@inixiative/config 0.1.0

package/README.md

@@ -0,0 +1,87 @@
+# @inixiative/config
+
+Shared toolchain for the inixiative ecosystem: tsconfig/biome/tsup presets, a version manifest (BOM), and a `sync`/`check` CLI that enforces both.
+
+## Presets
+
+| Export | Use |
+| --- | --- |
+| `@inixiative/config/tsconfig/base.json` | bun library (bundler resolution, verbatimModuleSyntax, `types: ["bun"]`) |
+| `@inixiative/config/tsconfig/node.json` | base + `types: ["node"]` |
+| `@inixiative/config/tsconfig/react.json` | base + DOM lib + `jsx: react-jsx` |
+| `@inixiative/config/biome/base.json` | formatter + linter core (single quotes, lineWidth 100, recommended + strictness block) |
+| `@inixiative/config/biome/react.json` | overlay: hook dependency linting |
+| `@inixiative/config/tsup` | `node(options)` / `react(options)` build presets |
+
+Adoption is three stub files plus the devDependency:
+
+```jsonc
+// tsconfig.json
+{ "extends": "@inixiative/config/tsconfig/base.json", "exclude": ["dist"] }
+
+// biome.json
+{ "extends": ["@inixiative/config/biome/base.json"] }
+```
+
+```ts
+// tsup.config.ts
+import { node } from '@inixiative/config/tsup';
+
+export default node();
+```
+
+Stubs hold `extends` plus minimal reviewed overrides only. This package never generates config bodies.
+
+## versions.json (the BOM)
+
+One version of `@inixiative/config` names one coherent ecosystem state:
+
+- `bun` — blessed runtime, written to `.bun-version` and `packageManager`
+- `toolchain` — exact pins for `@biomejs/biome`, `typescript`, `tsup`, `@types/bun`
+- `required` — toolchain packages every repo must carry
+- `ecosystem` — the blessed, mutually-verified `@inixiative/*` set
+
+TypeScript 6.0 notes, discovered by this repo's fixture suite:
+
+- TS 6.0 no longer auto-includes `node_modules/@types`, so `base.json` sets `types: ["bun"]` and `@types/bun` is required.
+- tsup's dts build trips TS 6.0's `baseUrl` deprecation; the tsup presets scope `ignoreDeprecations: "6.0"` to the dts build only.
+
+## CLI
+
+```
+bunx @inixiative/config check [dir] [--preset=base|node|react]
+bunx @inixiative/config sync  [dir] [--preset=...] [--force] [--no-install]
+bunx @inixiative/config scan  [root]
+bunx @inixiative/config train [root]
+```
+
+`check` is read-only and exits non-zero on drift — run it in CI after a frozen-lockfile install. It verifies toolchain pins, `"latest"` ranges, `packageManager`/`.bun-version`, legacy `bun.lockb`, a committed (tracked, un-ignored) `bun.lock`, required scripts (`check`/`typecheck`/`lint`/`test`), stub `extends`, presence of this package, and for every ecosystem dependency that the declared range admits the blessed version and the lockfile actually resolves to it (the stale-lockfile class).
+
+`sync` applies every fix, re-locks via `bun install`, and runs `bun update` on stale ecosystem entries. It refuses to run on a dirty working tree without `--force`. The react preset is inferred from a `react` dependency; override with `--preset`. Missing scripts are filled with defaults; existing script bodies are never touched.
+
+`scan` runs `check` across every ecosystem checkout under a root directory. Targets are derived from the BOM's `ecosystem` keys and matched by package name, so directory names and local layout never need declaring.
+
+`train` is the release cascade, run from this repo's checkout. It walks the ecosystem in dependency order; per repo it: skips if dirty or behind origin → bumps ecosystem ranges to the BOM → re-locks → runs the repo's `check` → commits only its own changes (`package.json` + `bun.lock`) → publishes via `npm publish` when the local version is ahead of npm (OTP prompts pass through) → records the published version in the BOM. It never pushes; review its commits, push, then commit and publish this package so the BOM names the new state.
+
+Division of labor: this CLI owns the toolchain set, ecosystem coherence, stubs, and lockfile format. Renovate owns everything else plus bumping `@inixiative/config` itself, and must be fenced off the toolchain packages.
+
+## CI
+
+Every lib repo gets a two-line caller workflow:
+
+```yaml
+name: ci
+on:
+  push:
+    branches: [main]
+  pull_request:
+jobs:
+  ci:
+    uses: inixiative/config/.github/workflows/lib-ci.yml@main
+```
+
+`lib-ci.yml` pins bun from `.bun-version`, installs with `--frozen-lockfile` (kills the stale-lockfile class), runs `inixiative-config check .`, then the repo's own `bun run check`.
+
+## Release flow
+
+Publishing moves in dependency order (json-rules → permissions → transitions → rules-builder). `train` automates the walk; after it completes, commit and publish this package so the BOM names the new state. Downstream repos pick it up via `sync`.

