@hublo/sentinel 1.6.0-alpha.1 → 1.6.0-alpha.3

package/dist/{chunk-P7NYSMLS.js → chunk-4DIJRIKJ.js}

@@ -6,7 +6,7 @@ import {
   readNxProjectName,
   readOwnPackage,
   readProjectPackageJson
-} from "./chunk-JRZI5IIN.js";
+} from "./chunk-ZNANJEMK.js";
 import {
   matchesTsconfigPattern
 } from "./chunk-O7REVMOC.js";
@@ -785,9 +785,9 @@ function resolveVitest(cwd) {
 
 // src/roles/test/adapters/vitest/vitest.adapter.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync25, mkdtempSync as mkdtempSync3, readFileSync as readFileSync25, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync25, mkdtempSync as mkdtempSync3, readFileSync as readFileSync26, writeFileSync as writeFileSync2 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { isAbsolute as isAbsolute2, join as join31, relative as relative7, resolve as resolve10 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join32, relative as relative7, resolve as resolve10 } from "node:path";
 
 // src/core/config/tool-args.ts
 import { existsSync as existsSync6 } from "node:fs";
@@ -5935,7 +5935,7 @@ function plan(context) {
 
 // src/roles/test/written-file-linter.ts
 import { existsSync as existsSync24 } from "node:fs";
-import { join as join30 } from "node:path";
+import { join as join31 } from "node:path";
 
 // src/roles/lint/module-baseline.ts
 import { existsSync as existsSync20, readFileSync as readFileSync22 } from "node:fs";
@@ -6706,6 +6706,10 @@ function lintTarget() {
   return { cache: true, inputs: ["default", "^default", `{projectRoot}/${LINT_CONFIG_FILE}`] };
 }
 
+// src/roles/lint/read-adoption.ts
+import { readFileSync as readFileSync25 } from "node:fs";
+import { join as join29 } from "node:path";
+
 // src/core/config/read-adoption.ts
 import { existsSync as existsSync22, readFileSync as readFileSync24 } from "node:fs";
 import { join as join28 } from "node:path";
@@ -6789,7 +6793,8 @@ function readAdoption(cwd, options) {
   const preset = normaliseExtends(parsed.extends).find((entry) => options.presetPattern.test(entry)) ?? null;
   if (preset === null) return NOT_ADOPTED2(target.path);
   const settings = options.settingsKey === null ? parsed : parsed[options.settingsKey];
-  const drift = presetOwnedKeys(settings, options.permitted, options.presetOwns?.(preset));
+  const owned = presetOwnedKeys(settings, options.permitted, options.presetOwns?.(preset));
+  const drift = options.refineDrift !== void 0 && settings !== void 0 ? options.refineDrift(owned, settings, preset) : owned;
   return {
     configFile: target.path,
     preset,
@@ -6800,24 +6805,2687 @@ function readAdoption(cwd, options) {
   };
 }
 
-// src/roles/lint/read-adoption.ts
-function readLintAdoption(cwd) {
-  return readAdoption(cwd, {
-    candidates: [LINT_CONFIG_FILE],
-    markers: ["@hublo/sentinel/oxlint/"],
-    fallback: LINT_CONFIG_FILE,
-    presetPattern: SENTINEL_LINT_PRESET,
-    // Drift for lint is any TOP-LEVEL key beyond `extends`, so the settings the shared
-    // reader inspects are the config's own root rather than a nested options object.
-    settingsKey: null,
-    permitted: PERMITTED_LOCAL_KEYS2
-  });
+// src/roles/lint/module-own-config.ts
+import { isDeepStrictEqual } from "node:util";
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function pluginKey(entry) {
+  if (typeof entry === "string") return entry;
+  if (isRecord(entry) && typeof entry.name === "string") return entry.name;
+  if (isRecord(entry) && typeof entry.specifier === "string") return entry.specifier;
+  return void 0;
+}
+function governedRuleNames(preset) {
+  return /* @__PURE__ */ new Set([
+    ...Object.keys(preset.rules),
+    ...(preset.overrides ?? []).flatMap((override) => Object.keys(override.rules))
+  ]);
+}
+function governedRules(preset) {
+  const governed = /* @__PURE__ */ new Map();
+  for (const name of governedRuleNames(preset)) {
+    const canonical = canonicalRuleName(name);
+    if (!governed.has(canonical)) governed.set(canonical, name);
+  }
+  return governed;
+}
+function moduleOwnBlocks(committed, preset) {
+  const blocks = {};
+  const kept = [];
+  const dropped = [];
+  const added = [];
+  const collided = [];
+  if (Array.isArray(committed.plugins)) {
+    const own = committed.plugins.filter(
+      (name) => typeof name === "string" && !preset.plugins.includes(name)
+    );
+    for (const name of own) added.push({ key: "plugins", entry: `plugins ${name}`, value: name });
+    if (own.length > 0) {
+      blocks.plugins = own;
+      kept.push(
+        `kept this module's own plugins (${own.join(", ")}): the preset does not enable them`
+      );
+    }
+  }
+  if (Array.isArray(committed.jsPlugins)) {
+    const presetKeys = new Set(preset.jsPlugins.map((entry) => pluginKey(entry)));
+    const own = [];
+    for (const entry of committed.jsPlugins) {
+      const key = pluginKey(entry);
+      const named = { key: "jsPlugins", entry: `jsPlugins ${key ?? "?"}`, value: entry };
+      if (key !== void 0 && presetKeys.has(key)) {
+        dropped.push(named.entry);
+        collided.push(named);
+      } else {
+        own.push(entry);
+        added.push(named);
+      }
+    }
+    if (own.length > 0) {
+      blocks.jsPlugins = own;
+      kept.push(
+        `kept ${own.length} jsPlugin(s) this module added (${own.map((entry) => pluginKey(entry) ?? "?").join(", ")})`
+      );
+    }
+  }
+  if (isRecord(committed.settings)) {
+    const presetSettings = preset.settings ?? {};
+    const own = {};
+    for (const [key, value] of Object.entries(committed.settings)) {
+      const named = { key: "settings", entry: `settings.${key}`, value };
+      if (key in presetSettings) {
+        dropped.push(named.entry);
+        collided.push(named);
+      } else {
+        own[key] = value;
+        added.push(named);
+      }
+    }
+    if (Object.keys(own).length > 0) {
+      blocks.settings = own;
+      kept.push(`kept this module's own settings (${Object.keys(own).join(", ")})`);
+    }
+  }
+  if (Array.isArray(committed.overrides)) {
+    const governed = governedRules(preset);
+    const byFiles = /* @__PURE__ */ new Map();
+    for (const block of committed.overrides) {
+      if (!isRecord(block) || !Array.isArray(block.files)) continue;
+      const files = JSON.stringify([...block.files].map(String).sort());
+      const rules = {};
+      for (const [rule, value] of Object.entries(isRecord(block.rules) ? block.rules : {})) {
+        const presetSpelling = governed.get(canonicalRuleName(rule));
+        if (presetSpelling === void 0) rules[rule] = value;
+        else
+          dropped.push(
+            `overrides[${block.files.join(", ")}] ${describeRuleKey(rule, presetSpelling)}`
+          );
+      }
+      const { rules: _rules, ...rest } = block;
+      for (const [key, value] of Object.entries(rest)) {
+        if (key === "files") continue;
+        const files2 = block.files.map(String);
+        added.push({
+          key: "overrides",
+          entry: `overrides[${files2.join(", ")}] ${key}`,
+          value,
+          files: files2
+        });
+      }
+      const merged = byFiles.get(files);
+      if (merged === void 0) {
+        byFiles.set(files, { ...rest, ...Object.keys(rules).length > 0 ? { rules } : {} });
+        continue;
+      }
+      const { files: _sameFiles, ...others } = rest;
+      const mergedRules = { ...isRecord(merged.rules) ? merged.rules : {}, ...rules };
+      Object.assign(
+        merged,
+        others,
+        Object.keys(mergedRules).length > 0 ? { rules: mergedRules } : {}
+      );
+    }
+    const own = [...byFiles.values()].filter((block) => Object.keys(block).length > 1);
+    if (own.length > 0) {
+      blocks.overrides = own;
+      kept.push(
+        `kept ${own.length} override block(s) this module set (${own.map((block) => block.files.join(", ")).join("; ")})`
+      );
+    }
+  }
+  return { blocks, kept, dropped, added, collided };
+}
+var SEVERITIES = {
+  off: "off",
+  allow: "off",
+  "0": "off",
+  warn: "warn",
+  "1": "warn",
+  error: "error",
+  deny: "error",
+  "2": "error"
+};
+function ruleSetting(value) {
+  const [head, ...options] = Array.isArray(value) ? value : [value];
+  if (typeof head !== "string" && typeof head !== "number") return void 0;
+  const severity = SEVERITIES[String(head)];
+  return severity === void 0 ? void 0 : [severity, ...options];
+}
+function isOffRuleValue(value) {
+  return ruleSetting(value)?.[0] === "off";
+}
+function sameRuleSetting(module, preset) {
+  const own = ruleSetting(module);
+  return own !== void 0 && isDeepStrictEqual(own, ruleSetting(preset));
+}
+var filesKey = (files) => JSON.stringify(files.map(String).sort());
+function moduleRuleStanding(committed, preset) {
+  const governed = governedRules(preset);
+  const byCanonical = (rules) => new Map(Object.entries(rules).map(([rule, value]) => [canonicalRuleName(rule), value]));
+  const topLevel = byCanonical(preset.rules);
+  const scoped = new Map(
+    (preset.overrides ?? []).map((override) => [
+      filesKey(override.files),
+      byCanonical(override.rules)
+    ])
+  );
+  const standing = { added: [], conflicts: [] };
+  const classify = (rules, key, files) => {
+    for (const [rule, value] of Object.entries(rules)) {
+      const canonical = canonicalRuleName(rule);
+      const where = files === void 0 ? {} : { files };
+      if (!governed.has(canonical)) {
+        standing.added.push({ rule, ...where, value });
+        continue;
+      }
+      const scope = files === void 0 ? void 0 : scoped.get(filesKey(files));
+      const presetValue = scope?.has(canonical) ? scope.get(canonical) : topLevel.get(canonical);
+      if (presetValue === void 0 || !sameRuleSetting(value, presetValue)) {
+        standing.conflicts.push({ key, rule, ...where });
+      }
+    }
+  };
+  if (isRecord(committed.rules)) classify(committed.rules, "rules");
+  if (Array.isArray(committed.overrides)) {
+    for (const block of committed.overrides) {
+      if (!isRecord(block) || !Array.isArray(block.files) || !isRecord(block.rules)) continue;
+      classify(block.rules, "overrides", block.files.map(String));
+    }
+  }
+  return standing;
+}
+function refineLintDrift(drift, committed, preset) {
+  const ruleConflicts = new Set(
+    moduleRuleStanding(committed, preset).conflicts.map((conflict) => conflict.key)
+  );
+  const collisions = new Set(moduleOwnBlocks(committed, preset).collided.map((entry) => entry.key));
+  const readBack = (key) => {
+    const value = committed[key];
+    switch (key) {
+      case "rules":
+      case "settings":
+        return isRecord(value);
+      case "plugins":
+        return Array.isArray(value) && value.every((name) => typeof name === "string");
+      case "jsPlugins":
+        return Array.isArray(value);
+      case "overrides":
+        return Array.isArray(value) && value.every(
+          (block) => isRecord(block) && Array.isArray(block.files) && (block.rules === void 0 || isRecord(block.rules))
+        );
+      default:
+        return false;
+    }
+  };
+  return drift.filter(
+    (key) => !readBack(key) || ruleConflicts.has(key) || collisions.has(key)
+  );
+}
+
+// src/roles/lint/presets/nest.json
+var nest_default = {
+  plugins: ["typescript", "jest", "vitest", "import", "unicorn", "oxc", "node"],
+  jsPlugins: [
+    "eslint-plugin-no-barrel-files",
+    {
+      name: "nx",
+      specifier: "@nx/eslint-plugin"
+    }
+  ],
+  settings: null,
+  rules: {
+    "array-callback-return": [
+      "error",
+      {
+        allowImplicit: false,
+        checkForEach: false,
+        allowVoid: false
+      }
+    ],
+    complexity: ["error", 30],
+    curly: ["error", "all"],
+    "dot-notation": [
+      "error",
+      {
+        allowKeywords: true,
+        allowPattern: ""
+      }
+    ],
+    eqeqeq: {
+      severity: "warn",
+      reason: "1 pre-existing violation(s) across one module, and they were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero."
