@inixiative/config 0.5.184 → 0.5.186

package/README.md

@@ -1,6 +1,8 @@
 # @inixiative/config
 
-Shared toolchain for the inixiative ecosystem: tsconfig/biome/tsup presets, a version manifest (BOM), and a `sync`/`check` CLI that enforces both.
+> One of the [inixiative](https://www.inixiative.com) building blocks. Stop rediscovering what you need to build. See [all the projects](https://github.com/inixiative).
+
+The shared toolchain and theme for the inixiative packages: tsconfig, Biome and tsup presets, the brand theme CSS, a version manifest (BOM), and a CLI. One `@inixiative/config` version names one set of `@inixiative/*` versions released and checked together. `check` fails CI when a repo drifts from that set (toolchain pins, ranges, a lockfile that resolves to another version), `sync` fixes the drift, and `train` publishes the packages in dependency order.
 
 ## Presets
 
@@ -37,16 +39,16 @@ Apps load the theme from this package at runtime, so it is a runtime `dependency
 
 ## versions.json (the BOM)
 
-One version of `@inixiative/config` names one coherent ecosystem state:
+One version of `@inixiative/config` names one coherent state of the inixiative packages:
 
-- `bun` — blessed runtime, written to `.bun-version` and `packageManager`
-- `toolchain` — exact pins for `@biomejs/biome`, `typescript`, `tsup`, `@types/bun`
-- `required` — toolchain packages every repo must carry
-- `ecosystem` — the primitives lane's blessed, mutually-verified `@inixiative/*` set, plus this package
-- `agentic` — the agentic lane's blessed set
-- `consumers` — private repos that follow the blessed sets but never publish, keyed by GitHub `owner/repo`: `lanes` names the lanes each consumes, `upstream` the repo it syncs from
-- `candidates` — published lane versions newer than their blessed one, waiting for every dependent to adopt them (see `train`); absent when there are none
-- `holds` — lane packages kept below a version, keyed by package (see Holds below); absent when there are none
+- `bun`: blessed runtime, written to `.bun-version` and `packageManager`
+- `toolchain`: exact pins for `@biomejs/biome`, `typescript`, `tsup`, `@types/bun`
+- `required`: toolchain packages every repo must carry
+- `ecosystem`: the primitives lane's blessed, mutually-verified `@inixiative/*` set, plus this package
+- `agentic`: the agentic lane's blessed set
+- `consumers`: private repos that follow the blessed sets but never publish, keyed by GitHub `owner/repo`: `lanes` names the lanes each consumes, `upstream` the repo it syncs from
+- `candidates`: published lane versions newer than their blessed one, waiting for every dependent to adopt them (see `train`); absent when there are none
+- `holds`: lane packages kept below a version, keyed by package (see Holds below); absent when there are none
 
 ```jsonc
 "consumers": {
@@ -71,29 +73,49 @@ bunx @inixiative/config sync  [dir] [--preset=...] [--force] [--no-install]
 bunx @inixiative/config scan  [root] [--lane=primitives|agentic]
 bunx @inixiative/config train [root] [--lane=primitives|agentic] [--push] [--dry-run]
 bunx @inixiative/config ports [project]
+bunx @inixiative/config terms [dir] [--write-baseline]
 ```
 
 `ports` prints each project's local ports from `ports.json` (also exported as `@inixiative/config/ports.json`). A project's port for a service is the service's usual default plus 100 times the project's block, so no two projects collide. Zealot alone sits at block 0, the defaults (Aron, 2026-10-20: it already runs there); every other project is off the defaults: Archive (block 7) serves HTTP on 4700 with Postgres on 6132; Kingdom (block 2) has web 3200, API 8200, Postgres 5632, Redis 6579. Reserved ports (macOS AirPlay on 5000 and 7000) are never assigned. Give a new project the next free block (never 0), and a new kind of service its usual default; the tests fail on any collision.
 
-`check` is read-only and exits non-zero on drift — run it in CI after a frozen-lockfile install. It verifies toolchain pins — declared once, at the root, pinned exactly: a workspace member declaring one is an error, and `bun.lock` must resolve each only to its pin (no second copy) — toolchain peer ranges (they must admit the pin and no older major; `sync` writes `>=<pin major>.<pin minor>.0`), `"latest"` ranges, `packageManager`/`.bun-version`, legacy `bun.lockb`, a committed (tracked, un-ignored) `bun.lock`, a gitignored `tmp/` (scratch space; `sync` adds `/tmp/*`, which keeps re-included files tracked), required scripts (`check`/`typecheck`/`lint`/`test`), lefthook (dep + `lefthook.yml` extending the shared hooks + `prepare` script; git repos only), stub `extends`, presence of this package, and for every ecosystem dependency — in the root or any workspace member, of either lane — that the declared range admits the blessed version and the lockfile actually resolves to it (the stale-lockfile class). A package with a candidate (one no hold covers) also accepts the candidate and anything between: a range admitting either passes, and so does a lock from the blessed version up to the candidate. A range that does not admit the blessed version is rewritten to `^<blessed>`, except an exact pin, which stays exact and moves to the blessed version. An npm alias (`"@inixiative/session-archive": "npm:@inixiative/archive@^0.2.1"`) is held to its target's blessed version and rewritten as an alias; `workspace:`, `file:` and `link:` ranges are a repo linking itself and are left alone.
+`check` is read-only and exits non-zero on drift; run it in CI after a frozen-lockfile install. It verifies toolchain pins (declared once, at the root, pinned exactly: a workspace member declaring one is an error, and `bun.lock` must resolve each only to its pin, with no second copy), toolchain peer ranges (they must admit the pin and no older major; `sync` writes `>=<pin major>.<pin minor>.0`), `"latest"` ranges, `packageManager`/`.bun-version`, legacy `bun.lockb`, a committed (tracked, un-ignored) `bun.lock`, a gitignored `tmp/` (scratch space; `sync` adds `/tmp/*`, which keeps re-included files tracked), required scripts (`check`/`typecheck`/`lint`/`test`), lefthook (dep + `lefthook.yml` extending the shared hooks + `prepare` script; git repos only), stub `extends`, presence of this package, and for every `@inixiative/*` dependency (in the root or any workspace member, of either lane) that the declared range admits the blessed version and the lockfile resolves to it (the stale-lockfile class). A package with a candidate (one no hold covers) also accepts the candidate and anything between: a range admitting either passes, and so does a lock from the blessed version up to the candidate. A range that does not admit the blessed version is rewritten to `^<blessed>`, except an exact pin, which stays exact and moves to the blessed version. An npm alias (`"@inixiative/session-archive": "npm:@inixiative/archive@^0.2.1"`) is held to its target's blessed version and rewritten as an alias; `workspace:`, `file:` and `link:` ranges are a repo linking itself and are left alone.
+
+`check` also runs the **retired-terms** rule (alone: `terms`), which keeps public copy from rotting back to names the project retired. It reads text people read, never code identifiers: every Markdown, MDX, HTML and Astro file a repo tracks, and each `package.json` `description`. Fixtures, changelogs (history records the rename), `node_modules`, generated Warden regions (`.foundry/regions/`; fix their source docs) and root `dist`, `build`, `coverage` and `tmp` are skipped. The rule runs in `check` and `terms` only; `scan`, `sync` and the train are about package drift and don't run it. The list lives in `src/retiredTerms.ts`, each term with the word to use instead, and comes from the workspace CLAUDE.md "Dead concepts" and the copy brief's "Retired words":
+
+| Term | Checked in | Use instead |
+| --- | --- | --- |
+| Kastle, Castle (capitalised) | every doc | Kingdom, owner, integration or Signet |
+| `RuntimeInstallation`, `kingdom_runtime_` | every doc | a Signet enrollment |
+| `signetDemo`, `medicalQuestionStep` | every doc | nothing; demos live in template-workbench |
+| `kingdom-workspace`, `foundry-lab`, `native-candidate` | every doc | the canonical repos |
+| foundry-oracle | every doc | Foundry and Oracle, two products |
+| "your own LLM/API keys" | every doc | your own subscriptions |
+| Cartographer, Librarian, Artificer, Steward (capitalised) | READMEs, package descriptions, site pages only | say what it does; Foundry's code still has a Librarian and a Cartographer |
+
+Left out on purpose, because a pattern would flag mostly legitimate text: "medical" (the doctor's-visit story is allowed in marketing), "Connection" and `connectionId` (WebSocket and database connections; Foundry's viewer has a live per-socket `connectionId`), "principal" (the permissions README's glossary word for any holder, job titles, the principal–agent problem), and "Cursor as a runtime" or "token savings" (a phrase can't tell a claim from a comparison).
+
+Per repo, in `scripts/ci/retired-terms/` (the same shape as template's doc-freshness rule):
+
+- `allow.txt` for legitimate uses: `<term>` allows it everywhere, `<path>\t<term>` in one file, or under a directory when the path ends in `/` (a retired-names table, a history doc). Stale copy never goes here.
+- `baseline.txt` for uses that predate the rule, `<path>\t<term>\t<count>`: reported as one warning, not failed. A use beyond the count fails, and so does a count that dropped (lower or delete the line), so the baseline only shrinks. `terms --write-baseline` writes it when there is none, and later only to shrink it: it refuses to add a use.
 
