@inixiative/config 0.5.35 → 0.5.36

package/README.md

@@ -40,7 +40,19 @@ One version of `@inixiative/config` names one coherent ecosystem state:
 - `bun` — blessed runtime, written to `.bun-version` and `packageManager`
 - `toolchain` — exact pins for `@biomejs/biome`, `typescript`, `tsup`, `@types/bun`
 - `required` — toolchain packages every repo must carry
-- `ecosystem` — the blessed, mutually-verified `@inixiative/*` set
+- `ecosystem` — the primitives lane's blessed, mutually-verified `@inixiative/*` set, plus this package
+- `agentic` — the agentic lane's blessed set
+- `consumers` — private repos that follow the blessed sets but never publish, keyed by GitHub `owner/repo`: `lanes` names the lanes each consumes, `upstream` the repo it syncs from
+
+```jsonc
+"consumers": {
+  "inixiative/template": { "lanes": ["primitives"] },
+  "inixiative/kingdom": { "lanes": ["primitives", "agentic"], "upstream": "inixiative/template" },
+  "inixiative/oracle": { "lanes": ["agentic"] }
+}
+```
+
+A lane is a release cascade with its own blessed set. `primitives` (json-rules, permissions, transitions, rules-builder, prisma-map, atlas, gloss, archive) ships first; `agentic` (agent-session → foundry-core → foundry) builds on the primitives' blessed set and never the reverse. `check` holds every repo to the union of all lanes, so a repo that mixes both answers to both.
 
 TypeScript 6.0 notes, discovered by this repo's fixture suite:
 
@@ -52,17 +64,23 @@ TypeScript 6.0 notes, discovered by this repo's fixture suite:
 ```
 bunx @inixiative/config check [dir] [--preset=base|node|react]
 bunx @inixiative/config sync  [dir] [--preset=...] [--force] [--no-install]
-bunx @inixiative/config scan  [root]
-bunx @inixiative/config train [root]
+bunx @inixiative/config scan  [root] [--lane=primitives|agentic]
+bunx @inixiative/config train [root] [--lane=primitives|agentic] [--push]
 ```
 
-`check` is read-only and exits non-zero on drift — run it in CI after a frozen-lockfile install. It verifies toolchain pins, `"latest"` ranges, `packageManager`/`.bun-version`, legacy `bun.lockb`, a committed (tracked, un-ignored) `bun.lock`, required scripts (`check`/`typecheck`/`lint`/`test`), lefthook (dep + `lefthook.yml` extending the shared hooks + `prepare` script; git repos only), stub `extends`, presence of this package, and for every ecosystem dependency that the declared range admits the blessed version and the lockfile actually resolves to it (the stale-lockfile class).
+`check` is read-only and exits non-zero on drift — run it in CI after a frozen-lockfile install. It verifies toolchain pins, `"latest"` ranges, `packageManager`/`.bun-version`, legacy `bun.lockb`, a committed (tracked, un-ignored) `bun.lock`, required scripts (`check`/`typecheck`/`lint`/`test`), lefthook (dep + `lefthook.yml` extending the shared hooks + `prepare` script; git repos only), stub `extends`, presence of this package, and for every ecosystem dependency — in the root or any workspace member, of either lane — that the declared range admits the blessed version and the lockfile actually resolves to it (the stale-lockfile class). An npm alias (`"@inixiative/session-archive": "npm:@inixiative/archive@^0.2.1"`) is held to its target's blessed version and rewritten as an alias; `workspace:`, `file:` and `link:` ranges are a repo linking itself and are left alone.
 
 `sync` applies every fix, re-locks via `bun install`, and runs `bun update` on stale ecosystem entries. It refuses to run on a dirty working tree without `--force`. The react preset is inferred from a `react` dependency; override with `--preset`. Missing scripts are filled with defaults; existing script bodies are never touched.
 
-`scan` runs `check` across every ecosystem checkout under a root directory. Targets are derived from the BOM's `ecosystem` keys and matched by package name, so directory names and local layout never need declaring. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, warns when a checkout sits on a non-default branch (its findings describe the branch, not what ships), and surfaces unmerged `claude/*` session branches.
+`scan` runs `check` across every ecosystem checkout under a root directory, for every lane or just the one `--lane` names. Targets are derived from the BOM: lane packages match by package name — the root package or any workspace member, so a monorepo such as foundry is found by the packages it publishes — and consumers match by their `origin` GitHub repo. Directory names and local layout never need declaring: scan looks at each child of the root and one level into a child without a `package.json` (a workspace folder such as `kingdom-workspace/`). Linked git worktrees are other sessions' branches and never targets; when several clones claim one package or repo, only those with an `origin` remote count, and if that still leaves more than one the target is reported ambiguous rather than guessed. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, warns when a checkout sits on a non-default branch (its findings describe the branch, not what ships), and surfaces unmerged `claude/*` session branches.
+
+`train` is the release cascade, run from this repo's checkout. It walks every lane in order (primitives, then agentic), or only the lane `--lane` names. Origin is the truth: it refuses to run from a config checkout behind origin, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It only ships the default branch: a checkout on a feature branch is skipped whole — never re-locked, committed to, or published from.
 
-`train` is the release cascade, run from this repo's checkout. Origin is the truth: it refuses to run from a config checkout behind origin or with any BOM repo missing a checkout, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It only ships the default branch: a checkout on a feature branch is skipped whole — never re-locked, committed to, or published from. It walks the ecosystem in dependency order; per repo it: bumps ecosystem ranges to the BOM → re-locks → runs the repo's `check` → commits only its own changes (`package.json` + `bun.lock`) → publishes via `npm publish` when the local version is ahead of npm (OTP prompts pass through) and waits until the registry serves that version → records it in the BOM. When anything was published it then ships this package last, so the BOM names the new state: bumps its own patch version if npm already has the current one, blesses that version in the BOM, brings the `test/fixtures` consumers onto the blessed set, runs `check`, commits, publishes. It never pushes unless asked: pass `--push` to push every repo it committed to, otherwise it prints the `git push` for each.
+Lanes stand alone. A lane with a package missing a checkout, or claimed by ambiguous checkouts, does not run; a lane whose check, commit or publish fails stops there and leaves its BOM entries as they were. Neither holds back the other lane. Within a lane it walks checkouts in dependency order; per checkout it: bumps ecosystem ranges to the blessed sets → re-locks → runs the repo's `check` → commits only its own changes (`package.json` files + `bun.lock`) → publishes each lane package whose local version is ahead of npm, in dependency order, and waits until the registry serves it → records it in its lane's section of the BOM. A root package publishes with `npm publish`; a workspace member is packed with `bun pm pack`, which rewrites `workspace:` ranges to the versions being released, and the tarball is published with `npm publish`, so OTP prompts pass through either way. A package already on npm at its local version but not yet blessed — published by hand, or by a train whose lane later failed — is blessed on the next run.
+
+Consumers run once, after every selected lane, upstreams first, against the full blessed set: a consumer of both lanes ends coherent with both whichever lane ran. They get the same bump → re-lock → `check`, never a publish, and their changes go through review: the train commits them on a `train/ecosystem-sync-<date>` branch and leaves the checkout there until it is merged.
+
+When anything was blessed it then ships this package last, so the BOM names the new state: bumps its own patch version if npm already has the current one, blesses that version in the BOM, brings the `test/fixtures` consumers onto the blessed set, runs `check`, commits, publishes. It never pushes unless asked: pass `--push` to push every repo it committed to and open a PR for each consumer branch; otherwise it prints the commands.
 