package/biome/base.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.5.2/schema.json",
+  "vcs": { "enabled": true, "clientKind": "git", "useIgnoreFile": true },
+  "files": {
+    "ignoreUnknown": false,
+    "includes": ["**", "!**/dist", "!**/node_modules"]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 100
+  },
+  "assist": { "actions": { "source": { "organizeImports": "on" } } },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true,
+      "correctness": {
+        "noUnusedVariables": "error"
+      },
+      "suspicious": {
+        "noExplicitAny": "warn",
+        "noImplicitAnyLet": "warn",
+        "noThenProperty": "off"
+      },
+      "style": {
+        "noNonNullAssertion": "warn"
+      }
+    }
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "single",
+      "trailingCommas": "all",
+      "semicolons": "always"
+    }
+  }
+}

package/biome/react.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.5.2/schema.json",
+  "linter": {
+    "rules": {
+      "correctness": {
+        "useExhaustiveDependencies": "warn"
+      }
+    }
+  }
+}

package/dist/cli.js

@@ -0,0 +1,587 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import { join as join2, resolve } from "path";
+
+// src/lib.ts
+import { spawnSync } from "child_process";
+import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+var packageRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+var REQUIRED_SCRIPTS = {
+  typecheck: "tsc --noEmit",
+  lint: "biome check .",
+  test: "bun test",
+  check: "bun run typecheck && bun run lint && bun run test"
+};
+var DEP_FIELDS = ["dependencies", "devDependencies", "peerDependencies"];
+var loadManifest = () => JSON.parse(readFileSync(join(packageRoot, "versions.json"), "utf8"));
+var ownVersion = () => JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8")).version;
+var stripJsonc = (text) => {
+  let out = "";
+  let inString = false;
+  let i = 0;
+  while (i < text.length) {
+    const ch = text[i];
+    const next = text[i + 1];
+    if (inString) {
+      out += ch;
+      if (ch === "\\") {
+        out += next ?? "";
+        i += 2;
+        continue;
+      }
+      if (ch === '"') inString = false;
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      out += ch;
+      i++;
+      continue;
+    }
+    if (ch === "/" && next === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i += 2;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out.replace(/,(\s*[}\]])/g, "$1");
+};
+var parseJsonc = (text) => JSON.parse(stripJsonc(text));
+var tryParseJsonc = (text) => {
+  try {
+    const parsed = parseJsonc(text);
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+};
+var parseRange = (range) => {
+  const match = range.match(/^(\^|~|>=)?\s*(\d+)\.(\d+)\.(\d+)(?:-[\w.]+)?$/);
+  if (!match) return null;
+  return {
+    op: match[1] ?? "=",
+    version: `${match[2]}.${match[3]}.${match[4]}`
+  };
+};
+var compare = (a, b) => {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    if (pa[i] !== pb[i]) return pa[i] - pb[i];
+  }
+  return 0;
+};
+var admits = (range, version) => {
+  if (range.includes("||")) {
+    const parts = range.split("||").map((part) => admits(part.trim(), version));
+    if (parts.some((p) => p === true)) return true;
+    return parts.includes(null) ? null : false;
+  }
+  const parsed = parseRange(range.trim());
+  if (!parsed) return null;
+  const cmp = compare(version, parsed.version);
+  if (parsed.op === "=") return cmp === 0;
+  if (parsed.op === ">=") return cmp >= 0;
+  if (cmp < 0) return false;
+  const [major, minor] = parsed.version.split(".").map(Number);
+  const [vMajor, vMinor] = version.split(".").map(Number);
+  if (parsed.op === "^") return major === 0 ? vMajor === 0 && vMinor === minor : vMajor === major;
