@inixiative/config 0.5.35 → 0.5.37

package/README.md

@@ -40,7 +40,19 @@ One version of `@inixiative/config` names one coherent ecosystem state:
 - `bun` — blessed runtime, written to `.bun-version` and `packageManager`
 - `toolchain` — exact pins for `@biomejs/biome`, `typescript`, `tsup`, `@types/bun`
 - `required` — toolchain packages every repo must carry
-- `ecosystem` — the blessed, mutually-verified `@inixiative/*` set
+- `ecosystem` — the primitives lane's blessed, mutually-verified `@inixiative/*` set, plus this package
+- `agentic` — the agentic lane's blessed set
+- `consumers` — private repos that follow the blessed sets but never publish, keyed by GitHub `owner/repo`: `lanes` names the lanes each consumes, `upstream` the repo it syncs from
+
+```jsonc
+"consumers": {
+  "inixiative/template": { "lanes": ["primitives"] },
+  "inixiative/kingdom": { "lanes": ["primitives", "agentic"], "upstream": "inixiative/template" },
+  "inixiative/oracle": { "lanes": ["agentic"] }
+}
+```
+
+A lane is a release cascade with its own blessed set. `primitives` (json-rules, permissions, transitions, rules-builder, prisma-map, atlas, gloss, archive) ships first; `agentic` (agent-session → foundry-core → foundry) builds on the primitives' blessed set and never the reverse. `check` holds every repo to the union of all lanes, so a repo that mixes both answers to both.
 
 TypeScript 6.0 notes, discovered by this repo's fixture suite:
 
@@ -52,17 +64,23 @@ TypeScript 6.0 notes, discovered by this repo's fixture suite:
 ```
 bunx @inixiative/config check [dir] [--preset=base|node|react]
 bunx @inixiative/config sync  [dir] [--preset=...] [--force] [--no-install]
-bunx @inixiative/config scan  [root]
-bunx @inixiative/config train [root]
+bunx @inixiative/config scan  [root] [--lane=primitives|agentic]
+bunx @inixiative/config train [root] [--lane=primitives|agentic] [--push]
 ```
 
-`check` is read-only and exits non-zero on drift — run it in CI after a frozen-lockfile install. It verifies toolchain pins, `"latest"` ranges, `packageManager`/`.bun-version`, legacy `bun.lockb`, a committed (tracked, un-ignored) `bun.lock`, required scripts (`check`/`typecheck`/`lint`/`test`), lefthook (dep + `lefthook.yml` extending the shared hooks + `prepare` script; git repos only), stub `extends`, presence of this package, and for every ecosystem dependency that the declared range admits the blessed version and the lockfile actually resolves to it (the stale-lockfile class).
+`check` is read-only and exits non-zero on drift — run it in CI after a frozen-lockfile install. It verifies toolchain pins, `"latest"` ranges, `packageManager`/`.bun-version`, legacy `bun.lockb`, a committed (tracked, un-ignored) `bun.lock`, required scripts (`check`/`typecheck`/`lint`/`test`), lefthook (dep + `lefthook.yml` extending the shared hooks + `prepare` script; git repos only), stub `extends`, presence of this package, and for every ecosystem dependency — in the root or any workspace member, of either lane — that the declared range admits the blessed version and the lockfile actually resolves to it (the stale-lockfile class). An npm alias (`"@inixiative/session-archive": "npm:@inixiative/archive@^0.2.1"`) is held to its target's blessed version and rewritten as an alias; `workspace:`, `file:` and `link:` ranges are a repo linking itself and are left alone.
 
 `sync` applies every fix, re-locks via `bun install`, and runs `bun update` on stale ecosystem entries. It refuses to run on a dirty working tree without `--force`. The react preset is inferred from a `react` dependency; override with `--preset`. Missing scripts are filled with defaults; existing script bodies are never touched.
 
-`scan` runs `check` across every ecosystem checkout under a root directory. Targets are derived from the BOM's `ecosystem` keys and matched by package name, so directory names and local layout never need declaring. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, warns when a checkout sits on a non-default branch (its findings describe the branch, not what ships), and surfaces unmerged `claude/*` session branches.
+`scan` runs `check` across every ecosystem checkout under a root directory, for every lane or just the one `--lane` names. Targets are derived from the BOM: lane packages match by package name — the root package or any workspace member, so a monorepo such as foundry is found by the packages it publishes — and consumers match by their `origin` GitHub repo. Directory names and local layout never need declaring: scan looks at each child of the root and one level into a child without a `package.json` (a workspace folder such as `kingdom-workspace/`). Linked git worktrees are other sessions' branches and never targets; when several clones claim one package or repo, only those with an `origin` remote count, and if that still leaves more than one the target is reported ambiguous rather than guessed. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, warns when a checkout sits on a non-default branch (its findings describe the branch, not what ships), and surfaces unmerged `claude/*` session branches.
+
+`train` is the release cascade, run from this repo's checkout. It walks every lane in order (primitives, then agentic), or only the lane `--lane` names. Origin is the truth: it refuses to run from a config checkout behind origin, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It only ships the default branch: a checkout on a feature branch is skipped whole — never re-locked, committed to, or published from.
 
-`train` is the release cascade, run from this repo's checkout. Origin is the truth: it refuses to run from a config checkout behind origin or with any BOM repo missing a checkout, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It only ships the default branch: a checkout on a feature branch is skipped whole — never re-locked, committed to, or published from. It walks the ecosystem in dependency order; per repo it: bumps ecosystem ranges to the BOM → re-locks → runs the repo's `check` → commits only its own changes (`package.json` + `bun.lock`) → publishes via `npm publish` when the local version is ahead of npm (OTP prompts pass through) and waits until the registry serves that version → records it in the BOM. When anything was published it then ships this package last, so the BOM names the new state: bumps its own patch version if npm already has the current one, blesses that version in the BOM, brings the `test/fixtures` consumers onto the blessed set, runs `check`, commits, publishes. It never pushes unless asked: pass `--push` to push every repo it committed to, otherwise it prints the `git push` for each.
+Lanes stand alone. A lane with a package missing a checkout, or claimed by ambiguous checkouts, does not run; a lane whose check, commit or publish fails stops there and leaves its BOM entries as they were. Neither holds back the other lane. Within a lane it walks checkouts in dependency order; per checkout it: bumps ecosystem ranges to the blessed sets → re-locks → runs the repo's `check` → commits only its own changes (`package.json` files + `bun.lock`) → publishes each lane package whose local version is ahead of npm, in dependency order, and waits until the registry serves it (up to 15 minutes, since npm holds new versions for processing) → records it in its lane's section of the BOM. A root package publishes with `npm publish`; a workspace member is packed with `bun pm pack`, which rewrites `workspace:` ranges to the versions being released, and the tarball is published with `npm publish`, so OTP prompts pass through either way. A package already on npm at its local version but not yet blessed — published by hand, or by a train whose lane later failed — is blessed on the next run.
+
+Consumers run once, after every selected lane, upstreams first, against the full blessed set: a consumer of both lanes ends coherent with both whichever lane ran. They get the same bump → re-lock → `check`, never a publish, and their changes go through review: the train commits them on a `train/ecosystem-sync-<date>` branch and leaves the checkout there until it is merged.
+
+When anything was blessed it then ships this package last, so the BOM names the new state: bumps its own patch version if npm already has the current one, blesses that version in the BOM, brings the `test/fixtures` consumers onto the blessed set, runs `check`, commits, publishes. It never pushes unless asked: pass `--push` to push every repo it committed to and open a PR for each consumer branch; otherwise it prints the commands.
 
