@hublo/sentinel 1.6.0-alpha.0 → 1.6.0-alpha.2

package/dist/{chunk-PC5R4DX5.js → chunk-R7DS7VN4.js}

@@ -9,6 +9,7 @@ import {
   LINT_BASELINE_SPECIFIER,
   LINT_CONFIG_FILE,
   LINT_MEASURE_FILE,
+  LINT_PRESETS,
   LINT_SCRIPT_NAME,
   OWNED_WHEN_SET_KEYS,
   PERMITTED_LOCAL_KEYS,
@@ -23,17 +24,24 @@ import {
   canonicalRuleName,
   describeHolds,
   describeRuleKey,
+  disabledFor,
+  downgradedFor,
   extendsWithBaseline,
   extendsWithPreset,
   formatPresetFor,
   formatPresetName,
   formatTargets,
+  governedRules,
+  hasLintPreset,
   heldRules,
   holdsFrom,
+  isOffRuleValue,
   isSentinelPreset,
+  lintPresetFor,
   lintTarget,
   localOnlyKeys,
   manifestOperation,
+  moduleOwnBlocks,
   moduleScripts,
   nxTargetOperations,
   oxfmtRejects,
@@ -48,6 +56,7 @@ import {
   readAdoption,
   readFormatAdoption,
   readLintAdoption,
+  readModuleAdditions,
   renderBaseline,
   resolveBin,
   resolveConfigTarget,
@@ -57,9 +66,10 @@ import {
   scriptPath,
   selfCommand,
   splitToolArgs,
+  uncoveredFor,
   walk,
   writtenFileFormatter
-} from "./chunk-P7NYSMLS.js";
+} from "./chunk-67QLOX6F.js";
 import {
   DEFAULT_MAX_DIAGNOSTICS,
   WORKSPACE_ROOT_MARKER,
@@ -84,7 +94,7 @@ import {
 } from "./chunk-7E6YTTAK.js";
 import {
   defineEnv
-} from "./chunk-NAFI7OLI.js";
+} from "./chunk-4EIY7TTR.js";
 import {
   globToRegExp
 } from "./chunk-O7REVMOC.js";
@@ -192,7 +202,15 @@ var shared_default = {
       ".spec.js",
       ".test.js",
       ".spec.jsx",
-      ".test.jsx"
+      ".test.jsx",
+      ".spec.mts",
+      ".test.mts",
+      ".spec.cts",
+      ".test.cts",
+      ".spec.mjs",
+      ".test.mjs",
+      ".spec.cjs",
+      ".test.cjs"
     ],
     excludeDirs: ["node_modules", "dist"]
   },
@@ -1400,16 +1418,25 @@ function deriveVars(files, readers) {
   return { required, optional };
 }
 var ENV_LINE = /^(?:export\s+)?([\w.-]+)\s*=(.*)$/;
-function isBlankValue(value) {
-  const trimmed = value.trim();
-  const quoted = /^(['"])(.*)\1$/.exec(trimmed);
-  return (quoted ? quoted[2] : trimmed) === "";
-}
-function openQuote(value) {
-  const trimmed = value.trim();
-  const quote = trimmed[0];
-  if (quote !== '"' && quote !== "'" && quote !== "`") return void 0;
-  return trimmed.length > 1 && trimmed.endsWith(quote) ? void 0 : quote;
+var QUOTES = /* @__PURE__ */ new Set(['"', "'", "`"]);
+function closingQuote(text, quote, from) {
+  for (let index = from; index < text.length; index += 1) {
+    if (text[index] === "\\" && text[index + 1] === quote) index += 1;
+    else if (text[index] === quote) return index;
+  }
+  return -1;
+}
+function readValue(raw) {
+  const value = raw.trimStart();
+  const quote = value[0];
+  if (quote !== void 0 && QUOTES.has(quote)) {
+    const end = closingQuote(value, quote, 1);
+    if (end === -1) return { blank: false, opens: quote };
+    const rest = value.slice(end + 1).trim();
+    return { blank: end === 1 && (rest === "" || rest.startsWith("#")) };
+  }
+  const comment = /\s#/.exec(raw);
+  return { blank: (comment ? raw.slice(0, comment.index) : raw).trim() === "" };
 }
 function parseEnvFile(content) {
   const entries = [];
@@ -1418,15 +1445,15 @@ function parseEnvFile(content) {
   for (const [index, rawLine] of lines.entries()) {
     const line = rawLine.trim();
     if (closing !== void 0) {
-      if (line.endsWith(closing)) closing = void 0;
+      if (closingQuote(line, closing, 0) !== -1) closing = void 0;
       continue;
     }
     if (line === "" || line.startsWith("#")) continue;
     const match = ENV_LINE.exec(line);
     if (!match) continue;
-    const value = match[2] ?? "";
-    entries.push({ key: match[1] ?? "", line: index + 1, blank: isBlankValue(value) });
-    closing = openQuote(value);
+    const { blank, opens } = readValue(match[2] ?? "");
+    entries.push({ key: match[1] ?? "", line: index + 1, blank });
+    closing = opens;
   }
   return {
     entries,
@@ -2267,9 +2294,15 @@ function escapeData(text) {
 function escapeProperty(text) {
   return escapeData(text).replace(/:/g, "%3A").replace(/,/g, "%2C");
 }
+var GITHUB_ANNOTATION_CAP = 10;
+function summaryAnnotation(command, count, level) {
+  const what = command === "error" ? "blocking findings" : level === "error" ? "advisory findings" : "findings";
+  const message = `${count} ${what} (GitHub shows at most ${GITHUB_ANNOTATION_CAP} ${command} annotations per step): the full list is in the env report, in this step's log, and in env-report/env.md with --output markdown`;
+  return `::${command} title=${escapeProperty(`env: ${count} ${what}`)}::${escapeData(message)}`;
+}
 function renderAnnotations(report) {
   if (report.level === "info") return [];
-  return report.findings.filter((entry) => entry.severity !== "info").map((entry) => {
+  const annotations = report.findings.filter((entry) => entry.severity !== "info").map((entry) => {
     const command = report.level === "error" && entry.severity === "blocking" ? "error" : "warning";
     const properties = [
       entry.file === void 0 ? void 0 : `file=${escapeProperty(entry.file)}`,
@@ -2277,8 +2310,13 @@ function renderAnnotations(report) {
       `title=${escapeProperty(`env rule ${entry.number}: ${entry.rule}`)}`
     ].filter(Boolean);
     const message = `${entry.name}${entry.detail ? ` (${entry.detail})` : ""}: ${RULES[entry.rule].help}`;
-    return `::${command} ${properties.join(",")}::${escapeData(message)}`;
+    return { command, line: `::${command} ${properties.join(",")}::${escapeData(message)}` };
   });
+  const summaries = ["error", "warning"].flatMap((command) => {
+    const count = annotations.filter((entry) => entry.command === command).length;
+    return count > GITHUB_ANNOTATION_CAP ? [summaryAnnotation(command, count, report.level)] : [];
+  });
+  return [...summaries, ...annotations.map((entry) => entry.line)];
 }
 
