@inixiative/config 0.5.64 → 0.5.65

package/README.md

@@ -77,7 +77,7 @@ bunx @inixiative/config ports [project]
 
 `scan` runs `check` across every ecosystem checkout under a root directory, for every lane or just the one `--lane` names. Targets are derived from the BOM: lane packages match by package name — the root package or any workspace member, so a monorepo such as foundry is found by the packages it publishes — and consumers match by their `origin` GitHub repo. Directory names and local layout never need declaring: scan looks at each child of the root and one level into a child without a `package.json` (a workspace folder such as `kingdom-workspace/`). Linked git worktrees are other sessions' branches and never targets; when several clones claim one package or repo, only those with an `origin` remote count, a clone directly under the root wins over one nested in a workspace folder, and if that still leaves more than one the target is reported ambiguous rather than guessed. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, warns when a checkout sits on a non-default branch (its findings describe the branch, not what ships), and surfaces unmerged `claude/*` session branches.
 
-`train` is the release cascade, run from this repo's checkout. It walks every lane in order (primitives, then agentic), or only the lane `--lane` names. Origin is the truth: it refuses to run from a config checkout behind origin, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It only ships the default branch: a checkout on a feature branch is skipped whole — never re-locked, committed to, or published from.
+`train` is the release cascade, run from a git checkout of this repo; it refuses to train from a copy that isn't one (a bunx or npm cache). One train at a time per machine: it takes one machine-wide lock, `~/.inixiative/train.lock`, shared by every clone, worktree and lane, and refuses to start while another train holds it, naming the holder and the lock path. The lock is created atomically and records the holder's pid, hostname and process start time. A lock is stale, and taken over, when its process is gone, its pid now belongs to a different process, or the file can't be parsed. A lock from another host is never judged stale; if its train is truly gone, delete the file. The lock is released on exit and on SIGINT, SIGTERM or SIGHUP. `--dry-run` takes no lock. It walks every lane in order (primitives, then agentic), or only the lane `--lane` names. Origin is the truth: it refuses to run from a config checkout behind origin, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It only ships the default branch: a checkout on a feature branch is skipped whole — never re-locked, committed to, or published from.
 
 Lanes stand alone. A lane with a package missing a checkout, or claimed by ambiguous checkouts, does not run; a lane whose check, commit or publish fails stops there and leaves its BOM entries as they were. Neither holds back the other lane. Within a lane it walks checkouts in dependency order; per checkout it: bumps ecosystem ranges to the blessed sets → re-locks → runs the repo's `check` → commits only its own changes (`package.json` files + `bun.lock`) → publishes each lane package whose local version is ahead of npm, in dependency order, and waits until the registry serves it (up to 15 minutes, since npm holds new versions for processing) → records it in its lane's section of the BOM. A root package publishes with `npm publish`; a workspace member is packed with `bun pm pack`, which rewrites `workspace:` ranges to the versions being released, and the tarball is published with `npm publish`, so OTP prompts pass through either way. A package already on npm at its local version but not yet blessed — published by hand, or by a train whose lane later failed — is blessed on the next run.
 

package/dist/cli.js

@@ -3,7 +3,7 @@
 // src/cli.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync2, mkdtempSync, readdirSync as readdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
-import { tmpdir } from "os";
+import { hostname as hostname2, tmpdir } from "os";
 import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
 
 // src/args.ts
@@ -11,15 +11,20 @@ import { parseArgs } from "util";
 
