@hublo/sentinel 1.5.1-alpha.2 → 1.6.0-alpha.0

package/dist/{chunk-JHLNNIZC.js → chunk-PC5R4DX5.js}

@@ -70,6 +70,7 @@ import {
   readProjectPackageJson
 } from "./chunk-JRZI5IIN.js";
 import {
+  DEFAULT_ENV_LEVEL,
   PRESET_NAMES,
   REPORT_DIR,
   SCRIPTS,
@@ -80,7 +81,10 @@ import {
   extensionsOf,
   isPlainObject,
   overridableSettings
-} from "./chunk-WBDBRGLV.js";
+} from "./chunk-7E6YTTAK.js";
+import {
+  defineEnv
+} from "./chunk-NAFI7OLI.js";
 import {
   globToRegExp
 } from "./chunk-O7REVMOC.js";
@@ -171,6 +175,67 @@ function palette(stream) {
   };
 }
 
+// src/roles/env/presets/shared.json
+var shared_default = {
+  readers: {
+    required: ["getOrFail", "requireEnv", "requireEnvVariable"],
+    optional: ["getOrDefault", "getEnvVariableOrDefault"]
+  },
+  scan: {
+    roots: ["."],
+    ext: [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"],
+    excludeSuffixes: [
+      ".spec.ts",
+      ".test.ts",
+      ".spec.tsx",
+      ".test.tsx",
+      ".spec.js",
+      ".test.js",
+      ".spec.jsx",
+      ".test.jsx"
+    ],
+    excludeDirs: ["node_modules", "dist"]
+  },
+  references: {
+    roots: ["."],
+    ext: [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs", ".svelte", ".vue"],
+    excludeSuffixes: [],
+    excludeDirs: ["node_modules", "dist"]
+  },
+  referencePatterns: [
+    "process\\.env\\s*\\.\\s*([A-Za-z0-9_]+)",
+    "process\\.env\\[\\s*['\"`]([^'\"`]+)['\"`]\\s*\\]",
+    "import\\.meta\\.env\\s*\\.\\s*([A-Za-z0-9_]+)",
+    "import\\.meta\\.env\\[\\s*['\"`]([^'\"`]+)['\"`]\\s*\\]",
+    `import\\s*\\{([^}]*)\\}\\s*from\\s*['"]\\$env/static/(?:public|private)['"]`,
+    "\\benv\\.([A-Z][A-Z0-9_]*)",
+    "\\{([^{}]*)\\}\\s*=\\s*env\\b"
+  ],
+  secretNamePatterns: ["SECRET", "TOKEN", "PASSWORD", "PRIVATE_?KEY", "ACCESS_?KEY", "API_?KEY"],
+  publicPrefixes: ["VITE_", "PUBLIC_", "NEXT_PUBLIC_", "REACT_APP_"],
+  envFiles: ["**/.env", "**/.env.*", "**/*.env"],
+  contracts: ["**/*.env*.example"],
+  nodeVersionFile: ".node-version"
+};
+
+// src/roles/env/preset-data.ts
+var data = shared_default;
+var envDefaults = data;
+function referencePatterns() {
+  return data.referencePatterns.map((source) => new RegExp(source, "g"));
+}
+function secretNamePatterns() {
+  return data.secretNamePatterns.map((source) => new RegExp(source, "i"));
+}
+var TARGET2 = "env";
+var ENV_CONFIG_FILE = "env.config.mjs";
+var REPORT_DIR2 = "env-report";
+var ENV_SHAPES = ["console", "json", "markdown"];
+var SHAPE_FILE = {
+  json: "env.json",
+  markdown: "env.md"
+};
+
 // src/roles/build/nest/nx-target.ts
 import { existsSync, readFileSync } from "node:fs";
 import { join, relative } from "node:path";
@@ -1289,15 +1354,1044 @@ function registerBuild() {
   setDefaultRunner("dev", "vite");
 }
 