 Division of labor: this CLI owns the toolchain set, ecosystem coherence, stubs, and lockfile format. Renovate owns everything else plus bumping `@inixiative/config` itself, and must be fenced off the toolchain packages.
 
@@ -85,4 +103,9 @@ jobs:
 
 ## Release flow
 
-Publishing moves in dependency order (for example, json-rules → permissions → transitions → rules-builder), with config last. Archive is included in the ecosystem BOM and release train as a standalone MIT-licensed package. `train` automates the whole walk, this package included. Downstream repos pick it up via `sync`.
+Two lanes, each publishing in dependency order, with config last:
+
+- **primitives** — for example json-rules → permissions → transitions → rules-builder, plus prisma-map, atlas, gloss and archive (a standalone MIT package). Consumers: template, kingdom.
+- **agentic** — agent-session → foundry-core → foundry, built on the primitives' blessed set. foundry-core and foundry publish from the foundry monorepo's `packages/core` and `packages/foundry`. Consumers: oracle (a private leaf), kingdom.
+
+A release is `train` (or `train --lane=agentic` to leave the primitives alone): bump the package's version on its default branch, then run the train. `train` automates the whole walk, this package and the consumer PRs included. Downstream repos pick up toolchain changes via `sync`.

package/dist/cli.js

@@ -2,15 +2,55 @@
 
 // src/cli.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join2, resolve } from "path";
+import { existsSync as existsSync2, mkdtempSync, readdirSync as readdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir } from "os";
+import { dirname as dirname2, join as join2, resolve } from "path";
 
