@inixiative/config 0.5.32 → 0.5.33

package/README.md

@@ -62,7 +62,7 @@ bunx @inixiative/config train [root]
 
 `scan` runs `check` across every ecosystem checkout under a root directory. Targets are derived from the BOM's `ecosystem` keys and matched by package name, so directory names and local layout never need declaring. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, warns when a checkout sits on a non-default branch (its findings describe the branch, not what ships), and surfaces unmerged `claude/*` session branches.
 
-`train` is the release cascade, run from this repo's checkout. Origin is the truth: it refuses to run from a config checkout behind origin or with any BOM repo missing a checkout, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It only ships the default branch: a checkout on a feature branch is skipped whole — never re-locked, committed to, or published from. It walks the ecosystem in dependency order; per repo it: bumps ecosystem ranges to the BOM → re-locks → runs the repo's `check` → commits only its own changes (`package.json` + `bun.lock`) → publishes via `npm publish` when the local version is ahead of npm (OTP prompts pass through) → records the published version in the BOM. It never pushes; review its commits, push, then commit and publish this package so the BOM names the new state.
+`train` is the release cascade, run from this repo's checkout. Origin is the truth: it refuses to run from a config checkout behind origin or with any BOM repo missing a checkout, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It only ships the default branch: a checkout on a feature branch is skipped whole — never re-locked, committed to, or published from. It walks the ecosystem in dependency order; per repo it: bumps ecosystem ranges to the BOM → re-locks → runs the repo's `check` → commits only its own changes (`package.json` + `bun.lock`) → publishes via `npm publish` when the local version is ahead of npm (OTP prompts pass through) and waits until the registry serves that version → records it in the BOM. When anything was published it then ships this package last, so the BOM names the new state: bumps its own patch version if npm already has the current one, blesses that version in the BOM, brings the `test/fixtures` consumers onto the blessed set, runs `check`, commits, publishes. It never pushes unless asked: pass `--push` to push every repo it committed to, otherwise it prints the `git push` for each.
 
 Division of labor: this CLI owns the toolchain set, ecosystem coherence, stubs, and lockfile format. Renovate owns everything else plus bumping `@inixiative/config` itself, and must be fenced off the toolchain packages.
 
@@ -85,4 +85,4 @@ jobs:
 
 ## Release flow
 
-Publishing moves in dependency order (json-rules → permissions → transitions → rules-builder). `train` automates the walk; after it completes, commit and publish this package so the BOM names the new state. Downstream repos pick it up via `sync`.
+Publishing moves in dependency order (json-rules → permissions → transitions → rules-builder → config). `train` automates the whole walk, this package included. Downstream repos pick it up via `sync`.

package/dist/cli.js

@@ -2,7 +2,7 @@
 
 // src/cli.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join2, resolve } from "path";
 