+// src/roles/env/adapters/conformance/conformance.adapter.ts
+import { existsSync as existsSync7, mkdirSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join10 } from "node:path";
+
+// src/roles/env/collect.ts
+import { dirname, join as join8 } from "node:path/posix";
+
+// src/roles/env/checks.ts
+var READER_VAR_NAME = String.raw`[A-Z0-9_]+`;
+var REFERENCED_NAME = /[A-Za-z_][A-Za-z0-9_]*/g;
+function lineAt(content, index) {
+  let line = 1;
+  for (let position = content.indexOf("\n"); position !== -1 && position < index; ) {
+    line += 1;
+    position = content.indexOf("\n", position + 1);
+  }
+  return line;
+}
+function readerRegex(readerName) {
+  return new RegExp(String.raw`(?<!\w)${readerName}\(\s*[\`'"](${READER_VAR_NAME})[\`'"]`, "g");
+}
+function recordReads(reads, matchers, file) {
+  for (const matcher of matchers) {
+    for (const match of file.content.matchAll(matcher)) {
+      const name = match[1];
+      if (name === void 0) continue;
+      const sites = reads.get(name);
+      if (sites?.some((site2) => site2.path === file.path)) continue;
+      const site = { path: file.path, line: lineAt(file.content, match.index) };
+      if (sites) sites.push(site);
+      else reads.set(name, [site]);
+    }
+  }
+}
+function deriveVars(files, readers) {
+  const requiredMatchers = (readers.required ?? []).map(readerRegex);
+  const optionalMatchers = (readers.optional ?? []).map(readerRegex);
+  const required = /* @__PURE__ */ new Map();
+  const optional = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    recordReads(required, requiredMatchers, file);
+    recordReads(optional, optionalMatchers, file);
+  }
+  return { required, optional };
+}
+var ENV_LINE = /^(?:export\s+)?([\w.-]+)\s*=(.*)$/;
+function isBlankValue(value) {
+  const trimmed = value.trim();
+  const quoted = /^(['"])(.*)\1$/.exec(trimmed);
+  return (quoted ? quoted[2] : trimmed) === "";
+}
+function openQuote(value) {
+  const trimmed = value.trim();
+  const quote = trimmed[0];
+  if (quote !== '"' && quote !== "'" && quote !== "`") return void 0;
+  return trimmed.length > 1 && trimmed.endsWith(quote) ? void 0 : quote;
+}
+function parseEnvFile(content) {
+  const entries = [];
+  const lines = content.split("\n");
+  let closing;
+  for (const [index, rawLine] of lines.entries()) {
+    const line = rawLine.trim();
+    if (closing !== void 0) {
+      if (line.endsWith(closing)) closing = void 0;
+      continue;
+    }
+    if (line === "" || line.startsWith("#")) continue;
+    const match = ENV_LINE.exec(line);
+    if (!match) continue;
+    const value = match[2] ?? "";
+    entries.push({ key: match[1] ?? "", line: index + 1, blank: isBlankValue(value) });
+    closing = openQuote(value);
+  }
+  return {
+    entries,
+    keys: entries.map((entry) => entry.key),
+    blanked: entries.filter((entry) => entry.blank).map((entry) => entry.key),
+    filled: entries.filter((entry) => !entry.blank).map((entry) => entry.key)
+  };
+}
+function diffContract(derived, declared, externallyProvided = []) {
+  const declaredKeys = new Set(declared);
+  const external = new Set(externallyProvided);
+  const unaccounted = [...derived.required.keys()].filter((name) => !declaredKeys.has(name) && !external.has(name)).sort();
+  const optionalUndeclared = [...derived.optional.keys()].filter((name) => !declaredKeys.has(name)).sort();
+  return { unaccounted, optionalUndeclared };
+}
+function findOrphanEnvFiles(envFiles, allow = []) {
+  const allowed = new Set(allow);
+  return envFiles.filter((path2) => !path2.endsWith(".example") && !allowed.has(path2)).sort();
+}
+function* referencedNames(content, patterns) {
+  for (const pattern of patterns) {
+    for (const match of content.matchAll(pattern)) {
+      for (const [name] of (match[1] ?? "").matchAll(REFERENCED_NAME)) yield name;
+    }
+  }
+}
+function findReferencedVars(files, patterns) {
+  const referenced = /* @__PURE__ */ new Map();
+  for (const { path: path2, content } of files) {
+    for (const name of referencedNames(content, patterns)) {
+      const readers = referenced.get(name) ?? /* @__PURE__ */ new Set();
+      readers.add(path2);
+      referenced.set(name, readers);
+    }
+  }
+  return referenced;
+}
+function findDeadVars(declaredKeys, referenced, allow = [], allowPatterns = []) {
+  const alive = new Set(referenced);
+  const allowed = new Set(allow);
+  const isExternal = (key) => allowed.has(key) || allowPatterns.some((pattern) => pattern.test(key));
+  return [...new Set(declaredKeys)].filter((key) => !alive.has(key) && !isExternal(key)).sort();
+}
+function auditEnvFileSecrets(parsed, options) {
+  const secretFilled = parsed.entries.filter(
+    (entry) => !entry.blank && options.secretPatterns.some((pattern) => pattern.test(entry.key))
+  );
+  const isPublic = (entry) => options.publicPrefixes.some((prefix) => entry.key.startsWith(prefix));
+  return {
+    mustBlank: secretFilled.filter((entry) => !isPublic(entry)),
+    publicSecrets: secretFilled.filter(isPublic)
+  };
+}
+function splitAllowlisted(locations, allowlist) {
+  const allow = new Set(allowlist);
+  const allowed = [];
+  const flagged = [];
+  for (const location of locations) (allow.has(location) ? allowed : flagged).push(location);
+  return { allowed, flagged };
+}
+function isDockerfilePath(path2) {
+  const name = path2.slice(path2.lastIndexOf("/") + 1);
+  if (name.endsWith(".dockerignore") || name.endsWith(".md")) return false;
+  return name === "dockerfile" || /^Dockerfile([.-][^/]+)?$/.test(name) || /\.[Dd]ockerfile$/.test(name);
+}
+function copySources(line) {
+  const words = line.split(/\s+/).slice(1);
+  const flags = words.findIndex((word) => !word.startsWith("--"));
+  const rest = flags === -1 ? "" : words.slice(flags).join(" ");
+  if (rest.startsWith("<<")) return [];
+  if (rest.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(rest);
+      if (Array.isArray(parsed) && parsed.every((entry) => typeof entry === "string")) {
+        return parsed.slice(0, -1);
+      }
+    } catch {
+    }
+  }
+  return words.slice(flags === -1 ? words.length : flags).slice(0, -1).map((word) => /^(['"])(.*)\1$/.exec(word)?.[2] ?? word);
+}
+function parseDockerfile(content) {
+  const froms = [];
+  const contextCopySources = [];
+  for (const [index, rawLine] of content.split("\n").entries()) {
+    const line = rawLine.trim();
+    const from = /^FROM\s+(\S+)/i.exec(line);
+    if (from) {
+      froms.push({ image: from[1] ?? "", line: index + 1 });
+      continue;
+    }
+    if (/^COPY\s/i.test(line) && !/--from=/i.test(line)) {
+      for (const source of copySources(line)) {
+        if (!/[*?$]/.test(source)) contextCopySources.push({ source, line: index + 1 });
+      }
+    }
+  }
+  return { froms, contextCopySources };
+}
+function dockerNodeVersion(fromImage) {
+  const match = /(?:^|\/)node:([0-9]+(?:\.[0-9]+){0,2})/.exec(fromImage);
+  return match?.[1] ?? null;
+}
+function normalizeNodeVersion(raw) {
+  const version = raw.trim().replace(/^v/i, "");
+  return version === "" ? void 0 : version;
+}
+function nodeVersionAligned(dockerVersion, expected) {
+  return expected === dockerVersion || expected.startsWith(`${dockerVersion}.`);
+}
+function dockerHardening(content) {
+  const lines = content.split("\n").map((line) => line.trim());
+  let lastFrom = -1;
+  lines.forEach((line, index) => {
+    if (/^FROM\s/i.test(line)) lastFrom = index;
+  });
+  const start = lastFrom === -1 ? 0 : lastFrom;
+  const finalStage = lines.slice(start).map((text, offset) => ({ text, line: start + offset + 1 }));
+  let user = null;
+  let userLine = start + 1;
+  for (const { text, line } of finalStage) {
+    const match = /^USER\s+(\S+)/i.exec(text);
+    if (match) {
+      user = match[1] ?? null;
+      userLine = line;
+    }
+  }
+  const runsAsRoot = !user || /^(root|0)(:|$)/i.test(user);
+  const ownsTree = finalStage.some(({ text }) => /chown\s+-R/i.test(text));
+  const copiesWithoutChown = ownsTree ? [] : finalStage.filter(({ text }) => /^COPY\s/i.test(text) && !/--chown=/i.test(text)).map(({ text, line }) => ({ instruction: text.replace(/\s+/g, " "), line }));
+  return { user, userLine, runsAsRoot, copiesWithoutChown };
+}
+function parseNxTargetRefs(content) {
+  return [...content.matchAll(/\bnx run\s+([^\s:$]+):([^\s$]+)/g)].map((match) => ({
+    project: match[1] ?? "",
+    targetSpec: match[2] ?? "",
+    line: lineAt(content, match.index)
+  }));
+}
+function nxTargetCandidates(targetSpec) {
+  const parts = targetSpec.split(":");
+  const candidates = [targetSpec];
+  if (parts.length > 1) candidates.push(parts.slice(0, -1).join(":"));
+  return candidates;
+}
+function resolveApp(path2, projects) {
+  let best = null;
+  for (const project of projects) {
+    if (path2 === project.root || path2.startsWith(`${project.root}/`)) {
+      if (!best || project.root.length > best.root.length) best = project;
+    }
+  }
+  return best ? best.name : null;
+}
+
+// src/roles/env/repository.ts
+import { execFileSync } from "node:child_process";
+import { readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
+import { join as join7 } from "node:path";
+var MAX_BUFFER = 256 * 1024 * 1024;
+function trackedPaths(root) {
+  const output = execFileSync("git", ["ls-files", "-z"], {
+    cwd: root,
+    encoding: "utf8",
+    maxBuffer: MAX_BUFFER
+  });
+  return output.split("\0").filter(Boolean);
+}
+function loadNxTargets(root) {
+  const nx = resolveBin(root, "nx");
+  if (nx === void 0) return void 0;
+  const runNx = (args) => execFileSync(nx, args, {
+    cwd: root,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    maxBuffer: MAX_BUFFER,
+    env: { ...process.env, NX_DAEMON: "false" }
+  });
+  try {
+    const projects = new Set(JSON.parse(runNx(["show", "projects", "--json"])));
+    const cache = /* @__PURE__ */ new Map();
+    return (project) => {
+      if (!projects.has(project)) return null;
+      const known = cache.get(project);
+      if (known) return known;
+      const data2 = JSON.parse(runNx(["show", "project", project, "--json"]));
+      const targets2 = new Set(Object.keys(data2.targets ?? {}));
+      cache.set(project, targets2);
+      return targets2;
+    };
+  } catch {
+    return void 0;
+  }
+}
+function openRepository(root) {
+  let tracked;
+  try {
+    tracked = trackedPaths(root);
+  } catch (error) {
+    throw new Error(
+      `git could not list the tracked files of ${root}: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
+  }
+  let nx = null;
+  const hasNx = tracked.includes("nx.json");
+  return {
+    root,
+    tracked,
+    read(path2) {
+      try {
+        return readFileSync6(join7(root, path2), "utf8");
+      } catch {
+        return void 0;
+      }
+    },
+    exists(path2) {
+      try {
+        statSync2(join7(root, path2));
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    hasNx,
+    nxTargets() {
+      if (nx === null) nx = hasNx ? loadNxTargets(root) : void 0;
+      return nx;
+    }
+  };
+}
+function loadProjects(view) {
+  const byRoot = /* @__PURE__ */ new Map();
+  for (const file of view.tracked) {
+    const manifest = /(?:^|\/)(project|package)\.json$/.exec(file);
+    if (!manifest) continue;
+    const slash = file.lastIndexOf("/");
+    if (slash === -1) continue;
+    const root = file.slice(0, slash);
+    const fromProjectJson = manifest[1] === "project";
+    const existing = byRoot.get(root);
+    if (existing && !(fromProjectJson && !existing.fromProjectJson)) continue;
+    try {
+      const name = JSON.parse(view.read(file) ?? "").name;
+      if (typeof name === "string" && name !== "") byRoot.set(root, { name, fromProjectJson });
+    } catch {
+    }
+  }
+  return [...byRoot].map(([root, { name }]) => ({ root, name }));
+}
+
+// src/roles/env/collect.ts
+var RULES = {
+  "required-var-undeclared": {
+    number: 1,
+    severity: "blocking",
+    help: "read by a required reader but declared in no contract: add it to the right .env*.example, or to externallyProvided if CI or a secret store provides it"
+  },
+  "optional-var-undeclared": {
+    number: 1,
+    severity: "info",
+    help: "read by an optional reader and declared in no contract; a default applies"
+  },
+  "committed-env-file": {
+    number: 2,
+    severity: "blocking",
+    help: "a real env file is committed: remove it from git (only .example contracts belong there; values come from a secret store)"
+  },
+  "var-not-in-app-contract": {
+    number: 3,
+    severity: "advisory",
+    help: "read in this app but declared only in another app's contract: declare it in this app's own contract, or in a shared root one"
+  },
+  "dead-var": {
+    number: 4,
+    severity: "advisory",
+    help: "declared but read nowhere in source: a candidate to remove, or add it to knownExternalVars if a tool or CI consumes it"
+  },
+  "public-secret-to-review": {
+    number: 5,
+    severity: "advisory",
+    help: "a public-prefixed, secret-named variable carries a committed value: it ships to the browser by design, confirm it is genuinely public"
+  },
+  "secret-not-blanked": {
+    number: 6,
+    severity: "blocking",
+    help: "a secret-named variable carries a committed value: blank it (leave the value empty) and move the value to a secret store"
+  },
+  "secret-allowlisted": {
+    number: 6,
+    severity: "advisory",
+    help: "a secret-named variable carries a committed value, accepted by allowNonBlankedSecrets: confirm it stays non-secret"
+  },
+  "dead-copy-path": {
+    number: 7,
+    severity: "blocking",
+    help: "this COPY source does not exist: remove the line or fix the path"
+  },
+  "nx-project-missing": {
+    number: 8,
+    severity: "blocking",
+    help: "this Dockerfile runs an nx project that does not exist: fix or remove the reference"
+  },
+  "nx-target-missing": {
+    number: 8,
+    severity: "blocking",
+    help: "this Dockerfile runs an nx target the project does not have: fix or remove the reference"
+  },
+  "node-version-mismatch": {
+    number: 9,
+    severity: "blocking",
+    help: "the FROM node version differs from .node-version: align the tag"
+  },
+  "dockerfile-runs-as-root": {
+    number: 10,
+    severity: "blocking",
+    help: "the final stage runs as root: set a non-root USER (USER node, or USER 1000:1000) so a compromise cannot tamper with the running image"
+  },
+  "copy-not-owned": {
+    number: 10,
+    severity: "blocking",
+    help: "this COPY into the runtime stage has no --chown, so it lands root-owned under a non-root USER: add --chown (node:node, or 1000:1000 with --link) or a RUN chown -R"
+  }
+};
+var RULE_ORDER = Object.keys(RULES);
+function inScope(path2, scope) {
+  const underRoot = scope.roots.some((root) => {
+    const cleaned = root.replace(/^\.\//, "").replace(/\/+$/, "");
+    return cleaned === "." || cleaned === "" || path2.startsWith(`${cleaned}/`);
+  });
+  if (!underRoot) return false;
+  const segments = path2.split("/");
+  const name = segments.pop() ?? "";
+  if (segments.some((segment) => scope.excludeDirs.includes(segment))) return false;
+  return scope.ext.some((suffix) => name.endsWith(suffix)) && !scope.excludeSuffixes.some((suffix) => name.endsWith(suffix));
+}
+function* sourcesOf(view, scope) {
+  for (const path2 of view.tracked) {
+    if (!inScope(path2, scope)) continue;
+    const content = view.read(path2);
+    if (content !== void 0) yield { path: path2, content };
+  }
+}
+function missingRoots(view, settings) {
+  const roots = [...settings.scan.roots, ...settings.references.roots];
+  return [
+    ...new Set(
+      roots.filter((root) => {
+        const cleaned = root.replace(/^\.\//, "").replace(/\/+$/, "");
+        if (cleaned === "." || cleaned === "") return false;
+        return !view.tracked.some((path2) => path2.startsWith(`${cleaned}/`));
+      })
+    )
+  ];
+}
+function finding(rule, fields) {
+  const { name, file, line, detail, readIn, app } = fields;
+  return {
+    rule,
+    number: RULES[rule].number,
+    severity: RULES[rule].severity,
+    name,
+    ...file === void 0 ? {} : { file },
+    ...line === void 0 ? {} : { line },
+    ...detail === void 0 ? {} : { detail },
+    ...readIn === void 0 ? {} : { readIn },
+    ...app === void 0 ? {} : { app }
+  };
+}
+function byReportOrder(left, right) {
+  return RULE_ORDER.indexOf(left.rule) - RULE_ORDER.indexOf(right.rule) || (left.file ?? "").localeCompare(right.file ?? "") || (left.line ?? 0) - (right.line ?? 0) || left.name.localeCompare(right.name);
+}
+function readEnvFiles(view, settings) {
+  const envGlobs = settings.envFiles.map(globToRegExp);
+  const contractGlobs = settings.contracts.map(globToRegExp);
+  const envFiles = view.tracked.filter((path2) => envGlobs.some((glob) => glob.test(path2)));
+  const contracts = view.tracked.filter((path2) => contractGlobs.some((glob) => glob.test(path2)));
+  const parsed = /* @__PURE__ */ new Map();
+  for (const path2 of /* @__PURE__ */ new Set([...envFiles, ...contracts])) {
+    const content = view.read(path2);
+    if (content !== void 0) parsed.set(path2, parseEnvFile(content));
+  }
+  return { envFiles, contracts, parsed };
+}
+function secretFindings(parsed, settings) {
+  const options = {
+    secretPatterns: settings.secretNamePatterns,
+    publicPrefixes: settings.publicPrefixes
+  };
+  const findings = [];
+  const mustBlank = /* @__PURE__ */ new Map();
+  for (const [file, content] of parsed) {
+    const audit = auditEnvFileSecrets(content, options);
+    for (const entry of audit.publicSecrets) {
+      findings.push(finding("public-secret-to-review", { name: entry.key, file, line: entry.line }));
+    }
+    for (const entry of audit.mustBlank) {
+      mustBlank.set(`${file}:${entry.key}`, { file, line: entry.line, name: entry.key });
+    }
+  }
+  const { allowed, flagged } = splitAllowlisted(
+    [...mustBlank.keys()],
+    settings.allowNonBlankedSecrets
+  );
+  for (const location of flagged) {
+    const entry = mustBlank.get(location);
+    if (entry) findings.push(finding("secret-not-blanked", entry));
+  }
+  for (const location of allowed) {
+    const entry = mustBlank.get(location);
+    if (entry) findings.push(finding("secret-allowlisted", entry));
+  }
+  return findings;
+}
+function allReadNames(derived, referenced) {
+  return /* @__PURE__ */ new Set([...referenced.keys(), ...derived.required.keys(), ...derived.optional.keys()]);
+}
+function misplacedFindings(view, settings, derived, referenced, contracts, declared) {
+  const projects = loadProjects(view);
+  const readsByApp = /* @__PURE__ */ new Map();
+  const addRead = (name, path2) => {
+    const app = resolveApp(path2, projects);
+    if (!app) return;
+    const reads = readsByApp.get(app) ?? /* @__PURE__ */ new Map();
+    if (!reads.has(name)) reads.set(name, path2);
+    readsByApp.set(app, reads);
+  };
+  for (const [name, sites] of derived.required) for (const site of sites) addRead(name, site.path);
+  for (const [name, paths] of referenced) for (const path2 of paths) addRead(name, path2);
+  const shared = /* @__PURE__ */ new Set();
+  const keysByApp = /* @__PURE__ */ new Map();
+  for (const { path: path2, parsed } of contracts) {
+    const app = resolveApp(path2, projects);
+    const keys = app === null ? shared : keysByApp.get(app) ?? /* @__PURE__ */ new Set();
+    for (const key of parsed.keys) keys.add(key);
+    if (app !== null) keysByApp.set(app, keys);
+  }
+  const external = new Set(settings.externallyProvided);
+  const findings = [];
+  for (const [app, reads] of readsByApp) {
+    const own = keysByApp.get(app);
+    if (!own) continue;
+    for (const [name, path2] of reads) {
+      if (declared.has(name) && !own.has(name) && !shared.has(name) && !external.has(name)) {
+        findings.push(
+          finding("var-not-in-app-contract", {
+            name,
+            file: path2,
+            app,
+            detail: `read in ${app}`
+          })
+        );
+      }
+    }
+  }
+  return findings;
+}
+function codeFindings(view, settings, contracts) {
+  const derived = deriveVars(sourcesOf(view, settings.scan), settings.readers);
+  const inventory = {
+    required: [...derived.required].map(([name, sites]) => ({ name, files: sites.length })).sort((left, right) => left.name.localeCompare(right.name)),
+    optional: [...derived.optional.keys()].sort(),
+    contracts: contracts.map(({ path: path2, parsed }) => ({ path: path2, keys: parsed.keys.length }))
+  };
+  const counts = { required: derived.required.size, optional: derived.optional.size };
