars` beside the preset's `typescript/no-unused-vars` is one rule too.
    */
   presetRuleCount(cwd) {
     const target = this.unresolvedPreset(cwd);
@@ -5337,7 +5715,7 @@ ${result.stderr ?? ""}`);
     let stub;
     try {
       stub = parseJsonc(
-        readFileSync13(join16(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync14(join17(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
@@ -5347,10 +5725,10 @@ ${result.stderr ?? ""}`);
     for (const entry of stub.extends ?? []) {
       try {
         const preset = parseJsonc(
-          readFileSync13(join16(cwd, entry), "utf8"),
+          readFileSync14(join17(cwd, entry), "utf8"),
           entry
         );
-        for (const rule of Object.keys(preset.rules ?? {})) names.add(rule);
+        for (const rule of Object.keys(preset.rules ?? {})) names.add(canonicalRuleName(rule));
       } catch {
         continue;
       }
@@ -5417,14 +5795,14 @@ ${result.stderr ?? ""}`);
     let parsed;
     try {
       parsed = parseJsonc(
-        readFileSync13(join16(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync14(join17(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return void 0;
     }
     const targets2 = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets2.find((target) => !existsSync12(join16(cwd, target)));
+    return targets2.find((target) => !existsSync12(join17(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -5456,8 +5834,8 @@ function registerLint() {
 
 // src/roles/static-analysis/adapters/jscpd/jscpd.adapter.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync18, mkdirSync as mkdirSync2, readFileSync as readFileSync19, unlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync2, readFileSync as readFileSync20, unlinkSync, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join27 } from "node:path";
 import { globSync as globSync5 } from "tinyglobby";
 
 // src/roles/static-analysis/bundle/budgets.ts
@@ -5486,21 +5864,21 @@ function bandFor(valueKb, referenceKb) {
 }
 
 // src/roles/static-analysis/bundle/scan.ts
-import { existsSync as existsSync14, readFileSync as readFileSync15 } from "node:fs";
-import { basename, join as join18 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync16 } from "node:fs";
+import { basename, join as join19 } from "node:path";
 import { pathToFileURL } from "node:url";
 import { gzipSync } from "node:zlib";
 import { globSync as globSync2 } from "tinyglobby";
 
 // src/roles/static-analysis/bundle/find-build.ts
-import { existsSync as existsSync13, readFileSync as readFileSync14, statSync as statSync4 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync15, statSync as statSync4 } from "node:fs";
+import { join as join18 } from "node:path";
 import { globSync } from "tinyglobby";
 var MANIFEST_GLOB = "server/_tanstack-start-manifest*.mjs";
 function candidateDirs(cwd) {
   const declared = readProjectPackageJson(cwd).nx?.targets?.build?.["outputs"];
-  const fromDeclaration = Array.isArray(declared) ? declared.filter((token) => typeof token === "string").map((token) => join17(cwd, token.replace(/^\{projectRoot\}\//, ""))) : [];
-  return [...fromDeclaration, join17(cwd, ".output"), join17(cwd, "dist"), join17(cwd, "build")];
+  const fromDeclaration = Array.isArray(declared) ? declared.filter((token) => typeof token === "string").map((token) => join18(cwd, token.replace(/^\{projectRoot\}\//, ""))) : [];
+  return [...fromDeclaration, join18(cwd, ".output"), join18(cwd, "dist"), join18(cwd, "build")];
 }
 function findBuildOutput(cwd) {
   const lookedIn = [];
@@ -5510,7 +5888,7 @@ function findBuildOutput(cwd) {
     const found = globSync(MANIFEST_GLOB, { cwd: dir, absolute: true, dot: false });
     if (found.length === 0) continue;
     const manifestPath = found[0];
-    const publicDir = join17(dir, "public");
+    const publicDir = join18(dir, "public");
     if (!existsSync13(publicDir)) continue;
     return { manifestPath, publicDir, ...dateOf(dir, manifestPath) };
   }
@@ -5533,10 +5911,10 @@ function findBuildOutput(cwd) {
   };
 }
 function dateOf(dir, manifestPath) {
