@inixiative/config 0.5.40 → 0.5.42

package/README.md

@@ -68,9 +68,9 @@ bunx @inixiative/config scan  [root] [--lane=primitives|agentic]
 bunx @inixiative/config train [root] [--lane=primitives|agentic] [--push]
 ```
 
-`check` is read-only and exits non-zero on drift — run it in CI after a frozen-lockfile install. It verifies toolchain pins, `"latest"` ranges, `packageManager`/`.bun-version`, legacy `bun.lockb`, a committed (tracked, un-ignored) `bun.lock`, required scripts (`check`/`typecheck`/`lint`/`test`), lefthook (dep + `lefthook.yml` extending the shared hooks + `prepare` script; git repos only), stub `extends`, presence of this package, and for every ecosystem dependency — in the root or any workspace member, of either lane — that the declared range admits the blessed version and the lockfile actually resolves to it (the stale-lockfile class). An npm alias (`"@inixiative/session-archive": "npm:@inixiative/archive@^0.2.1"`) is held to its target's blessed version and rewritten as an alias; `workspace:`, `file:` and `link:` ranges are a repo linking itself and are left alone.
+`check` is read-only and exits non-zero on drift — run it in CI after a frozen-lockfile install. It verifies toolchain pins — declared once, at the root, pinned exactly: a workspace member declaring one is an error, and `bun.lock` must resolve each only to its pin (no second copy) — toolchain peer ranges (they must admit the pin and no older major; `sync` writes `>=<pin major>.<pin minor>.0`), `"latest"` ranges, `packageManager`/`.bun-version`, legacy `bun.lockb`, a committed (tracked, un-ignored) `bun.lock`, required scripts (`check`/`typecheck`/`lint`/`test`), lefthook (dep + `lefthook.yml` extending the shared hooks + `prepare` script; git repos only), stub `extends`, presence of this package, and for every ecosystem dependency — in the root or any workspace member, of either lane — that the declared range admits the blessed version and the lockfile actually resolves to it (the stale-lockfile class). An npm alias (`"@inixiative/session-archive": "npm:@inixiative/archive@^0.2.1"`) is held to its target's blessed version and rewritten as an alias; `workspace:`, `file:` and `link:` ranges are a repo linking itself and are left alone.
 
-`sync` applies every fix, re-locks via `bun install`, and runs `bun update` on stale ecosystem entries. It refuses to run on a dirty working tree without `--force`. The react preset is inferred from a `react` dependency; override with `--preset`. Missing scripts are filled with defaults; existing script bodies are never touched.
+`sync` applies every fix (deleting member toolchain entries and their stale member links), re-locks via `bun install` (`--force` when a second toolchain copy survives), and runs `bun update` on stale ecosystem entries in the directory that declares them. It refuses to run on a dirty working tree without `--force`. The react preset is inferred from a `react` dependency; override with `--preset`. Missing scripts are filled with defaults; existing script bodies are never touched.
 
 `scan` runs `check` across every ecosystem checkout under a root directory, for every lane or just the one `--lane` names. Targets are derived from the BOM: lane packages match by package name — the root package or any workspace member, so a monorepo such as foundry is found by the packages it publishes — and consumers match by their `origin` GitHub repo. Directory names and local layout never need declaring: scan looks at each child of the root and one level into a child without a `package.json` (a workspace folder such as `kingdom-workspace/`). Linked git worktrees are other sessions' branches and never targets; when several clones claim one package or repo, only those with an `origin` remote count, and if that still leaves more than one the target is reported ambiguous rather than guessed. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, warns when a checkout sits on a non-default branch (its findings describe the branch, not what ships), and surfaces unmerged `claude/*` session branches.