 // src/lib.ts
 import { spawnSync } from "child_process";
-import { existsSync, globSync, readdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import {
+  existsSync,
+  globSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "fs";
 import { dirname, join, sep } from "path";
 import { fileURLToPath } from "url";
 var packageRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+var LANES = ["primitives", "agentic"];
+var isLane = (value) => LANES.includes(value);
+var lanePackages = (manifest2, lane) => {
+  const section = lane === "primitives" ? manifest2.ecosystem : manifest2.agentic ?? {};
+  const { "@inixiative/config": _config, ...packages } = section;
+  return packages;
+};
+var laneSection = (manifest2, lane) => {
+  if (lane === "primitives") return manifest2.ecosystem;
+  manifest2.agentic ??= {};
+  return manifest2.agentic;
+};
+var blessedVersions = (manifest2) => ({
+  ...manifest2.ecosystem,
+  ...manifest2.agentic
+});
+var consumersFor = (manifest2, lanes2) => {
+  const consumers = manifest2.consumers ?? {};
+  const selected = Object.keys(consumers).filter((repo) => consumers[repo].lanes.some((lane) => lanes2.includes(lane))).sort();
+  const order = [];
+  const visit = (repo, trail) => {
+    if (order.includes(repo)) return;
+    if (trail.includes(repo))
+      throw new Error(`consumer upstream cycle: ${[...trail, repo].join(" \u2192 ")}`);
+    const upstream = consumers[repo].upstream;
+    if (upstream && selected.includes(upstream)) visit(upstream, [...trail, repo]);
+    order.push(repo);
+  };
+  for (const repo of selected) visit(repo, []);
+  return order;
+};
 var REQUIRED_SCRIPTS = {
   typecheck: "tsc --noEmit",
   lint: "biome check .",
@@ -107,65 +147,184 @@ var admits = (range, version) => {
   }
   return vMajor === major && vMinor === minor;
 };
-var lockedVersion = (lockText, name) => {
+var lockedVersion = (lockText, key, target = key) => {
   const lock = tryParseJsonc(lockText);
   const packages = lock?.packages;
   if (!packages || typeof packages !== "object") return null;
-  const entry = packages[name];
+  const entry = packages[key];
   const spec = Array.isArray(entry) ? entry[0] : null;
-  if (typeof spec !== "string" || !spec.startsWith(`${name}@`)) return null;
-  const version = spec.slice(name.length + 1);
+  if (typeof spec !== "string" || !spec.startsWith(`${target}@`)) return null;
+  const version = spec.slice(target.length + 1);
   return /^\d/.test(version) ? version : null;
 };
-var topoOrder = (root, manifest2) => {
-  const repos = discoverRepos(root, manifest2).map((repo) => ({
-    ...repo,
-    pkg: JSON.parse(readFileSync(join(repo.dir, "package.json"), "utf8"))
-  }));
-  const names = new Set(repos.map((repo) => repo.name));
-  const dependsOn = /* @__PURE__ */ new Map();
-  for (const repo of repos) {
-    const edges = /* @__PURE__ */ new Set();
+var npmAlias = (spec) => {
+  const match = spec.match(/^npm:((?:@[^/@]+\/)?[^@]+)@(.+)$/);
+  return match ? { name: match[1], range: match[2] } : null;
+};
+var readJson = (path) => {
+  try {
+    return tryParseJsonc(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+};
+var originRepo = (dir2) => {
+  const url = spawnSync("git", ["remote", "get-url", "origin"], { cwd: dir2, encoding: "utf8" });
+  if (url.status !== 0) return null;
+  const match = url.stdout.trim().match(/github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?\/?$/);
+  return match ? match[1] : null;
+};
+var isLinkedWorktree = (dir2) => {
+  const dotGit = join(dir2, ".git");
+  return existsSync(dotGit) && !statSync(dotGit).isDirectory();
+};
+var childDirs = (dir2) => readdirSync(dir2, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).filter((entry) => entry.name !== "node_modules").map((entry) => join(dir2, entry.name));
+var candidateDirs = (root) => {
+  const dirs = [];
+  for (const child of childDirs(root)) {
+    const nested = existsSync(join(child, "package.json")) ? [child] : childDirs(child).filter((dir2) => existsSync(join(dir2, "package.json")));
+    dirs.push(...nested.filter((dir2) => !isLinkedWorktree(dir2)));
+  }
+  return dirs;
+};
+var discover = (root, manifest2, lanes2 = LANES) => {
+  const wanted = /* @__PURE__ */ new Map();
+  for (const lane of lanes2) {
+    for (const name of Object.keys(lanePackages(manifest2, lane))) wanted.set(name, lane);
+  }
+  const consumerRepos = new Set(consumersFor(manifest2, lanes2));
+  const claims = /* @__PURE__ */ new Map();
+  const claim = (key, checkout) => claims.set(key, [...claims.get(key) ?? [], checkout]);
+  for (const dir2 of candidateDirs(root)) {
+    const pkg = readJson(join(dir2, "package.json"));
+    if (!pkg) continue;
+    const name = typeof pkg.name === "string" ? pkg.name : dir2;
+    const provided = [
+      { name: pkg.name, path: "package.json" },
+      ...workspacePackagePaths(dir2, pkg).map((path) => ({
+        name: readJson(join(dir2, path))?.name,
+        path
+      }))
+    ].filter(
+      (entry) => typeof entry.name === "string" && wanted.has(entry.name)
+    );
+    if (provided.length > 0) {
+      const checkout = {
+        dir: dir2,
+        name,
+        pkg,
+        lane: wanted.get(provided[0].name),
+        packages: provided
+      };
+      for (const entry of provided) claim(entry.name, checkout);
+      continue;
+    }
+    if (consumerRepos.size === 0 || !existsSync(join(dir2, ".git"))) continue;
+    const repo = originRepo(dir2);
+    if (repo && consumerRepos.has(repo)) {
+      const consumer = manifest2.consumers[repo];
+      claim(repo, { dir: dir2, name, pkg, lane: null, packages: [], consumer: { repo, ...consumer } });
+    }
+  }
+  const chosen = /* @__PURE__ */ new Map();
+  const ambiguous = [];
+  for (const [key, candidates] of claims) {
+    const pool = candidates.length > 1 ? candidates.filter((candidate) => originRepo(candidate.dir)) : candidates;
+    if (pool.length === 1) chosen.set(pool[0].dir, pool[0]);
+    else ambiguous.push({ key, dirs: candidates.map((candidate) => candidate.dir).sort() });
+  }
+  const ambiguousDirs = new Set(ambiguous.flatMap((entry) => entry.dirs));
+  const checkouts = [...chosen.values()].filter((checkout) => !ambiguousDirs.has(checkout.dir)).map((checkout) => ({ ...checkout, packages: publishOrder(checkout) })).sort((a, b) => a.name.localeCompare(b.name));
+  return { checkouts, ambiguous: ambiguous.sort((a, b) => a.key.localeCompare(b.key)) };
+};
+var dependencyNames = (dir2, paths) => {
+  const names = /* @__PURE__ */ new Set();
+  for (const path of paths) {
+    const pkg = readJson(join(dir2, path));
     for (const field of DEP_FIELDS) {
-      for (const dep of Object.keys(repo.pkg[field] ?? {})) {