+  if (contracts.length === 0) return { findings: [], inventory, counts, compared: false };
+  const declaredAt = /* @__PURE__ */ new Map();
+  for (const { path: path2, parsed } of contracts) {
+    for (const entry of parsed.entries) {
+      if (!declaredAt.has(entry.key)) declaredAt.set(entry.key, { file: path2, line: entry.line });
+    }
+  }
+  const declared = new Set(declaredAt.keys());
+  const { unaccounted, optionalUndeclared } = diffContract(
+    derived,
+    declared,
+    settings.externallyProvided
+  );
+  const referenced = findReferencedVars(
+    sourcesOf(view, settings.references),
+    settings.referencePatterns
+  );
+  const dead = findDeadVars(
+    declared,
+    allReadNames(derived, referenced),
+    settings.knownExternalVars,
+    settings.knownExternalPatterns
+  );
+  const findings = [
+    ...unaccounted.map((name) => {
+      const sites = derived.required.get(name) ?? [];
+      return finding("required-var-undeclared", {
+        name,
+        file: sites[0]?.path,
+        line: sites[0]?.line,
+        readIn: sites.map((site) => site.path)
+      });
+    }),
+    ...misplacedFindings(view, settings, derived, referenced, contracts, declared),
+    ...dead.map((name) => finding("dead-var", { name, ...declaredAt.get(name) })),
+    ...optionalUndeclared.map((name) => {
+      const site = derived.optional.get(name)?.[0];
+      return finding("optional-var-undeclared", { name, file: site?.path, line: site?.line });
+    })
+  ];
+  return { findings, inventory, counts, compared: true };
+}
+function dockerFindings(view, settings) {
+  const excluded = (path2) => settings.docker.excludePaths.some((prefix) => path2.startsWith(prefix));
+  const dockerfiles = view.tracked.filter((path2) => isDockerfilePath(path2) && !excluded(path2));
+  const rawNodeVersion = view.read(settings.nodeVersionFile);
+  const expected = rawNodeVersion === void 0 ? void 0 : normalizeNodeVersion(rawNodeVersion);
+  const findings = [];
+  const notes = [];
+  let uncheckedNxRefs = 0;
+  let nxUnavailable = false;
+  for (const file of dockerfiles) {
+    const content = view.read(file);
+    if (content === void 0) continue;
+    const { froms, contextCopySources } = parseDockerfile(content);
+    for (const { image, line } of froms) {
+      const version = dockerNodeVersion(image);
+      if (version && expected && !nodeVersionAligned(version, expected)) {
+        findings.push(
+          finding("node-version-mismatch", {
+            name: `node:${version}`,
+            file,
+            line,
+            detail: `expected ${expected} (${settings.nodeVersionFile})`
+          })
+        );
+      }
+    }
+    for (const { source, line } of contextCopySources) {
+      if (!view.exists(join8(".", source)) && !view.exists(join8(dirname(file), source))) {
+        findings.push(finding("dead-copy-path", { name: source, file, line }));
+      }
+    }
+    const { runsAsRoot, user, userLine, copiesWithoutChown } = dockerHardening(content);
+    if (runsAsRoot && !settings.docker.allowRoot.includes(file)) {
+      findings.push(
+        finding("dockerfile-runs-as-root", {
+          name: user ? `USER ${user}` : "no USER set",
+          file,
+          line: userLine
+        })
+      );
+    }
+    for (const { instruction, line } of copiesWithoutChown) {
+      findings.push(finding("copy-not-owned", { name: instruction, file, line }));
+    }
+    const refs = parseNxTargetRefs(content);
+    if (refs.length === 0) continue;
+    const lookup = view.hasNx ? view.nxTargets() : void 0;
+    if (lookup === void 0) {
+      uncheckedNxRefs += refs.length;
+      nxUnavailable ||= view.hasNx;
+      continue;
+    }
+    for (const { project, targetSpec, line } of refs) {
+      const targets2 = lookup(project);
+      if (targets2 === null) {
+        findings.push(finding("nx-project-missing", { name: project, file, line }));
+      } else if (!nxTargetCandidates(targetSpec).some((target) => targets2.has(target))) {
+        findings.push(
+          finding("nx-target-missing", { name: `${project}:${targetSpec}`, file, line })
+        );
+      }
+    }
+  }
+  if (dockerfiles.length === 0)
+    notes.push("no Dockerfile is tracked: rules 7 to 10 had nothing to check");
+  if (dockerfiles.length > 0 && expected === void 0) {
+    notes.push(
+      `no ${settings.nodeVersionFile} at the repository root: rule 9 had no version to compare the FROM tags with`
+    );
+  }
+  if (!view.hasNx) {
+    notes.push(
+      uncheckedNxRefs > 0 ? `not an nx workspace (no nx.json): rule 8 skipped, ${uncheckedNxRefs} \`nx run\` reference(s) not checked` : "not an nx workspace (no nx.json): rule 8 skipped"
+    );
+  } else if (nxUnavailable) {
+    notes.push(
+      `the repository's own nx could not run (not installed?): rule 8 skipped, ${uncheckedNxRefs} \`nx run\` reference(s) not checked`
+    );
+  }
+  return { findings, notes, dockerfiles: dockerfiles.length, nodeVersion: expected ?? null };
+}
+function collectEnvReport(view, settings, level, config) {
+  const missing = missingRoots(view, settings);
+  if (missing.length > 0) {
+    throw new Error(
+      `${config ?? "the env settings"}: scan root(s) holding no tracked file: ${missing.join(", ")}`
+    );
+  }
+  const { envFiles, contracts, parsed } = readEnvFiles(view, settings);
+  const contractFiles = contracts.flatMap((path2) => {
+    const content = parsed.get(path2);
+    return content ? [{ path: path2, parsed: content }] : [];
+  });
+  const code = codeFindings(view, settings, contractFiles);
+  const docker = dockerFindings(view, settings);
+  const orphans = findOrphanEnvFiles(envFiles, settings.allowedCommittedEnvFiles);
+  const notes = [];
+  if (!code.compared) {
+    notes.push(
+      `no contract is committed (${settings.contracts.join(", ")}): rules 1, 3 and 4 had nothing to compare the code with`
+    );
+  }
+  if (code.counts.required === 0) {
+    notes.push(
+      `no required reader call found (${settings.readers.required.join(", ")}): rule 1 had nothing to check; name the repository's own helper in readers.required`
+    );
+  }
+  notes.push(...docker.notes);
+  return {
+    level,
+    config,
+    scanned: settings.scan.roots,
+    counts: {
+      required: code.counts.required,
+      optional: code.counts.optional,
+      contracts: contractFiles.length,
+      envFiles: envFiles.length,
+      dockerfiles: docker.dockerfiles
+    },
+    nodeVersion: docker.nodeVersion,
+    findings: [
+      ...code.findings,
+      ...orphans.map((file) => finding("committed-env-file", { name: file, file })),
+      ...secretFindings(parsed, settings),
+      ...docker.findings
+    ].sort(byReportOrder),
+    notes,
+    inventory: code.inventory
+  };
+}
+function blockingFindings(report) {
+  return report.findings.filter((entry) => entry.severity === "blocking");
+}
+
+// src/roles/env/configs/resolve.ts
+import { existsSync as existsSync6 } from "node:fs";
+import { join as join9 } from "node:path";
+import { pathToFileURL } from "node:url";
+function explainUnreadableEnvConfig(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const code = error.code;
+  const missingPackage = (code === "ERR_PACKAGE_PATH_NOT_EXPORTED" || code === "ERR_MODULE_NOT_FOUND") && message.includes("@hublo/sentinel");
+  if (!missingPackage) return message;
+  return `${message}
+  This repository cannot import @hublo/sentinel/env: it does not install sentinel, or installs a release without the env role. Export the same object without defineEnv (export default { ... }), which sentinel validates the same way.`;
+}
+function unique(values) {
+  return [...new Set(values)];
+}
+function scopeOf(base, input) {
+  return {
+    roots: input?.roots ?? base.roots,
+    ext: input?.ext ?? base.ext,
+    excludeSuffixes: input?.excludeSuffixes ?? base.excludeSuffixes,
+    excludeDirs: input?.excludeDirs ?? base.excludeDirs
+  };
+}
+function asPattern(entry) {
+  return entry instanceof RegExp ? entry : new RegExp(entry);
+}
+function resolveEnvSettings(input) {
+  return {
+    readers: {
+      required: unique([...envDefaults.readers.required, ...input.readers?.required ?? []]),
+      optional: unique([...envDefaults.readers.optional, ...input.readers?.optional ?? []])
+    },
+    scan: scopeOf(envDefaults.scan, input.scan),
+    references: scopeOf(envDefaults.references, input.references),
+    referencePatterns: referencePatterns(),
+    secretNamePatterns: secretNamePatterns(),
+    publicPrefixes: [...envDefaults.publicPrefixes],
+    envFiles: unique([...envDefaults.envFiles, ...input.envFiles ?? []]),
+    contracts: unique([...envDefaults.contracts, ...input.contracts ?? []]),
+    nodeVersionFile: envDefaults.nodeVersionFile,
+    externallyProvided: input.externallyProvided ?? [],
+    knownExternalVars: input.knownExternalVars ?? [],
+    knownExternalPatterns: (input.knownExternalPatterns ?? []).map(asPattern),
+    allowNonBlankedSecrets: input.allowNonBlankedSecrets ?? [],
+    allowedCommittedEnvFiles: input.allowedCommittedEnvFiles ?? [],
+    docker: {
+      allowRoot: input.docker?.allowRoot ?? [],
+      excludePaths: input.docker?.excludePaths ?? []
+    }
+  };
+}
+async function loadEnvConfig(root) {
+  const path2 = join9(root, ENV_CONFIG_FILE);
+  if (!existsSync6(path2)) {
+    return { settings: resolveEnvSettings({}), from: null, unreadable: null };
+  }
+  try {
+    const loaded = await import(pathToFileURL(path2).href);
+    const declared = defineEnv(loaded.default ?? {});
+    return { settings: resolveEnvSettings(declared), from: ENV_CONFIG_FILE, unreadable: null };
+  } catch (error) {
+    return {
+      settings: resolveEnvSettings({}),
+      from: null,
+      unreadable: `${ENV_CONFIG_FILE}: ${explainUnreadableEnvConfig(error)}`
+    };
+  }
+}
+
+// src/roles/env/report.ts
+var LEVEL_MEANING = {
+  info: "report only",
+  warning: "report, and annotate in GitHub Actions; never fails",
+  error: "fails on a blocking finding (rules 1, 2, 6, 7 to 10)"
+};
+function locationOf(entry) {
+  if (entry.file === void 0) return "";
+  return entry.line === void 0 ? entry.file : `${entry.file}:${entry.line}`;
+}
+function groupByRule(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const entry of findings) {
+    const group = groups.get(entry.rule) ?? [];
+    group.push(entry);
+    groups.set(entry.rule, group);
+  }
+  return groups;
+}
+function describe(entry) {
+  const where = locationOf(entry);
+  const subject = entry.rule === "committed-env-file" ? "" : entry.name;
+  const more = entry.readIn !== void 0 && entry.readIn.length > 1 ? ` (read in ${entry.readIn.length} files)` : entry.detail ? ` (${entry.detail})` : "";
+  return [where, subject].filter(Boolean).join("  ") + more;
+}
+function verdictOf(report) {
+  const blocking = blockingFindings(report).length;
+  if (blocking === 0) return "no blocking finding";
+  const counted = `${blocking} blocking finding${blocking === 1 ? "" : "s"}`;
+  return report.level === "error" ? `${counted}: failing` : `${counted}: reported, not failing`;
+}
+function headline(report) {
+  const { counts } = report;
+  return `${counts.envFiles} env file(s), ${counts.contracts} contract(s), ${counts.required} required and ${counts.optional} optional variable(s) read, ${counts.dockerfiles} Dockerfile(s)` + (report.nodeVersion ? `, node ${report.nodeVersion}` : "");
+}
+function renderConsole(report, palette2) {
+  const lines = [];
+  lines.push(
+    `${palette2.strong("env")} ${palette2.dim(`(level ${report.level}: ${LEVEL_MEANING[report.level]})`)}`
+  );
+  lines.push(`  ${headline(report)}`);
+  lines.push(
+    `  ${palette2.dim(`settings: ${report.config ?? "sentinel defaults (no env.config.mjs)"}`)}`
+  );
+  const listed = report.findings.filter((entry) => entry.severity !== "info");
+  const informational = report.findings.length - listed.length;
+  for (const [rule, entries] of groupByRule(listed)) {
+    const meta = RULES[rule];
+    const mark = meta.severity === "blocking" ? palette2.fail("\u2717") : palette2.warn("!");
+    lines.push("");
+    lines.push(
+      `  ${mark} ${palette2.strong(`[${rule}]`)} ${palette2.dim(`rule ${meta.number}, ${meta.severity}, ${entries.length}`)}`
+    );
+    lines.push(`    ${palette2.dim(meta.help)}`);
+    for (const entry of entries) lines.push(`      ${describe(entry)}`);
+  }
+  if (informational > 0) {
+    lines.push("");
+    lines.push(
+      `  ${palette2.dim(`info: ${informational} optional variable(s) in no contract (a default applies); listed in --json`)}`
+    );
+  }
+  for (const note of report.notes) lines.push(`  ${palette2.dim(`note: ${note}`)}`);
+  lines.push("");
+  const blocking = blockingFindings(report).length;
+  const verdict = verdictOf(report);
+  lines.push(
+    `  ${blocking === 0 ? palette2.ok(verdict) : report.level === "error" ? palette2.fail(verdict) : palette2.warn(verdict)}`
+  );
+  return `${lines.join("\n")}
+`;
+}
+function cell(text) {
+  return text.replace(/\|/g, "\\|");
+}
+function renderMarkdown(report) {
+  const lines = ["<!-- sentinel-env-report -->", "## Env conformance", ""];
+  lines.push(`**Level:** \`${report.level}\` (${LEVEL_MEANING[report.level]})  `);
+  lines.push(`**Scanned:** ${headline(report)}  `);
+  lines.push(`**Settings:** ${report.config ? `\`${report.config}\`` : "sentinel defaults"}`);
+  lines.push("");
+  const listed = report.findings.filter((entry) => entry.severity !== "info");
+  const groups = groupByRule(listed);
+  if (groups.size === 0) {
+    lines.push("No finding.");
+  } else {
+    lines.push("| rule | finding | severity | count |", "| --- | --- | --- | --- |");
+    for (const [rule, entries] of groups) {
+      const meta = RULES[rule];
+      lines.push(`| ${meta.number} | \`${rule}\` | ${meta.severity} | ${entries.length} |`);
+    }
+    for (const [rule, entries] of groups) {
+      lines.push("", `<details><summary><code>${rule}</code>: ${entries.length}</summary>`, "");
+      lines.push(cell(RULES[rule].help), "");
+      for (const entry of entries) lines.push(`- \`${cell(describe(entry))}\``);
+      lines.push("", "</details>");
+    }
+  }
+  if (report.notes.length > 0) {
+    lines.push("");
+    for (const note of report.notes) lines.push(`> ${note}`);
+  }
+  lines.push("", `**Verdict:** ${verdictOf(report)}`);
+  return `${lines.join("\n")}
+`;
+}
+function reportDocument(report) {
+  return {
+    level: report.level,
+    verdict: verdictOf(report),
+    blocking: blockingFindings(report).length,
+    config: report.config,
+    scanned: report.scanned,
+    counts: report.counts,
+    nodeVersion: report.nodeVersion,
+    notes: report.notes,
+    findings: report.findings,
+    inventory: report.inventory
+  };
+}
+function renderJson(report) {
+  return `${JSON.stringify(reportDocument(report), null, 2)}
+`;
+}
+function escapeData(text) {
+  return text.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+}
+function escapeProperty(text) {
+  return escapeData(text).replace(/:/g, "%3A").replace(/,/g, "%2C");
+}
+function renderAnnotations(report) {
+  if (report.level === "info") return [];
+  return report.findings.filter((entry) => entry.severity !== "info").map((entry) => {
+    const command = report.level === "error" && entry.severity === "blocking" ? "error" : "warning";
+    const properties = [
+      entry.file === void 0 ? void 0 : `file=${escapeProperty(entry.file)}`,
+      entry.line === void 0 ? void 0 : `line=${entry.line}`,
+      `title=${escapeProperty(`env rule ${entry.number}: ${entry.rule}`)}`
+    ].filter(Boolean);
+    const message = `${entry.name}${entry.detail ? ` (${entry.detail})` : ""}: ${RULES[entry.rule].help}`;
+    return `::${command} ${properties.join(",")}::${escapeData(message)}`;
+  });
+}
+
+// src/roles/env/adapters/conformance/conformance.adapter.ts
+function shapesOf(output) {
+  const asked = [
+    ...new Set(
+      (output ?? "console").split(",").map((one) => one.trim()).filter((one) => one !== "")
+    )
+  ];
+  return {
+    known: asked.filter((one) => ENV_SHAPES.includes(one)),
+    unknown: asked.filter((one) => !ENV_SHAPES.includes(one))
+  };
+}
+function writeShapes(root, report, shapes) {
+  const files = shapes.filter((shape) => shape !== "console");
+  if (files.length === 0) return [];
+  const directory = join10(root, REPORT_DIR2);
+  mkdirSync(directory, { recursive: true });
+  for (const [shape, name] of Object.entries(SHAPE_FILE)) {
+    const path2 = join10(directory, name);
+    if (!files.includes(shape) && existsSync7(path2)) unlinkSync(path2);
+  }
+  return files.map((shape) => {
+    const name = SHAPE_FILE[shape];
+    writeFileSync2(
+      join10(directory, name),
+      shape === "json" ? renderJson(report) : renderMarkdown(report)
+    );
+    return `${REPORT_DIR2}/${name}`;
+  });
+}
+var ConformanceAdapter = class extends BaseAdapter {
+  target = TARGET2;
+  runner = "conformance";
+  /** A repository has no stack, so every preset applies: the role never reads one. */
+  appliesTo(_preset) {
+    return true;
+  }
+  /** Nothing to adopt: the role reads the repository and writes no config of its own. */
+  plan() {
+    return {
+      operations: [],
+      blocked: "env has no --init: it writes no config. An optional env.config.mjs at the repository root declares exceptions; run it with `sentinel --run --env`."
+    };
+  }
+  /** `--run`: check, print the report, write the asked files, annotate. */
+  async run(ctx) {
+    return this.check(ctx, true);
+  }
+  /** `--run --json`: the same check, for a machine. Prints nothing on stdout. */
+  async report(ctx) {
+    return this.check(ctx, false);
+  }
+  say(message) {
+    process.stderr.write(`sentinel env: ${message}
+`);
+  }
+  async check(ctx, printing) {
+    const level = ctx.envLevel ?? DEFAULT_ENV_LEVEL;
+    const { known, unknown } = shapesOf(ctx.output);
+    if (unknown.length > 0) {
+      this.say(
+        `writes ${ENV_SHAPES.join(", ")}; not ${unknown.join(", ")}, which another role may write.`
+      );
+    }
+    const { settings, from, unreadable } = await loadEnvConfig(ctx.cwd);
+    if (unreadable) {
+      this.say(unreadable);
+      return { ok: false, code: 1 };
+    }
+    let report;
+    try {
+      report = collectEnvReport(openRepository(ctx.cwd), settings, level, from);
+    } catch (error) {
+      this.say(error instanceof Error ? error.message : String(error));
+      return { ok: false, code: 1 };
+    }
+    if (printing) {
+      const written = writeShapes(ctx.cwd, report, known);
+      process.stdout.write(renderConsole(report, palette(process.stdout)));
+      if (written.length > 0) process.stdout.write(`
+  written: ${written.join(", ")}
+`);
+    }
+    if (ctx.githubActions) {
+      const annotations = renderAnnotations(report);
+      if (annotations.length > 0) {
+        const stream = printing ? process.stdout : process.stderr;
+        stream.write(`${annotations.join("\n")}
+`);
+      }
+    }
+    const failing = level === "error" && blockingFindings(report).length > 0;
+    return { ok: !failing, code: failing ? 1 : 0, metrics: reportDocument(report) };
+  }
+};
+
+// src/roles/env/register.ts
+function registerEnv() {
+  register(new ConformanceAdapter());
+  setDefaultRunner("env", "conformance");
+}
+
 // src/roles/format/adapters/oxfmt/oxfmt.adapter.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync9 } from "node:fs";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "node:fs";
+import { join as join15 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 
 // src/core/config/has-source.ts
 import { readdirSync } from "node:fs";
-import { extname, join as join7, relative as relative2 } from "node:path";
+import { extname, join as join11, relative as relative2 } from "node:path";
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -1348,7 +2442,7 @@ function hasSourceFiles(cwd, extensions) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join7(dir, entry.name));
+        if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(join11(dir, entry.name));
         continue;
       }
       if (wanted.has(extname(entry.name))) return true;
@@ -1369,7 +2463,7 @@ function listSourceFiles(cwd, extensions) {
       continue;
     }
     for (const entry of entries) {
-      const full = join7(dir, entry.name);
+      const full = join11(dir, entry.name);
       if (entry.isDirectory()) {
         if (!SKIP_DIRECTORIES.has(entry.name)) queue.push(full);
         continue;
@@ -1388,8 +2482,8 @@ function scopeFlags(paths, options = []) {
 }
 
