@inixiative/config 0.5.45 → 0.5.47

package/README.md

@@ -71,11 +71,11 @@ bunx @inixiative/config ports [project]
 
 `ports` prints each project's local ports from `ports.json` (also exported as `@inixiative/config/ports.json`). A project's port for a service is the service's usual default plus 100 times the project's block, so no two projects collide and none sits on a default: Archive (block 7) serves HTTP on 4700 with Postgres on 6132; Kingdom (block 2) has web 3200, API 8200, Postgres 5632, Redis 6579. Reserved ports (macOS AirPlay on 5000 and 7000) are never assigned. Give a new project the next free block, and a new kind of service its usual default; the tests fail on any collision.
 
-`check` is read-only and exits non-zero on drift — run it in CI after a frozen-lockfile install. It verifies toolchain pins — declared once, at the root, pinned exactly: a workspace member declaring one is an error, and `bun.lock` must resolve each only to its pin (no second copy) — toolchain peer ranges (they must admit the pin and no older major; `sync` writes `>=<pin major>.<pin minor>.0`), `"latest"` ranges, `packageManager`/`.bun-version`, legacy `bun.lockb`, a committed (tracked, un-ignored) `bun.lock`, required scripts (`check`/`typecheck`/`lint`/`test`), lefthook (dep + `lefthook.yml` extending the shared hooks + `prepare` script; git repos only), stub `extends`, presence of this package, and for every ecosystem dependency — in the root or any workspace member, of either lane — that the declared range admits the blessed version and the lockfile actually resolves to it (the stale-lockfile class). An npm alias (`"@inixiative/session-archive": "npm:@inixiative/archive@^0.2.1"`) is held to its target's blessed version and rewritten as an alias; `workspace:`, `file:` and `link:` ranges are a repo linking itself and are left alone.
+`check` is read-only and exits non-zero on drift — run it in CI after a frozen-lockfile install. It verifies toolchain pins — declared once, at the root, pinned exactly: a workspace member declaring one is an error, and `bun.lock` must resolve each only to its pin (no second copy) — toolchain peer ranges (they must admit the pin and no older major; `sync` writes `>=<pin major>.<pin minor>.0`), `"latest"` ranges, `packageManager`/`.bun-version`, legacy `bun.lockb`, a committed (tracked, un-ignored) `bun.lock`, required scripts (`check`/`typecheck`/`lint`/`test`), lefthook (dep + `lefthook.yml` extending the shared hooks + `prepare` script; git repos only), stub `extends`, presence of this package, and for every ecosystem dependency — in the root or any workspace member, of either lane — that the declared range admits the blessed version and the lockfile actually resolves to it (the stale-lockfile class). A range that does not admit the blessed version is rewritten to `^<blessed>`, except an exact pin, which stays exact and moves to the blessed version. An npm alias (`"@inixiative/session-archive": "npm:@inixiative/archive@^0.2.1"`) is held to its target's blessed version and rewritten as an alias; `workspace:`, `file:` and `link:` ranges are a repo linking itself and are left alone.
 
 `sync` applies every fix (deleting member toolchain entries and their stale member links), re-locks via `bun install` (`--force` when a second toolchain copy survives), and runs `bun update` on stale ecosystem entries in the directory that declares them. It refuses to run on a dirty working tree without `--force`. The react preset is inferred from a `react` dependency; override with `--preset`. Missing scripts are filled with defaults; existing script bodies are never touched.
 
-`scan` runs `check` across every ecosystem checkout under a root directory, for every lane or just the one `--lane` names. Targets are derived from the BOM: lane packages match by package name — the root package or any workspace member, so a monorepo such as foundry is found by the packages it publishes — and consumers match by their `origin` GitHub repo. Directory names and local layout never need declaring: scan looks at each child of the root and one level into a child without a `package.json` (a workspace folder such as `kingdom-workspace/`). Linked git worktrees are other sessions' branches and never targets; when several clones claim one package or repo, only those with an `origin` remote count, and if that still leaves more than one the target is reported ambiguous rather than guessed. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, warns when a checkout sits on a non-default branch (its findings describe the branch, not what ships), and surfaces unmerged `claude/*` session branches.
+`scan` runs `check` across every ecosystem checkout under a root directory, for every lane or just the one `--lane` names. Targets are derived from the BOM: lane packages match by package name — the root package or any workspace member, so a monorepo such as foundry is found by the packages it publishes — and consumers match by their `origin` GitHub repo. Directory names and local layout never need declaring: scan looks at each child of the root and one level into a child without a `package.json` (a workspace folder such as `kingdom-workspace/`). Linked git worktrees are other sessions' branches and never targets; when several clones claim one package or repo, only those with an `origin` remote count, a clone directly under the root wins over one nested in a workspace folder, and if that still leaves more than one the target is reported ambiguous rather than guessed. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, warns when a checkout sits on a non-default branch (its findings describe the branch, not what ships), and surfaces unmerged `claude/*` session branches.
 