 // src/roles/env/adapters/conformance/conformance.adapter.ts
@@ -2311,6 +2349,10 @@ function writeShapes(root, report, shapes) {
     return `${REPORT_DIR2}/${name}`;
   });
 }
+function oneLine(message) {
+  const [head = "", ...rest] = message.split("\n").map((line) => line.trim().replace(/^- /, "")).filter((line) => line !== "");
+  return rest.length === 0 ? head : `${head} ${rest.join("; ")}`;
+}
 var ConformanceAdapter = class extends BaseAdapter {
   target = TARGET2;
   runner = "conformance";
@@ -2345,17 +2387,17 @@ var ConformanceAdapter = class extends BaseAdapter {
         `writes ${ENV_SHAPES.join(", ")}; not ${unknown.join(", ")}, which another role may write.`
       );
     }
+    const refuse = (message) => {
+      this.say(message);
+      return { ok: false, code: 1, metrics: { level, error: oneLine(message) } };
+    };
     const { settings, from, unreadable } = await loadEnvConfig(ctx.cwd);
-    if (unreadable) {
-      this.say(unreadable);
-      return { ok: false, code: 1 };
-    }
+    if (unreadable) return refuse(unreadable);
     let report;
     try {
       report = collectEnvReport(openRepository(ctx.cwd), settings, level, from);
     } catch (error) {
-      this.say(error instanceof Error ? error.message : String(error));
-      return { ok: false, code: 1 };
+      return refuse(error instanceof Error ? error.message : String(error));
     }
     if (printing) {
       const written = writeShapes(ctx.cwd, report, known);
@@ -3214,2516 +3256,92 @@ var OxfmtAdapter = class extends BaseAdapter {
    * linter is about to change. An existing format segment is left exactly where the module
    * already had it, since moving it would be churn for no gain.
    *
-   * The dedicated `format` / `format:fix` scripts stay, for running the formatter alone.
-   */
-  joinFormatIntoLint(original, rewritten, selfCommand2) {
-    const command = selfCommand2 ?? SENTINEL_FORMAT_COMMAND;
-    for (const [name, keepFix] of [
-      ["lint", false],
-      ["lint:fix", true]
-    ]) {
-      const script = rewritten[name] ?? original[name];
-      if (!script || script.trim() === "") continue;
-      if (invokesFormat(script)) continue;
-      rewritten[name] = `${script} && ${keepFix ? `${command} --fix` : command}`;
-    }
-    return rewritten;
-  }
-};
-
-// src/roles/format/register.ts
-function registerFormat() {
-  register(new OxfmtAdapter());
-  setDefaultRunner("format", "oxfmt");
-}
-
-// src/roles/lint/adapters/oxlint/oxlint.adapter.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync15, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join21 } from "node:path";
-
-// src/core/config/deferred-rules.ts
-function deferredRuleNames(rules) {
-  return rules.map((entry) => entry.rule);
-}
-
-// src/core/fix-report.ts
-import { statSync as statSync3 } from "node:fs";
-import { join as join16 } from "node:path";
-var CONFIG_REFUSED = /failed to parse .*config|invalid config file/i;
-function readFailure(output) {
-  const lines = output.split("\n").map((line2) => line2.trim());
-  if (!lines.some((line2) => CONFIG_REFUSED.test(line2))) return void 0;
-  const detail = lines.find((line2) => /invalid config file/i.test(line2));
-  const line = (detail ?? lines.find((entry) => entry !== "") ?? "").replace(/^x\s*/, "");
-  return line.split(/:\s*Failed to parse config/i)[0] ?? line;
-}
-function fingerprint(path2) {
-  try {
-    const stat = statSync3(path2);
-    return `${stat.size}:${stat.mtimeMs}`;
-  } catch {
-    return void 0;
-  }
-}
-function snapshotFiles(cwd, extensions) {
-  const snapshot = /* @__PURE__ */ new Map();
-  for (const file of listSourceFiles(cwd, extensions)) {
-    const mark = fingerprint(join16(cwd, file));
-    if (mark !== void 0) snapshot.set(file, mark);
-  }
-  return snapshot;
-}
-function changedSince(cwd, before, extensions) {
-  const changed = [];
-  for (const file of listSourceFiles(cwd, extensions)) {
-    const now = fingerprint(join16(cwd, file));
-    if (now === void 0) continue;
-    if (before.get(file) !== now) changed.push(file);
-  }
-  return changed.sort();
-}
-var NAMED_IN_REPORT = 5;
-var NOT_INSTALLED_YET = /invalid config file[\s\S]*node_modules/i;
-function presetNotInstalledYet(failure) {
-  return NOT_INSTALLED_YET.test(failure);
-}
-function describeFixOutcome(outcome, toolLabel) {
-  if (outcome.failure !== void 0) {
-    if (NOT_INSTALLED_YET.test(outcome.failure)) {
-      return `the ${toolLabel} preset is not installed in this module yet, which is expected: this command just added it and the install comes next. Nothing was fixed. Run \`pnpm install\`, then \`sentinel --run --${toolLabel} --fix\` to clear what a machine can clear.`;
-    }
-    return `the ${toolLabel} autofix could not run, so nothing was fixed and this module has not been checked: ${outcome.failure}`;
-  }
-  if (outcome.changed.length === 0) return `the ${toolLabel} autofix changed nothing`;
-  const named = outcome.changed.slice(0, NAMED_IN_REPORT).join(", ");
-  const rest = outcome.changed.length - NAMED_IN_REPORT;
-  const listed = rest > 0 ? `${named} and ${rest} more` : named;
-  return `the ${toolLabel} autofix rewrote ${outcome.changed.length} file${outcome.changed.length === 1 ? "" : "s"}: ${listed}. Review the diff before committing: rules this module used to have switched off are enforced from now on.`;
-}
-
-// src/roles/lint/presets/nest.json
-var nest_default = {
-  plugins: ["typescript", "jest", "vitest", "import", "unicorn", "oxc", "node"],
-  jsPlugins: [
-    "eslint-plugin-no-barrel-files",
-    {
-      name: "nx",
-      specifier: "@nx/eslint-plugin"
-    }
-  ],
-  settings: null,
-  rules: {
-    "array-callback-return": [
-      "error",
-      {
-        allowImplicit: false,
-        checkForEach: false,
-        allowVoid: false
-      }
-    ],
-    complexity: ["error", 30],
-    curly: ["error", "all"],
-    "dot-notation": [
-      "error",
-      {
-        allowKeywords: true,
-        allowPattern: ""
-      }
-    ],
-    eqeqeq: {
-      severity: "warn",
-      reason: "1 pre-existing violation(s) across one module, and they were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero."
-    },
-    "for-direction": "error",
-    "func-style": {
-      severity: "warn",
-      reason: "58 pre-existing violation(s) across network and contract, and they were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero.",
-      options: [
-        "expression",
-        {
-          allowArrowFunctions: false,
-          allowTypeAnnotation: false,
-          overrides: {}
-        }
-      ]
-    },
-    "import/no-duplicates": [
-      "error",
-      {
-        considerQueryString: true,
-        "prefer-inline": true
-      }
-    ],
-    "jest/expect-expect": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-alias-methods": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-commented-out-tests": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-deprecated-functions": "error",
-    "jest/no-disabled-tests": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-done-callback": "error",
-    "jest/no-export": "error",
-    "jest/no-focused-tests": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-identical-title": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-interpolation-in-snapshots": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-jasmine-globals": "error",
-    "jest/no-mocks-import": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-standalone-expect": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-test-prefixes": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/prefer-to-be": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/prefer-to-contain": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/prefer-to-have-length": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/valid-describe-callback": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/valid-expect": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/valid-expect-in-promise": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/valid-title": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "no-async-promise-executor": "error",
-    "no-barrel-files/no-barrel-files": {
-      severity: "off",
-      reason: "nest modules use barrel index.ts files as a deliberate structural pattern; the rule fired 127 times and every one was the architecture working as intended"
-    },
-    "no-case-declarations": "error",
-    "no-compare-neg-zero": "error",
-    "no-cond-assign": ["error", "except-parens"],
-    "no-console": {
-      severity: "warn",
-      reason: "61 pre-existing violation(s) across network, db-client-management and others, and they were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero.",
-      options: [
-        {
-          allow: ["warn", "error"]
-        }
-      ]
-    },
-    "no-constant-binary-expression": "error",
-    "no-constant-condition": [
-      "error",
-      {
-        checkLoops: "allExceptWhileTrue"
-      }
-    ],
-    "no-control-regex": {
-      severity: "off",
-      reason: "the single occurrence is a regex whose whole purpose is stripping ASCII control characters before XML output, which the rule cannot distinguish from an accident"
-    },
-    "no-debugger": "error",
-    "no-delete-var": "error",
-    "no-dupe-else-if": "error",
-    "no-dupe-keys": "error",
-    "no-duplicate-case": "error",
-    "no-else-return": [
-      "error",
-      {
-        allowElseIf: true
-      }
-    ],
-    "no-empty": [
-      "error",
-      {
-        allowEmptyCatch: false
-      }
-    ],
-    "no-empty-character-class": "error",
-    "no-empty-pattern": [
-      "error",
-      {
-        allowObjectPatternsAsParameters: false
-      }
-    ],
-    "no-empty-static-block": "error",
-    "no-ex-assign": "error",
-    "no-extra-boolean-cast": ["error", {}],
-    "no-fallthrough": [
-      "error",
-      {
-        allowEmptyCase: false,
-        reportUnusedFallthroughComment: false
-      }
-    ],
-    "no-global-assign": [
-      "error",
-      {
-        exceptions: []
-      }
-    ],
-    "no-implicit-coercion": [
-      "error",
-      {
-        allow: [],
-        boolean: true,
-        disallowTemplateShorthand: false,
-        number: true,
-        string: true
-      }
-    ],
-    "no-invalid-regexp": ["error", {}],
-    "no-irregular-whitespace": [
-      "error",
-      {
-        skipComments: false,
-        skipJSXText: false,
-        skipRegExps: false,
-        skipStrings: true,
-        skipTemplates: false
-      }
-    ],
-    "no-lonely-if": "error",
-    "no-loss-of-precision": "error",
-    "no-misleading-character-class": "error",
-    "no-nonoctal-decimal-escape": "error",
-    "no-prototype-builtins": "error",
-    "no-regex-spaces": "error",
-    "no-restricted-imports": [
-      "error",
-      {
-        paths: [
-          {
-            name: "@front/theme",
-            importNames: [
-              "hubloTheme",
-              "legacyHubloTheme",
-              "customCommonColors",
-              "customPalette",
-              "breakpointsOptions",
-              "breakpointsValues",
-              "spacingConstants"
-            ],
-            message: "Use the MUI theme context or the public providers exposed by @front/theme."
-          }
-        ],
-        patterns: [
-          {
-            group: ["@front/theme/*", "!@front/theme/testing"],
-            message: "Deep imports from @front/theme are forbidden outside the theme lib."
-          }
-        ]
-      }
-    ],
-    "no-self-assign": [
-      "error",
-      {
-        props: true
-      }
-    ],
-    "no-shadow-restricted-names": [
-      "error",
-      {
-        reportGlobalThis: false
-      }
-    ],
-    "no-sparse-arrays": "error",
-    "no-unneeded-ternary": [
-      "error",
-      {
-        defaultAssignment: true
-      }
-    ],
-    "no-unsafe-finally": "error",
-    "no-unsafe-optional-chaining": {
-      severity: "warn",
-      reason: "7 pre-existing violation(s) across the db-* libs, and they were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero.",
-      options: [
-        {
-          disallowArithmeticOperators: false
-        }
-      ]
-    },
-    "no-unused-labels": "error",
-    "no-unused-private-class-members": "error",
-    "no-useless-backreference": "error",
-    "no-useless-catch": "error",
-    "no-useless-escape": [
-      "error",
-      {
-        allowRegexCharacters: []
-      }
-    ],
-    "no-useless-return": "error",
-    "nx/enforce-module-boundaries": [
-      "error",
-      {
-        enforceBuildableLibDependency: true,
-        allow: [],
-        depConstraints: [
-          {
-            sourceTag: "*",
-            onlyDependOnLibsWithTags: ["*"]
-          }
-        ]
-      }
-    ],
-    "prefer-arrow-callback": [
-      "error",
-      {
-        allowNamedFunctions: false,
-        allowUnboundThis: true
-      }
-    ],
-    "require-yield": "error",
-    "typescript/await-thenable": "error",
-    "typescript/no-confusing-non-null-assertion": "error",
-    "typescript/no-empty-function": {
-      severity: "warn",
-      reason: "pre-existing violations that were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero.",
-      options: [
-        {
-          allow: []
-        }
-      ]
-    },
-    "typescript/no-explicit-any": "error",
-    "typescript/no-floating-promises": [
-      "error",
-      {
-        ignoreVoid: true
-      }
-    ],
-    "typescript/no-import-type-side-effects": "error",
-    "typescript/no-inferrable-types": "error",
-    "typescript/no-non-null-assertion": "error",
-    "typescript/no-unused-vars": {
-      severity: "warn",
-      reason: "pre-existing violations that were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero.",
-      options: [
-        {
-          argsIgnorePattern: "^_",
-          caughtErrors: "none"
-        }
-      ]
-    },
-    "typescript/return-await": {
-      severity: "warn",
-      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
-      options: ["in-try-catch"]
-    },
-    "typescript/switch-exhaustiveness-check": [
-      "error",
-      {
-        considerDefaultExhaustiveForUnions: true
-      }
-    ],
-    "use-isnan": [
-      "error",
-      {
-        enforceForIndexOf: false,
-        enforceForSwitchCase: true
-      }
-    ],
-    "valid-typeof": [
-      "error",
-      {
-        requireStringLiterals: false
-      }
-    ],
-    "vitest/expect-expect": {
-      severity: "warn",
-      reason: "the modules already ran this at warn (confirmed in the bff-admin proof-of-concept config); adoption is like-for-like, so raising it to error is a separate decision"
-    },
-    "vitest/no-alias-methods": "error",
-    "vitest/no-commented-out-tests": {
-      severity: "warn",
-      reason: "the modules already ran this at warn (confirmed in the bff-admin proof-of-concept config); adoption is like-for-like, so raising it to error is a separate decision"
-    },
-    "vitest/no-conditional-expect": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/no-disabled-tests": {
-      severity: "warn",
-      reason: "the modules already ran this at warn (confirmed in the bff-admin proof-of-concept config); a skipped test is a deliberate act often paired with a ticket, so it reports rather than blocks"
-    },
-    "vitest/no-focused-tests": "error",
-    "vitest/no-identical-title": "error",
-    "vitest/no-interpolation-in-snapshots": "error",
-    "vitest/no-mocks-import": "error",
-    "vitest/no-standalone-expect": "error",
-    "vitest/no-test-prefixes": "error",
-    "vitest/prefer-to-be": "error",
-    "vitest/prefer-to-contain": "error",
-    "vitest/prefer-to-have-length": "error",
-    "vitest/require-mock-type-parameters": {
-      severity: "off",
-      reason: "4 479 of the 5 255 findings this plugin reports over this repository, 85% of them. It asks for type parameters on vi.fn<\u2026>(), a convention this codebase never had; adopting it is its own piece of work and not part of reading the right plugin"
-    },
-    "vitest/require-to-throw-message": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/valid-describe-callback": "error",
-    "vitest/valid-expect": {
-      severity: "warn",
-      reason: "1 pre-existing violation(s) across bdd-tooling, and they were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero."
-    },
-    "vitest/valid-expect-in-promise": "error",
-    "vitest/valid-title": "error",
-    "vitest/warn-todo": {
-      severity: "warn",
-      reason: "a todo test is a reminder rather than a defect, so it reports and never blocks"
-    }
-  },
-  uncovered: {
-    "array-bracket-newline": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    "array-bracket-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    "block-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    "computed-property-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    "dot-location": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    "eol-last": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    "func-call-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    "import/order": "import ordering is FORMATTING, and the format role owns it: oxfmt's `sortImports` reproduces exactly these groups (builtin, external, internal, parent/index, sibling, alphabetical, blank line between) and sorts a file completely in ONE pass, because it rewrites the whole import block. A lint fixer cannot: it emits text edits over overlapping ranges, so this rule needed several runs to finish (five imports took four passes, measured) and sentinel deliberately runs autofix once. Enforced by `pnpm run format`, not by the linter, which is also why `eslint-plugin-import` is no longer hosted at all: its only other rule, no-duplicates, is native in oxlint.",
-    "key-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    "keyword-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    "lines-between-class-members": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    "no-invalid-this": "no oxlint equivalent, and hosting does not help: the rule crashes on every file under oxlint's plugin API (sourceCode.getJSDocComment is not implemented). Its coverage moves to TypeScript's noImplicitThis, which the sentinel TypeScript role manages.",
-    "no-multi-spaces": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    "no-octal": "no oxlint equivalent",
-    "no-restricted-syntax": "no oxlint equivalent, and unlike the react tier this preset hosts no house-rule plugin, so architectural guards written as AST selectors are not enforced at all. They belong in sentinel's `hublo` plugin, next to the frontend ones: tell us which guards your service relies on. A per-module copy of a house rule drifts, which is the problem sentinel exists to remove.",
-    "no-trailing-spaces": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    "template-curly-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
-    "typescript/member-ordering": "oxlint has no native rule for it, and the preset deliberately does NOT host @typescript-eslint/eslint-plugin: hosting a whole plugin for one rule costs a dependency, a load step and a pass over every file. Accepted as a loss rather than paid for, the same call as no-octal."
-  },
-  overrides: [
-    {
-      files: [
-        "**/*.test.ts",
-        "**/*.test.tsx",
-        "**/*.spec.ts",
-        "**/*.spec.tsx",
-        "**/*.integration-spec.ts",
-        "**/*.e2e-spec.ts"
-      ],
-      rules: {
-        "no-restricted-properties": {
-          severity: "warn",
-          reason: "held at warn: over the 8 011 test files, 7 call Math.random(), 104 call Date.now(), 3 crypto.randomUUID(), 1 performance.now() and 1 process.hrtime, and 28 of the files that read the clock already install fake timers. A warning says it without turning a suite that was green yesterday red. Verified at error on a fixture carrying all nine forms: these six are reported, new Date('2026-01-01') is not, which is the point",
-          options: [
-            {
-              object: "Math",
-              property: "random",
-              message: "No Math.random() in a test: use a deterministic fixture, or stub the random source."
-            },
-            {
-              object: "Date",
-              property: "now",
-              message: "No Date.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
-            },
-            {
-              object: "performance",
-              property: "now",
-              message: "No performance.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
-            },
-            {
-              object: "process",
-              property: "hrtime",
-              message: "No process.hrtime in a test: use vi.useFakeTimers() with vi.setSystemTime()."
-            },
-            {
-              object: "crypto",
-              property: "randomUUID",
-              message: "No crypto.randomUUID() in a test: use a fixed id, or stub the random source."
-            },
-            {
-              object: "crypto",
-              property: "getRandomValues",
-              message: "No crypto.getRandomValues() in a test: use a fixed buffer, or stub the random source."
-            }
-          ]
-        },
-        "no-restricted-globals": {
-          severity: "warn",
-          reason: "held at warn: 68 test files call setTimeout and only 2 of them install fake timers, so waiting on the real clock is the second source of flakiness after reading it. The flush idiom await new Promise((resolve) => setTimeout(resolve, 0)) is inside that count and is usually harmless, which is exactly why this reports and never blocks",
-          options: [
-            {
-              name: "setTimeout",
-              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
-            },
-            {
-              name: "setInterval",
-              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
-            }
-          ]
-        }
-      }
-    }
-  ]
-};
-
-// src/roles/lint/presets/node.json
-var node_default = {
-  plugins: ["typescript", "oxc", "vitest"],
-  jsPlugins: [],
-  settings: null,
-  rules: {
-    "typescript/no-unused-expressions": {
-      severity: "warn",
-      reason: "3 pre-existing violations in apps/cloud/institution, never reported because the nx eslint target matched a couple of files per module. Held at warn so adoption stays a lateral move; the debt is visible in `--inspect` and the severity returns once it reaches zero. Parked in the node LAYER rather than the shared base on purpose: the base is the floor every preset stands on, and softening it would weaken presets that have no such debt.",
-      options: [
-        {
-          allowShortCircuit: false,
-          allowTaggedTemplates: false,
-          allowTernary: false
-        }
-      ]
-    },
-    "vitest/expect-expect": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/no-alias-methods": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/no-commented-out-tests": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/no-conditional-expect": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/no-disabled-tests": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/no-focused-tests": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/no-identical-title": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/no-interpolation-in-snapshots": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/no-mocks-import": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/no-standalone-expect": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/no-test-prefixes": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/prefer-to-be": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/prefer-to-contain": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/prefer-to-have-length": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/require-mock-type-parameters": {
-      severity: "off",
-      reason: "4 479 of the 5 255 findings this plugin reports over this repository, 85% of them. It asks for type parameters on vi.fn<\u2026>(), a convention this codebase never had; adopting it is its own piece of work and not part of reading the right plugin"
-    },
-    "vitest/require-to-throw-message": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/valid-describe-callback": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/valid-expect": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/valid-expect-in-promise": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/valid-title": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    },
-    "vitest/warn-todo": {
-      severity: "warn",
-      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
-    }
-  },
-  overrides: [
-    {
-      files: [
-        "**/*.test.ts",
-        "**/*.test.tsx",
-        "**/*.spec.ts",
-        "**/*.spec.tsx",
-        "**/*.integration-spec.ts",
-        "**/*.e2e-spec.ts"
-      ],
-      rules: {
-        "no-restricted-properties": {
-          severity: "warn",
-          reason: "held at warn: over the 8 011 test files, 7 call Math.random(), 104 call Date.now(), 3 crypto.randomUUID(), 1 performance.now() and 1 process.hrtime, and 28 of the files that read the clock already install fake timers. A warning says it without turning a suite that was green yesterday red. Verified at error on a fixture carrying all nine forms: these six are reported, new Date('2026-01-01') is not, which is the point",
-          options: [
-            {
-              object: "Math",
-              property: "random",
-              message: "No Math.random() in a test: use a deterministic fixture, or stub the random source."
-            },
-            {
-              object: "Date",
-              property: "now",
-              message: "No Date.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
-            },
-            {
-              object: "performance",
-              property: "now",
-              message: "No performance.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
-            },
-            {
-              object: "process",
-              property: "hrtime",
-              message: "No process.hrtime in a test: use vi.useFakeTimers() with vi.setSystemTime()."
-            },
-            {
-              object: "crypto",
-              property: "randomUUID",
-              message: "No crypto.randomUUID() in a test: use a fixed id, or stub the random source."
-            },
-            {
-              object: "crypto",
-              property: "getRandomValues",
-              message: "No crypto.getRandomValues() in a test: use a fixed buffer, or stub the random source."
-            }
-          ]
-        },
-        "no-restricted-globals": {
-          severity: "warn",
-          reason: "held at warn: 68 test files call setTimeout and only 2 of them install fake timers, so waiting on the real clock is the second source of flakiness after reading it. The flush idiom await new Promise((resolve) => setTimeout(resolve, 0)) is inside that count and is usually harmless, which is exactly why this reports and never blocks",
-          options: [
-            {
-              name: "setTimeout",
-              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
-            },
-            {
-              name: "setInterval",
-              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
-            }
-          ]
-        }
-      }
-    }
-  ]
-};
-
-// src/roles/lint/presets/react-lib.json
-var react_lib_default = {
-  plugins: ["typescript", "react", "jsx-a11y", "jest", "vitest", "unicorn", "oxc", "nextjs"],
-  jsPlugins: [
-    "eslint-plugin-no-barrel-files",
-    {
-      name: "nx",
-      specifier: "@nx/eslint-plugin"
-    },
-    {
-      name: "jest-dom",
-      specifier: "eslint-plugin-jest-dom"
-    },
-    {
-      name: "storybook",
-      specifier: "eslint-plugin-storybook"
-    },
-    "../plugins/hublo.js",
-    {
-      name: "@tanstack/query",
-      specifier: "@tanstack/eslint-plugin-query"
-    }
-  ],
-  settings: null,
-  renames: {
-    "@next/next": "nextjs"
-  },
-  rules: {
-    "@tanstack/query/exhaustive-deps": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/infinite-query-property-order": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/mutation-property-order": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/no-rest-destructuring": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/no-unstable-deps": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/no-void-query-fn": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/prefer-query-options": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/stable-query-client": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    curly: ["error", "all"],
-    "for-direction": "error",
-    "hublo/no-regex-lookbehind": "error",
-    "jest-dom/prefer-checked": "error",
-    "jest-dom/prefer-empty": "error",
-    "jest-dom/prefer-enabled-disabled": "error",
-    "jest-dom/prefer-focus": "error",
-    "jest-dom/prefer-in-document": "error",
-    "jest-dom/prefer-required": "error",
-    "jest-dom/prefer-to-have-attribute": "error",
-    "jest-dom/prefer-to-have-class": "error",
-    "jest-dom/prefer-to-have-style": "error",
-    "jest-dom/prefer-to-have-text-content": "error",
-    "jest-dom/prefer-to-have-value": "error",
-    "jest/expect-expect": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-alias-methods": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-commented-out-tests": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-conditional-expect": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-deprecated-functions": "error",
-    "jest/no-disabled-tests": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-done-callback": "error",
-    "jest/no-export": "error",
-    "jest/no-focused-tests": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-identical-title": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-interpolation-in-snapshots": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-jasmine-globals": "error",
-    "jest/no-mocks-import": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-standalone-expect": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/no-test-prefixes": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/prefer-to-be": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/prefer-to-contain": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/prefer-to-have-length": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/valid-describe-callback": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/valid-expect": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/valid-expect-in-promise": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jest/valid-title": {
-      severity: "off",
-      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
-    },
-    "jsx-a11y/anchor-is-valid": [
-      "error",
-      {
-        components: ["Link"],
-        specialLink: ["hrefLeft", "hrefRight"],
-        aspects: ["invalidHref", "preferButton"]
-      }
-    ],
-    "nextjs/google-font-display": {
-      severity: "warn",
-      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
-    },
-    "nextjs/google-font-preconnect": {
-      severity: "warn",
-      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
-    },
-    "nextjs/inline-script-id": "error",
-    "nextjs/next-script-for-ga": {
-      severity: "warn",
-      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
-    },
-    "nextjs/no-assign-module-variable": "error",
-    "nextjs/no-async-client-component": {
-      severity: "warn",
-      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
-    },
-    "nextjs/no-before-interactive-script-outside-document": {
-      severity: "warn",
-      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
-    },
-    "nextjs/no-css-tags": {
-      severity: "warn",
-      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
-    },
-    "nextjs/no-document-import-in-page": "error",
-    "nextjs/no-duplicate-head": "error",
-    "nextjs/no-head-element": {
-      severity: "warn",
-      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
-    },
-    "nextjs/no-head-import-in-document": "error",
-    "nextjs/no-html-link-for-pages": "error",
-    "nextjs/no-img-element": {
-      severity: "warn",
-      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
-    },
-    "nextjs/no-page-custom-font": {
-      severity: "warn",
-      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
-    },
-    "nextjs/no-script-component-in-head": "error",
-    "nextjs/no-styled-jsx-in-document": {
-      severity: "warn",
-      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
-    },
-    "nextjs/no-sync-scripts": "error",
-    "nextjs/no-title-in-document-head": {
-      severity: "warn",
-      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
-    },
-    "nextjs/no-typos": {
-      severity: "warn",
-      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
-    },
-    "nextjs/no-unwanted-polyfillio": {
-      severity: "warn",
-      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
-    },
-    "no-async-promise-executor": "error",
-    "no-barrel-files/no-barrel-files": {
-      severity: "warn",
-      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first."
-    },
-    "no-case-declarations": "error",
-    "no-compare-neg-zero": "error",
-    "no-cond-assign": ["error", "except-parens"],
-    "no-console": {
-      severity: "warn",
-      reason: "53 pre-existing violation(s) across libs/front/analytics, and they were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero.",
-      options: [
-        {
-          allow: ["warn", "error"]
-        }
-      ]
-    },
-    "no-constant-binary-expression": "error",
-    "no-constant-condition": [
-      "error",
-      {
-        checkLoops: "allExceptWhileTrue"
-      }
-    ],
-    "no-control-regex": "error",
-    "no-debugger": "error",
-    "no-delete-var": "error",
-    "no-dupe-else-if": "error",
-    "no-duplicate-case": "error",
-    "no-empty": [
-      "error",
-      {
-        allowEmptyCatch: false
-      }
-    ],
-    "no-empty-character-class": "error",
-    "no-empty-pattern": [
-      "error",
-      {
-        allowObjectPatternsAsParameters: false
-      }
-    ],
-    "no-empty-static-block": "error",
-    "no-ex-assign": "error",
-    "no-extra-boolean-cast": ["error", {}],
-    "no-fallthrough": [
-      "error",
-      {
-        allowEmptyCase: false,
-        reportUnusedFallthroughComment: false
-      }
-    ],
-    "no-global-assign": [
-      "error",
-      {
-        exceptions: []
-      }
-    ],
-    "no-invalid-regexp": ["error", {}],
-    "no-irregular-whitespace": [
-      "error",
-      {
-        skipComments: false,
-        skipJSXText: false,
-        skipRegExps: false,
-        skipStrings: true,
-        skipTemplates: false
-      }
-    ],
-    "no-loss-of-precision": "error",
-    "no-misleading-character-class": "error",
-    "no-nonoctal-decimal-escape": "error",
-    "no-prototype-builtins": "error",
-    "no-regex-spaces": "error",