 // src/roles/format/deliberate-import-order.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join8 } from "node:path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join12 } from "node:path";
 import { parseSync } from "oxc-parser";
 import { format } from "oxfmt";
 
@@ -1526,8 +2620,8 @@ async function pinDeliberateImportOrder(cwd, options) {
   if (!options.sortImports) return [];
   const pinned = [];
   for (const file of listSourceFiles(cwd, CODE_EXTENSIONS).sort()) {
-    const path2 = join8(cwd, file);
-    const text = readFileSync6(path2, "utf8");
+    const path2 = join12(cwd, file);
+    const text = readFileSync7(path2, "utf8");
     if (!text.includes("eslint-disable") && !MODULE_NAMES.some((name) => text.includes(name)))
       continue;
     const before = readImports(file, text);
@@ -1535,7 +2629,7 @@ async function pinDeliberateImportOrder(cwd, options) {
     const sorted = await format(file, text, options);
     if (sorted.errors.length > 0) continue;
     if (!wouldMove(before, readImports(file, sorted.code))) continue;
-    writeFileSync2(path2, pin(text, before));
+    writeFileSync3(path2, pin(text, before));
     pinned.push(file);
   }
   return pinned;
@@ -1569,8 +2663,8 @@ function writesWhenRewritten(name, command) {
 var CHECK_SCRIPT_NAMES = /* @__PURE__ */ new Set(["lint", "format", "check", "test", "typecheck", "verify"]);
 
 // src/roles/format/inherited-ignores.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
+import { join as join13 } from "node:path";
 var ROOT_IGNORE_FILE = ".prettierignore";
 function isPattern(line) {
   const trimmed = line.trim();
@@ -1586,11 +2680,11 @@ function toModulePattern(pattern) {
 }
 function inheritedIgnorePatterns(workspaceRoot) {
   if (!workspaceRoot) return [];
-  const path2 = join9(workspaceRoot, ROOT_IGNORE_FILE);
-  if (!existsSync6(path2)) return [];
+  const path2 = join13(workspaceRoot, ROOT_IGNORE_FILE);
+  if (!existsSync8(path2)) return [];
   let contents;
   try {
-    contents = readFileSync7(path2, "utf8");
+    contents = readFileSync8(path2, "utf8");
   } catch {
     return [];
   }
@@ -1635,8 +2729,8 @@ function needsSvelteCompiler(output) {
 }
 
 // src/roles/format/prettier-config.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "node:fs";
+import { join as join14 } from "node:path";
 var UNSUPPORTED = /* @__PURE__ */ new Set(["plugins", "parser", "filepath", "rangeStart", "rangeEnd"]);
 function toOxfmtOverrides(value) {
   if (!Array.isArray(value)) return { overrides: [], unresolved: [] };
@@ -1661,14 +2755,14 @@ function toOxfmtOverrides(value) {
   return { overrides, unresolved };
 }
 function readPrettierSettings(cwd) {
-  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync7(join10(cwd, name)));
+  const file = PRETTIER_CONFIG_FILES.find((name) => existsSync9(join14(cwd, name)));
   if (!file) return { options: {}, unresolved: [] };
   if (/\.(js|cjs|mjs)$/.test(file)) {
     return { options: {}, file, unresolved: [`${file} is JavaScript, so it was not executed`] };
   }
   let parsed;
   try {
-    parsed = parseJsonc(readFileSync8(join10(cwd, file), "utf8"), file);
+    parsed = parseJsonc(readFileSync9(join14(cwd, file), "utf8"), file);
   } catch {
     return { options: {}, file, unresolved: [`${file} could not be parsed`] };
   }
@@ -1786,7 +2880,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       manifestOperation(context2.cwd, this.formatScripts(context2.cwd))
     ];
     const prettierConfigs = PRETTIER_CONFIG_FILES.filter(
-      (name) => existsSync8(join11(context2.cwd, name))
+      (name) => existsSync10(join15(context2.cwd, name))
     );
     for (const name of prettierConfigs) operations.push({ kind: "delete", path: name });
     const removableDeps = this.modulePrettierDependencies(context2.cwd);
@@ -1979,7 +3073,7 @@ var OxfmtAdapter = class extends BaseAdapter {
     const adoption = readFormatAdoption(ctx.cwd);
     const preset = formatPresetFor(adoption.preset ?? DEFAULT_PRESET);
     const options = { ...preset, ...adoption.local };
-    const describe = (value) => typeof value === "string" ? value : JSON.stringify(value);
+    const describe2 = (value) => typeof value === "string" ? value : JSON.stringify(value);
     return {
       runner: "oxfmt",
       configFile: adoption.configFile,
@@ -1988,7 +3082,7 @@ var OxfmtAdapter = class extends BaseAdapter {
       options,
       overrides: Object.entries(adoption.local).filter(([key]) => !ALWAYS_LOCAL_KEYS.includes(key)).map(([key, value]) => ({
         rule: key,
-        reason: key in preset ? `${describe(value)}, where the ${adoption.preset ?? DEFAULT_PRESET} preset says ${describe(preset[key])}` : `${describe(value)}, which the preset does not set`
+        reason: key in preset ? `${describe2(value)}, where the ${adoption.preset ?? DEFAULT_PRESET} preset says ${describe2(preset[key])}` : `${describe2(value)}, which the preset does not set`
       })),
       // Which files this module does not format at all. A long list here is worth a look:
       // it is the quiet way a module stops being covered.
@@ -2063,7 +3157,7 @@ var OxfmtAdapter = class extends BaseAdapter {
   modulePrettierDependencies(cwd) {
     const isPrettierPackage = (name) => name === "prettier" || name.startsWith("prettier-plugin-") || name.startsWith("@prettier/");
     try {
-      const manifest = JSON.parse(readFileSync9(join11(cwd, "package.json"), "utf8"));
+      const manifest = JSON.parse(readFileSync10(join15(cwd, "package.json"), "utf8"));
       return Object.keys(manifest.devDependencies ?? {}).filter(isPrettierPackage).map((name) => ["devDependencies", name]);
     } catch {
       return [];
@@ -2145,8 +3239,8 @@ function registerFormat() {
 
 // src/roles/lint/adapters/oxlint/oxlint.adapter.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync14, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync15, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join21 } from "node:path";
 
 // src/core/config/deferred-rules.ts
 function deferredRuleNames(rules) {
@@ -2154,8 +3248,8 @@ function deferredRuleNames(rules) {
 }
 
 // src/core/fix-report.ts
-import { statSync as statSync2 } from "node:fs";
-import { join as join12 } from "node:path";
+import { statSync as statSync3 } from "node:fs";
+import { join as join16 } from "node:path";
 var CONFIG_REFUSED = /failed to parse .*config|invalid config file/i;
 function readFailure(output) {
   const lines = output.split("\n").map((line2) => line2.trim());
@@ -2166,7 +3260,7 @@ function readFailure(output) {
 }
 function fingerprint(path2) {
   try {
-    const stat = statSync2(path2);
+    const stat = statSync3(path2);
     return `${stat.size}:${stat.mtimeMs}`;
   } catch {
     return void 0;
@@ -2175,7 +3269,7 @@ function fingerprint(path2) {
 function snapshotFiles(cwd, extensions) {
   const snapshot = /* @__PURE__ */ new Map();
   for (const file of listSourceFiles(cwd, extensions)) {
-    const mark = fingerprint(join12(cwd, file));
+    const mark = fingerprint(join16(cwd, file));
     if (mark !== void 0) snapshot.set(file, mark);
   }
   return snapshot;
@@ -2183,7 +3277,7 @@ function snapshotFiles(cwd, extensions) {
 function changedSince(cwd, before, extensions) {
   const changed = [];
   for (const file of listSourceFiles(cwd, extensions)) {
-    const now = fingerprint(join12(cwd, file));
+    const now = fingerprint(join16(cwd, file));
     if (now === void 0) continue;
     if (before.get(file) !== now) changed.push(file);
   }
@@ -4153,7 +5247,7 @@ var react_default = {
 };
 
 // src/roles/lint/presets/shared.json
-var shared_default = {
+var shared_default2 = {
   rules: {
     "no-var": "error",
     "prefer-const": [
@@ -4530,7 +5624,7 @@ var tools_default = {
 };
 
 // src/roles/lint/preset-data.ts
-var SHARED_RULES = shared_default.rules;
+var SHARED_RULES = shared_default2.rules;
 var PRESET_FILES = {
   nest: nest_default,
   node: node_default,
@@ -4643,14 +5737,14 @@ function downgradedRulesFor(preset) {
 }
 
 // src/roles/lint/extra-layers.ts
-import { existsSync as existsSync9, readFileSync as readFileSync10 } from "node:fs";
-import { isAbsolute, join as join13, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync11 } from "node:fs";
+import { isAbsolute, join as join17, resolve as resolve2 } from "node:path";
 function ruleCount(cwd, specifier) {
   const path2 = isAbsolute(specifier) ? specifier : resolve2(cwd, specifier);
-  if (!existsSync9(path2)) return void 0;
+  if (!existsSync11(path2)) return void 0;
   try {
     const parsed = parseJsonc(
-      readFileSync10(path2, "utf8"),
+      readFileSync11(path2, "utf8"),
       specifier
     );
     return Object.keys(parsed.rules ?? {}).length;
@@ -4670,7 +5764,7 @@ function extraLayers(cwd, extendsList) {
 function committedExtendsList(cwd, configFile) {
   try {
     const parsed = parseJsonc(
-      readFileSync10(join13(cwd, configFile), "utf8"),
+      readFileSync11(join17(cwd, configFile), "utf8"),
       configFile
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -4853,12 +5947,12 @@ function lintPresetFor(preset) {
 }
 
 // src/roles/lint/adapters/oxlint/plan.ts
-import { existsSync as existsSync11, readFileSync as readFileSync13 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
+import { join as join20 } from "node:path";
 
 // src/roles/lint/eslint-ignores.ts
-import { existsSync as existsSync10, readFileSync as readFileSync11 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "node:fs";
+import { join as join18 } from "node:path";
 import { parseSync as parseSync2 } from "oxc-parser";
 var OPAQUE_SOURCE = /\b(includeIgnoreFile)\s*\([^)]*\)/g;
 function toOxlintPattern(pattern) {
@@ -4870,11 +5964,11 @@ function readRootEslintIgnores(root) {
   return { patterns: patterns.filter((pattern) => pattern.startsWith("**/")), unresolved };
 }
 function readEslintIgnores(cwd) {
-  const config = ESLINT_CONFIG_FILES.map((name) => join14(cwd, name)).find((path2) => existsSync10(path2));
+  const config = ESLINT_CONFIG_FILES.map((name) => join18(cwd, name)).find((path2) => existsSync12(path2));
   if (!config) return { patterns: [], unresolved: [] };
   let source;
   try {
-    source = readFileSync11(config, "utf8");
+    source = readFileSync12(config, "utf8");
   } catch {
     return { patterns: [], unresolved: [] };
   }
@@ -4945,8 +6039,8 @@ function keepsOtherCommands3(script) {
 }
 