+    },
+    "for-direction": "error",
+    "func-style": {
+      severity: "warn",
+      reason: "58 pre-existing violation(s) across network and contract, and they were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero.",
+      options: [
+        "expression",
+        {
+          allowArrowFunctions: false,
+          allowTypeAnnotation: false,
+          overrides: {}
+        }
+      ]
+    },
+    "import/no-duplicates": [
+      "error",
+      {
+        considerQueryString: true,
+        "prefer-inline": true
+      }
+    ],
+    "jest/expect-expect": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-alias-methods": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-commented-out-tests": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-deprecated-functions": "error",
+    "jest/no-disabled-tests": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-done-callback": "error",
+    "jest/no-export": "error",
+    "jest/no-focused-tests": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-identical-title": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-interpolation-in-snapshots": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-jasmine-globals": "error",
+    "jest/no-mocks-import": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-standalone-expect": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-test-prefixes": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/prefer-to-be": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/prefer-to-contain": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/prefer-to-have-length": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/valid-describe-callback": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/valid-expect": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/valid-expect-in-promise": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/valid-title": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "no-async-promise-executor": "error",
+    "no-barrel-files/no-barrel-files": {
+      severity: "off",
+      reason: "nest modules use barrel index.ts files as a deliberate structural pattern; the rule fired 127 times and every one was the architecture working as intended"
+    },
+    "no-case-declarations": "error",
+    "no-compare-neg-zero": "error",
+    "no-cond-assign": ["error", "except-parens"],
+    "no-console": {
+      severity: "warn",
+      reason: "61 pre-existing violation(s) across network, db-client-management and others, and they were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero.",
+      options: [
+        {
+          allow: ["warn", "error"]
+        }
+      ]
+    },
+    "no-constant-binary-expression": "error",
+    "no-constant-condition": [
+      "error",
+      {
+        checkLoops: "allExceptWhileTrue"
+      }
+    ],
+    "no-control-regex": {
+      severity: "off",
+      reason: "the single occurrence is a regex whose whole purpose is stripping ASCII control characters before XML output, which the rule cannot distinguish from an accident"
+    },
+    "no-debugger": "error",
+    "no-delete-var": "error",
+    "no-dupe-else-if": "error",
+    "no-dupe-keys": "error",
+    "no-duplicate-case": "error",
+    "no-else-return": [
+      "error",
+      {
+        allowElseIf: true
+      }
+    ],
+    "no-empty": [
+      "error",
+      {
+        allowEmptyCatch: false
+      }
+    ],
+    "no-empty-character-class": "error",
+    "no-empty-pattern": [
+      "error",
+      {
+        allowObjectPatternsAsParameters: false
+      }
+    ],
+    "no-empty-static-block": "error",
+    "no-ex-assign": "error",
+    "no-extra-boolean-cast": ["error", {}],
+    "no-fallthrough": [
+      "error",
+      {
+        allowEmptyCase: false,
+        reportUnusedFallthroughComment: false
+      }
+    ],
+    "no-global-assign": [
+      "error",
+      {
+        exceptions: []
+      }
+    ],
+    "no-implicit-coercion": [
+      "error",
+      {
+        allow: [],
+        boolean: true,
+        disallowTemplateShorthand: false,
+        number: true,
+        string: true
+      }
+    ],
+    "no-invalid-regexp": ["error", {}],
+    "no-irregular-whitespace": [
+      "error",
+      {
+        skipComments: false,
+        skipJSXText: false,
+        skipRegExps: false,
+        skipStrings: true,
+        skipTemplates: false
+      }
+    ],
+    "no-lonely-if": "error",
+    "no-loss-of-precision": "error",
+    "no-misleading-character-class": "error",
+    "no-nonoctal-decimal-escape": "error",
+    "no-prototype-builtins": "error",
+    "no-regex-spaces": "error",
+    "no-restricted-imports": [
+      "error",
+      {
+        paths: [
+          {
+            name: "@front/theme",
+            importNames: [
+              "hubloTheme",
+              "legacyHubloTheme",
+              "customCommonColors",
+              "customPalette",
+              "breakpointsOptions",
+              "breakpointsValues",
+              "spacingConstants"
+            ],
+            message: "Use the MUI theme context or the public providers exposed by @front/theme."
+          }
+        ],
+        patterns: [
+          {
+            group: ["@front/theme/*", "!@front/theme/testing"],
+            message: "Deep imports from @front/theme are forbidden outside the theme lib."
+          }
+        ]
+      }
+    ],
+    "no-self-assign": [
+      "error",
+      {
+        props: true
+      }
+    ],
+    "no-shadow-restricted-names": [
+      "error",
+      {
+        reportGlobalThis: false
+      }
+    ],
+    "no-sparse-arrays": "error",
+    "no-unneeded-ternary": [
+      "error",
+      {
+        defaultAssignment: true
+      }
+    ],
+    "no-unsafe-finally": "error",
+    "no-unsafe-optional-chaining": {
+      severity: "warn",
+      reason: "7 pre-existing violation(s) across the db-* libs, and they were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero.",
+      options: [
+        {
+          disallowArithmeticOperators: false
+        }
+      ]
+    },
+    "no-unused-labels": "error",
+    "no-unused-private-class-members": "error",
+    "no-useless-backreference": "error",
+    "no-useless-catch": "error",
+    "no-useless-escape": [
+      "error",
+      {
+        allowRegexCharacters: []
+      }
+    ],
+    "no-useless-return": "error",
+    "nx/enforce-module-boundaries": [
+      "error",
+      {
+        enforceBuildableLibDependency: true,
+        allow: [],
+        depConstraints: [
+          {
+            sourceTag: "*",
+            onlyDependOnLibsWithTags: ["*"]
+          }
+        ]
+      }
+    ],
+    "prefer-arrow-callback": [
+      "error",
+      {
+        allowNamedFunctions: false,
+        allowUnboundThis: true
+      }
+    ],
+    "require-yield": "error",
+    "typescript/await-thenable": "error",
+    "typescript/no-confusing-non-null-assertion": "error",
+    "typescript/no-empty-function": {
+      severity: "warn",
+      reason: "pre-existing violations that were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero.",
+      options: [
+        {
+          allow: []
+        }
+      ]
+    },
+    "typescript/no-explicit-any": "error",
+    "typescript/no-floating-promises": [
+      "error",
+      {
+        ignoreVoid: true
+      }
+    ],
+    "typescript/no-import-type-side-effects": "error",
+    "typescript/no-inferrable-types": "error",
+    "typescript/no-non-null-assertion": "error",
+    "typescript/return-await": {
+      severity: "warn",
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
+      options: ["in-try-catch"]
+    },
+    "typescript/switch-exhaustiveness-check": [
+      "error",
+      {
+        considerDefaultExhaustiveForUnions: true
+      }
+    ],
+    "use-isnan": [
+      "error",
+      {
+        enforceForIndexOf: false,
+        enforceForSwitchCase: true
+      }
+    ],
+    "valid-typeof": [
+      "error",
+      {
+        requireStringLiterals: false
+      }
+    ],
+    "vitest/expect-expect": {
+      severity: "warn",
+      reason: "the modules already ran this at warn (confirmed in the bff-admin proof-of-concept config); adoption is like-for-like, so raising it to error is a separate decision"
+    },
+    "vitest/no-alias-methods": "error",
+    "vitest/no-commented-out-tests": {
+      severity: "warn",
+      reason: "the modules already ran this at warn (confirmed in the bff-admin proof-of-concept config); adoption is like-for-like, so raising it to error is a separate decision"
+    },
+    "vitest/no-conditional-expect": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/no-disabled-tests": {
+      severity: "warn",
+      reason: "the modules already ran this at warn (confirmed in the bff-admin proof-of-concept config); a skipped test is a deliberate act often paired with a ticket, so it reports rather than blocks"
+    },
+    "vitest/no-focused-tests": "error",
+    "vitest/no-identical-title": "error",
+    "vitest/no-interpolation-in-snapshots": "error",
+    "vitest/no-mocks-import": "error",
+    "vitest/no-standalone-expect": "error",
+    "vitest/no-test-prefixes": "error",
+    "vitest/prefer-to-be": "error",
+    "vitest/prefer-to-contain": "error",
+    "vitest/prefer-to-have-length": "error",
+    "vitest/require-mock-type-parameters": {
+      severity: "off",
+      reason: "4 479 of the 5 255 findings this plugin reports over this repository, 85% of them. It asks for type parameters on vi.fn<\u2026>(), a convention this codebase never had; adopting it is its own piece of work and not part of reading the right plugin"
+    },
+    "vitest/require-to-throw-message": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/valid-describe-callback": "error",
+    "vitest/valid-expect": {
+      severity: "warn",
+      reason: "1 pre-existing violation(s) across bdd-tooling, and they were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero."
+    },
+    "vitest/valid-expect-in-promise": "error",
+    "vitest/valid-title": "error",
+    "vitest/warn-todo": {
+      severity: "warn",
+      reason: "a todo test is a reminder rather than a defect, so it reports and never blocks"
+    }
+  },
+  uncovered: {
+    "array-bracket-newline": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "array-bracket-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "block-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "computed-property-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "dot-location": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "eol-last": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "func-call-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "import/order": "import ordering is FORMATTING, and the format role owns it: oxfmt's `sortImports` reproduces exactly these groups (builtin, external, internal, parent/index, sibling, alphabetical, blank line between) and sorts a file completely in ONE pass, because it rewrites the whole import block. A lint fixer cannot: it emits text edits over overlapping ranges, so this rule needed several runs to finish (five imports took four passes, measured) and sentinel deliberately runs autofix once. Enforced by `pnpm run format`, not by the linter, which is also why `eslint-plugin-import` is no longer hosted at all: its only other rule, no-duplicates, is native in oxlint.",
+    "key-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "keyword-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "lines-between-class-members": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "no-invalid-this": "no oxlint equivalent, and hosting does not help: the rule crashes on every file under oxlint's plugin API (sourceCode.getJSDocComment is not implemented). Its coverage moves to TypeScript's noImplicitThis, which the sentinel TypeScript role manages.",
+    "no-multi-spaces": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "no-octal": "no oxlint equivalent",
+    "no-restricted-syntax": "no oxlint equivalent, and unlike the react tier this preset hosts no house-rule plugin, so architectural guards written as AST selectors are not enforced at all. They belong in sentinel's `hublo` plugin, next to the frontend ones: tell us which guards your service relies on. A per-module copy of a house rule drifts, which is the problem sentinel exists to remove.",
+    "no-trailing-spaces": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "template-curly-spacing": "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between.",
+    "typescript/member-ordering": "oxlint has no native rule for it, and the preset deliberately does NOT host @typescript-eslint/eslint-plugin: hosting a whole plugin for one rule costs a dependency, a load step and a pass over every file. Accepted as a loss rather than paid for, the same call as no-octal."