-    "no-restricted-properties": [
-      "error",
-      {
-        object: "i18n",
-        property: "changeLanguage",
-        message: "This does not work in Nextjs. Please use Link or router instead. See https://nextjs.org/docs/advanced-features/i18n-routing#transition-between-locales"
-      }
-    ],
-    "no-self-assign": [
-      "error",
-      {
-        props: true
-      }
-    ],
-    "no-shadow-restricted-names": [
-      "error",
-      {
-        reportGlobalThis: false
-      }
-    ],
-    "no-sparse-arrays": "error",
-    "no-unsafe-finally": "error",
-    "no-unsafe-optional-chaining": [
-      "error",
-      {
-        disallowArithmeticOperators: false
-      }
-    ],
-    "no-unused-labels": "error",
-    "no-unused-private-class-members": "error",
-    "no-useless-backreference": "error",
-    "no-useless-catch": "error",
-    "no-useless-escape": [
-      "error",
-      {
-        allowRegexCharacters: []
-      }
-    ],
-    "nx/enforce-module-boundaries": [
-      "error",
-      {
-        enforceBuildableLibDependency: true,
-        allow: [],
-        depConstraints: [
-          {
-            sourceTag: "*",
-            onlyDependOnLibsWithTags: ["*"]
-          }
-        ]
-      }
-    ],
-    "react-hooks/exhaustive-deps": {
-      severity: "warn",
-      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first."
-    },
-    "react-hooks/rules-of-hooks": "error",
-    "react/jsx-curly-brace-presence": {
-      severity: "warn",
-      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first.",
-      options: [
-        {
-          props: "never",
-          children: "never"
-        }
-      ]
-    },
-    "react/jsx-no-useless-fragment": [
-      "error",
-      {
-        allowExpressions: true
-      }
-    ],
-    "require-yield": "error",
-    "typescript/consistent-type-imports": [
-      "error",
-      {
-        fixStyle: "inline-type-imports"
-      }
-    ],
-    "typescript/no-empty-function": [
-      "error",
-      {
-        allow: []
-      }
-    ],
-    "typescript/no-explicit-any": "error",
-    "typescript/no-floating-promises": [
-      "error",
-      {
-        ignoreVoid: true
-      }
-    ],
-    "typescript/no-inferrable-types": "error",
-    "typescript/no-non-null-assertion": {
-      severity: "warn",
-      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first."
-    },
-    "typescript/no-unused-vars": [
-      "error",
-      {
-        argsIgnorePattern: "^_",
-        caughtErrors: "none"
-      }
-    ],
-    "typescript/no-useless-constructor": {
-      severity: "warn",
-      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first."
-    },
-    "typescript/return-await": {
-      severity: "warn",
-      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
-      options: ["in-try-catch"]
-    },
-    "use-isnan": [
-      "error",
-      {
-        enforceForIndexOf: false,
-        enforceForSwitchCase: true
-      }
-    ],
-    "valid-typeof": [
-      "error",
-      {
-        requireStringLiterals: false
-      }
-    ],
-    "vitest/expect-expect": [
-      "error",
-      {
-        assertFunctionNames: [
-          "expect",
-          "expect*",
-          "waitForElementToBeRemoved",
-          "screen.findBy*",
-          "result.findBy*"
-        ]
-      }
-    ],
-    "vitest/no-alias-methods": "error",
-    "vitest/no-commented-out-tests": {
-      severity: "warn",
-      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first."
-    },
-    "vitest/no-conditional-expect": "error",
-    "vitest/no-disabled-tests": {
-      severity: "warn",
-      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first."
-    },
-    "vitest/no-focused-tests": "error",
-    "vitest/no-identical-title": "error",
-    "vitest/no-interpolation-in-snapshots": "error",
-    "vitest/no-mocks-import": "error",
-    "vitest/no-standalone-expect": "error",
-    "vitest/no-test-prefixes": "error",
-    "vitest/prefer-to-be": "error",
-    "vitest/prefer-to-contain": "error",
-    "vitest/prefer-to-have-length": "error",
-    "vitest/require-mock-type-parameters": {
-      severity: "off",
-      reason: "4 479 of the 5 255 findings this plugin reports over this repository, 85% of them. It asks for type parameters on vi.fn<\u2026>(), a convention this codebase never had; adopting it is its own piece of work and not part of reading the right plugin"
-    },
-    "vitest/require-to-throw-message": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/valid-describe-callback": "error",
-    "vitest/valid-expect": "error",
-    "vitest/valid-expect-in-promise": "error",
-    "vitest/valid-title": "error",
-    "vitest/warn-todo": {
-      severity: "warn",
-      reason: "a todo test is a reminder rather than a defect, so it reports and never blocks"
-    }
-  },
-  overrides: [
-    {
-      files: ["**/*.stories.ts", "**/*.stories.tsx", "**/*.stories.js", "**/*.stories.jsx"],
-      rules: {
-        "storybook/await-interactions": "error",
-        "storybook/context-in-play-function": "error",
-        "storybook/default-exports": "error",
-        "storybook/hierarchy-separator": {
-          severity: "warn",
-          reason: "the storybook plugin sets this severity for story files; adoption is like-for-like"
-        },
-        "storybook/no-redundant-story-name": {
-          severity: "warn",
-          reason: "the storybook plugin sets this severity for story files; adoption is like-for-like"
-        },
-        "storybook/no-renderer-packages": "error",
-        "storybook/prefer-pascal-case": {
-          severity: "warn",
-          reason: "the storybook plugin sets this severity for story files; adoption is like-for-like"
-        },
-        "storybook/story-exports": "error",
-        "storybook/use-storybook-expect": "error",
-        "storybook/use-storybook-testing-library": "error",
-        "react-hooks/rules-of-hooks": {
-          severity: "off",
-          reason: "off for story files in the module's own config, and it has to be: a story's render function is not a React component and the rule cannot tell, so it reports every useState in a story. Measured on libs/front/components: 7 errors, none of them real."
-        }
-      }
-    },
-    {
-      files: [
-        "**/*.test.ts",
-        "**/*.test.tsx",
-        "**/*.spec.ts",
-        "**/*.spec.tsx",
-        "**/*.integration-spec.ts",
-        "**/*.e2e-spec.ts"
-      ],
-      rules: {
-        "no-restricted-properties": {
-          severity: "warn",
-          reason: "held at warn: over the 8 011 test files, 7 call Math.random(), 104 call Date.now(), 3 crypto.randomUUID(), 1 performance.now() and 1 process.hrtime, and 28 of the files that read the clock already install fake timers. A warning says it without turning a suite that was green yesterday red. Verified at error on a fixture carrying all nine forms: these six are reported, new Date('2026-01-01') is not, which is the point",
-          options: [
-            {
-              object: "Math",
-              property: "random",
-              message: "No Math.random() in a test: use a deterministic fixture, or stub the random source."
-            },
-            {
-              object: "Date",
-              property: "now",
-              message: "No Date.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
-            },
-            {
-              object: "performance",
-              property: "now",
-              message: "No performance.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
-            },
-            {
-              object: "process",
-              property: "hrtime",
-              message: "No process.hrtime in a test: use vi.useFakeTimers() with vi.setSystemTime()."
-            },
-            {
-              object: "crypto",
-              property: "randomUUID",
-              message: "No crypto.randomUUID() in a test: use a fixed id, or stub the random source."
-            },
-            {
-              object: "crypto",
-              property: "getRandomValues",
-              message: "No crypto.getRandomValues() in a test: use a fixed buffer, or stub the random source."
-            }
-          ]
-        },
-        "no-restricted-globals": {
-          severity: "warn",
-          reason: "held at warn: 68 test files call setTimeout and only 2 of them install fake timers, so waiting on the real clock is the second source of flakiness after reading it. The flush idiom await new Promise((resolve) => setTimeout(resolve, 0)) is inside that count and is usually harmless, which is exactly why this reports and never blocks",
-          options: [
-            {
-              name: "setTimeout",
-              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
-            },
-            {
-              name: "setInterval",
-              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
-            }
-          ]
-        }
-      }
-    }
-  ],
-  uncovered: {
-    "no-octal": "no oxlint equivalent",
-    "no-restricted-syntax": "no oxlint equivalent; the house rules it encoded ship as the local `hublo` plugin instead, so this tier hosts `../plugins/hublo.js` too. It enforces exactly one of them: `hublo/no-regex-lookbehind`, because a library is where that bug is WRITTEN and it reaches an app tier only by being imported (HUB-43431 shipped from libs/front/components into the worker app). The palette selectors stay app-tier only.",
-    semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
-  }
-};
-
-// src/roles/lint/presets/react.json
-var react_default = {
-  plugins: ["typescript", "react", "jsx-a11y", "jest", "vitest", "import", "unicorn", "oxc"],
-  jsPlugins: [
-    "eslint-plugin-no-barrel-files",
-    {
-      name: "nx",
-      specifier: "@nx/eslint-plugin"
-    },
-    {
-      name: "@tanstack/query",
-      specifier: "@tanstack/eslint-plugin-query"
-    },
-    {
-      name: "styled-components-a11y",
-      specifier: "eslint-plugin-styled-components-a11y"
-    },
-    {
-      name: "react-refresh",
-      specifier: "eslint-plugin-react-refresh"
-    },
-    "../plugins/hublo.js",
-    {
-      name: "@tanstack/router",
-      specifier: "@tanstack/eslint-plugin-router"
-    }
-  ],
-  settings: null,
-  rules: {
-    "@tanstack/query/exhaustive-deps": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/infinite-query-property-order": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/mutation-property-order": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/no-rest-destructuring": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/no-unstable-deps": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/no-void-query-fn": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/prefer-query-options": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/query/stable-query-client": {
-      severity: "warn",
-      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
-    },
-    "@tanstack/router/create-route-property-order": {
-      severity: "warn",
-      reason: "held at warn on the APP tier only: routes live in applications, and libs/front holds 0 of the 227 files that call createFileRoute, the same reason hublo/require-reload-document is here and not in react-lib. Measured over the three fronts, 7 133 files and 226 route files, the two rules report 3 findings, all create-route-property-order on host-admin. The order is not cosmetic: TanStack Router infers types through it"
-    },
-    "@tanstack/router/route-param-names": {
-      severity: "warn",
-      reason: "held at warn on the APP tier only: routes live in applications, and libs/front holds 0 of the 227 files that call createFileRoute, the same reason hublo/require-reload-document is here and not in react-lib. Measured over the three fronts, 7 133 files and 226 route files, the two rules report 3 findings, all create-route-property-order on host-admin. The order is not cosmetic: TanStack Router infers types through it"
-    },
-    curly: ["error", "all"],
-    "for-direction": "error",
-    "hublo/no-palette-common": {
-      severity: "off",
-      reason: "the house rule finds 3 real violations; they are fixed as their own change rather than inside a linter swap, so the rule ships visible-but-off and can be switched on once they are"
-    },
-    "hublo/no-regex-lookbehind": "error",
-    "hublo/require-reload-document": "error",
-    "jest/expect-expect": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-alias-methods": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-commented-out-tests": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-conditional-expect": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-deprecated-functions": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-disabled-tests": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-done-callback": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-export": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-focused-tests": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-identical-title": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-interpolation-in-snapshots": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-jasmine-globals": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-mocks-import": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-standalone-expect": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/no-test-prefixes": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/prefer-to-be": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/prefer-to-contain": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/prefer-to-have-length": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/valid-describe-callback": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/valid-expect": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/valid-expect-in-promise": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jest/valid-title": {
-      severity: "off",
-      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
-    },
-    "jsx-a11y/alt-text": "error",
-    "jsx-a11y/anchor-has-content": "error",
-    "jsx-a11y/anchor-is-valid": "error",
-    "jsx-a11y/aria-activedescendant-has-tabindex": "error",
-    "jsx-a11y/aria-props": "error",
-    "jsx-a11y/aria-proptypes": "error",
-    "jsx-a11y/aria-role": "error",
-    "jsx-a11y/aria-unsupported-elements": "error",
-    "jsx-a11y/autocomplete-valid": "error",
-    "jsx-a11y/click-events-have-key-events": "error",
-    "jsx-a11y/heading-has-content": "error",
-    "jsx-a11y/html-has-lang": "error",
-    "jsx-a11y/iframe-has-title": "error",
-    "jsx-a11y/img-redundant-alt": {
-      severity: "off",
-      reason: 'one real finding, a decorative image whose title is already rendered as a heading beside it, so the fix is alt="". A genuine accessibility issue rather than a false positive: parked only so swapping linters stays a lateral move, and worth switching back on as soon as it is fixed'
-    },
-    "jsx-a11y/interactive-supports-focus": [
-      "error",
-      {
-        tabbable: [
-          "button",
-          "checkbox",
-          "link",
-          "progressbar",
-          "searchbox",
-          "slider",
-          "spinbutton",
-          "switch",
-          "textbox"
-        ]
-      }
-    ],
-    "jsx-a11y/label-has-associated-control": "error",
-    "jsx-a11y/media-has-caption": "error",
-    "jsx-a11y/mouse-events-have-key-events": "error",
-    "jsx-a11y/no-access-key": "error",
-    "jsx-a11y/no-autofocus": "error",
-    "jsx-a11y/no-distracting-elements": "error",
-    "jsx-a11y/no-interactive-element-to-noninteractive-role": "error",
-    "jsx-a11y/no-noninteractive-element-interactions": [
-      "error",
-      {
-        body: ["onError", "onLoad"],
-        iframe: ["onError", "onLoad"],
-        img: ["onError", "onLoad"]
-      }
-    ],
-    "jsx-a11y/no-noninteractive-element-to-interactive-role": "error",
-    "jsx-a11y/no-noninteractive-tabindex": "error",
-    "jsx-a11y/no-redundant-roles": "error",
-    "jsx-a11y/no-static-element-interactions": "error",
-    "jsx-a11y/role-has-required-aria-props": "error",
-    "jsx-a11y/role-supports-aria-props": "error",
-    "jsx-a11y/scope": "error",
-    "jsx-a11y/tabindex-no-positive": "error",
-    "no-async-promise-executor": "error",
-    "no-barrel-files/no-barrel-files": {
-      severity: "warn",
-      reason: "the modules already ran this at warn (confirmed in the host-admin proof-of-concept config); nest disables it outright as deliberate architecture, react keeps it visible"
-    },
-    "no-case-declarations": "error",
-    "no-compare-neg-zero": "error",
-    "no-cond-assign": ["error", "except-parens"],
-    "no-console": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "no-constant-binary-expression": "error",
-    "no-constant-condition": [
-      "error",
-      {
-        checkLoops: "allExceptWhileTrue"
-      }
-    ],
-    "no-control-regex": "error",
-    "no-debugger": "error",
-    "no-delete-var": "error",
-    "no-dupe-else-if": "error",
-    "no-duplicate-case": "error",
-    "no-empty": [
-      "error",
-      {
-        allowEmptyCatch: false
-      }
-    ],
-    "no-empty-character-class": "error",
-    "no-empty-pattern": [
-      "error",
-      {
-        allowObjectPatternsAsParameters: false
-      }
-    ],
-    "no-empty-static-block": "error",
-    "no-ex-assign": "error",
-    "no-extra-boolean-cast": ["error", {}],
-    "no-fallthrough": [
-      "error",
-      {
-        allowEmptyCase: false,
-        reportUnusedFallthroughComment: false
-      }
-    ],
-    "no-global-assign": [
-      "error",
-      {
-        exceptions: []
-      }
-    ],
-    "no-invalid-regexp": ["error", {}],
-    "no-irregular-whitespace": [
-      "error",
-      {
-        skipComments: false,
-        skipJSXText: false,
-        skipRegExps: false,
-        skipStrings: true,
-        skipTemplates: false
-      }
-    ],
-    "no-loss-of-precision": "error",
-    "no-misleading-character-class": "error",
-    "no-nonoctal-decimal-escape": "error",
-    "no-prototype-builtins": "error",
-    "no-regex-spaces": "error",
-    "no-restricted-imports": [
-      "error",
-      {
-        patterns: [
-          {
-            group: ["next/*"],
-            message: "Importing from next/* is not allowed in the admin project."
-          },
-          {
-            group: ["storybook/*"],
-            message: "Importing from storybook/* is not allowed in the admin project."
-          },
-          {
-            group: ["@nestjs/*"],
-            message: "Importing from @nestjs/* is not allowed in the admin project."
-          },
-          {
-            group: ["next-i18next"],
-            message: "Importing from next-i18next is not allowed in the admin project."
-          },
-          {
-            group: ["@hublo/style/colors", "@hublo/style/colors/*"],
-            message: "Importing runtime colors directly is not allowed. Use the MUI theme, theme-derived CSS variables, or an explicit product-specific mapping."
-          }
-        ]
-      }
-    ],
-    "no-self-assign": [
-      "error",
-      {
-        props: true
-      }
-    ],
-    "no-shadow-restricted-names": [
-      "error",
-      {
-        reportGlobalThis: false
-      }
-    ],
-    "no-sparse-arrays": "error",
-    "no-unexpected-multiline": "error",
-    "no-unsafe-finally": "error",
-    "no-unsafe-optional-chaining": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "no-unused-labels": "error",
-    "no-unused-private-class-members": "error",
-    "no-useless-backreference": "error",
-    "no-useless-catch": "error",
-    "no-useless-escape": [
-      "error",
-      {
-        allowRegexCharacters: []
-      }
-    ],
-    "nx/enforce-module-boundaries": [
-      "error",
-      {
-        enforceBuildableLibDependency: true,
-        allow: [],
-        depConstraints: [
-          {
-            sourceTag: "*",
-            onlyDependOnLibsWithTags: ["*"]
-          }
-        ]
-      }
-    ],
-    "react-hooks/exhaustive-deps": {
-      severity: "warn",
-      reason: "the modules already ran this at warn (confirmed in the host-admin proof-of-concept config); its suggested fix can change behaviour, so it reports and a human decides"
-    },
-    "react-hooks/rules-of-hooks": "error",
-    "react-refresh/only-export-components": {
-      severity: "warn",
-      reason: "the modules already ran this at warn (confirmed in the host-admin proof-of-concept config); it guards fast-refresh ergonomics, not correctness",
-      options: [
-        {
-          allowConstantExport: true
-        }
-      ]
-    },
-    "react/jsx-curly-brace-presence": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "require-yield": "error",
-    "styled-components-a11y/alt-text": "error",
-    "styled-components-a11y/anchor-has-content": "error",
-    "styled-components-a11y/anchor-is-valid": "error",
-    "styled-components-a11y/aria-activedescendant-has-tabindex": "error",
-    "styled-components-a11y/aria-props": "error",
-    "styled-components-a11y/aria-proptypes": "error",
-    "styled-components-a11y/aria-role": "error",
-    "styled-components-a11y/aria-unsupported-elements": "error",
-    "styled-components-a11y/autocomplete-valid": "error",
-    "styled-components-a11y/click-events-have-key-events": "error",
-    "styled-components-a11y/control-has-associated-label": {
-      severity: "off",
-      reason: "off in the host-admin proof-of-concept config, with its element and role ignore lists; it fires on composed styled components where the label lives in a wrapper the rule cannot see",
-      options: [
-        {
-          ignoreElements: ["audio", "canvas", "embed", "input", "textarea", "tr", "video"],
-          ignoreRoles: [
-            "grid",
-            "listbox",
-            "menu",
-            "menubar",
-            "radiogroup",
-            "row",
-            "tablist",
-            "toolbar",
-            "tree",
-            "treegrid"
-          ],
-          includeRoles: ["alert", "dialog"]
-        }
-      ]
-    },
-    "styled-components-a11y/heading-has-content": "error",
-    "styled-components-a11y/html-has-lang": "error",
-    "styled-components-a11y/iframe-has-title": "error",
-    "styled-components-a11y/img-redundant-alt": "error",
-    "styled-components-a11y/interactive-supports-focus": [
-      "error",
-      {
-        tabbable: [
-          "button",
-          "checkbox",
-          "link",
-          "progressbar",
-          "searchbox",
-          "slider",
-          "spinbutton",
-          "switch",
-          "textbox"
-        ]
-      }
-    ],
-    "styled-components-a11y/label-has-associated-control": "error",
-    "styled-components-a11y/label-has-for": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "styled-components-a11y/media-has-caption": "error",
-    "styled-components-a11y/mouse-events-have-key-events": "error",
-    "styled-components-a11y/no-access-key": "error",
-    "styled-components-a11y/no-autofocus": "error",
-    "styled-components-a11y/no-distracting-elements": "error",
-    "styled-components-a11y/no-interactive-element-to-noninteractive-role": "error",
-    "styled-components-a11y/no-noninteractive-element-interactions": [
-      "error",
-      {
-        body: ["onError", "onLoad"],
-        iframe: ["onError", "onLoad"],
-        img: ["onError", "onLoad"]
-      }
-    ],
-    "styled-components-a11y/no-noninteractive-element-to-interactive-role": "error",
-    "styled-components-a11y/no-noninteractive-tabindex": "error",
-    "styled-components-a11y/no-redundant-roles": "error",
-    "styled-components-a11y/no-static-element-interactions": "error",
-    "styled-components-a11y/role-has-required-aria-props": "error",
-    "styled-components-a11y/role-supports-aria-props": "error",
-    "styled-components-a11y/scope": "error",
-    "styled-components-a11y/tabindex-no-positive": "error",
-    "typescript/await-thenable": "error",
-    "typescript/no-array-delete": "error",
-    "typescript/no-base-to-string": "error",
-    "typescript/no-duplicate-type-constituents": "error",
-    "typescript/no-empty-function": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "typescript/no-explicit-any": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "typescript/no-floating-promises": [
-      "error",
-      {
-        ignoreVoid: true
-      }
-    ],
-    "typescript/no-for-in-array": "error",
-    "typescript/no-implied-eval": "error",
-    "typescript/no-inferrable-types": "error",
-    "typescript/no-misused-promises": [
-      "error",
-      {
-        checksVoidReturn: {
-          attributes: false
-        }
-      }
-    ],
-    "typescript/no-non-null-assertion": {
-      severity: "warn",
-      reason: "kept at the severity the proof of concept measured; no module config set it, so raising it to error would be a NEW enforcement decision rather than a like-for-like migration, and it needs its own count of violations first"
-    },
-    "typescript/no-redundant-type-constituents": "error",
-    "typescript/no-require-imports": "error",
-    "typescript/no-unnecessary-type-assertion": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "typescript/no-unsafe-argument": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "typescript/no-unsafe-assignment": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "typescript/no-unsafe-call": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "typescript/no-unsafe-enum-comparison": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "typescript/no-unsafe-member-access": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "typescript/no-unsafe-return": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "typescript/no-unsafe-unary-minus": "error",
-    "typescript/no-unused-vars": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "typescript/only-throw-error": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "typescript/prefer-promise-reject-errors": "error",
-    "typescript/require-await": {
-      severity: "off",
-      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
-    },
-    "typescript/restrict-plus-operands": "error",
-    "typescript/restrict-template-expressions": "error",
-    "typescript/return-await": {
-      severity: "warn",
-      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
-      options: ["in-try-catch"]
-    },
-    "typescript/switch-exhaustiveness-check": {
-      severity: "warn",
-      reason: "kept at the severity the proof of concept measured; no module config set it, so raising it to error would be a NEW enforcement decision rather than a like-for-like migration, and it needs its own count of violations first"
-    },
-    "typescript/unbound-method": "error",
-    "use-isnan": [
-      "error",
-      {
-        enforceForIndexOf: false,
-        enforceForSwitchCase: true
-      }
-    ],
-    "valid-typeof": [
-      "error",
-      {
-        requireStringLiterals: false
-      }
-    ],
-    "vitest/expect-expect": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/no-alias-methods": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/no-commented-out-tests": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/no-conditional-expect": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/no-disabled-tests": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/no-focused-tests": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/no-identical-title": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/no-interpolation-in-snapshots": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/no-mocks-import": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/no-standalone-expect": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/no-test-prefixes": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/prefer-to-be": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/prefer-to-contain": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/prefer-to-have-length": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/require-mock-type-parameters": {
-      severity: "off",
-      reason: "4 479 of the 5 255 findings this plugin reports over this repository, 85% of them. It asks for type parameters on vi.fn<\u2026>(), a convention this codebase never had; adopting it is its own piece of work and not part of reading the right plugin"
-    },
-    "vitest/require-to-throw-message": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/valid-describe-callback": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/valid-expect": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/valid-expect-in-promise": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/valid-title": {
-      severity: "warn",
-      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
-    },
-    "vitest/warn-todo": {
-      severity: "warn",
-      reason: "a todo test is a reminder rather than a defect, so it reports and never blocks"
-    }
-  },
-  uncovered: {
-    "import/order": "import ordering is FORMATTING, and the format role owns it: oxfmt's `sortImports` reproduces exactly these groups (builtin, external, internal, parent/index, sibling, alphabetical, blank line between) and sorts a file completely in ONE pass, because it rewrites the whole import block. A lint fixer cannot: it emits text edits over overlapping ranges, so this rule needed several runs to finish (five imports took four passes, measured) and sentinel deliberately runs autofix once. Enforced by `pnpm run format`, not by the linter, which is also why `eslint-plugin-import` is no longer hosted at all: its only other rule, no-duplicates, is native in oxlint.",
-    "no-octal": "no oxlint equivalent",
-    "no-restricted-syntax": "no oxlint equivalent as configuration, so the AST selectors this repo used are shipped as real rules in the local `hublo` plugin instead, which this tier hosts (`../plugins/hublo.js`). Three are hosted today: the eight palette selectors as `hublo/no-palette-common`, the lookbehind selector as `hublo/no-regex-lookbehind`, and the TanStack Router one as `hublo/require-reload-document`, carried here from an ESLint selector in the monorepo (PR #22043) because ADR 0042 makes this the layer that outlives it. App tier only: measured on main, `libs/front` calls `redirect(` nowhere, while host-admin does in 93 files and console in 2. Any selector NOT in that plugin is not enforced here; propose it and it joins the plugin rather than a per-module copy.",
-    semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
-  },
-  overrides: [
-    {
-      files: [
-        "**/*.test.ts",
-        "**/*.test.tsx",
-        "**/*.spec.ts",
-        "**/*.spec.tsx",
-        "**/*.integration-spec.ts",
-        "**/*.e2e-spec.ts"
-      ],
-      rules: {
-        "no-restricted-properties": {
-          severity: "warn",
-          reason: "held at warn: over the 8 011 test files, 7 call Math.random(), 104 call Date.now(), 3 crypto.randomUUID(), 1 performance.now() and 1 process.hrtime, and 28 of the files that read the clock already install fake timers. A warning says it without turning a suite that was green yesterday red. Verified at error on a fixture carrying all nine forms: these six are reported, new Date('2026-01-01') is not, which is the point",
-          options: [
-            {
-              object: "Math",
-              property: "random",
-              message: "No Math.random() in a test: use a deterministic fixture, or stub the random source."
-            },
-            {
-              object: "Date",
-              property: "now",
-              message: "No Date.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
-            },
-            {
-              object: "performance",
-              property: "now",
-              message: "No performance.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
-            },
-            {
-              object: "process",
-              property: "hrtime",
-              message: "No process.hrtime in a test: use vi.useFakeTimers() with vi.setSystemTime()."
-            },
-            {
-              object: "crypto",
-              property: "randomUUID",
-              message: "No crypto.randomUUID() in a test: use a fixed id, or stub the random source."
-            },
-            {
-              object: "crypto",
-              property: "getRandomValues",
-              message: "No crypto.getRandomValues() in a test: use a fixed buffer, or stub the random source."
-            }
-          ]
-        },
-        "no-restricted-globals": {
-          severity: "warn",
-          reason: "held at warn: 68 test files call setTimeout and only 2 of them install fake timers, so waiting on the real clock is the second source of flakiness after reading it. The flush idiom await new Promise((resolve) => setTimeout(resolve, 0)) is inside that count and is usually harmless, which is exactly why this reports and never blocks",
-          options: [
-            {
-              name: "setTimeout",
-              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
-            },
-            {
-              name: "setInterval",
-              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
-            }
-          ]
-        }
-      }
+   * The dedicated `format` / `format:fix` scripts stay, for running the formatter alone.
+   */
+  joinFormatIntoLint(original, rewritten, selfCommand2) {
+    const command = selfCommand2 ?? SENTINEL_FORMAT_COMMAND;
+    for (const [name, keepFix] of [
+      ["lint", false],
+      ["lint:fix", true]
+    ]) {
+      const script = rewritten[name] ?? original[name];
+      if (!script || script.trim() === "") continue;
+      if (invokesFormat(script)) continue;
+      rewritten[name] = `${script} && ${keepFix ? `${command} --fix` : command}`;
     }
-  ]
-};
-
-// src/roles/lint/presets/shared.json
-var shared_default2 = {
-  rules: {
-    "no-var": "error",
-    "prefer-const": [
-      "error",
-      {
-        destructuring: "any",
-        ignoreReadBeforeAssign: false
-      }
-    ],
-    "prefer-rest-params": "error",
-    "prefer-spread": "error",
-    "typescript/ban-ts-comment": "error",
-    "typescript/no-array-constructor": "error",
-    "typescript/no-duplicate-enum-values": "error",
-    "typescript/no-empty-object-type": "error",
-    "typescript/no-extra-non-null-assertion": "error",
-    "typescript/no-misused-new": "error",
-    "typescript/no-namespace": "error",
-    "typescript/no-non-null-asserted-optional-chain": "error",
-    "typescript/no-this-alias": "error",
-    "typescript/no-unnecessary-type-constraint": "error",
-    "typescript/no-unsafe-declaration-merging": "error",
-    "typescript/no-unsafe-function-type": "error",
-    "typescript/no-unused-expressions": [
-      "error",
-      {
-        allowShortCircuit: false,
-        allowTaggedTemplates: false,
-        allowTernary: false
-      }
-    ],
-    "typescript/no-wrapper-object-types": "error",
-    "typescript/prefer-as-const": "error",
-    "typescript/prefer-namespace-keyword": "error",
-    "typescript/triple-slash-reference": "error"
+    return rewritten;
   }
 };
 