-        if (names.has(dep) && dep !== repo.name) edges.add(dep);
+      for (const [key, spec] of Object.entries(pkg?.[field] ?? {})) {
+        names.add(key);
+        const alias = npmAlias(spec);
+        if (alias) names.add(alias.name);
       }
     }
-    dependsOn.set(repo.name, edges);
   }
+  return names;
+};
+var orderBy = (items, key, deps) => {
   const order = [];
   const done = /* @__PURE__ */ new Set();
-  while (done.size < repos.length) {
-    const ready = repos.filter(
-      (repo) => !done.has(repo.name) && [...dependsOn.get(repo.name)].every((dep) => done.has(dep))
-    ).sort((a, b) => a.name.localeCompare(b.name));
+  while (done.size < items.length) {
+    const ready = items.filter((item) => !done.has(key(item)) && deps(item).every((dep) => done.has(dep))).sort((a, b) => key(a).localeCompare(key(b)));
     if (ready.length === 0) throw new Error("dependency cycle among ecosystem repos");
-    for (const repo of ready) {
-      order.push(repo);
-      done.add(repo.name);
+    for (const item of ready) {
+      order.push(item);
+      done.add(key(item));
     }
   }
   return order;
 };
-var writeManifest = (manifest2) => writeFileSync(join(packageRoot, "versions.json"), `${JSON.stringify(manifest2, null, 2)}
-`);
-var discoverRepos = (root, manifest2) => {
-  const repos = [];
-  for (const entry of readdirSync(root)) {
-    const pkgPath = join(root, entry, "package.json");
-    if (!existsSync(pkgPath)) continue;
-    const name = tryParseJsonc(readFileSync(pkgPath, "utf8"))?.name;
-    if (typeof name === "string" && name in manifest2.ecosystem && name !== "@inixiative/config")
-      repos.push({ dir: join(root, entry), name });
-  }
-  return repos.sort((a, b) => a.name.localeCompare(b.name));
+var publishOrder = (checkout) => {
+  const names = new Set(checkout.packages.map((entry) => entry.name));
+  const deps = new Map(
+    checkout.packages.map((entry) => [
+      entry.name,
+      [...dependencyNames(checkout.dir, [entry.path])].filter(
+        (dep) => names.has(dep) && dep !== entry.name
+      )
+    ])
+  );
+  return orderBy(
+    checkout.packages,
+    (entry) => entry.name,
+    (entry) => deps.get(entry.name) ?? []
+  );
 };
-var missingRepos = (repos, manifest2) => {
-  const found = new Set(repos.map((repo) => repo.name));
-  return Object.keys(manifest2.ecosystem).filter(
-    (name) => name !== "@inixiative/config" && !found.has(name)
+var topoOrder = (checkouts) => {
+  const publishing = checkouts.filter((checkout) => !checkout.consumer);
+  const owner = /* @__PURE__ */ new Map();
+  for (const checkout of publishing) {
+    for (const entry of checkout.packages) owner.set(entry.name, checkout.dir);
+  }
+  return orderBy(
+    publishing,
+    (checkout) => checkout.dir,
+    (checkout) => {
+      const paths = ["package.json", ...workspacePackagePaths(checkout.dir, checkout.pkg)];
+      return [...dependencyNames(checkout.dir, paths)].map((dep) => owner.get(dep)).filter((dir2) => !!dir2 && dir2 !== checkout.dir);
+    }
   );
 };
+var trainPlan = (root, manifest2, lanes2 = LANES) => {
+  const { checkouts, ambiguous } = discover(root, manifest2, lanes2);
+  const consumerOrder = consumersFor(manifest2, lanes2);
+  const byRepo = new Map(
+    checkouts.flatMap(
+      (checkout) => checkout.consumer ? [[checkout.consumer.repo, checkout]] : []
+    )
+  );
+  return {
+    lanes: LANES.filter((lane) => lanes2.includes(lane)).map((lane) => {
+      const names = new Set(Object.keys(lanePackages(manifest2, lane)));
+      const own = checkouts.filter((checkout) => checkout.lane === lane);
+      return {
+        lane,
+        checkouts: topoOrder(own),
+        missing: [...names].filter(
+          (name) => !own.some((checkout) => checkout.packages.some((entry) => entry.name === name)) && !ambiguous.some((entry) => entry.key === name)
+        ),
+        ambiguous: ambiguous.filter((entry) => names.has(entry.key))
+      };
+    }),
+    consumers: consumerOrder.flatMap((repo) => byRepo.get(repo) ?? []),
+    missingConsumers: consumerOrder.filter(
+      (repo) => !byRepo.has(repo) && !ambiguous.some((entry) => entry.key === repo)
+    ),
+    ambiguousConsumers: ambiguous.filter((entry) => consumerOrder.includes(entry.key))
+  };
+};
+var writeManifest = (manifest2) => writeFileSync(join(packageRoot, "versions.json"), `${JSON.stringify(manifest2, null, 2)}
+`);
 var workspacePackagePaths = (dir2, pkg) => {
   const raw = pkg.workspaces;
   const globs = Array.isArray(raw) ? raw : Array.isArray(raw?.packages) ? raw.packages : [];
@@ -407,22 +566,28 @@ function inspect(dir2, manifest2, presetOverride) {
       }
     }))
   ];
-  for (const [name, blessed] of Object.entries(manifest2.ecosystem)) {
-    for (const target of rangeTargets) {
-      if (name === target.pkg.name) continue;
-      for (const field of DEP_FIELDS) {
-        const deps = target.pkg[field];
-        const range = deps?.[name];
-        if (!range || range.startsWith("file:") || range.startsWith("link:")) continue;
+  const blessedSet = blessedVersions(manifest2);
+  const staleKeys = /* @__PURE__ */ new Set();
+  for (const target of rangeTargets) {
+    for (const field of DEP_FIELDS) {
+      const deps = target.pkg[field];
+      for (const [key, spec] of Object.entries(deps ?? {})) {
+        if (/^(file|link|workspace):/.test(spec)) continue;
+        const alias = npmAlias(spec);
+        const name = alias && !(key in blessedSet) ? alias.name : key;
+        const range = alias && name === alias.name ? alias.range : spec;
+        const blessed = blessedSet[name];
+        if (!blessed || name === target.pkg.name || !deps) continue;
+        const rewrite = (next) => name === key ? next : `npm:${name}@${next}`;
         const ok = admits(range, blessed);
         if (ok === false) {
           findings.push({
             level: "error",
             kind: "ecosystem-range",
             name,
-            message: `${target.label}${name} ${field} range ${range} does not admit blessed ${blessed} \u2192 ^${blessed}`,
+            message: `${target.label}${key} ${field} range ${spec} does not admit blessed ${blessed} \u2192 ${rewrite(`^${blessed}`)}`,
             fix: () => {
-              deps[name] = `^${blessed}`;
+              deps[key] = rewrite(`^${blessed}`);
               target.mark();
             }
           });
@@ -430,28 +595,28 @@ function inspect(dir2, manifest2, presetOverride) {
         if (ok === null) {
           findings.push({
             level: "warn",
-            message: `${target.label}${name} range ${range} not understood; verify manually against ${blessed}`
+            message: `${target.label}${key} range ${spec} not understood; verify manually against ${blessed}`