-  const record = join17(dir, "nitro.json");
+  const record = join18(dir, "nitro.json");
   if (existsSync13(record)) {
     try {
-      const parsed = JSON.parse(readFileSync14(record, "utf8"));
+      const parsed = JSON.parse(readFileSync15(record, "utf8"));
       if (typeof parsed.date === "string") {
         const date = new Date(parsed.date);
         if (!Number.isNaN(date.getTime())) return { builtAt: date, builtAtFrom: "build record" };
@@ -5562,9 +5940,9 @@ function kindOf(path2) {
   return "other";
 }
 function resolveAnnounced(publicDir, announced) {
-  const direct = join18(publicDir, announced);
+  const direct = join19(publicDir, announced);
   if (existsSync14(direct)) return direct;
-  const stripped = join18(publicDir, announced.replace(/^\/[^/]+\//, "/"));
+  const stripped = join19(publicDir, announced.replace(/^\/[^/]+\//, "/"));
   return existsSync14(stripped) ? stripped : void 0;
 }
 function emptyWeight() {
@@ -5601,7 +5979,7 @@ async function scanBundle(cwd) {
         unresolved.push(announced);
         measured.set(announced, void 0);
       } else {
-        const buffer = readFileSync15(path2);
+        const buffer = readFileSync16(path2);
         measured.set(announced, {
           parsed: buffer.length,
           transfer: gzipSync(buffer, { level: 9 }).length
@@ -5688,7 +6066,7 @@ function scanDynamicLayer(publicDir, references) {
   })) {
     const name = basename(path2);
     if (referenced.has(name)) continue;
-    const buffer = readFileSync15(path2);
+    const buffer = readFileSync16(path2);
     const size = { parsed: buffer.length, transfer: gzipSync(buffer, { level: 9 }).length };
     add(all2, size);
     const group = groupOf(name);
@@ -5716,23 +6094,23 @@ function scanDynamicLayer(publicDir, references) {
 }
 
 // src/roles/static-analysis/sources.ts
-import { readFileSync as readFileSync16 } from "node:fs";
-import { join as join21 } from "node:path";
-import { parseSync as parseSync2 } from "oxc-parser";
+import { readFileSync as readFileSync17 } from "node:fs";
+import { join as join22 } from "node:path";
+import { parseSync as parseSync3 } from "oxc-parser";
 import { globSync as globSync3 } from "tinyglobby";
 
 // src/roles/static-analysis/adapters/jscpd/tool-config.ts
-import { existsSync as existsSync16, mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync16, mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 
 // src/roles/static-analysis/configs/resolve.ts
 import { existsSync as existsSync15 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 var STATIC_CONFIG_FILE = "static-analysis.config.mjs";
 async function loadStaticConfig(cwd) {
-  const path2 = join19(cwd, STATIC_CONFIG_FILE);
+  const path2 = join20(cwd, STATIC_CONFIG_FILE);
   if (!existsSync15(path2)) {
     return { config: defineStaticAnalysis(), from: null, unreadable: null };
   }
@@ -5779,7 +6157,7 @@ function exclusions(config, scope = "tests") {
   return [.../* @__PURE__ */ new Set([...config.ignore, ...OWN_ARTEFACTS, ...tests])];
 }
 function measuredRoots(cwd) {
-  return existsSync16(join20(cwd, "src")) ? ["src"] : ["."];
+  return existsSync16(join21(cwd, "src")) ? ["src"] : ["."];
 }
 function fileSettings(config, scope, extraEntries = []) {
   return {
@@ -5809,9 +6187,9 @@ function fileSettings(config, scope, extraEntries = []) {
   };
 }
 function duplicationRun(config, paths, scope) {
-  const dir = mkdtempSync(join20(tmpdir(), "sentinel-static-"));
-  const configPath = join20(dir, "jscpd.json");
-  writeFileSync3(configPath, `${JSON.stringify(fileSettings(config, scope), null, 2)}
+  const dir = mkdtempSync(join21(tmpdir(), "sentinel-static-"));
+  const configPath = join21(dir, "jscpd.json");
+  writeFileSync4(configPath, `${JSON.stringify(fileSettings(config, scope), null, 2)}
 `, "utf8");
   const args = [
     "--config",
@@ -5836,9 +6214,9 @@ function duplicationRun(config, paths, scope) {
   return { args, rawReportDir: dir, dispose: () => rmSync3(dir, { force: true, recursive: true }) };
 }
 function deadCodeRun(config, paths, extraEntries = []) {