-`sync` applies every fix (deleting member toolchain entries and their stale member links), re-locks via `bun install` (`--force` when a second toolchain copy survives), and runs `bun update` on stale ecosystem entries in the directory that declares them. It refuses to run on a dirty working tree without `--force`. The react preset is inferred from a `react` dependency; override with `--preset`. Missing scripts are filled with defaults; existing script bodies are never touched.
+`sync` applies every fix (deleting member toolchain entries and their stale member links), re-locks via `bun install` (`--force` when a second toolchain copy survives), and runs `bun update` on stale `@inixiative/*` entries in the directory that declares them. It refuses to run on a dirty working tree without `--force`. The react preset is inferred from a `react` dependency; override with `--preset`. Missing scripts are filled with defaults; existing script bodies are never touched.
 
-`scan` runs `check` across every ecosystem checkout under a root directory, for every lane or just the one `--lane` names. Targets are derived from the BOM: lane packages match by package name — the root package or any workspace member, so a monorepo such as foundry is found by the packages it publishes — and consumers match by their `origin` GitHub repo. Directory names and local layout never need declaring: scan looks at each child of the root and one level into a child without a `package.json` (a workspace folder such as `team-workspace/`). Linked git worktrees are other sessions' branches and never targets; when several clones claim one package or repo, only those with an `origin` remote count, a clone directly under the root wins over one nested in a workspace folder, and if that still leaves more than one the target is reported ambiguous rather than guessed. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, warns when a checkout sits on a non-default branch (its findings describe the branch, not what ships), and surfaces unmerged `claude/*` session branches.
+`scan` runs `check` across every inixiative checkout under a root directory, for every lane or just the one `--lane` names. Targets are derived from the BOM: lane packages match by package name (the root package or any workspace member, so a monorepo such as foundry is found by the packages it publishes), and consumers match by their `origin` GitHub repo. Directory names and local layout never need declaring: scan looks at each child of the root and one level into a child without a `package.json` (a workspace folder such as `team-workspace/`). Linked git worktrees are other sessions' branches and never targets; when several clones claim one package or repo, only those with an `origin` remote count, a clone directly under the root wins over one nested in a workspace folder, and if that still leaves more than one the target is reported ambiguous rather than guessed. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, warns when a checkout sits on a non-default branch (its findings describe the branch, not what ships), and lists unmerged `claude/*` session branches.
 
-`train` is the release cascade, run from a git checkout of this repo; it refuses to train from a copy that isn't one (a bunx or npm cache). One train at a time per machine: it takes one machine-wide lock, `~/.inixiative/train.lock`, shared by every clone, worktree and lane, and refuses to start while another train holds it, naming the holder and the lock path. The lock is created atomically and records the holder's pid, hostname and process start time. A lock is stale, and taken over, when its process is gone, its pid now belongs to a different process, or the file can't be parsed. A lock from another host is never judged stale; if its train is truly gone, delete the file. The lock is released on exit and on SIGINT, SIGTERM or SIGHUP. `--dry-run` takes no lock. It walks every lane in order (primitives, then agentic), or only the lane `--lane` names. Origin is the truth: it refuses to run from a config checkout behind origin, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It only ships the default branch: a checkout on a feature branch is skipped whole — never re-locked, committed to, or published from.
+`train` is the release cascade, run from a git checkout of this repo; it refuses to train from a copy that isn't one (a bunx or npm cache). One train at a time per machine: it takes one machine-wide lock, `~/.inixiative/train.lock`, shared by every clone, worktree and lane, and refuses to start while another train holds it, naming the holder and the lock path. The lock is created atomically and records the holder's pid, hostname and process start time. A lock is stale, and taken over, when its process is gone, its pid now belongs to a different process, or the file can't be parsed. A lock from another host is never judged stale; if its train is gone, delete the file. The lock is released on exit and on SIGINT, SIGTERM or SIGHUP. `--dry-run` takes no lock. It walks every lane in order (primitives, then agentic), or only the lane `--lane` names. Origin is the truth: it refuses to run from a config checkout behind origin, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It only ships the default branch: a checkout on a feature branch is skipped whole: never re-locked, committed to, or published from.
 