 // src/lib.ts
 import { spawnSync } from "child_process";
+import { randomUUID } from "crypto";
 import {
   existsSync,
   globSync,
+  linkSync,
+  mkdirSync,
   readdirSync,
   readFileSync,
+  realpathSync,
   rmSync,
   statSync,
   writeFileSync
 } from "fs";
+import { homedir, hostname } from "os";
 import { dirname, join, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 var packageRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
@@ -806,6 +811,115 @@ function inspect(dir2, manifest2, presetOverride) {
     }
   };
 }
+var trainLockPath = () => join(homedir(), ".inixiative", "train.lock");
+var isAlive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+};
+var processStart = (pid) => {
+  const ps = spawnSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8" });
+  const start = ps.status === 0 ? ps.stdout.trim() : "";
+  return start === "" ? null : start;
+};
+var parseLock = (contents) => {
+  try {
+    const lock = JSON.parse(contents);
+    return lock && typeof lock === "object" && !Array.isArray(lock) && typeof lock.pid === "number" ? lock : null;
+  } catch {
+    return null;
+  }
+};
+var staleness = (contents, lock) => {
+  if (!lock) return { reason: "corrupt", contents };
+  if (lock.hostname !== hostname()) return null;
+  if (!isAlive(lock.pid)) return { reason: "gone", holder: lock };
+  const start = processStart(lock.pid);
+  if (lock.processStart && start && start !== lock.processStart) {
+    return { reason: "pid reused", holder: lock };
+  }
+  return null;
+};
+var readOrNull = (path) => {
+  try {
+    return readFileSync(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+};
+var createExclusive = (path, contents) => {
+  const draft = `${path}.${process.pid}.${randomUUID()}`;
+  writeFileSync(draft, contents, { flag: "wx" });
+  try {
+    linkSync(draft, path);
+    return true;
+  } catch (error) {
+    if (error.code === "EEXIST") return false;
+    throw error;
+  } finally {
+    rmSync(draft, { force: true });
+  }
+};
+var TAKEOVER_TIMEOUT_MS = 1e4;
+var removeStale = (path, stale) => {
+  const mutex = `${path}.takeover`;
+  if (!createExclusive(mutex, `${process.pid}
+`)) {
+    try {
+      if (Date.now() - statSync(mutex).mtimeMs > TAKEOVER_TIMEOUT_MS)
+        rmSync(mutex, { force: true });
+    } catch {
+    }
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+    return;
+  }
+  try {
+    if (readOrNull(path) === stale) rmSync(path, { force: true });
+  } finally {
+    rmSync(mutex, { force: true });
+  }
+};
+var acquireTrainLock = (path, holder) => {
+  mkdirSync(dirname(path), { recursive: true });
+  const mine = `${JSON.stringify(holder, null, 2)}
+`;
+  let reclaimed;
+  for (; ; ) {
+    if (createExclusive(path, mine)) {
+      const release = () => {
+        if (readOrNull(path) === mine) rmSync(path, { force: true });
+      };
+      return reclaimed ? { ok: true, release, reclaimed } : { ok: true, release };
+    }
+    const current = readOrNull(path);
+    if (current === null) continue;
+    const lock = parseLock(current);
+    const stale = staleness(current, lock);
+    if (!stale && lock) return { ok: false, heldBy: lock, path };
+    if (!stale) continue;
+    reclaimed = stale;
+    removeStale(path, current);
+  }
+};
+var holdTrainLock = (release) => {
+  process.on("exit", release);
+  for (const [signal, code] of [
+    ["SIGINT", 130],
+    ["SIGTERM", 143],
+    ["SIGHUP", 129]
+  ]) {
+    process.on(signal, () => process.exit(code));
+  }
+};
+var isConfigCheckout = (dir2) => {
+  const top = spawnSync("git", ["rev-parse", "--show-toplevel"], { cwd: dir2, encoding: "utf8" });
+  if (top.status !== 0) return false;
+  return realpathSync(top.stdout.trim()) === realpathSync(dir2) && originRepo(dir2) === "inixiative/config";
+};
 