-  const dir = mkdtempSync(join20(tmpdir(), "sentinel-static-"));
-  const configPath = join20(dir, "jscpd.json");
-  writeFileSync3(
+  const dir = mkdtempSync(join21(tmpdir(), "sentinel-static-"));
+  const configPath = join21(dir, "jscpd.json");
+  writeFileSync4(
     configPath,
     `${JSON.stringify(fileSettings(config, "dead-code", extraEntries), null, 2)}
 `,
@@ -5889,12 +6267,12 @@ function readParsed(cwd, files, passes) {
 function parsedSource(cwd, path2) {
   let text;
   try {
-    text = readFileSync16(join21(cwd, path2), "utf8");
+    text = readFileSync17(join22(cwd, path2), "utf8");
   } catch {
     return void 0;
   }
   try {
-    const parsed = parseSync2(path2, text);
+    const parsed = parseSync3(path2, text);
     if (parsed.errors.length > 0) return void 0;
     return { path: path2, text, program: parsed.program };
   } catch {
@@ -5903,7 +6281,7 @@ function parsedSource(cwd, path2) {
 }
 
 // src/roles/static-analysis/complexity/cyclomatic.ts
-import { parseSync as parseSync3 } from "oxc-parser";
+import { parseSync as parseSync4 } from "oxc-parser";
 var FUNCTION_NODES = /* @__PURE__ */ new Set([
   "FunctionDeclaration",
   "FunctionExpression",
@@ -6076,13 +6454,13 @@ function unreadableNote(coverage) {
 }
 
 // src/roles/static-analysis/excerpt.ts
-import { readFileSync as readFileSync17 } from "node:fs";
-import { join as join23 } from "node:path";
+import { readFileSync as readFileSync18 } from "node:fs";
+import { join as join24 } from "node:path";
 
 // src/roles/static-analysis/maintainability/size-rules.ts
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 var GAUGE_THRESHOLDS = {
   // McCabe 1976 says 10, our p90 says 11. The only indicator where two independent candidates agree
   // within one unit, and 94.8% of our functions already sit in the 1-10 band SEI calls low risk.
@@ -6111,7 +6489,7 @@ var GAUGE_THRESHOLDS = {
   "cognitive-complexity": 7
 };
 var COGNITIVE = "cognitive-complexity";
-var cognitivePlugin = () => join22(ownPackageDir(), "plugins", "sonar-cognitive.js");
+var cognitivePlugin = () => join23(ownPackageDir(), "plugins", "sonar-cognitive.js");
 var CATEGORIES = [
   "correctness",
   "suspicious",
@@ -6143,9 +6521,9 @@ function sizeRulesConfig() {
   };
 }
 function sizeRulesRun(paths, ignore) {
-  const dir = mkdtempSync2(join22(tmpdir2(), "sentinel-size-"));
-  const configPath = join22(dir, "oxlintrc.json");
-  writeFileSync4(configPath, `${JSON.stringify(sizeRulesConfig(), null, 2)}
+  const dir = mkdtempSync2(join23(tmpdir2(), "sentinel-size-"));
+  const configPath = join23(dir, "oxlintrc.json");
+  writeFileSync5(configPath, `${JSON.stringify(sizeRulesConfig(), null, 2)}
 `, "utf8");
   return {
     // `--format json` because the console shape is rendered by this role from the figures: a
@@ -7602,7 +7980,7 @@ function linesOf(cache, cwd, relative5) {
   if (cache.has(relative5)) return cache.get(relative5);
   let lines;
   try {
-    lines = readFileSync17(join23(cwd, relative5), "utf8").split("\n");
+    lines = readFileSync18(join24(cwd, relative5), "utf8").split("\n");
   } catch {
     lines = void 0;
   }
@@ -7834,7 +8212,7 @@ var SCRIPT = `(function(){
 })();`;
 
 // src/roles/static-analysis/graph/imports.ts
-import { dirname, join as join24 } from "node:path";
+import { dirname, join as join25 } from "node:path";
 var TS_BEHIND_JS = {
   ".js": [".ts", ".tsx"],
   ".mjs": [".mts"],
@@ -7887,7 +8265,7 @@ function specifiersOf(program) {
 }
 function resolveSpecifier(from, specifier, known) {
   if (!specifier.startsWith(".")) return void 0;
-  const base = join24(dirname(from), specifier);
+  const base = join25(dirname(from), specifier);
   if (known.has(base)) return base;
   for (const extension of RESOLVABLE_EXTENSIONS) {
     if (known.has(base + extension)) return base + extension;
@@ -7898,7 +8276,7 @@ function resolveSpecifier(from, specifier, known) {
     if (known.has(swapped)) return swapped;
   }
   for (const extension of RESOLVABLE_EXTENSIONS) {
-    const index = join24(base, `index${extension}`);