-// src/roles/lint/presets/svelte.json
-var svelte_default = {
-  plugins: ["typescript", "oxc"],
-  jsPlugins: [],
-  settings: null,
-  rules: {
-    "constructor-super": "error",
-    "for-direction": "error",
-    "getter-return": [
-      "error",
-      {
-        allowImplicit: false
-      }
-    ],
-    "no-async-promise-executor": "error",
-    "no-case-declarations": "error",
-    "no-class-assign": "error",
-    "no-compare-neg-zero": "error",
-    "no-cond-assign": ["error", "except-parens"],
-    "no-const-assign": "error",
-    "no-constant-binary-expression": "error",
-    "no-constant-condition": [
-      "error",
-      {
-        checkLoops: "allExceptWhileTrue"
-      }
-    ],
-    "no-control-regex": "error",
-    "no-debugger": "error",
-    "no-delete-var": "error",
-    "no-dupe-class-members": "error",
-    "no-dupe-else-if": "error",
-    "no-dupe-keys": "error",
-    "no-duplicate-case": "error",
-    "no-empty": [
-      "error",
-      {
-        allowEmptyCatch: false
-      }
-    ],
-    "no-empty-character-class": "error",
-    "no-empty-pattern": [
-      "error",
-      {
-        allowObjectPatternsAsParameters: false
-      }
-    ],
-    "no-empty-static-block": "error",
-    "no-ex-assign": "error",
-    "no-extra-boolean-cast": ["error", {}],
-    "no-fallthrough": [
-      "error",
-      {
-        allowEmptyCase: false,
-        reportUnusedFallthroughComment: false
-      }
-    ],
-    "no-func-assign": "error",
-    "no-global-assign": [
-      "error",
-      {
-        exceptions: []
-      }
-    ],
-    "no-import-assign": "error",
-    "no-invalid-regexp": ["error", {}],
-    "no-irregular-whitespace": [
-      "error",
-      {
-        skipComments: false,
-        skipJSXText: false,
-        skipRegExps: false,
-        skipStrings: true,
-        skipTemplates: false
-      }
-    ],
-    "no-loss-of-precision": "error",
-    "no-misleading-character-class": "error",
-    "no-new-native-nonconstructor": "error",
-    "no-nonoctal-decimal-escape": "error",
-    "no-obj-calls": "error",
-    "no-prototype-builtins": "error",
-    "no-redeclare": [
-      "error",
-      {
-        builtinGlobals: true
-      }
-    ],
-    "no-regex-spaces": "error",
-    "no-self-assign": [
-      "error",
-      {
-        props: true
-      }
-    ],
-    "no-setter-return": "error",
-    "no-shadow-restricted-names": [
-      "error",
-      {
-        reportGlobalThis: false
-      }
-    ],
-    "no-sparse-arrays": "error",
-    "no-this-before-super": "error",
-    "no-undef": {
-      severity: "off",
-      reason: "unusable under oxlint for Svelte, and not for want of configuration. Svelte 5's runes ($state, $props, $derived, $effect) are compiler globals, and `$store` auto-subscription invents an identifier per store ($_, $page, $currentAdmin, \u2026), so the names cannot be enumerated. eslint-plugin-svelte's PARSER supplies both; oxlint has no Svelte parser, so it reported 1641 undefined identifiers on hr-management, none of them real. TypeScript and svelte-check already report genuinely undefined identifiers, which is why react and nest never enabled this rule either."
-    },
-    "no-unreachable": "error",
-    "no-unsafe-finally": "error",
-    "no-unsafe-negation": [
-      "error",
-      {
-        enforceForOrderingRelations: false
-      }
-    ],
-    "no-unsafe-optional-chaining": [
-      "error",
-      {
-        disallowArithmeticOperators: false
-      }
-    ],
-    "no-unused-labels": "error",
-    "no-unused-private-class-members": "error",
-    "no-useless-backreference": "error",
-    "no-useless-catch": "error",
-    "no-useless-escape": [
-      "error",
-      {
-        allowRegexCharacters: []
-      }
-    ],
-    "no-with": "error",
-    "prefer-rest-params": {
-      severity: "warn",
-      reason: "error in the module's eslint config, but never actually reported: `eslint src/lib/analytics/useAnalytics.js` exits clean today while oxlint finds 3 real violations in it. Held at warn so adoption does not turn a green module red, and restored to error once they are fixed. Not auto-fixable, verified with --fix."
-    },
-    "prefer-spread": {
-      severity: "warn",
-      reason: "error in the module's eslint config, but never actually reported: `eslint src/lib/analytics/useAnalytics.js` exits clean today while oxlint finds 3 real violations in it. Held at warn so adoption does not turn a green module red, and restored to error once they are fixed. Not auto-fixable, verified with --fix."
-    },
-    "require-yield": "error",
-    "typescript/no-explicit-any": {
-      severity: "warn",
-      reason: "libs/front/ui enforces it and apps/front/hr-management turns it off; enforcing it would newly fail hr-management, so it reports for both instead of breaking one"
-    },
-    "typescript/no-require-imports": "error",
-    "typescript/no-unused-vars": {
-      severity: "warn",
-      reason: "the two modules disagree: libs/front/ui runs it at error with no ignore patterns, apps/front/hr-management at warn with the ^_ patterns kept here (both read from eslint --print-config). Holding it at error would newly fail hr-management, so it reports for both and keeps the patterns hr-management already relies on",
-      options: [
-        {
-          varsIgnorePattern: "^_",
-          argsIgnorePattern: "^_",
-          destructuredArrayIgnorePattern: "^_"
-        }
-      ]
-    },
-    "use-isnan": [
-      "error",
-      {
-        enforceForIndexOf: false,
-        enforceForSwitchCase: true
-      }
-    ],
-    "valid-typeof": [
-      "error",
-      {
-        requireStringLiterals: false
-      }
-    ]
-  },
-  uncovered: {
-    "svelte/comment-directive": "oxlint cannot parse Svelte templates, so the eslint-disable comments inside markup are neither read nor honoured",
-    "svelte/system": "the plugin internal rule that reports Svelte parse errors; it needs the Svelte parser",
-    "svelte/no-at-debug-tags": "reads {@debug} in the template",
-    "svelte/no-at-html-tags": "reads {@html} in the template, the XSS guard; the highest-value loss in this list",
-    "svelte/no-dupe-else-if-blocks": "reads {#if}/{:else if} chains in the template",
-    "svelte/no-dupe-style-properties": "reads the style block",
-    "svelte/no-dynamic-slot-name": "reads <slot> in the template",
-    "svelte/no-inner-declarations": "the Svelte-aware variant; the core rule it shadows is not a substitute inside markup",
-    "svelte/no-not-function-handler": "reads on:event handlers in the template",
-    "svelte/no-object-in-text-mustaches": "reads {expression} interpolation in the template",
-    "svelte/no-shorthand-style-property-overrides": "reads the style block",
-    "svelte/no-unknown-style-directive-property": "reads style: directives in the template",
-    "svelte/no-unused-svelte-ignore": "reads svelte-ignore comments in the template",
-    "svelte/valid-compile": "runs the Svelte compiler and reports its warnings",
-    "no-dupe-args": "no oxlint equivalent (TypeScript rejects duplicate parameter names anyway)",
-    "no-octal": "no oxlint equivalent"
-  }
-};
+// src/roles/format/register.ts
+function registerFormat() {
+  register(new OxfmtAdapter());
+  setDefaultRunner("format", "oxfmt");
+}
 