+  },
+  overrides: [
+    {
+      files: [
+        "**/*.test.ts",
+        "**/*.test.tsx",
+        "**/*.spec.ts",
+        "**/*.spec.tsx",
+        "**/*.integration-spec.ts",
+        "**/*.e2e-spec.ts"
+      ],
+      rules: {
+        "no-restricted-properties": {
+          severity: "warn",
+          reason: "held at warn: over the 8 011 test files, 7 call Math.random(), 104 call Date.now(), 3 crypto.randomUUID(), 1 performance.now() and 1 process.hrtime, and 28 of the files that read the clock already install fake timers. A warning says it without turning a suite that was green yesterday red. Verified at error on a fixture carrying all nine forms: these six are reported, new Date('2026-01-01') is not, which is the point",
+          options: [
+            {
+              object: "Math",
+              property: "random",
+              message: "No Math.random() in a test: use a deterministic fixture, or stub the random source."
+            },
+            {
+              object: "Date",
+              property: "now",
+              message: "No Date.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+            },
+            {
+              object: "performance",
+              property: "now",
+              message: "No performance.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+            },
+            {
+              object: "process",
+              property: "hrtime",
+              message: "No process.hrtime in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+            },
+            {
+              object: "crypto",
+              property: "randomUUID",
+              message: "No crypto.randomUUID() in a test: use a fixed id, or stub the random source."
+            },
+            {
+              object: "crypto",
+              property: "getRandomValues",
+              message: "No crypto.getRandomValues() in a test: use a fixed buffer, or stub the random source."
+            }
+          ]
+        },
+        "no-restricted-globals": {
+          severity: "warn",
+          reason: "held at warn: 68 test files call setTimeout and only 2 of them install fake timers, so waiting on the real clock is the second source of flakiness after reading it. The flush idiom await new Promise((resolve) => setTimeout(resolve, 0)) is inside that count and is usually harmless, which is exactly why this reports and never blocks",
+          options: [
+            {
+              name: "setTimeout",
+              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+            },
+            {
+              name: "setInterval",
+              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+            }
+          ]
+        }
+      }
+    }
+  ]
+};
+
+// src/roles/lint/presets/node.json
+var node_default = {
+  plugins: ["typescript", "oxc", "vitest"],
+  jsPlugins: [],
+  settings: null,
+  rules: {
+    "typescript/no-unused-expressions": {
+      severity: "warn",
+      reason: "3 pre-existing violations in apps/cloud/institution, never reported because the nx eslint target matched a couple of files per module. Held at warn so adoption stays a lateral move; the debt is visible in `--inspect` and the severity returns once it reaches zero. Parked in the node LAYER rather than the shared base on purpose: the base is the floor every preset stands on, and softening it would weaken presets that have no such debt.",
+      options: [
+        {
+          allowShortCircuit: false,
+          allowTaggedTemplates: false,
+          allowTernary: false
+        }
+      ]
+    },
+    "vitest/expect-expect": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/no-alias-methods": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/no-commented-out-tests": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/no-conditional-expect": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/no-disabled-tests": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/no-focused-tests": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/no-identical-title": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/no-interpolation-in-snapshots": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/no-mocks-import": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/no-standalone-expect": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/no-test-prefixes": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/prefer-to-be": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/prefer-to-contain": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/prefer-to-have-length": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/require-mock-type-parameters": {
+      severity: "off",
+      reason: "4 479 of the 5 255 findings this plugin reports over this repository, 85% of them. It asks for type parameters on vi.fn<\u2026>(), a convention this codebase never had; adopting it is its own piece of work and not part of reading the right plugin"
+    },
+    "vitest/require-to-throw-message": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/valid-describe-callback": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/valid-expect": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/valid-expect-in-promise": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/valid-title": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    },
+    "vitest/warn-todo": {
+      severity: "warn",
+      reason: "the backend tier runs tests and this preset carried no test rule at all, so the whole set ships at warn: it reports and never blocks a suite that was green yesterday"
+    }
+  },
+  overrides: [
+    {
+      files: [
+        "**/*.test.ts",
+        "**/*.test.tsx",
+        "**/*.spec.ts",
+        "**/*.spec.tsx",
+        "**/*.integration-spec.ts",
+        "**/*.e2e-spec.ts"
+      ],
+      rules: {
+        "no-restricted-properties": {
+          severity: "warn",
+          reason: "held at warn: over the 8 011 test files, 7 call Math.random(), 104 call Date.now(), 3 crypto.randomUUID(), 1 performance.now() and 1 process.hrtime, and 28 of the files that read the clock already install fake timers. A warning says it without turning a suite that was green yesterday red. Verified at error on a fixture carrying all nine forms: these six are reported, new Date('2026-01-01') is not, which is the point",
+          options: [
+            {
+              object: "Math",
+              property: "random",
+              message: "No Math.random() in a test: use a deterministic fixture, or stub the random source."
+            },
+            {
+              object: "Date",
+              property: "now",
+              message: "No Date.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+            },
+            {
+              object: "performance",
+              property: "now",
+              message: "No performance.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+            },
+            {
+              object: "process",
+              property: "hrtime",
+              message: "No process.hrtime in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+            },
+            {
+              object: "crypto",
+              property: "randomUUID",
+              message: "No crypto.randomUUID() in a test: use a fixed id, or stub the random source."
+            },
+            {
+              object: "crypto",
+              property: "getRandomValues",
+              message: "No crypto.getRandomValues() in a test: use a fixed buffer, or stub the random source."
+            }
+          ]
+        },
+        "no-restricted-globals": {
+          severity: "warn",
+          reason: "held at warn: 68 test files call setTimeout and only 2 of them install fake timers, so waiting on the real clock is the second source of flakiness after reading it. The flush idiom await new Promise((resolve) => setTimeout(resolve, 0)) is inside that count and is usually harmless, which is exactly why this reports and never blocks",
+          options: [
+            {
+              name: "setTimeout",
+              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+            },
+            {
+              name: "setInterval",
+              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+            }
+          ]
+        }
+      }
+    }
+  ]
+};
+
+// src/roles/lint/presets/react-lib.json
+var react_lib_default = {
+  plugins: ["typescript", "react", "jsx-a11y", "jest", "vitest", "unicorn", "oxc", "nextjs"],
+  jsPlugins: [
+    "eslint-plugin-no-barrel-files",
+    {
+      name: "nx",
+      specifier: "@nx/eslint-plugin"
+    },
+    {
+      name: "jest-dom",
+      specifier: "eslint-plugin-jest-dom"
+    },
+    {
+      name: "storybook",
+      specifier: "eslint-plugin-storybook"
+    },
+    "../plugins/hublo.js",
+    {
+      name: "@tanstack/query",
+      specifier: "@tanstack/eslint-plugin-query"
+    }
+  ],
+  settings: null,
+  renames: {
+    "@next/next": "nextjs"
+  },
+  rules: {
+    "@tanstack/query/exhaustive-deps": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/infinite-query-property-order": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/mutation-property-order": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/no-rest-destructuring": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/no-unstable-deps": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/no-void-query-fn": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/prefer-query-options": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/stable-query-client": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    curly: ["error", "all"],
+    "for-direction": "error",
+    "hublo/no-regex-lookbehind": "error",
+    "jest-dom/prefer-checked": "error",
+    "jest-dom/prefer-empty": "error",
+    "jest-dom/prefer-enabled-disabled": "error",
+    "jest-dom/prefer-focus": "error",
+    "jest-dom/prefer-in-document": "error",
+    "jest-dom/prefer-required": "error",
+    "jest-dom/prefer-to-have-attribute": "error",
+    "jest-dom/prefer-to-have-class": "error",
+    "jest-dom/prefer-to-have-style": "error",
+    "jest-dom/prefer-to-have-text-content": "error",
+    "jest-dom/prefer-to-have-value": "error",
+    "jest/expect-expect": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-alias-methods": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-commented-out-tests": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-conditional-expect": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-deprecated-functions": "error",
+    "jest/no-disabled-tests": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-done-callback": "error",
+    "jest/no-export": "error",
+    "jest/no-focused-tests": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-identical-title": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-interpolation-in-snapshots": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-jasmine-globals": "error",
+    "jest/no-mocks-import": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-standalone-expect": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/no-test-prefixes": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/prefer-to-be": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/prefer-to-contain": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/prefer-to-have-length": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/valid-describe-callback": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/valid-expect": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/valid-expect-in-promise": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jest/valid-title": {
+      severity: "off",
+      reason: "the vitest plugin reports the same violation at the same offset, and this repository runs vitest: measured over apps and libs, 765 of this plugin\u2019s 769 findings are duplicates of the vitest ones. Its rules fire on jest-style files too, so nothing is lost by reading them once"
+    },
+    "jsx-a11y/anchor-is-valid": [
+      "error",
+      {
+        components: ["Link"],
+        specialLink: ["hrefLeft", "hrefRight"],
+        aspects: ["invalidHref", "preferButton"]
+      }
+    ],
+    "nextjs/google-font-display": {
+      severity: "warn",
+      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
+    },
+    "nextjs/google-font-preconnect": {
+      severity: "warn",
+      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
+    },
+    "nextjs/inline-script-id": "error",
+    "nextjs/next-script-for-ga": {
+      severity: "warn",
+      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
+    },
+    "nextjs/no-assign-module-variable": "error",
+    "nextjs/no-async-client-component": {
+      severity: "warn",
+      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
+    },
+    "nextjs/no-before-interactive-script-outside-document": {
+      severity: "warn",
+      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
+    },
+    "nextjs/no-css-tags": {
+      severity: "warn",
+      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
+    },
+    "nextjs/no-document-import-in-page": "error",
+    "nextjs/no-duplicate-head": "error",
+    "nextjs/no-head-element": {
+      severity: "warn",
+      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
+    },
+    "nextjs/no-head-import-in-document": "error",
+    "nextjs/no-html-link-for-pages": "error",
+    "nextjs/no-img-element": {
+      severity: "warn",
+      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
+    },
+    "nextjs/no-page-custom-font": {
+      severity: "warn",
+      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
+    },
+    "nextjs/no-script-component-in-head": "error",
+    "nextjs/no-styled-jsx-in-document": {
+      severity: "warn",
+      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
+    },
+    "nextjs/no-sync-scripts": "error",
+    "nextjs/no-title-in-document-head": {
+      severity: "warn",
+      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
+    },
+    "nextjs/no-typos": {
+      severity: "warn",
+      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
+    },
+    "nextjs/no-unwanted-polyfillio": {
+      severity: "warn",
+      reason: "Next's own recommended config sets this at warn, and the libs inherit it. Four of the ten front libs really do import `next` (`components` alone in 40 files), so the rule is not decoration here, but its severity is Next's call rather than ours."