+    const index = join25(base, `index${extension}`);
     if (known.has(index)) return index;
   }
   return void 0;
@@ -8011,26 +8389,26 @@ function scanSyntax(cwd, config) {
 
 // src/roles/static-analysis/workspace/consumers.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync17, mkdirSync, readFileSync as readFileSync18, statSync as statSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname2, join as join25, relative as relative4, resolve as resolve3, sep } from "node:path";
-var CACHE_DIR = join25("node_modules", ".cache", "sentinel");
+import { existsSync as existsSync17, mkdirSync, readFileSync as readFileSync19, statSync as statSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname2, join as join26, relative as relative4, resolve as resolve3, sep } from "node:path";
+var CACHE_DIR = join26("node_modules", ".cache", "sentinel");
 var CACHE_FILE = "consumer-index.json";
 var SHAPE = 4;
 function workspaceRootFrom(cwd) {
   let dir = resolve3(cwd);
   for (; ; ) {
-    if (existsSync17(join25(dir, WORKSPACE_ROOT_MARKER))) return dir;
+    if (existsSync17(join26(dir, WORKSPACE_ROOT_MARKER))) return dir;
     const parent = dirname2(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function aliasTable(workspaceRoot) {
-  const file = join25(workspaceRoot, "tsconfig.base.json");
+  const file = join26(workspaceRoot, "tsconfig.base.json");
   if (!existsSync17(file)) return /* @__PURE__ */ new Map();
   let paths;
   try {
-    const parsed = JSON.parse(readFileSync18(file, "utf8"));
+    const parsed = JSON.parse(readFileSync19(file, "utf8"));
     paths = parsed.compilerOptions?.paths ?? {};
   } catch {
     return /* @__PURE__ */ new Map();
@@ -8048,7 +8426,7 @@ function aliasTable(workspaceRoot) {
 function resolveSpecifier2(specifier, table, workspaceRoot) {
   const isFile = (candidate) => {
     try {
-      return statSync5(join25(workspaceRoot, candidate)).isFile();
+      return statSync5(join26(workspaceRoot, candidate)).isFile();
     } catch {
       return false;
     }
@@ -8085,11 +8463,11 @@ function resolveSpecifier2(specifier, table, workspaceRoot) {
   return void 0;
 }
 function resolveRelative(importer, specifier, workspaceRoot) {
-  const base = join25(dirname2(importer), specifier).split(sep).join("/");
+  const base = join26(dirname2(importer), specifier).split(sep).join("/");
   if (base.startsWith("..")) return void 0;
   const isFile = (candidate) => {
     try {
-      return statSync5(join25(workspaceRoot, candidate)).isFile();
+      return statSync5(join26(workspaceRoot, candidate)).isFile();
     } catch {
       return false;
     }
@@ -8187,10 +8565,10 @@ function hash(text) {
 }
 function consumerIndex(workspaceRoot, moduleRoots) {
   const key = cacheKey(workspaceRoot);
-  const file = join25(workspaceRoot, CACHE_DIR, CACHE_FILE);
+  const file = join26(workspaceRoot, CACHE_DIR, CACHE_FILE);
   if (key && existsSync17(file)) {
     try {
-      const cached = JSON.parse(readFileSync18(file, "utf8"));
+      const cached = JSON.parse(readFileSync19(file, "utf8"));
       if (cached.key === key) {
         return {
           imported: new Set(cached.imported),
@@ -8204,14 +8582,14 @@ function consumerIndex(workspaceRoot, moduleRoots) {
   const index = buildConsumerIndex(workspaceRoot, moduleRoots());
   if (key) {
     try {
-      mkdirSync(join25(workspaceRoot, CACHE_DIR), { recursive: true });
+      mkdirSync(join26(workspaceRoot, CACHE_DIR), { recursive: true });
       const payload = {
         key,
         imported: [...index.imported],
         testOnly: [...index.testOnly],
         builtFrom: index.builtFrom
       };
-      writeFileSync5(file, JSON.stringify(payload), "utf8");
+      writeFileSync6(file, JSON.stringify(payload), "utf8");
     } catch {
     }
   }
@@ -8308,7 +8686,7 @@ var JscpdAdapter = class extends BaseAdapter {
       operations: [
         // `write` and not `merge-json`: this file is code, and the engine's in-place merge is for
         // JSON. A re-init therefore RESTORES the stub, so an existing one is left alone below.