 // src/roles/lint/rename-suppressions.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync12, statSync as statSync3 } from "node:fs";
-import { join as join15, relative as relative3 } from "node:path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync13, statSync as statSync4 } from "node:fs";
+import { join as join19, relative as relative3 } from "node:path";
 var SOURCE_EXTENSIONS = [
   ".ts",
   ".tsx",
@@ -4993,10 +6087,10 @@ function* sourceFiles(dir) {
     return;
   }
   for (const entry of entries) {
-    const full = join15(dir, entry);
+    const full = join19(dir, entry);
     let isDirectory;
     try {
-      isDirectory = statSync3(full).isDirectory();
+      isDirectory = statSync4(full).isDirectory();
     } catch {
       continue;
     }
@@ -5013,7 +6107,7 @@ function findSuppressionRenames(cwd, renames) {
   for (const file of sourceFiles(cwd)) {
     let content;
     try {
-      content = readFileSync12(file, "utf8");
+      content = readFileSync13(file, "utf8");
     } catch {
       continue;
     }
@@ -5159,7 +6253,7 @@ function plan2(context2) {
       keys: removableDeps
     });
   }
-  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync11(join16(context2.cwd, name)));
+  const eslintConfigs = ESLINT_CONFIG_FILES.filter((name) => existsSync13(join20(context2.cwd, name)));
   for (const name of eslintConfigs) operations.push({ kind: "delete", path: name });
   operations.push(
     ...nxTargetOperations({
@@ -5273,7 +6367,7 @@ function lintScripts(cwd) {
 function committedExtends(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync13(join16(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync14(join20(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : [];
@@ -5285,7 +6379,7 @@ var isRecord2 = (value) => typeof value === "object" && value !== null && !Array
 function committedConfig(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync13(join16(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync14(join20(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return isRecord2(parsed) ? parsed : {};
@@ -5309,7 +6403,7 @@ function describeGoverned(rule, variant) {
 function committedIgnorePatterns(cwd) {
   try {
     const parsed = parseJsonc(
-      readFileSync13(join16(cwd, LINT_CONFIG_FILE), "utf8"),
+      readFileSync14(join20(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
     return Array.isArray(parsed.ignorePatterns) ? parsed.ignorePatterns.filter((entry) => typeof entry === "string") : [];
@@ -5321,7 +6415,7 @@ function moduleEslintDependencies(cwd) {
   const isEslintPackage = (name) => name === "eslint" || name === "@types/eslint" || name === "typescript-eslint" || name.startsWith("@typescript-eslint/") || name.startsWith("eslint-plugin-") || name.startsWith("eslint-config-") || name.startsWith("@eslint/");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync13(join16(cwd, "package.json"), "utf8"));
+    manifest = JSON.parse(readFileSync14(join20(cwd, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -5502,23 +6596,23 @@ ${result.stderr ?? ""}`);
    * build the developer can see, rather than a silent half-adoption they cannot.
    */
   writeModuleBaseline(ctx, oxlint, env) {
-    const configPath = join17(ctx.cwd, LINT_CONFIG_FILE);
-    const baselinePath = join17(ctx.cwd, LINT_BASELINE_FILE);
-    if (!existsSync12(configPath)) return;
+    const configPath = join21(ctx.cwd, LINT_CONFIG_FILE);
+    const baselinePath = join21(ctx.cwd, LINT_BASELINE_FILE);
+    if (!existsSync14(configPath)) return;
     let config;
     try {
       config = parseJsonc(
-        readFileSync14(configPath, "utf8"),
+        readFileSync15(configPath, "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return;
     }
     const current = Array.isArray(config.extends) ? config.extends : [];
-    const measurePath = join17(ctx.cwd, LINT_MEASURE_FILE);
+    const measurePath = join21(ctx.cwd, LINT_MEASURE_FILE);
     let measured;
     try {
-      writeFileSync3(
+      writeFileSync4(
         measurePath,
         `${JSON.stringify({ ...config, extends: extendsWithBaseline(current, false) }, null, 2)}
 `
@@ -5553,7 +6647,7 @@ ${result.stderr ?? ""}`);
     );
     const next = extendsWithBaseline(current, holds.length > 0);
     if (holds.length > 0) {
-      writeFileSync3(baselinePath, renderBaseline(holds, readOwnPackage().version));
+      writeFileSync4(baselinePath, renderBaseline(holds, readOwnPackage().version));
       process.stderr.write(`  ${palette(process.stderr).warn(describeHolds(holds))}
 `);
     } else {
@@ -5561,12 +6655,12 @@ ${result.stderr ?? ""}`);
     }
     if (next.length !== current.length || next.some((entry, at) => entry !== current[at])) {
       config.extends = next;
-      writeFileSync3(configPath, `${JSON.stringify(config, null, 2)}
+      writeFileSync4(configPath, `${JSON.stringify(config, null, 2)}
 `);
     }
   }
   async run(ctx) {
-    if (!existsSync12(join17(ctx.cwd, LINT_CONFIG_FILE))) {
+    if (!existsSync14(join21(ctx.cwd, LINT_CONFIG_FILE))) {
       process.stderr.write(
         `sentinel lint(oxlint): no ${LINT_CONFIG_FILE} in this module; run \`sentinel --init --lint\` to adopt.
 `
@@ -5715,7 +6809,7 @@ ${result.stderr ?? ""}`);
     let stub;
     try {
       stub = parseJsonc(
-        readFileSync14(join17(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync15(join21(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
@@ -5725,7 +6819,7 @@ ${result.stderr ?? ""}`);
     for (const entry of stub.extends ?? []) {
       try {
         const preset = parseJsonc(
-          readFileSync14(join17(cwd, entry), "utf8"),
+          readFileSync15(join21(cwd, entry), "utf8"),
           entry
         );
         for (const rule of Object.keys(preset.rules ?? {})) names.add(canonicalRuleName(rule));
@@ -5795,14 +6889,14 @@ ${result.stderr ?? ""}`);
     let parsed;
     try {
       parsed = parseJsonc(
-        readFileSync14(join17(cwd, LINT_CONFIG_FILE), "utf8"),
+        readFileSync15(join21(cwd, LINT_CONFIG_FILE), "utf8"),
         LINT_CONFIG_FILE
       );
     } catch {
       return void 0;
     }
     const targets2 = Array.isArray(parsed.extends) ? parsed.extends.filter((entry) => typeof entry === "string") : typeof parsed.extends === "string" ? [parsed.extends] : [];
-    return targets2.find((target) => !existsSync12(join17(cwd, target)));
+    return targets2.find((target) => !existsSync14(join21(cwd, target)));
   }
   /** Announce what is not enforced, so reduced coverage is never silent. */
   announceDisabled(preset) {
@@ -5834,8 +6928,8 @@ function registerLint() {
 
 // src/roles/static-analysis/adapters/jscpd/jscpd.adapter.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync18, mkdirSync as mkdirSync2, readFileSync as readFileSync20, unlinkSync, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join27 } from "node:path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync3, readFileSync as readFileSync21, unlinkSync as unlinkSync2, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join31 } from "node:path";
 import { globSync as globSync5 } from "tinyglobby";
 
 // src/roles/static-analysis/bundle/budgets.ts
@@ -5864,32 +6958,32 @@ function bandFor(valueKb, referenceKb) {
 }
 
 // src/roles/static-analysis/bundle/scan.ts
-import { existsSync as existsSync14, readFileSync as readFileSync16 } from "node:fs";
-import { basename, join as join19 } from "node:path";
-import { pathToFileURL } from "node:url";
+import { existsSync as existsSync16, readFileSync as readFileSync17 } from "node:fs";
+import { basename, join as join23 } from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
 import { gzipSync } from "node:zlib";
 import { globSync as globSync2 } from "tinyglobby";
 
 // src/roles/static-analysis/bundle/find-build.ts
-import { existsSync as existsSync13, readFileSync as readFileSync15, statSync as statSync4 } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync16, statSync as statSync5 } from "node:fs";
+import { join as join22 } from "node:path";
 import { globSync } from "tinyglobby";
 var MANIFEST_GLOB = "server/_tanstack-start-manifest*.mjs";
 function candidateDirs(cwd) {
   const declared = readProjectPackageJson(cwd).nx?.targets?.build?.["outputs"];
-  const fromDeclaration = Array.isArray(declared) ? declared.filter((token) => typeof token === "string").map((token) => join18(cwd, token.replace(/^\{projectRoot\}\//, ""))) : [];
-  return [...fromDeclaration, join18(cwd, ".output"), join18(cwd, "dist"), join18(cwd, "build")];
+  const fromDeclaration = Array.isArray(declared) ? declared.filter((token) => typeof token === "string").map((token) => join22(cwd, token.replace(/^\{projectRoot\}\//, ""))) : [];
+  return [...fromDeclaration, join22(cwd, ".output"), join22(cwd, "dist"), join22(cwd, "build")];
 }
 function findBuildOutput(cwd) {
   const lookedIn = [];
   for (const dir of candidateDirs(cwd)) {
     lookedIn.push(dir);
-    if (!existsSync13(dir)) continue;
+    if (!existsSync15(dir)) continue;
     const found = globSync(MANIFEST_GLOB, { cwd: dir, absolute: true, dot: false });
     if (found.length === 0) continue;
     const manifestPath = found[0];
-    const publicDir = join18(dir, "public");
-    if (!existsSync13(publicDir)) continue;
+    const publicDir = join22(dir, "public");
+    if (!existsSync15(publicDir)) continue;
     return { manifestPath, publicDir, ...dateOf(dir, manifestPath) };
   }
   const pkg = readProjectPackageJson(cwd);
@@ -5911,10 +7005,10 @@ function findBuildOutput(cwd) {
   };
 }
 function dateOf(dir, manifestPath) {
-  const record = join18(dir, "nitro.json");
-  if (existsSync13(record)) {
+  const record = join22(dir, "nitro.json");
+  if (existsSync15(record)) {
     try {
-      const parsed = JSON.parse(readFileSync15(record, "utf8"));
+      const parsed = JSON.parse(readFileSync16(record, "utf8"));
       if (typeof parsed.date === "string") {
         const date = new Date(parsed.date);
         if (!Number.isNaN(date.getTime())) return { builtAt: date, builtAtFrom: "build record" };
@@ -5922,7 +7016,7 @@ function dateOf(dir, manifestPath) {
     } catch {
     }
   }
-  return { builtAt: statSync4(manifestPath).mtime, builtAtFrom: "file timestamp" };
+  return { builtAt: statSync5(manifestPath).mtime, builtAtFrom: "file timestamp" };
 }
 function isBuildOutput(found) {
   return "manifestPath" in found;
@@ -5940,10 +7034,10 @@ function kindOf(path2) {
   return "other";
 }
 function resolveAnnounced(publicDir, announced) {
-  const direct = join19(publicDir, announced);
-  if (existsSync14(direct)) return direct;
-  const stripped = join19(publicDir, announced.replace(/^\/[^/]+\//, "/"));
-  return existsSync14(stripped) ? stripped : void 0;
+  const direct = join23(publicDir, announced);
+  if (existsSync16(direct)) return direct;
+  const stripped = join23(publicDir, announced.replace(/^\/[^/]+\//, "/"));
+  return existsSync16(stripped) ? stripped : void 0;
 }
 function emptyWeight() {
   return { transfer: 0, parsed: 0, files: 0 };
@@ -5979,7 +7073,7 @@ async function scanBundle(cwd) {
         unresolved.push(announced);
         measured.set(announced, void 0);
       } else {
-        const buffer = readFileSync16(path2);
+        const buffer = readFileSync17(path2);
         measured.set(announced, {
           parsed: buffer.length,
           transfer: gzipSync(buffer, { level: 9 }).length
@@ -6030,7 +7124,7 @@ async function scanBundle(cwd) {
 }
 async function loadManifest(path2) {
   try {
-    const loaded = await import(pathToFileURL(path2).href);
+    const loaded = await import(pathToFileURL2(path2).href);
     if (typeof loaded.tsrStartManifest !== "function") return void 0;
     const produced = loaded.tsrStartManifest();
     return produced !== null && typeof produced === "object" ? produced : void 0;
@@ -6066,7 +7160,7 @@ function scanDynamicLayer(publicDir, references) {
   })) {
     const name = basename(path2);
     if (referenced.has(name)) continue;
-    const buffer = readFileSync16(path2);
+    const buffer = readFileSync17(path2);
     const size = { parsed: buffer.length, transfer: gzipSync(buffer, { level: 9 }).length };
     add(all2, size);
     const group = groupOf(name);
@@ -6094,28 +7188,28 @@ function scanDynamicLayer(publicDir, references) {
 }
 
 // src/roles/static-analysis/sources.ts
-import { readFileSync as readFileSync17 } from "node:fs";
-import { join as join22 } from "node:path";
+import { readFileSync as readFileSync18 } from "node:fs";
+import { join as join26 } from "node:path";
 import { parseSync as parseSync3 } from "oxc-parser";
 import { globSync as globSync3 } from "tinyglobby";
 
 // src/roles/static-analysis/adapters/jscpd/tool-config.ts
-import { existsSync as existsSync16, mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync18, mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join21 } from "node:path";
+import { join as join25 } from "node:path";
 
 // src/roles/static-analysis/configs/resolve.ts
-import { existsSync as existsSync15 } from "node:fs";
-import { join as join20 } from "node:path";
-import { pathToFileURL as pathToFileURL2 } from "node:url";
+import { existsSync as existsSync17 } from "node:fs";
+import { join as join24 } from "node:path";
+import { pathToFileURL as pathToFileURL3 } from "node:url";
 var STATIC_CONFIG_FILE = "static-analysis.config.mjs";
 async function loadStaticConfig(cwd) {
-  const path2 = join20(cwd, STATIC_CONFIG_FILE);
-  if (!existsSync15(path2)) {
+  const path2 = join24(cwd, STATIC_CONFIG_FILE);
+  if (!existsSync17(path2)) {
     return { config: defineStaticAnalysis(), from: null, unreadable: null };
   }
   try {
-    const loaded = await import(pathToFileURL2(path2).href);
+    const loaded = await import(pathToFileURL3(path2).href);
     return { config: adopt(loaded.default), from: STATIC_CONFIG_FILE, unreadable: null };
   } catch (error) {
     return {
@@ -6157,7 +7251,7 @@ function exclusions(config, scope = "tests") {
   return [.../* @__PURE__ */ new Set([...config.ignore, ...OWN_ARTEFACTS, ...tests])];
 }
 function measuredRoots(cwd) {
-  return existsSync16(join21(cwd, "src")) ? ["src"] : ["."];
+  return existsSync18(join25(cwd, "src")) ? ["src"] : ["."];
 }
 function fileSettings(config, scope, extraEntries = []) {
   return {
@@ -6187,9 +7281,9 @@ function fileSettings(config, scope, extraEntries = []) {
   };
 }
 function duplicationRun(config, paths, scope) {
-  const dir = mkdtempSync(join21(tmpdir(), "sentinel-static-"));
-  const configPath = join21(dir, "jscpd.json");
-  writeFileSync4(configPath, `${JSON.stringify(fileSettings(config, scope), null, 2)}
+  const dir = mkdtempSync(join25(tmpdir(), "sentinel-static-"));
+  const configPath = join25(dir, "jscpd.json");
+  writeFileSync5(configPath, `${JSON.stringify(fileSettings(config, scope), null, 2)}
 `, "utf8");
   const args = [
     "--config",
@@ -6214,9 +7308,9 @@ function duplicationRun(config, paths, scope) {
   return { args, rawReportDir: dir, dispose: () => rmSync3(dir, { force: true, recursive: true }) };
 }
 function deadCodeRun(config, paths, extraEntries = []) {
-  const dir = mkdtempSync(join21(tmpdir(), "sentinel-static-"));
-  const configPath = join21(dir, "jscpd.json");
-  writeFileSync4(
+  const dir = mkdtempSync(join25(tmpdir(), "sentinel-static-"));
+  const configPath = join25(dir, "jscpd.json");
+  writeFileSync5(
     configPath,
     `${JSON.stringify(fileSettings(config, "dead-code", extraEntries), null, 2)}
 `,
@@ -6267,7 +7361,7 @@ function readParsed(cwd, files, passes) {
 function parsedSource(cwd, path2) {
   let text;
   try {
-    text = readFileSync17(join22(cwd, path2), "utf8");
+    text = readFileSync18(join26(cwd, path2), "utf8");
   } catch {
     return void 0;
   }
@@ -6361,7 +7455,7 @@ function nameOf(fn, parent) {
   if (key) return key;
   return "(anonymous)";
 }
-function lineAt(source, offset) {
+function lineAt2(source, offset) {
   if (offset === void 0) return 1;
   let line = 1;
   for (let index = 0; index < offset && index < source.length; index += 1) {
@@ -6383,7 +7477,7 @@ function complexityOfProgram(program, source) {
       if (!FUNCTION_NODES.has(node.type ?? "")) return;
       found.push({
         name: nameOf(node, parents.get(node)),
-        line: lineAt(source, node.start),
+        line: lineAt2(source, node.start),
         complexity: complexityOf(node)
       });
     },
@@ -6454,13 +7548,13 @@ function unreadableNote(coverage) {
 }
 