 Division of labor: this CLI owns the toolchain set, ecosystem coherence, stubs, and lockfile format. Renovate owns everything else plus bumping `@inixiative/config` itself, and must be fenced off the toolchain packages.
 
@@ -85,4 +103,9 @@ jobs:
 
 ## Release flow
 
-Publishing moves in dependency order (for example, json-rules → permissions → transitions → rules-builder), with config last. Archive is included in the ecosystem BOM and release train as a standalone MIT-licensed package. `train` automates the whole walk, this package included. Downstream repos pick it up via `sync`.
+Two lanes, each publishing in dependency order, with config last:
+
+- **primitives** — for example json-rules → permissions → transitions → rules-builder, plus prisma-map, atlas, gloss and archive (a standalone MIT package). Consumers: template, kingdom.
+- **agentic** — agent-session → foundry-core → foundry, built on the primitives' blessed set. foundry-core and foundry publish from the foundry monorepo's `packages/core` and `packages/foundry`. Consumers: oracle (a private leaf), kingdom.
+
+A release is `train` (or `train --lane=agentic` to leave the primitives alone): bump the package's version on its default branch, then run the train. `train` automates the whole walk, this package and the consumer PRs included. Downstream repos pick up toolchain changes via `sync`.

package/dist/cli.js

@@ -2,15 +2,55 @@
 
 // src/cli.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join2, resolve } from "path";
+import { existsSync as existsSync2, mkdtempSync, readdirSync as readdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir } from "os";
+import { dirname as dirname2, join as join2, resolve } from "path";
 