+  return vMajor === major && vMinor === minor;
+};
+var lockedVersion = (lockText, name) => {
+  const match = lockText.match(new RegExp(`"${name.replace(/\//g, "\\/")}@(\\d[^"]*)"`));
+  return match ? match[1] : null;
+};
+var topoOrder = (root, manifest2) => {
+  const repos = discoverRepos(root, manifest2).map((repo) => ({
+    ...repo,
+    pkg: JSON.parse(readFileSync(join(repo.dir, "package.json"), "utf8"))
+  }));
+  const names = new Set(repos.map((repo) => repo.name));
+  const dependsOn = /* @__PURE__ */ new Map();
+  for (const repo of repos) {
+    const edges = /* @__PURE__ */ new Set();
+    for (const field of DEP_FIELDS) {
+      for (const dep of Object.keys(repo.pkg[field] ?? {})) {
+        if (names.has(dep) && dep !== repo.name) edges.add(dep);
+      }
+    }
+    dependsOn.set(repo.name, edges);
+  }
+  const order = [];
+  const done = /* @__PURE__ */ new Set();
+  while (done.size < repos.length) {
+    const ready = repos.filter(
+      (repo) => !done.has(repo.name) && [...dependsOn.get(repo.name)].every((dep) => done.has(dep))
+    ).sort((a, b) => a.name.localeCompare(b.name));
+    if (ready.length === 0) throw new Error("dependency cycle among ecosystem repos");
+    for (const repo of ready) {
+      order.push(repo);
+      done.add(repo.name);
+    }
+  }
+  return order;
+};
+var writeManifest = (manifest2) => writeFileSync(join(packageRoot, "versions.json"), `${JSON.stringify(manifest2, null, 2)}
+`);
+var discoverRepos = (root, manifest2) => {
+  const repos = [];
+  for (const entry of readdirSync(root)) {
+    const pkgPath = join(root, entry, "package.json");
+    if (!existsSync(pkgPath)) continue;
+    const name = tryParseJsonc(readFileSync(pkgPath, "utf8"))?.name;
+    if (typeof name === "string" && name in manifest2.ecosystem)
+      repos.push({ dir: join(root, entry), name });
+  }
+  return repos.sort((a, b) => a.name.localeCompare(b.name));
+};
+var detectPreset = (pkg, override) => {
+  if (override) return override;
+  const hasReact = DEP_FIELDS.some((field) => pkg[field]?.react !== void 0);
+  return hasReact ? "react" : "base";
+};
+function inspect(dir2, manifest2, presetOverride) {
+  const findings = [];
+  const pkgPath = join(dir2, "package.json");
+  if (!existsSync(pkgPath)) {
+    return {
+      findings: [{ level: "error", message: `no package.json in ${dir2}` }],
+      flush: () => false
+    };
+  }
+  const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+  let pkgDirty = false;
+  const touch = () => {
+    pkgDirty = true;
+  };
+  for (const [name, pin] of Object.entries(manifest2.toolchain)) {
+    let present = false;
+    for (const field of DEP_FIELDS) {
+      const deps = pkg[field];
+      if (!deps?.[name]) continue;
+      present = true;
+      if (field === "peerDependencies") continue;
+      if (deps[name] !== pin) {
+        findings.push({
+          level: "error",
+          message: `${name} ${deps[name]} \u2192 ${pin} (${field})`,
+          fix: () => {
+            deps[name] = pin;
+            touch();
+          }
+        });
+      }
+    }
+    if (!present && manifest2.required.includes(name)) {
+      findings.push({
+        level: "error",
+        message: `${name} missing \u2192 devDependency ${pin}`,
+        fix: () => {
+          pkg.devDependencies ??= {};
+          pkg.devDependencies[name] = pin;
+          touch();
+        }
+      });
+    }
+  }
+  for (const field of DEP_FIELDS) {
+    const deps = pkg[field];
+    if (!deps) continue;
+    for (const [name, range] of Object.entries(deps)) {
+      if (range !== "latest") continue;
+      const pin = manifest2.toolchain[name];
+      findings.push({