 `train` is the release cascade, run from this repo's checkout. It walks every lane in order (primitives, then agentic), or only the lane `--lane` names. Origin is the truth: it refuses to run from a config checkout behind origin, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It only ships the default branch: a checkout on a feature branch is skipped whole — never re-locked, committed to, or published from.
 
@@ -83,7 +83,7 @@ Lanes stand alone. A lane with a package missing a checkout, or claimed by ambig
 
 Consumers run once, after every selected lane, upstreams first, against the full blessed set: a consumer of both lanes ends coherent with both whichever lane ran. They get the same bump → re-lock → `check`, never a publish, and their changes go through review: the train commits them on a `train/ecosystem-sync-<date>` branch and leaves the checkout there until it is merged.
 
-When anything was blessed it then ships this package last, so the BOM names the new state: bumps its own patch version if npm already has the current one, blesses that version in the BOM, brings the `test/fixtures` consumers onto the blessed set, runs `check`, commits, publishes. It never pushes unless asked: pass `--push` to push every repo it committed to and open a PR for each consumer branch; otherwise it prints the commands.
+When anything was blessed it then ships this package last, so the BOM names the new state: bumps its own patch version if npm already has the current one, blesses that version in the BOM, brings the `test/fixtures` consumers onto the blessed set, runs `check`, commits, publishes. Then every checkout the train re-locked (lane packages on their default branch, consumers on their review branch) is re-locked onto that new `@inixiative/config` and committed, so none is left pinning the previous release. It never pushes unless asked: pass `--push` to push every repo it committed to and open a PR for each consumer branch; otherwise it prints the commands.
 
 Division of labor: this CLI owns the toolchain set, ecosystem coherence, stubs, and lockfile format. Renovate owns everything else plus bumping `@inixiative/config` itself, and must be fenced off the toolchain packages.
 

package/dist/cli.js

@@ -4,7 +4,7 @@
 import { spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync2, mkdtempSync, readdirSync as readdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname2, join as join2, resolve } from "path";
+import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
 