-Lanes stand alone. A lane with a package missing a checkout, or claimed by ambiguous checkouts, does not run; a lane whose own check (not one against candidates, below), commit or publish fails stops there: what it already published stays a candidate, and none of its candidates is blessed that run. Neither holds back the other lane. Within a lane it walks checkouts in dependency order; per checkout it: bumps ecosystem ranges to the blessed sets with their candidates in place → re-locks → runs the repo's `check` → commits only its own changes (`package.json` files + `bun.lock`) → publishes each lane package whose local version is ahead of npm, in dependency order, and waits until the registry serves it (up to 15 minutes, since npm holds new versions for processing) → records it as a candidate in the BOM.
+Lanes stand alone. A lane with a package missing a checkout, or claimed by ambiguous checkouts, does not run; a lane whose own check (not one against candidates, below), commit or publish fails stops there: what it already published stays a candidate, and none of its candidates is blessed that run. Neither holds back the other lane. Within a lane it walks checkouts in dependency order; per checkout it: bumps `@inixiative/*` ranges to the blessed sets with their candidates in place → re-locks → runs the repo's `check` → commits only its own changes (`package.json` files + `bun.lock`) → publishes each lane package whose local version is ahead of npm, in dependency order, and waits until the registry serves it (up to 15 minutes, since npm holds new versions for processing) → records it as a candidate in the BOM.
 
 Blessing is two-phase, so a dependent that needs work never deadlocks a release:
 
 1. **Candidate.** A published version is recorded under `candidates`, and the config release that ends the train carries it, so `check` in any repo's CI accepts it from then on.
 2. **Adopt.** A repo (lane checkout or consumer) whose check fails against the candidates it was moved onto doesn't stop the train. Its checkout is put back as it was, and the train opens `train/adopt-<pkg>-<version>` in a worktree (the repo's own `worktree:create <base> <branch>` when it declares one, so a template-based repo gets its slot's databases, released with its `worktree:destroy`; otherwise a temporary linked worktree; either way with the repo's ignored `.env*` files copied in where missing): the same bump and re-lock, then the repo's `train:adopt` script if its package.json declares one (Foundry's re-records cassettes with `bun run test:live`), all committed, and re-locked onto the new config release so the PR's CI judges it against the candidates. A lane checkout that adopts publishes nothing this run. A consumer that passes against candidates gets the same branch name: its default branch is still on the previous versions until the branch merges. If the adoption's commit is refused (its hooks typecheck), the branch is deleted and the summary says to adopt by hand.
-3. **Promote.** At the end of each run a candidate is blessed (moved into its lane's section) unless something holds it: its lane stopped; a repo has an adoption branch for it that is not yet on its default branch (opened this run, unmerged, or committed but never pushed); or a repo that declares it was not walked to an outcome this run — another lane's checkout, a skipped or failed one, a consumer without a checkout. A later train finds a waiting adoption branch and opens nothing new; once it merges, the repo is on the candidate and the train promotes it. A candidate every dependent already accepts is blessed in the run that published it. An adoption PR closed without merging holds its candidates until its branch is deleted.
+3. **Promote.** At the end of each run a candidate is blessed (moved into its lane's section) unless something holds it: its lane stopped; a repo has an adoption branch for it that is not yet on its default branch (opened this run, unmerged, or committed but never pushed); or a repo that declares it was not walked to an outcome this run (another lane's checkout, a skipped or failed one, a consumer without a checkout). A later train finds a waiting adoption branch and opens nothing new; once it merges, the repo is on the candidate and the train promotes it. A candidate every dependent already accepts is blessed in the run that published it. An adoption PR closed without merging holds its candidates until its branch is deleted.
 
 The summary lists what was blessed, every candidate with what holds it, every hold with its reason, and each pending adoption branch with its PR when `gh` can find one.
 
-**Holds.** A hold keeps a package's breaking line out of the ecosystem while its dependents can't take it yet (signet 0.12 waiting on Kingdom's grants cutover), without stopping the package's own releases or anyone else's:
+**Holds.** A hold keeps a package's breaking line out of the blessed set while its dependents can't take it yet (signet 0.12 waiting on Kingdom's grants cutover), without stopping the package's own releases or anyone else's:
 
 ```jsonc
 "holds": {
@@ -115,7 +137,7 @@ Every version at or above `below` is held; versions below it ride the train as u
 
 `scan` and the train's summary print each hold with its reason, and name a held candidate as not applied. Lifting a hold is deleting its entry: the next train records the held version found on npm at the local version (or applies the held candidate) and adopts it like any other.
 
-A root package publishes with `npm publish`; a workspace member is packed with `bun pm pack`, which rewrites `workspace:` ranges to the versions being released, and the tarball is published with `npm publish`, so OTP prompts pass through either way. A package already on npm at its local version but neither blessed nor a candidate — published by hand, or by a train whose lane later failed — becomes a candidate on the next run, unless a hold covers that version. Likewise, an `@inixiative/config` version committed ahead of npm (a release whose publish failed) is published by the next run, even when it blesses nothing new.
+A root package publishes with `npm publish`; a workspace member is packed with `bun pm pack`, which rewrites `workspace:` ranges to the versions being released, and the tarball is published with `npm publish`, so OTP prompts pass through either way. A package already on npm at its local version but neither blessed nor a candidate (published by hand, or by a train whose lane later failed) becomes a candidate on the next run, unless a hold covers that version. Likewise, an `@inixiative/config` version committed ahead of npm (a release whose publish failed) is published by the next run, even when it blesses nothing new.
 
 Consumers run once, after every selected lane, upstreams first, against the full blessed set: a consumer of both lanes ends coherent with both whichever lane ran. They get the same bump → re-lock → `check`, never a publish, and their changes go through review: the train commits them on a `train/ecosystem-sync-<date>` branch, in a worktree, and puts the checkout back on its default branch, clean.
 
@@ -125,7 +147,7 @@ When anything was recorded or blessed it then ships this package last, so the BO
 
 Each command accepts only its own flags. An unknown or misplaced flag (`--dryrun`, `--push` on `sync`) is a usage error and exits 2 before anything runs.
 
-Division of labor: this CLI owns the toolchain set, ecosystem coherence, stubs, and lockfile format. Renovate owns everything else plus bumping `@inixiative/config` itself, and must be fenced off the toolchain packages.
+Division of labor: this CLI owns the toolchain set, `@inixiative/*` version coherence, stubs, and lockfile format. Renovate owns everything else plus bumping `@inixiative/config` itself, and must be fenced off the toolchain packages.
 
 ## CI
 
@@ -142,13 +164,13 @@ jobs:
     uses: inixiative/config/.github/workflows/lib-ci.yml@main
 ```
 
-`lib-ci.yml` pins bun from `.bun-version`, installs with `--frozen-lockfile` (kills the stale-lockfile class), runs `inixiative-config check .`, then the repo's own `bun run check`.
+`lib-ci.yml` pins bun from `.bun-version`, installs with `--frozen-lockfile` (kills the stale-lockfile class), runs `inixiative-config check .` (retired terms included), then the repo's own `bun run check`. A repo that doesn't use `lib-ci.yml` (template, Kingdom, Oracle, agent-session, gloss, Tribe) adopts the retired-terms rule by running `bunx inixiative-config terms .` from its own CI rules (template: a `scripts/ci/rules/retired-terms.sh` beside `doc-freshness.sh`).
 