+        level: "error",
+        message: `${name} pinned to "latest" in ${field}${pin ? ` \u2192 ${pin}` : " \u2192 pin a version"}`,
+        fix: pin ? () => {
+          deps[name] = pin;
+          touch();
+        } : void 0
+      });
+    }
+  }
+  for (const [script, fallback] of Object.entries(REQUIRED_SCRIPTS)) {
+    if (pkg.scripts?.[script]) continue;
+    findings.push({
+      level: "error",
+      message: `scripts.${script} missing \u2192 "${fallback}"`,
+      fix: () => {
+        pkg.scripts ??= {};
+        pkg.scripts[script] = fallback;
+        touch();
+      }
+    });
+  }
+  if (pkg.name !== "@inixiative/config" && !DEP_FIELDS.some((field) => pkg[field]?.["@inixiative/config"])) {
+    findings.push({
+      level: "error",
+      message: `@inixiative/config missing \u2192 devDependency ^${ownVersion()} (extends cannot resolve without it)`,
+      fix: () => {
+        pkg.devDependencies ??= {};
+        pkg.devDependencies["@inixiative/config"] = `^${ownVersion()}`;
+        touch();
+      }
+    });
+  }
+  const expectedPm = `bun@${manifest2.bun}`;
+  if (pkg.packageManager !== expectedPm) {
+    findings.push({
+      level: "error",
+      message: `packageManager ${pkg.packageManager ?? "(unset)"} \u2192 ${expectedPm}`,
+      fix: () => {
+        pkg.packageManager = expectedPm;
+        touch();
+      }
+    });
+  }
+  const bunVersionPath = join(dir2, ".bun-version");
+  const bunVersion = existsSync(bunVersionPath) ? readFileSync(bunVersionPath, "utf8").trim() : null;
+  if (bunVersion !== manifest2.bun) {
+    findings.push({
+      level: "error",
+      message: `.bun-version ${bunVersion ?? "(missing)"} \u2192 ${manifest2.bun}`,
+      fix: () => writeFileSync(bunVersionPath, `${manifest2.bun}
+`)
+    });
+  }
+  const lockbPath = join(dir2, "bun.lockb");
+  if (existsSync(lockbPath)) {
+    findings.push({
+      level: "error",
+      message: "legacy binary bun.lockb \u2192 delete and re-lock as bun.lock",
+      fix: () => rmSync(lockbPath)
+    });
+  }
+  const lockPath = join(dir2, "bun.lock");
+  const lockText = existsSync(lockPath) ? readFileSync(lockPath, "utf8") : null;
+  if (existsSync(join(dir2, ".git"))) {
+    if (!lockText) {
+      findings.push({
+        level: "error",
+        message: "bun.lock missing \u2192 run bun install and commit the lockfile"
+      });
+    } else if (spawnSync("git", ["check-ignore", "-q", "bun.lock"], { cwd: dir2 }).status === 0) {
+      findings.push({
+        level: "error",
+        message: "bun.lock is gitignored \u2192 stop ignoring it and commit the lockfile"
+      });
+    } else if (spawnSync("git", ["ls-files", "--error-unmatch", "bun.lock"], { cwd: dir2 }).status !== 0) {
+      findings.push({
+        level: "error",
+        message: "bun.lock untracked \u2192 commit the lockfile"
+      });
+    }
+  }
+  for (const [name, blessed] of Object.entries(manifest2.ecosystem)) {
+    if (name === pkg.name) continue;
+    for (const field of DEP_FIELDS) {
+      const deps = pkg[field];
+      const range = deps?.[name];
+      if (!range) continue;
+      const ok = admits(range, blessed);
+      if (ok === false) {
+        findings.push({
+          level: "error",
+          kind: "ecosystem-range",
+          name,
+          message: `${name} ${field} range ${range} does not admit blessed ${blessed} \u2192 ^${blessed}`,
+          fix: () => {
+            deps[name] = `^${blessed}`;
+            touch();
+          }
+        });
+      }
+      if (ok === null) {
+        findings.push({
+          level: "warn",
+          message: `${name} range ${range} not understood; verify manually against ${blessed}`
+        });
+      }
+    }