 // src/lib.ts
@@ -657,6 +657,7 @@ if (command === "train") {
   console.log(`train order: ${order.map((repo) => repo.name).join(" \u2192 ")}`);
   const published = [];
   const skipped = [];
+  const committed = [];
   let bomDirty = false;
   for (const repo of order) {
     console.log(`
@@ -756,6 +757,7 @@ if (command === "train") {
         console.error(`\u2717 commit failed in ${repo.name} \u2014 aborting train`);
         process.exit(1);
       }
+      committed.push(repo.dir);
     }
     if (ahead) {
       console.log(`publishing ${repo.name}@${localVersion} (npm has ${remoteVersion ?? "none"})`);
@@ -764,6 +766,13 @@ if (command === "train") {
         console.error(`\u2717 publish failed for ${repo.name} \u2014 aborting train`);
         process.exit(1);
       }
+      if (!servedByRegistry(repo.name, localVersion)) {
+        console.error(
+          `\u2717 npm accepted ${repo.name}@${localVersion} but the registry does not serve it \u2014 aborting train`
+        );
+        process.exit(1);
+      }
+      committed.push(repo.dir);
       manifest.ecosystem[repo.name] = localVersion;
       writeManifest(manifest);
       bomDirty = true;
@@ -775,11 +784,88 @@ if (command === "train") {
   console.log(`
 published: ${published.length === 0 ? "nothing" : published.join(", ")}`);
   if (skipped.length > 0) console.log(`skipped: ${skipped.join(", ")}`);
-  if (bomDirty)
-    console.log("BOM updated in versions.json \u2014 commit @inixiative/config and publish it");
-  console.log("train does not push \u2014 review the commits it made, then push each repo");
+  if (bomDirty) {
+    const remote = spawnSync2("npm", ["view", "@inixiative/config@latest", "version"], {
+      encoding: "utf8"
+    });
+    const remoteVersion = remote.status === 0 ? remote.stdout.trim() : null;
+    let version = ownVersion();
+    if (remoteVersion !== null && compare(version, remoteVersion) <= 0) {
+      version = bumpPatch(remoteVersion);
+      const pkgPath = join2(packageRoot, "package.json");
+      const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+      pkg.version = version;
+      writeFileSync2(pkgPath, `${JSON.stringify(pkg, null, 2)}
+`);
+    }
+    manifest.ecosystem["@inixiative/config"] = version;
+    writeManifest(manifest);
+    for (const fixture of fixtureDirs()) {
+      const inspection = inspect(fixture, manifest);
+      for (const finding of inspection.findings)
+        if (finding.kind === "ecosystem-range") finding.fix?.();
+      inspection.flush();
+    }
+    const check = spawnSync2("bun", ["run", "check"], { cwd: packageRoot, stdio: "inherit" });
+    if (check.status !== 0) {
+      console.error("\u2717 check failed in @inixiative/config \u2014 aborting before publish");
+      process.exit(1);
+    }
+    spawnSync2("git", ["add", "--", "package.json", "versions.json", "test/fixtures"], {
+      cwd: packageRoot
+    });
+    const commit = spawnSync2(
+      "git",
+      ["commit", "-m", `chore: bless ${published.join(", ")} \u2014 ${version}`],
+      {
+        cwd: packageRoot,
+        stdio: "inherit"
+      }
+    );
+    if (commit.status !== 0) {
+      console.error("\u2717 commit failed in @inixiative/config \u2014 aborting before publish");
+      process.exit(1);
+    }
+    const publish = spawnSync2("npm", ["publish"], { cwd: packageRoot, stdio: "inherit" });
+    if (publish.status !== 0 || !servedByRegistry("@inixiative/config", version)) {
+      console.error("\u2717 publish failed for @inixiative/config");
+      process.exit(1);
+    }
+    committed.push(packageRoot);
+    console.log(`published: @inixiative/config@${version} \u2014 the BOM names the new state`);
+  }
+  if (flags.has("--push")) {
+    for (const repoDir of committed) {
+      const push = spawnSync2("git", ["push"], { cwd: repoDir, stdio: "inherit" });
+      if (push.status !== 0) {
+        console.error(`\u2717 push failed in ${repoDir}`);
+        process.exit(1);
+      }
+    }
+    console.log(`pushed: ${committed.length} repo${committed.length === 1 ? "" : "s"}`);
+  } else if (committed.length > 0) {
+    console.log("train does not push without --push \u2014 review its commits, then push:");
+    for (const repoDir of committed) console.log(`  git -C ${repoDir} push`);
+  }
   process.exit(0);
 }
+function servedByRegistry(name, version) {
+  for (let attempt = 0; attempt < 10; attempt++) {
+    const view = spawnSync2("npm", ["view", `${name}@${version}`, "version"], { encoding: "utf8" });
+    if (view.status === 0 && view.stdout.trim() === version) return true;
+    Bun.sleepSync(3e3);
+  }
+  return false;
+}
+function bumpPatch(version) {
+  const [major, minor, patch] = version.split(".").map(Number);
+  return `${major}.${minor}.${(patch ?? 0) + 1}`;
+}
+function fixtureDirs() {
+  const root = join2(packageRoot, "test", "fixtures");
+  if (!existsSync2(root)) return [];
+  return readdirSync2(root).map((name) => join2(root, name)).filter((dir2) => existsSync2(join2(dir2, "package.json")));
+}
 if (existsSync2(join2(dir, ".git")) && !flags.has("--force")) {
   const status = spawnSync2("git", ["status", "--porcelain"], { cwd: dir, encoding: "utf8" });
   if (status.status === 0 && status.stdout.trim().length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/config",
-  "version": "0.5.32",
+  "version": "0.5.33",
   "description": "Shared toolchain for the inixiative ecosystem: tsconfig/biome/tsup presets, a version manifest (BOM), and a sync/check CLI",
   "type": "module",
   "license": "MIT",

package/versions.json

@@ -13,7 +13,7 @@
     "@types/bun"
   ],
   "ecosystem": {
-    "@inixiative/config": "0.5.32",
+    "@inixiative/config": "0.5.33",
     "@inixiative/json-rules": "2.25.0",
     "@inixiative/permissions": "0.3.2",
     "@inixiative/transitions": "0.1.0",