+    },
+    "no-async-promise-executor": "error",
+    "no-barrel-files/no-barrel-files": {
+      severity: "warn",
+      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first."
+    },
+    "no-case-declarations": "error",
+    "no-compare-neg-zero": "error",
+    "no-cond-assign": ["error", "except-parens"],
+    "no-console": {
+      severity: "warn",
+      reason: "53 pre-existing violation(s) across libs/front/analytics, and they were never reported: the nx eslint target matched a couple of files per module (2 of 2888 on bff-admin), so the rule was configured and not enforced. Held at warn so adoption stays a lateral move rather than turning green modules red for code that predates it; the debt stays visible and countable via `--run --lint --json` and `--inspect`, and the severity is restored once it reaches zero.",
+      options: [
+        {
+          allow: ["warn", "error"]
+        }
+      ]
+    },
+    "no-constant-binary-expression": "error",
+    "no-constant-condition": [
+      "error",
+      {
+        checkLoops: "allExceptWhileTrue"
+      }
+    ],
+    "no-control-regex": "error",
+    "no-debugger": "error",
+    "no-delete-var": "error",
+    "no-dupe-else-if": "error",
+    "no-duplicate-case": "error",
+    "no-empty": [
+      "error",
+      {
+        allowEmptyCatch: false
+      }
+    ],
+    "no-empty-character-class": "error",
+    "no-empty-pattern": [
+      "error",
+      {
+        allowObjectPatternsAsParameters: false
+      }
+    ],
+    "no-empty-static-block": "error",
+    "no-ex-assign": "error",
+    "no-extra-boolean-cast": ["error", {}],
+    "no-fallthrough": [
+      "error",
+      {
+        allowEmptyCase: false,
+        reportUnusedFallthroughComment: false
+      }
+    ],
+    "no-global-assign": [
+      "error",
+      {
+        exceptions: []
+      }
+    ],
+    "no-invalid-regexp": ["error", {}],
+    "no-irregular-whitespace": [
+      "error",
+      {
+        skipComments: false,
+        skipJSXText: false,
+        skipRegExps: false,
+        skipStrings: true,
+        skipTemplates: false
+      }
+    ],
+    "no-loss-of-precision": "error",
+    "no-misleading-character-class": "error",
+    "no-nonoctal-decimal-escape": "error",
+    "no-prototype-builtins": "error",
+    "no-regex-spaces": "error",
+    "no-restricted-properties": [
+      "error",
+      {
+        object: "i18n",
+        property: "changeLanguage",
+        message: "This does not work in Nextjs. Please use Link or router instead. See https://nextjs.org/docs/advanced-features/i18n-routing#transition-between-locales"
+      }
+    ],
+    "no-self-assign": [
+      "error",
+      {
+        props: true
+      }
+    ],
+    "no-shadow-restricted-names": [
+      "error",
+      {
+        reportGlobalThis: false
+      }
+    ],
+    "no-sparse-arrays": "error",
+    "no-unsafe-finally": "error",
+    "no-unsafe-optional-chaining": [
+      "error",
+      {
+        disallowArithmeticOperators: false
+      }
+    ],
+    "no-unused-labels": "error",
+    "no-unused-private-class-members": "error",
+    "no-useless-backreference": "error",
+    "no-useless-catch": "error",
+    "no-useless-escape": [
+      "error",
+      {
+        allowRegexCharacters: []
+      }
+    ],
+    "nx/enforce-module-boundaries": [
+      "error",
+      {
+        enforceBuildableLibDependency: true,
+        allow: [],
+        depConstraints: [
+          {
+            sourceTag: "*",
+            onlyDependOnLibsWithTags: ["*"]
+          }
+        ]
+      }
+    ],
+    "react-hooks/exhaustive-deps": {
+      severity: "warn",
+      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first."
+    },
+    "react-hooks/rules-of-hooks": "error",
+    "react/jsx-curly-brace-presence": {
+      severity: "warn",
+      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first.",
+      options: [
+        {
+          props: "never",
+          children: "never"
+        }
+      ]
+    },
+    "react/jsx-no-useless-fragment": [
+      "error",
+      {
+        allowExpressions: true
+      }
+    ],
+    "require-yield": "error",
+    "typescript/consistent-type-imports": [
+      "error",
+      {
+        fixStyle: "inline-type-imports"
+      }
+    ],
+    "typescript/no-empty-function": [
+      "error",
+      {
+        allow: []
+      }
+    ],
+    "typescript/no-explicit-any": "error",
+    "typescript/no-floating-promises": [
+      "error",
+      {
+        ignoreVoid: true
+      }
+    ],
+    "typescript/no-inferrable-types": "error",
+    "typescript/no-non-null-assertion": {
+      severity: "warn",
+      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first."
+    },
+    "typescript/no-useless-constructor": {
+      severity: "warn",
+      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first."
+    },
+    "typescript/return-await": {
+      severity: "warn",
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
+      options: ["in-try-catch"]
+    },
+    "use-isnan": [
+      "error",
+      {
+        enforceForIndexOf: false,
+        enforceForSwitchCase: true
+      }
+    ],
+    "valid-typeof": [
+      "error",
+      {
+        requireStringLiterals: false
+      }
+    ],
+    "vitest/expect-expect": [
+      "error",
+      {
+        assertFunctionNames: [
+          "expect",
+          "expect*",
+          "waitForElementToBeRemoved",
+          "screen.findBy*",
+          "result.findBy*"
+        ]
+      }
+    ],
+    "vitest/no-alias-methods": "error",
+    "vitest/no-commented-out-tests": {
+      severity: "warn",
+      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first."
+    },
+    "vitest/no-conditional-expect": "error",
+    "vitest/no-disabled-tests": {
+      severity: "warn",
+      reason: "the front libs already run this at warn today (read with `eslint --print-config`), so keeping it there is a like-for-like migration. Raising it to error would be a NEW enforcement decision, and it needs its own count of violations first."
+    },
+    "vitest/no-focused-tests": "error",
+    "vitest/no-identical-title": "error",
+    "vitest/no-interpolation-in-snapshots": "error",
+    "vitest/no-mocks-import": "error",
+    "vitest/no-standalone-expect": "error",
+    "vitest/no-test-prefixes": "error",
+    "vitest/prefer-to-be": "error",
+    "vitest/prefer-to-contain": "error",
+    "vitest/prefer-to-have-length": "error",
+    "vitest/require-mock-type-parameters": {
+      severity: "off",
+      reason: "4 479 of the 5 255 findings this plugin reports over this repository, 85% of them. It asks for type parameters on vi.fn<\u2026>(), a convention this codebase never had; adopting it is its own piece of work and not part of reading the right plugin"
+    },
+    "vitest/require-to-throw-message": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/valid-describe-callback": "error",
+    "vitest/valid-expect": "error",
+    "vitest/valid-expect-in-promise": "error",
+    "vitest/valid-title": "error",
+    "vitest/warn-todo": {
+      severity: "warn",
+      reason: "a todo test is a reminder rather than a defect, so it reports and never blocks"
+    }
+  },
+  overrides: [
+    {
+      files: ["**/*.stories.ts", "**/*.stories.tsx", "**/*.stories.js", "**/*.stories.jsx"],
+      rules: {
+        "storybook/await-interactions": "error",
+        "storybook/context-in-play-function": "error",
+        "storybook/default-exports": "error",
+        "storybook/hierarchy-separator": {
+          severity: "warn",
+          reason: "the storybook plugin sets this severity for story files; adoption is like-for-like"
+        },
+        "storybook/no-redundant-story-name": {
+          severity: "warn",
+          reason: "the storybook plugin sets this severity for story files; adoption is like-for-like"
+        },
+        "storybook/no-renderer-packages": "error",
+        "storybook/prefer-pascal-case": {
+          severity: "warn",
+          reason: "the storybook plugin sets this severity for story files; adoption is like-for-like"
+        },
+        "storybook/story-exports": "error",
+        "storybook/use-storybook-expect": "error",
+        "storybook/use-storybook-testing-library": "error",
+        "react-hooks/rules-of-hooks": {
+          severity: "off",
+          reason: "off for story files in the module's own config, and it has to be: a story's render function is not a React component and the rule cannot tell, so it reports every useState in a story. Measured on libs/front/components: 7 errors, none of them real."
+        }
+      }
+    },
+    {
+      files: [
+        "**/*.test.ts",
+        "**/*.test.tsx",
+        "**/*.spec.ts",
+        "**/*.spec.tsx",
+        "**/*.integration-spec.ts",
+        "**/*.e2e-spec.ts"
+      ],
+      rules: {
+        "no-restricted-properties": {
+          severity: "warn",
+          reason: "held at warn: over the 8 011 test files, 7 call Math.random(), 104 call Date.now(), 3 crypto.randomUUID(), 1 performance.now() and 1 process.hrtime, and 28 of the files that read the clock already install fake timers. A warning says it without turning a suite that was green yesterday red. Verified at error on a fixture carrying all nine forms: these six are reported, new Date('2026-01-01') is not, which is the point",
+          options: [
+            {
+              object: "Math",
+              property: "random",
+              message: "No Math.random() in a test: use a deterministic fixture, or stub the random source."
+            },
+            {
+              object: "Date",
+              property: "now",
+              message: "No Date.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+            },
+            {
+              object: "performance",
+              property: "now",
+              message: "No performance.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+            },
+            {
+              object: "process",
+              property: "hrtime",
+              message: "No process.hrtime in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+            },
+            {
+              object: "crypto",
+              property: "randomUUID",
+              message: "No crypto.randomUUID() in a test: use a fixed id, or stub the random source."
+            },
+            {
+              object: "crypto",
+              property: "getRandomValues",
+              message: "No crypto.getRandomValues() in a test: use a fixed buffer, or stub the random source."