+    const installed = pkg.dependencies?.[name] ?? pkg.devDependencies?.[name];
+    if (lockText && installed) {
+      const locked = lockedVersion(lockText, name);
+      if (locked && admits(installed, locked) === false) {
+        findings.push({
+          level: "error",
+          kind: "stale-lock",
+          name,
+          message: `${name} locked at ${locked}, violating declared ${installed} (stale lockfile) \u2192 re-lock`
+        });
+      } else if (locked && locked !== blessed) {
+        findings.push({
+          level: "error",
+          kind: "stale-lock",
+          name,
+          message: `${name} locked at ${locked}, blessed is ${blessed} \u2192 re-lock`
+        });
+      }
+    }
+  }
+  const preset = detectPreset(pkg, presetOverride);
+  const tsconfigTarget = `@inixiative/config/tsconfig/${preset}.json`;
+  const tsconfigPath = join(dir2, "tsconfig.json");
+  if (!existsSync(tsconfigPath)) {
+    findings.push({
+      level: "error",
+      message: `tsconfig.json missing \u2192 stub extending ${tsconfigTarget}`,
+      fix: () => writeFileSync(
+        tsconfigPath,
+        `${JSON.stringify({ extends: tsconfigTarget, exclude: ["dist"] }, null, 2)}
+`
+      )
+    });
+  } else {
+    const tsconfig = tryParseJsonc(readFileSync(tsconfigPath, "utf8")) ?? {};
+    const extendsValue = tsconfig.extends;
+    if (typeof extendsValue !== "string" || !extendsValue.startsWith("@inixiative/config/tsconfig/")) {
+      findings.push({
+        level: "error",
+        message: `tsconfig.json extends ${typeof extendsValue === "string" ? extendsValue : "(none)"} \u2192 ${tsconfigTarget}; local compilerOptions retained as overrides, review them`,
+        fix: () => {
+          const { extends: _replaced, ...rest } = tsconfig;
+          const next = { extends: tsconfigTarget, ...rest };
+          writeFileSync(tsconfigPath, `${JSON.stringify(next, null, 2)}
+`);
+        }
+      });
+    }
+  }
+  const biomeTargets = preset === "react" ? ["@inixiative/config/biome/base.json", "@inixiative/config/biome/react.json"] : ["@inixiative/config/biome/base.json"];
+  const biomePath = join(dir2, "biome.json");
+  if (!existsSync(biomePath)) {
+    findings.push({
+      level: "error",
+      message: `biome.json missing \u2192 stub extending ${biomeTargets.join(" + ")}`,
+      fix: () => writeFileSync(biomePath, `${JSON.stringify({ extends: biomeTargets }, null, 2)}
+`)
+    });
+  } else {
+    const biome = tryParseJsonc(readFileSync(biomePath, "utf8")) ?? {};
+    const extendsValue = Array.isArray(biome.extends) ? biome.extends : [];
+    const missing = biomeTargets.filter((target) => !extendsValue.includes(target));
+    if (missing.length > 0) {
+      findings.push({
+        level: "error",
+        message: `biome.json missing extends ${missing.join(", ")}; local rules retained as overrides, review them`,
+        fix: () => {
+          const next = { ...biome, extends: biomeTargets };
+          writeFileSync(biomePath, `${JSON.stringify(next, null, 2)}
+`);
+        }
+      });
+    }
+  }
+  return {
+    findings,
+    flush: () => {
+      if (!pkgDirty) return false;
+      writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}
+`);
+      return true;
+    }
+  };
+}
+
+// src/cli.ts
+var args = process.argv.slice(2);
+var command = args[0];
+var flags = new Set(args.filter((arg) => arg.startsWith("--")).map((arg) => arg.split("=")[0]));
+var presetFlag = args.find((arg) => arg.startsWith("--preset="))?.split("=")[1];
+var positional = args.slice(1).filter((arg) => !arg.startsWith("--"));
+var dir = resolve(positional[0] ?? ".");
+var usage = () => {
+  console.log(
+    "Usage: inixiative-config <check|sync|scan|train> [dir] [--preset=base|node|react] [--force] [--no-install]"