+          });
+        }
+        if (!lockText || field === "peerDependencies" || staleKeys.has(key)) continue;
+        const locked = lockedVersion(lockText, key, name);
+        if (locked && admits(range, locked) === false) {
+          staleKeys.add(key);
+          findings.push({
+            level: "error",
+            kind: "stale-lock",
+            name: key,
+            message: `${target.label}${key} locked at ${locked}, violating declared ${spec} (stale lockfile) \u2192 re-lock`
+          });
+        } else if (locked && locked !== blessed) {
+          staleKeys.add(key);
+          findings.push({
+            level: "error",
+            kind: "stale-lock",
+            name: key,
+            message: `${target.label}${key} locked at ${locked}, blessed is ${blessed} \u2192 re-lock`
           });
         }
-      }
-    }
-    const installed = pkg.dependencies?.[name] ?? pkg.devDependencies?.[name];
-    if (lockText && installed) {
-      const locked = lockedVersion(lockText, name);
-      if (locked && admits(installed, locked) === false) {
-        findings.push({
-          level: "error",
-          kind: "stale-lock",
-          name,
-          message: `${name} locked at ${locked}, violating declared ${installed} (stale lockfile) \u2192 re-lock`
-        });
-      } else if (locked && locked !== blessed) {
-        findings.push({
-          level: "error",
-          kind: "stale-lock",
-          name,
-          message: `${name} locked at ${locked}, blessed is ${blessed} \u2192 re-lock`
-        });
       }
     }
   }
@@ -535,16 +700,19 @@ var args = process.argv.slice(2);
 var command = args[0];
 var flags = new Set(args.filter((arg) => arg.startsWith("--")).map((arg) => arg.split("=")[0]));
 var presetFlag = args.find((arg) => arg.startsWith("--preset="))?.split("=")[1];
+var laneFlag = args.find((arg) => arg.startsWith("--lane="))?.split("=")[1];
 var positional = args.slice(1).filter((arg) => !arg.startsWith("--"));
 var dir = resolve(positional[0] ?? ".");
 var usage = () => {
   console.log(
-    "Usage: inixiative-config <check|sync|scan|train> [dir] [--preset=base|node|react] [--force] [--no-install]"
+    "Usage: inixiative-config <check|sync|scan|train> [dir] [--preset=base|node|react] [--lane=primitives|agentic] [--force] [--no-install] [--push]"
   );
   process.exit(2);
 };
 if (!["check", "sync", "scan", "train"].includes(command)) usage();
 if (presetFlag && !["base", "node", "react"].includes(presetFlag)) usage();
+if (laneFlag !== void 0 && !isLane(laneFlag)) usage();
+var lanes = laneFlag && isLane(laneFlag) ? [laneFlag] : [...LANES];
 var manifest = loadManifest();
 var report = (findings) => {
   for (const finding of findings) {
@@ -600,18 +768,21 @@ if (command === "check") {
   const { findings } = inspect(dir, manifest, presetFlag);
   process.exit(report(findings) > 0 ? 1 : 0);
 }
+var laneLabel = (checkout) => checkout.consumer ? `consumer of ${checkout.consumer.lanes.join(" + ")}` : `${checkout.lane} lane`;
 if (command === "scan") {
-  const repos = discoverRepos(dir, manifest);
-  if (repos.length === 0) {
+  const plan = trainPlan(dir, manifest, lanes);
+  const checkouts = [...plan.lanes.flatMap((lane) => lane.checkouts), ...plan.consumers];
+  if (checkouts.length === 0) {
     console.error(`\u2717 no ecosystem repos found under ${dir}`);
     process.exit(1);
   }
-  const missing = missingRepos(repos, manifest);
+  const missing = [...plan.lanes.flatMap((lane) => lane.missing), ...plan.missingConsumers];
+  const ambiguous = [...plan.lanes.flatMap((lane) => lane.ambiguous), ...plan.ambiguousConsumers];
   const drifted = [];
-  for (const repo of repos) {
+  for (const checkout of checkouts) {
     console.log(`
-${repo.name} \u2014 ${repo.dir}`);
-    const off = offDefaultBranch(repo.dir);
+${checkout.name} \u2014 ${checkout.dir} (${laneLabel(checkout)})`);
+    const off = offDefaultBranch(checkout.dir);
     const branchFindings = off ? [
       {
         level: "warn",
@@ -620,175 +791,280 @@ ${repo.name} \u2014 ${repo.dir}`);
     ] : [];
     const findings = [
       ...branchFindings,
-      ...staleCheckoutFindings(repo.dir),
-      ...inspect(repo.dir, manifest).findings
+      ...staleCheckoutFindings(checkout.dir),
+      ...inspect(checkout.dir, manifest).findings
     ];
-    if (report(findings) > 0) drifted.push(repo.name);
-    for (const branch of unmergedSessionBranches(repo.dir)) {
+    if (report(findings) > 0) drifted.push(checkout.name);
+    for (const branch of unmergedSessionBranches(checkout.dir)) {
       console.log(`\u26A0 unmerged session branch: ${branch}`);
     }
   }
   if (missing.length > 0) console.error(`
 \u2717 no checkout found for: ${missing.join(", ")}`);
+  for (const entry of ambiguous) {
+    console.error(`\u2717 ambiguous checkouts for ${entry.key}: ${entry.dirs.join(", ")}`);
+  }
   console.log(
     `
-scanned ${repos.length} repos: ${drifted.length === 0 ? "all in sync" : `${drifted.length} drifted (${drifted.join(", ")})`}${missing.length > 0 ? `, ${missing.length} missing` : ""}`
+scanned ${checkouts.length} repos (${lanes.join(" + ")}): ${drifted.length === 0 ? "all in sync" : `${drifted.length} drifted (${drifted.join(", ")})`}${missing.length > 0 ? `, ${missing.length} missing` : ""}${ambiguous.length > 0 ? `, ${ambiguous.length} ambiguous` : ""}`
   );
-  process.exit(drifted.length > 0 || missing.length > 0 ? 1 : 0);
+  process.exit(drifted.length > 0 || missing.length > 0 || ambiguous.length > 0 ? 1 : 0);
 }
+var Abort = class extends Error {
+};
 if (command === "train") {
-  const order = topoOrder(dir, manifest);
-  if (order.length === 0) {
-    console.error(`\u2717 no ecosystem repos found under ${dir}`);
-    process.exit(1);
-  }
-  const missing = missingRepos(order, manifest);
-  if (missing.length > 0) {
-    console.error(
-      `\u2717 no checkout under ${dir} for: ${missing.join(", ")} \u2014 a partial train ships an incoherent set`
-    );
-    process.exit(1);
-  }
   git(packageRoot, "fetch", "--quiet");
   if (behindOrigin(packageRoot) > 0) {
     console.error("\u2717 this config checkout is behind origin \u2014 its blessed set is stale; pull first");
     process.exit(1);
   }
-  console.log(`train order: ${order.map((repo) => repo.name).join(" \u2192 ")}`);
-  const published = [];
+  const plan = trainPlan(dir, manifest, lanes);
+  if (plan.lanes.every((lane) => lane.checkouts.length === 0) && plan.consumers.length === 0) {
+    console.error(`\u2717 no ecosystem repos found under ${dir}`);
+    process.exit(1);
+  }
+  const blessed = [];
   const skipped = [];
-  const committed = [];