-// src/roles/lint/presets/tools.json
-var tools_default = {
-  plugins: ["typescript", "oxc", "unicorn", "import", "node"],
-  jsPlugins: [],
-  settings: null,
-  rules: {
-    "for-direction": "error",
-    "no-async-promise-executor": "error",
-    "no-case-declarations": "error",
-    "no-compare-neg-zero": "error",
-    "no-cond-assign": ["error", "except-parens"],
-    "no-constant-binary-expression": [
-      "error",
-      {
-        checkRelationalComparisons: false
-      }
-    ],
-    "no-constant-condition": [
-      "error",
-      {
-        checkLoops: "allExceptWhileTrue"
-      }
-    ],
-    "no-control-regex": "error",
-    "no-debugger": "error",
-    "no-delete-var": "error",
-    "no-dupe-else-if": "error",
-    "no-duplicate-case": "error",
-    "no-empty": [
-      "error",
-      {
-        allowEmptyCatch: false
-      }
-    ],
-    "no-empty-character-class": "error",
-    "no-empty-pattern": [
-      "error",
-      {
-        allowObjectPatternsAsParameters: false
-      }
-    ],
-    "no-empty-static-block": "error",
-    "no-ex-assign": "error",
-    "no-extra-boolean-cast": ["error", {}],
-    "no-fallthrough": [
-      "error",
-      {
-        allowEmptyCase: false,
-        reportUnusedFallthroughComment: false
-      }
-    ],
-    "no-global-assign": [
-      "error",
-      {
-        exceptions: []
-      }
-    ],
-    "no-invalid-regexp": ["error", {}],
-    "no-irregular-whitespace": [
-      "error",
-      {
-        skipComments: false,
-        skipJSXText: false,
-        skipRegExps: false,
-        skipStrings: true,
-        skipTemplates: false
-      }
-    ],
-    "no-loss-of-precision": "error",
-    "no-misleading-character-class": [
-      "error",
-      {
-        allowEscape: false
-      }
-    ],
-    "no-nonoctal-decimal-escape": "error",
-    "no-prototype-builtins": "error",
-    "no-regex-spaces": "error",
-    "no-self-assign": [
-      "error",
-      {
-        props: true
-      }
-    ],
-    "no-shadow-restricted-names": [
-      "error",
-      {
-        reportGlobalThis: true
-      }
-    ],
-    "no-sparse-arrays": "error",
-    "no-unassigned-vars": "error",
-    "no-unsafe-finally": "error",
-    "no-unsafe-optional-chaining": [
-      "error",
-      {
-        disallowArithmeticOperators: false
-      }
-    ],
-    "no-unused-labels": "error",
-    "no-unused-private-class-members": "error",
-    "no-useless-assignment": "error",
-    "no-useless-backreference": "error",
-    "no-useless-catch": "error",
-    "no-useless-escape": [
-      "error",
-      {
-        allowRegexCharacters: []
-      }
-    ],
-    "preserve-caught-error": [
-      "error",
-      {
-        requireCatchParameter: false
-      }
-    ],
-    "require-yield": "error",
-    "typescript/no-explicit-any": "error",
-    "typescript/no-require-imports": "error",
-    "typescript/no-unused-vars": [
-      "error",
-      {
-        argsIgnorePattern: "^_",
-        varsIgnorePattern: "^_"
-      }
-    ],
-    "use-isnan": [
-      "error",
-      {
-        enforceForIndexOf: false,
-        enforceForSwitchCase: true
-      }
-    ],
-    "valid-typeof": [
-      "error",
-      {
-        requireStringLiterals: false
-      }
-    ]
-  },
-  uncovered: {
-    "no-octal": "no oxlint equivalent"
-  }
-};
+// src/roles/lint/adapters/oxlint/oxlint.adapter.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync14, readFileSync as readFileSync15, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join21 } from "node:path";
 