+  );
+  process.exit(2);
+};
+if (!["check", "sync", "scan", "train"].includes(command)) usage();
+if (presetFlag && !["base", "node", "react"].includes(presetFlag)) usage();
+var manifest = loadManifest();
+var report = (findings) => {
+  for (const finding of findings) {
+    console.log(`${finding.level === "error" ? "\u2717" : "\u26A0"} ${finding.message}`);
+  }
+  const errors = findings.filter((finding) => finding.level === "error").length;
+  const warnings = findings.length - errors;
+  console.log(
+    findings.length === 0 ? "\u2713 in sync" : `${errors} error${errors === 1 ? "" : "s"}, ${warnings} warning${warnings === 1 ? "" : "s"}`
+  );
+  return errors;
+};
+if (process.versions.bun && process.versions.bun !== manifest.bun) {
+  console.log(`\u26A0 running bun ${process.versions.bun}, blessed is ${manifest.bun} (bun upgrade)`);
+}
+if (command === "check") {
+  const { findings } = inspect(dir, manifest, presetFlag);
+  process.exit(report(findings) > 0 ? 1 : 0);
+}
+if (command === "scan") {
+  const repos = discoverRepos(dir, manifest);
+  if (repos.length === 0) {
+    console.error(`\u2717 no ecosystem repos found under ${dir}`);
+    process.exit(1);
+  }
+  const drifted = [];
+  for (const repo of repos) {
+    console.log(`
+${repo.name} \u2014 ${repo.dir}`);
+    if (report(inspect(repo.dir, manifest).findings) > 0) drifted.push(repo.name);
+  }
+  console.log(
+    `
+scanned ${repos.length} repos: ${drifted.length === 0 ? "all in sync" : `${drifted.length} drifted (${drifted.join(", ")})`}`
+  );
+  process.exit(drifted.length > 0 ? 1 : 0);
+}
+if (command === "train") {
+  const order = topoOrder(dir, manifest);
+  if (order.length === 0) {
+    console.error(`\u2717 no ecosystem repos found under ${dir}`);
+    process.exit(1);
+  }
+  console.log(`train order: ${order.map((repo) => repo.name).join(" \u2192 ")}`);
+  const published = [];
+  const skipped = [];
+  let bomDirty = false;
+  for (const repo of order) {
+    console.log(`
+\u25B8 ${repo.name} \u2014 ${repo.dir}`);
+    const porcelain = spawnSync2("git", ["status", "--porcelain"], {
+      cwd: repo.dir,
+      encoding: "utf8"
+    });
+    if (porcelain.status !== 0) {
+      console.log("\u26A0 not a git checkout \u2014 skipping");
+      skipped.push(repo.name);
+      continue;
+    }
+    if (porcelain.stdout.trim().length > 0) {
+      console.log("\u26A0 dirty working tree \u2014 commit or stash your work first, skipping");
+      skipped.push(repo.name);
+      continue;
+    }
+    spawnSync2("git", ["fetch", "--quiet"], { cwd: repo.dir });
+    const behind = spawnSync2("git", ["rev-list", "--count", "HEAD..@{upstream}"], {
+      cwd: repo.dir,
+      encoding: "utf8"
+    });
+    if (behind.status === 0 && Number(behind.stdout.trim()) > 0) {
+      console.log("\u26A0 behind origin \u2014 pull first, skipping");
+      skipped.push(repo.name);
+      continue;
+    }
+    const inspection = inspect(repo.dir, manifest);
+    const bumps = inspection.findings.filter((finding) => finding.kind === "ecosystem-range");
+    for (const bump of bumps) {
+      console.log(`  ${bump.message}`);
+      bump.fix?.();
+    }
+    inspection.flush();
+    let touched = bumps.length > 0;
+    const remote = spawnSync2("npm", ["view", `${repo.name}@latest`, "version"], {
+      encoding: "utf8"
+    });
+    const remoteVersion = remote.status === 0 ? remote.stdout.trim() : null;
+    const localVersion = repo.pkg.version ?? "0.0.0";
+    const ahead = remoteVersion === null || compare(localVersion, remoteVersion) > 0;
+    if (remoteVersion && compare(localVersion, remoteVersion) < 0) {
+      console.log(`\u26A0 local ${localVersion} is behind npm ${remoteVersion} \u2014 pull first, skipping`);