+  const failed = [];
+  const committed = /* @__PURE__ */ new Set();
+  const reviewBranches = [];
   let bomDirty = false;
-  for (const repo of order) {
-    console.log(`
-\u25B8 ${repo.name} \u2014 ${repo.dir}`);
-    const porcelain = spawnSync2("git", ["status", "--porcelain"], {
-      cwd: repo.dir,
-      encoding: "utf8"
-    });
+  const ready = (checkout) => {
+    const porcelain = git(checkout.dir, "status", "--porcelain");
     if (porcelain.status !== 0) {
       console.log("\u26A0 not a git checkout \u2014 skipping");
-      skipped.push(repo.name);
-      continue;
+      return false;
     }
-    const off = offDefaultBranch(repo.dir);
+    const off = offDefaultBranch(checkout.dir);
     if (off) {
       console.log(
         `\u26A0 on ${off.branch}, not ${off.main} \u2014 the train only ships the default branch, skipping`
       );
-      skipped.push(repo.name);
-      continue;
+      return false;
     }
     if (porcelain.stdout.trim().length > 0) {
-      console.log("\u26A0 dirty working tree \u2014 commit or stash your work first, skipping");
-      skipped.push(repo.name);
-      continue;
+      console.log("\u26A0 dirty working tree \u2014 commit your work first, skipping");
+      return false;
     }
-    git(repo.dir, "fetch", "--quiet");
-    for (const branch of unmergedSessionBranches(repo.dir)) {
+    git(checkout.dir, "fetch", "--quiet");
+    for (const branch of unmergedSessionBranches(checkout.dir)) {
       console.log(`\u26A0 unmerged session branch: ${branch} \u2014 a bump may be hiding there`);
     }
-    const behind = behindOrigin(repo.dir);
+    const behind = behindOrigin(checkout.dir);
     if (behind > 0) {
-      const localOnly = git(repo.dir, "rev-list", "--count", "@{upstream}..HEAD");
+      const localOnly = git(checkout.dir, "rev-list", "--count", "@{upstream}..HEAD");
       if (localOnly.status === 0 && Number(localOnly.stdout.trim()) > 0) {
         console.log("\u26A0 diverged from origin \u2014 reconcile first, skipping");
-        skipped.push(repo.name);
-        continue;
+        return false;
       }
-      const ff = git(repo.dir, "merge", "--ff-only", "@{upstream}");
-      if (ff.status !== 0) {
+      if (git(checkout.dir, "merge", "--ff-only", "@{upstream}").status !== 0) {
         console.log("\u26A0 fast-forward to origin failed \u2014 reconcile first, skipping");
-        skipped.push(repo.name);
-        continue;
+        return false;
       }
       console.log(`\u2193 fast-forwarded to origin (+${behind})`);
-      repo.pkg = JSON.parse(readFileSync2(join2(repo.dir, "package.json"), "utf8"));
+      checkout.pkg = JSON.parse(readFileSync2(join2(checkout.dir, "package.json"), "utf8"));
     }
-    const inspection = inspect(repo.dir, manifest);
+    return true;
+  };
+  const bumpRanges = (checkout) => {
+    const inspection = inspect(checkout.dir, manifest);
     const bumps = inspection.findings.filter((finding) => finding.kind === "ecosystem-range");
     for (const bump of bumps) {
       console.log(`  ${bump.message}`);
       bump.fix?.();
     }
     inspection.flush();
-    const bumped = bumps.length > 0;
-    const staleLock = inspection.findings.some((finding) => finding.kind === "stale-lock");
-    const remote = spawnSync2("npm", ["view", `${repo.name}@latest`, "version"], {
-      encoding: "utf8"
+    return {
+      inspection,
+      bumped: bumps.length > 0,
+      staleLock: inspection.findings.some((finding) => finding.kind === "stale-lock")
+    };
+  };
+  const relockAndCheck = (checkout) => {
+    if (spawnSync2("bun", ["install"], { cwd: checkout.dir, stdio: "inherit" }).status !== 0) {
+      throw new Abort(`bun install failed in ${checkout.name}`);
+    }
+    const stale = inspect(checkout.dir, manifest).findings.filter((finding) => finding.kind === "stale-lock" && finding.name).map((finding) => finding.name);
+    if (stale.length > 0) {
+      spawnSync2("bun", ["update", ...new Set(stale)], { cwd: checkout.dir, stdio: "inherit" });
+    }
+    if (spawnSync2("bun", ["run", "check"], { cwd: checkout.dir, stdio: "inherit" }).status !== 0) {
+      throw new Abort(`check failed in ${checkout.name}`);
+    }
+  };
+  const commitOwned = (checkout, packagePaths) => {
+    const tracked = [...packagePaths, "bun.lock"];
+    const mutated = git(checkout.dir, "status", "--porcelain", "--", ...tracked);
+    if (mutated.status !== 0 || mutated.stdout.trim().length === 0) return false;
+    if (git(checkout.dir, "add", "--", ...tracked).status !== 0) {
+      throw new Abort(`git add failed in ${checkout.name} \u2014 is bun.lock ignored?`);
+    }
+    const commit = spawnSync2("git", ["commit", "-m", "chore: sync ecosystem deps to blessed set"], {
+      cwd: checkout.dir,
+      stdio: "inherit"
     });
-    const remoteVersion = remote.status === 0 ? remote.stdout.trim() : null;
-    const localVersion = repo.pkg.version ?? "0.0.0";
-    const ahead = remoteVersion === null || compare(localVersion, remoteVersion) > 0;
-    if (remoteVersion && compare(localVersion, remoteVersion) < 0) {
-      console.log(`\u26A0 local ${localVersion} is behind npm ${remoteVersion} \u2014 pull first, skipping`);
-      skipped.push(repo.name);
-      continue;
+    if (commit.status !== 0) throw new Abort(`commit failed in ${checkout.name}`);
+    return true;
+  };
+  const publish = (checkout, entry) => {
+    if (entry.path === "package.json") {
+      return spawnSync2("npm", ["publish"], { cwd: checkout.dir, stdio: "inherit" }).status === 0;
     }
-    if (bumped || ahead || staleLock) {
-      const install = spawnSync2("bun", ["install"], { cwd: repo.dir, stdio: "inherit" });
-      if (install.status !== 0) {
-        console.error("\u2717 bun install failed \u2014 aborting train");
-        process.exit(1);
+    const memberDir = join2(checkout.dir, dirname2(entry.path));
+    const out = mkdtempSync(join2(tmpdir(), "inixiative-train-"));
+    try {
+      const pack = spawnSync2("bun", ["pm", "pack", "--destination", out], {
+        cwd: memberDir,
+        stdio: "inherit"
+      });
+      const tarball = readdirSync2(out).find((name) => name.endsWith(".tgz"));
+      if (pack.status !== 0 || !tarball) return false;
+      return spawnSync2("npm", ["publish", join2(out, tarball)], { cwd: memberDir, stdio: "inherit" }).status === 0;
+    } finally {
+      rmSync2(out, { recursive: true, force: true });
+    }
+  };
+  const npmLatest = (name) => {
+    const remote = spawnSync2("npm", ["view", `${name}@latest`, "version"], { encoding: "utf8" });
+    return remote.status === 0 ? remote.stdout.trim() : null;
+  };
+  for (const { lane, checkouts, missing, ambiguous } of plan.lanes) {