 ## Release flow
 
 Two lanes, each publishing in dependency order, with config last:
 
-- **primitives** — for example json-rules → permissions → transitions → rules-builder, plus prisma-map, atlas and gloss. Consumers: template, kingdom.
-- **agentic** — signet, kcp (the Kingdom CLI proxy, on signet), archive and agent-session, then foundry-core → foundry (foundry depends on archive), built on the primitives' blessed set. foundry-core and foundry publish from the foundry monorepo's `packages/core` and `packages/foundry`. Consumers: oracle (a private leaf), kingdom.
+- **primitives:** for example json-rules → permissions → transitions → rules-builder, plus prisma-map, atlas and gloss. Consumers: template, kingdom.
+- **agentic:** signet, kcp (the Kingdom CLI proxy, on signet), archive and agent-session, then foundry-core → foundry → foundry-acp (foundry depends on archive), built on the primitives' blessed set. foundry-core, foundry and foundry-acp publish from the foundry monorepo's `packages/core`, `packages/foundry` and `packages/acp`. Consumers: oracle (a private leaf), kingdom.
 
 A release is `train` (or `train --lane=agentic` to leave the primitives alone): bump the package's version on its default branch, then run the train. `train` automates the whole walk, this package and the consumer PRs included. Downstream repos pick up toolchain changes via `sync`.

package/dist/cli.js

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import {
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync3,
   mkdtempSync,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync2,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync2
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync3,
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync3
 } from "fs";
 import { hostname as hostname2, tmpdir } from "os";
-import { basename, dirname as dirname2, join as join2, resolve as resolve2 } from "path";
+import { basename, dirname as dirname3, join as join3, resolve as resolve2 } from "path";
 
 // src/args.ts
 import { parseArgs } from "util";
@@ -999,7 +999,7 @@ var isConfigCheckout = (dir2) => {
 };
 
 // src/args.ts
-var COMMANDS = ["check", "sync", "scan", "train", "ports"];
+var COMMANDS = ["check", "sync", "scan", "train", "ports", "terms"];
 var PRESETS = ["base", "node", "react"];
 var preset = { type: "string" };
 var lane = { type: "string" };
@@ -1009,7 +1009,8 @@ var OPTIONS = {
   sync: { preset, force: flag, "no-install": flag },
   scan: { lane },
   train: { lane, push: flag, "dry-run": flag },
-  ports: {}
+  ports: {},
+  terms: { "write-baseline": flag }
 };
 var UsageError = class extends Error {
 };
@@ -1057,7 +1058,8 @@ var parseCommandLine = (argv) => {
     force: values.force === true,
     noInstall: values["no-install"] === true,
     push: values.push === true,
-    dryRun: values["dry-run"] === true
+    dryRun: values["dry-run"] === true,
+    writeBaseline: values["write-baseline"] === true
   };
 };
 