 // src/lib.ts
 import { spawnSync } from "child_process";
-import { existsSync, globSync, readdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import {
+  existsSync,
+  globSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "fs";
 import { dirname, join, sep } from "path";
 import { fileURLToPath } from "url";
 var packageRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+var LANES = ["primitives", "agentic"];
+var isLane = (value) => LANES.includes(value);
+var lanePackages = (manifest2, lane) => {
+  const section = lane === "primitives" ? manifest2.ecosystem : manifest2.agentic ?? {};
+  const { "@inixiative/config": _config, ...packages } = section;
+  return packages;
+};
+var laneSection = (manifest2, lane) => {
+  if (lane === "primitives") return manifest2.ecosystem;
+  manifest2.agentic ??= {};
+  return manifest2.agentic;
+};
+var blessedVersions = (manifest2) => ({
+  ...manifest2.ecosystem,
+  ...manifest2.agentic
+});
+var consumersFor = (manifest2, lanes2) => {
+  const consumers = manifest2.consumers ?? {};
+  const selected = Object.keys(consumers).filter((repo) => consumers[repo].lanes.some((lane) => lanes2.includes(lane))).sort();
+  const order = [];
+  const visit = (repo, trail) => {
+    if (order.includes(repo)) return;
+    if (trail.includes(repo))
+      throw new Error(`consumer upstream cycle: ${[...trail, repo].join(" \u2192 ")}`);
+    const upstream = consumers[repo].upstream;
+    if (upstream && selected.includes(upstream)) visit(upstream, [...trail, repo]);
+    order.push(repo);
+  };
+  for (const repo of selected) visit(repo, []);
+  return order;
+};
 var REQUIRED_SCRIPTS = {
   typecheck: "tsc --noEmit",
   lint: "biome check .",
@@ -107,65 +147,184 @@ var admits = (range, version) => {
   }
   return vMajor === major && vMinor === minor;
 };
-var lockedVersion = (lockText, name) => {
+var lockedVersion = (lockText, key, target = key) => {
   const lock = tryParseJsonc(lockText);
   const packages = lock?.packages;
   if (!packages || typeof packages !== "object") return null;
-  const entry = packages[name];
+  const entry = packages[key];
   const spec = Array.isArray(entry) ? entry[0] : null;
-  if (typeof spec !== "string" || !spec.startsWith(`${name}@`)) return null;
-  const version = spec.slice(name.length + 1);
+  if (typeof spec !== "string" || !spec.startsWith(`${target}@`)) return null;
+  const version = spec.slice(target.length + 1);
   return /^\d/.test(version) ? version : null;
 };
-var topoOrder = (root, manifest2) => {
-  const repos = discoverRepos(root, manifest2).map((repo) => ({
-    ...repo,
-    pkg: JSON.parse(readFileSync(join(repo.dir, "package.json"), "utf8"))
-  }));
-  const names = new Set(repos.map((repo) => repo.name));
-  const dependsOn = /* @__PURE__ */ new Map();
-  for (const repo of repos) {
-    const edges = /* @__PURE__ */ new Set();
+var npmAlias = (spec) => {
+  const match = spec.match(/^npm:((?:@[^/@]+\/)?[^@]+)@(.+)$/);
+  return match ? { name: match[1], range: match[2] } : null;
+};
+var readJson = (path) => {
+  try {
+    return tryParseJsonc(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+};
+var originRepo = (dir2) => {
+  const url = spawnSync("git", ["remote", "get-url", "origin"], { cwd: dir2, encoding: "utf8" });
+  if (url.status !== 0) return null;
+  const match = url.stdout.trim().match(/github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?\/?$/);
+  return match ? match[1] : null;
+};
+var isLinkedWorktree = (dir2) => {
+  const dotGit = join(dir2, ".git");
+  return existsSync(dotGit) && !statSync(dotGit).isDirectory();
+};
+var childDirs = (dir2) => readdirSync(dir2, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).filter((entry) => entry.name !== "node_modules").map((entry) => join(dir2, entry.name));
+var candidateDirs = (root) => {
+  const dirs = [];
+  for (const child of childDirs(root)) {
+    const nested = existsSync(join(child, "package.json")) ? [child] : childDirs(child).filter((dir2) => existsSync(join(dir2, "package.json")));
+    dirs.push(...nested.filter((dir2) => !isLinkedWorktree(dir2)));
+  }
+  return dirs;
+};
+var discover = (root, manifest2, lanes2 = LANES) => {
+  const wanted = /* @__PURE__ */ new Map();
+  for (const lane of lanes2) {
+    for (const name of Object.keys(lanePackages(manifest2, lane))) wanted.set(name, lane);
+  }
+  const consumerRepos = new Set(consumersFor(manifest2, lanes2));
+  const claims = /* @__PURE__ */ new Map();
+  const claim = (key, checkout) => claims.set(key, [...claims.get(key) ?? [], checkout]);
+  for (const dir2 of candidateDirs(root)) {
+    const pkg = readJson(join(dir2, "package.json"));
+    if (!pkg) continue;
+    const name = typeof pkg.name === "string" ? pkg.name : dir2;
+    const provided = [
+      { name: pkg.name, path: "package.json" },
+      ...workspacePackagePaths(dir2, pkg).map((path) => ({
+        name: readJson(join(dir2, path))?.name,
+        path
+      }))
+    ].filter(
+      (entry) => typeof entry.name === "string" && wanted.has(entry.name)
+    );
+    if (provided.length > 0) {
+      const checkout = {
+        dir: dir2,
+        name,
+        pkg,
+        lane: wanted.get(provided[0].name),
+        packages: provided
+      };
+      for (const entry of provided) claim(entry.name, checkout);
+      continue;
+    }
+    if (consumerRepos.size === 0 || !existsSync(join(dir2, ".git"))) continue;
+    const repo = originRepo(dir2);
+    if (repo && consumerRepos.has(repo)) {
+      const consumer = manifest2.consumers[repo];
+      claim(repo, { dir: dir2, name, pkg, lane: null, packages: [], consumer: { repo, ...consumer } });
+    }
+  }
+  const chosen = /* @__PURE__ */ new Map();
+  const ambiguous = [];
+  for (const [key, candidates] of claims) {
+    const pool = candidates.length > 1 ? candidates.filter((candidate) => originRepo(candidate.dir)) : candidates;
+    if (pool.length === 1) chosen.set(pool[0].dir, pool[0]);
+    else ambiguous.push({ key, dirs: candidates.map((candidate) => candidate.dir).sort() });
+  }
+  const ambiguousDirs = new Set(ambiguous.flatMap((entry) => entry.dirs));
+  const checkouts = [...chosen.values()].filter((checkout) => !ambiguousDirs.has(checkout.dir)).map((checkout) => ({ ...checkout, packages: publishOrder(checkout) })).sort((a, b) => a.name.localeCompare(b.name));
+  return { checkouts, ambiguous: ambiguous.sort((a, b) => a.key.localeCompare(b.key)) };
+};
+var dependencyNames = (dir2, paths) => {
+  const names = /* @__PURE__ */ new Set();
+  for (const path of paths) {
+    const pkg = readJson(join(dir2, path));