-// src/roles/lint/preset-data.ts
-var SHARED_RULES = shared_default2.rules;
-var PRESET_FILES = {
-  nest: nest_default,
-  node: node_default,
-  react: react_default,
-  svelte: svelte_default,
-  tools: tools_default
-};
-var VARIANT_FILES = {
-  "react-lib": react_lib_default
-};
-var LINT_PRESETS = Object.keys(PRESET_FILES);
-var GENERATED_LINT_PRESETS = [
-  ...Object.keys(PRESET_FILES),
-  ...Object.keys(VARIANT_FILES)
-];
-function hasLintPreset(preset) {
-  return preset in PRESET_FILES;
-}
-function presetFile(preset) {
-  return VARIANT_FILES[preset] ?? PRESET_FILES[preset] ?? node_default;
-}
-function sharedRules() {
-  return SHARED_RULES;
-}
-function presetRules(preset) {
-  return presetFile(preset).rules;
-}
-function uncoveredFor(preset) {
-  return Object.entries(presetFile(preset).uncovered ?? {}).map(([rule, reason]) => ({ rule, reason })).sort((left, right) => left.rule.localeCompare(right.rule));
+// src/core/config/deferred-rules.ts
+function deferredRuleNames(rules) {
+  return rules.map((entry) => entry.rule);
 }
 