+            }
+          ]
+        },
+        "no-restricted-globals": {
+          severity: "warn",
+          reason: "held at warn: 68 test files call setTimeout and only 2 of them install fake timers, so waiting on the real clock is the second source of flakiness after reading it. The flush idiom await new Promise((resolve) => setTimeout(resolve, 0)) is inside that count and is usually harmless, which is exactly why this reports and never blocks",
+          options: [
+            {
+              name: "setTimeout",
+              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+            },
+            {
+              name: "setInterval",
+              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+            }
+          ]
+        }
+      }
+    }
+  ],
+  uncovered: {
+    "no-octal": "no oxlint equivalent",
+    "no-restricted-syntax": "no oxlint equivalent; the house rules it encoded ship as the local `hublo` plugin instead, so this tier hosts `../plugins/hublo.js` too. It enforces exactly one of them: `hublo/no-regex-lookbehind`, because a library is where that bug is WRITTEN and it reaches an app tier only by being imported (HUB-43431 shipped from libs/front/components into the worker app). The palette selectors stay app-tier only.",
+    semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
+  }
+};
+
+// src/roles/lint/presets/react.json
+var react_default = {
+  plugins: ["typescript", "react", "jsx-a11y", "jest", "vitest", "import", "unicorn", "oxc"],
+  jsPlugins: [
+    "eslint-plugin-no-barrel-files",
+    {
+      name: "nx",
+      specifier: "@nx/eslint-plugin"
+    },
+    {
+      name: "@tanstack/query",
+      specifier: "@tanstack/eslint-plugin-query"
+    },
+    {
+      name: "styled-components-a11y",
+      specifier: "eslint-plugin-styled-components-a11y"
+    },
+    {
+      name: "react-refresh",
+      specifier: "eslint-plugin-react-refresh"
+    },
+    "../plugins/hublo.js",
+    {
+      name: "@tanstack/router",
+      specifier: "@tanstack/eslint-plugin-router"
+    }
+  ],
+  settings: null,
+  rules: {
+    "@tanstack/query/exhaustive-deps": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/infinite-query-property-order": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/mutation-property-order": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/no-rest-destructuring": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/no-unstable-deps": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/no-void-query-fn": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/prefer-query-options": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/query/stable-query-client": {
+      severity: "warn",
+      reason: "held at warn across the react tier: the plugin is now a dependency of sentinel, so the rule runs everywhere instead of being named by a preset that could not load it. Measured over 8 784 files of console, host-admin, libs/front/api and libs/front/components, the eight rules report 806 findings, of which 796 are prefer-query-options and 10 are the correctness ones (exhaustive-deps 9, no-rest-destructuring 1). A module that wants them to block decides that for itself, and pays the 10 fixes"
+    },
+    "@tanstack/router/create-route-property-order": {
+      severity: "warn",
+      reason: "held at warn on the APP tier only: routes live in applications, and libs/front holds 0 of the 227 files that call createFileRoute, the same reason hublo/require-reload-document is here and not in react-lib. Measured over the three fronts, 7 133 files and 226 route files, the two rules report 3 findings, all create-route-property-order on host-admin. The order is not cosmetic: TanStack Router infers types through it"
+    },
+    "@tanstack/router/route-param-names": {
+      severity: "warn",
+      reason: "held at warn on the APP tier only: routes live in applications, and libs/front holds 0 of the 227 files that call createFileRoute, the same reason hublo/require-reload-document is here and not in react-lib. Measured over the three fronts, 7 133 files and 226 route files, the two rules report 3 findings, all create-route-property-order on host-admin. The order is not cosmetic: TanStack Router infers types through it"
+    },
+    curly: ["error", "all"],
+    "for-direction": "error",
+    "hublo/no-palette-common": {
+      severity: "off",
+      reason: "the house rule finds 3 real violations; they are fixed as their own change rather than inside a linter swap, so the rule ships visible-but-off and can be switched on once they are"
+    },
+    "hublo/no-regex-lookbehind": "error",
+    "hublo/require-reload-document": "error",
+    "jest/expect-expect": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-alias-methods": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-commented-out-tests": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-conditional-expect": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-deprecated-functions": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-disabled-tests": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-done-callback": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-export": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-focused-tests": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-identical-title": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-interpolation-in-snapshots": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-jasmine-globals": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-mocks-import": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-standalone-expect": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/no-test-prefixes": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/prefer-to-be": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/prefer-to-contain": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/prefer-to-have-length": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/valid-describe-callback": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/valid-expect": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/valid-expect-in-promise": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jest/valid-title": {
+      severity: "off",
+      reason: "pre-existing test-suite debt; enabling it on adoption would surface a wall of findings and make a lateral move look like a regression"
+    },
+    "jsx-a11y/alt-text": "error",
+    "jsx-a11y/anchor-has-content": "error",
+    "jsx-a11y/anchor-is-valid": "error",
+    "jsx-a11y/aria-activedescendant-has-tabindex": "error",
+    "jsx-a11y/aria-props": "error",
+    "jsx-a11y/aria-proptypes": "error",
+    "jsx-a11y/aria-role": "error",
+    "jsx-a11y/aria-unsupported-elements": "error",
+    "jsx-a11y/autocomplete-valid": "error",
+    "jsx-a11y/click-events-have-key-events": "error",
+    "jsx-a11y/heading-has-content": "error",
+    "jsx-a11y/html-has-lang": "error",
+    "jsx-a11y/iframe-has-title": "error",
+    "jsx-a11y/img-redundant-alt": {
+      severity: "off",
+      reason: 'one real finding, a decorative image whose title is already rendered as a heading beside it, so the fix is alt="". A genuine accessibility issue rather than a false positive: parked only so swapping linters stays a lateral move, and worth switching back on as soon as it is fixed'
+    },
+    "jsx-a11y/interactive-supports-focus": [
+      "error",
+      {
+        tabbable: [
+          "button",
+          "checkbox",
+          "link",
+          "progressbar",
+          "searchbox",
+          "slider",
+          "spinbutton",
+          "switch",
+          "textbox"
+        ]
+      }
+    ],
+    "jsx-a11y/label-has-associated-control": "error",
+    "jsx-a11y/media-has-caption": "error",
+    "jsx-a11y/mouse-events-have-key-events": "error",
+    "jsx-a11y/no-access-key": "error",
+    "jsx-a11y/no-autofocus": "error",
+    "jsx-a11y/no-distracting-elements": "error",
+    "jsx-a11y/no-interactive-element-to-noninteractive-role": "error",
+    "jsx-a11y/no-noninteractive-element-interactions": [
+      "error",
+      {
+        body: ["onError", "onLoad"],
+        iframe: ["onError", "onLoad"],
+        img: ["onError", "onLoad"]
+      }
+    ],
+    "jsx-a11y/no-noninteractive-element-to-interactive-role": "error",
+    "jsx-a11y/no-noninteractive-tabindex": "error",
+    "jsx-a11y/no-redundant-roles": "error",
+    "jsx-a11y/no-static-element-interactions": "error",
+    "jsx-a11y/role-has-required-aria-props": "error",
+    "jsx-a11y/role-supports-aria-props": "error",
+    "jsx-a11y/scope": "error",
+    "jsx-a11y/tabindex-no-positive": "error",
+    "no-async-promise-executor": "error",
+    "no-barrel-files/no-barrel-files": {
+      severity: "warn",
+      reason: "the modules already ran this at warn (confirmed in the host-admin proof-of-concept config); nest disables it outright as deliberate architecture, react keeps it visible"
+    },
+    "no-case-declarations": "error",
+    "no-compare-neg-zero": "error",
+    "no-cond-assign": ["error", "except-parens"],
+    "no-console": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "no-constant-binary-expression": "error",
+    "no-constant-condition": [
+      "error",
+      {
+        checkLoops: "allExceptWhileTrue"
+      }
+    ],
+    "no-control-regex": "error",
+    "no-debugger": "error",
+    "no-delete-var": "error",
+    "no-dupe-else-if": "error",
+    "no-duplicate-case": "error",
+    "no-empty": [
+      "error",
+      {
+        allowEmptyCatch: false
+      }
+    ],
+    "no-empty-character-class": "error",
+    "no-empty-pattern": [
+      "error",
+      {
+        allowObjectPatternsAsParameters: false
+      }
+    ],
+    "no-empty-static-block": "error",
+    "no-ex-assign": "error",
+    "no-extra-boolean-cast": ["error", {}],
+    "no-fallthrough": [
+      "error",
+      {
+        allowEmptyCase: false,
+        reportUnusedFallthroughComment: false
+      }
+    ],
+    "no-global-assign": [
+      "error",
+      {
+        exceptions: []
+      }
+    ],
+    "no-invalid-regexp": ["error", {}],
+    "no-irregular-whitespace": [
+      "error",
+      {
+        skipComments: false,
+        skipJSXText: false,
+        skipRegExps: false,
+        skipStrings: true,
+        skipTemplates: false
+      }
+    ],
+    "no-loss-of-precision": "error",
+    "no-misleading-character-class": "error",
+    "no-nonoctal-decimal-escape": "error",
+    "no-prototype-builtins": "error",
+    "no-regex-spaces": "error",
+    "no-restricted-imports": [
+      "error",
+      {
+        patterns: [
+          {
+            group: ["next/*"],
+            message: "Importing from next/* is not allowed in the admin project."
+          },
+          {
+            group: ["storybook/*"],
+            message: "Importing from storybook/* is not allowed in the admin project."
+          },
+          {
+            group: ["@nestjs/*"],
+            message: "Importing from @nestjs/* is not allowed in the admin project."
+          },
+          {
+            group: ["next-i18next"],
+            message: "Importing from next-i18next is not allowed in the admin project."
+          },
+          {
+            group: ["@hublo/style/colors", "@hublo/style/colors/*"],
+            message: "Importing runtime colors directly is not allowed. Use the MUI theme, theme-derived CSS variables, or an explicit product-specific mapping."