     for (const field of DEP_FIELDS) {
-      for (const dep of Object.keys(repo.pkg[field] ?? {})) {
-        if (names.has(dep) && dep !== repo.name) edges.add(dep);
+      for (const [key, spec] of Object.entries(pkg?.[field] ?? {})) {
+        names.add(key);
+        const alias = npmAlias(spec);
+        if (alias) names.add(alias.name);
       }
     }
-    dependsOn.set(repo.name, edges);
   }
+  return names;
+};
+var orderBy = (items, key, deps) => {
   const order = [];
   const done = /* @__PURE__ */ new Set();
-  while (done.size < repos.length) {
-    const ready = repos.filter(
-      (repo) => !done.has(repo.name) && [...dependsOn.get(repo.name)].every((dep) => done.has(dep))
-    ).sort((a, b) => a.name.localeCompare(b.name));
+  while (done.size < items.length) {
+    const ready = items.filter((item) => !done.has(key(item)) && deps(item).every((dep) => done.has(dep))).sort((a, b) => key(a).localeCompare(key(b)));
     if (ready.length === 0) throw new Error("dependency cycle among ecosystem repos");
-    for (const repo of ready) {
-      order.push(repo);
-      done.add(repo.name);
+    for (const item of ready) {
+      order.push(item);
+      done.add(key(item));
     }
   }
   return order;
 };
-var writeManifest = (manifest2) => writeFileSync(join(packageRoot, "versions.json"), `${JSON.stringify(manifest2, null, 2)}
-`);
-var discoverRepos = (root, manifest2) => {
-  const repos = [];
-  for (const entry of readdirSync(root)) {
-    const pkgPath = join(root, entry, "package.json");
-    if (!existsSync(pkgPath)) continue;
-    const name = tryParseJsonc(readFileSync(pkgPath, "utf8"))?.name;
-    if (typeof name === "string" && name in manifest2.ecosystem && name !== "@inixiative/config")
-      repos.push({ dir: join(root, entry), name });
-  }
-  return repos.sort((a, b) => a.name.localeCompare(b.name));
+var publishOrder = (checkout) => {
+  const names = new Set(checkout.packages.map((entry) => entry.name));
+  const deps = new Map(
+    checkout.packages.map((entry) => [
+      entry.name,
+      [...dependencyNames(checkout.dir, [entry.path])].filter(
+        (dep) => names.has(dep) && dep !== entry.name
+      )
+    ])
+  );
+  return orderBy(
+    checkout.packages,
+    (entry) => entry.name,
+    (entry) => deps.get(entry.name) ?? []
+  );
+};
+var topoOrder = (checkouts) => {
+  const publishing = checkouts.filter((checkout) => !checkout.consumer);
+  const owner = /* @__PURE__ */ new Map();
+  for (const checkout of publishing) {
+    for (const entry of checkout.packages) owner.set(entry.name, checkout.dir);
+  }
+  return orderBy(
+    publishing,
+    (checkout) => checkout.dir,
+    (checkout) => {
+      const paths = ["package.json", ...workspacePackagePaths(checkout.dir, checkout.pkg)];
+      return [...dependencyNames(checkout.dir, paths)].map((dep) => owner.get(dep)).filter((dir2) => !!dir2 && dir2 !== checkout.dir);
+    }
+  );
 };
-var missingRepos = (repos, manifest2) => {
-  const found = new Set(repos.map((repo) => repo.name));
-  return Object.keys(manifest2.ecosystem).filter(
-    (name) => name !== "@inixiative/config" && !found.has(name)
+var trainPlan = (root, manifest2, lanes2 = LANES) => {
+  const { checkouts, ambiguous } = discover(root, manifest2, lanes2);
+  const consumerOrder = consumersFor(manifest2, lanes2);
+  const byRepo = new Map(
+    checkouts.flatMap(
+      (checkout) => checkout.consumer ? [[checkout.consumer.repo, checkout]] : []
+    )
   );
+  return {
+    lanes: LANES.filter((lane) => lanes2.includes(lane)).map((lane) => {
+      const names = new Set(Object.keys(lanePackages(manifest2, lane)));
+      const own = checkouts.filter((checkout) => checkout.lane === lane);
+      return {
+        lane,
+        checkouts: topoOrder(own),
+        missing: [...names].filter(
+          (name) => !own.some((checkout) => checkout.packages.some((entry) => entry.name === name)) && !ambiguous.some((entry) => entry.key === name)
+        ),
+        ambiguous: ambiguous.filter((entry) => names.has(entry.key))
+      };
+    }),
+    consumers: consumerOrder.flatMap((repo) => byRepo.get(repo) ?? []),
+    missingConsumers: consumerOrder.filter(
+      (repo) => !byRepo.has(repo) && !ambiguous.some((entry) => entry.key === repo)
+    ),
+    ambiguousConsumers: ambiguous.filter((entry) => consumerOrder.includes(entry.key))
+  };
 };
+var writeManifest = (manifest2) => writeFileSync(join(packageRoot, "versions.json"), `${JSON.stringify(manifest2, null, 2)}
+`);
 var workspacePackagePaths = (dir2, pkg) => {
   const raw = pkg.workspaces;
   const globs = Array.isArray(raw) ? raw : Array.isArray(raw?.packages) ? raw.packages : [];
@@ -407,22 +566,28 @@ function inspect(dir2, manifest2, presetOverride) {
       }
     }))
   ];
-  for (const [name, blessed] of Object.entries(manifest2.ecosystem)) {
-    for (const target of rangeTargets) {
-      if (name === target.pkg.name) continue;
-      for (const field of DEP_FIELDS) {
-        const deps = target.pkg[field];
-        const range = deps?.[name];
-        if (!range || range.startsWith("file:") || range.startsWith("link:")) continue;
+  const blessedSet = blessedVersions(manifest2);
+  const staleKeys = /* @__PURE__ */ new Set();
+  for (const target of rangeTargets) {
+    for (const field of DEP_FIELDS) {
+      const deps = target.pkg[field];
+      for (const [key, spec] of Object.entries(deps ?? {})) {
+        if (/^(file|link|workspace):/.test(spec)) continue;
+        const alias = npmAlias(spec);
+        const name = alias && !(key in blessedSet) ? alias.name : key;
+        const range = alias && name === alias.name ? alias.range : spec;
+        const blessed = blessedSet[name];
+        if (!blessed || name === target.pkg.name || !deps) continue;
+        const rewrite = (next) => name === key ? next : `npm:${name}@${next}`;
         const ok = admits(range, blessed);
         if (ok === false) {
           findings.push({
             level: "error",
             kind: "ecosystem-range",
             name,
-            message: `${target.label}${name} ${field} range ${range} does not admit blessed ${blessed} \u2192 ^${blessed}`,
+            message: `${target.label}${key} ${field} range ${spec} does not admit blessed ${blessed} \u2192 ${rewrite(`^${blessed}`)}`,
             fix: () => {
-              deps[name] = `^${blessed}`;
+              deps[key] = rewrite(`^${blessed}`);
               target.mark();
             }
           });
@@ -430,28 +595,28 @@ function inspect(dir2, manifest2, presetOverride) {
         if (ok === null) {