+      skipped.push(repo.name);
+      continue;
+    }
+    if (touched || ahead) {
+      const install = spawnSync2("bun", ["install"], { cwd: repo.dir, stdio: "inherit" });
+      if (install.status !== 0) {
+        console.error("\u2717 bun install failed \u2014 aborting train");
+        process.exit(1);
+      }
+      const stale = inspect(repo.dir, manifest).findings.filter((finding) => finding.kind === "stale-lock" && finding.name).map((finding) => finding.name);
+      if (stale.length > 0) {
+        spawnSync2("bun", ["update", ...new Set(stale)], { cwd: repo.dir, stdio: "inherit" });
+        touched = true;
+      }
+      const check = spawnSync2("bun", ["run", "check"], { cwd: repo.dir, stdio: "inherit" });
+      if (check.status !== 0) {
+        console.error(`\u2717 check failed in ${repo.name} \u2014 aborting train`);
+        process.exit(1);
+      }
+    }
+    if (touched) {
+      spawnSync2("git", ["add", "package.json", "bun.lock"], { cwd: repo.dir });
+      const commit = spawnSync2(
+        "git",
+        ["commit", "-m", "chore: sync ecosystem deps to blessed set"],
+        { cwd: repo.dir, stdio: "inherit" }
+      );
+      if (commit.status !== 0) {
+        console.error(`\u2717 commit failed in ${repo.name} \u2014 aborting train`);
+        process.exit(1);
+      }
+    }
+    if (ahead) {
+      console.log(`publishing ${repo.name}@${localVersion} (npm has ${remoteVersion ?? "none"})`);
+      const publish = spawnSync2("npm", ["publish"], { cwd: repo.dir, stdio: "inherit" });
+      if (publish.status !== 0) {
+        console.error(`\u2717 publish failed for ${repo.name} \u2014 aborting train`);
+        process.exit(1);
+      }
+      manifest.ecosystem[repo.name] = localVersion;
+      writeManifest(manifest);
+      bomDirty = true;
+      published.push(`${repo.name}@${localVersion}`);
+    } else {
+      console.log(`\u2713 ${repo.name}@${localVersion} already on npm`);
+    }
+  }
+  console.log(`
+published: ${published.length === 0 ? "nothing" : published.join(", ")}`);
+  if (skipped.length > 0) console.log(`skipped: ${skipped.join(", ")}`);
+  if (bomDirty)
+    console.log("BOM updated in versions.json \u2014 commit @inixiative/config and publish it");
+  console.log("train does not push \u2014 review the commits it made, then push each repo");
+  process.exit(0);
+}
+if (existsSync2(join2(dir, ".git")) && !flags.has("--force")) {
+  const status = spawnSync2("git", ["status", "--porcelain"], { cwd: dir, encoding: "utf8" });
+  if (status.status === 0 && status.stdout.trim().length > 0) {
+    console.error("\u2717 working tree dirty \u2014 commit first or pass --force");
+    process.exit(1);
+  }
+}
+var first = inspect(dir, manifest, presetFlag);
+for (const finding of first.findings) finding.fix?.();
+first.flush();
+var fixed = first.findings.filter((finding) => finding.fix).length;
+if (fixed > 0) console.log(`applied ${fixed} fix${fixed === 1 ? "" : "es"}`);
+if (!flags.has("--no-install")) {
+  const install = spawnSync2("bun", ["install"], { cwd: dir, stdio: "inherit" });
+  if (install.status !== 0) {
+    console.error("\u2717 bun install failed");
+    process.exit(1);
+  }
+  const stale = inspect(dir, manifest, presetFlag).findings.filter((finding) => finding.kind === "stale-lock" && finding.name).map((finding) => finding.name);
+  if (stale.length > 0) {
+    const update = spawnSync2("bun", ["update", ...new Set(stale)], { cwd: dir, stdio: "inherit" });
+    if (update.status !== 0) {
+      console.error("\u2717 bun update failed");
+      process.exit(1);
+    }
+  }
+}
+var final = inspect(dir, manifest, presetFlag);
+process.exit(report(final.findings) > 0 ? 1 : 0);