+    console.log(
+      `
+\u2550 ${lane} lane: ${checkouts.map((checkout) => checkout.name).join(" \u2192 ") || "(none)"}`
+    );
+    const section = laneSection(manifest, lane);
+    const before = { ...section };
+    const laneBlessed = [];
+    try {
+      if (missing.length > 0) {
+        throw new Abort(
+          `no checkout under ${dir} for: ${missing.join(", ")} \u2014 a partial lane ships an incoherent set`
+        );
       }
-      const stale = inspect(repo.dir, manifest).findings.filter((finding) => finding.kind === "stale-lock" && finding.name).map((finding) => finding.name);
-      if (stale.length > 0) {
-        spawnSync2("bun", ["update", ...new Set(stale)], { cwd: repo.dir, stdio: "inherit" });
+      if (ambiguous.length > 0) {
+        throw new Abort(
+          ambiguous.map((entry) => `ambiguous checkouts for ${entry.key}: ${entry.dirs.join(", ")}`).join("; ")
+        );
       }
-      const check = spawnSync2("bun", ["run", "check"], { cwd: repo.dir, stdio: "inherit" });
-      if (check.status !== 0) {
-        console.error(`\u2717 check failed in ${repo.name} \u2014 aborting train`);
-        process.exit(1);
+      for (const checkout of checkouts) {
+        console.log(`
+\u25B8 ${checkout.name} \u2014 ${checkout.dir}`);
+        if (!ready(checkout)) {
+          skipped.push(checkout.name);
+          continue;
+        }
+        const { inspection, bumped, staleLock } = bumpRanges(checkout);
+        const releases = checkout.packages.map((entry) => {
+          const local = JSON.parse(readFileSync2(join2(checkout.dir, entry.path), "utf8")).version ?? "0.0.0";
+          const remote = npmLatest(entry.name);
+          return { entry, local, remote, ahead: remote === null || compare(local, remote) > 0 };
+        });
+        const behind = releases.find(
+          (release) => release.remote && compare(release.local, release.remote) < 0
+        );
+        if (behind) {
+          console.log(
+            `\u26A0 ${behind.entry.name} local ${behind.local} is behind npm ${behind.remote} \u2014 pull first, skipping`
+          );
+          skipped.push(checkout.name);
+          continue;
+        }
+        if (bumped || staleLock || releases.some((release) => release.ahead))
+          relockAndCheck(checkout);
+        if (commitOwned(checkout, inspection.packagePaths)) committed.add(checkout.dir);
+        for (const { entry, local, remote, ahead } of releases) {
+          if (ahead) {
+            console.log(`publishing ${entry.name}@${local} (npm has ${remote ?? "none"})`);
+            if (!publish(checkout, entry)) throw new Abort(`publish failed for ${entry.name}`);
+            if (!servedByRegistry(entry.name, local)) {
+              throw new Abort(
+                `npm accepted ${entry.name}@${local} but the registry does not serve it`
+              );
+            }
+          } else if (section[entry.name] === local) {
+            console.log(`\u2713 ${entry.name}@${local} already on npm and blessed`);
+            continue;
+          } else {
+            console.log(`\u2713 ${entry.name}@${local} already on npm \u2014 blessing it`);
+          }
+          section[entry.name] = local;
+          laneBlessed.push(`${entry.name}@${local}`);
+        }
       }
-    }
-    const tracked = [...inspection.packagePaths, "bun.lock"];
-    const mutated = spawnSync2("git", ["status", "--porcelain", "--", ...tracked], {
-      cwd: repo.dir,
-      encoding: "utf8"
-    });
-    if (mutated.status === 0 && mutated.stdout.trim().length > 0) {
-      spawnSync2("git", ["add", "--", ...tracked], { cwd: repo.dir });
-      const commit = spawnSync2(
-        "git",
-        ["commit", "-m", "chore: sync ecosystem deps to blessed set"],
-        { cwd: repo.dir, stdio: "inherit" }
+      if (laneBlessed.length > 0) {
+        writeManifest(manifest);
+        bomDirty = true;
+        blessed.push(...laneBlessed);
+      }
+      console.log(
+        `${lane} lane blessed: ${laneBlessed.length === 0 ? "nothing new" : laneBlessed.join(", ")}`
       );
-      if (commit.status !== 0) {
-        console.error(`\u2717 commit failed in ${repo.name} \u2014 aborting train`);
-        process.exit(1);
+    } catch (error) {
+      if (!(error instanceof Abort)) throw error;
+      for (const name of Object.keys(section)) delete section[name];
+      Object.assign(section, before);
+      failed.push(`${lane} lane`);
+      console.error(`\u2717 ${error.message} \u2014 ${lane} lane stopped; its BOM entries are unchanged`);
+      if (laneBlessed.length > 0) {
+        console.error(
+          `  published but not blessed: ${laneBlessed.join(", ")} \u2014 the next train blesses them`
+        );
       }
-      committed.push(repo.dir);
     }
-    if (ahead) {
-      console.log(`publishing ${repo.name}@${localVersion} (npm has ${remoteVersion ?? "none"})`);
-      const publish = spawnSync2("npm", ["publish"], { cwd: repo.dir, stdio: "inherit" });
-      if (publish.status !== 0) {
-        console.error(`\u2717 publish failed for ${repo.name} \u2014 aborting train`);
-        process.exit(1);
+  }
+  if (plan.consumers.length > 0 || plan.missingConsumers.length > 0) {
+    console.log(
+      `
+\u2550 consumers: ${plan.consumers.map((checkout) => checkout.name).join(" \u2192 ") || "(none)"}`
+    );
+  }
+  for (const repo of plan.missingConsumers) {
+    console.error(`\u2717 no checkout under ${dir} for consumer ${repo}`);
+    failed.push(repo);
+  }
+  for (const entry of plan.ambiguousConsumers) {
+    console.error(`\u2717 ambiguous checkouts for consumer ${entry.key}: ${entry.dirs.join(", ")}`);
+    failed.push(entry.key);
+  }
+  for (const checkout of plan.consumers) {
+    console.log(`
+\u25B8 ${checkout.name} \u2014 ${checkout.dir} (${laneLabel(checkout)})`);
+    if (!ready(checkout)) {
+      skipped.push(checkout.name);
+      continue;
+    }
+    try {
+      const { inspection, bumped, staleLock } = bumpRanges(checkout);
+      if (!bumped && !staleLock) {
+        console.log("\u2713 already on the blessed set");
+        continue;
       }
-      if (!servedByRegistry(repo.name, localVersion)) {
-        console.error(
-          `\u2717 npm accepted ${repo.name}@${localVersion} but the registry does not serve it \u2014 aborting train`
-        );
-        process.exit(1);
+      relockAndCheck(checkout);
+      const base = offDefaultBranch(checkout.dir)?.main ?? currentBranch(checkout.dir);
+      const branch = freeBranch(
+        checkout.dir,
+        `train/ecosystem-sync-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`
+      );
+      if (git(checkout.dir, "switch", "-c", branch).status !== 0) {
