@useinsider/eslint-config 4.0.0-beta.1 → 4.0.0-beta.3

package/dist/cli.cjs

@@ -309,20 +309,26 @@ function detectVueApiPattern(input) {
 //#region src/cli/dispatch.ts
 var yesFlags = /* @__PURE__ */ new Set(["--yes", "-y"]);
 var noInstallFlags = /* @__PURE__ */ new Set(["--no-install"]);
+var fromLintFlags = /* @__PURE__ */ new Set(["--from-lint"]);
 function isYesFlag(arg) {
 	return yesFlags.has(arg);
 }
 function isNoInstallFlag(arg) {
 	return noInstallFlags.has(arg);
 }
+function isFromLintFlag(arg) {
+	return fromLintFlags.has(arg);
+}
 function parseMigrateArgs(rest) {
 	const yes = rest.some(isYesFlag);
 	const noInstall = rest.some(isNoInstallFlag);
-	const positional = rest.filter((arg) => !isYesFlag(arg) && !isNoInstallFlag(arg));
+	const fromLint = rest.some(isFromLintFlag);
+	const positional = rest.filter((arg) => !isYesFlag(arg) && !isNoInstallFlag(arg) && !isFromLintFlag(arg));
 	return {
 		target: positional.length > 0 ? positional[positional.length - 1] : void 0,
 		yes,
-		noInstall
+		noInstall,
+		fromLint
 	};
 }
 function parseScaffoldArgs(argv) {
@@ -333,8 +339,9 @@ function printUsage(stderr, unknown) {
 	stderr("Usage:");
 	stderr("  npx @useinsider/eslint-config [--yes|-y]");
 	stderr("      Scaffold insider.lint.*, eslint.config.* and oxlint.config.*");
-	stderr("  npx @useinsider/eslint-config migrate [path] [--yes|-y] [--no-install]");
+	stderr("  npx @useinsider/eslint-config migrate [path] [--yes|-y] [--no-install] [--from-lint]");
 	stderr("      Split an existing useInsider() or .eslintrc* config into the three-file layout");
+	stderr("      --from-lint: started by a failing lint run — confirm first, exit non-zero if declined");
 }
 function isScaffoldArgv(argv) {
 	return argv.every((arg) => isYesFlag(arg));
@@ -349,12 +356,13 @@ async function dispatch(argv, cwd, deps) {
 	}
 	const [subcommand, ...rest] = argv;
 	if (subcommand === "migrate") {
-		const { target, yes, noInstall } = parseMigrateArgs(rest);
+		const { target, yes, noInstall, fromLint } = parseMigrateArgs(rest);
 		return deps.migrate({
 			cwd,
 			target,
 			yes,
-			noInstall
+			noInstall,
+			fromLint
 		});
 	}
 	printUsage(deps.stderr, subcommand);
@@ -661,39 +669,66 @@ function noteGenericError(clack, summary, context, specs) {
 async function tryRetryInstall(clack, installer, deps, context) {
 	try {
 		await installer(deps);
+		return { installed: true };
 	} catch (retryError) {
-		noteError(clack, "Retry install failed after wipe: ", retryError instanceof Error ? retryError.message : String(retryError), context, deps);
+		const retryReason = retryError instanceof Error ? retryError.message : String(retryError);
+		noteError(clack, "Retry install failed after wipe: ", retryReason, context, deps);
+		return {
+			installed: false,
+			reason: retryReason
+		};
 	}
 }
 async function tryGenericRetryInstall(clack, installer, deps, context) {
 	try {
 		await installer(deps);
+		return { installed: true };
 	} catch (retryError) {
-		noteGenericError(clack, buildGenericSummary(`Clean reinstall failed: ${retryError instanceof Error ? retryError.message : String(retryError)}`), context, deps);
+		const summary = buildGenericSummary(`Clean reinstall failed: ${retryError instanceof Error ? retryError.message : String(retryError)}`);
+		noteGenericError(clack, summary, context, deps);
+		return {
+			installed: false,
+			reason: summary
+		};
 	}
 }
 async function handlePeerDepFailure(clack, deps, autoConfirm, installer, reason, context) {
 	if (!await confirmPeerDepWipe(clack, autoConfirm)) {
 		noteError(clack, "Install failed: ", reason, context, deps);
-		return;
+		return {
+			installed: false,
+			reason
+		};
 	}
 	performFullWipe(clack, context);
-	await tryRetryInstall(clack, installer, deps, context);
+	return tryRetryInstall(clack, installer, deps, context);
 }
 async function handleGenericFailure(clack, deps, autoConfirm, installer, reason, context) {
 	const summary = buildGenericSummary(reason);
 	if (!await confirmCleanReinstall(clack, autoConfirm, summary)) {
 		if (clack.note) clack.note(`${summary}\nSkipping clean reinstall. Please resolve the issue manually and re-run.`, "Error");
-		return;
+		return {
+			installed: false,
+			reason: summary
+		};
 	}
 	performFullWipe(clack, context);
-	await tryGenericRetryInstall(clack, installer, deps, context);
+	return tryGenericRetryInstall(clack, installer, deps, context);
 }
+/**
+* Installs the dependencies, offering one wipe-and-retry when the first attempt fails, and reports
+* whether they ended up installed. Every failure path is already explained to the consumer through
+* `clack`, so the outcome exists for the caller's exit code rather than for a second message.
+* @example
+* const outcome = await installWithRetry(options);
+* if (!outcome.installed) { return 1; }
+*/
 async function installWithRetry(opts) {
 	const installer = opts.installer ?? defaultInstaller;
 	const fs = opts.fsOps ?? defaultWipeFs();
 	try {
 		await installer(opts.deps);
+		return { installed: true };
 	} catch (error) {
 		const reason = error instanceof Error ? error.message : String(error);
 		const context = {
@@ -701,16 +736,30 @@ async function installWithRetry(opts) {
 			fs,
 			detected: detectLockfile(opts.cwd, fs.exists)
 		};
-		if (isPeerDepFailure(reason)) {
-			await handlePeerDepFailure(opts.clack, opts.deps, opts.autoConfirm, installer, reason, context);
-			return;
-		}
-		await handleGenericFailure(opts.clack, opts.deps, opts.autoConfirm, installer, reason, context);
+		if (isPeerDepFailure(reason)) return handlePeerDepFailure(opts.clack, opts.deps, opts.autoConfirm, installer, reason, context);
+		return handleGenericFailure(opts.clack, opts.deps, opts.autoConfirm, installer, reason, context);
 	}
 }
 //#endregion
+//#region src/cli/detectIndent.ts
+var DEFAULT_INDENT = "    ";
+/**
+* The indentation a JSON source already uses, as the string `JSON.stringify` takes for its third
+* argument. A width would be wrong: `JSON.stringify` emits that many *spaces*, so a tab-indented
+* manifest comes back re-indented with spaces and every line of it shows up in the diff.
+* @example
+* detectIndent('{\n\t"name": "app"\n}'); // '\t'
+* @example
+* detectIndent('{"name":"app"}', '  '); // '  '
+*/
+function detectIndent(raw, fallback = DEFAULT_INDENT) {
+	const match = /\n([\t ]+)\S/u.exec(raw);
+	return match ? match[1] : fallback;
+}
+//#endregion
 //#region src/cli/lintLayout.ts
-var OXLINT_LINT_SCRIPT = "oxlint --disable-nested-config && eslint .";
+var OXLINT_COMMAND = "oxlint --disable-nested-config";
+var OXLINT_LINT_SCRIPT = `${OXLINT_COMMAND} && eslint .`;
 /**
 * Extension for the lint module and the oxlint config. oxlint only discovers `oxlint.config.ts` and
 * `oxlint.config.mts`, and Node warns on a bare `.ts` file inside a package that declares no
@@ -726,29 +775,45 @@ function resolveLayoutExtension(cwd) {
 		return "mts";
 	}
 }
-function findExistingEslintConfig(cwd, fallback) {
-	return [
-		"ts",
-		"mts",
-		"cts",
-		"js",
-		"mjs",
-		"cjs"
-	].map((ext) => `eslint.config.${ext}`).find((filename) => (0, node_fs.existsSync)((0, node_path.join)(cwd, filename))) ?? fallback;
+var ESLINT_CONFIG_EXTENSIONS = [
+	"ts",
+	"mts",
+	"cts",
+	"js",
+	"mjs",
+	"cjs"
+];
+var TYPESCRIPT_CONFIG_EXTENSIONS = /* @__PURE__ */ new Set([
+	"cts",
+	"mts",
+	"ts"
+]);
+function extensionOf(filename) {
+	return filename.slice(filename.lastIndexOf(".") + 1);
+}
+function existingEslintConfigs(cwd) {
+	return ESLINT_CONFIG_EXTENSIONS.map((extension) => `eslint.config.${extension}`).filter((filename) => (0, node_fs.existsSync)((0, node_path.join)(cwd, filename)));
 }
 /**
-* The three filenames `useInsider()` requires, resolved against a consumer directory. An existing
-* `eslint.config.*` keeps its name so a migration does not leave two flat configs behind.
+* The three filenames `useInsider()` requires, resolved against a consumer directory. A JavaScript
+* flat config is renamed to the TypeScript extension — it cannot import the lint module on every
+* supported Node version — and every other `eslint.config.*` in the directory is reported through
+* `replacedEslintConfigs` so the caller deletes it. ESLint resolves `.js`/`.mjs`/`.cjs` before the
+* TypeScript extensions, so a leftover JavaScript config keeps winning over the one just written.
 * @example
-* resolveLintLayout('/repo'); // { lintModule: 'insider.lint.mts', eslintConfig: 'eslint.config.mjs', ... }
+* resolveLintLayout('/repo');
+* // { eslintConfig: 'eslint.config.ts', replacedEslintConfigs: ['eslint.config.js'], ... }
 */
-function resolveLintLayout(cwd, eslintConfigFallback = "eslint.config.mjs") {
+function resolveLintLayout(cwd) {
 	const extension = resolveLayoutExtension(cwd);
+	const existing = existingEslintConfigs(cwd);
+	const eslintConfig = existing.find((filename) => TYPESCRIPT_CONFIG_EXTENSIONS.has(extensionOf(filename))) ?? `eslint.config.${extension}`;
 	return {
 		extension,
 		lintModule: `insider.lint.${extension}`,
 		oxlintConfig: `oxlint.config.${extension}`,
-		eslintConfig: findExistingEslintConfig(cwd, eslintConfigFallback)
+		eslintConfig,
+		replacedEslintConfigs: existing.filter((filename) => filename !== eslintConfig)
 	};
 }
 /**
@@ -782,7 +847,7 @@ function renderOxlintConfigFile(lintModule) {
 * The two thin files that sit beside a lint module, ready to write.