 // src/roles/static-analysis/excerpt.ts
-import { readFileSync as readFileSync18 } from "node:fs";
-import { join as join24 } from "node:path";
+import { readFileSync as readFileSync19 } from "node:fs";
+import { join as join28 } from "node:path";
 
 // src/roles/static-analysis/maintainability/size-rules.ts
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join27 } from "node:path";
 var GAUGE_THRESHOLDS = {
   // McCabe 1976 says 10, our p90 says 11. The only indicator where two independent candidates agree
   // within one unit, and 94.8% of our functions already sit in the 1-10 band SEI calls low risk.
@@ -6489,7 +7583,7 @@ var GAUGE_THRESHOLDS = {
   "cognitive-complexity": 7
 };
 var COGNITIVE = "cognitive-complexity";
-var cognitivePlugin = () => join23(ownPackageDir(), "plugins", "sonar-cognitive.js");
+var cognitivePlugin = () => join27(ownPackageDir(), "plugins", "sonar-cognitive.js");
 var CATEGORIES = [
   "correctness",
   "suspicious",
@@ -6521,9 +7615,9 @@ function sizeRulesConfig() {
   };
 }
 function sizeRulesRun(paths, ignore) {
-  const dir = mkdtempSync2(join23(tmpdir2(), "sentinel-size-"));
-  const configPath = join23(dir, "oxlintrc.json");
-  writeFileSync5(configPath, `${JSON.stringify(sizeRulesConfig(), null, 2)}
+  const dir = mkdtempSync2(join27(tmpdir2(), "sentinel-size-"));
+  const configPath = join27(dir, "oxlintrc.json");
+  writeFileSync6(configPath, `${JSON.stringify(sizeRulesConfig(), null, 2)}
 `, "utf8");
   return {
     // `--format json` because the console shape is rendered by this role from the figures: a
@@ -7047,23 +8141,23 @@ function helpDetails(help, withoutReference) {
           <p class="source">Source: ${prose(help.source)}</p>
         </details>`;
 }
-function secondSide(finding) {
-  if (!finding.other) return "";
+function secondSide(finding2) {
+  if (!finding2.other) return "";
   const file = (at) => at.split(":")[0] ?? at;
-  const sameFile = file(finding.other) === file(finding.path);
+  const sameFile = file(finding2.other) === file(finding2.path);
   const label = sameFile ? "and line" : "and";
-  const shownSide = sameFile ? finding.other.split(":")[1] ?? finding.other : finding.other;
+  const shownSide = sameFile ? finding2.other.split(":")[1] ?? finding2.other : finding2.other;
   return ` <span class="unit">${label}</span> <code>${escape(shownSide)}</code>`;
 }
 var HTML_GROUP_LIMIT = 50;
 function listedByMetric(findings) {
   const groups = /* @__PURE__ */ new Map();
-  for (const finding of findings) {
-    const bucket = groups.get(finding.metric) ?? [];
-    bucket.push(finding);
-    groups.set(finding.metric, bucket);
+  for (const finding2 of findings) {
+    const bucket = groups.get(finding2.metric) ?? [];
+    bucket.push(finding2);
+    groups.set(finding2.metric, bucket);
   }
-  const weight = (finding) => finding.value ?? finding.lines ?? 0;
+  const weight = (finding2) => finding2.value ?? finding2.lines ?? 0;
   return new Map(
     [...groups.entries()].map(([metric, all2]) => {
       const sorted = [...all2].sort((left, right) => weight(right) - weight(left));
@@ -7093,7 +8187,7 @@ function caveatsOf(report) {
   }
   return found;
 }
-function renderConsole(report) {
+function renderConsole2(report) {
   const lines = [];
   const width = (pick) => Math.max(...report.rows.map((row) => pick(row).length));
   const label = (row) => helpFor(row.metric)?.label ?? row.metric;
@@ -7148,7 +8242,7 @@ function renderConsole(report) {
 `;
 }
 var JSON_SCHEMA_VERSION = 1;
-function renderJson(report) {
+function renderJson2(report) {
   const rows = report.rows.map((row) => {
     const help = helpFor(row.metric);
     return { ...row, help: help ? { label: help.label, caveat: help.caveat } : null };
@@ -7165,11 +8259,11 @@ function renderJson(report) {
   return `${JSON.stringify(envelope, null, 2)}
 `;
 }
-function renderMarkdown(report) {
+function renderMarkdown2(report) {
   const version = report.settings.find((setting) => setting.key === "sentinel")?.value;
   const places = /* @__PURE__ */ new Map();
-  for (const finding of report.findings) {
-    places.set(finding.metric, (places.get(finding.metric) ?? 0) + 1);
+  for (const finding2 of report.findings) {
+    places.set(finding2.metric, (places.get(finding2.metric) ?? 0) + 1);
   }
   const figureLine = (row) => {
     const help = helpFor(row.metric);
@@ -7223,64 +8317,64 @@ function ruleChip(metric) {
   const threshold = GAUGE_THRESHOLDS[metric];
   return threshold === void 0 ? "" : ` <span class="chip"><code>${escape(metric)}</code> &gt; ${threshold}</span>`;
 }
-function measureOf(finding) {
-  const metric = finding.metric;
+function measureOf(finding2) {
+  const metric = finding2.metric;
   const number = (value, unit = "") => `<span class="pmeas">${grouped(value)}${unit === "" ? "" : `<span class="unit">${escape(unit)}</span>`}</span>`;
-  if (finding.value !== void 0) {
-    if (GAUGE_THRESHOLDS[metric] !== void 0) return number(finding.value);
-    if (metric.startsWith("complexity")) return number(finding.value, "complexity");
-    if (finding.dependsOn !== void 0) return number(finding.value, "imported by");
-    if (metric === "cycles") return number(finding.value, "files in the cycle");
-    return number(finding.value);
+  if (finding2.value !== void 0) {
+    if (GAUGE_THRESHOLDS[metric] !== void 0) return number(finding2.value);
+    if (metric.startsWith("complexity")) return number(finding2.value, "complexity");
+    if (finding2.dependsOn !== void 0) return number(finding2.value, "imported by");
+    if (metric === "cycles") return number(finding2.value, "files in the cycle");
+    return number(finding2.value);
   }
-  return finding.lines === void 0 ? "" : number(finding.lines, "lines");
+  return finding2.lines === void 0 ? "" : number(finding2.lines, "lines");
 }
-function metaOf(finding) {
+function metaOf(finding2) {
   const pairs = [];
   const add2 = (label, value) => {
     pairs.push(`<span class="pair"><span class="k">${escape(label)}</span>${value}</span>`);
   };
-  if (finding.name) {
+  if (finding2.name) {
     add2(
-      finding.metric.startsWith("complexity") ? "function" : "name",
-      `<code>${escape(finding.name)}</code>`
+      finding2.metric.startsWith("complexity") ? "function" : "name",
+      `<code>${escape(finding2.name)}</code>`
     );
   }
-  if (finding.dependsOn !== void 0) add2("depends on", String(finding.dependsOn));
-  if (finding.instability !== void 0) add2("instability", finding.instability.toFixed(2));
-  if (finding.centrality !== void 0) add2("centrality", finding.centrality.toFixed(4));
-  if (finding.lines !== void 0 && finding.value !== void 0)
-    add2("length", `${finding.lines} lines`);
-  if (finding.confidence !== void 0) add2("confidence", `${finding.confidence}%`);
-  if (finding.reason) add2("unsure", `<span class="reason">${escape(finding.reason)}</span>`);
+  if (finding2.dependsOn !== void 0) add2("depends on", String(finding2.dependsOn));
+  if (finding2.instability !== void 0) add2("instability", finding2.instability.toFixed(2));
+  if (finding2.centrality !== void 0) add2("centrality", finding2.centrality.toFixed(4));
+  if (finding2.lines !== void 0 && finding2.value !== void 0)
+    add2("length", `${finding2.lines} lines`);
+  if (finding2.confidence !== void 0) add2("confidence", `${finding2.confidence}%`);
+  if (finding2.reason) add2("unsure", `<span class="reason">${escape(finding2.reason)}</span>`);
   return pairs.length === 0 ? "" : `          <div class="pmeta">${pairs.join("")}</div>
 `;
 }
-function codeSummary(finding) {
-  const count = finding.excerpt === void 0 ? 0 : finding.excerpt.split("\n").length;
-  if (finding.metric === "clones" || finding.metric === "clonesTests") {
-    return `${finding.lines ?? count} duplicated lines`;
+function codeSummary(finding2) {
+  const count = finding2.excerpt === void 0 ? 0 : finding2.excerpt.split("\n").length;
+  if (finding2.metric === "clones" || finding2.metric === "clonesTests") {
+    return `${finding2.lines ?? count} duplicated lines`;
   }
-  if (finding.excerptFirstLine === 1) return `the first ${count} lines`;
-  return `${count} lines from ${finding.excerptFirstLine ?? "?"}`;
+  if (finding2.excerptFirstLine === 1) return `the first ${count} lines`;
+  return `${count} lines from ${finding2.excerptFirstLine ?? "?"}`;
 }
-function codeBlock(finding) {
-  if (finding.excerpt === void 0) return "";
-  const first = finding.excerptFirstLine;
-  const body = first === void 0 ? escape(finding.excerpt) : finding.excerpt.split("\n").map((line, offset) => `<span class="n">${first + offset}</span>${escape(line)}`).join("\n");
+function codeBlock(finding2) {
+  if (finding2.excerpt === void 0) return "";
+  const first = finding2.excerptFirstLine;
+  const body = first === void 0 ? escape(finding2.excerpt) : finding2.excerpt.split("\n").map((line, offset) => `<span class="n">${first + offset}</span>${escape(line)}`).join("\n");
   return `          <details class="pcode">
-            <summary>${escape(codeSummary(finding))}</summary>
+            <summary>${escape(codeSummary(finding2))}</summary>
             <pre class="code">${body}</pre>
           </details>
 `;
 }
-function placeCard(finding) {
+function placeCard(finding2) {
   return `        <div class="pcard">
           <div class="phead">
-            <code class="path">${escape(finding.path)}</code>${secondSide(finding)}
-            <span class="pright">${measureOf(finding)}${ruleChip(finding.metric)}</span>
+            <code class="path">${escape(finding2.path)}</code>${secondSide(finding2)}
+            <span class="pright">${measureOf(finding2)}${ruleChip(finding2.metric)}</span>
           </div>
-${metaOf(finding)}${codeBlock(finding)}        </div>`;
+${metaOf(finding2)}${codeBlock(finding2)}        </div>`;
 }
 function placesFor(group) {
   const total = group.listed.length + group.rest;
@@ -7288,7 +8382,7 @@ function placesFor(group) {
   return `        <details class="place">
           <summary>where to look <span class="count">${grouped(total)} ${total === 1 ? "place" : "places"}</span>${capped}</summary>
           <div class="cards">
-${group.listed.map((finding) => placeCard(finding)).join("\n")}
+${group.listed.map((finding2) => placeCard(finding2)).join("\n")}
           </div>
 ${group.rest > 0 ? `          <p class="sub">The other ${group.rest} are not on this page. <code>${SCRIPTS.json}</code> writes all of them, from the same run as this one.</p>` : ""}
         </details>`;
@@ -7345,17 +8439,17 @@ var KIND_UNITS = {
   cycles: "files",
   mostImported: "imported by"
 };
-function findingRow(finding) {
-  const path2 = finding.path;
+function findingRow(finding2) {
+  const path2 = finding2.path;
   const cut = path2.lastIndexOf("/");
   const dir = cut === -1 ? "" : path2.slice(0, cut + 1);
   const file = cut === -1 ? path2 : path2.slice(cut + 1);
-  const measure = finding.value ?? finding.lines;
-  const unit = KIND_UNITS[finding.metric];
-  const haystack = [path2, finding.name, finding.other].filter(Boolean).join(" ").toLowerCase();
-  return `          <tr data-kind="${escape(kindOf2(finding.metric))}" data-find="${escape(haystack)}">
-            <td><span class="kind">${escape(kindOf2(finding.metric))}</span></td>
-            <td class="where"><span class="dir">${escape(dir)}</span><b>${escape(file)}</b>${finding.name === void 0 ? "" : `<span class="sym">${escape(finding.name)}</span>`}${finding.other === void 0 ? "" : `<span class="sym">&#8596; ${escape(finding.other)}</span>`}</td>
+  const measure = finding2.value ?? finding2.lines;
+  const unit = KIND_UNITS[finding2.metric];
+  const haystack = [path2, finding2.name, finding2.other].filter(Boolean).join(" ").toLowerCase();
+  return `          <tr data-kind="${escape(kindOf2(finding2.metric))}" data-find="${escape(haystack)}">
+            <td><span class="kind">${escape(kindOf2(finding2.metric))}</span></td>
+            <td class="where"><span class="dir">${escape(dir)}</span><b>${escape(file)}</b>${finding2.name === void 0 ? "" : `<span class="sym">${escape(finding2.name)}</span>`}${finding2.other === void 0 ? "" : `<span class="sym">&#8596; ${escape(finding2.other)}</span>`}</td>
             <td class="meas">${measure === void 0 ? "" : `<b>${escape(typeof measure === "number" ? grouped(measure) : String(measure))}</b>${unit === void 0 ? "" : `<span>${escape(unit)}</span>`}`}</td>
           </tr>`;
 }
@@ -7365,7 +8459,7 @@ function findingsPanel(report) {
     return `      <p class="read">This run produced no finding to list.</p>`;
   }
   const counts = /* @__PURE__ */ new Map();
-  for (const finding of findings) counts.set(finding.metric, (counts.get(finding.metric) ?? 0) + 1);
+  for (const finding2 of findings) counts.set(finding2.metric, (counts.get(finding2.metric) ?? 0) + 1);
   const chips = [...counts.entries()].map(
     ([metric, count]) => `<button type="button" class="fchip" data-kind="${escape(kindOf2(metric))}">${escape(kindOf2(metric))} <span>${grouped(count)}</span></button>`
   ).join("\n        ");
@@ -7388,7 +8482,7 @@ function findingsPanel(report) {
           <tr><th scope="col">Kind</th><th scope="col">Where</th><th scope="col" class="meas">Measure</th></tr>
         </thead>
         <tbody>
-${findings.map((finding) => findingRow(finding)).join("\n")}
+${findings.map((finding2) => findingRow(finding2)).join("\n")}
         </tbody>
       </table>`;
 }
@@ -7401,7 +8495,7 @@ function summaryParts(report, bold) {
   const withReference = report.rows.filter((row) => row.status !== void 0);
   const above = withReference.filter((row) => row.status === "exceed").length;
   const findings = report.findings ?? [];
-  const inTests = findings.filter((finding) => finding.metric === "clonesTests").length;
+  const inTests = findings.filter((finding2) => finding2.metric === "clonesTests").length;
   const inProduct = findings.length - inTests;
   const thresholds = withReference.length === 0 ? [] : above === 0 ? [`${bold("No threshold exceeded")}: the measured levels are within the recommended norm`] : [`${bold(`${above} threshold${above === 1 ? "" : "s"} exceeded`)}`];
   return [
@@ -7980,7 +9074,7 @@ function linesOf(cache, cwd, relative5) {
   if (cache.has(relative5)) return cache.get(relative5);
   let lines;
   try {
-    lines = readFileSync18(join24(cwd, relative5), "utf8").split("\n");
+    lines = readFileSync19(join28(cwd, relative5), "utf8").split("\n");
   } catch {
     lines = void 0;
   }
@@ -8003,16 +9097,16 @@ function declarationOf(lines, name) {
   }
   return hits.length === 1 ? hits[0] : void 0;
 }
-function windowFor(finding, lines) {
-  const { line } = pointOf(finding.path);
+function windowFor(finding2, lines) {
+  const { line } = pointOf(finding2.path);
   const head = () => ({
     firstLine: 1,
     text: lines.slice(0, WINDOW.lines).join("\n")
   });
-  if (WHOLE_FILE.has(finding.metric) || SHOWS_THE_HEAD.has(finding.metric)) return head();
-  const at = line ?? (finding.name ? declarationOf(lines, finding.name) : void 0);
+  if (WHOLE_FILE.has(finding2.metric) || SHOWS_THE_HEAD.has(finding2.metric)) return head();
+  const at = line ?? (finding2.name ? declarationOf(lines, finding2.name) : void 0);
   if (at === void 0) return void 0;
-  const nests = NESTS_UPWARD.has(finding.metric);
+  const nests = NESTS_UPWARD.has(finding2.metric);
   const from = nests ? Math.max(1, at - WINDOW.nesting.before) : at;
   const to = Math.min(lines.length, nests ? at + WINDOW.nesting.after : at + WINDOW.lines - 1);
   if (from > lines.length) return void 0;
@@ -8021,18 +9115,18 @@ function windowFor(finding, lines) {
 function withExcerpts(report, cwd) {
   const wanted = /* @__PURE__ */ new Set();
   for (const group of listedByMetric(report.findings).values()) {
-    for (const finding of group.listed) {
-      if (finding.excerpt === void 0) wanted.add(finding);
+    for (const finding2 of group.listed) {
+      if (finding2.excerpt === void 0) wanted.add(finding2);
     }
   }
   if (wanted.size === 0) return report;
   const cache = /* @__PURE__ */ new Map();
-  const findings = report.findings.map((finding) => {
-    if (!wanted.has(finding)) return finding;
-    const lines = linesOf(cache, cwd, pointOf(finding.path).file);
-    if (lines === void 0) return finding;
-    const found = windowFor(finding, lines);
-    return found === void 0 ? finding : { ...finding, excerpt: found.text, excerptFirstLine: found.firstLine };
+  const findings = report.findings.map((finding2) => {
+    if (!wanted.has(finding2)) return finding2;
+    const lines = linesOf(cache, cwd, pointOf(finding2.path).file);
+    if (lines === void 0) return finding2;
+    const found = windowFor(finding2, lines);
+    return found === void 0 ? finding2 : { ...finding2, excerpt: found.text, excerptFirstLine: found.firstLine };
   });
   return { ...report, findings };
 }
@@ -8212,7 +9306,7 @@ var SCRIPT = `(function(){
 })();`;
 
