@hublo/sentinel 1.6.0-alpha.1 → 1.6.0-alpha.2

package/README.md

@@ -254,7 +254,7 @@ The rules live in `sentinel`. Each module keeps a **thin, generated stub** per t
 
 - **Rules in sentinel** — one source of truth, versioned.
 - **Thin stubs per module** — the stub is what keeps the **editor working** (VS Code discovers config by file, real-time lint/type/format stay live) and what **nx** uses to infer targets. Stubs are **generated by `sentinel --init`**, never hand-written; swapping a runner regenerates them.
-- **Drift guard** — sentinel validates that each stub is _only_ the sanctioned `extends`, with nothing added or overridden. Unsanctioned drift is flagged in CI; a genuine exception must be **declared in an allowlist** (visible, reviewed), never silent.
+- **Drift guard** — sentinel validates that each stub is _only_ the sanctioned `extends`, with nothing of the preset's overridden. Unsanctioned drift is flagged in CI; a genuine exception must be **declared in an allowlist** (visible, reviewed), never silent. One addition is sanctioned, in lint: what the preset does not govern (a rule it does not name, a plugin, jsPlugin or setting it does not set) is the module's own, kept by `--init`, not drift, and listed by `--inspect`; a rule the preset names, set to another value, or an entry that collides with the preset's, is drift ([lint-adoption.md](docs/lint-adoption.md#what---inspect-calls-drift-and-what-it-lists-as-yours)).
 - **Per-module install** — `@hublo/sentinel` is added per module, so adoption is **gradual** (migrate lot by lot; a module can adopt sentinel while its neighbour still uses the old config). Root configs are removed only once the **last** module has migrated.
 - **Runner binaries** (`eslint`, `typescript`, `vite`, `vitest`, …) are **resolved from the adopting module** at run time (sentinel looks for the tool in the module, then falls back to `PATH`), so the editor and nx keep using the exact binary the project already installs. sentinel does **not** declare them as dependencies today, so it does not pin their versions: the module still owns its own `typescript`. Having sentinel dictate those versions (as peer dependencies, so the whole toolchain rides the sentinel version) is the intended end state, and it lands with the tool tickets that actually bundle a runner.
 
@@ -467,7 +467,8 @@ preset guessing): for each module it reads the committed `tsconfig` `extends` ch
 reports whether it is **adopted** (extends a sentinel preset), which preset, and whether
 it is **conformant** (drift-free, a re-`update` would change nothing), plus a coverage
 footer. This is the **drift guard** as a command, `--status --ci` exits non-zero when an
-adopted module has drifted.
+adopted module has drifted. For lint, what a module adds that its preset does not govern is not
+drift; a rule the preset names, set differently (stricter included, for now), is.
 
 ```
   ✓ host-admin (react) typescript — adopted (react) conformant

package/dist/bin/sentinel.js

@@ -12,10 +12,10 @@ import {
   presetNotInstalledYet,
   registerAdapters,
   resolve
-} from "../chunk-5267A6X3.js";
+} from "../chunk-R7DS7VN4.js";
 import {
   resolveContext
-} from "../chunk-P7NYSMLS.js";
+} from "../chunk-67QLOX6F.js";
 import {
   ensureWorkspacePrep,
   findWorkspaceRoot,
@@ -584,7 +584,7 @@ async function runValidate(ctx) {
     );
   }
   if (!ctx.targets.includes("test")) return 1;
-  const { validateModuleTests } = await import("../validate-5SD5CTTO.js");
+  const { validateModuleTests } = await import("../validate-NP7X6XCG.js");
   const outcomes = modules.flatMap(
     (module) => validateModuleTests(module.name, module.root)
   );
@@ -616,7 +616,9 @@ var HEAD_KEYS = /* @__PURE__ */ new Set([
   "diagnosticsTruncated"
 ]);
 function isRuleList(value) {
-  return Array.isArray(value) && value.every((entry) => typeof entry === "object" && entry !== null && "rule" in entry);
+  return Array.isArray(value) && value.every(
+    (entry) => typeof entry === "object" && entry !== null && ("rule" in entry || "entry" in entry)
+  );
 }
 var RULE_BLOCKS = [
   { key: "deferred", label: "deferred (phase 1, non-breaking):" },
@@ -630,7 +632,11 @@ var RULE_BLOCKS = [
   // adopted module can be missing a check nobody in it ever chose to drop. Reduced coverage
   // has to be readable, or the difference between an accepted cost and a regression is only
   // that nobody looked.
-  { key: "unenforced", label: "not checked at all:" }
+  { key: "unenforced", label: "not checked at all:" },
+  // The other direction, and listed for the same reason: a rule a module adds to its lint
+  // preset is not drift, so nothing else on the row would ever show it was there.
+  { key: "added", label: "added by the module (kept by --init, not drift):" },
+  { key: "addedConfig", label: "config added by the module (kept by --init, not drift):" }
 ];
 var MAX_INLINE_WIDTH = 60;
 function renderValue(key, value, p) {
@@ -674,9 +680,9 @@ function renderSummary(item, p) {
   for (const { label, rules } of blocks) {
     if (rules.length === 0) continue;
     lines.push(`      ${p.warn(label)}`);
-    for (const { rule, phase, reason } of rules) {
+    for (const { rule, entry, phase, reason } of rules) {
       const detail = phase === void 0 ? reason : `phase ${phase}: ${reason}`;
-      lines.push(`        ${p.warn("\u2022")} ${p.strong(rule)} ${p.dim(`\u2014 ${detail}`)}`);
+      lines.push(`        ${p.warn("\u2022")} ${p.strong(rule ?? entry ?? "?")} ${p.dim(`\u2014 ${detail}`)}`);
     }
   }
   return lines.join("\n");