 * @example
 * renderLintLayoutFiles(resolveLintLayout('/repo')).map(file => file.filename);
-* // ['eslint.config.mjs', 'oxlint.config.mts']
+* // ['eslint.config.mts', 'oxlint.config.mts']
 */
 function renderLintLayoutFiles(layout) {
 	return [{
@@ -793,20 +858,112 @@ function renderLintLayoutFiles(layout) {
 		source: renderOxlintConfigFile(layout.lintModule)
 	}];
 }
-var DEFAULT_INDENT = 2;
-function detectIndent$1(raw) {
-	const firstBreak = raw.indexOf("\n");
-	if (firstBreak === -1) return DEFAULT_INDENT;
-	const rest = raw.slice(firstBreak + 1);
-	const width = rest.length - rest.trimStart().length;
-	return width > 0 ? width : DEFAULT_INDENT;
+var DEFAULT_MANIFEST_INDENT = "  ";
+var SEGMENT_SEPARATOR = /&&|\|\||[;|]/u;
+var ASSIGNMENT = /^[A-Za-z_]\w*=/u;
+var WRAPPER_COMMANDS = /* @__PURE__ */ new Set([
+	"bunx",
+	"cross-env",
+	"dotenv",
+	"exec",
+	"npx",
+	"pnpm",
+	"run",
+	"yarn"
+]);
+function baseName(token) {
+	return token.slice(token.lastIndexOf("/") + 1).replace(/\.[mc]?js$/u, "");
+}
+function segmentsOf(command) {
+	return command.split(SEGMENT_SEPARATOR).map((segment) => segment.trim()).filter((segment) => segment.length > 0);
+}
+function tokensOf(segment) {
+	return segment.split(/\s+/u).filter((token) => token.length > 0 && !ASSIGNMENT.test(token));
+}
+function commandWordOf(segment) {
+	return tokensOf(segment).map(baseName).find((word) => !word.startsWith("-") && !WRAPPER_COMMANDS.has(word)) ?? null;
+}
+/**
+* Whether a package script really invokes the `eslint` binary, as opposed to delegating to another
+* script that does. `npm run lint:es` is not an ESLint invocation; `NODE_OPTIONS=… eslint .` is.
+* @example
+* invokesBinary('npm run lint:es-ci -- --cache', 'eslint'); // false
+*/
+function invokesBinary(command, binary) {
+	return segmentsOf(command).some((segment) => commandWordOf(segment) === binary);
+}
+function oxlintPrefixFor(command) {
+	return tokensOf(command).includes("--fix") ? `${OXLINT_COMMAND} --fix` : OXLINT_COMMAND;
+}
+var CANONICAL_LINT_SCRIPT = "lint";
+function referencedScripts(command, names) {
+	return tokensOf(command).map((token) => token.replace(/^["']|["']$/gu, "").replace(/^npm:/u, "")).filter((token) => names.has(token));
+}
+function collectReachable(scripts, names, script, seen) {
+	if (seen.has(script)) return;
+	seen.add(script);
+	referencedScripts(scripts[script] ?? "", names).forEach((next) => {
+		collectReachable(scripts, names, next, seen);
+	});
+}
+function reachableFromLint(scripts) {
+	const names = new Set(Object.keys(scripts));
+	const seen = /* @__PURE__ */ new Set();
+	if (names.has(CANONICAL_LINT_SCRIPT)) collectReachable(scripts, names, CANONICAL_LINT_SCRIPT, seen);
+	return seen;
+}
+function fixingRank(candidate) {
+	return tokensOf(candidate.previous).includes("--fix") ? 1 : 0;
+}
+function compareCandidates(left, right) {
+	return fixingRank(left) - fixingRank(right) || left.script.length - right.script.length || left.script.localeCompare(right.script);
+}
+function selectTarget(scripts, candidates) {
+	if (candidates.length === 0) return null;
+	const reachable = reachableFromLint(scripts);
+	const preferred = candidates.filter((candidate) => reachable.has(candidate.script));
+	return [...preferred.length > 0 ? preferred : candidates].sort(compareCandidates)[0];
+}
+function planChanges(scripts) {
+	const alreadyRunsOxlint = [];
+	const candidates = [];
+	Object.entries(scripts).forEach(([script, previous]) => {
+		if (!invokesBinary(previous, "eslint")) return;
+		if (invokesBinary(previous, "oxlint")) {
+			alreadyRunsOxlint.push(script);
+			return;
+		}
+		candidates.push({
+			script,
+			previous
+		});
+	});
+	const target = selectTarget(scripts, candidates);
+	if (!target) return {
+		changes: [],
+		alreadyRunsOxlint,
+		skipped: []
+	};
+	return {
+		changes: [{
+			script: target.script,
+			previous: target.previous,
+			next: `${oxlintPrefixFor(target.previous)} && ${target.previous}`
+		}],
+		alreadyRunsOxlint,
+		skipped: candidates.filter((candidate) => candidate.script !== target.script)
+	};
 }
 /**
-* Rewrites the consumer's `lint` script so both linters run. Returns the manifest untouched when it
-* already runs oxlint, so re-running the CLI is idempotent.
+* Adds oxlint beside the one script that actually runs ESLint, by prepending to it rather than
+* replacing it — so a composed `lint` such as `run-p lint:type lint:es lint:style` keeps its
+* type-check and stylelint passes and only its `lint:es-ci` leaf is rewritten. Sibling entry points
+* that also run ESLint (`lint:fix`, `lint:ci`) are reported through `skipped` rather than rewritten,
+* so oxlint runs once per lint pass. Never rewrites a script it did not author: when nothing invokes
+* `eslint` and a `lint` script already exists, the manifest is left alone and the conflict reported.
 * @example
-* setLintScript('{"scripts":{"lint":"eslint ."}}').manifest;
-* // '…"lint": "oxlint --disable-nested-config && eslint ."…'
+* setLintScript('{"scripts":{"lint":"eslint ."}}').changes;
+* // [{ script: 'lint', previous: 'eslint .', next: 'oxlint --disable-nested-config && eslint .' }]
 */
 function setLintScript(rawManifest) {
 	let parsed;
@@ -815,25 +972,77 @@ function setLintScript(rawManifest) {
 	} catch {
 		return {
 			manifest: rawManifest,
-			changed: false
+			changed: false,
+			changes: [],
+			alreadyRunsOxlint: [],
+			skipped: []
 		};
 	}
-	const previous = parsed.scripts?.lint;
-	if (previous?.includes("oxlint")) return {
+	const scripts = parsed.scripts ?? {};
+	const { changes, alreadyRunsOxlint, skipped } = planChanges(scripts);
+	const existingLint = scripts.lint;
+	if (changes.length === 0 && alreadyRunsOxlint.length === 0) {
+		if (existingLint !== void 0) return {
+			manifest: rawManifest,
+			changed: false,
+			changes: [],
+			alreadyRunsOxlint: [],
+			skipped: [],
+			unresolved: {
+				reason: "lint-script-runs-neither",
+				script: "lint",
+				previous: existingLint
+			}
+		};
+		changes.push({
+			script: "lint",
+			previous: "",
+			next: OXLINT_LINT_SCRIPT
+		});
+	}
+	if (changes.length === 0) return {
 		manifest: rawManifest,
 		changed: false,
-		previous
-	};
-	parsed.scripts = {
-		...parsed.scripts,
-		lint: OXLINT_LINT_SCRIPT
+		changes: [],
+		alreadyRunsOxlint,
+		skipped
 	};
+	parsed.scripts = { ...scripts };
+	changes.forEach((change) => {
+		parsed.scripts[change.script] = change.next;
+	});
 	return {
-		manifest: `${JSON.stringify(parsed, null, detectIndent$1(rawManifest))}\n`,
+		manifest: `${JSON.stringify(parsed, null, detectIndent(rawManifest, DEFAULT_MANIFEST_INDENT))}\n`,
 		changed: true,
-		previous
+		changes,
+		alreadyRunsOxlint,
+		skipped
 	};
 }
+/**
+* The scripts that still run ESLint alone, for the CLI to print. Each line carries the oxlint prefix
+* that script would need, so a consumer who wants oxlint on a second entry point can paste it.
+* @example
+* formatSkippedLintScripts([{ script: 'lint:fix', previous: 'eslint . --fix' }]);
+* // 'lint:fix\n  prefix with: oxlint --disable-nested-config --fix && '
+*/
+function formatSkippedLintScripts(skipped) {
+	return skipped.map((candidate) => `${candidate.script}\n  prefix with: ${oxlintPrefixFor(candidate.previous)} && `).join("\n\n");
+}
+/**
+* One line per rewritten script, for the CLI to print. The previous command survives verbatim inside
+* the new one, so the report doubles as the recovery instructions.
+* @example
+* formatLintScriptChanges([{ script: 'lint:es-ci', previous: 'eslint .', next: 'oxlint && eslint .' }]);
+* // 'lint:es-ci\n  before: eslint .\n  after:  oxlint && eslint .'
+*/
+function formatLintScriptChanges(changes) {
+	return changes.map((change) => [
+		change.script,
+		`  before: ${change.previous === "" ? "(no such script)" : change.previous}`,
+		`  after:  ${change.next}`
+	].join("\n")).join("\n\n");
+}
 //#endregion
 //#region src/cli/quote.ts
 function quote(value) {
@@ -1585,6 +1794,18 @@ var ALL_PRESET_DEPS = [
 	...Object.values(SCOPE_TO_DEPS)
 ];
 var PRESET_DEPENDENCY_KEYS = new Set(ALL_PRESET_DEPS.flatMap((record) => Object.keys(record)));
+var MIGRATABLE_SCOPES = new Set(Object.keys(SCOPE_TO_DEPS));
+/**
+* Whether a `useInsider()` option key is a scope this migration can derive dependencies for. The
+* four `*OptionsApi` scopes are deliberately absent from the registry, so a config using one is
+* carried over untouched while its dependencies are reported as unresolved.
