@inixiative/config 0.4.2 → 0.5.1

package/README.md

@@ -60,9 +60,9 @@ bunx @inixiative/config train [root]
 
 `sync` applies every fix, re-locks via `bun install`, and runs `bun update` on stale ecosystem entries. It refuses to run on a dirty working tree without `--force`. The react preset is inferred from a `react` dependency; override with `--preset`. Missing scripts are filled with defaults; existing script bodies are never touched.
 
-`scan` runs `check` across every ecosystem checkout under a root directory. Targets are derived from the BOM's `ecosystem` keys and matched by package name, so directory names and local layout never need declaring.
+`scan` runs `check` across every ecosystem checkout under a root directory. Targets are derived from the BOM's `ecosystem` keys and matched by package name, so directory names and local layout never need declaring. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, and surfaces unmerged `claude/*` session branches.
 
-`train` is the release cascade, run from this repo's checkout. It walks the ecosystem in dependency order; per repo it: skips if dirty or behind origin → bumps ecosystem ranges to the BOM → re-locks → runs the repo's `check` → commits only its own changes (`package.json` + `bun.lock`) → publishes via `npm publish` when the local version is ahead of npm (OTP prompts pass through) → records the published version in the BOM. It never pushes; review its commits, push, then commit and publish this package so the BOM names the new state.
+`train` is the release cascade, run from this repo's checkout. Origin is the truth: it refuses to run from a config checkout behind origin or with any BOM repo missing a checkout, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It walks the ecosystem in dependency order; per repo it: bumps ecosystem ranges to the BOM → re-locks → runs the repo's `check` → commits only its own changes (`package.json` + `bun.lock`) → publishes via `npm publish` when the local version is ahead of npm (OTP prompts pass through) → records the published version in the BOM. It never pushes; review its commits, push, then commit and publish this package so the BOM names the new state.
 
 Division of labor: this CLI owns the toolchain set, ecosystem coherence, stubs, and lockfile format. Renovate owns everything else plus bumping `@inixiative/config` itself, and must be fenced off the toolchain packages.
 

package/dist/cli.js

@@ -2,7 +2,7 @@
 
 // src/cli.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { join as join2, resolve } from "path";
 