 // src/roles/static-analysis/graph/imports.ts
-import { dirname, join as join25 } from "node:path";
+import { dirname as dirname2, join as join29 } from "node:path";
 var TS_BEHIND_JS = {
   ".js": [".ts", ".tsx"],
   ".mjs": [".mts"],
@@ -8265,7 +9359,7 @@ function specifiersOf(program) {
 }
 function resolveSpecifier(from, specifier, known) {
   if (!specifier.startsWith(".")) return void 0;
-  const base = join25(dirname(from), specifier);
+  const base = join29(dirname2(from), specifier);
   if (known.has(base)) return base;
   for (const extension of RESOLVABLE_EXTENSIONS) {
     if (known.has(base + extension)) return base + extension;
@@ -8276,7 +9370,7 @@ function resolveSpecifier(from, specifier, known) {
     if (known.has(swapped)) return swapped;
   }
   for (const extension of RESOLVABLE_EXTENSIONS) {
-    const index = join25(base, `index${extension}`);
+    const index = join29(base, `index${extension}`);
     if (known.has(index)) return index;
   }
   return void 0;
@@ -8389,26 +9483,26 @@ function scanSyntax(cwd, config) {
 
 // src/roles/static-analysis/workspace/consumers.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync17, mkdirSync, readFileSync as readFileSync19, statSync as statSync5, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname2, join as join26, relative as relative4, resolve as resolve3, sep } from "node:path";
-var CACHE_DIR = join26("node_modules", ".cache", "sentinel");
+import { existsSync as existsSync19, mkdirSync as mkdirSync2, readFileSync as readFileSync20, statSync as statSync6, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname3, join as join30, relative as relative4, resolve as resolve3, sep } from "node:path";
+var CACHE_DIR = join30("node_modules", ".cache", "sentinel");
 var CACHE_FILE = "consumer-index.json";
 var SHAPE = 4;
 function workspaceRootFrom(cwd) {
   let dir = resolve3(cwd);
   for (; ; ) {
-    if (existsSync17(join26(dir, WORKSPACE_ROOT_MARKER))) return dir;
-    const parent = dirname2(dir);
+    if (existsSync19(join30(dir, WORKSPACE_ROOT_MARKER))) return dir;
+    const parent = dirname3(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function aliasTable(workspaceRoot) {
-  const file = join26(workspaceRoot, "tsconfig.base.json");
-  if (!existsSync17(file)) return /* @__PURE__ */ new Map();
+  const file = join30(workspaceRoot, "tsconfig.base.json");
+  if (!existsSync19(file)) return /* @__PURE__ */ new Map();
   let paths;
   try {
-    const parsed = JSON.parse(readFileSync19(file, "utf8"));
+    const parsed = JSON.parse(readFileSync20(file, "utf8"));
     paths = parsed.compilerOptions?.paths ?? {};
   } catch {
     return /* @__PURE__ */ new Map();
@@ -8426,7 +9520,7 @@ function aliasTable(workspaceRoot) {
 function resolveSpecifier2(specifier, table, workspaceRoot) {
   const isFile = (candidate) => {
     try {
-      return statSync5(join26(workspaceRoot, candidate)).isFile();
+      return statSync6(join30(workspaceRoot, candidate)).isFile();
     } catch {
       return false;
     }
@@ -8463,11 +9557,11 @@ function resolveSpecifier2(specifier, table, workspaceRoot) {
   return void 0;
 }
 function resolveRelative(importer, specifier, workspaceRoot) {
-  const base = join26(dirname2(importer), specifier).split(sep).join("/");
+  const base = join30(dirname3(importer), specifier).split(sep).join("/");
   if (base.startsWith("..")) return void 0;
   const isFile = (candidate) => {
     try {
-      return statSync5(join26(workspaceRoot, candidate)).isFile();
+      return statSync6(join30(workspaceRoot, candidate)).isFile();
     } catch {
       return false;
     }
@@ -8565,10 +9659,10 @@ function hash(text) {
 }
 function consumerIndex(workspaceRoot, moduleRoots) {
   const key = cacheKey(workspaceRoot);
-  const file = join26(workspaceRoot, CACHE_DIR, CACHE_FILE);
-  if (key && existsSync17(file)) {
+  const file = join30(workspaceRoot, CACHE_DIR, CACHE_FILE);
+  if (key && existsSync19(file)) {
     try {
-      const cached = JSON.parse(readFileSync19(file, "utf8"));
+      const cached = JSON.parse(readFileSync20(file, "utf8"));
       if (cached.key === key) {
         return {
           imported: new Set(cached.imported),
@@ -8582,14 +9676,14 @@ function consumerIndex(workspaceRoot, moduleRoots) {
   const index = buildConsumerIndex(workspaceRoot, moduleRoots());
   if (key) {
     try {
-      mkdirSync(join26(workspaceRoot, CACHE_DIR), { recursive: true });
+      mkdirSync2(join30(workspaceRoot, CACHE_DIR), { recursive: true });
       const payload = {
         key,
         imported: [...index.imported],
         testOnly: [...index.testOnly],
         builtFrom: index.builtFrom
       };
-      writeFileSync6(file, JSON.stringify(payload), "utf8");
+      writeFileSync7(file, JSON.stringify(payload), "utf8");
     } catch {
     }
   }
@@ -8686,7 +9780,7 @@ var JscpdAdapter = class extends BaseAdapter {
       operations: [
         // `write` and not `merge-json`: this file is code, and the engine's in-place merge is for
         // JSON. A re-init therefore RESTORES the stub, so an existing one is left alone below.
-        ...existsSync18(join27(context2.cwd, STATIC_CONFIG_FILE)) ? [] : [{ kind: "write", path: STATIC_CONFIG_FILE, contents: configStub() }],
+        ...existsSync20(join31(context2.cwd, STATIC_CONFIG_FILE)) ? [] : [{ kind: "write", path: STATIC_CONFIG_FILE, contents: configStub() }],
         manifestOperation(context2.cwd, scripts()),
         ...nxTargetOperations({ cwd: context2.cwd, targets: targets() })
         // The report directory is ignored ONCE at the workspace root, by `--init`'s workspace prep,
@@ -8803,7 +9897,7 @@ var JscpdAdapter = class extends BaseAdapter {
       const written = [];
       for (const shape of shapes)
         written.push(...await emit(report, shape, ctx.cwd, graph, coverage));
-      process.stdout.write(renderConsole(report));
+      process.stdout.write(renderConsole2(report));
       if (written.length > 0) process.stdout.write(`
   written: ${written.join(", ")}
 `);
@@ -8936,7 +10030,7 @@ var JscpdAdapter = class extends BaseAdapter {
     const declared = moduleScripts(ctx.cwd);
     const missing = Object.keys(scripts()).filter((name) => !(name in declared));
     const adopted = missing.length < Object.keys(scripts()).length;
-    const hasConfig = existsSync18(join27(ctx.cwd, STATIC_CONFIG_FILE));
+    const hasConfig = existsSync20(join31(ctx.cwd, STATIC_CONFIG_FILE));
     return {
       adopted,
       preset: adopted ? ctx.preset : null,
@@ -9028,15 +10122,15 @@ function runDeadCode(jscpd, config, paths, cwd, extraEntries = []) {
   try {
     const ran = runTool(jscpd, args, cwd, "dead-code");
     if (ran.kind !== "ran") return ran;
-    const path2 = join27(rawReportDir, RAW_REPORT["dead-code"]);
-    if (!existsSync18(path2)) {
+    const path2 = join31(rawReportDir, RAW_REPORT["dead-code"]);
+    if (!existsSync20(path2)) {
       process.stderr.write(
         `sentinel static-analysis(jscpd): the dead-code pass wrote no ${RAW_REPORT["dead-code"]}
 `
       );
       return { kind: "failed", code: 1 };
     }
-    const parsed = safeParseDeadCode(readFileSync20(path2, "utf8"));
+    const parsed = safeParseDeadCode(readFileSync21(path2, "utf8"));
     const statistics = parsed?.statistics;
     if (!statistics) {
       process.stderr.write(
@@ -9049,8 +10143,8 @@ function runDeadCode(jscpd, config, paths, cwd, extraEntries = []) {
       return { kind: "no-entry-point", files: statistics.files ?? 0 };
     }
     const byCategory = {};
-    for (const finding of parsed?.findings ?? []) {
-      const category = finding.category ?? "unknown";
+    for (const finding2 of parsed?.findings ?? []) {
+      const category = finding2.category ?? "unknown";
       byCategory[category] = (byCategory[category] ?? 0) + 1;
     }
     return { kind: "figures", statistics, byCategory, findings: parsed?.findings ?? [] };
@@ -9059,11 +10153,11 @@ function runDeadCode(jscpd, config, paths, cwd, extraEntries = []) {
   }
 }
 function moduleRelative(name, roots, cwd) {
-  if (existsSync18(join27(cwd, name))) return name;
+  if (existsSync20(join31(cwd, name))) return name;
   for (const root of roots) {
     if (root === ".") continue;
     const candidate = `${root}/${name}`;
-    if (existsSync18(join27(cwd, candidate))) return candidate;
+    if (existsSync20(join31(cwd, candidate))) return candidate;
   }
   return name;
 }
@@ -9072,8 +10166,8 @@ function runDuplication(jscpd, config, paths, scope, cwd) {
   try {
     const ran = runTool(jscpd, args, cwd, scope);
     if (ran.kind !== "ran") return ran;
-    const path2 = join27(rawReportDir, RAW_REPORT.duplication);
-    const parsed = existsSync18(path2) ? safeParse(readFileSync20(path2, "utf8")) : void 0;
+    const path2 = join31(rawReportDir, RAW_REPORT.duplication);
+    const parsed = existsSync20(path2) ? safeParse(readFileSync21(path2, "utf8")) : void 0;
     const total = parsed?.statistics?.total;
     if (!total) {
       process.stderr.write(
@@ -9137,7 +10231,7 @@ function placesToLook(product, tests, dead, complexity, graph, size, outsideTest
   const toolTestOnlyPaths = new Set(
     dead.kind === "figures" ? dead.findings.filter((f) => f.category === "unused-file" && f.reasons?.includes("used-only-by-tests")).map((f) => f.path ?? "").filter(Boolean) : []
   );
-  const metricOf = (finding) => finding.category === "unused-file" && finding.reasons?.includes("used-only-by-tests") === true ? "usedOnlyByTests" : deadMetric[finding.category ?? ""] ?? "deadLinesPercent";
+  const metricOf = (finding2) => finding2.category === "unused-file" && finding2.reasons?.includes("used-only-by-tests") === true ? "usedOnlyByTests" : deadMetric[finding2.category ?? ""] ?? "deadLinesPercent";
   const weight = (f) => f.value ?? f.lines ?? 0;
   const inOrder = (all2) => [...all2].sort(
     (left, right) => left.metric.localeCompare(right.metric) || weight(right) - weight(left) || left.path.localeCompare(right.path) || (left.other ?? "").localeCompare(right.other ?? "")
@@ -9152,14 +10246,14 @@ function placesToLook(product, tests, dead, complexity, graph, size, outsideTest
       name: fn.name,
       value: fn.complexity
     })),
-    ...dead.kind === "figures" && !unreadable ? dead.findings.map((finding) => ({
-      metric: metricOf(finding),
-      path: finding.path ?? "(unknown)",
-      ...finding.name ? { name: finding.name } : {},
-      ...finding.lines === void 0 ? {} : { lines: finding.lines },
-      ...finding.confidence === void 0 ? {} : { confidence: finding.confidence },
-      ...finding.reasons?.length ? { reason: finding.reasons.join(", ") } : {},
-      ...finding.message ? { message: finding.message } : {}
+    ...dead.kind === "figures" && !unreadable ? dead.findings.map((finding2) => ({
+      metric: metricOf(finding2),
+      path: finding2.path ?? "(unknown)",
+      ...finding2.name ? { name: finding2.name } : {},
+      ...finding2.lines === void 0 ? {} : { lines: finding2.lines },
+      ...finding2.confidence === void 0 ? {} : { confidence: finding2.confidence },
+      ...finding2.reasons?.length ? { reason: finding2.reasons.join(", ") } : {},
+      ...finding2.message ? { message: finding2.message } : {}
     })) : [],
     /*
      * The files the workspace index found, which the tool cannot see.
@@ -9242,8 +10336,8 @@ function outsideOf(cwd) {
 function moduleRootsOf(workspaceRoot) {
   const roots = [];
   for (const area of ["apps", "libs"]) {
-    const base = join27(workspaceRoot, area);
-    if (!existsSync18(base)) continue;
+    const base = join31(workspaceRoot, area);
+    if (!existsSync20(base)) continue;
     for (const entry of globSync5([`${area}/**/package.json`, `${area}/**/project.json`], {
       cwd: workspaceRoot,
       ignore: ["**/node_modules/**"],
@@ -9400,8 +10494,8 @@ function assembleReport({
   }
   const toolTestOnly = new Set(
     dead.kind === "figures" ? dead.findings.filter(
-      (finding) => finding.category === "unused-file" && finding.reasons?.includes("used-only-by-tests") === true
-    ).map((finding) => finding.path ?? "").filter(Boolean) : []
+      (finding2) => finding2.category === "unused-file" && finding2.reasons?.includes("used-only-by-tests") === true
+    ).map((finding2) => finding2.path ?? "").filter(Boolean) : []
   );
   if (dead.kind === "figures" && !unreadable) {
     const stats = dead.statistics;
@@ -9576,23 +10670,23 @@ function assembleReport({
     byLanguage
   };
 }
-var SHAPE_FILE = {
+var SHAPE_FILE2 = {
   json: `${TARGET}.json`,
   html: `${TARGET}.html`,
   markdown: `${TARGET}.md`
 };
 var PICTURE_FILE = `${TARGET}-graph.svg`;
 function clearStaleOutputs(cwd, keeping) {
-  for (const name of [...Object.values(SHAPE_FILE), PICTURE_FILE]) {
+  for (const name of [...Object.values(SHAPE_FILE2), PICTURE_FILE]) {
     if (keeping.has(name)) continue;
-    const path2 = join27(cwd, REPORT_DIR, name);
-    if (existsSync18(path2)) unlinkSync(path2);
+    const path2 = join31(cwd, REPORT_DIR, name);
+    if (existsSync20(path2)) unlinkSync2(path2);
   }
 }
 function outputsOf(shapes, graph, coverage) {
   const keeping = /* @__PURE__ */ new Set();
   for (const shape of shapes) {
-    const name = SHAPE_FILE[shape];
+    const name = SHAPE_FILE2[shape];
     if (name !== void 0) keeping.add(name);
   }
   if (shapes.includes("html") && drawsPicture(graph, coverage)) keeping.add(PICTURE_FILE);
@@ -9604,19 +10698,19 @@ function drawsPicture(graph, coverage) {
 async function emit(report, shape, cwd, graph, coverage) {
   if (shape === "console") return [];
   const detailed = shape === "markdown" ? report : withExcerpts(report, cwd);
-  mkdirSync2(join27(cwd, REPORT_DIR), { recursive: true });
+  mkdirSync3(join31(cwd, REPORT_DIR), { recursive: true });
   const written = [];
   if (shape === "html" && drawsPicture(graph, coverage)) {
     const drawn = layOut(graph.graph, graph.communityOf);
-    const path2 = join27(cwd, REPORT_DIR, PICTURE_FILE);
+    const path2 = join31(cwd, REPORT_DIR, PICTURE_FILE);
     await writeGraphPicture(drawn, path2);
     written.push(`${REPORT_DIR}/${PICTURE_FILE}`);
     detailed.picture = buildExplorer(drawn, graph.communityOf).markup;
   }
-  const RENDER = { json: renderJson, html: renderHtml, markdown: renderMarkdown };
-  const name = SHAPE_FILE[shape] ?? `${TARGET}.${shape}`;
+  const RENDER = { json: renderJson2, html: renderHtml, markdown: renderMarkdown2 };
+  const name = SHAPE_FILE2[shape] ?? `${TARGET}.${shape}`;
   const body = RENDER[shape](detailed);
-  writeFileSync7(join27(cwd, REPORT_DIR, name), body, "utf8");
+  writeFileSync8(join31(cwd, REPORT_DIR, name), body, "utf8");
   written.unshift(`${REPORT_DIR}/${name}`);
   return written;
 }
@@ -9650,9 +10744,9 @@ function registerTest() {
 