 

package/dist/cli.js

@@ -157,6 +157,27 @@ var lockedVersion = (lockText, key, target = key) => {
   const version = spec.slice(target.length + 1);
   return /^\d/.test(version) ? version : null;
 };
+var lockedCopies = (lockText, name) => {
+  const packages = tryParseJsonc(lockText)?.packages;
+  if (!packages || typeof packages !== "object") return [];
+  return Object.entries(packages).flatMap(([key, entry]) => {
+    const spec = Array.isArray(entry) ? entry[0] : null;
+    if (typeof spec !== "string" || !spec.startsWith(`${name}@`)) return [];
+    const version = spec.slice(name.length + 1);
+    return /^\d/.test(version) ? [{ key, version }] : [];
+  });
+};
+var peerFloor = (pin) => {
+  const [major, minor] = pin.split(".");
+  return `>=${major}.${minor}.0`;
+};
+var admitsOlderMajor = (range, pin) => {
+  const pinMajor = Number(pin.split(".")[0]);
+  return range.split("||").some((part) => {
+    const parsed = parseRange(part.trim());
+    return !!parsed && Number(parsed.version.split(".")[0]) < pinMajor;
+  });
+};
 var npmAlias = (spec) => {
   const match = spec.match(/^npm:((?:@[^/@]+\/)?[^@]+)@(.+)$/);
   return match ? { name: match[1], range: match[2] } : null;
@@ -337,6 +358,15 @@ var workspacePackagePaths = (dir2, pkg) => {
   }
   return [...paths].sort();
 };
+var staleUpdates = (dir2, findings) => {
+  const groups = /* @__PURE__ */ new Map();
+  for (const finding of findings) {
+    if (finding.kind !== "stale-lock" || !finding.name) continue;
+    const cwd = join(dir2, dirname(finding.path ?? "package.json"));
+    groups.set(cwd, (groups.get(cwd) ?? /* @__PURE__ */ new Set()).add(finding.name));
+  }
+  return [...groups].map(([cwd, names]) => ({ cwd, names: [...names] }));
+};
 var detectPreset = (pkg, override) => {
   if (override) return override;
   const hasReact = DEP_FIELDS.some((field) => pkg[field]?.react !== void 0);
@@ -557,15 +587,77 @@ function inspect(dir2, manifest2, presetOverride) {
     }
   }
   const rangeTargets = [
-    { label: "", pkg, mark: touch },
+    { label: "", path: "package.json", pkg, mark: touch },
     ...members.map((member) => ({
       label: `${member.rel}: `,
+      path: member.rel,
       pkg: member.pkg,
       mark: () => {
         member.dirty = true;
       }
     }))
   ];
+  for (const [index, member] of members.entries()) {
+    const target = rangeTargets[index + 1];
+    for (const name of Object.keys(manifest2.toolchain)) {
+      for (const field of ["dependencies", "devDependencies"]) {
+        const deps = member.pkg[field];
+        if (!deps?.[name]) continue;
+        findings.push({
+          level: "error",
+          kind: "member-toolchain",
+          name,
+          path: member.rel,
+          message: `${member.rel}: ${name} declared in a workspace member \u2192 remove; the root pin applies`,
+          fix: () => {
+            delete deps[name];
+            target.mark();
+          }
+        });
+      }
+    }
+  }
+  for (const target of rangeTargets) {
+    const peers = target.pkg.peerDependencies;
+    for (const [name, pin] of Object.entries(manifest2.toolchain)) {
+      const range = peers?.[name];
+      if (!range || !peers) continue;
+      const floor = peerFloor(pin);
+      const ok = admits(range, pin);
+      if (ok === null) {
+        findings.push({
+          level: "warn",
+          message: `${target.label}${name} peer range ${range} not understood; verify it admits pinned ${pin}`
+        });
+        continue;
+      }
+      const reason = !ok ? `does not admit pinned ${pin}` : admitsOlderMajor(range, pin) ? `admits majors below pinned ${pin}` : null;
+      if (!reason) continue;
+      findings.push({
+        level: "error",
+        message: `${target.label}${name} peerDependencies range ${range} ${reason} \u2192 ${floor}`,
+        fix: () => {
+          peers[name] = floor;
+          target.mark();
+        }
+      });
+    }
+  }
+  if (lockText) {
+    for (const [name, pin] of Object.entries(manifest2.toolchain)) {
+      const seen = /* @__PURE__ */ new Set();
+      for (const { key, version } of lockedCopies(lockText, name)) {
+        if (version === pin || seen.has(version)) continue;
+        seen.add(version);
+        findings.push({
+          level: "error",
+          kind: "toolchain-lock",
+          name,
+          message: `bun.lock resolves ${name}@${version} (${key}) beside the pinned ${pin} \u2192 re-lock`
+        });
+      }
+    }
+  }
   const blessedSet = blessedVersions(manifest2);