 // src/lib.ts
@@ -160,6 +160,12 @@ var discoverRepos = (root, manifest2) => {
   }
   return repos.sort((a, b) => a.name.localeCompare(b.name));
 };
+var missingRepos = (repos, manifest2) => {
+  const found = new Set(repos.map((repo) => repo.name));
+  return Object.keys(manifest2.ecosystem).filter(
+    (name) => name !== "@inixiative/config" && !found.has(name)
+  );
+};
 var detectPreset = (pkg, override) => {
   if (override) return override;
   const hasReact = DEP_FIELDS.some((field) => pkg[field]?.react !== void 0);
@@ -510,6 +516,34 @@ var report = (findings) => {
 if (process.versions.bun && process.versions.bun !== manifest.bun) {
   console.log(`\u26A0 running bun ${process.versions.bun}, blessed is ${manifest.bun} (bun upgrade)`);
 }
+var git = (cwd, ...gitArgs) => spawnSync2("git", gitArgs, { cwd, encoding: "utf8" });
+var behindOrigin = (cwd) => {
+  const behind = git(cwd, "rev-list", "--count", "HEAD..@{upstream}");
+  return behind.status === 0 ? Number(behind.stdout.trim()) : 0;
+};
+var staleCheckoutFindings = (cwd) => {
+  git(cwd, "fetch", "--quiet");
+  const behind = behindOrigin(cwd);
+  return behind > 0 ? [
+    {
+      level: "error",
+      message: `checkout is ${behind} commit${behind === 1 ? "" : "s"} behind origin \u2014 local state is stale, pull before trusting findings`
+    }
+  ] : [];
+};
+var unmergedSessionBranches = (cwd) => {
+  const branches = git(
+    cwd,
+    "branch",
+    "-r",
+    "--no-merged",
+    "@{upstream}",
+    "--list",
+    "origin/claude/*"
+  );
+  if (branches.status !== 0) return [];
+  return branches.stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+};
 if (command === "check") {
   const { findings } = inspect(dir, manifest, presetFlag);
   process.exit(report(findings) > 0 ? 1 : 0);
@@ -520,17 +554,24 @@ if (command === "scan") {
     console.error(`\u2717 no ecosystem repos found under ${dir}`);
     process.exit(1);
   }
+  const missing = missingRepos(repos, manifest);
   const drifted = [];
   for (const repo of repos) {
     console.log(`
 ${repo.name} \u2014 ${repo.dir}`);
-    if (report(inspect(repo.dir, manifest).findings) > 0) drifted.push(repo.name);
+    const findings = [...staleCheckoutFindings(repo.dir), ...inspect(repo.dir, manifest).findings];
+    if (report(findings) > 0) drifted.push(repo.name);
+    for (const branch of unmergedSessionBranches(repo.dir)) {
+      console.log(`\u26A0 unmerged session branch: ${branch}`);
+    }
   }
+  if (missing.length > 0) console.error(`
+\u2717 no checkout found for: ${missing.join(", ")}`);
   console.log(
     `
-scanned ${repos.length} repos: ${drifted.length === 0 ? "all in sync" : `${drifted.length} drifted (${drifted.join(", ")})`}`
+scanned ${repos.length} repos: ${drifted.length === 0 ? "all in sync" : `${drifted.length} drifted (${drifted.join(", ")})`}${missing.length > 0 ? `, ${missing.length} missing` : ""}`
   );
-  process.exit(drifted.length > 0 ? 1 : 0);
+  process.exit(drifted.length > 0 || missing.length > 0 ? 1 : 0);
 }
 if (command === "train") {
   const order = topoOrder(dir, manifest);
@@ -538,6 +579,18 @@ if (command === "train") {
     console.error(`\u2717 no ecosystem repos found under ${dir}`);
     process.exit(1);
   }
+  const missing = missingRepos(order, manifest);
+  if (missing.length > 0) {
+    console.error(
+      `\u2717 no checkout under ${dir} for: ${missing.join(", ")} \u2014 a partial train ships an incoherent set`
+    );
+    process.exit(1);
+  }
+  git(packageRoot, "fetch", "--quiet");
+  if (behindOrigin(packageRoot) > 0) {
+    console.error("\u2717 this config checkout is behind origin \u2014 its blessed set is stale; pull first");
+    process.exit(1);
+  }
   console.log(`train order: ${order.map((repo) => repo.name).join(" \u2192 ")}`);
   const published = [];
   const skipped = [];
@@ -559,15 +612,26 @@ if (command === "train") {
       skipped.push(repo.name);
       continue;
     }
-    spawnSync2("git", ["fetch", "--quiet"], { cwd: repo.dir });
-    const behind = spawnSync2("git", ["rev-list", "--count", "HEAD..@{upstream}"], {
-      cwd: repo.dir,
-      encoding: "utf8"
-    });
-    if (behind.status === 0 && Number(behind.stdout.trim()) > 0) {
-      console.log("\u26A0 behind origin \u2014 pull first, skipping");
-      skipped.push(repo.name);
-      continue;
+    git(repo.dir, "fetch", "--quiet");
+    for (const branch of unmergedSessionBranches(repo.dir)) {
+      console.log(`\u26A0 unmerged session branch: ${branch} \u2014 a bump may be hiding there`);
+    }
+    const behind = behindOrigin(repo.dir);
+    if (behind > 0) {
+      const localOnly = git(repo.dir, "rev-list", "--count", "@{upstream}..HEAD");
+      if (localOnly.status === 0 && Number(localOnly.stdout.trim()) > 0) {
+        console.log("\u26A0 diverged from origin \u2014 reconcile first, skipping");
+        skipped.push(repo.name);
+        continue;
+      }
+      const ff = git(repo.dir, "merge", "--ff-only", "@{upstream}");
+      if (ff.status !== 0) {
+        console.log("\u26A0 fast-forward to origin failed \u2014 reconcile first, skipping");
+        skipped.push(repo.name);
+        continue;
+      }
+      console.log(`\u2193 fast-forwarded to origin (+${behind})`);
+      repo.pkg = JSON.parse(readFileSync2(join2(repo.dir, "package.json"), "utf8"));
     }
     const inspection = inspect(repo.dir, manifest);
     const bumps = inspection.findings.filter((finding) => finding.kind === "ecosystem-range");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/config",
-  "version": "0.4.2",
+  "version": "0.5.1",
   "description": "Shared toolchain for the inixiative ecosystem: tsconfig/biome/tsup presets, a version manifest (BOM), and a sync/check CLI",
   "type": "module",
   "license": "MIT",

package/versions.json

@@ -13,8 +13,8 @@
     "@types/bun"
   ],
   "ecosystem": {
-    "@inixiative/config": "0.4.2",
-    "@inixiative/json-rules": "2.14.1",
+    "@inixiative/config": "0.5.1",
+    "@inixiative/json-rules": "2.15.0",
     "@inixiative/permissions": "0.3.2",
     "@inixiative/transitions": "0.1.0",
     "@inixiative/rules-builder": "0.15.0",