-// src/roles/lint/rule-data.ts
-var sharedRules2 = sharedRules();
-function isDecision(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function severityOf(value) {
-  if (isDecision(value)) return value.severity;
-  if (Array.isArray(value)) return String(value[0]);
-  return value;
+// src/core/fix-report.ts
+import { statSync as statSync3 } from "node:fs";
+import { join as join16 } from "node:path";
+var CONFIG_REFUSED = /failed to parse .*config|invalid config file/i;
+function readFailure(output) {
+  const lines = output.split("\n").map((line2) => line2.trim());
+  if (!lines.some((line2) => CONFIG_REFUSED.test(line2))) return void 0;
+  const detail = lines.find((line2) => /invalid config file/i.test(line2));
+  const line = (detail ?? lines.find((entry) => entry !== "") ?? "").replace(/^x\s*/, "");
+  return line.split(/:\s*Failed to parse config/i)[0] ?? line;
 }
-function validate(preset, rules) {
-  for (const [rule, value] of Object.entries(rules)) {
-    const severity = severityOf(value);
-    if (!["off", "warn", "error"].includes(severity)) {
-      throw new Error(
-        `${preset}: rule "${rule}" has severity "${severity}"; expected off, warn or error`
-      );
-    }
-    if (severity === "error") continue;
-    const reason = isDecision(value) ? value.reason.trim() : "";
-    if (reason === "") {
-      throw new Error(
-        `${preset}: rule "${rule}" is set to "${severity}" without a reason. Every rule that is not enforced must say why, so --inspect can tell a developer what is not running. Use { "severity": "${severity}", "reason": "..." }.`
-      );
-    }
+function fingerprint(path2) {
+  try {
+    const stat = statSync3(path2);
+    return `${stat.size}:${stat.mtimeMs}`;
+  } catch {
+    return void 0;
   }
 }
-function rejectTwoSpellings(label, rules) {
-  const seen = /* @__PURE__ */ new Map();
-  for (const rule of Object.keys(rules)) {
-    const canonical = canonicalRuleName(rule);
-    const other = seen.get(canonical);
-    if (other !== void 0) {
-      throw new Error(
-        `${label}: "${other}" and "${rule}" are the same rule to oxlint (${canonical}). Configure it once, under one name: oxlint keeps both and picks one by hash order.`
-      );
-    }
-    seen.set(canonical, rule);
+function snapshotFiles(cwd, extensions) {
+  const snapshot = /* @__PURE__ */ new Map();
+  for (const file of listSourceFiles(cwd, extensions)) {
+    const mark = fingerprint(join16(cwd, file));
+    if (mark !== void 0) snapshot.set(file, mark);
   }
+  return snapshot;
 }
-function layered(preset) {
-  const base = sharedRules();
-  const layer = presetRules(preset);
-  validate("base", base);
-  validate(preset, layer);
-  return { ...base, ...layer };
-}
-function toRuleMap(label, rules) {
-  validate(label, rules);
-  rejectTwoSpellings(label, rules);
-  const entries = Object.entries(rules).map(([rule, value]) => {
-    if (!isDecision(value)) return [rule, value];
-    const options = value.options ?? [];
-    return [rule, options.length > 0 ? [value.severity, ...options] : value.severity];
-  });
-  return Object.fromEntries(entries);
-}
-function rulesFor(preset) {
-  return toRuleMap(preset, layered(preset));
-}
-function disabledFor(preset) {
-  return decisionsAt(preset, "off");
+function changedSince(cwd, before, extensions) {
+  const changed = [];
+  for (const file of listSourceFiles(cwd, extensions)) {
+    const now = fingerprint(join16(cwd, file));
+    if (now === void 0) continue;
+    if (before.get(file) !== now) changed.push(file);
+  }
+  return changed.sort();
 }
-function downgradedFor(preset) {
-  return decisionsAt(preset, "warn");
+var NAMED_IN_REPORT = 5;
+var NOT_INSTALLED_YET = /invalid config file[\s\S]*node_modules/i;
+function presetNotInstalledYet(failure) {
+  return NOT_INSTALLED_YET.test(failure);
 }
-function decisionsAt(preset, severity) {
-  return Object.entries(layered(preset)).filter(([, value]) => isDecision(value) && value.severity === severity).map(([rule, value]) => ({ rule, reason: value.reason })).sort((left, right) => left.rule.localeCompare(right.rule));
+function describeFixOutcome(outcome, toolLabel) {
+  if (outcome.failure !== void 0) {
+    if (NOT_INSTALLED_YET.test(outcome.failure)) {
+      return `the ${toolLabel} preset is not installed in this module yet, which is expected: this command just added it and the install comes next. Nothing was fixed. Run \`pnpm install\`, then \`sentinel --run --${toolLabel} --fix\` to clear what a machine can clear.`;
+    }
+    return `the ${toolLabel} autofix could not run, so nothing was fixed and this module has not been checked: ${outcome.failure}`;
+  }
+  if (outcome.changed.length === 0) return `the ${toolLabel} autofix changed nothing`;
+  const named = outcome.changed.slice(0, NAMED_IN_REPORT).join(", ");
+  const rest = outcome.changed.length - NAMED_IN_REPORT;
+  const listed = rest > 0 ? `${named} and ${rest} more` : named;
+  return `the ${toolLabel} autofix rewrote ${outcome.changed.length} file${outcome.changed.length === 1 ? "" : "s"}: ${listed}. Review the diff before committing: rules this module used to have switched off are enforced from now on.`;
 }
 