@@ -1103,6 +1105,238 @@ function portsFor(project) {
   );
 }
 
+// src/retiredTerms.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import {
+  existsSync as existsSync2,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync2,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+var RETIRED_TERMS = [
+  {
+    id: "kastle",
+    pattern: /\bkastles?\b/gi,
+    scope: "docs",
+    instead: "Kingdom, owner, integration or Signet"
+  },
+  {
+    id: "castle",
+    pattern: /\bCastles?\b/g,
+    scope: "docs",
+    instead: "Kingdom, owner, integration or Signet"
+  },
+  {
+    id: "runtime-keys",
+    pattern: /\bRuntimeInstallations?\b|\bkingdom_runtime_/g,
+    scope: "docs",
+    instead: "a Signet enrollment on the Foundry integration"
+  },
+  {
+    id: "medical-demo",
+    pattern: /\bsignetDemo\b|\bmedicalQuestionStep\b/g,
+    scope: "docs",
+    instead: "nothing: the demo is gone (demos live in template-workbench)"
+  },
+  {
+    id: "retired-workspaces",
+    pattern: /\bkingdom-workspace\b|\bfoundry-lab\b|\bnative-candidate\b/g,
+    scope: "docs",
+    instead: "the canonical repos (kingdom, foundry)"
+  },
+  {
+    id: "foundry-oracle",
+    pattern: /\bfoundry-oracle\b/gi,
+    scope: "docs",
+    instead: "Foundry and Oracle, two products"
+  },
+  {
+    id: "own-llm-keys",
+    pattern: /\byour own (?:LLM|model|API) keys?\b/gi,
+    scope: "docs",
+    instead: "your own subscriptions (Foundry runs on subscription logins)"
+  },
+  {
+    id: "foundry-roles",
+    pattern: /\b(?:Cartographer|Librarian|Artificer|Steward)s?\b/g,
+    scope: "public",
+    instead: "say what it does: Wardens point at what exists; your agent decides"
+  }
+];
+var RETIRED_TERMS_DIR = "scripts/ci/retired-terms";
+var ALLOW_FILE = `${RETIRED_TERMS_DIR}/allow.txt`;
+var BASELINE_FILE = `${RETIRED_TERMS_DIR}/baseline.txt`;
+var TEXT_FILE = /\.(md|mdx|html|astro)$/i;
+var PUBLIC_FILE = /(^|\/)README[^/]*\.md$|\.(html|astro|mdx)$/i;
+var SKIPPED = /(^|\/)(node_modules|\.git|\.worktrees|fixtures|rule-violations)\/|^(dist|build|coverage|tmp)\/|^\.foundry\/regions\/|(^|\/)CHANGELOG[^/]*\.md$/i;
+var walk = (root, dir2 = "", out = []) => {
+  for (const entry of readdirSync2(join2(root, dir2), { withFileTypes: true })) {
+    const rel = dir2 ? `${dir2}/${entry.name}` : entry.name;
+    if (entry.isDirectory() && !SKIPPED.test(`${rel}/`)) walk(root, rel, out);
+    else if (entry.isFile()) out.push(rel);
+  }
+  return out;
+};
+var readText = (abs) => {
+  try {
+    return lstatSync(abs).isFile() ? readFileSync2(abs, "utf8") : null;
+  } catch {
+    return null;
+  }
+};
+var listFiles = (root) => {
+  if (existsSync2(join2(root, ".git"))) {
+    const listed = spawnSync2(
+      "git",
+      ["ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+      {
+        cwd: root,
+        encoding: "utf8"
+      }
+    );
+    if (listed.status === 0) return listed.stdout.split("\0").filter(Boolean);
+  }
+  return walk(root);
+};
+var lineOf = (text, index) => text.slice(0, index).split("\n").length;
+var scanRetiredTerms = (root) => {
+  const hits = [];
+  for (const path of listFiles(root).sort()) {
+    if (SKIPPED.test(path) || path.startsWith(`${RETIRED_TERMS_DIR}/`)) continue;
+    const isManifest = /(^|\/)package\.json$/.test(path);
+    if (!isManifest && !TEXT_FILE.test(path)) continue;
+    const raw = readText(join2(root, path));
+    if (raw === null) continue;
+    let text = raw;
+    if (isManifest) {
+      try {
+        const description = JSON.parse(raw).description;
+        if (typeof description !== "string") continue;
+        text = description;
+      } catch {
+        continue;
+      }
+    }
+    const isPublic = isManifest || PUBLIC_FILE.test(path);
+    for (const term of RETIRED_TERMS) {
+      if (term.scope === "public" && !isPublic) continue;
+      for (const match of text.matchAll(term.pattern)) {
+        hits.push({
+          path,
+          line: isManifest ? lineOf(raw, raw.indexOf('"description"')) : lineOf(text, match.index),
+          term,
+          text: match[0]
+        });
+      }
+    }
+  }
+  return hits;
+};
+var readList = (root, file) => {
+  const abs = join2(root, file);
+  if (!existsSync2(abs)) return [];
+  return readFileSync2(abs, "utf8").split("\n").map((line) => line.trimEnd()).filter((line) => line.trim() !== "" && !line.trimStart().startsWith("#"));
+};
+var allowedBy = (lines) => {
+  const rules = lines.map((line) => {
+    const [first2, second] = line.split("	");
+    return second === void 0 ? { path: "", term: first2.trim() } : { path: first2, term: second.trim() };
+  });
+  return (hit) => rules.some(
+    (rule) => rule.term === hit.term.id && (rule.path === "" || rule.path === hit.path || rule.path.endsWith("/") && hit.path.startsWith(rule.path))
+  );
+};
+var countByKey = (hits) => {
+  const counts = /* @__PURE__ */ new Map();
+  for (const hit of hits) {
+    const key = `${hit.path}	${hit.term.id}`;
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+  }
+  return counts;
+};
+var BASELINE_LINE = /^([^\t]+)\t([^\t]+)\t(\d+)$/;
+var readBaseline = (root) => {
+  const counts = /* @__PURE__ */ new Map();
+  const malformed = [];
+  for (const line of readList(root, BASELINE_FILE)) {
+    const match = BASELINE_LINE.exec(line);
+    if (match) counts.set(`${match[1]}	${match[2]}`, Number(match[3]));
+    else malformed.push(line);
+  }
+  return { counts, malformed };
+};
+var checkRetiredTerms = (root) => {
+  const allowed = allowedBy(readList(root, ALLOW_FILE));
+  const hits = scanRetiredTerms(root).filter((hit) => !allowed(hit));
+  const counts = countByKey(hits);
+  const { counts: baseline, malformed } = readBaseline(root);
+  const findings = malformed.map((line) => ({
+    level: "error",
+    message: `${BASELINE_FILE}: "${line}" is not <path>\\t<term>\\t<count> \u2192 rewrite it with terms --write-baseline`
+  }));
+  for (const [key, count] of counts) {
+    const known = baseline.get(key) ?? 0;
+    if (count <= known) continue;
+    const fresh = hits.filter((hit) => `${hit.path}	${hit.term.id}` === key).slice(known);
+    for (const hit of fresh) {
+      findings.push({
+        level: "error",
+        message: `retired term in ${hit.path}:${hit.line}: "${hit.text}" (${hit.term.id}) \u2192 ${hit.term.instead}`
+      });
+    }
+  }
+  for (const [key, known] of baseline) {
+    const count = counts.get(key) ?? 0;
+    if (count >= known) continue;
+    const [path, term] = key.split("	");
+    findings.push({
+      level: "error",
+      message: count === 0 ? `${BASELINE_FILE}: ${path} no longer uses ${term} \u2192 delete its line` : `${BASELINE_FILE}: ${path} uses ${term} ${count}\xD7 now, not ${known} \u2192 lower its count`
+    });
+  }
+  const baselined = [...counts].reduce(
+    (sum, [key, count]) => sum + Math.min(count, baseline.get(key) ?? 0),
+    0
+  );
+  if (baselined > 0) {
+    findings.push({
+      level: "warn",
+      message: `${baselined} retired-term use${baselined === 1 ? "" : "s"} in ${BASELINE_FILE} (not blocking; fix the copy and shrink the baseline)`