+* @example
+* isMigratableScope('vue3Typescript'); // true
+* isMigratableScope('vue3OptionsApi'); // false
+*/
+function isMigratableScope(key) {
+	return MIGRATABLE_SCOPES.has(key);
+}
 function isEslintRelatedDependency(name) {
 	if (SAFELIST.has(name)) return false;
 	if (EXACT_PATTERNS.has(name)) return true;
@@ -1699,11 +1920,6 @@ function buildInstallList(scopes, manifest) {
 var readOwnEslintConfigManifest = readOwnEslintConfigManifest$1;
 //#endregion
 //#region src/cli/prunePackageJson.ts
-function detectIndent(raw) {
-	const match = /\n([ \t]+)"/u.exec(raw);
-	if (!match) return "    ";
-	return match[1];
-}
 function serializeManifest(manifest, indent) {
 	return `${JSON.stringify(manifest, null, indent)}\n`;
 }
@@ -1752,32 +1968,89 @@ var TS_EXTENSIONS_SNIPPET = [
 	"    }",
 	"}"
 ].join("\n");
-var DEFAULT_INDENT_UNIT = "    ";
-function readEffectiveFlag(path, raw) {
+function acceptsTsExtensionsFlag(options) {
+	return options.noEmit === true || options.emitDeclarationOnly === true || options.rewriteRelativeImportExtensions === true;
+}
+function parseTsconfig(path, raw) {
 	const { config } = typescript.parseConfigFileTextToJson(path, raw);
-	if (!config) return false;
-	return typescript.parseJsonConfigFileContent(config, typescript.sys, (0, node_path.dirname)(path), void 0, path).options.allowImportingTsExtensions === true;
+	if (!config) return null;
+	const parsed = typescript.parseJsonConfigFileContent(config, typescript.sys, (0, node_path.dirname)(path), void 0, path);
+	return {
+		enabled: parsed.options.allowImportingTsExtensions === true,
+		acceptsFlag: acceptsTsExtensionsFlag(parsed.options),
+		fileNames: parsed.fileNames,
+		references: (parsed.projectReferences ?? []).map((reference) => reference.path)
+	};
 }
-/**
-* The consumer's root `tsconfig.json` plus whether `allowImportingTsExtensions` already resolves to
-* `true` — including when it arrives through `extends`, which is followed the same way `tsc` does.
-* @example
-* readTsconfigState('/repo')?.enabled; // true when /repo/tsconfig.json extends a base that sets it
-*/
-function readTsconfigState(cwd) {
-	const path = (0, node_path.join)(cwd, "tsconfig.json");
+function readTsconfigAt(path, governedFiles) {
 	if (!(0, node_fs.existsSync)(path)) return null;
 	try {
 		const raw = (0, node_fs.readFileSync)(path, "utf8");
+		const parsed = parseTsconfig(path, raw);
+		if (!parsed) return {
+			state: {
+				path,
+				raw,
+				enabled: false,
+				governs: false,
+				acceptsFlag: false
+			},
+			references: []
+		};
+		const owned = new Set(parsed.fileNames.map((name) => typescript.sys.resolvePath(name)));
+		const governs = governedFiles.some((file) => owned.has(typescript.sys.resolvePath(file)));
 		return {
-			path,
-			raw,
-			enabled: readEffectiveFlag(path, raw)
+			state: {
+				path,
+				raw,
+				enabled: parsed.enabled,
+				governs,
+				acceptsFlag: parsed.acceptsFlag
+			},
+			references: parsed.references
 		};
 	} catch {
 		return null;
 	}
 }
+function resolveReferencePath(reference) {
+	if (!(0, node_fs.existsSync)(reference)) return reference;
+	return typescript.sys.directoryExists(reference) ? (0, node_path.join)(reference, "tsconfig.json") : reference;
+}
+/**
+* Every tsconfig in the consumer's solution — the root plus each project reference — annotated with
+* whether it actually type-checks the generated lint files. A solution-style root has an empty file
+* set, so the project that governs `insider.lint.ts` is usually a referenced `tsconfig.node.json`,
+* and that is the one `tsc` reports TS5097 from.
+* @example
+* collectTsconfigStates('/repo', ['/repo/insider.lint.ts']).filter(state => state.governs);
+* // [{ path: '/repo/tsconfig.node.json', enabled: true, governs: true, ... }]
+*/
+function collectTsconfigStates(cwd, governedFiles = []) {
+	const root = readTsconfigAt((0, node_path.join)(cwd, "tsconfig.json"), governedFiles);
+	if (!root) return [];
+	const seen = /* @__PURE__ */ new Set([root.state.path]);
+	const states = [root.state];
+	root.references.forEach((reference) => {
+		const path = resolveReferencePath(reference);
+		if (seen.has(path)) return;
+		seen.add(path);
+		const referenced = readTsconfigAt(path, governedFiles);
+		if (referenced) states.push(referenced.state);
+	});
+	return states;
+}
+/**
+* The tsconfigs that must gain `allowImportingTsExtensions`: the ones that type-check the generated
+* files and do not already resolve the flag to `true`. Empty when an applicable config already sets
+* it, and empty when no config type-checks the generated files at all — a tsconfig that never sees
+* them cannot raise TS5097, so editing it would only add a flag it has no use for.
+* @example
+* tsconfigsNeedingFlag('/repo', ['/repo/insider.lint.ts']).map(state => state.path); // []
+*/
+function tsconfigsNeedingFlag(cwd, governedFiles) {
+	return collectTsconfigStates(cwd, governedFiles).filter((state) => state.governs && !state.enabled);
+}
 function rootObject(source) {
 	const [statement] = source.statements;
 	const expression = statement?.expression;
@@ -1791,10 +2064,6 @@ function indentAt(raw, position) {
 	const prefix = raw.slice(lineStart, position);
 	return prefix.trim().length === 0 ? prefix : "";
 }
-function detectIndentUnit(raw) {
-	const match = /\n([\t ]+)\S/u.exec(raw);
-	return match ? match[1] : DEFAULT_INDENT_UNIT;
-}
 function splice(raw, start, end, text) {
 	return raw.slice(0, start) + text + raw.slice(end);
 }
@@ -1804,14 +2073,14 @@ function setExistingFlag(raw, source, property) {
 function insertIntoCompilerOptions(raw, source, compilerOptions, object) {
 	const openBrace = object.getStart(source) + 1;
 	const [first] = object.properties;
-	if (first) return splice(raw, openBrace, openBrace, `\n${indentAt(raw, first.getStart(source)) || detectIndentUnit(raw).repeat(2)}"${TS_EXTENSIONS_FLAG}": true,`);
+	if (first) return splice(raw, openBrace, openBrace, `\n${indentAt(raw, first.getStart(source)) || detectIndent(raw).repeat(2)}"${TS_EXTENSIONS_FLAG}": true,`);
 	const outer = indentAt(raw, compilerOptions.getStart(source));
-	const unit = detectIndentUnit(raw);
+	const unit = detectIndent(raw);
 	return splice(raw, openBrace, object.getEnd() - 1, `\n${outer}${unit}"${TS_EXTENSIONS_FLAG}": true\n${outer}`);
 }
 function insertCompilerOptions(raw, source, root) {
 	const openBrace = root.getStart(source) + 1;
-	const unit = detectIndentUnit(raw);
+	const unit = detectIndent(raw);
 	const [first] = root.properties;
 	const indent = first ? indentAt(raw, first.getStart(source)) || unit : unit;
 	const block = `\n${indent}"compilerOptions": {\n${indent}${unit}"${TS_EXTENSIONS_FLAG}": true\n${indent}}`;
@@ -1861,6 +2130,10 @@ function noteManualStep(clack, lintModule) {
 	if (!clack.note) return;
 	clack.note(`\`eslint.config.*\` imports \`./${lintModule}\` by its real extension, which \`tsc\` rejects with TS5097 unless \`${TS_EXTENSIONS_FLAG}\` is on. Add this to your tsconfig.json:\n\n${TS_EXTENSIONS_SNIPPET}`, "tsconfig.json not updated");
 }
+function noteEmitConflict(clack, path, lintModule) {
+	if (!clack.note) return;
+	clack.note(`${path} type-checks \`./${lintModule}\`, so \`tsc\` needs \`${TS_EXTENSIONS_FLAG}\` there — but that project emits, and TypeScript rejects the pair with TS5096. Set \`noEmit\`, \`emitDeclarationOnly\` or \`rewriteRelativeImportExtensions\` on it first, then add:\n\n${TS_EXTENSIONS_SNIPPET}`, "tsconfig.json not updated");
+}
 async function confirmFlag(clack, path) {
 	const result = await clack.confirm({
 		message: `Set \`${TS_EXTENSIONS_FLAG}: true\` in ${path}? Without it \`tsc\` fails with TS5097 on the generated config files.`,
@@ -1868,16 +2141,14 @@ async function confirmFlag(clack, path) {
 	});
 	return !clack.isCancel(result) && result === true;
 }
-/**
-* Offers to set `allowImportingTsExtensions` on the consumer's `tsconfig.json`, and prints the exact
-* snippet when the offer is declined. A no-op when there is no `tsconfig.json` or the flag already
-* resolves to `true` through the `extends` chain.
-* @example
-* await applyTsExtensionsFlag(clack, { cwd: '/repo', lintModule: 'insider.lint.ts' });
-*/
-async function applyTsExtensionsFlag(clack, input) {
-	const state = readTsconfigState(input.cwd);
-	if (!state || state.enabled) return;
+function governedFilesOf(input) {
+	return [input.lintModule, input.eslintConfig].filter((name) => Boolean(name)).map((name) => (0, node_path.join)(input.cwd, name));
+}
+async function applyToOne(clack, state, input) {
+	if (!state.acceptsFlag) {
+		noteEmitConflict(clack, state.path, input.lintModule);
+		return;
+	}
 	if (!(input.autoConfirm || await confirmFlag(clack, state.path))) {
 		noteManualStep(clack, input.lintModule);
 		return;
@@ -1890,6 +2161,22 @@ async function applyTsExtensionsFlag(clack, input) {
 	(0, node_fs.writeFileSync)(state.path, result.source, "utf8");
 	if (clack.note) clack.note(`Set \`${TS_EXTENSIONS_FLAG}: true\` in ${state.path}.`, "Updated tsconfig.json");
 }
+/**
+* Offers to set `allowImportingTsExtensions` on every tsconfig that actually type-checks the
+* generated lint files, and prints the exact snippet when an offer is declined or when the project
+* emits — in which case writing the flag would trade TS5097 for TS5096. A no-op when there is no
+* `tsconfig.json`, when no config governs the generated files, or when an applicable config already
+* resolves the flag to `true` — through its own `compilerOptions`, through `extends`, or by being a
+* project reference that already sets it.