           findings.push({
             level: "warn",
-            message: `${target.label}${name} range ${range} not understood; verify manually against ${blessed}`
+            message: `${target.label}${key} range ${spec} not understood; verify manually against ${blessed}`
+          });
+        }
+        if (!lockText || field === "peerDependencies" || staleKeys.has(key)) continue;
+        const locked = lockedVersion(lockText, key, name);
+        if (locked && admits(range, locked) === false) {
+          staleKeys.add(key);
+          findings.push({
+            level: "error",
+            kind: "stale-lock",
+            name: key,
+            message: `${target.label}${key} locked at ${locked}, violating declared ${spec} (stale lockfile) \u2192 re-lock`
+          });
+        } else if (locked && locked !== blessed) {
+          staleKeys.add(key);
+          findings.push({
+            level: "error",
+            kind: "stale-lock",
+            name: key,
+            message: `${target.label}${key} locked at ${locked}, blessed is ${blessed} \u2192 re-lock`
           });
         }
-      }
-    }
-    const installed = pkg.dependencies?.[name] ?? pkg.devDependencies?.[name];
-    if (lockText && installed) {
-      const locked = lockedVersion(lockText, name);
-      if (locked && admits(installed, locked) === false) {
-        findings.push({
-          level: "error",
-          kind: "stale-lock",
-          name,
-          message: `${name} locked at ${locked}, violating declared ${installed} (stale lockfile) \u2192 re-lock`
-        });
-      } else if (locked && locked !== blessed) {
-        findings.push({
-          level: "error",
-          kind: "stale-lock",
-          name,
-          message: `${name} locked at ${locked}, blessed is ${blessed} \u2192 re-lock`
-        });
       }
     }
   }
@@ -535,16 +700,19 @@ var args = process.argv.slice(2);
 var command = args[0];
 var flags = new Set(args.filter((arg) => arg.startsWith("--")).map((arg) => arg.split("=")[0]));
 var presetFlag = args.find((arg) => arg.startsWith("--preset="))?.split("=")[1];
+var laneFlag = args.find((arg) => arg.startsWith("--lane="))?.split("=")[1];
 var positional = args.slice(1).filter((arg) => !arg.startsWith("--"));
 var dir = resolve(positional[0] ?? ".");
 var usage = () => {
   console.log(
-    "Usage: inixiative-config <check|sync|scan|train> [dir] [--preset=base|node|react] [--force] [--no-install]"
+    "Usage: inixiative-config <check|sync|scan|train> [dir] [--preset=base|node|react] [--lane=primitives|agentic] [--force] [--no-install] [--push]"
   );
   process.exit(2);
 };
 if (!["check", "sync", "scan", "train"].includes(command)) usage();
 if (presetFlag && !["base", "node", "react"].includes(presetFlag)) usage();
+if (laneFlag !== void 0 && !isLane(laneFlag)) usage();
+var lanes = laneFlag && isLane(laneFlag) ? [laneFlag] : [...LANES];
 var manifest = loadManifest();
 var report = (findings) => {
   for (const finding of findings) {
@@ -600,18 +768,21 @@ if (command === "check") {
   const { findings } = inspect(dir, manifest, presetFlag);
   process.exit(report(findings) > 0 ? 1 : 0);
 }
+var laneLabel = (checkout) => checkout.consumer ? `consumer of ${checkout.consumer.lanes.join(" + ")}` : `${checkout.lane} lane`;
 if (command === "scan") {
-  const repos = discoverRepos(dir, manifest);
-  if (repos.length === 0) {
+  const plan = trainPlan(dir, manifest, lanes);
+  const checkouts = [...plan.lanes.flatMap((lane) => lane.checkouts), ...plan.consumers];
+  if (checkouts.length === 0) {
     console.error(`\u2717 no ecosystem repos found under ${dir}`);
     process.exit(1);
   }
-  const missing = missingRepos(repos, manifest);
+  const missing = [...plan.lanes.flatMap((lane) => lane.missing), ...plan.missingConsumers];
+  const ambiguous = [...plan.lanes.flatMap((lane) => lane.ambiguous), ...plan.ambiguousConsumers];
   const drifted = [];
-  for (const repo of repos) {
+  for (const checkout of checkouts) {
     console.log(`
-${repo.name} \u2014 ${repo.dir}`);
-    const off = offDefaultBranch(repo.dir);
+${checkout.name} \u2014 ${checkout.dir} (${laneLabel(checkout)})`);
+    const off = offDefaultBranch(checkout.dir);
     const branchFindings = off ? [
       {
         level: "warn",
@@ -620,175 +791,280 @@ ${repo.name} \u2014 ${repo.dir}`);
     ] : [];
     const findings = [
       ...branchFindings,
-      ...staleCheckoutFindings(repo.dir),
-      ...inspect(repo.dir, manifest).findings
+      ...staleCheckoutFindings(checkout.dir),
+      ...inspect(checkout.dir, manifest).findings
     ];
-    if (report(findings) > 0) drifted.push(repo.name);
-    for (const branch of unmergedSessionBranches(repo.dir)) {
+    if (report(findings) > 0) drifted.push(checkout.name);
+    for (const branch of unmergedSessionBranches(checkout.dir)) {
       console.log(`\u26A0 unmerged session branch: ${branch}`);
     }
   }
   if (missing.length > 0) console.error(`
 \u2717 no checkout found for: ${missing.join(", ")}`);
+  for (const entry of ambiguous) {
+    console.error(`\u2717 ambiguous checkouts for ${entry.key}: ${entry.dirs.join(", ")}`);
+  }
   console.log(
     `
-scanned ${repos.length} repos: ${drifted.length === 0 ? "all in sync" : `${drifted.length} drifted (${drifted.join(", ")})`}${missing.length > 0 ? `, ${missing.length} missing` : ""}`
+scanned ${checkouts.length} repos (${lanes.join(" + ")}): ${drifted.length === 0 ? "all in sync" : `${drifted.length} drifted (${drifted.join(", ")})`}${missing.length > 0 ? `, ${missing.length} missing` : ""}${ambiguous.length > 0 ? `, ${ambiguous.length} ambiguous` : ""}`
   );
-  process.exit(drifted.length > 0 || missing.length > 0 ? 1 : 0);
+  process.exit(drifted.length > 0 || missing.length > 0 || ambiguous.length > 0 ? 1 : 0);
 }
+var Abort = class extends Error {
+};
 if (command === "train") {
-  const order = topoOrder(dir, manifest);
-  if (order.length === 0) {
-    console.error(`\u2717 no ecosystem repos found under ${dir}`);
-    process.exit(1);
-  }
-  const missing = missingRepos(order, manifest);
-  if (missing.length > 0) {
-    console.error(
-      `\u2717 no checkout under ${dir} for: ${missing.join(", ")} \u2014 a partial train ships an incoherent set`
-    );
-    process.exit(1);
-  }
   git(packageRoot, "fetch", "--quiet");
   if (behindOrigin(packageRoot) > 0) {
     console.error("\u2717 this config checkout is behind origin \u2014 its blessed set is stale; pull first");
     process.exit(1);
   }
-  console.log(`train order: ${order.map((repo) => repo.name).join(" \u2192 ")}`);