+    });
+  }
+  return { findings, hits };
+};
+var writeRetiredTermsBaseline = (root) => {
+  const allowed = allowedBy(readList(root, ALLOW_FILE));
+  const counts = countByKey(scanRetiredTerms(root).filter((hit) => !allowed(hit)));
+  const path = join2(root, BASELINE_FILE);
+  if (existsSync2(path)) {
+    const { counts: baseline } = readBaseline(root);
+    const refused = [...counts].filter(([key, count]) => count > (baseline.get(key) ?? 0)).map(
+      ([key, count]) => `${key.replace("	", " ")} ${count}\xD7 (baseline ${baseline.get(key) ?? 0})`
+    );
+    if (refused.length > 0) return { written: 0, refused };
+  }
+  const header = [
+    "# Retired-term uses that predate the rule: reported, not failed (@inixiative/config check).",
+    "# One per line: <path>\\t<term>\\t<count>. Fix the copy and lower or delete its line.",
+    "# Rewrite after fixing: inixiative-config terms --write-baseline (it refuses to grow)."
+  ];
+  const lines = [...counts].sort(([a], [b]) => a.localeCompare(b)).map(([key, n]) => `${key}	${n}`);
+  if (lines.length === 0) {
+    rmSync2(path, { force: true });
+    return { written: 0, refused: [] };
+  }
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, `${[...header, ...lines].join("\n")}
+`);
+  return { written: lines.length, refused: [] };
+};
+
 // src/cli.ts
 var commandLine;
 try {
@@ -1111,7 +1345,7 @@ try {
   if (!(error instanceof UsageError)) throw error;
   console.error(`\u2717 ${error.message}`);
   console.error(
-    "Usage: inixiative-config check [dir] [--preset=base|node|react]\n       inixiative-config sync [dir] [--preset=base|node|react] [--force] [--no-install]\n       inixiative-config scan [root] [--lane=primitives|agentic]\n       inixiative-config train [root] [--lane=primitives|agentic] [--push] [--dry-run]\n       inixiative-config ports [project]"
+    "Usage: inixiative-config check [dir] [--preset=base|node|react]\n       inixiative-config sync [dir] [--preset=base|node|react] [--force] [--no-install]\n       inixiative-config scan [root] [--lane=primitives|agentic]\n       inixiative-config train [root] [--lane=primitives|agentic] [--push] [--dry-run]\n       inixiative-config ports [project]\n       inixiative-config terms [dir] [--write-baseline]"
   );
   process.exit(2);
 }
@@ -1145,7 +1379,7 @@ var report = (findings) => {
 if (process.versions.bun && process.versions.bun !== manifest.bun) {
   console.log(`\u26A0 running bun ${process.versions.bun}, blessed is ${manifest.bun} (bun upgrade)`);
 }
-var git = (cwd, ...gitArgs) => spawnSync2("git", gitArgs, { cwd, encoding: "utf8" });
+var git = (cwd, ...gitArgs) => spawnSync3("git", gitArgs, { cwd, encoding: "utf8" });
 var behindOrigin = (cwd) => {
   const behind = git(cwd, "rev-list", "--count", "HEAD..@{upstream}");
   return behind.status === 0 ? Number(behind.stdout.trim()) : 0;
@@ -1183,7 +1417,20 @@ var offDefaultBranch = (cwd) => {
 };
 if (command === "check") {
   const { findings } = inspect(dir, manifest, presetFlag);
-  process.exit(report(findings) > 0 ? 1 : 0);
+  process.exit(report([...findings, ...checkRetiredTerms(dir).findings]) > 0 ? 1 : 0);
+}
+if (command === "terms") {
+  if (commandLine.writeBaseline) {
+    const { written, refused } = writeRetiredTermsBaseline(dir);
+    if (refused.length > 0) {
+      console.error("\u2717 the baseline only shrinks; fix these uses (or allow a legitimate one):");
+      for (const entry of refused) console.error(`  ${entry}`);
+      process.exit(1);
+    }
+    console.log(`wrote ${written} baseline entr${written === 1 ? "y" : "ies"}`);
+    process.exit(0);
+  }
+  process.exit(report(checkRetiredTerms(dir).findings) > 0 ? 1 : 0);
 }
 var laneLabel = (checkout) => checkout.consumer ? `consumer of ${checkout.consumer.lanes.join(" + ")}` : `${checkout.lane} lane`;
 if (command === "scan") {
@@ -1306,7 +1553,7 @@ if (command === "train") {
   const worktrees = [];
   const removeWorktree = ({ repo, path, tooling }) => {
     if (tooling) {
-      spawnSync2("bun", ["run", "worktree:destroy", basename(path), "--force"], {
+      spawnSync3("bun", ["run", "worktree:destroy", basename(path), "--force"], {
         cwd: repo,
         stdio: "inherit"
       });
@@ -1355,7 +1602,7 @@ if (command === "train") {
       }
       if (!dryRun) {
         console.log(`\u2193 fast-forwarded to origin (+${behind})`);
-        checkout.pkg = JSON.parse(readFileSync2(join2(checkout.dir, "package.json"), "utf8"));
+        checkout.pkg = JSON.parse(readFileSync3(join3(checkout.dir, "package.json"), "utf8"));
       }
     }
     return true;
@@ -1381,7 +1628,7 @@ if (command === "train") {
     };
   };
   const relockAndCheck = (checkout, check = true) => effect(`re-lock ${checkout.name}${check ? " and run its check" : ""}`, void 0, () => {
-    const install = (...flags) => spawnSync2("bun", ["install", ...flags], { cwd: checkout.dir, stdio: "inherit" }).status === 0;
+    const install = (...flags) => spawnSync3("bun", ["install", ...flags], { cwd: checkout.dir, stdio: "inherit" }).status === 0;
     if (!install() && !install("--no-cache")) {
       throw new Abort(`bun install failed in ${checkout.name}`);
     }
@@ -1389,9 +1636,9 @@ if (command === "train") {
       checkout.dir,
       inspect(checkout.dir, target()).findings
     )) {
-      spawnSync2("bun", ["update", ...names], { cwd, stdio: "inherit" });
+      spawnSync3("bun", ["update", ...names], { cwd, stdio: "inherit" });
     }
-    if (check && spawnSync2("bun", ["run", "check"], { cwd: checkout.dir, stdio: "inherit" }).status !== 0) {
+    if (check && spawnSync3("bun", ["run", "check"], { cwd: checkout.dir, stdio: "inherit" }).status !== 0) {
       throw new CheckFailed(`check failed in ${checkout.name}`);
     }
   });
@@ -1400,7 +1647,7 @@ if (command === "train") {
     if (git(checkout.dir, "status", "--porcelain").stdout.trim() === "") return;
     git(checkout.dir, "reset", "--quiet", "--hard", "HEAD");
     git(checkout.dir, "clean", "--quiet", "-fd");
-    spawnSync2("bun", ["install", "--frozen-lockfile"], { cwd: checkout.dir, stdio: "inherit" });
+    spawnSync3("bun", ["install", "--frozen-lockfile"], { cwd: checkout.dir, stdio: "inherit" });
   });
   const movesOf = (checkout) => {
     const candidates2 = activeCandidates(manifest);
@@ -1430,11 +1677,11 @@ if (command === "train") {
   };
   const worktree = (checkout, branch) => {
     const tooling = !!checkout.pkg.scripts?.["worktree:create"];
-    const path = tooling ? join2(checkout.dir, ".worktrees", branch.replaceAll("/", "-")) : join2(mkdtempSync(join2(tmpdir(), "inixiative-train-")), basename(checkout.dir));
-    const created = tooling ? spawnSync2("bun", ["run", "worktree:create", defaultBranch(checkout.dir), branch], {
+    const path = tooling ? join3(checkout.dir, ".worktrees", branch.replaceAll("/", "-")) : join3(mkdtempSync(join3(tmpdir(), "inixiative-train-")), basename(checkout.dir));
+    const created = tooling ? spawnSync3("bun", ["run", "worktree:create", defaultBranch(checkout.dir), branch], {
       cwd: checkout.dir,
       stdio: "inherit"