   const staleKeys = /* @__PURE__ */ new Set();
   for (const target of rangeTargets) {
@@ -606,6 +698,7 @@ function inspect(dir2, manifest2, presetOverride) {
             level: "error",
             kind: "stale-lock",
             name: key,
+            path: target.path,
             message: `${target.label}${key} locked at ${locked}, violating declared ${spec} (stale lockfile) \u2192 re-lock`
           });
         } else if (locked && locked !== blessed) {
@@ -614,6 +707,7 @@ function inspect(dir2, manifest2, presetOverride) {
             level: "error",
             kind: "stale-lock",
             name: key,
+            path: target.path,
             message: `${target.label}${key} locked at ${locked}, blessed is ${blessed} \u2192 re-lock`
           });
         }
@@ -884,9 +978,11 @@ if (command === "train") {
     if (spawnSync2("bun", ["install"], { cwd: checkout.dir, stdio: "inherit" }).status !== 0) {
       throw new Abort(`bun install failed in ${checkout.name}`);
     }
-    const stale = inspect(checkout.dir, manifest).findings.filter((finding) => finding.kind === "stale-lock" && finding.name).map((finding) => finding.name);
-    if (stale.length > 0) {
-      spawnSync2("bun", ["update", ...new Set(stale)], { cwd: checkout.dir, stdio: "inherit" });
+    for (const { cwd, names } of staleUpdates(
+      checkout.dir,
+      inspect(checkout.dir, manifest).findings
+    )) {
+      spawnSync2("bun", ["update", ...names], { cwd, stdio: "inherit" });
     }
     if (spawnSync2("bun", ["run", "check"], { cwd: checkout.dir, stdio: "inherit" }).status !== 0) {
       throw new Abort(`check failed in ${checkout.name}`);
@@ -1179,16 +1275,29 @@ first.flush();
 var fixed = first.findings.filter((finding) => finding.fix).length;
 if (fixed > 0) console.log(`applied ${fixed} fix${fixed === 1 ? "" : "es"}`);
 if (!flags.has("--no-install")) {
-  const install = spawnSync2("bun", ["install"], { cwd: dir, stdio: "inherit" });
-  if (install.status !== 0) {
-    console.error("\u2717 bun install failed");
-    process.exit(1);
+  const relinked = new Set(
+    first.findings.flatMap(
+      (finding) => finding.kind === "member-toolchain" && finding.path ? [dirname2(finding.path)] : []
+    )
+  );
+  for (const member of relinked) {
+    rmSync2(join2(dir, member, "node_modules"), { recursive: true, force: true });
+  }
+  const install = (...extra) => {
+    if (spawnSync2("bun", ["install", ...extra], { cwd: dir, stdio: "inherit" }).status !== 0) {
+      console.error("\u2717 bun install failed");
+      process.exit(1);
+    }
+  };
+  install();
+  let installed = inspect(dir, manifest, presetFlag);
+  if (installed.findings.some((finding) => finding.kind === "toolchain-lock")) {
+    install("--force");
+    installed = inspect(dir, manifest, presetFlag);
   }
-  const stale = inspect(dir, manifest, presetFlag).findings.filter((finding) => finding.kind === "stale-lock" && finding.name).map((finding) => finding.name);
-  if (stale.length > 0) {
-    const update = spawnSync2("bun", ["update", ...new Set(stale)], { cwd: dir, stdio: "inherit" });
-    if (update.status !== 0) {
-      console.error("\u2717 bun update failed");
+  for (const { cwd, names } of staleUpdates(dir, installed.findings)) {
+    if (spawnSync2("bun", ["update", ...names], { cwd, stdio: "inherit" }).status !== 0) {
+      console.error(`\u2717 bun update failed in ${cwd}`);
       process.exit(1);
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/config",
-  "version": "0.5.40",
+  "version": "0.5.42",
   "description": "Shared toolchain for the inixiative ecosystem: tsconfig/biome/tsup presets, a version manifest (BOM), and a sync/check CLI",
   "type": "module",
   "license": "MIT",
@@ -56,8 +56,8 @@
   },
   "peerDependencies": {
     "@biomejs/biome": ">=2.5.0",
-    "tsup": ">=8.0.0",
-    "typescript": ">=5.9.0"
+    "tsup": ">=8.5.0",
+    "typescript": ">=6.0.0"
   },
   "peerDependenciesMeta": {
     "@biomejs/biome": {

package/versions.json

@@ -13,7 +13,7 @@
     "@types/bun"
   ],
   "ecosystem": {
-    "@inixiative/config": "0.5.40",
+    "@inixiative/config": "0.5.42",
     "@inixiative/json-rules": "2.25.0",
     "@inixiative/permissions": "0.3.2",
     "@inixiative/transitions": "0.1.0",
@@ -24,7 +24,7 @@
     "@inixiative/archive": "0.5.1"
   },
   "agentic": {
-    "@inixiative/agent-session": "0.2.0",
+    "@inixiative/agent-session": "0.3.1",
     "@inixiative/foundry-core": "0.2.0",
     "@inixiative/foundry": "0.2.0"
   },