-  const published = [];
+  const plan = trainPlan(dir, manifest, lanes);
+  if (plan.lanes.every((lane) => lane.checkouts.length === 0) && plan.consumers.length === 0) {
+    console.error(`\u2717 no ecosystem repos found under ${dir}`);
+    process.exit(1);
+  }
+  const blessed = [];
   const skipped = [];
-  const committed = [];
+  const failed = [];
+  const committed = /* @__PURE__ */ new Set();
+  const reviewBranches = [];
   let bomDirty = false;
-  for (const repo of order) {
-    console.log(`
-\u25B8 ${repo.name} \u2014 ${repo.dir}`);
-    const porcelain = spawnSync2("git", ["status", "--porcelain"], {
-      cwd: repo.dir,
-      encoding: "utf8"
-    });
+  const ready = (checkout) => {
+    const porcelain = git(checkout.dir, "status", "--porcelain");
     if (porcelain.status !== 0) {
       console.log("\u26A0 not a git checkout \u2014 skipping");
-      skipped.push(repo.name);
-      continue;
+      return false;
     }
-    const off = offDefaultBranch(repo.dir);
+    const off = offDefaultBranch(checkout.dir);
     if (off) {
       console.log(
         `\u26A0 on ${off.branch}, not ${off.main} \u2014 the train only ships the default branch, skipping`
       );
-      skipped.push(repo.name);
-      continue;
+      return false;
     }
     if (porcelain.stdout.trim().length > 0) {
-      console.log("\u26A0 dirty working tree \u2014 commit or stash your work first, skipping");
-      skipped.push(repo.name);
-      continue;
+      console.log("\u26A0 dirty working tree \u2014 commit your work first, skipping");
+      return false;
     }
-    git(repo.dir, "fetch", "--quiet");
-    for (const branch of unmergedSessionBranches(repo.dir)) {
+    git(checkout.dir, "fetch", "--quiet");
+    for (const branch of unmergedSessionBranches(checkout.dir)) {
       console.log(`\u26A0 unmerged session branch: ${branch} \u2014 a bump may be hiding there`);
     }
-    const behind = behindOrigin(repo.dir);
+    const behind = behindOrigin(checkout.dir);
     if (behind > 0) {
-      const localOnly = git(repo.dir, "rev-list", "--count", "@{upstream}..HEAD");
+      const localOnly = git(checkout.dir, "rev-list", "--count", "@{upstream}..HEAD");
       if (localOnly.status === 0 && Number(localOnly.stdout.trim()) > 0) {
         console.log("\u26A0 diverged from origin \u2014 reconcile first, skipping");
-        skipped.push(repo.name);
-        continue;
+        return false;
       }
-      const ff = git(repo.dir, "merge", "--ff-only", "@{upstream}");
-      if (ff.status !== 0) {
+      if (git(checkout.dir, "merge", "--ff-only", "@{upstream}").status !== 0) {
         console.log("\u26A0 fast-forward to origin failed \u2014 reconcile first, skipping");
-        skipped.push(repo.name);
-        continue;
+        return false;
       }
       console.log(`\u2193 fast-forwarded to origin (+${behind})`);
-      repo.pkg = JSON.parse(readFileSync2(join2(repo.dir, "package.json"), "utf8"));
+      checkout.pkg = JSON.parse(readFileSync2(join2(checkout.dir, "package.json"), "utf8"));
     }
-    const inspection = inspect(repo.dir, manifest);
+    return true;
+  };
+  const bumpRanges = (checkout) => {
+    const inspection = inspect(checkout.dir, manifest);
     const bumps = inspection.findings.filter((finding) => finding.kind === "ecosystem-range");
     for (const bump of bumps) {
       console.log(`  ${bump.message}`);
       bump.fix?.();
     }
     inspection.flush();
-    const bumped = bumps.length > 0;
-    const staleLock = inspection.findings.some((finding) => finding.kind === "stale-lock");
-    const remote = spawnSync2("npm", ["view", `${repo.name}@latest`, "version"], {
-      encoding: "utf8"
+    return {
+      inspection,
+      bumped: bumps.length > 0,
+      staleLock: inspection.findings.some((finding) => finding.kind === "stale-lock")
+    };
+  };
+  const relockAndCheck = (checkout) => {
+    if (spawnSync2("bun", ["install"], { cwd: checkout.dir, stdio: "inherit" }).status !== 0) {
+      throw new Abort(`bun install failed in ${checkout.name}`);
+    }
+    const stale = inspect(checkout.dir, manifest).findings.filter((finding) => finding.kind === "stale-lock" && finding.name).map((finding) => finding.name);
+    if (stale.length > 0) {
+      spawnSync2("bun", ["update", ...new Set(stale)], { cwd: checkout.dir, stdio: "inherit" });
+    }
+    if (spawnSync2("bun", ["run", "check"], { cwd: checkout.dir, stdio: "inherit" }).status !== 0) {
+      throw new Abort(`check failed in ${checkout.name}`);
+    }
+  };
+  const commitOwned = (checkout, packagePaths) => {
+    const tracked = [...packagePaths, "bun.lock"];
+    const mutated = git(checkout.dir, "status", "--porcelain", "--", ...tracked);
+    if (mutated.status !== 0 || mutated.stdout.trim().length === 0) return false;
+    if (git(checkout.dir, "add", "--", ...tracked).status !== 0) {
+      throw new Abort(`git add failed in ${checkout.name} \u2014 is bun.lock ignored?`);
+    }
+    const commit = spawnSync2("git", ["commit", "-m", "chore: sync ecosystem deps to blessed set"], {
+      cwd: checkout.dir,
+      stdio: "inherit"
     });
-    const remoteVersion = remote.status === 0 ? remote.stdout.trim() : null;
-    const localVersion = repo.pkg.version ?? "0.0.0";
-    const ahead = remoteVersion === null || compare(localVersion, remoteVersion) > 0;
-    if (remoteVersion && compare(localVersion, remoteVersion) < 0) {
-      console.log(`\u26A0 local ${localVersion} is behind npm ${remoteVersion} \u2014 pull first, skipping`);
-      skipped.push(repo.name);
-      continue;
+    if (commit.status !== 0) throw new Abort(`commit failed in ${checkout.name}`);
+    return true;
+  };
+  const publish = (checkout, entry) => {
+    if (entry.path === "package.json") {
+      return spawnSync2("npm", ["publish"], { cwd: checkout.dir, stdio: "inherit" }).status === 0;
     }
-    if (bumped || ahead || staleLock) {
-      const install = spawnSync2("bun", ["install"], { cwd: repo.dir, stdio: "inherit" });
-      if (install.status !== 0) {
-        console.error("\u2717 bun install failed \u2014 aborting train");
-        process.exit(1);
+    const memberDir = join2(checkout.dir, dirname2(entry.path));
+    const out = mkdtempSync(join2(tmpdir(), "inixiative-train-"));
+    try {
+      const pack = spawnSync2("bun", ["pm", "pack", "--destination", out], {
+        cwd: memberDir,
+        stdio: "inherit"
+      });
+      const tarball = readdirSync2(out).find((name) => name.endsWith(".tgz"));
+      if (pack.status !== 0 || !tarball) return false;