-        ...existsSync18(join26(context2.cwd, STATIC_CONFIG_FILE)) ? [] : [{ kind: "write", path: STATIC_CONFIG_FILE, contents: configStub() }],
+        ...existsSync18(join27(context2.cwd, STATIC_CONFIG_FILE)) ? [] : [{ kind: "write", path: STATIC_CONFIG_FILE, contents: configStub() }],
         manifestOperation(context2.cwd, scripts()),
         ...nxTargetOperations({ cwd: context2.cwd, targets: targets() })
         // The report directory is ignored ONCE at the workspace root, by `--init`'s workspace prep,
@@ -8558,7 +8936,7 @@ var JscpdAdapter = class extends BaseAdapter {
     const declared = moduleScripts(ctx.cwd);
     const missing = Object.keys(scripts()).filter((name) => !(name in declared));
     const adopted = missing.length < Object.keys(scripts()).length;
-    const hasConfig = existsSync18(join26(ctx.cwd, STATIC_CONFIG_FILE));
+    const hasConfig = existsSync18(join27(ctx.cwd, STATIC_CONFIG_FILE));
     return {
       adopted,
       preset: adopted ? ctx.preset : null,
@@ -8650,7 +9028,7 @@ function runDeadCode(jscpd, config, paths, cwd, extraEntries = []) {
   try {
     const ran = runTool(jscpd, args, cwd, "dead-code");
     if (ran.kind !== "ran") return ran;
-    const path2 = join26(rawReportDir, RAW_REPORT["dead-code"]);
+    const path2 = join27(rawReportDir, RAW_REPORT["dead-code"]);
     if (!existsSync18(path2)) {
       process.stderr.write(
         `sentinel static-analysis(jscpd): the dead-code pass wrote no ${RAW_REPORT["dead-code"]}
@@ -8658,7 +9036,7 @@ function runDeadCode(jscpd, config, paths, cwd, extraEntries = []) {
       );
       return { kind: "failed", code: 1 };
     }
-    const parsed = safeParseDeadCode(readFileSync19(path2, "utf8"));
+    const parsed = safeParseDeadCode(readFileSync20(path2, "utf8"));
     const statistics = parsed?.statistics;
     if (!statistics) {
       process.stderr.write(
@@ -8681,11 +9059,11 @@ function runDeadCode(jscpd, config, paths, cwd, extraEntries = []) {
   }
 }
 function moduleRelative(name, roots, cwd) {
-  if (existsSync18(join26(cwd, name))) return name;
+  if (existsSync18(join27(cwd, name))) return name;
   for (const root of roots) {
     if (root === ".") continue;
     const candidate = `${root}/${name}`;
-    if (existsSync18(join26(cwd, candidate))) return candidate;
+    if (existsSync18(join27(cwd, candidate))) return candidate;
   }
   return name;
 }
@@ -8694,8 +9072,8 @@ function runDuplication(jscpd, config, paths, scope, cwd) {
   try {
     const ran = runTool(jscpd, args, cwd, scope);
     if (ran.kind !== "ran") return ran;
-    const path2 = join26(rawReportDir, RAW_REPORT.duplication);
-    const parsed = existsSync18(path2) ? safeParse(readFileSync19(path2, "utf8")) : void 0;
+    const path2 = join27(rawReportDir, RAW_REPORT.duplication);
+    const parsed = existsSync18(path2) ? safeParse(readFileSync20(path2, "utf8")) : void 0;
     const total = parsed?.statistics?.total;
     if (!total) {
       process.stderr.write(
@@ -8864,7 +9242,7 @@ function outsideOf(cwd) {
 function moduleRootsOf(workspaceRoot) {
   const roots = [];
   for (const area of ["apps", "libs"]) {
-    const base = join26(workspaceRoot, area);
+    const base = join27(workspaceRoot, area);
     if (!existsSync18(base)) continue;
     for (const entry of globSync5([`${area}/**/package.json`, `${area}/**/project.json`], {
       cwd: workspaceRoot,
@@ -9207,7 +9585,7 @@ var PICTURE_FILE = `${TARGET}-graph.svg`;
 function clearStaleOutputs(cwd, keeping) {
   for (const name of [...Object.values(SHAPE_FILE), PICTURE_FILE]) {
     if (keeping.has(name)) continue;
-    const path2 = join26(cwd, REPORT_DIR, name);