 // src/args.ts
 var COMMANDS = ["check", "sync", "scan", "train", "ports"];
@@ -828,17 +942,28 @@ var parseCommandLine = (argv) => {
   if (!isCommand(command2)) throw new UsageError(`unknown command: ${command2 ?? "(none)"}`);
   let values;
   let positionals2;
+  let tokens;
   try {
     const options = OPTIONS[command2];
-    ({ values, positionals: positionals2 } = parseArgs({
+    ({ values, positionals: positionals2, tokens } = parseArgs({
       args: argv.slice(1),
       options,
       allowPositionals: true,
-      strict: true
+      strict: true,
+      tokens: true
     }));
   } catch (error) {
     throw new UsageError(`${command2}: ${error instanceof Error ? error.message : String(error)}`);
   }
+  if (positionals2.length > 1)
+    throw new UsageError(
+      `${command2}: unexpected argument ${positionals2[1]} \u2014 did you mean --${positionals2[1]}?`
+    );
+  const names = tokens.flatMap(
+    (token) => token.kind === "option" && token.name ? [token.name] : []
+  );
+  const repeated = names.find((name, index) => names.indexOf(name) !== index);
+  if (repeated) throw new UsageError(`${command2}: --${repeated} given more than once`);
   const presetValue = values.preset;
   if (typeof presetValue === "string" && !PRESETS.includes(presetValue)) {
     throw new UsageError(`unknown preset: ${presetValue}`);
@@ -1034,6 +1159,44 @@ if (command === "train") {
     return planned;
   };
   if (dryRun) console.log("dry run: nothing is installed, written, committed, published or pushed");
+  if (!isConfigCheckout(packageRoot)) {
+    const message = `this config (${packageRoot}) is not a git checkout of inixiative/config \u2014 run the train from a clone, never a bunx or npm copy`;
+    if (!dryRun) {
+      console.error(`\u2717 ${message}`);
+      process.exit(1);
+    }
+    console.log(`\u26A0 ${message}`);
+  }
+  if (!dryRun) {
+    const path = trainLockPath();
+    const lock = acquireTrainLock(path, {
+      pid: process.pid,
+      hostname: hostname2(),
+      processStart: processStart(process.pid),
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      lanes,
+      root: dir,
+      checkout: packageRoot
+    });
+    if (!lock.ok) {
+      const { pid, hostname: host, startedAt, lanes: held, root, checkout } = lock.heldBy;
+      console.error(
+        `\u2717 another train is running (pid ${pid} on ${host}, lanes ${held.join(" + ")}, root ${root}, from ${checkout}, since ${startedAt}) \u2014 wait for it to finish; one train at a time. If that train is truly gone, delete ${lock.path}`
+      );
+      process.exit(1);
+    }
+    const stale = lock.reclaimed;
+    if (stale?.reason === "corrupt") {
+      console.log(
+        `\u26A0 took over a corrupt train lock at ${path} (unparsable: ${JSON.stringify(stale.contents)})`
+      );
+    } else if (stale) {
+      console.log(
+        `\u26A0 took over a stale train lock (pid ${stale.holder.pid} ${stale.reason === "gone" ? "is gone" : "now belongs to another process"})`
+      );
+    }
+    holdTrainLock(lock.release);
+  }
   git(packageRoot, "fetch", "--quiet");
   if (behindOrigin(packageRoot) > 0) {
     if (!dryRun) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/config",
-  "version": "0.5.64",
+  "version": "0.5.65",
   "description": "Shared toolchain for the inixiative ecosystem: tsconfig/biome/tsup presets, a version manifest (BOM), and a sync/check CLI",
   "type": "module",
   "license": "MIT",

package/versions.json

@@ -13,12 +13,12 @@
     "@types/bun"
   ],
   "ecosystem": {
-    "@inixiative/config": "0.5.64",
-    "@inixiative/json-rules": "3.5.0",
+    "@inixiative/config": "0.5.65",
+    "@inixiative/json-rules": "3.5.1",
     "@inixiative/permissions": "0.4.0",
-    "@inixiative/transitions": "0.4.0",
-    "@inixiative/rules-builder": "0.30.0",
-    "@inixiative/prisma-map": "0.3.0",
+    "@inixiative/transitions": "0.5.0",
+    "@inixiative/rules-builder": "0.31.0",
+    "@inixiative/prisma-map": "0.3.1",
     "@inixiative/atlas": "0.2.0",
     "@inixiative/gloss": "0.0.5"
   },