+* @example
+* await applyTsExtensionsFlag(clack, { cwd: '/repo', lintModule: 'insider.lint.ts' });
+*/
+async function applyTsExtensionsFlag(clack, input) {
+	await tsconfigsNeedingFlag(input.cwd, governedFilesOf(input)).reduce(async (previous, state) => {
+		await previous;
+		return applyToOne(clack, state, input);
+	}, Promise.resolve());
+}
 //#endregion
 //#region src/cli/migrate/disableDirectives.ts
 var DIRECTIVE_HEAD = /^\s*eslint-disable(-next-line|-line)?(?![\w-])/u;
@@ -2050,31 +2337,103 @@ function rewriteDirectives(source, fileExtension) {
 function isLintedFile(filePath) {
 	return LINTED_EXTENSIONS.includes((0, node_path.extname)(filePath));
 }
-function collectFiles(directory, accumulator) {
-	(0, node_fs.readdirSync)(directory).forEach((entry) => {
-		if (SKIPPED_DIRECTORIES.has(entry)) return;
-		const full = (0, node_path.join)(directory, entry);
-		if ((0, node_fs.statSync)(full).isDirectory()) {
-			collectFiles(full, accumulator);
+function readEntries(directory) {
+	try {
+		return (0, node_fs.readdirSync)(directory, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+}
+function realPathOf(path) {
+	try {
+		return (0, node_fs.realpathSync)(path);
+	} catch {
+		return null;
+	}
+}
+function collectFiles(directory, accumulator, visited) {
+	const real = realPathOf(directory);
+	if (real === null || visited.has(real)) return;
+	visited.add(real);
+	readEntries(directory).forEach((entry) => {
+		if (SKIPPED_DIRECTORIES.has(entry.name)) return;
+		const full = (0, node_path.join)(directory, entry.name);
+		if (entry.isDirectory()) {
+			collectFiles(full, accumulator, visited);
+			return;
+		}
+		if (entry.isFile() && isLintedFile(full)) accumulator.push(full);
+	});
+}
+function readSource(filePath) {
+	try {
+		return (0, node_fs.readFileSync)(filePath, "utf8");
+	} catch {
+		return null;
+	}
+}
+/**
+* Every file whose `eslint-disable` comments would be re-pointed, and the rewritten source, without
+* touching disk. The directive rewrite is the largest diff a migration produces, so the count is
+* reported — and confirmed — before anything is written. Files that could not be read come back in
+* `skipped` instead of aborting the walk.
+* @example
+* previewDisableDirectives('/repo').candidates.length; // 131
+*/
+function previewDisableDirectives(cwd) {
+	const files = [];
+	const candidates = [];
+	const skipped = [];
+	collectFiles(cwd, files, /* @__PURE__ */ new Set());
+	files.forEach((filePath) => {
+		const source = readSource(filePath);
+		if (source === null) {
+			skipped.push(filePath);
 			return;
 		}
-		if (isLintedFile(full)) accumulator.push(full);
+		const result = rewriteDirectives(source, (0, node_path.extname)(filePath));
+		if (result.changed) candidates.push({
+			path: filePath,
+			source: result.source
+		});
 	});
+	return {
+		candidates,
+		skipped
+	};
+}
+/**
+* What the consumer is told about the files the rewrite could not touch: the paths, then why it
+* matters and how to finish the job. Nothing else in the migration is affected, and saying so is the
+* point — the layout was already written by the time the walk ran.
+* @example
+* formatUntouchedDirectiveFiles(['/repo/src/vendor.ts']); // '/repo/src/vendor.ts\n\nThese could not…'
+*/
+function formatUntouchedDirectiveFiles(skipped) {
+	return `${skipped.join("\n")}\n\nThese could not be read or written, so their \`eslint-disable\` comments still name rules oxlint now owns and ESLint will report each one as an unused directive. Everything else was migrated. Fix the access and re-run \`npx @useinsider/eslint-config migrate\` to pick them up.`;
 }
 /**
 * Applies {@link rewriteDirectives} across a consumer tree, skipping build output and dependencies.
+* A candidate whose write fails comes back in `skipped`, so one failed write costs its own
+* directives rather than every later file's.
 * @example
 * rewriteDisableDirectives('/repo').rewritten; // ['/repo/src/logger.ts']
 */
-function rewriteDisableDirectives(cwd) {
-	const files = [];
-	collectFiles(cwd, files);
-	return { rewritten: files.filter((filePath) => {
-		const result = rewriteDirectives((0, node_fs.readFileSync)(filePath, "utf8"), (0, node_path.extname)(filePath));
-		if (!result.changed) return false;
-		(0, node_fs.writeFileSync)(filePath, result.source, "utf8");
-		return true;
-	}) };
+function rewriteDisableDirectives(cwd, candidates = previewDisableDirectives(cwd).candidates) {
+	const rewritten = [];
+	const skipped = [];
+	candidates.forEach((candidate) => {
+		try {
+			(0, node_fs.writeFileSync)(candidate.path, candidate.source, "utf8");
+			rewritten.push(candidate.path);
+		} catch {
+			skipped.push(candidate.path);
+		}
+	});
+	return {
+		rewritten,
+		skipped
+	};
 }
 //#endregion
 //#region src/cli/migrate/stringEntry.ts
@@ -2103,7 +2462,7 @@ function leadingCommentTextFor(sourceFile, node) {
 }
 //#endregion
 //#region src/cli/migrate/eslintrc/parse.ts
-function lineOf$1(sourceFile, node) {
+function lineOf$2(sourceFile, node) {
 	const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
 	return line + 1;
 }
@@ -2397,7 +2756,7 @@ function readSharedBlockFields(input) {
 	};
 }
 function readOverride(object, context, elementNode) {
-	const line = lineOf$1(context.sourceFile, object);
+	const line = lineOf$2(context.sourceFile, object);
 	const filesProperty = findProperty$1(object, "files");
 	const files = filesProperty ? readStringOrEntries(filesProperty.initializer, context.sourceFile) : [];
 	if (files.length === 0) {
@@ -2454,7 +2813,7 @@ function findExportObject(sourceFile) {
 	return result;
 }
 function buildRoot(object, context) {
-	const line = lineOf$1(context.sourceFile, object);
+	const line = lineOf$2(context.sourceFile, object);
 	const shared = readSharedBlockFields({
 		object,
 		line,
@@ -3084,7 +3443,7 @@ var knownPresets = /* @__PURE__ */ new Set([
 	"dom",
 	"node"
 ]);
-function lineOf(sourceFile, node) {
+function lineOf$1(sourceFile, node) {
 	const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
 	return line + 1;
 }
@@ -3387,7 +3746,7 @@ function classifyPresets(presetList, line, warnings) {
 	};
 }
 function parseUseInsiderCall(callExpression, sourceFile, warnings) {
-	const line = lineOf(sourceFile, callExpression);
+	const line = lineOf$1(sourceFile, callExpression);
 	const [firstArgument] = callExpression.arguments;
 	if (!firstArgument || !typescript.isObjectLiteralExpression(firstArgument)) {
 		warnings.push({
@@ -3487,7 +3846,7 @@ function tryClassifyStandaloneGlobals(objectLiteral, keys, line, sourceFile) {
 	};
 }
 function classifyObjectElement(objectLiteral, sourceFile, warnings) {
-	const line = lineOf(sourceFile, objectLiteral);
+	const line = lineOf$1(sourceFile, objectLiteral);
 	const keys = objectLiteral.properties.map(propertyKeyName).filter((name) => name !== null);
 	const ignoresBlock = tryClassifyIgnoresBlock(objectLiteral, keys, line, sourceFile);
 	if (ignoresBlock) return ignoresBlock;
@@ -3524,7 +3883,7 @@ function classifyArrayElement(element, sourceFile, warnings) {
 		if (leadingComment !== void 0) parsed.leadingComment = leadingComment;
 		return parsed;
 	}
-	const line = lineOf(sourceFile, element);
+	const line = lineOf$1(sourceFile, element);
 	warnings.push({
 		kind: "unrecognized-block",
 		line,
@@ -3541,18 +3900,19 @@ function classifyArrayElement(element, sourceFile, warnings) {
 function isDefineConfigCall(expression) {
 	return typescript.isCallExpression(expression) && typescript.isIdentifier(expression.expression) && expression.expression.text === "defineConfig";
 }
-function findDefaultExportArray(sourceFile) {
-	const exportExpressions = sourceFile.statements.filter(typescript.isExportAssignment).map((statement) => unwrapTypeCasts(statement.expression));
-	const directArray = exportExpressions.find(typescript.isArrayLiteralExpression);
-	if (directArray) return directArray;
-	const defineConfigCall = exportExpressions.find(isDefineConfigCall);
-	if (!defineConfigCall) return null;
-	const [first] = defineConfigCall.arguments;
+function defineConfigArray(exportExpressions) {
+	const [first] = exportExpressions.find(isDefineConfigCall)?.arguments ?? [];
 	if (!first) return null;
 	const unwrappedFirst = unwrapTypeCasts(first);
 	if (typescript.isArrayLiteralExpression(unwrappedFirst)) return unwrappedFirst;
 	return null;
 }
+function findDefaultExportElements(sourceFile) {
+	const exportExpressions = sourceFile.statements.filter(typescript.isExportAssignment).map((statement) => unwrapTypeCasts(statement.expression));
+	const array = exportExpressions.find(typescript.isArrayLiteralExpression) ?? defineConfigArray(exportExpressions);
+	if (array) return [...array.elements];
+	return exportExpressions;
+}
 function checkDefineConfigWrap(sourceFile) {
 	return sourceFile.statements.some((statement) => {
 		if (!typescript.isExportAssignment(statement)) return false;
@@ -3591,7 +3951,7 @@ function classifyInsiderImport(statement, sourceFile, flags) {
 			return;
 		}
 		flags.hasUseInsider = true;
-		const line = lineOf(sourceFile, statement);