+      return spawnSync2("npm", ["publish", join2(out, tarball)], { cwd: memberDir, stdio: "inherit" }).status === 0;
+    } finally {
+      rmSync2(out, { recursive: true, force: true });
+    }
+  };
+  const npmLatest = (name) => {
+    const remote = spawnSync2("npm", ["view", `${name}@latest`, "version"], { encoding: "utf8" });
+    return remote.status === 0 ? remote.stdout.trim() : null;
+  };
+  for (const { lane, checkouts, missing, ambiguous } of plan.lanes) {
+    console.log(
+      `
+\u2550 ${lane} lane: ${checkouts.map((checkout) => checkout.name).join(" \u2192 ") || "(none)"}`
+    );
+    const section = laneSection(manifest, lane);
+    const before = { ...section };
+    const laneBlessed = [];
+    try {
+      if (missing.length > 0) {
+        throw new Abort(
+          `no checkout under ${dir} for: ${missing.join(", ")} \u2014 a partial lane ships an incoherent set`
+        );
       }
-      const stale = inspect(repo.dir, manifest).findings.filter((finding) => finding.kind === "stale-lock" && finding.name).map((finding) => finding.name);
-      if (stale.length > 0) {
-        spawnSync2("bun", ["update", ...new Set(stale)], { cwd: repo.dir, stdio: "inherit" });
+      if (ambiguous.length > 0) {
+        throw new Abort(
+          ambiguous.map((entry) => `ambiguous checkouts for ${entry.key}: ${entry.dirs.join(", ")}`).join("; ")
+        );
       }
-      const check = spawnSync2("bun", ["run", "check"], { cwd: repo.dir, stdio: "inherit" });
-      if (check.status !== 0) {
-        console.error(`\u2717 check failed in ${repo.name} \u2014 aborting train`);
-        process.exit(1);
+      for (const checkout of checkouts) {
+        console.log(`
+\u25B8 ${checkout.name} \u2014 ${checkout.dir}`);
+        if (!ready(checkout)) {
+          skipped.push(checkout.name);
+          continue;
+        }
+        const { inspection, bumped, staleLock } = bumpRanges(checkout);
+        const releases = checkout.packages.map((entry) => {
+          const local = JSON.parse(readFileSync2(join2(checkout.dir, entry.path), "utf8")).version ?? "0.0.0";
+          const remote = npmLatest(entry.name);
+          return { entry, local, remote, ahead: remote === null || compare(local, remote) > 0 };
+        });
+        const behind = releases.find(
+          (release) => release.remote && compare(release.local, release.remote) < 0
+        );
+        if (behind) {
+          console.log(
+            `\u26A0 ${behind.entry.name} local ${behind.local} is behind npm ${behind.remote} \u2014 pull first, skipping`
+          );
+          skipped.push(checkout.name);
+          continue;
+        }
+        if (bumped || staleLock || releases.some((release) => release.ahead))
+          relockAndCheck(checkout);
+        if (commitOwned(checkout, inspection.packagePaths)) committed.add(checkout.dir);
+        for (const { entry, local, remote, ahead } of releases) {
+          if (ahead) {
+            console.log(`publishing ${entry.name}@${local} (npm has ${remote ?? "none"})`);
+            if (!publish(checkout, entry)) throw new Abort(`publish failed for ${entry.name}`);
+            if (!servedByRegistry(entry.name, local)) {
+              throw new Abort(
+                `npm accepted ${entry.name}@${local} but the registry does not serve it`
+              );
+            }
+          } else if (section[entry.name] === local) {
+            console.log(`\u2713 ${entry.name}@${local} already on npm and blessed`);
+            continue;
+          } else {
+            console.log(`\u2713 ${entry.name}@${local} already on npm \u2014 blessing it`);
+          }
+          section[entry.name] = local;
+          laneBlessed.push(`${entry.name}@${local}`);
+        }
       }
-    }
-    const tracked = [...inspection.packagePaths, "bun.lock"];
-    const mutated = spawnSync2("git", ["status", "--porcelain", "--", ...tracked], {
-      cwd: repo.dir,
-      encoding: "utf8"
-    });
-    if (mutated.status === 0 && mutated.stdout.trim().length > 0) {
-      spawnSync2("git", ["add", "--", ...tracked], { cwd: repo.dir });
-      const commit = spawnSync2(
-        "git",
-        ["commit", "-m", "chore: sync ecosystem deps to blessed set"],
-        { cwd: repo.dir, stdio: "inherit" }
+      if (laneBlessed.length > 0) {
+        writeManifest(manifest);
+        bomDirty = true;
+        blessed.push(...laneBlessed);
+      }
+      console.log(
+        `${lane} lane blessed: ${laneBlessed.length === 0 ? "nothing new" : laneBlessed.join(", ")}`
       );
-      if (commit.status !== 0) {
-        console.error(`\u2717 commit failed in ${repo.name} \u2014 aborting train`);
-        process.exit(1);
+    } catch (error) {
+      if (!(error instanceof Abort)) throw error;
+      for (const name of Object.keys(section)) delete section[name];
+      Object.assign(section, before);
+      failed.push(`${lane} lane`);
+      console.error(`\u2717 ${error.message} \u2014 ${lane} lane stopped; its BOM entries are unchanged`);
+      if (laneBlessed.length > 0) {
+        console.error(
+          `  published but not blessed: ${laneBlessed.join(", ")} \u2014 the next train blesses them`
+        );
       }
-      committed.push(repo.dir);
     }
-    if (ahead) {
-      console.log(`publishing ${repo.name}@${localVersion} (npm has ${remoteVersion ?? "none"})`);
-      const publish = spawnSync2("npm", ["publish"], { cwd: repo.dir, stdio: "inherit" });
-      if (publish.status !== 0) {
-        console.error(`\u2717 publish failed for ${repo.name} \u2014 aborting train`);
-        process.exit(1);
+  }
+  if (plan.consumers.length > 0 || plan.missingConsumers.length > 0) {
+    console.log(
+      `
+\u2550 consumers: ${plan.consumers.map((checkout) => checkout.name).join(" \u2192 ") || "(none)"}`
+    );
+  }
+  for (const repo of plan.missingConsumers) {
+    console.error(`\u2717 no checkout under ${dir} for consumer ${repo}`);
+    failed.push(repo);
+  }
+  for (const entry of plan.ambiguousConsumers) {
+    console.error(`\u2717 ambiguous checkouts for consumer ${entry.key}: ${entry.dirs.join(", ")}`);
+    failed.push(entry.key);
+  }
+  for (const checkout of plan.consumers) {
+    console.log(`
+\u25B8 ${checkout.name} \u2014 ${checkout.dir} (${laneLabel(checkout)})`);
+    if (!ready(checkout)) {
+      skipped.push(checkout.name);
+      continue;
+    }
+    try {
+      const { inspection, bumped, staleLock } = bumpRanges(checkout);
+      if (!bumped && !staleLock) {
+        console.log("\u2713 already on the blessed set");
+        continue;
       }
-      if (!servedByRegistry(repo.name, localVersion)) {