package/dist/tsup.d.ts

@@ -0,0 +1,6 @@
+import { Options } from 'tsup';
+
+declare const node: (options?: Options) => Options | Options[] | ((overrideOptions: Options) => Options | Options[] | Promise<Options | Options[]>);
+declare const react: (options?: Options) => Options | Options[] | ((overrideOptions: Options) => Options | Options[] | Promise<Options | Options[]>);
+
+export { node, react };

package/dist/tsup.js

@@ -0,0 +1,23 @@
+// src/tsup.ts
+import { defineConfig } from "tsup";
+var base = {
+  entry: ["src/index.ts"],
+  format: ["cjs", "esm"],
+  dts: { compilerOptions: { ignoreDeprecations: "6.0" } },
+  splitting: false,
+  sourcemap: true,
+  clean: true
+};
+var node = (options = {}) => defineConfig({ ...base, ...options });
+var react = (options = {}) => {
+  const external = Array.isArray(options.external) ? options.external : [];
+  return defineConfig({
+    ...base,
+    ...options,
+    external: [.../* @__PURE__ */ new Set(["react", "react-dom", "react/jsx-runtime", ...external])]
+  });
+};
+export {
+  node,
+  react
+};

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@inixiative/config",
+  "version": "0.1.0",
+  "description": "Shared toolchain for the inixiative ecosystem: tsconfig/biome/tsup presets, a version manifest (BOM), and a sync/check CLI",
+  "type": "module",
+  "license": "MIT",
+  "author": "Aron Greenspan",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/inixiative/config"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "inixiative-config": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "tsconfig",
+    "biome",
+    "versions.json",
+    "README.md"
+  ],
+  "exports": {
+    "./versions.json": "./versions.json",
+    "./tsconfig/base.json": "./tsconfig/base.json",
+    "./tsconfig/node.json": "./tsconfig/node.json",
+    "./tsconfig/react.json": "./tsconfig/react.json",
+    "./biome/base.json": "./biome/base.json",
+    "./biome/react.json": "./biome/react.json",
+    "./tsup": {
+      "types": "./dist/tsup.d.ts",
+      "import": "./dist/tsup.js"
+    }
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "bun test",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check .",
+    "format": "biome format --write .",
+    "check": "bun run typecheck && bun run lint && bun run test",
+    "prepublishOnly": "bun run check && bun run build"
+  },
+  "packageManager": "bun@1.3.14",
+  "devDependencies": {
+    "@biomejs/biome": "2.5.2",
+    "@types/bun": "1.3.14",
+    "tsup": "8.5.1",
+    "typescript": "6.0.3"
+  },
+  "peerDependencies": {
+    "@biomejs/biome": ">=2.5.0",
+    "tsup": ">=8.0.0",
+    "typescript": ">=5.9.0"
+  },
+  "peerDependenciesMeta": {
+    "@biomejs/biome": {
+      "optional": true
+    },
+    "tsup": {
+      "optional": true
+    },
+    "typescript": {
+      "optional": true
+    }
+  }
+}

package/tsconfig/base.json

@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "lib": ["ESNext"],
+    "types": ["bun"],
+    "target": "ESNext",
+    "module": "ESNext",
+    "moduleDetection": "force",
+    "allowJs": true,
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "noEmit": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUnusedLocals": false,
+    "noUnusedParameters": false,
+    "noPropertyAccessFromIndexSignature": false
+  }
+}

package/tsconfig/node.json

@@ -0,0 +1,6 @@
+{
+  "extends": "./base.json",
+  "compilerOptions": {
+    "types": ["node"]
+  }
+}

package/tsconfig/react.json

@@ -0,0 +1,7 @@
+{
+  "extends": "./base.json",
+  "compilerOptions": {
+    "lib": ["ESNext", "DOM", "DOM.Iterable"],
+    "jsx": "react-jsx"
+  }
+}

package/versions.json

@@ -0,0 +1,18 @@
+{
+  "bun": "1.3.14",
+  "toolchain": {
+    "@biomejs/biome": "2.5.2",
+    "typescript": "6.0.3",
+    "tsup": "8.5.1",
+    "@types/bun": "1.3.14"
+  },
+  "required": ["@biomejs/biome", "typescript", "@types/bun"],
+  "ecosystem": {
+    "@inixiative/json-rules": "2.12.1",
+    "@inixiative/permissions": "0.3.1",
+    "@inixiative/transitions": "0.0.3",
+    "@inixiative/rules-builder": "0.13.0",
+    "@inixiative/prisma-map": "0.1.0",
+    "@inixiative/atlas": "0.1.0"
+  }
+}