+		const line = lineOf$1(sourceFile, statement);
 		flags.preserved.push({
 			raw: statement.getText(sourceFile),
 			moduleSpecifier: "@useinsider/eslint-config"
@@ -3636,7 +3996,7 @@ function collectSilenceRulesCalls(sourceFile) {
 		if (!rules) return null;
 		const leadingComment = leadingCommentTextFor(sourceFile, statement);
 		const call = {
-			line: lineOf(sourceFile, statement),
+			line: lineOf$1(sourceFile, statement),
 			rules
 		};
 		if (leadingComment !== void 0) call.leadingComment = leadingComment;
@@ -3649,8 +4009,7 @@ function parseV1Config(source, filePath) {
 	const imports = inspectImports(sourceFile);
 	warnings.push(...imports.warnings);
 	const silenceRulesCalls = collectSilenceRulesCalls(sourceFile);
-	const arrayLiteral = findDefaultExportArray(sourceFile);
-	const arrayElements = arrayLiteral ? arrayLiteral.elements.map((element) => classifyArrayElement(element, sourceFile, warnings)).filter((entry) => entry !== null) : [];
+	const arrayElements = findDefaultExportElements(sourceFile).map((element) => classifyArrayElement(element, sourceFile, warnings)).filter((entry) => entry !== null);
 	return {
 		hasUseInsiderImport: imports.hasUseInsider,
 		hasSilenceRulesImport: imports.hasSilenceRules,
@@ -3662,6 +4021,220 @@ function parseV1Config(source, filePath) {
 	};
 }
 //#endregion
+//#region src/cli/migrate/rehouseV3.ts
+var INSIDER_MODULE = "@useinsider/eslint-config";
+var COMPOSER_NAME = "useInsider";
+var DEFINE_CONFIG_NAME = "defineConfig";
+var SILENCE_RULES_NAME = "silenceRules";
+var RENDERER_EXPORT = "export const { useInsiderESLint, useInsiderOXC } = ";
+var RESERVED_KEYS = /* @__PURE__ */ new Set([
+	"ignores",
+	"jquery",
+	"strict",
+	"spellChecker",
+	"silenceRules",
+	"configFiles"
+]);
+function isInsiderImport(statement) {
+	const { moduleSpecifier } = statement;
+	return typescript.isStringLiteral(moduleSpecifier) && moduleSpecifier.text === INSIDER_MODULE;
+}
+function composerAliases(sourceFile) {
+	const aliases = /* @__PURE__ */ new Set();
+	sourceFile.statements.forEach((statement) => {
+		if (!typescript.isImportDeclaration(statement) || !isInsiderImport(statement)) return;
+		const bindings = statement.importClause?.namedBindings;
+		if (!bindings || !typescript.isNamedImports(bindings)) return;
+		bindings.elements.forEach((element) => {
+			if ((element.propertyName?.text ?? element.name.text) === COMPOSER_NAME) aliases.add(element.name.text);
+		});
+	});
+	return aliases;
+}
+function isCallOf(node, names) {
+	return typescript.isCallExpression(node) && typescript.isIdentifier(node.expression) && names.has(node.expression.text);
+}
+function collectCalls(sourceFile, names) {
+	const found = [];
+	const visit = (node) => {
+		if (isCallOf(node, names)) found.push(node);
+		typescript.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return found;
+}
+function peel(expression, state) {
+	if (typescript.isParenthesizedExpression(expression) || typescript.isSpreadElement(expression)) return peel(expression.expression, state);
+	if (typescript.isAsExpression(expression) || typescript.isSatisfiesExpression(expression)) {
+		state.droppedAnnotation = true;
+		return peel(expression.expression, state);
+	}
+	if (typescript.isAwaitExpression(expression)) {
+		state.awaited = true;
+		return peel(expression.expression, state);
+	}
+	return expression;
+}
+function peelArray(expression, state) {
+	if (!typescript.isArrayLiteralExpression(expression) || expression.elements.length === 0) return expression;
+	state.arrayWrapped = true;
+	state.siblingElements = expression.elements.length - 1;
+	return peel(expression.elements[0], state);
+}
+function unwrapDefaultExport(expression, state) {
+	const peeled = peel(expression, state);
+	if (isCallOf(peeled, /* @__PURE__ */ new Set([DEFINE_CONFIG_NAME]))) {
+		state.definedConfig = true;
+		return peeled;
+	}
+	return peelArray(peeled, state);
+}
+function argumentObject(call) {
+	const [first] = call.arguments;
+	if (!first || !typescript.isObjectLiteralExpression(first)) return null;
+	return first;
+}
+function propertyKey(property) {
+	const { name } = property;
+	if (name === void 0) return null;
+	if (typescript.isIdentifier(name) || typescript.isStringLiteral(name)) return name.text;
+	return null;
+}
+function unreadableReason(argument, keysRead) {
+	if (!argument) return "is not an object literal";
+	if (argument.properties.some(typescript.isSpreadAssignment)) return "spreads another object";
+	return keysRead < argument.properties.length ? "has a property whose key is not a literal name" : null;
+}
+function readArgument(call) {
+	const argument = argumentObject(call);
+	const optionKeys = (argument?.properties ?? []).map(propertyKey).filter((key) => key !== null);
+	const candidates = optionKeys.filter((key) => !RESERVED_KEYS.has(key));
+	return {
+		optionKeys,
+		scopes: candidates.filter(isMigratableScope),
+		unregisteredKeys: candidates.filter((key) => !isMigratableScope(key)),
+		unreadable: unreadableReason(argument, optionKeys.length)
+	};
+}
+function refuse(reason) {
+	return {
+		kind: "refused",
+		reason
+	};
+}
+function multipleCallsReason(name) {
+	return `${name} calls ${COMPOSER_NAME}() more than once. v4 has exactly one call — in the lint module — and it returns the two renderers instead of a config array, so the results cannot be concatenated. Merge them into a single call, one entry per scope key, then re-run the migration.`;
+}
+function mixedArrayReason(name, siblings) {
+	return `${name}'s default export combines ${COMPOSER_NAME}() with ${siblings} other flat-config ${siblings === 1 ? "block" : "blocks"}, which have nowhere to go in a lint module. Fold them into the call first — directory ignores into \`ignores\`, per-file rule overrides into \`configFiles\` — then re-run the migration.`;
+}
+function indirectCallReason(name) {
+	return `${name} calls ${COMPOSER_NAME}(), but its default export is not that call. The migration re-houses the call itself, so make it the default export (\`export default ${COMPOSER_NAME}({ ... })\`) and re-run the migration.`;
+}
+function defineConfigReason(name) {
+	return `${name} wraps ${COMPOSER_NAME}() in ${DEFINE_CONFIG_NAME}(). v4's lint module exports the two renderers rather than a flat-config array, so there is nothing left for ${DEFINE_CONFIG_NAME}() to validate — drop the wrapper and re-run the migration.`;
+}
+function presetReason(name) {
+	return `${name} still passes the v1 \`preset\` option, and this release could not read it — the preset list has to be an array of string literals. Restore the literal list and re-run the migration, or convert the call to the scope-keyed form by hand.`;
+}
+function annotationWarning(line) {
+	return {
+		kind: "dropped-type-annotation",
+		line,
+		message: `The type annotation on the default export was dropped — ${COMPOSER_NAME}() now returns \`{ useInsiderESLint, useInsiderOXC }\` rather than a config array. Delete the type import if nothing else uses it.`
+	};
+}
+function unregisteredScopeWarning(key, line) {
+	return {
+		kind: "unregistered-scope",
+		line,
+		message: `\`${key}\` has no dependency manifest in the migration, so nothing was added to the install list for it. The key itself was carried over untouched — check its plugins are installed.`
+	};
+}
+function unreadableArgumentWarning(line, reason) {
+	return {
+		kind: "unrecognized-block",
+		line,
+		message: `The ${COMPOSER_NAME}() argument ${reason}, so its scope list could not be read in full. The call was carried over untouched; the dependency list may be incomplete.`
+	};
+}
+function lineOf(sourceFile, node) {
+	return sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
+}
+function collectWarnings(line, reading, state) {
+	const warnings = [];
+	if (state.droppedAnnotation) warnings.push(annotationWarning(line));
+	if (reading.unreadable) warnings.push(unreadableArgumentWarning(line, reading.unreadable));
+	reading.unregisteredKeys.forEach((key) => {
+		warnings.push(unregisteredScopeWarning(key, line));
+	});
+	return warnings;
+}
+function spliceExport(input) {
+	const start = input.statement.getStart(input.sourceFile);
+	const prefix = input.source.slice(0, start);
+	const suffix = input.source.slice(input.statement.getEnd());
+	const rehoused = `${prefix}${RENDERER_EXPORT}${input.callText};${suffix}`;
+	return rehoused.endsWith("\n") ? rehoused : `${rehoused}\n`;
+}
+function defaultExports(sourceFile) {
+	return sourceFile.statements.filter(typescript.isExportAssignment).filter((statement) => statement.isExportEquals !== true);
+}
+function emptyState() {
+	return {
+		awaited: false,
+		arrayWrapped: false,
+		droppedAnnotation: false,
+		siblingElements: 0,
+		definedConfig: false
+	};
+}
+/**
+* Re-houses a v3 single-file config as a v4 lint module. Nothing about the configuration itself
+* changes between the two majors — only where the call lives — so the source is spliced rather than
+* re-rendered: every import, `silenceRules(...)` call, comment and blank line outside the export
+* statement survives byte-for-byte.