 // src/roles/typescript/adapters/tsc/tsc.adapter.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync19, readFileSync as readFileSync22 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync23 } from "node:fs";
 import { createRequire } from "node:module";
-import { join as join29 } from "node:path";
+import { join as join33 } from "node:path";
 
 // src/roles/typescript/presets/nest.json
 var nest_default2 = {
@@ -9704,7 +10798,7 @@ var react_default2 = {
 };
 
 // src/roles/typescript/presets/shared.json
-var shared_default2 = {
+var shared_default3 = {
   $schema: "https://json.schemastore.org/tsconfig",
   compilerOptions: {
     strict: true,
@@ -9730,7 +10824,7 @@ var shared_default2 = {
 };
 
 // src/roles/typescript/preset-data.ts
-var SHARED = shared_default2;
+var SHARED = shared_default3;
 var LAYERS = {
   nest: nest_default2,
   node: node_default2,
@@ -9837,8 +10931,8 @@ function readTsconfigAdoption(cwd) {
 }
 
 // src/roles/typescript/adapters/tsc/plan.ts
-import { readFileSync as readFileSync21 } from "node:fs";
-import { join as join28 } from "node:path";
+import { readFileSync as readFileSync22 } from "node:fs";
+import { join as join32 } from "node:path";
 
 // src/roles/typescript/typecheck-script.ts
 var SENTINEL_TYPECHECK_COMMAND = "sentinel --run --typescript";
@@ -9931,7 +11025,7 @@ function planAdoption(context2) {
     };
   }
   const existing = parseJsonc(
-    readFileSync21(join28(context2.cwd, target.path), "utf8"),
+    readFileSync22(join32(context2.cwd, target.path), "utf8"),
     target.path
   );
   const extendsChain = composeExtends(existing.extends, preset);
@@ -10069,7 +11163,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     let chain;
     try {
       const parsed = parseJsonc(
-        readFileSync22(join29(cwd, target.path), "utf8"),
+        readFileSync23(join33(cwd, target.path), "utf8"),
         target.path
       );
       chain = parsed.extends;
@@ -10082,7 +11176,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
     );
     if (preset === void 0) return void 0;
     try {
-      createRequire(join29(cwd, "noop.js")).resolve(preset);
+      createRequire(join33(cwd, "noop.js")).resolve(preset);
       return void 0;
     } catch {
       return preset;
@@ -10178,7 +11272,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
   referencedProjects(cwd, config) {
     try {
       const parsed = parseJsonc(
-        readFileSync22(join29(cwd, config), "utf8"),
+        readFileSync23(join33(cwd, config), "utf8"),
         config
       );
       const referenced = (parsed.references ?? []).map((reference) => reference.path).filter((path2) => typeof path2 === "string" && path2.length > 0);
@@ -10194,7 +11288,7 @@ var TscAdapter = class _TscAdapter extends BaseAdapter {
    * check.
    */
   typecheckTarget(cwd) {
-    if (existsSync19(join29(cwd, "tsconfig.json"))) return "tsconfig.json";
+    if (existsSync21(join33(cwd, "tsconfig.json"))) return "tsconfig.json";
     const target = resolveTsconfigTarget(cwd);
     return target.reason === "none" ? null : target.path;
   }
@@ -10319,6 +11413,7 @@ function registerAdapters() {
   registerBuild();
   registerTest();
   registerStaticAnalysis();
+  registerEnv();
 }
 
 // src/core/detect-framework.ts
@@ -10365,12 +11460,12 @@ function diffLines(before, after) {
     { length: from.length + 1 },
     () => new Array(to.length + 1).fill(0)
   );
-  const cell = (i2, j2) => lcs[i2]?.[j2] ?? 0;
+  const cell2 = (i2, j2) => lcs[i2]?.[j2] ?? 0;
   for (let i2 = from.length - 1; i2 >= 0; i2--) {
     const row = lcs[i2];
     if (!row) continue;
     for (let j2 = to.length - 1; j2 >= 0; j2--) {
-      row[j2] = from[i2] === to[j2] ? cell(i2 + 1, j2 + 1) + 1 : Math.max(cell(i2 + 1, j2), cell(i2, j2 + 1));
+      row[j2] = from[i2] === to[j2] ? cell2(i2 + 1, j2 + 1) + 1 : Math.max(cell2(i2 + 1, j2), cell2(i2, j2 + 1));
     }
   }
   const out = [];
@@ -10381,7 +11476,7 @@ function diffLines(before, after) {
       out.push(`  ${from[i] ?? ""}`);
       i++;
       j++;
-    } else if (cell(i + 1, j) >= cell(i, j + 1)) {
+    } else if (cell2(i + 1, j) >= cell2(i, j + 1)) {
       out.push(`- ${from[i] ?? ""}`);
       i++;
     } else {
@@ -10400,7 +11495,7 @@ function replaceLines(current, replacements) {
 }
 
 // src/core/apply-plan.ts
-import { existsSync as existsSync20, readFileSync as readFileSync23, renameSync, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync24, renameSync, rmSync as rmSync5, writeFileSync as writeFileSync9 } from "node:fs";
 import { resolve as resolve4, sep as sep2 } from "node:path";
 import { applyEdits, findNodeAtLocation, modify, parseTree } from "jsonc-parser";
 function resolveWithinRoot(cwd, relativePath) {
@@ -10412,7 +11507,7 @@ function resolveWithinRoot(cwd, relativePath) {
   return absolutePath;
 }
 function readIfExists(absolutePath) {
-  return existsSync20(absolutePath) ? readFileSync23(absolutePath, "utf8") : void 0;
+  return existsSync22(absolutePath) ? readFileSync24(absolutePath, "utf8") : void 0;
 }
 function* leaves(value, prefix = []) {
   for (const [key, keyValue] of Object.entries(value)) {
@@ -10514,7 +11609,7 @@ function preparePlan(cwd, plan3) {
 }
 function writeFileAtomic(absolutePath, contents) {
   const tempPath = `${absolutePath}.sentinel-${process.pid}.tmp`;
-  writeFileSync8(tempPath, contents);
+  writeFileSync9(tempPath, contents);
   renameSync(tempPath, absolutePath);
 }
 function applyPlan(cwd, plan3) {
@@ -10530,8 +11625,8 @@ function applyPlan(cwd, plan3) {
 }
 
 // src/core/config/preset-evidence.ts
-import { existsSync as existsSync21, readdirSync as readdirSync3, readFileSync as readFileSync24 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync23, readdirSync as readdirSync3, readFileSync as readFileSync25 } from "node:fs";
+import { join as join34 } from "node:path";
 var PATH_SIGNALS = [
   {
     preset: "nest",
@@ -10565,12 +11660,12 @@ function sourceImports(cwd, pattern) {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!NOT_SCANNED.has(entry.name)) stack.push(join30(dir, entry.name));
+        if (!NOT_SCANNED.has(entry.name)) stack.push(join34(dir, entry.name));
         continue;
       }
       if (!SOURCE_FILE.test(entry.name)) continue;
       try {
-        if (pattern.test(readFileSync24(join30(dir, entry.name), "utf8"))) return true;
+        if (pattern.test(readFileSync25(join34(dir, entry.name), "utf8"))) return true;
       } catch {
         continue;
       }
@@ -10579,11 +11674,11 @@ function sourceImports(cwd, pattern) {
   return false;
 }
 function dependencyNames(cwd) {
-  const path2 = join30(cwd, "package.json");
-  if (!existsSync21(path2)) return [];
+  const path2 = join34(cwd, "package.json");
+  if (!existsSync23(path2)) return [];
   try {
     const manifest = parseJsonc(
-      readFileSync24(path2, "utf8"),
+      readFileSync25(path2, "utf8"),
       path2
     );
     return [
@@ -10606,7 +11701,7 @@ function reactTsconfigEvidence(cwd) {
   }
   for (const name of entries) {
     try {
-      const config = parseJsonc(readFileSync24(join30(cwd, name), "utf8"), name);
+      const config = parseJsonc(readFileSync25(join34(cwd, name), "utf8"), name);
       if (config.compilerOptions?.jsx !== void 0) return 'its tsconfig sets "jsx"';
       const extended = Array.isArray(config.extends) ? config.extends : config.extends === void 0 ? [] : [config.extends];
       if (extended.some((entry) => entry === REACT_TYPESCRIPT_PRESET)) {
@@ -10813,6 +11908,7 @@ export {
   resolve,
   buildConfigFile,
   palette,
+  ENV_SHAPES,
   presetNotInstalledYet,
   registerAdapters,
   correctingSignal,