+          }
+        ]
+      }
+    ],
+    "no-self-assign": [
+      "error",
+      {
+        props: true
+      }
+    ],
+    "no-shadow-restricted-names": [
+      "error",
+      {
+        reportGlobalThis: false
+      }
+    ],
+    "no-sparse-arrays": "error",
+    "no-unexpected-multiline": "error",
+    "no-unsafe-finally": "error",
+    "no-unsafe-optional-chaining": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "no-unused-labels": "error",
+    "no-unused-private-class-members": "error",
+    "no-useless-backreference": "error",
+    "no-useless-catch": "error",
+    "no-useless-escape": [
+      "error",
+      {
+        allowRegexCharacters: []
+      }
+    ],
+    "nx/enforce-module-boundaries": [
+      "error",
+      {
+        enforceBuildableLibDependency: true,
+        allow: [],
+        depConstraints: [
+          {
+            sourceTag: "*",
+            onlyDependOnLibsWithTags: ["*"]
+          }
+        ]
+      }
+    ],
+    "react-hooks/exhaustive-deps": {
+      severity: "warn",
+      reason: "the modules already ran this at warn (confirmed in the host-admin proof-of-concept config); its suggested fix can change behaviour, so it reports and a human decides"
+    },
+    "react-hooks/rules-of-hooks": "error",
+    "react-refresh/only-export-components": {
+      severity: "warn",
+      reason: "the modules already ran this at warn (confirmed in the host-admin proof-of-concept config); it guards fast-refresh ergonomics, not correctness",
+      options: [
+        {
+          allowConstantExport: true
+        }
+      ]
+    },
+    "react/jsx-curly-brace-presence": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "require-yield": "error",
+    "styled-components-a11y/alt-text": "error",
+    "styled-components-a11y/anchor-has-content": "error",
+    "styled-components-a11y/anchor-is-valid": "error",
+    "styled-components-a11y/aria-activedescendant-has-tabindex": "error",
+    "styled-components-a11y/aria-props": "error",
+    "styled-components-a11y/aria-proptypes": "error",
+    "styled-components-a11y/aria-role": "error",
+    "styled-components-a11y/aria-unsupported-elements": "error",
+    "styled-components-a11y/autocomplete-valid": "error",
+    "styled-components-a11y/click-events-have-key-events": "error",
+    "styled-components-a11y/control-has-associated-label": {
+      severity: "off",
+      reason: "off in the host-admin proof-of-concept config, with its element and role ignore lists; it fires on composed styled components where the label lives in a wrapper the rule cannot see",
+      options: [
+        {
+          ignoreElements: ["audio", "canvas", "embed", "input", "textarea", "tr", "video"],
+          ignoreRoles: [
+            "grid",
+            "listbox",
+            "menu",
+            "menubar",
+            "radiogroup",
+            "row",
+            "tablist",
+            "toolbar",
+            "tree",
+            "treegrid"
+          ],
+          includeRoles: ["alert", "dialog"]
+        }
+      ]
+    },
+    "styled-components-a11y/heading-has-content": "error",
+    "styled-components-a11y/html-has-lang": "error",
+    "styled-components-a11y/iframe-has-title": "error",
+    "styled-components-a11y/img-redundant-alt": "error",
+    "styled-components-a11y/interactive-supports-focus": [
+      "error",
+      {
+        tabbable: [
+          "button",
+          "checkbox",
+          "link",
+          "progressbar",
+          "searchbox",
+          "slider",
+          "spinbutton",
+          "switch",
+          "textbox"
+        ]
+      }
+    ],
+    "styled-components-a11y/label-has-associated-control": "error",
+    "styled-components-a11y/label-has-for": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "styled-components-a11y/media-has-caption": "error",
+    "styled-components-a11y/mouse-events-have-key-events": "error",
+    "styled-components-a11y/no-access-key": "error",
+    "styled-components-a11y/no-autofocus": "error",
+    "styled-components-a11y/no-distracting-elements": "error",
+    "styled-components-a11y/no-interactive-element-to-noninteractive-role": "error",
+    "styled-components-a11y/no-noninteractive-element-interactions": [
+      "error",
+      {
+        body: ["onError", "onLoad"],
+        iframe: ["onError", "onLoad"],
+        img: ["onError", "onLoad"]
+      }
+    ],
+    "styled-components-a11y/no-noninteractive-element-to-interactive-role": "error",
+    "styled-components-a11y/no-noninteractive-tabindex": "error",
+    "styled-components-a11y/no-redundant-roles": "error",
+    "styled-components-a11y/no-static-element-interactions": "error",
+    "styled-components-a11y/role-has-required-aria-props": "error",
+    "styled-components-a11y/role-supports-aria-props": "error",
+    "styled-components-a11y/scope": "error",
+    "styled-components-a11y/tabindex-no-positive": "error",
+    "typescript/await-thenable": "error",
+    "typescript/no-array-delete": "error",
+    "typescript/no-base-to-string": "error",
+    "typescript/no-duplicate-type-constituents": "error",
+    "typescript/no-empty-function": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-explicit-any": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-floating-promises": [
+      "error",
+      {
+        ignoreVoid: true
+      }
+    ],
+    "typescript/no-for-in-array": "error",
+    "typescript/no-implied-eval": "error",
+    "typescript/no-inferrable-types": "error",
+    "typescript/no-misused-promises": [
+      "error",
+      {
+        checksVoidReturn: {
+          attributes: false
+        }
+      }
+    ],
+    "typescript/no-non-null-assertion": {
+      severity: "warn",
+      reason: "kept at the severity the proof of concept measured; no module config set it, so raising it to error would be a NEW enforcement decision rather than a like-for-like migration, and it needs its own count of violations first"
+    },
+    "typescript/no-redundant-type-constituents": "error",
+    "typescript/no-require-imports": "error",
+    "typescript/no-unnecessary-type-assertion": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-argument": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-assignment": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-call": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-enum-comparison": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-member-access": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-return": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/no-unsafe-unary-minus": "error",
+    "typescript/only-throw-error": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/prefer-promise-reject-errors": "error",
+    "typescript/require-await": {
+      severity: "off",
+      reason: "pre-existing debt measured during the proof of concept; parked so adoption stays non-breaking"
+    },
+    "typescript/restrict-plus-operands": "error",
+    "typescript/restrict-template-expressions": "error",
+    "typescript/return-await": {
+      severity: "warn",
+      reason: "replaces the deprecated core `no-return-await`, which both modules set to error but which was never actually reporting: the nx lint target expanded to 2 files of 2888. `in-try-catch` rather than `never`, and the planning adoption is what settled it. `never` forces `return await f()` to become `const x = await f(); return x` even inside a `try`, where the await is REQUIRED for the catch to fire: it produced 10 such edits across 15 modules, every one of them inside a try/catch, and every one of them a rewrite that made the code longer without making it safer. Worse, the obvious reading of the rule is to delete the `await`, which silently stops the catch from running. `in-try-catch` is what typescript-eslint recommends and flags none of those 10. Held at warn so adoption does not turn a green module red, and raised to error once the remaining findings are fixed.",
+      options: ["in-try-catch"]
+    },
+    "typescript/switch-exhaustiveness-check": {
+      severity: "warn",
+      reason: "kept at the severity the proof of concept measured; no module config set it, so raising it to error would be a NEW enforcement decision rather than a like-for-like migration, and it needs its own count of violations first"
+    },
+    "typescript/unbound-method": "error",
+    "use-isnan": [
+      "error",
+      {
+        enforceForIndexOf: false,
+        enforceForSwitchCase: true
+      }
+    ],
+    "valid-typeof": [
+      "error",
+      {
+        requireStringLiterals: false
+      }
+    ],
+    "vitest/expect-expect": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/no-alias-methods": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/no-commented-out-tests": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/no-conditional-expect": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/no-disabled-tests": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/no-focused-tests": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/no-identical-title": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/no-interpolation-in-snapshots": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/no-mocks-import": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/no-standalone-expect": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/no-test-prefixes": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/prefer-to-be": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/prefer-to-contain": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/prefer-to-have-length": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/require-mock-type-parameters": {
+      severity: "off",
+      reason: "4 479 of the 5 255 findings this plugin reports over this repository, 85% of them. It asks for type parameters on vi.fn<\u2026>(), a convention this codebase never had; adopting it is its own piece of work and not part of reading the right plugin"
+    },
+    "vitest/require-to-throw-message": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/valid-describe-callback": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/valid-expect": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/valid-expect-in-promise": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/valid-title": {
+      severity: "warn",
+      reason: "new to this preset and the test suite predates it, so it reports and never blocks. The reason the jest equivalent was parked was that enabling it on adoption would make a lateral move look like a regression; a warning does not"
+    },
+    "vitest/warn-todo": {
+      severity: "warn",
+      reason: "a todo test is a reminder rather than a defect, so it reports and never blocks"
+    }
+  },
+  uncovered: {
+    "import/order": "import ordering is FORMATTING, and the format role owns it: oxfmt's `sortImports` reproduces exactly these groups (builtin, external, internal, parent/index, sibling, alphabetical, blank line between) and sorts a file completely in ONE pass, because it rewrites the whole import block. A lint fixer cannot: it emits text edits over overlapping ranges, so this rule needed several runs to finish (five imports took four passes, measured) and sentinel deliberately runs autofix once. Enforced by `pnpm run format`, not by the linter, which is also why `eslint-plugin-import` is no longer hosted at all: its only other rule, no-duplicates, is native in oxlint.",
+    "no-octal": "no oxlint equivalent",
+    "no-restricted-syntax": "no oxlint equivalent as configuration, so the AST selectors this repo used are shipped as real rules in the local `hublo` plugin instead, which this tier hosts (`../plugins/hublo.js`). Three are hosted today: the eight palette selectors as `hublo/no-palette-common`, the lookbehind selector as `hublo/no-regex-lookbehind`, and the TanStack Router one as `hublo/require-reload-document`, carried here from an ESLint selector in the monorepo (PR #22043) because ADR 0042 makes this the layer that outlives it. App tier only: measured on main, `libs/front` calls `redirect(` nowhere, while host-admin does in 93 files and console in 2. Any selector NOT in that plugin is not enforced here; propose it and it joins the plugin rather than a per-module copy.",
+    semi: "formatting, and the formatter owns it. It moves to oxfmt, which is deliberately the LAST step of the migration, so nothing enforces it in between."
+  },
+  overrides: [
+    {
+      files: [
+        "**/*.test.ts",
+        "**/*.test.tsx",
+        "**/*.spec.ts",
+        "**/*.spec.tsx",
+        "**/*.integration-spec.ts",
+        "**/*.e2e-spec.ts"
+      ],
+      rules: {
+        "no-restricted-properties": {
+          severity: "warn",
+          reason: "held at warn: over the 8 011 test files, 7 call Math.random(), 104 call Date.now(), 3 crypto.randomUUID(), 1 performance.now() and 1 process.hrtime, and 28 of the files that read the clock already install fake timers. A warning says it without turning a suite that was green yesterday red. Verified at error on a fixture carrying all nine forms: these six are reported, new Date('2026-01-01') is not, which is the point",
+          options: [
+            {
+              object: "Math",
+              property: "random",
+              message: "No Math.random() in a test: use a deterministic fixture, or stub the random source."
+            },
+            {
+              object: "Date",
+              property: "now",
+              message: "No Date.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+            },
+            {
+              object: "performance",
+              property: "now",
+              message: "No performance.now() in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+            },
+            {
+              object: "process",
+              property: "hrtime",
+              message: "No process.hrtime in a test: use vi.useFakeTimers() with vi.setSystemTime()."
+            },
+            {
+              object: "crypto",
+              property: "randomUUID",
+              message: "No crypto.randomUUID() in a test: use a fixed id, or stub the random source."
+            },
+            {
+              object: "crypto",
+              property: "getRandomValues",
+              message: "No crypto.getRandomValues() in a test: use a fixed buffer, or stub the random source."
+            }
+          ]
+        },
+        "no-restricted-globals": {
+          severity: "warn",
+          reason: "held at warn: 68 test files call setTimeout and only 2 of them install fake timers, so waiting on the real clock is the second source of flakiness after reading it. The flush idiom await new Promise((resolve) => setTimeout(resolve, 0)) is inside that count and is usually harmless, which is exactly why this reports and never blocks",
+          options: [
+            {
+              name: "setTimeout",
+              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+            },
+            {
+              name: "setInterval",
+              message: "No real timer in a test: vi.useFakeTimers() then vi.advanceTimersByTime()."