+* @example
+* rehouseV3Config("import { useInsider } from '@useinsider/eslint-config';\nexport default useInsider({});", 'eslint.config.js');
+* // { kind: 'rehoused', rehoused: { lintModule: '…export const { useInsiderESLint, useInsiderOXC } = useInsider({});\n', … } }
+*/
+function rehouseV3Config(source, filePath) {
+	const name = (0, node_path.basename)(filePath);
+	const sourceFile = typescript.createSourceFile(filePath, source, typescript.ScriptTarget.Latest, true);
+	const aliases = composerAliases(sourceFile);
+	const calls = collectCalls(sourceFile, aliases);
+	const exportStatements = defaultExports(sourceFile);
+	if (calls.length === 0) return { kind: "not-v3" };
+	if (exportStatements.length !== 1) return refuse(indirectCallReason(name));
+	if (calls.length > 1) return refuse(multipleCallsReason(name));
+	const [statement] = exportStatements;
+	const state = emptyState();
+	const unwrapped = unwrapDefaultExport(statement.expression, state);
+	if (state.definedConfig) return refuse(defineConfigReason(name));
+	if (state.siblingElements > 0) return refuse(mixedArrayReason(name, state.siblingElements));
+	if (!isCallOf(unwrapped, aliases)) return refuse(indirectCallReason(name));
+	const reading = readArgument(unwrapped);
+	if (reading.optionKeys.includes("preset")) return refuse(presetReason(name));
+	return {
+		kind: "rehoused",
+		rehoused: {
+			lintModule: spliceExport({
+				source,
+				sourceFile,
+				statement,
+				callText: unwrapped.getText(sourceFile)
+			}),
+			scopes: reading.scopes,
+			optionKeys: reading.optionKeys,
+			unregisteredKeys: reading.unregisteredKeys,
+			silenceRulesCallCount: collectCalls(sourceFile, /* @__PURE__ */ new Set([SILENCE_RULES_NAME])).length,
+			droppedAwait: state.awaited,
+			droppedArrayWrapper: state.arrayWrapped,
+			warnings: collectWarnings(lineOf(sourceFile, unwrapped), reading, state)
+		}
+	};
+}
+//#endregion
 //#region src/cli/migrate/pruneUnusedImports.ts
 var INSIDER_MODULE_SPECIFIER = "@useinsider/eslint-config";
 function readModuleSpecifier(statement) {
@@ -4383,53 +4956,56 @@ function formatWarnings(warnings) {
 }
 //#endregion
 //#region src/cli/migrate/writer.ts
-function writeLayout(eslintConfigPath, lintModuleSource) {
-	const directory = (0, node_path.dirname)(eslintConfigPath);
-	const layout = resolveLintLayout(directory, (0, node_path.basename)(eslintConfigPath));
+function writeLayout(directory, lintModuleSource) {
+	const layout = resolveLintLayout(directory);
 	const lintModulePath = (0, node_path.join)(directory, layout.lintModule);
 	(0, node_fs.writeFileSync)(lintModulePath, lintModuleSource, "utf8");
 	const writtenPaths = [lintModulePath];
-	renderLintLayoutFiles({
-		...layout,
-		eslintConfig: (0, node_path.basename)(eslintConfigPath)
-	}).forEach((file) => {
+	renderLintLayoutFiles(layout).forEach((file) => {
 		const path = (0, node_path.join)(directory, file.filename);
 		(0, node_fs.writeFileSync)(path, file.source, "utf8");
 		writtenPaths.push(path);
 	});
 	return {
+		eslintConfigPath: (0, node_path.join)(directory, layout.eslintConfig),
 		lintModulePath,
-		writtenPaths
+		writtenPaths,
+		replacedEslintConfigPaths: layout.replacedEslintConfigs.map((name) => (0, node_path.join)(directory, name))
 	};
 }
+function withoutDuplicates(paths, keep) {
+	return [...new Set(paths.filter((path) => path !== keep))];
+}
 /**
 * Writes the three-file layout beside an existing flat config: the rendered `useInsider()` call
-* becomes `insider.lint.*`, and `eslint.config.*` / `oxlint.config.*` become thin re-exports.
+* becomes `insider.lint.*`, and `eslint.config.*` / `oxlint.config.*` become thin re-exports. A
+* JavaScript-extension source config is superseded by the TypeScript one and nominated for deletion.
 * @example
-* writeMigration('/repo/eslint.config.mjs', source).writtenPaths.length; // 3
+* writeMigration('/repo/eslint.config.js', source).deletedSourceCandidates; // ['/repo/eslint.config.js']
 */
 function writeMigration(targetPath, newSource) {
-	const { lintModulePath, writtenPaths } = writeLayout(targetPath, newSource);
+	const result = writeLayout((0, node_path.dirname)(targetPath), newSource);
 	return {
-		targetPath,
-		lintModulePath,
-		writtenPaths
+		targetPath: result.eslintConfigPath,
+		lintModulePath: result.lintModulePath,
+		writtenPaths: result.writtenPaths,
+		deletedSourceCandidates: withoutDuplicates([...result.replacedEslintConfigPaths, targetPath], result.eslintConfigPath)
 	};
 }
 /**
 * Same as {@link writeMigration}, but for a legacy `.eslintrc*` source that has to be replaced by a
-* differently-named flat config. Nominates the old file for deletion when the name changed.
+* differently-named flat config.
 * @example
-* writeMigrationLegacy('/repo/.eslintrc.cjs', '/repo/eslint.config.mjs', source).deletedSourceCandidate;
-* // '/repo/.eslintrc.cjs'
+* writeMigrationLegacy('/repo/.eslintrc.cjs', '/repo/eslint.config.mts', src).deletedSourceCandidates;
+* // ['/repo/.eslintrc.cjs']
 */
 function writeMigrationLegacy(sourcePath, writePath, newSource) {
-	const { lintModulePath, writtenPaths } = writeLayout(writePath, newSource);
+	const result = writeLayout((0, node_path.dirname)(writePath), newSource);
 	return {
-		targetPath: writePath,
-		lintModulePath,
-		writtenPaths,
-		deletedSourceCandidate: (0, node_path.basename)(sourcePath) === (0, node_path.basename)(writePath) ? void 0 : sourcePath
+		targetPath: result.eslintConfigPath,
+		lintModulePath: result.lintModulePath,
+		writtenPaths: result.writtenPaths,
+		deletedSourceCandidates: withoutDuplicates([...result.replacedEslintConfigPaths, sourcePath], result.eslintConfigPath)
 	};
 }
 //#endregion
@@ -4489,6 +5065,22 @@ function describeStrict(plan) {
 	if (plan.config.strictGlobs.length > 0) return `Strict scopes: 1 (${plan.config.strictGlobs.length} globs)`;
 	return "Strict scopes: 0";
 }
+function describeRehousedKeys(label, keys) {
+	return keys.length === 0 ? `${label}: (none)` : `${label}: ${keys.join(", ")}`;
+}
+function rehouseSummary(rehoused) {
+	const lines = [
+		"Source: v3 single-file eslint.config.*",
+		"Re-housed as the lint module: only the export statement changed, every other line is byte-for-byte.",
+		describeRehousedKeys("Options carried over", rehoused.optionKeys),
+		describeRehousedKeys("Scopes with dependencies", rehoused.scopes),
+		`silenceRules() calls kept: ${rehoused.silenceRulesCallCount}`
+	];
+	if (rehoused.droppedAwait) lines.push("Dropped the `await` on the call — useInsider() is synchronous in v4.");
+	if (rehoused.droppedArrayWrapper) lines.push("Dropped the array wrapper around the call — the lint module exports the renderers.");
+	lines.push(`Warnings: ${rehoused.warnings.length}`);
+	return lines.join("\n");
+}
 function summary(plan, format) {
 	const lines = [];
 	if (format === "eslintrc") lines.push("Source: legacy .eslintrc");
@@ -4501,29 +5093,51 @@ function summary(plan, format) {
 	lines.push(`Warnings: ${plan.warnings.length}`);
 	return lines.join("\n");
 }
-function planFromSource(source, filePath, format) {
-	if (format === "flat") {
-		const parseResult = parseV1Config(source, filePath);
-		if (!isV1Shape(parseResult)) return null;
-		const plan = transformToV2(parseResult);
-		return {
-			plan,
-			rendered: renderV2(plan)
+function sourceModelFrom(resolved) {
+	if (resolved.format !== "flat") {
+		const parseResult = parseEslintrc(resolved.source, resolved.targetPath);
+		return parseResult.found ? {
+			ok: true,
+			model: {
+				kind: "plan",
+				plan: transformEslintrcToV2(parseResult)
+			}
+		} : {
+			ok: false,
+			reason: null
 		};
 	}
-	const parseResult = parseEslintrc(source, filePath);
-	if (!parseResult.found) return null;
-	const plan = transformEslintrcToV2(parseResult);
+	const parseResult = parseV1Config(resolved.source, resolved.targetPath);
+	if (isV1Shape(parseResult)) return {
+		ok: true,
+		model: {
+			kind: "plan",
+			plan: transformToV2(parseResult)
+		}
+	};
+	const outcome = rehouseV3Config(resolved.source, resolved.targetPath);
+	if (outcome.kind === "rehoused") return {
+		ok: true,
+		model: {
+			kind: "rehouse",
+			rehoused: outcome.rehoused
+		}
+	};
 	return {
-		plan,
-		rendered: renderV2(plan)
+		ok: false,
+		reason: outcome.kind === "refused" ? outcome.reason : null
 	};
 }
-function targetWritePath(cwd, sourcePath, format) {
-	if (format !== "eslintrc") return sourcePath;
-	const base = (0, node_path.basename)(sourcePath);
-	const dir = sourcePath.slice(0, sourcePath.length - base.length);
-	return (0, node_path.join)(dir.length > 0 ? dir : cwd, "eslint.config.mjs");
+function scopesOf(model) {
+	if (model.kind === "plan") return new Set(model.plan.config.scopes.keys());
+	return new Set(model.rehoused.scopes);
+}
+function warningsOf(model) {
+	return model.kind === "plan" ? model.plan.warnings : model.rehoused.warnings;
+}
+function targetWritePath(cwd, sourcePath) {
+	const directory = (0, node_path.dirname)(sourcePath) || cwd;
+	return (0, node_path.join)(directory, resolveLintLayout(directory).eslintConfig);
 }
 function parseEslintIgnoreContents(raw) {
 	return raw.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
@@ -4557,6 +5171,17 @@ function describeDepChanges(depChanges) {
 	lines.push(`- Install (${depChanges.install.specs.length}): ${depChanges.install.specs.join(", ")}`);
 	return lines.join("\n");
 }
+async function confirmGuidedStart(clack, sourcePath) {
+	const result = await clack.confirm({
+		message: `${(0, node_path.basename)(sourcePath)} still uses the v3 single-file layout. Migrate it now?`,
+		initialValue: true
+	});