 // src/roles/lint/disabled-rules.ts
@@ -5773,110 +3391,6 @@ function committedExtendsList(cwd, configFile) {
   }
 }
 
-// src/roles/lint/module-own-config.ts
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-function pluginKey(entry) {
-  if (typeof entry === "string") return entry;
-  if (isRecord(entry) && typeof entry.name === "string") return entry.name;
-  if (isRecord(entry) && typeof entry.specifier === "string") return entry.specifier;
-  return void 0;
-}
-function governedRuleNames(preset) {
-  return /* @__PURE__ */ new Set([
-    ...Object.keys(preset.rules),
-    ...(preset.overrides ?? []).flatMap((override) => Object.keys(override.rules))
-  ]);
-}
-function governedRules(preset) {
-  const governed = /* @__PURE__ */ new Map();
-  for (const name of governedRuleNames(preset)) {
-    const canonical = canonicalRuleName(name);
-    if (!governed.has(canonical)) governed.set(canonical, name);
-  }
-  return governed;
-}
-function moduleOwnBlocks(committed, preset) {
-  const blocks = {};
-  const kept = [];
-  const dropped = [];
-  if (Array.isArray(committed.plugins)) {
-    const own = committed.plugins.filter(
-      (name) => typeof name === "string" && !preset.plugins.includes(name)
-    );
-    if (own.length > 0) {
-      blocks.plugins = own;
-      kept.push(
-        `kept this module's own plugins (${own.join(", ")}): the preset does not enable them`
-      );
-    }
-  }
-  if (Array.isArray(committed.jsPlugins)) {
-    const presetKeys = new Set(preset.jsPlugins.map((entry) => pluginKey(entry)));
-    const own = [];
-    for (const entry of committed.jsPlugins) {
-      const key = pluginKey(entry);
-      if (key !== void 0 && presetKeys.has(key)) dropped.push(`jsPlugins ${key}`);
-      else own.push(entry);
-    }
-    if (own.length > 0) {
-      blocks.jsPlugins = own;
-      kept.push(
-        `kept ${own.length} jsPlugin(s) this module added (${own.map((entry) => pluginKey(entry) ?? "?").join(", ")})`
-      );
-    }
-  }
-  if (isRecord(committed.settings)) {
-    const presetSettings = preset.settings ?? {};
-    const own = {};
-    for (const [key, value] of Object.entries(committed.settings)) {
-      if (key in presetSettings) dropped.push(`settings.${key}`);
-      else own[key] = value;
-    }
-    if (Object.keys(own).length > 0) {
-      blocks.settings = own;
-      kept.push(`kept this module's own settings (${Object.keys(own).join(", ")})`);
-    }
-  }
-  if (Array.isArray(committed.overrides)) {
-    const governed = governedRules(preset);
-    const byFiles = /* @__PURE__ */ new Map();
-    for (const block of committed.overrides) {
-      if (!isRecord(block) || !Array.isArray(block.files)) continue;
-      const files = JSON.stringify([...block.files].map(String).sort());
-      const rules = {};
-      for (const [rule, value] of Object.entries(isRecord(block.rules) ? block.rules : {})) {
-        const presetSpelling = governed.get(canonicalRuleName(rule));
-        if (presetSpelling === void 0) rules[rule] = value;
-        else
-          dropped.push(
-            `overrides[${block.files.join(", ")}] ${describeRuleKey(rule, presetSpelling)}`
-          );
-      }
-      const { rules: _rules, ...rest } = block;
-      const merged = byFiles.get(files);
-      if (merged === void 0) {
-        byFiles.set(files, { ...rest, ...Object.keys(rules).length > 0 ? { rules } : {} });
-        continue;
-      }
-      const { files: _sameFiles, ...others } = rest;
-      const mergedRules = { ...isRecord(merged.rules) ? merged.rules : {}, ...rules };
-      Object.assign(
-        merged,
-        others,
-        Object.keys(mergedRules).length > 0 ? { rules: mergedRules } : {}
-      );
-    }
-    const own = [...byFiles.values()].filter((block) => Object.keys(block).length > 1);
-    if (own.length > 0) {
-      blocks.overrides = own;
-      kept.push(
-        `kept ${own.length} override block(s) this module set (${own.map((block) => block.files.join(", ")).join("; ")})`
-      );
-    }
-  }
-  return { blocks, kept, dropped };
-}
-
 // src/roles/lint/parse-diagnostics.ts
 function ruleId(code) {
   const inner = /\(([^)]+)\)/.exec(code);
@@ -5926,26 +3440,6 @@ function errorCountsByConfigRule(stdout) {
   return counts;
 }
 
-// src/roles/lint/presets.ts
-var hasRuleData = (name) => GENERATED_LINT_PRESETS.includes(name);
-function lintPresetFor(preset) {
-  const file = presetFile(preset);
-  const resolved = hasRuleData(preset) ? preset : "node";
-  return {
-    plugins: file.plugins,
-    jsPlugins: file.jsPlugins,
-    ...file.settings === null ? {} : { settings: file.settings },
-    ...file.renames ? { renames: file.renames } : {},
-    ...file.overrides ? {
-      overrides: file.overrides.map((override, index) => ({
-        files: override.files,
-        rules: toRuleMap(`${preset} override ${index}`, override.rules)
-      }))
-    } : {},
-    rules: rulesFor(resolved)
-  };
-}
-
 // src/roles/lint/adapters/oxlint/plan.ts
 import { existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
 import { join as join20 } from "node:path";
@@ -6229,7 +3723,7 @@ function plan2(context2) {
   const carried = [.../* @__PURE__ */ new Set([...DEFAULT_IGNORE_PATTERNS, ...moduleOwn])];
   const committed = committedConfig(context2.cwd);
   const { kept: teamRules, governed: droppedRules } = moduleOwnRules(
-    isRecord2(committed.rules) ? committed.rules : {},
+    isRecord(committed.rules) ? committed.rules : {},
     lintPresetFor(variant)
   );
   const teamBlocks = moduleOwnBlocks(committed, lintPresetFor(variant));
@@ -6375,14 +3869,14 @@ function committedExtends(cwd) {
     return [];
   }
 }
-var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 function committedConfig(cwd) {
   try {
     const parsed = parseJsonc(
       readFileSync14(join20(cwd, LINT_CONFIG_FILE), "utf8"),
       LINT_CONFIG_FILE
     );
-    return isRecord2(parsed) ? parsed : {};
+    return isRecord(parsed) ? parsed : {};
   } catch {
     return {};
   }
@@ -6777,7 +4271,11 @@ ${result.stderr ?? ""}`);
       // else here: the stub still holds only `extends` and `ignorePatterns`, so a module with
       // a team layer reports `conformant=true drift=[]` and used to say nothing at all about
       // the extra rules it runs. See `extra-layers` for why that state is legitimate.
-      layers: extraLayers(ctx.cwd, committedExtendsList(ctx.cwd, LINT_CONFIG_FILE))
+      layers: extraLayers(ctx.cwd, committedExtendsList(ctx.cwd, LINT_CONFIG_FILE)),
+      // What this module ADDS in its own stub: rules the preset does not name. Not drift, by the
+      // criterion a re-init keeps them by, so without this list they would be invisible. A rule
+      // the preset names, set differently, is not here: it is a conflict, reported as drift.
+      ...describeAdditions(readModuleAdditions(ctx.cwd))
     };
   }
   /** How many rules the extended preset enforces, read from the preset on disk. */
@@ -6919,6 +4417,28 @@ ${result.stderr ?? ""}`);
     );
   }
 };
+function describeAdditions(additions) {
+  return {
+    added: additions.rules.map((entry) => ({
+      rule: entry.rule,
+      ...entry.files === void 0 ? {} : { files: entry.files },
+      value: entry.value,
+      reason: describeAddition(entry.value, entry.files)
+    })),
+    addedConfig: additions.config.map((entry) => ({
+      entry: entry.entry,
+      key: entry.key,
+      ...entry.files === void 0 ? {} : { files: entry.files },
+      value: entry.value,
+      reason: typeof entry.value === "string" ? "the preset does not set it" : `${JSON.stringify(entry.value)}: the preset does not set it`
+    }))
+  };
+}
+function describeAddition(value, files) {
+  const where = files === void 0 ? "" : ` for ${files.join(", ")}`;
+  const off = files === void 0 && isOffRuleValue(value) ? "; off changes nothing, since a rule the preset does not name is already off" : "";
+  return `${JSON.stringify(value)}${where}: the preset does not name this rule${off}`;
+}
 
 // src/roles/lint/register.ts
 function registerLint() {
@@ -10749,7 +8269,7 @@ import { createRequire } from "node:module";
 import { join as join33 } from "node:path";
 
 // src/roles/typescript/presets/nest.json
-var nest_default2 = {
+var nest_default = {
   compilerOptions: {
     module: "esnext",
     moduleResolution: "bundler",
@@ -10766,7 +8286,7 @@ var nest_default2 = {
 };
 
 // src/roles/typescript/presets/node.json
-var node_default2 = {
+var node_default = {
   compilerOptions: {
     module: "esnext",
     moduleResolution: "bundler",
@@ -10779,7 +8299,7 @@ var node_default2 = {
 };
 
 // src/roles/typescript/presets/react.json
-var react_default2 = {
+var react_default = {
   compilerOptions: {
     target: "ES2023",
     lib: ["ES2023", "DOM", "DOM.Iterable"],
@@ -10798,7 +8318,7 @@ var react_default2 = {
 };
 
 // src/roles/typescript/presets/shared.json
-var shared_default3 = {
+var shared_default2 = {
   $schema: "https://json.schemastore.org/tsconfig",
   compilerOptions: {
     strict: true,
@@ -10824,15 +8344,15 @@ var shared_default3 = {
 };
 
 // src/roles/typescript/preset-data.ts
-var SHARED = shared_default3;
+var SHARED = shared_default2;
 var LAYERS = {
-  nest: nest_default2,
-  node: node_default2,
-  react: react_default2
+  nest: nest_default,
+  node: node_default,
+  react: react_default
 };
 var SHIPPED_PRESETS = Object.keys(LAYERS).sort();
 var DEFERRED_RULES = Object.entries(SHARED.deferred ?? {}).map(([rule, entry]) => ({ rule, phase: entry.phase, reason: entry.reason })).sort((left, right) => left.rule.localeCompare(right.rule));
-function validate2() {
+function validate() {
   for (const { rule, phase, reason } of DEFERRED_RULES) {
     if (!Number.isInteger(phase) || phase < 2) {
       throw new Error(
@@ -10858,7 +8378,7 @@ function validate2() {
     }
   }
 }
-validate2();
+validate();
 function hasShippedPreset(preset) {
   return preset in LAYERS;
 }