+            }
+          ]
+        }
+      }
+    }
+  ]
+};
+
+// src/roles/lint/presets/shared.json
+var shared_default = {
+  rules: {
+    "no-var": "error",
+    "prefer-const": [
+      "error",
+      {
+        destructuring: "any",
+        ignoreReadBeforeAssign: false
+      }
+    ],
+    "prefer-rest-params": "error",
+    "prefer-spread": "error",
+    "typescript/ban-ts-comment": "error",
+    "typescript/no-array-constructor": "error",
+    "typescript/no-duplicate-enum-values": "error",
+    "typescript/no-empty-object-type": "error",
+    "typescript/no-extra-non-null-assertion": "error",
+    "typescript/no-misused-new": "error",
+    "typescript/no-namespace": "error",
+    "typescript/no-non-null-asserted-optional-chain": "error",
+    "typescript/no-this-alias": "error",
+    "typescript/no-unnecessary-type-constraint": "error",
+    "typescript/no-unsafe-declaration-merging": "error",
+    "typescript/no-unsafe-function-type": "error",
+    "typescript/no-unused-expressions": [
+      "error",
+      {
+        allowShortCircuit: false,
+        allowTaggedTemplates: false,
+        allowTernary: false
+      }
+    ],
+    "typescript/no-unused-vars": [
+      "error",
+      {
+        argsIgnorePattern: "^_",
+        caughtErrors: "none",
+        ignoreRestSiblings: true
+      }
+    ],
+    "typescript/no-wrapper-object-types": "error",
+    "typescript/prefer-as-const": "error",
+    "typescript/prefer-namespace-keyword": "error",
+    "typescript/triple-slash-reference": "error"
+  }
+};
+
+// src/roles/lint/presets/svelte.json
+var svelte_default = {
+  plugins: ["typescript", "oxc"],
+  jsPlugins: [],
+  settings: null,
+  rules: {
+    "constructor-super": "error",
+    "for-direction": "error",
+    "getter-return": [
+      "error",
+      {
+        allowImplicit: false
+      }
+    ],
+    "no-async-promise-executor": "error",
+    "no-case-declarations": "error",
+    "no-class-assign": "error",
+    "no-compare-neg-zero": "error",
+    "no-cond-assign": ["error", "except-parens"],
+    "no-const-assign": "error",
+    "no-constant-binary-expression": "error",
+    "no-constant-condition": [
+      "error",
+      {
+        checkLoops: "allExceptWhileTrue"
+      }
+    ],
+    "no-control-regex": "error",
+    "no-debugger": "error",
+    "no-delete-var": "error",
+    "no-dupe-class-members": "error",
+    "no-dupe-else-if": "error",
+    "no-dupe-keys": "error",
+    "no-duplicate-case": "error",
+    "no-empty": [
+      "error",
+      {
+        allowEmptyCatch: false
+      }
+    ],
+    "no-empty-character-class": "error",
+    "no-empty-pattern": [
+      "error",
+      {
+        allowObjectPatternsAsParameters: false
+      }
+    ],
+    "no-empty-static-block": "error",
+    "no-ex-assign": "error",
+    "no-extra-boolean-cast": ["error", {}],
+    "no-fallthrough": [
+      "error",
+      {
+        allowEmptyCase: false,
+        reportUnusedFallthroughComment: false
+      }
+    ],
+    "no-func-assign": "error",
+    "no-global-assign": [
+      "error",
+      {
+        exceptions: []
+      }
+    ],
+    "no-import-assign": "error",
+    "no-invalid-regexp": ["error", {}],
+    "no-irregular-whitespace": [
+      "error",
+      {
+        skipComments: false,
+        skipJSXText: false,
+        skipRegExps: false,
+        skipStrings: true,
+        skipTemplates: false
+      }
+    ],
+    "no-loss-of-precision": "error",
+    "no-misleading-character-class": "error",
+    "no-new-native-nonconstructor": "error",
+    "no-nonoctal-decimal-escape": "error",
+    "no-obj-calls": "error",
+    "no-prototype-builtins": "error",
+    "no-redeclare": [
+      "error",
+      {
+        builtinGlobals: true
+      }
+    ],
+    "no-regex-spaces": "error",
+    "no-self-assign": [
+      "error",
+      {
+        props: true
+      }
+    ],
+    "no-setter-return": "error",
+    "no-shadow-restricted-names": [
+      "error",
+      {
+        reportGlobalThis: false
+      }
+    ],
+    "no-sparse-arrays": "error",
+    "no-this-before-super": "error",
+    "no-undef": {
+      severity: "off",
+      reason: "unusable under oxlint for Svelte, and not for want of configuration. Svelte 5's runes ($state, $props, $derived, $effect) are compiler globals, and `$store` auto-subscription invents an identifier per store ($_, $page, $currentAdmin, \u2026), so the names cannot be enumerated. eslint-plugin-svelte's PARSER supplies both; oxlint has no Svelte parser, so it reported 1641 undefined identifiers on hr-management, none of them real. TypeScript and svelte-check already report genuinely undefined identifiers, which is why react and nest never enabled this rule either."
+    },
+    "no-unreachable": "error",
+    "no-unsafe-finally": "error",
+    "no-unsafe-negation": [
+      "error",
+      {
+        enforceForOrderingRelations: false
+      }
+    ],
+    "no-unsafe-optional-chaining": [
+      "error",
+      {
+        disallowArithmeticOperators: false
+      }
+    ],
+    "no-unused-labels": "error",
+    "no-unused-private-class-members": "error",
+    "no-useless-backreference": "error",
+    "no-useless-catch": "error",
+    "no-useless-escape": [
+      "error",
+      {
+        allowRegexCharacters: []
+      }
+    ],
+    "no-with": "error",
+    "prefer-rest-params": {
+      severity: "warn",
+      reason: "error in the module's eslint config, but never actually reported: `eslint src/lib/analytics/useAnalytics.js` exits clean today while oxlint finds 3 real violations in it. Held at warn so adoption does not turn a green module red, and restored to error once they are fixed. Not auto-fixable, verified with --fix."
+    },
+    "prefer-spread": {
+      severity: "warn",
+      reason: "error in the module's eslint config, but never actually reported: `eslint src/lib/analytics/useAnalytics.js` exits clean today while oxlint finds 3 real violations in it. Held at warn so adoption does not turn a green module red, and restored to error once they are fixed. Not auto-fixable, verified with --fix."
+    },
+    "require-yield": "error",
+    "typescript/no-explicit-any": {
+      severity: "warn",
+      reason: "libs/front/ui enforces it and apps/front/hr-management turns it off; enforcing it would newly fail hr-management, so it reports for both instead of breaking one"
+    },
+    "typescript/no-require-imports": "error",
+    "use-isnan": [
+      "error",
+      {
+        enforceForIndexOf: false,
+        enforceForSwitchCase: true
+      }
+    ],
+    "valid-typeof": [
+      "error",
+      {
+        requireStringLiterals: false
+      }
+    ]
+  },
+  uncovered: {
+    "svelte/comment-directive": "oxlint cannot parse Svelte templates, so the eslint-disable comments inside markup are neither read nor honoured",
+    "svelte/system": "the plugin internal rule that reports Svelte parse errors; it needs the Svelte parser",
+    "svelte/no-at-debug-tags": "reads {@debug} in the template",
+    "svelte/no-at-html-tags": "reads {@html} in the template, the XSS guard; the highest-value loss in this list",
+    "svelte/no-dupe-else-if-blocks": "reads {#if}/{:else if} chains in the template",
+    "svelte/no-dupe-style-properties": "reads the style block",
+    "svelte/no-dynamic-slot-name": "reads <slot> in the template",
+    "svelte/no-inner-declarations": "the Svelte-aware variant; the core rule it shadows is not a substitute inside markup",
+    "svelte/no-not-function-handler": "reads on:event handlers in the template",
+    "svelte/no-object-in-text-mustaches": "reads {expression} interpolation in the template",
+    "svelte/no-shorthand-style-property-overrides": "reads the style block",
+    "svelte/no-unknown-style-directive-property": "reads style: directives in the template",
+    "svelte/no-unused-svelte-ignore": "reads svelte-ignore comments in the template",
+    "svelte/valid-compile": "runs the Svelte compiler and reports its warnings",
+    "no-dupe-args": "no oxlint equivalent (TypeScript rejects duplicate parameter names anyway)",
+    "no-octal": "no oxlint equivalent"
+  }
+};
+
+// src/roles/lint/presets/tools.json
+var tools_default = {
+  plugins: ["typescript", "oxc", "unicorn", "import", "node"],
+  jsPlugins: [],
+  settings: null,
+  rules: {
+    "for-direction": "error",
+    "no-async-promise-executor": "error",
+    "no-case-declarations": "error",
+    "no-compare-neg-zero": "error",
+    "no-cond-assign": ["error", "except-parens"],
+    "no-constant-binary-expression": [
+      "error",
+      {
+        checkRelationalComparisons: false
+      }
+    ],
+    "no-constant-condition": [
+      "error",
+      {
+        checkLoops: "allExceptWhileTrue"
+      }
+    ],
+    "no-control-regex": "error",
+    "no-debugger": "error",
+    "no-delete-var": "error",
+    "no-dupe-else-if": "error",
+    "no-duplicate-case": "error",
+    "no-empty": [
+      "error",
+      {
+        allowEmptyCatch: false
+      }
+    ],
+    "no-empty-character-class": "error",
+    "no-empty-pattern": [
+      "error",
+      {
+        allowObjectPatternsAsParameters: false
+      }
+    ],
+    "no-empty-static-block": "error",
+    "no-ex-assign": "error",
+    "no-extra-boolean-cast": ["error", {}],
+    "no-fallthrough": [
+      "error",
+      {
+        allowEmptyCase: false,
+        reportUnusedFallthroughComment: false
+      }
+    ],
+    "no-global-assign": [
+      "error",
+      {
+        exceptions: []
+      }
+    ],
+    "no-invalid-regexp": ["error", {}],
+    "no-irregular-whitespace": [
+      "error",
+      {
+        skipComments: false,
+        skipJSXText: false,
+        skipRegExps: false,
+        skipStrings: true,
+        skipTemplates: false
+      }
+    ],
+    "no-loss-of-precision": "error",
+    "no-misleading-character-class": [
+      "error",
+      {
+        allowEscape: false
+      }
+    ],
+    "no-nonoctal-decimal-escape": "error",
+    "no-prototype-builtins": "error",
+    "no-regex-spaces": "error",
+    "no-self-assign": [
+      "error",
+      {
+        props: true
+      }
+    ],
+    "no-shadow-restricted-names": [
+      "error",
+      {
+        reportGlobalThis: true
+      }
+    ],
+    "no-sparse-arrays": "error",
+    "no-unassigned-vars": "error",
+    "no-unsafe-finally": "error",
+    "no-unsafe-optional-chaining": [
+      "error",
+      {
+        disallowArithmeticOperators: false
+      }
+    ],
+    "no-unused-labels": "error",
+    "no-unused-private-class-members": "error",
+    "no-useless-assignment": "error",
+    "no-useless-backreference": "error",
+    "no-useless-catch": "error",
+    "no-useless-escape": [
+      "error",
+      {
+        allowRegexCharacters: []
+      }
+    ],
+    "preserve-caught-error": [
+      "error",
+      {
+        requireCatchParameter: false
+      }
+    ],
+    "require-yield": "error",
+    "typescript/no-explicit-any": "error",
+    "typescript/no-require-imports": "error",
+    "use-isnan": [
+      "error",
+      {
+        enforceForIndexOf: false,
+        enforceForSwitchCase: true
+      }
+    ],
+    "valid-typeof": [
+      "error",
+      {
+        requireStringLiterals: false
+      }