-    }).status === 0 && existsSync2(path) : git(checkout.dir, "worktree", "add", "--quiet", "-b", branch, path, "HEAD").status === 0;
+    }).status === 0 && existsSync3(path) : git(checkout.dir, "worktree", "add", "--quiet", "-b", branch, path, "HEAD").status === 0;
     if (!created) throw new Abort(`could not create ${branch} in ${checkout.name}`);
     worktrees.push({ repo: checkout.dir, path, tooling });
     const envFiles = git(
@@ -1449,9 +1696,9 @@ if (command === "train") {
       (file) => /(^|\/)\.env[^/]*$/.test(file) && !/(^|\/)(node_modules|\.worktrees)\//.test(file)
     );
     for (const file of envFiles) {
-      if (existsSync2(join2(path, file))) continue;
-      mkdirSync2(dirname2(join2(path, file)), { recursive: true });
-      writeFileSync2(join2(path, file), readFileSync2(join2(checkout.dir, file)));
+      if (existsSync3(join3(path, file))) continue;
+      mkdirSync3(dirname3(join3(path, file)), { recursive: true });
+      writeFileSync3(join3(path, file), readFileSync3(join3(checkout.dir, file)));
     }
     return { ...checkout, dir: path };
   };
@@ -1475,8 +1722,8 @@ if (command === "train") {
       () => {
         const branchCheckout = worktree(checkout, branch);
         for (const path of [...packagePaths, "bun.lock"]) {
-          if (existsSync2(join2(checkout.dir, path))) {
-            writeFileSync2(join2(branchCheckout.dir, path), readFileSync2(join2(checkout.dir, path)));
+          if (existsSync3(join3(checkout.dir, path))) {
+            writeFileSync3(join3(branchCheckout.dir, path), readFileSync3(join3(checkout.dir, path)));
           }
         }
         restore(checkout);
@@ -1517,7 +1764,7 @@ if (command === "train") {
           try {
             bumpRanges(branchCheckout);
             relockAndCheck(branchCheckout, false);
-            if (script && spawnSync2("bun", ["run", "train:adopt"], {
+            if (script && spawnSync3("bun", ["run", "train:adopt"], {
               cwd: branchCheckout.dir,
               stdio: "inherit"
             }).status !== 0) {
@@ -1526,7 +1773,7 @@ if (command === "train") {
               );
             }
             git(branchCheckout.dir, "add", "-A");
-            const commit = spawnSync2("git", ["commit", "-m", `chore: adopt ${label}`], {
+            const commit = spawnSync3("git", ["commit", "-m", `chore: adopt ${label}`], {
               cwd: branchCheckout.dir,
               stdio: "inherit"
             });
@@ -1555,14 +1802,14 @@ if (command === "train") {
     if (dryRun && !changes) return false;
     return effect(`commit its package.json files + bun.lock in ${checkout.name}`, true, () => {
       const tracked = [...packagePaths, "bun.lock"].filter(
-        (path) => existsSync2(join2(checkout.dir, path))
+        (path) => existsSync3(join3(checkout.dir, path))
       );
       const mutated = git(checkout.dir, "status", "--porcelain", "--", ...tracked);
       if (mutated.status !== 0 || mutated.stdout.trim().length === 0) return false;
       if (git(checkout.dir, "add", "--", ...tracked).status !== 0) {
         throw new Abort(`git add failed in ${checkout.name} \u2014 is bun.lock ignored?`);
       }
-      const commit = spawnSync2("git", ["commit", "-m", message], {
+      const commit = spawnSync3("git", ["commit", "-m", message], {
         cwd: checkout.dir,
         stdio: "inherit"
       });
@@ -1580,24 +1827,24 @@ if (command === "train") {
   });
   const publishToNpm = (checkout, entry) => {
     if (entry.path === "package.json") {
-      return spawnSync2("npm", ["publish"], { cwd: checkout.dir, stdio: "inherit" }).status === 0;
+      return spawnSync3("npm", ["publish"], { cwd: checkout.dir, stdio: "inherit" }).status === 0;
     }
-    const memberDir = join2(checkout.dir, dirname2(entry.path));
-    const out = mkdtempSync(join2(tmpdir(), "inixiative-train-"));
+    const memberDir = join3(checkout.dir, dirname3(entry.path));
+    const out = mkdtempSync(join3(tmpdir(), "inixiative-train-"));
     try {
-      const pack = spawnSync2("bun", ["pm", "pack", "--destination", out], {
+      const pack = spawnSync3("bun", ["pm", "pack", "--destination", out], {
         cwd: memberDir,
         stdio: "inherit"
       });
-      const tarball = readdirSync2(out).find((name) => name.endsWith(".tgz"));
+      const tarball = readdirSync3(out).find((name) => name.endsWith(".tgz"));
       if (pack.status !== 0 || !tarball) return false;
-      return spawnSync2("npm", ["publish", join2(out, tarball)], { cwd: memberDir, stdio: "inherit" }).status === 0;
+      return spawnSync3("npm", ["publish", join3(out, tarball)], { cwd: memberDir, stdio: "inherit" }).status === 0;
     } finally {
-      rmSync2(out, { recursive: true, force: true });
+      rmSync3(out, { recursive: true, force: true });
     }
   };
   const npmLatest = (name) => {
-    const remote = spawnSync2("npm", ["view", `${name}@latest`, "version"], { encoding: "utf8" });
+    const remote = spawnSync3("npm", ["view", `${name}@latest`, "version"], { encoding: "utf8" });
     return remote.status === 0 ? remote.stdout.trim() : null;
   };
   for (const { lane: lane2, checkouts, missing, ambiguous } of plan.lanes) {
@@ -1626,7 +1873,7 @@ if (command === "train") {
           continue;
         }
         const releases = checkout.packages.map((entry) => {
-          const local = JSON.parse(readFileSync2(join2(checkout.dir, entry.path), "utf8")).version ?? "0.0.0";
+          const local = JSON.parse(readFileSync3(join3(checkout.dir, entry.path), "utf8")).version ?? "0.0.0";
           const remote = npmLatest(entry.name);
           return { entry, local, remote, ahead: remote === null || compare(local, remote) > 0 };
         });
@@ -1816,10 +2063,10 @@ blessed: ${promoted.length === 0 ? "nothing" : promoted.join(", ")}`);
       version = bumpPatch(remoteVersion);
       const bumped = version;
       effect(`bump @inixiative/config to ${bumped} in package.json`, void 0, () => {
-        const pkgPath = join2(packageRoot, "package.json");
-        const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+        const pkgPath = join3(packageRoot, "package.json");
+        const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
         pkg.version = bumped;
-        writeFileSync2(pkgPath, `${JSON.stringify(pkg, null, 2)}
+        writeFileSync3(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `);
       });
     }
@@ -1838,7 +2085,7 @@ blessed: ${promoted.length === 0 ? "nothing" : promoted.join(", ")}`);
       }
     );
     effect("run bun run check in @inixiative/config", void 0, () => {
-      const check = spawnSync2("bun", ["run", "check"], { cwd: packageRoot, stdio: "inherit" });
+      const check = spawnSync3("bun", ["run", "check"], { cwd: packageRoot, stdio: "inherit" });
       if (check.status !== 0) {
         console.error("\u2717 check failed in @inixiative/config \u2014 aborting before publish");
         process.exit(1);
@@ -1849,12 +2096,12 @@ blessed: ${promoted.length === 0 ? "nothing" : promoted.join(", ")}`);
       recorded.length > 0 ? `candidate ${recorded.join(", ")}` : ""
