@inixiative/config 0.5.7 → 0.5.8

package/README.md

@@ -60,9 +60,9 @@ bunx @inixiative/config train [root]
 
 `sync` applies every fix, re-locks via `bun install`, and runs `bun update` on stale ecosystem entries. It refuses to run on a dirty working tree without `--force`. The react preset is inferred from a `react` dependency; override with `--preset`. Missing scripts are filled with defaults; existing script bodies are never touched.
 
-`scan` runs `check` across every ecosystem checkout under a root directory. Targets are derived from the BOM's `ecosystem` keys and matched by package name, so directory names and local layout never need declaring. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, and surfaces unmerged `claude/*` session branches.
+`scan` runs `check` across every ecosystem checkout under a root directory. Targets are derived from the BOM's `ecosystem` keys and matched by package name, so directory names and local layout never need declaring. Origin is the truth, not the checkout: scan fetches per repo and fails on checkouts behind origin (their findings describe a stale tree), fails when a BOM entry has no checkout at all, warns when a checkout sits on a non-default branch (its findings describe the branch, not what ships), and surfaces unmerged `claude/*` session branches.
 
-`train` is the release cascade, run from this repo's checkout. Origin is the truth: it refuses to run from a config checkout behind origin or with any BOM repo missing a checkout, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It walks the ecosystem in dependency order; per repo it: bumps ecosystem ranges to the BOM → re-locks → runs the repo's `check` → commits only its own changes (`package.json` + `bun.lock`) → publishes via `npm publish` when the local version is ahead of npm (OTP prompts pass through) → records the published version in the BOM. It never pushes; review its commits, push, then commit and publish this package so the BOM names the new state.
+`train` is the release cascade, run from this repo's checkout. Origin is the truth: it refuses to run from a config checkout behind origin or with any BOM repo missing a checkout, and it fast-forwards clean checkouts to origin before working (dirty or diverged repos still skip). It only ships the default branch: a checkout on a feature branch is skipped whole — never re-locked, committed to, or published from. It walks the ecosystem in dependency order; per repo it: bumps ecosystem ranges to the BOM → re-locks → runs the repo's `check` → commits only its own changes (`package.json` + `bun.lock`) → publishes via `npm publish` when the local version is ahead of npm (OTP prompts pass through) → records the published version in the BOM. It never pushes; review its commits, push, then commit and publish this package so the BOM names the new state.
 
 Division of labor: this CLI owns the toolchain set, ecosystem coherence, stubs, and lockfile format. Renovate owns everything else plus bumping `@inixiative/config` itself, and must be fenced off the toolchain packages.
 

package/dist/cli.js

@@ -544,6 +544,14 @@ var unmergedSessionBranches = (cwd) => {
   if (branches.status !== 0) return [];
   return branches.stdout.split("\n").map((line) => line.trim()).filter(Boolean);
 };
+var offDefaultBranch = (cwd) => {
+  const branch = git(cwd, "rev-parse", "--abbrev-ref", "HEAD");
+  if (branch.status !== 0) return null;
+  const head = git(cwd, "symbolic-ref", "--short", "refs/remotes/origin/HEAD");
+  const main = head.status === 0 ? head.stdout.trim().replace(/^origin\//, "") : "main";
+  const current = branch.stdout.trim();
+  return current === main ? null : { branch: current, main };
+};
 if (command === "check") {
   const { findings } = inspect(dir, manifest, presetFlag);
   process.exit(report(findings) > 0 ? 1 : 0);
@@ -559,7 +567,18 @@ if (command === "scan") {
   for (const repo of repos) {
     console.log(`
 ${repo.name} \u2014 ${repo.dir}`);
-    const findings = [...staleCheckoutFindings(repo.dir), ...inspect(repo.dir, manifest).findings];
+    const off = offDefaultBranch(repo.dir);
+    const branchFindings = off ? [
+      {
+        level: "warn",
+        message: `checkout is on ${off.branch}, not ${off.main} \u2014 findings reflect the branch, not what ships`
+      }
+    ] : [];
+    const findings = [
+      ...branchFindings,
+      ...staleCheckoutFindings(repo.dir),
+      ...inspect(repo.dir, manifest).findings
+    ];
     if (report(findings) > 0) drifted.push(repo.name);
     for (const branch of unmergedSessionBranches(repo.dir)) {
       console.log(`\u26A0 unmerged session branch: ${branch}`);
@@ -607,6 +626,14 @@ if (command === "train") {
       skipped.push(repo.name);
       continue;
     }
+    const off = offDefaultBranch(repo.dir);
+    if (off) {
+      console.log(
+        `\u26A0 on ${off.branch}, not ${off.main} \u2014 the train only ships the default branch, skipping`
+      );
+      skipped.push(repo.name);
+      continue;
+    }
     if (porcelain.stdout.trim().length > 0) {
       console.log("\u26A0 dirty working tree \u2014 commit or stash your work first, skipping");
       skipped.push(repo.name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/config",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "description": "Shared toolchain for the inixiative ecosystem: tsconfig/biome/tsup presets, a version manifest (BOM), and a sync/check CLI",
   "type": "module",
   "license": "MIT",

package/versions.json

@@ -13,11 +13,11 @@
     "@types/bun"
   ],
   "ecosystem": {
-    "@inixiative/config": "0.5.7",
+    "@inixiative/config": "0.5.8",
     "@inixiative/json-rules": "2.17.1",
     "@inixiative/permissions": "0.3.2",
     "@inixiative/transitions": "0.1.0",
-    "@inixiative/rules-builder": "0.18.0",
+    "@inixiative/rules-builder": "0.18.1",
     "@inixiative/prisma-map": "0.1.0",
     "@inixiative/atlas": "0.1.1"
   }