+    ]
+  },
+  uncovered: {
+    "no-octal": "no oxlint equivalent"
+  }
+};
+
+// src/roles/lint/preset-data.ts
+var SHARED_RULES = shared_default.rules;
+var PRESET_FILES = {
+  nest: nest_default,
+  node: node_default,
+  react: react_default,
+  svelte: svelte_default,
+  tools: tools_default
+};
+var VARIANT_FILES = {
+  "react-lib": react_lib_default
+};
+var LINT_PRESETS = Object.keys(PRESET_FILES);
+var GENERATED_LINT_PRESETS = [
+  ...Object.keys(PRESET_FILES),
+  ...Object.keys(VARIANT_FILES)
+];
+function hasLintPreset(preset) {
+  return preset in PRESET_FILES;
+}
+function presetFile(preset) {
+  return VARIANT_FILES[preset] ?? PRESET_FILES[preset] ?? node_default;
+}
+function sharedRules() {
+  return SHARED_RULES;
+}
+function presetRules(preset) {
+  return presetFile(preset).rules;
+}
+function uncoveredFor(preset) {
+  return Object.entries(presetFile(preset).uncovered ?? {}).map(([rule, reason]) => ({ rule, reason })).sort((left, right) => left.rule.localeCompare(right.rule));
+}
+
+// src/roles/lint/rule-data.ts
+var sharedRules2 = sharedRules();
+function isDecision(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function severityOf(value) {
+  if (isDecision(value)) return value.severity;
+  if (Array.isArray(value)) return String(value[0]);
+  return value;
+}
+function validate(preset, rules) {
+  for (const [rule, value] of Object.entries(rules)) {
+    const severity = severityOf(value);
+    if (!["off", "warn", "error"].includes(severity)) {
+      throw new Error(
+        `${preset}: rule "${rule}" has severity "${severity}"; expected off, warn or error`
+      );
+    }
+    if (severity === "error") continue;
+    const reason = isDecision(value) ? value.reason.trim() : "";
+    if (reason === "") {
+      throw new Error(
+        `${preset}: rule "${rule}" is set to "${severity}" without a reason. Every rule that is not enforced must say why, so --inspect can tell a developer what is not running. Use { "severity": "${severity}", "reason": "..." }.`
+      );
+    }
+  }
+}
+function rejectTwoSpellings(label, rules) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const rule of Object.keys(rules)) {
+    const canonical = canonicalRuleName(rule);
+    const other = seen.get(canonical);
+    if (other !== void 0) {
+      throw new Error(
+        `${label}: "${other}" and "${rule}" are the same rule to oxlint (${canonical}). Configure it once, under one name: oxlint keeps both and picks one by hash order.`
+      );
+    }
+    seen.set(canonical, rule);
+  }
+}
+function layered(preset) {
+  const base = sharedRules();
+  const layer = presetRules(preset);
+  validate("base", base);
+  validate(preset, layer);
+  return { ...base, ...layer };
+}
+function toRuleMap(label, rules) {
+  validate(label, rules);
+  rejectTwoSpellings(label, rules);
+  const entries = Object.entries(rules).map(([rule, value]) => {
+    if (!isDecision(value)) return [rule, value];
+    const options = value.options ?? [];
+    return [rule, options.length > 0 ? [value.severity, ...options] : value.severity];
+  });
+  return Object.fromEntries(entries);
+}
+function rulesFor(preset) {
+  return toRuleMap(preset, layered(preset));
+}
+function disabledFor(preset) {
+  return decisionsAt(preset, "off");
+}
+function downgradedFor(preset) {
+  return decisionsAt(preset, "warn");
+}
+function decisionsAt(preset, severity) {
+  return Object.entries(layered(preset)).filter(([, value]) => isDecision(value) && value.severity === severity).map(([rule, value]) => ({ rule, reason: value.reason })).sort((left, right) => left.rule.localeCompare(right.rule));
+}
+
+// src/roles/lint/presets.ts
+var hasRuleData = (name) => GENERATED_LINT_PRESETS.includes(name);
+function lintPresetFor(preset) {
+  const file = presetFile(preset);
+  const resolved = hasRuleData(preset) ? preset : "node";
+  return {
+    plugins: file.plugins,
+    jsPlugins: file.jsPlugins,
+    ...file.settings === null ? {} : { settings: file.settings },
+    ...file.renames ? { renames: file.renames } : {},
+    ...file.overrides ? {
+      overrides: file.overrides.map((override, index) => ({
+        files: override.files,
+        rules: toRuleMap(`${preset} override ${index}`, override.rules)
+      }))
+    } : {},
+    rules: rulesFor(resolved)
+  };
+}
+
+// src/roles/lint/read-adoption.ts
+function shippedPreset(presetPath2) {
+  const variant = presetNameFromPath(presetPath2);
+  return variant !== void 0 && GENERATED_LINT_PRESETS.includes(variant) ? lintPresetFor(variant) : void 0;
+}
+function readLintAdoption(cwd) {
+  return readAdoption(cwd, {
+    candidates: [LINT_CONFIG_FILE],
+    markers: ["@hublo/sentinel/oxlint/"],
+    fallback: LINT_CONFIG_FILE,
+    presetPattern: SENTINEL_LINT_PRESET,
+    // Drift for lint is read from the TOP-LEVEL keys beyond `extends`, so the settings the
+    // shared reader inspects are the config's own root rather than a nested options object.
+    settingsKey: null,
+    permitted: PERMITTED_LOCAL_KEYS2,
+    // `rules` and `overrides` are drift only when they CONFLICT with the preset, by the
+    // criterion a re-init keeps or drops them by: a rule the preset does not name is the
+    // module's addition, kept and listed by `--inspect`, not drift. A preset sentinel does not
+    // ship cannot be compared with, so its module keeps the allowlist answer.
+    refineDrift: (drift, config, presetPath2) => {
+      const preset = shippedPreset(presetPath2);
+      return preset !== void 0 ? refineLintDrift(drift, config, preset) : [...drift];
+    }
+  });
+}
+var NO_ADDITIONS = { rules: [], config: [] };
+function readModuleAdditions(cwd) {
+  const adoption = readLintAdoption(cwd);
+  const preset = adoption.adopted ? shippedPreset(adoption.preset) : void 0;
+  if (preset === void 0 || adoption.configFile === null) return NO_ADDITIONS;
+  try {
+    const config = parseJsonc(
+      readFileSync25(join29(cwd, adoption.configFile), "utf8"),
+      adoption.configFile
+    );
+    if (typeof config !== "object" || config === null || Array.isArray(config)) {
+      return NO_ADDITIONS;
+    }
+    const committed = config;
+    return {
+      rules: moduleRuleStanding(committed, preset).added,
+      config: moduleOwnBlocks(committed, preset).added
+    };
+  } catch {
+    return NO_ADDITIONS;
+  }
 }
 
 // src/roles/lint/resolve-oxlint.ts
 import { existsSync as existsSync23 } from "node:fs";
 import { createRequire as createRequire6 } from "node:module";
-import { delimiter as delimiter2, dirname as dirname13, join as join29 } from "node:path";
+import { delimiter as delimiter2, dirname as dirname13, join as join30 } from "node:path";
 import { fileURLToPath } from "node:url";
 var PACKAGE_OF = {
   oxlint: "oxlint",
@@ -6842,14 +9510,14 @@ function tsgolintShim(cwd) {
   for (const owner of ["oxlint-tsgolint", "oxlint"]) {
     try {
       const packageDir = dirname13(require3.resolve(`${owner}/package.json`));
-      candidates.push(join29(packageDir, "node_modules", ".bin", "tsgolint"));
-      candidates.push(join29(packageDir, "..", ".bin", "tsgolint"));
+      candidates.push(join30(packageDir, "node_modules", ".bin", "tsgolint"));
+      candidates.push(join30(packageDir, "..", ".bin", "tsgolint"));
     } catch {
     }
   }
   try {
     const ownRoot = dirname13(require3.resolve("@hublo/sentinel/package.json"));
-    candidates.push(join29(ownRoot, "node_modules", ".bin", "tsgolint"));
+    candidates.push(join30(ownRoot, "node_modules", ".bin", "tsgolint"));
   } catch {
     candidates.push(resolveBin(dirname13(fileURLToPath(import.meta.url)), "tsgolint") ?? "");
   }
@@ -6867,7 +9535,7 @@ function writtenFileLinter(cwd) {
       return { bin: oxlint, args: ["--fix"], origin: "this module's own oxlint config" };
     }
   }
-  const config = ESLINT_CONFIG_FILES.map((name) => join30(cwd, name)).find((path) => existsSync24(path));
+  const config = ESLINT_CONFIG_FILES.map((name) => join31(cwd, name)).find((path) => existsSync24(path));
   const eslint = resolveBin(cwd, "eslint");
   if (config !== void 0 && eslint !== void 0) {
     return {
@@ -6889,7 +9557,7 @@ var FORMATTABLE = /\.(m|c)?(j|t)sx?$|\.json$/;
 var FORMAT_BATCH = 25;
 function readIfPossible(path) {
   try {
-    return readFileSync25(path, "utf8");
+    return readFileSync26(path, "utf8");
   } catch {
     return void 0;
   }
@@ -7015,12 +9683,12 @@ var VitestAdapter = class _VitestAdapter extends BaseAdapter {
     const linter = writtenFileLinter(ctx.cwd);
     if (linter === void 0) return;
     const workspaceRoot = findWorkspaceRoot(ctx.cwd) ?? ctx.cwd;
-    const fromRoot = (file) => relative7(workspaceRoot, join31(ctx.cwd, file));
+    const fromRoot = (file) => relative7(workspaceRoot, join32(ctx.cwd, file));
     let unsettled = 0;
     const reverted = [];
     for (let at = 0; at < written.length; at += FORMAT_BATCH) {
       const batch = written.slice(at, at + FORMAT_BATCH);
-      const before = new Map(batch.map((file) => [file, readIfPossible(join31(ctx.cwd, file))]));
+      const before = new Map(batch.map((file) => [file, readIfPossible(join32(ctx.cwd, file))]));
       const pass = spawnSync(linter.bin, [...linter.args, ...batch.map(fromRoot)], {
         cwd: workspaceRoot,
         encoding: "utf8"
@@ -7029,11 +9697,11 @@ var VitestAdapter = class _VitestAdapter extends BaseAdapter {
       for (const file of batch) {
         const was = before.get(file);
         if (was === void 0) continue;
-        const now = readIfPossible(join31(ctx.cwd, file));
+        const now = readIfPossible(join32(ctx.cwd, file));
         if (now === void 0 || now === was) continue;
         const lost = lineLostByTheFixer(was, now);
         if (lost === void 0) continue;
-        writeFileSync2(join31(ctx.cwd, file), was);
+        writeFileSync2(join32(ctx.cwd, file), was);
         reverted.push(`${file}: \`${lost.slice(0, 80)}\``);
       }
     }
@@ -7112,7 +9780,7 @@ var VitestAdapter = class _VitestAdapter extends BaseAdapter {
         metrics: { ..._VitestAdapter.NOTHING_TO_REPORT, error: "vitest not available" }
       };
     }
-    const out = join31(mkdtempSync3(join31(tmpdir3(), "sentinel-test-report-")), "vitest.json");
+    const out = join32(mkdtempSync3(join32(tmpdir3(), "sentinel-test-report-")), "vitest.json");
     const { cwd: runFrom, options, env } = fromWorkspaceRoot(ctx.cwd, [], []);
     const result = spawnSync(bin, ["run", ...options, "--reporter=json", `--outputFile=${out}`], {
       cwd: runFrom,
@@ -7136,7 +9804,7 @@ var VitestAdapter = class _VitestAdapter extends BaseAdapter {
     }
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync25(out, "utf8"));
+      parsed = JSON.parse(readFileSync26(out, "utf8"));
     } catch {
       return {
         ok: false,
@@ -7298,11 +9966,21 @@ export {
   presetNameFromPath,
   ESLINT_CONFIG_FILES,
   lintTarget,
+  LINT_PRESETS,
+  hasLintPreset,
+  uncoveredFor,
+  disabledFor,
+  downgradedFor,
+  governedRules,
+  moduleOwnBlocks,
+  isOffRuleValue,
+  lintPresetFor,
   presetOwnedKeys,
   localOnlyKeys,
   resolveConfigTarget,
   readAdoption,
   readLintAdoption,
+  readModuleAdditions,
   resolveOxlint,
   canRunTypeAware,
   oxlintPath,