 // src/lib.ts
 import { spawnSync } from "child_process";
@@ -17,7 +17,7 @@ import {
   statSync,
   writeFileSync
 } from "fs";
-import { dirname, join, sep } from "path";
+import { dirname, join, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 var packageRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
 var LANES = ["primitives", "agentic"];
@@ -250,7 +250,9 @@ var discover = (root, manifest2, lanes2 = LANES) => {
   const chosen = /* @__PURE__ */ new Map();
   const ambiguous = [];
   for (const [key, candidates] of claims) {
-    const pool = candidates.length > 1 ? candidates.filter((candidate) => originRepo(candidate.dir)) : candidates;
+    let pool = candidates.length > 1 ? candidates.filter((candidate) => originRepo(candidate.dir)) : candidates;
+    const direct = pool.filter((candidate) => dirname(candidate.dir) === resolve(root));
+    if (pool.length > 1 && direct.length === 1) pool = direct;
     if (pool.length === 1) chosen.set(pool[0].dir, pool[0]);
     else ambiguous.push({ key, dirs: candidates.map((candidate) => candidate.dir).sort() });
   }
@@ -673,13 +675,14 @@ function inspect(dir2, manifest2, presetOverride) {
         const rewrite = (next) => name === key ? next : `npm:${name}@${next}`;
         const ok = admits(range, blessed);
         if (ok === false) {
+          const next = /^\d+\.\d+\.\d+(?:-[\w.-]+)?$/.test(range) ? blessed : `^${blessed}`;
           findings.push({
             level: "error",
             kind: "ecosystem-range",
             name,
-            message: `${target.label}${key} ${field} range ${spec} does not admit blessed ${blessed} \u2192 ${rewrite(`^${blessed}`)}`,
+            message: `${target.label}${key} ${field} range ${spec} does not admit blessed ${blessed} \u2192 ${rewrite(next)}`,
             fix: () => {
-              deps[key] = rewrite(`^${blessed}`);
+              deps[key] = rewrite(next);
               target.mark();
             }
           });
@@ -838,7 +841,7 @@ var flags = new Set(args.filter((arg) => arg.startsWith("--")).map((arg) => arg.
 var presetFlag = args.find((arg) => arg.startsWith("--preset="))?.split("=")[1];
 var laneFlag = args.find((arg) => arg.startsWith("--lane="))?.split("=")[1];
 var positional = args.slice(1).filter((arg) => !arg.startsWith("--"));
-var dir = resolve(positional[0] ?? ".");
+var dir = resolve2(positional[0] ?? ".");
 var usage = () => {
   console.log(
     "Usage: inixiative-config <check|sync|scan|train> [dir] [--preset=base|node|react] [--lane=primitives|agentic] [--force] [--no-install] [--push]\n       inixiative-config ports [project]"
@@ -1025,7 +1028,7 @@ if (command === "train") {
       staleLock: inspection.findings.some((finding) => finding.kind === "stale-lock")
     };
   };
-  const relockAndCheck = (checkout) => {
+  const relockAndCheck = (checkout, check = true) => {
     if (spawnSync2("bun", ["install"], { cwd: checkout.dir, stdio: "inherit" }).status !== 0) {
       throw new Abort(`bun install failed in ${checkout.name}`);
     }
@@ -1035,10 +1038,11 @@ if (command === "train") {
     )) {
       spawnSync2("bun", ["update", ...names], { cwd, stdio: "inherit" });
     }
-    if (spawnSync2("bun", ["run", "check"], { cwd: checkout.dir, stdio: "inherit" }).status !== 0) {
+    if (check && spawnSync2("bun", ["run", "check"], { cwd: checkout.dir, stdio: "inherit" }).status !== 0) {
       throw new Abort(`check failed in ${checkout.name}`);
     }
   };
+  const followers = [];
   const commitOwned = (checkout, packagePaths) => {
     const tracked = [...packagePaths, "bun.lock"];
     const mutated = git(checkout.dir, "status", "--porcelain", "--", ...tracked);
@@ -1120,6 +1124,7 @@ if (command === "train") {
         if (bumped || staleLock || releases.some((release) => release.ahead))
           relockAndCheck(checkout);
         if (commitOwned(checkout, inspection.packagePaths)) committed.add(checkout.dir);
+        followers.push(checkout);
         for (const { entry, local, remote, ahead } of releases) {
           if (ahead) {
             console.log(`publishing ${entry.name}@${local} (npm has ${remote ?? "none"})`);
@@ -1196,6 +1201,7 @@ if (command === "train") {
       if (git(checkout.dir, "switch", "-c", branch).status !== 0) {
         throw new Abort(`could not create ${branch} in ${checkout.name}`);
       }
+      followers.push(checkout);
       if (commitOwned(checkout, inspection.packagePaths)) {
         reviewBranches.push({ dir: checkout.dir, branch, base });
         console.log(`committed on ${branch} for review; the checkout stays on it until merged`);
@@ -1253,6 +1259,20 @@ blessed: ${blessed.length === 0 ? "nothing" : blessed.join(", ")}`);
     }
     committed.add(packageRoot);
     console.log(`published: @inixiative/config@${version} \u2014 the BOM names the new state`);
+    for (const checkout of followers) {
+      try {
+        const { inspection, bumped, staleLock } = bumpRanges(checkout);
+        if (!bumped && !staleLock) continue;
+        relockAndCheck(checkout, false);
+        if (commitOwned(checkout, inspection.packagePaths) && !checkout.consumer)
+          committed.add(checkout.dir);
+        console.log(`\u2713 ${checkout.name} locked to @inixiative/config@${version}`);
+      } catch (error) {
+        if (!(error instanceof Abort)) throw error;
+        failed.push(checkout.name);
+        console.error(`\u2717 ${error.message} \u2014 re-lock onto @inixiative/config@${version} by hand`);
+      }
+    }
   }
   if (flags.has("--push")) {
     for (const repoDir of committed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/config",
-  "version": "0.5.45",
+  "version": "0.5.47",
   "description": "Shared toolchain for the inixiative ecosystem: tsconfig/biome/tsup presets, a version manifest (BOM), and a sync/check CLI",
   "type": "module",
   "license": "MIT",

package/versions.json

@@ -13,20 +13,20 @@
     "@types/bun"
   ],
   "ecosystem": {
-    "@inixiative/config": "0.5.45",
+    "@inixiative/config": "0.5.47",
     "@inixiative/json-rules": "2.26.0",
-    "@inixiative/permissions": "0.3.3",
-    "@inixiative/transitions": "0.1.0",
+    "@inixiative/permissions": "0.3.4",
+    "@inixiative/transitions": "0.1.1",
     "@inixiative/rules-builder": "0.28.0",
     "@inixiative/prisma-map": "0.2.0",
     "@inixiative/atlas": "0.1.1",
-    "@inixiative/gloss": "0.0.4"
+    "@inixiative/gloss": "0.0.5"
   },
   "agentic": {
     "@inixiative/archive": "0.7.0",
     "@inixiative/agent-session": "0.3.1",
-    "@inixiative/foundry-core": "0.2.0",
-    "@inixiative/foundry": "0.2.0"
+    "@inixiative/foundry-core": "0.3.0",
+    "@inixiative/foundry": "0.3.0"
   },
   "consumers": {
     "inixiative/template": {