+	return !clack.isCancel(result) && result === true;
+}
+function noteConfigRename(clack, sourcePath, writePath) {
+	if (!clack.note || (0, node_path.basename)(sourcePath) === (0, node_path.basename)(writePath)) return;
+	clack.note(`${(0, node_path.basename)(sourcePath)} -> ${(0, node_path.basename)(writePath)}\n\nESLint loads a JavaScript config through Node, so importing the TypeScript lint module from one needs unflagged type stripping (Node >= 22.18) and fails on Node 20. A TypeScript config goes through jiti and loads on every supported version.`, "Renaming the flat config");
+}
 async function confirmWrite(clack, writePath, initial = true) {
 	const message = `Write migrated config to ${writePath}?`;
 	const result = await clack.confirm({
@@ -4593,17 +5218,26 @@ function emitInstallNextSteps(clack, depSummary, cwd) {
 	if (message === null) return;
 	clack.note(message, "Next steps");
 }
-function emitSummary(clack, plan, format) {
-	if (clack.note) clack.note(summary(plan, format), "Migration summary");
-	if (plan.warnings.length > 0 && clack.note) clack.note(formatWarnings(plan.warnings), "Warnings");
+function emitSummary(clack, model, format) {
+	if (!clack.note) return;
+	clack.note(model.kind === "plan" ? summary(model.plan, format) : rehouseSummary(model.rehoused), "Migration summary");
+	const warnings = warningsOf(model);
+	if (warnings.length > 0) clack.note(formatWarnings(warnings), "Warnings");
 }
 function writeAndAnnounce(clack, targetPath, writePath, rendered, format) {
 	const result = format === "eslintrc" ? writeMigrationLegacy(targetPath, writePath, rendered) : writeMigration(targetPath, rendered);
 	clack.outro(`Wrote ${result.writtenPaths.join(", ")}`);
-	return { deletedSourceCandidate: result.deletedSourceCandidate };
+	return { deletedSourceCandidates: result.deletedSourceCandidates };
+}
+function supersededFlatConfigs(sourcePath, writePath) {
+	const directory = (0, node_path.dirname)(writePath);
+	const { replacedEslintConfigs } = resolveLintLayout(directory);
+	const candidates = [...replacedEslintConfigs.map((filename) => (0, node_path.join)(directory, filename)), writePath];
+	return [...new Set(candidates.filter((path) => path !== sourcePath && (0, node_fs.existsSync)(path)))];
 }
-async function confirmOverwriteExistingOutput(clack, writePath, sourcePath, initial = false) {
-	const message = `An \`${(0, node_path.basename)(writePath)}\` already exists. Overwrite + delete \`${(0, node_path.basename)(sourcePath)}\`?`;
+async function confirmOverwriteExistingOutput(clack, superseded, sourcePath, initial = false) {
+	const names = superseded.map((path) => (0, node_path.basename)(path));
+	const message = `${names.length === 1 ? `An \`${names[0]}\` already exists` : `\`${names.join("`, `")}\` already exist`}. Overwrite + delete \`${(0, node_path.basename)(sourcePath)}\`?`;
 	const result = await clack.confirm({
 		message,
 		initialValue: initial
@@ -4638,23 +5272,30 @@ function resolveSource(input, clack) {
 		}
 	};
 }
+function renderModel(model, eslintIgnore) {
+	if (model.kind === "rehouse") return model.rehoused.lintModule;
+	if (eslintIgnore && eslintIgnore.patterns.length > 0) mergeIgnorePatterns(model.plan, eslintIgnore.patterns);
+	return renderV2(model.plan);
+}
 function prepareMigration(resolved, input) {
-	const planResult = planFromSource(resolved.source, resolved.targetPath, resolved.format);
-	if (!planResult) return null;
-	const { plan } = planResult;
-	const writePath = targetWritePath(input.cwd, resolved.targetPath, resolved.format);
+	const outcome = sourceModelFrom(resolved);
+	if (!outcome.ok) return outcome;
+	const writePath = targetWritePath(input.cwd, resolved.targetPath);
 	const eslintIgnore = findEslintIgnore(resolved.targetPath);
-	if (eslintIgnore && eslintIgnore.patterns.length > 0) mergeIgnorePatterns(plan, eslintIgnore.patterns);
 	return {
-		plan,
-		rendered: renderV2(plan),
-		writePath,
-		eslintIgnore
+		ok: true,
+		prepared: {
+			model: outcome.model,
+			rendered: renderModel(outcome.model, eslintIgnore),
+			writePath,
+			eslintIgnore
+		}
 	};
 }
 async function runConfirmations(clack, input, targetPath, writePath, previous) {
-	if (writePath !== targetPath && (0, node_fs.existsSync)(writePath)) {
-		if (!await confirmOverwriteExistingOutput(clack, writePath, targetPath, previous?.overwriteExisting ?? false)) {
+	const superseded = supersededFlatConfigs(targetPath, writePath);
+	if (superseded.length > 0) {
+		if (!await confirmOverwriteExistingOutput(clack, superseded, targetPath, previous?.overwriteExisting ?? false)) {
 			clack.outro("Aborted: existing output kept.");
 			return false;
 		}
@@ -4678,7 +5319,7 @@ function tryReadConsumerManifest(path) {
 		return null;
 	}
 }
-function computeDepSummary(plan, writePath, overrides) {
+function computeDepSummary(model, writePath, overrides) {
 	const pkgPath = consumerPackageJsonPath(writePath);
 	const manifest = tryReadConsumerManifest(pkgPath);
 	if (!manifest) return {
@@ -4691,7 +5332,7 @@ function computeDepSummary(plan, writePath, overrides) {
 	};
 	const pruneOutcome = pruneEslintDependencies(manifest);
 	const ownManifest = (overrides?.readEslintConfigManifest ?? readOwnEslintConfigManifest)();
-	const install = buildInstallList(new Set(plan.config.scopes.keys()), ownManifest);
+	const install = buildInstallList(scopesOf(model), ownManifest);
 	return {
 		removed: pruneOutcome.removed,
 		install,
@@ -4712,7 +5353,7 @@ function resolveInstallCwd(depSummary, input) {
 	return input.cwd;
 }
 async function runInstaller(clack, depSummary, input) {
-	await installWithRetry({
+	return installWithRetry({
 		deps: depSummary.install.specs,
 		cwd: resolveInstallCwd(depSummary, input),
 		autoConfirm: Boolean(input.yes),
@@ -4724,42 +5365,79 @@ async function runInstaller(clack, depSummary, input) {
 async function applyDepChanges(clack, depSummary, input) {
 	if (!depSummary.packageJsonPath) {
 		if (clack.note) clack.note("No package.json found alongside the migrated config — skipping dependency updates.", "Notice");
-		return;
+		return true;
 	}
 	persistPrunedManifest(depSummary);
 	if (input.noInstall) {
 		emitInstallNextSteps(clack, depSummary, input.cwd);
-		return;
+		return true;
 	}
 	if (!input.yes) {
 		if (!await confirmInstall(clack, depSummary)) {
 			emitInstallNextSteps(clack, depSummary, input.cwd);
-			return;
+			return true;
 		}
 	}
 	noteFallbacks(clack, depSummary);
-	await runInstaller(clack, depSummary, input);
+	if (!(await runInstaller(clack, depSummary, input)).installed) {
+		emitInstallNextSteps(clack, depSummary, input.cwd);
+		return false;
+	}
+	return true;
 }
 function performWriteAndCleanup(clack, resolved, prepared) {
 	const outcome = writeAndAnnounce(clack, resolved.targetPath, prepared.writePath, prepared.rendered, resolved.format);
-	if (prepared.eslintIgnore) safeUnlink(prepared.eslintIgnore.path, clack, ".eslintignore");
-	if (outcome.deletedSourceCandidate) safeUnlink(outcome.deletedSourceCandidate, clack, "source config");
+	if (prepared.eslintIgnore && prepared.model.kind === "plan") safeUnlink(prepared.eslintIgnore.path, clack, ".eslintignore");
+	outcome.deletedSourceCandidates.forEach((path) => {
+		safeUnlink(path, clack, "superseded config");
+	});
+}
+function noteLintScriptOutcome$1(clack, result) {
+	if (!clack.note) return;
+	if (result.unresolved) {
+		clack.note(`Left \`${result.unresolved.script}\` untouched — it runs neither eslint nor oxlint:\n\n  ${result.unresolved.previous}\n\nAdd \`${OXLINT_LINT_SCRIPT}\` yourself, next to whatever invokes ESLint.`, "package.json script not changed");
+		return;
+	}
+	if (result.alreadyRunsOxlint.length > 0 && result.changes.length === 0) {
+		clack.note(`\`${result.alreadyRunsOxlint.join("`, `")}\` already run oxlint — left alone.`, "package.json scripts unchanged");
+		return;
+	}
+	if (result.skipped.length > 0) clack.note(`${formatSkippedLintScripts(result.skipped)}\n\noxlint was added to one entry point only, so it does not run twice over the same tree.`, "package.json scripts left alone");
+	if (result.changes.length === 0) return;
+	clack.note(`${formatLintScriptChanges(result.changes)}\n\noxlint was prepended, never substituted, so every command that was there still runs.`, "Updated package.json scripts");
 }
 function applyLintScript$1(clack, directory) {
 	const manifestPath = (0, node_path.join)(directory, "package.json");
 	if (!(0, node_fs.existsSync)(manifestPath)) return;
 	const result = setLintScript((0, node_fs.readFileSync)(manifestPath, "utf8"));
-	if (!result.changed) return;
-	(0, node_fs.writeFileSync)(manifestPath, result.manifest, "utf8");
-	if (clack.note) {
-		const previous = result.previous ?? "(none)";
-		clack.note(`lint: ${previous} -> oxlint --disable-nested-config && eslint .`, "Updated package.json script");
+	if (result.changed) (0, node_fs.writeFileSync)(manifestPath, result.manifest, "utf8");
+	noteLintScriptOutcome$1(clack, result);
+}
+function noteUntouchedDirectiveFiles(clack, skipped) {
+	if (skipped.length === 0 || !clack.note) return;
+	clack.note(formatUntouchedDirectiveFiles(skipped), `${skipped.length} file(s) left untouched`);
+}
+async function rewriteDirectivesWithNote(clack, directory, autoConfirm) {
+	const { candidates, skipped } = previewDisableDirectives(directory);
+	noteUntouchedDirectiveFiles(clack, skipped);
+	if (candidates.length === 0) return;
+	const count = candidates.length;
+	if (clack.note) clack.note(`${count} file(s) carry an \`eslint-disable\` naming a rule oxlint now owns. Left as they are, ESLint reports each one as an unused directive.