+    const path2 = join27(cwd, REPORT_DIR, name);
     if (existsSync18(path2)) unlinkSync(path2);
   }
 }
@@ -9226,11 +9604,11 @@ function drawsPicture(graph, coverage) {
 async function emit(report, shape, cwd, graph, coverage) {
   if (shape === "console") return [];
   const detailed = shape === "markdown" ? report : withExcerpts(report, cwd);
-  mkdirSync2(join26(cwd, REPORT_DIR), { recursive: true });
+  mkdirSync2(join27(cwd, REPORT_DIR), { recursive: true });
   const written = [];
   if (shape === "html" && drawsPicture(graph, coverage)) {
     const drawn = layOut(graph.graph, graph.communityOf);
-    const path2 = join26(cwd, REPORT_DIR, PICTURE_FILE);
+    const path2 = join27(cwd, REPORT_DIR, PICTURE_FILE);
     await writeGraphPicture(drawn, path2);
     written.push(`${REPORT_DIR}/${PICTURE_FILE}`);
     detailed.picture = buildExplorer(drawn, graph.communityOf).markup;
@@ -9238,7 +9616,7 @@ async function emit(report, shape, cwd, graph, coverage) {
   const RENDER = { json: renderJson, html: renderHtml, markdown: renderMarkdown };
   const name = SHAPE_FILE[shape] ?? `${TARGET}.${shape}`;
   const body = RENDER[shape](detailed);
-  writeFileSync6(join26(cwd, REPORT_DIR, name), body, "utf8");
+  writeFileSync7(join27(cwd, REPORT_DIR, name), body, "utf8");
   written.unshift(`${REPORT_DIR}/${name}`);
   return written;
 }
@@ -9272,9 +9650,9 @@ function registerTest() {
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync19, readFileSync as readFileSync21 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync22 } from "node:fs";
 import { createRequire } from "node:module";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -9459,8 +9837,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync20 } from "node:fs";
-import { join as join27 } from "node:path";
+import { readFileSync as readFileSync21 } from "node:fs";
+import { join as join28 } from "node:path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -9553,7 +9931,7 @@ function planAdoption(context2) {
     };
   }
   const existing = parseJsonc(
-    readFileSync20(join27(context2.cwd, target.path), "utf8"),
+    readFileSync21(join28(context2.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -9691,7 +10069,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync21(join28(cwd, target.path), "utf8"),
+        readFileSync22(join29(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -9704,7 +10082,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire(join28(cwd, "noop.js")).resolve(preset);
+      createRequire(join29(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -9800,7 +10178,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync21(join28(cwd, config), "utf8"),
+        readFileSync22(join29(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path2) => typeof path2 === "string" && path2.length > 0);
@@ -9816,7 +10194,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync19(join28(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync19(join29(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -10022,7 +10400,7 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync20, readFileSync as readFileSync22, renameSync, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync23, renameSync, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
 import { resolve as resolve4, sep as sep2 } from "node:path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 function resolveWithinRoot(cwd, relativePath) {
@@ -10034,7 +10412,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync20(absolutePath) ? readFileSync22(absolutePath, "utf8") : void 0;