-        console.error(
-          `\u2717 npm accepted ${repo.name}@${localVersion} but the registry does not serve it \u2014 aborting train`
-        );
-        process.exit(1);
+      relockAndCheck(checkout);
+      const base = offDefaultBranch(checkout.dir)?.main ?? currentBranch(checkout.dir);
+      const branch = freeBranch(
+        checkout.dir,
+        `train/ecosystem-sync-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`
+      );
+      if (git(checkout.dir, "switch", "-c", branch).status !== 0) {
+        throw new Abort(`could not create ${branch} in ${checkout.name}`);
       }
-      committed.push(repo.dir);
-      manifest.ecosystem[repo.name] = localVersion;
-      writeManifest(manifest);
-      bomDirty = true;
-      published.push(`${repo.name}@${localVersion}`);
-    } else {
-      console.log(`\u2713 ${repo.name}@${localVersion} already on npm`);
+      if (commitOwned(checkout, inspection.packagePaths)) {
+        reviewBranches.push({ dir: checkout.dir, branch, base });
+        console.log(`committed on ${branch} for review; the checkout stays on it until merged`);
+      }
+    } catch (error) {
+      if (!(error instanceof Abort)) throw error;
+      failed.push(checkout.name);
+      console.error(`\u2717 ${error.message} \u2014 its working tree is left as is for inspection`);
     }
   }
   console.log(`
-published: ${published.length === 0 ? "nothing" : published.join(", ")}`);
+blessed: ${blessed.length === 0 ? "nothing" : blessed.join(", ")}`);
   if (skipped.length > 0) console.log(`skipped: ${skipped.join(", ")}`);
+  if (failed.length > 0) console.log(`failed: ${failed.join(", ")}`);
   if (bomDirty) {
-    const remote = spawnSync2("npm", ["view", "@inixiative/config@latest", "version"], {
-      encoding: "utf8"
-    });
-    const remoteVersion = remote.status === 0 ? remote.stdout.trim() : null;
+    const remoteVersion = npmLatest("@inixiative/config");
     let version = ownVersion();
     if (remoteVersion !== null && compare(version, remoteVersion) <= 0) {
       version = bumpPatch(remoteVersion);
@@ -816,38 +1092,59 @@ published: ${published.length === 0 ? "nothing" : published.join(", ")}`);
     });
     const commit = spawnSync2(
       "git",
-      ["commit", "-m", `chore: bless ${published.join(", ")} \u2014 ${version}`],
-      {
-        cwd: packageRoot,
-        stdio: "inherit"
-      }
+      ["commit", "-m", `chore: bless ${blessed.join(", ")} \u2014 ${version}`],
+      { cwd: packageRoot, stdio: "inherit" }
     );
     if (commit.status !== 0) {
       console.error("\u2717 commit failed in @inixiative/config \u2014 aborting before publish");
       process.exit(1);
     }
-    const publish = spawnSync2("npm", ["publish"], { cwd: packageRoot, stdio: "inherit" });
-    if (publish.status !== 0 || !servedByRegistry("@inixiative/config", version)) {
+    const publish2 = spawnSync2("npm", ["publish"], { cwd: packageRoot, stdio: "inherit" });
+    if (publish2.status !== 0 || !servedByRegistry("@inixiative/config", version)) {
       console.error("\u2717 publish failed for @inixiative/config");
       process.exit(1);
     }
-    committed.push(packageRoot);
+    committed.add(packageRoot);
     console.log(`published: @inixiative/config@${version} \u2014 the BOM names the new state`);
   }
   if (flags.has("--push")) {
     for (const repoDir of committed) {
-      const push = spawnSync2("git", ["push"], { cwd: repoDir, stdio: "inherit" });
-      if (push.status !== 0) {
+      if (spawnSync2("git", ["push"], { cwd: repoDir, stdio: "inherit" }).status !== 0) {
         console.error(`\u2717 push failed in ${repoDir}`);
         process.exit(1);
       }
     }
-    console.log(`pushed: ${committed.length} repo${committed.length === 1 ? "" : "s"}`);
-  } else if (committed.length > 0) {
+    for (const { dir: repoDir, branch, base } of reviewBranches) {
+      const push = spawnSync2("git", ["push", "-u", "origin", branch], {
+        cwd: repoDir,
+        stdio: "inherit"
+      });
+      const pr = push.status === 0 && spawnSync2("gh", ["pr", "create", "--fill", "--base", base, "--head", branch], {
+        cwd: repoDir,
+        stdio: "inherit"
+      }).status === 0;
+      if (!pr) console.error(`\u2717 could not push ${branch} and open its PR in ${repoDir}`);
+    }
+    console.log(`pushed: ${committed.size + reviewBranches.length} repos`);
+  } else if (committed.size > 0 || reviewBranches.length > 0) {
     console.log("train does not push without --push \u2014 review its commits, then push:");
     for (const repoDir of committed) console.log(`  git -C ${repoDir} push`);
+    for (const { dir: repoDir, branch, base } of reviewBranches) {
+      console.log(
+        `  git -C ${repoDir} push -u origin ${branch} && (cd ${repoDir} && gh pr create --fill --base ${base})`
+      );
+    }
   }
-  process.exit(0);
+  process.exit(failed.length > 0 ? 1 : 0);
+}
+function currentBranch(cwd) {
+  return git(cwd, "rev-parse", "--abbrev-ref", "HEAD").stdout.trim();
+}
+function freeBranch(cwd, name) {
+  const taken = (candidate2) => git(cwd, "rev-parse", "--verify", "--quiet", `refs/heads/${candidate2}`).status === 0;
+  let candidate = name;
+  for (let n = 2; taken(candidate); n++) candidate = `${name}-${n}`;
+  return candidate;
 }
 function servedByRegistry(name, version) {
   for (let attempt = 0; attempt < 10; attempt++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/config",
-  "version": "0.5.35",
+  "version": "0.5.36",
   "description": "Shared toolchain for the inixiative ecosystem: tsconfig/biome/tsup presets, a version manifest (BOM), and a sync/check CLI",
   "type": "module",
   "license": "MIT",

package/versions.json

@@ -13,7 +13,7 @@
     "@types/bun"
   ],
   "ecosystem": {
-    "@inixiative/config": "0.5.35",
+    "@inixiative/config": "0.5.36",
     "@inixiative/json-rules": "2.25.0",
     "@inixiative/permissions": "0.3.2",
     "@inixiative/transitions": "0.1.0",
@@ -22,5 +22,29 @@
     "@inixiative/atlas": "0.1.1",
     "@inixiative/gloss": "0.0.4",
     "@inixiative/archive": "0.2.1"
+  },
+  "agentic": {
+    "@inixiative/agent-session": "0.2.0",
+    "@inixiative/foundry-core": "0.1.0",
+    "@inixiative/foundry": "0.1.0"
+  },
+  "consumers": {
+    "inixiative/template": {
+      "lanes": [
+        "primitives"
+      ]
+    },
+    "inixiative/kingdom": {
+      "lanes": [
+        "primitives",
+        "agentic"
+      ],
+      "upstream": "inixiative/template"
+    },
+    "inixiative/oracle": {
+      "lanes": [
+        "agentic"
+      ]
+    }
   }
 }