+        throw new Abort(`could not create ${branch} in ${checkout.name}`);
       }
-      committed.push(repo.dir);
-      manifest.ecosystem[repo.name] = localVersion;
-      writeManifest(manifest);
-      bomDirty = true;
-      published.push(`${repo.name}@${localVersion}`);
-    } else {
-      console.log(`\u2713 ${repo.name}@${localVersion} already on npm`);
+      if (commitOwned(checkout, inspection.packagePaths)) {
+        reviewBranches.push({ dir: checkout.dir, branch, base });
+        console.log(`committed on ${branch} for review; the checkout stays on it until merged`);
+      }
+    } catch (error) {
+      if (!(error instanceof Abort)) throw error;
+      failed.push(checkout.name);
+      console.error(`\u2717 ${error.message} \u2014 its working tree is left as is for inspection`);
     }
   }
   console.log(`
-published: ${published.length === 0 ? "nothing" : published.join(", ")}`);
+blessed: ${blessed.length === 0 ? "nothing" : blessed.join(", ")}`);
   if (skipped.length > 0) console.log(`skipped: ${skipped.join(", ")}`);
+  if (failed.length > 0) console.log(`failed: ${failed.join(", ")}`);
   if (bomDirty) {
-    const remote = spawnSync2("npm", ["view", "@inixiative/config@latest", "version"], {
-      encoding: "utf8"
-    });
-    const remoteVersion = remote.status === 0 ? remote.stdout.trim() : null;
+    const remoteVersion = npmLatest("@inixiative/config");
     let version = ownVersion();
     if (remoteVersion !== null && compare(version, remoteVersion) <= 0) {
       version = bumpPatch(remoteVersion);
@@ -816,46 +1092,70 @@ published: ${published.length === 0 ? "nothing" : published.join(", ")}`);
     });
     const commit = spawnSync2(
       "git",
-      ["commit", "-m", `chore: bless ${published.join(", ")} \u2014 ${version}`],
-      {
-        cwd: packageRoot,
-        stdio: "inherit"
-      }
+      ["commit", "-m", `chore: bless ${blessed.join(", ")} \u2014 ${version}`],
+      { cwd: packageRoot, stdio: "inherit" }
     );
     if (commit.status !== 0) {
       console.error("\u2717 commit failed in @inixiative/config \u2014 aborting before publish");
       process.exit(1);
     }
-    const publish = spawnSync2("npm", ["publish"], { cwd: packageRoot, stdio: "inherit" });
-    if (publish.status !== 0 || !servedByRegistry("@inixiative/config", version)) {
+    const publish2 = spawnSync2("npm", ["publish"], { cwd: packageRoot, stdio: "inherit" });
+    if (publish2.status !== 0 || !servedByRegistry("@inixiative/config", version)) {
       console.error("\u2717 publish failed for @inixiative/config");
       process.exit(1);
     }
-    committed.push(packageRoot);
+    committed.add(packageRoot);
     console.log(`published: @inixiative/config@${version} \u2014 the BOM names the new state`);
   }
   if (flags.has("--push")) {
     for (const repoDir of committed) {
-      const push = spawnSync2("git", ["push"], { cwd: repoDir, stdio: "inherit" });
-      if (push.status !== 0) {
+      if (spawnSync2("git", ["push"], { cwd: repoDir, stdio: "inherit" }).status !== 0) {
         console.error(`\u2717 push failed in ${repoDir}`);
         process.exit(1);
       }
     }
-    console.log(`pushed: ${committed.length} repo${committed.length === 1 ? "" : "s"}`);
-  } else if (committed.length > 0) {
+    for (const { dir: repoDir, branch, base } of reviewBranches) {
+      const push = spawnSync2("git", ["push", "-u", "origin", branch], {
+        cwd: repoDir,
+        stdio: "inherit"
+      });
+      const pr = push.status === 0 && spawnSync2("gh", ["pr", "create", "--fill", "--base", base, "--head", branch], {
+        cwd: repoDir,
+        stdio: "inherit"
+      }).status === 0;
+      if (!pr) console.error(`\u2717 could not push ${branch} and open its PR in ${repoDir}`);
+    }
+    console.log(`pushed: ${committed.size + reviewBranches.length} repos`);
+  } else if (committed.size > 0 || reviewBranches.length > 0) {
     console.log("train does not push without --push \u2014 review its commits, then push:");
     for (const repoDir of committed) console.log(`  git -C ${repoDir} push`);
+    for (const { dir: repoDir, branch, base } of reviewBranches) {
+      console.log(
+        `  git -C ${repoDir} push -u origin ${branch} && (cd ${repoDir} && gh pr create --fill --base ${base})`
+      );
+    }
   }
-  process.exit(0);
+  process.exit(failed.length > 0 ? 1 : 0);
+}
+function currentBranch(cwd) {
+  return git(cwd, "rev-parse", "--abbrev-ref", "HEAD").stdout.trim();
+}
+function freeBranch(cwd, name) {
+  const taken = (candidate2) => git(cwd, "rev-parse", "--verify", "--quiet", `refs/heads/${candidate2}`).status === 0;
+  let candidate = name;
+  for (let n = 2; taken(candidate); n++) candidate = `${name}-${n}`;
+  return candidate;
 }
 function servedByRegistry(name, version) {
-  for (let attempt = 0; attempt < 10; attempt++) {
-    const view = spawnSync2("npm", ["view", `${name}@${version}`, "version"], { encoding: "utf8" });
+  const deadline = Date.now() + 15 * 6e4;
+  while (true) {
+    const view = spawnSync2("npm", ["view", `${name}@${version}`, "version", "--prefer-online"], {
+      encoding: "utf8"
+    });
     if (view.status === 0 && view.stdout.trim() === version) return true;
-    Bun.sleepSync(3e3);
+    if (Date.now() >= deadline) return false;
+    Bun.sleepSync(1e4);
   }
-  return false;
 }
 function bumpPatch(version) {
   const [major, minor, patch] = version.split(".").map(Number);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/config",
-  "version": "0.5.35",
+  "version": "0.5.37",
   "description": "Shared toolchain for the inixiative ecosystem: tsconfig/biome/tsup presets, a version manifest (BOM), and a sync/check CLI",
   "type": "module",
   "license": "MIT",

package/versions.json

@@ -13,7 +13,7 @@
     "@types/bun"
   ],
   "ecosystem": {
-    "@inixiative/config": "0.5.35",
+    "@inixiative/config": "0.5.37",
     "@inixiative/json-rules": "2.25.0",
     "@inixiative/permissions": "0.3.2",
     "@inixiative/transitions": "0.1.0",
@@ -21,6 +21,30 @@
     "@inixiative/prisma-map": "0.2.0",
     "@inixiative/atlas": "0.1.1",
     "@inixiative/gloss": "0.0.4",
-    "@inixiative/archive": "0.2.1"
+    "@inixiative/archive": "0.3.0"
+  },
+  "agentic": {
+    "@inixiative/agent-session": "0.2.0",
+    "@inixiative/foundry-core": "0.2.0",
+    "@inixiative/foundry": "0.2.0"
+  },
+  "consumers": {
+    "inixiative/template": {
+      "lanes": [
+        "primitives"
+      ]
+    },
+    "inixiative/kingdom": {
+      "lanes": [
+        "primitives",
+        "agentic"
+      ],
+      "upstream": "inixiative/template"
+    },
+    "inixiative/oracle": {
+      "lanes": [
+        "agentic"
+      ]
+    }
   }
 }