+  return existsSync20(absolutePath) ? readFileSync23(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -10136,7 +10514,7 @@ function preparePlan(cwd, plan3) {
 }
 function writeFileAtomic(absolutePath, contents) {
   const tempPath = `${absolutePath}.sentinel-${process.pid}.tmp`;
-  writeFileSync7(tempPath, contents);
+  writeFileSync8(tempPath, contents);
   renameSync(tempPath, absolutePath);
 }
 function applyPlan(cwd, plan3) {
@@ -10152,8 +10530,8 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync21, readdirSync as readdirSync3, readFileSync as readFileSync23 } from "node:fs";
-import { join as join29 } from "node:path";
+import { existsSync as existsSync21, readdirSync as readdirSync3, readFileSync as readFileSync24 } from "node:fs";
+import { join as join30 } from "node:path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -10187,12 +10565,12 @@ function sourceImports(cwd, pattern) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!NOT_SCANNED.has(entry.name)) stack.push(join29(dir, entry.name));
+        if (!NOT_SCANNED.has(entry.name)) stack.push(join30(dir, entry.name));
         continue;
       }
       if (!SOURCE_FILE.test(entry.name)) continue;
       try {
-        if (pattern.test(readFileSync23(join29(dir, entry.name), "utf8"))) return true;
+        if (pattern.test(readFileSync24(join30(dir, entry.name), "utf8"))) return true;
       } catch {
         continue;
       }
@@ -10201,11 +10579,11 @@ function sourceImports(cwd, pattern) {
   return false;
 }
 function dependencyNames(cwd) {
-  const path2 = join29(cwd, "package.json");
+  const path2 = join30(cwd, "package.json");
   if (!existsSync21(path2)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync23(path2, "utf8"),
+      readFileSync24(path2, "utf8"),
       path2
     );
     return [
@@ -10228,7 +10606,7 @@ function reactTsconfigEvidence(cwd) {
   }
   for (const name of entries) {
     try {
-      const config = parseJsonc(readFileSync23(join29(cwd, name), "utf8"), name);
+      const config = parseJsonc(readFileSync24(join30(cwd, name), "utf8"), name);
       if (config.compilerOptions?.jsx !== void 0) return 'its tsconfig sets "jsx"';
       const extended = Array.isArray(config.extends) ? config.extends : config.extends === void 0 ? [] : [config.extends];
       if (extended.some((entry) => entry === REACT_TYPESCRIPT_PRESET)) {
@@ -10329,8 +10707,10 @@ async function dispatch(opts) {
   }
   const detected = resolveFlavour(opts);
   const resolutionPreset = opts.preset ?? declaredPresetFor(opts.target, opts.cwd) ?? detected;
-  if (resolutionPreset === "tools") {
-    const message = `tools modules are not adopted one at a time: they sometimes hold configuration shared with the workspace root, so they move WITH the root, as one reviewed change owned by the tooling team rather than by the module's team.`;
+  const declaredTools = opts.preset === void 0 ? availableTargets().find((target) => declaredPresetFor(target, opts.cwd) === "tools") : void 0;
+  if (resolutionPreset === "tools" || declaredTools !== void 0) {
+    const declaredBy = declaredTools === void 0 || declaredTools === opts.target ? "" : `this module's ${declaredTools} config declares the tools preset, and `;
+    const message = `${declaredBy}tools modules are not adopted one at a time: they sometimes hold configuration shared with the workspace root, so they move WITH the root, as one reviewed change owned by the tooling team rather than by the module's team.`;
     process.stderr.write(`  ${palette(process.stderr).dim(`${opts.target}: ${message}`)}
 `);
     opts.record?.({ role: opts.target, status: "deferred", reason: message });