     ].filter(Boolean).join("; ") || "release"} \u2014 ${version}`;
     effect(`commit "${message}" in @inixiative/config`, void 0, () => {
-      spawnSync2("git", ["add", "--", "package.json", "versions.json", "test/fixtures"], {
+      spawnSync3("git", ["add", "--", "package.json", "versions.json", "test/fixtures"], {
         cwd: packageRoot
       });
-      if (spawnSync2("git", ["diff", "--cached", "--quiet"], { cwd: packageRoot }).status === 0)
+      if (spawnSync3("git", ["diff", "--cached", "--quiet"], { cwd: packageRoot }).status === 0)
         return;
-      const commit = spawnSync2("git", ["commit", "-m", message], {
+      const commit = spawnSync3("git", ["commit", "-m", message], {
         cwd: packageRoot,
         stdio: "inherit"
       });
@@ -1864,7 +2111,7 @@ blessed: ${promoted.length === 0 ? "nothing" : promoted.join(", ")}`);
       }
     });
     effect(`publish @inixiative/config@${version} to npm`, void 0, () => {
-      const publish2 = spawnSync2("npm", ["publish"], { cwd: packageRoot, stdio: "inherit" });
+      const publish2 = spawnSync3("npm", ["publish"], { cwd: packageRoot, stdio: "inherit" });
       if (publish2.status !== 0 || !servedByRegistry("@inixiative/config", version)) {
         console.error("\u2717 publish failed for @inixiative/config");
         process.exit(1);
@@ -1898,17 +2145,17 @@ dry run complete \u2014 a real train would commit in ${committed.size} repo(s) a
     for (const { dir: repoDir, branch } of reviewBranches) console.log(`  ${repoDir} (${branch})`);
   } else if (commandLine.push) {
     for (const repoDir of committed) {
-      if (spawnSync2("git", ["push"], { cwd: repoDir, stdio: "inherit" }).status !== 0) {
+      if (spawnSync3("git", ["push"], { cwd: repoDir, stdio: "inherit" }).status !== 0) {
         console.error(`\u2717 push failed in ${repoDir}`);
         process.exit(1);
       }
     }
     for (const { dir: repoDir, branch, base } of reviewBranches) {
-      const push = spawnSync2("git", ["push", "-u", "origin", branch], {
+      const push = spawnSync3("git", ["push", "-u", "origin", branch], {
         cwd: repoDir,
         stdio: "inherit"
       });
-      const pr = push.status === 0 && spawnSync2("gh", ["pr", "create", "--fill", "--base", base, "--head", branch], {
+      const pr = push.status === 0 && spawnSync3("gh", ["pr", "create", "--fill", "--base", base, "--head", branch], {
         cwd: repoDir,
         stdio: "inherit"
       }).status === 0;
@@ -1927,7 +2174,7 @@ dry run complete \u2014 a real train would commit in ${committed.size} repo(s) a
   process.exit(failed.length > 0 ? 1 : 0);
 }
 function prUrl(cwd, branch) {
-  const view = spawnSync2("gh", ["pr", "view", branch, "--json", "url", "--jq", ".url"], {
+  const view = spawnSync3("gh", ["pr", "view", branch, "--json", "url", "--jq", ".url"], {
     cwd,
     encoding: "utf8"
   });
@@ -1945,7 +2192,7 @@ function freeBranch(cwd, name) {
 function servedByRegistry(name, version) {
   const deadline = Date.now() + 15 * 6e4;
   while (true) {
-    const view = spawnSync2("npm", ["view", `${name}@${version}`, "version", "--prefer-online"], {
+    const view = spawnSync3("npm", ["view", `${name}@${version}`, "version", "--prefer-online"], {
       encoding: "utf8"
     });
     if (view.status === 0 && view.stdout.trim() === version) return true;
@@ -1958,12 +2205,12 @@ function bumpPatch(version) {
   return `${major}.${minor}.${(patch ?? 0) + 1}`;
 }
 function fixtureDirs() {
-  const root = join2(packageRoot, "test", "fixtures");
-  if (!existsSync2(root)) return [];
-  return readdirSync2(root).map((name) => join2(root, name)).filter((dir2) => existsSync2(join2(dir2, "package.json")));
+  const root = join3(packageRoot, "test", "fixtures");
+  if (!existsSync3(root)) return [];
+  return readdirSync3(root).map((name) => join3(root, name)).filter((dir2) => existsSync3(join3(dir2, "package.json")));
 }
-if (existsSync2(join2(dir, ".git")) && !commandLine.force) {
-  const status = spawnSync2("git", ["status", "--porcelain"], { cwd: dir, encoding: "utf8" });
+if (existsSync3(join3(dir, ".git")) && !commandLine.force) {
+  const status = spawnSync3("git", ["status", "--porcelain"], { cwd: dir, encoding: "utf8" });
   if (status.status === 0 && status.stdout.trim().length > 0) {
     console.error("\u2717 working tree dirty \u2014 commit first or pass --force");
     process.exit(1);
@@ -1977,14 +2224,14 @@ if (fixed > 0) console.log(`applied ${fixed} fix${fixed === 1 ? "" : "es"}`);
 if (!commandLine.noInstall) {
   const relinked = new Set(
     first.findings.flatMap(
-      (finding) => finding.kind === "member-toolchain" && finding.path ? [dirname2(finding.path)] : []
+      (finding) => finding.kind === "member-toolchain" && finding.path ? [dirname3(finding.path)] : []
     )
   );
   for (const member of relinked) {
-    rmSync2(join2(dir, member, "node_modules"), { recursive: true, force: true });
+    rmSync3(join3(dir, member, "node_modules"), { recursive: true, force: true });
   }
   const install = (...extra) => {
-    if (spawnSync2("bun", ["install", ...extra], { cwd: dir, stdio: "inherit" }).status !== 0) {
+    if (spawnSync3("bun", ["install", ...extra], { cwd: dir, stdio: "inherit" }).status !== 0) {
       console.error("\u2717 bun install failed");
       process.exit(1);
     }
@@ -1996,7 +2243,7 @@ if (!commandLine.noInstall) {
     installed = inspect(dir, manifest, presetFlag);
   }
   for (const { cwd, names } of staleUpdates(dir, installed.findings)) {
-    if (spawnSync2("bun", ["update", ...names], { cwd, stdio: "inherit" }).status !== 0) {
+    if (spawnSync3("bun", ["update", ...names], { cwd, stdio: "inherit" }).status !== 0) {
       console.error(`\u2717 bun update failed in ${cwd}`);
       process.exit(1);
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@inixiative/config",
-  "version": "0.5.184",
-  "description": "Shared toolchain for the inixiative ecosystem: tsconfig/biome/tsup presets, a version manifest (BOM), and a sync/check CLI",
+  "version": "0.5.186",
+  "description": "Shared toolchain and theme for the inixiative packages: tsconfig/biome/tsup presets, theme CSS, a version manifest (BOM), and a sync/check/train CLI",
   "type": "module",
   "license": "MIT",
   "author": "Aron Greenspan",

package/versions.json

@@ -13,7 +13,7 @@
     "@types/bun"
   ],
   "ecosystem": {
-    "@inixiative/config": "0.5.184",
+    "@inixiative/config": "0.5.186",
     "@inixiative/json-rules": "3.16.0",
     "@inixiative/permissions": "0.18.0",
     "@inixiative/transitions": "0.6.0",
@@ -26,7 +26,7 @@
     "@inixiative/signet": "0.12.2",
     "@inixiative/kcp": "0.1.0",
     "@inixiative/archive": "0.33.0",
-    "@inixiative/agent-session": "0.9.0",
+    "@inixiative/agent-session": "0.10.0",
     "@inixiative/foundry-core": "0.5.10",
     "@inixiative/foundry": "0.5.7",
     "@inixiative/foundry-acp": "0.1.2"
@@ -52,6 +52,6 @@
   },
   "candidates": {
     "@inixiative/atlas": "0.5.0",
-    "@inixiative/agent-session": "0.10.0"
+    "@inixiative/agent-session": "0.11.0"
   }
 }