+
+This is a separate, source-wide diff — review it on its own commit.`, "Disable directives");
+	if (!autoConfirm) {
+		const proceed = await clack.confirm({
+			message: `Re-point \`eslint-disable\` onto \`oxlint-disable\` in ${count} file(s) now?`,
+			initialValue: true
+		});
+		if (clack.isCancel(proceed) || proceed !== true) {
+			if (clack.note) clack.note("Skipped. Re-run `npx @useinsider/eslint-config migrate` to apply it later.", "Disable directives not rewritten");
+			return;
+		}
 	}
-}
-function rewriteDirectivesWithNote(clack, directory) {
-	const { rewritten } = rewriteDisableDirectives(directory);
-	if (rewritten.length === 0 || !clack.note) return;
-	clack.note(`Re-pointed eslint-disable comments onto oxlint-disable in ${rewritten.length} file(s).`, "Disable directives");
+	const { rewritten, skipped: unwritten } = rewriteDisableDirectives(directory, candidates);
+	if (clack.note) clack.note(`Re-pointed directives in ${rewritten.length} file(s).`, "Disable directives");
+	noteUntouchedDirectiveFiles(clack, unwritten);
 }
 function loadPreviousMigrate(clack, cwd) {
 	const restored = loadSession({ cwd });
@@ -4768,10 +5446,15 @@ function loadPreviousMigrate(clack, cwd) {
 	return previousMigrate;
 }
 function emitNothingToMigrate(clack, format) {
-	clack.outro(format === "eslintrc" ? "No legacy `.eslintrc` shape found — nothing to migrate." : "No v1 useInsider patterns found — nothing to migrate.");
+	clack.outro(format === "eslintrc" ? "No legacy `.eslintrc` shape found — nothing to migrate." : "No v1 or v3 useInsider patterns found — nothing to migrate.");
+}
+function noteUnfoldedEslintIgnore(clack, prepared) {
+	const patterns = prepared.eslintIgnore?.patterns ?? [];
+	if (!clack.note || prepared.model.kind !== "rehouse" || patterns.length === 0) return;
+	clack.note(`${prepared.eslintIgnore?.path} still holds ${patterns.length} pattern(s). Flat config does not read it, and the v3 config was carried over verbatim, so they were not folded into \`ignores\`. Move the ones you still need into the \`ignores\` array and delete the file.`, ".eslintignore left alone");
 }
 function persistMigrateSession(input, prepared, resolved) {
-	const overwriteExisting = prepared.writePath !== resolved.targetPath && (0, node_fs.existsSync)(prepared.writePath);
+	const overwriteExisting = supersededFlatConfigs(resolved.targetPath, prepared.writePath).length > 0;
 	saveSession({
 		command: "migrate",
 		migrate: {
@@ -4783,34 +5466,54 @@ function persistMigrateSession(input, prepared, resolved) {
 		}
 	}, { cwd: input.cwd });
 }
+async function finishMigrate(clack, depSummary, input) {
+	if (depSummary && !await applyDepChanges(clack, depSummary, input)) {
+		clack.cancel("Config migrated, but the dependencies did not install. Install them and re-run lint.");
+		return 1;
+	}
+	clearSession({ cwd: input.cwd });
+	return 0;
+}
 async function runMigrate(input, clackOverride) {
 	const clack = clackOverride ?? await loadClack();
 	const sourceResult = resolveSource(input, clack);
 	if (!sourceResult.ok) return sourceResult.exitCode;
 	const { resolved } = sourceResult;
 	clack.intro(`Migrating ${resolved.targetPath}`);
+	const declinedExitCode = input.fromLint ? 1 : 0;
+	if (input.fromLint && !input.yes && !await confirmGuidedStart(clack, resolved.targetPath)) {
+		clack.outro("Left the config as it is — nothing was written.");
+		return declinedExitCode;
+	}
 	const previousMigrate = loadPreviousMigrate(clack, input.cwd);
-	const prepared = prepareMigration(resolved, input);
-	if (!prepared) {
-		emitNothingToMigrate(clack, resolved.format);
-		return 0;
+	const outcome = prepareMigration(resolved, input);
+	if (!outcome.ok) {
+		if (outcome.reason === null) {
+			emitNothingToMigrate(clack, resolved.format);
+			return declinedExitCode;
+		}
+		clack.cancel(outcome.reason);
+		return 1;
 	}
-	emitSummary(clack, prepared.plan, resolved.format);
-	const depSummary = computeDepSummary(prepared.plan, prepared.writePath, input.overrides);
-	if (!await runConfirmations(clack, input, resolved.targetPath, prepared.writePath, previousMigrate)) return 0;
+	const { prepared } = outcome;
+	emitSummary(clack, prepared.model, resolved.format);
+	noteUnfoldedEslintIgnore(clack, prepared);
+	noteConfigRename(clack, resolved.targetPath, prepared.writePath);
+	const depSummary = computeDepSummary(prepared.model, prepared.writePath, input.overrides);
+	if (!await runConfirmations(clack, input, resolved.targetPath, prepared.writePath, previousMigrate)) return declinedExitCode;
 	persistMigrateSession(input, prepared, resolved);
 	performWriteAndCleanup(clack, resolved, prepared);
 	applyLintScript$1(clack, (0, node_path.dirname)(prepared.writePath));
-	rewriteDirectivesWithNote(clack, (0, node_path.dirname)(prepared.writePath));
+	await rewriteDirectivesWithNote(clack, (0, node_path.dirname)(prepared.writePath), Boolean(input.yes));
 	const consumerDir = (0, node_path.dirname)(prepared.writePath);
+	const consumerLayout = resolveLintLayout(consumerDir);
 	await applyTsExtensionsFlag(clack, {
 		cwd: consumerDir,
-		lintModule: resolveLintLayout(consumerDir).lintModule,
+		lintModule: consumerLayout.lintModule,
+		eslintConfig: consumerLayout.eslintConfig,
 		autoConfirm: input.yes
 	});
-	if (depSummary) await applyDepChanges(clack, depSummary, input);
-	clearSession({ cwd: input.cwd });
-	return 0;
+	return finishMigrate(clack, depSummary, input);
 }
 //#endregion
 //#region src/cli/index.ts
@@ -4977,9 +5680,19 @@ async function resolveHybridAnswers(clack, input, answers) {
 }
 function applyLintScript(cwd) {
 	const manifestPath = (0, node_path.join)(cwd, "package.json");
-	if (!(0, node_fs.existsSync)(manifestPath)) return;
+	if (!(0, node_fs.existsSync)(manifestPath)) return null;
 	const result = setLintScript((0, node_fs.readFileSync)(manifestPath, "utf8"));
 	if (result.changed) (0, node_fs.writeFileSync)(manifestPath, result.manifest, "utf8");
+	return result;
+}
+function noteLintScriptOutcome(clack, result) {
+	if (!clack.note || !result) return;
+	if (result.unresolved) {
+		clack.note(`Left \`${result.unresolved.script}\` untouched — it runs neither eslint nor oxlint:\n\n  ${result.unresolved.previous}\n\nAdd \`${OXLINT_LINT_SCRIPT}\` yourself, next to whatever invokes ESLint.`, "package.json script not changed");
+		return;
+	}
+	if (result.skipped.length > 0) clack.note(`${formatSkippedLintScripts(result.skipped)}\n\noxlint was added to one entry point only, so it does not run twice over the same tree.`, "package.json scripts left alone");
+	if (result.changes.length > 0) clack.note(formatLintScriptChanges(result.changes), "Updated package.json scripts");
 }
 function writeLintLayout(cwd, lintModuleSource) {
 	const layout = resolveLintLayout(cwd);
@@ -4988,21 +5701,26 @@ function writeLintLayout(cwd, lintModuleSource) {
 	renderLintLayoutFiles(layout).forEach((file) => {
 		(0, node_fs.writeFileSync)((0, node_path.join)(cwd, file.filename), file.source, "utf8");
 	});
-	applyLintScript(cwd);
-	return lintModulePath;
+	layout.replacedEslintConfigs.forEach((filename) => {
+		(0, node_fs.rmSync)((0, node_path.join)(cwd, filename), { force: true });
+	});
+	return {
+		lintModulePath,
+		lintScript: applyLintScript(cwd)
+	};
 }
 async function installAndWrite(clack, input, answers, options) {
 	if (options.pruneBeforeInstall) noteOverridePrune(clack, pruneConsumerPackageJson(input.cwd).removed);
 	const deps = buildDependencyList(answers);
 	if (clack.note) clack.note(deps.map((dep) => `  - ${dep}`).join("\n"), "Installing dev dependencies");
-	await installWithRetry({
+	if (!(await installWithRetry({
 		deps,
 		cwd: input.cwd,
 		autoConfirm: Boolean(input.yes),
 		clack,
 		installer: input.overrides?.installer ?? installDependencies,
 		fsOps: input.overrides?.wipeFs
-	});
+	})).installed) return null;
 	return writeLintLayout(input.cwd, renderLintModuleFile(answers));
 }
 async function runScaffold(input, clackOverride) {
@@ -5024,14 +5742,21 @@ async function runScaffold(input, clackOverride) {
 			existingConfigChoice: "override"
 		}
 	}, { cwd: input.cwd });
-	const targetPath = await installAndWrite(clack, input, resolvedAnswers, { pruneBeforeInstall: viaOverride });
+	const written = await installAndWrite(clack, input, resolvedAnswers, { pruneBeforeInstall: viaOverride });
+	if (!written) {
+		clack.cancel("Dependencies were not installed — nothing was written. Fix the install and re-run.");
+		return 1;
+	}
+	noteLintScriptOutcome(clack, written.lintScript);
+	const layout = resolveLintLayout(input.cwd);
 	await applyTsExtensionsFlag(clack, {
 		cwd: input.cwd,
-		lintModule: resolveLintLayout(input.cwd).lintModule,
+		lintModule: layout.lintModule,
+		eslintConfig: layout.eslintConfig,
 		autoConfirm: input.yes
 	});
 	clearSession({ cwd: input.cwd });
-	clack.outro(`Wrote ${targetPath} and its sibling linter configs`);
+	clack.outro(`Wrote ${written.lintModulePath} and its sibling linter configs`);
 	return 0;
 }
 async function runScaffoldSubcommand(scaffoldInput) {
@@ -5042,7 +5767,8 @@ async function runMigrateSubcommand(input) {
 		cwd: input.cwd,
 		target: input.target,
 		yes: input.yes,
-		noInstall: input.noInstall
+		noInstall: input.noInstall,
+		fromLint: input.fromLint
 	});
 }
 function writeStderr(line) {