@hublo/sentinel 1.5.0-alpha.24 → 1.5.0-alpha.25

package/dist/bin/sentinel.js

@@ -15,7 +15,7 @@ import {
   palette,
   registerAdapters,
   resolve
-} from "../chunk-VQZCC5QQ.js";
+} from "../chunk-I3IEZLBG.js";
 import {
   resolveContext
 } from "../chunk-ZMVI65FF.js";

package/dist/{chunk-VQZCC5QQ.js → chunk-I3IEZLBG.js}

@@ -6009,6 +6009,7 @@ function renderMarkdown(report) {
     const family = familyOf(finding.metric);
     if (family !== void 0) places.set(family, (places.get(family) ?? 0) + 1);
   }
+  const version = report.settings.find((setting) => setting.key === "sentinel")?.value;
   const present = new Set(report.rows.map((row) => row.metric));
   const rows = FAMILIES.filter(
     (family) => family.metrics.some((metric) => present.has(metric)) || places.has(family.label)
@@ -6037,6 +6038,11 @@ ${report.notes.map((note) => `- ${note.split(". ")[0] ?? note}`).join("\n")}
     "> `(ok)` or `(exceed)` is where a figure sits against a PUBLISHED reference; a figure with no",
     "> marker has none, which is a decision and not a gap. A file breaching several rules counts",
     "> once per rule. The code behind every place is in the `static-analysis.html` artifact.",
+    // ⭐ The version that produced these numbers, because the thresholds a module cannot override
+    // live in the tool: nine gauge limits, the complexity bands, the bundle budgets. Two recaps
+    // from two versions are not comparable, and without this nothing on the comment would say so.
+    // Read from the settings the report already carries rather than from the package a second time.
+    ...version === void 0 ? [] : [`> Measured by sentinel ${version}.`],
     ""
   ].join("\n");
 }
@@ -7379,6 +7385,19 @@ function measuredWith(config) {
   const moved = (key) => config.moved.some((path2) => path2 === key || path2.startsWith(`${key}.`));
   const row = (key, value) => ({ key, value, moved: moved(key) });
   return [
+    /**
+     * ⭐ The tool's own version, first, and it is the same argument this list already makes about
+     * every other line: "6.81% found with `minTokens` at 50 and 6.81% found with it at 100 are not
+     * the same measurement". The version is the stronger case, because the numbers a module cannot
+     * override live HERE: the nine gauge thresholds, the complexity bands, the bundle budgets, and
+     * what each figure's unit means. `max-nested-callbacks` sat at 10 and now sits at 3;
+     * `complexityMax` carried a unit and no longer does. A report that does not name the version
+     * that produced it cannot be held against a report from last month, and nothing on the page
+     * would say why the two disagree.
+     *
+     * Never `moved`: it is not a setting a module can turn, which is exactly why it has to be said.
+     */
+    { key: "sentinel", value: readOwnPackage().version, moved: false },
     row("duplication.minTokens", String(config.duplication.minTokens)),
     row("duplication.minLines", String(config.duplication.minLines)),
     row("duplication.kinds", config.duplication.kinds.join(", ")),

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-VQZCC5QQ.js";
+} from "./chunk-I3IEZLBG.js";
 import {
   BaseAdapter
 } from "./chunk-ZMVI65FF.js";

package/docs/bundle-analysis-spec.md

@@ -214,12 +214,12 @@ A report nobody opens is a report that changes nothing, and the published cases
 both of them put the figures where the review already happens. So this release does not stop at a
 page on disk.
 
-|                 |                                                                                                                     |
-| --------------- | ------------------------------------------------------------------------------------------------------------------- |
-| what is posted  | a recap of the figures for the fronts the pull request touched, with each band                                      |
-| when            | every run, not only on a breach: a recap that appears only when something is wrong is a recap nobody learns to read |
-| blocking        | **no**, and that is a choice for now rather than an end state                                                       |
-| on a second run | the same comment is updated, never a second one                                                                     |
+|                 |                                                                                                                        |
+| --------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| what is posted  | one section per module the pull request touched: six rows, one per family, the headline figure and the places it holds |
+| when            | every run, not only on a breach: a recap that appears only when something is wrong is a recap nobody learns to read    |
+| blocking        | **no**, and that is a choice for now rather than an end state                                                          |
+| on a second run | the same comment is updated, never a second one                                                                        |
 
 ⛔ The division of labour matters, because getting it wrong couples this role to one CI provider.
 **sentinel renders the content, the repository's workflow posts it.** The content is markdown
@@ -227,6 +227,33 @@ produced from the same figures the other three shapes carry, which makes it test
 identical to what the console printed. Who holds the token, which event triggers it and how a
 comment is found again are the repository's business, not this role's.
 
+### 8.1 What it is, as built
+
+⚠️ It covers the **whole role**, not the bundle alone, and that is a correction to the line above
+that said "the fronts the pull request touched". A pull request touches libraries and services too,
+and a recap that stayed silent on them would teach a reader that this role only speaks about fronts.
+A module with no build gets five rows and a line saying why the sixth is absent.
+
+Three decisions worth stating, because each one was a fork:
+
+- **The headline per family is declared, not positional.** Three of the six would be wrong taken as
+  "the first metric listed": `importEdges` leads structure and is a size rather than a signal, so a
+  big module would look bad for being big, and `entryPoints` leads dead code and is the walk's
+  starting condition rather than a result.
+- **The row is named by the metric's own help label**, not the family's name. "Duplication | 0.75%"
+  does not say of what; "Duplicated lines" does. One wording, shared with the page.
+- **A marker says where a figure sits against a published reference**, `(ok)` included, and a row
+  with no marker has no reference rather than sitting inside one. Those are different facts, and
+  six of this role's figures genuinely have none.
+
+It reads no source file and lays out no graph: a recap shows no code, so it skips both the 201 file
+reads and the 5-second layout the page pays for.
+
+⛔ And it says on itself that it is **not compared with `main`**. See section 9: the delta needs a
+stored baseline. A figure in a pull-request comment is read as a delta by default, and that reading
+is wrong in the dangerous direction, since a module already at 6.81% looks exactly like one this
+branch pushed there.
+
 ## 9. Deferred, with the reason
 
 Recorded in issue #97. Both need something this release does not have, and neither changes a figure

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.5.0-alpha.24",
+  "version": "1.5.0-alpha.25",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",