docs: scrub references to a specific consumer (Scriptor) throughout (#27)

* docs: scrub references to a specific consumer (Scriptor) throughout

iManager is a general-purpose embeddable CMS framework. Calling out
one specific host application (Scriptor) implies a primary / blessed
consumer that doesn't exist — the library is consumer-agnostic and
the docs should read that way.

Rewrites all consumer-naming mentions across user-facing and planning
docs, and moves the host-side cutover plan into the host's own repo.

Changes
-------

User-facing:
- `README.md` — drops "the reference consumer is Scriptor", drops
  "shipped with Scriptor ≤ 1.x" and "use Scriptor ≤ 1.x" framing,
  drops the link to the Scriptor-integration phase plan.
- `CHANGELOG.md` — Phase 12 cache invalidation hook and Phase 14e
  files entries lose their "(Scriptor's …)" call-outs in favour of
  the underlying capability.
- `docs/migration-guide.md` — Step 5 drops the "Scriptor's own
  switchover is documented in …" reference; the workaround note
  describes a self-referential parent field generically.
- `docs/api/README.md`, `docs/api/domain.md`, `docs/api/field-types.md`
  — three stray references rewritten generically (cache subsystem
  blurb, lazy-listener tip, render() motivation).

Planning:
- `docs/imanager-2.0-plan.md` — Phase 14 reframed as "First-Consumer-
  Cutover (Release-Gate)"; release strategy, phase-status row, and
  acceptance criteria use host-neutral language.
- `docs/imanager-analysis.md` — header reframes as a 1.x analysis;
  drops the "embedded in Scriptor 1.12.1" framing.

Removed:
- `docs/imanager-2.0-phase-14-plan.md` — this is the consumer-side
  cutover detail plan; it belongs in the consumer's own docs/.

* ci: strip auto-set GitHub OAuth from composer auth before install

`shivammathur/setup-php@v2` automatically copies `secrets.GITHUB_TOKEN`
into Composer's global `github-oauth.github.com` config to lift the
unauthenticated Packagist rate limit. GitHub now issues JWT-shaped
`ghs_*` installation tokens (uppercase letters, dots, dashes), which
Composer 2.x's `BaseIO::setAuthentication` validation regex rejects
as "invalid characters" — `composer install` then dies before
fetching any dependency.

We don't actually need the token for public-Packagist installs (the
unauthenticated limit is fine for our matrix). Unset the OAuth entry
right after `setup-php` runs and let Composer fall back to anonymous
requests.

Bundled into this docs PR so the PR's CI can go green on this branch
— a CI infra hotfix on a standalone branch wouldn't help, since CI
runs the workflow file from the PR branch itself.

Author: bigin

.github/workflows/ci.yml

@@ -32,6 +32,16 @@ jobs:
           coverage: none
           tools: composer:v2
 
+      # shivammathur/setup-php auto-writes secrets.GITHUB_TOKEN to
+      # composer's global github-oauth config. GitHub now issues
+      # JWT-shaped ghs_* tokens (uppercase letters, dots, dashes)
+      # that older Composer 2.x BaseIO validation rejects, breaking
+      # `composer install` before any package is fetched. We don't
+      # need the token for public-Packagist installs anyway; strip
+      # it so Composer falls back to anonymous Packagist requests.
+      - name: Strip auto-set GitHub OAuth from composer auth
+        run: composer config --global --unset github-oauth.github.com || true
+
       - name: Get composer cache directory
         id: composer-cache
         run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"

CHANGELOG.md

@@ -114,8 +114,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - `Imanager\Cache\FilesystemCache` implementing PSR-16
   `CacheInterface`; HTML snippet caching with TTL + atomic write.
-- Invalidation hook published as a domain event so listeners
-  (Scriptor's `PageCacheInvalidationListener`) can clear on writes.
+- Invalidation hook published as a domain event so host listeners
+  can clear cached entries on writes without monkey-patching the
+  storage layer.
 
 ### Phase 13 — Files & upload
 
@@ -150,7 +151,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   captions / alt text); `File` domain object + `FileRepository`
   updated; full test coverage (`feature/file-title-column`).
 - `feat(files): File::withPosition()` helper for ordered file
-  re-numbering used by Scriptor's pages-edit drag-handle (#21).
+  re-numbering — supports drag-and-drop reordering in host editor
+  UIs without re-saving the surrounding item (#21).
 
 ### Phase 16 — Docs & examples (in progress)
 

README.md

@@ -8,25 +8,24 @@ iManager is a small CMS **framework**, not a CMS application: you embed
 it inside your own PHP app and get a typed domain model, a Repository
 layer over SQLite (JSON columns + FTS5), a Field-Type plugin system,
 file storage with on-demand thumbnails, and a CLI for schema and
-migration ops. The reference consumer is
-[Scriptor](https://github.com/bigin/Scriptor), a flat-file CMS that
-boots iManager and adds an Editor UI on top of it.
+migration ops. Use it under any PHP front-end you like — a hand-rolled
+admin tool, a flat-file CMS, an internal API, a static-site generator
+that needs a typed content store. iManager has no opinion about how
+your application is shaped.
 
 ---
 
 ## Status
 
 **🚧 2.0 development in progress — not for production use.**
 
-iManager 2.0 is a ground-up rewrite of the iManager library that
-shipped with Scriptor ≤ 1.x. The 2.0 line replaces the flat
-`var_export`-based persistence with SQLite (JSON `items.data` column +
-generated columns + FTS5), introduces typed domain models, a Repository
-/ Query layer, a CLI tool, and a clean field-type plugin system. The
-2.0.0 Packagist tag is targeted for Phase 17 — until then,
-`bigins/imanager:2.0.x-dev` is the way to consume it.
-
-For the current production-ready 1.x line, use Scriptor ≤ 1.x.
+iManager 2.0 is a ground-up rewrite of the 1.x library. The 2.0 line
+replaces the flat `var_export`-based persistence with SQLite (JSON
+`items.data` column + generated columns + FTS5), introduces typed
+domain models, a Repository / Query layer, a CLI tool, and a clean
+field-type plugin system. The 2.0.0 Packagist tag is targeted for
+Phase 17 — until then, `bigins/imanager:2.0.x-dev` is the way to
+consume it. The 1.x line remains available for production use.
 
 ---
 
@@ -176,8 +175,6 @@ Available composer scripts:
 
 - **Master plan** (multi-phase rewrite, phase status):
   [`docs/imanager-2.0-plan.md`](docs/imanager-2.0-plan.md).
-- **Phase 14 detail plan** (Scriptor integration):
-  [`docs/imanager-2.0-phase-14-plan.md`](docs/imanager-2.0-phase-14-plan.md).
 - **Changelog**: [`CHANGELOG.md`](CHANGELOG.md).
 - API reference, migration guide (1.x → 2.0), deployment guide,
   field-type cookbook, and query cookbook are landing during Phase 16.

docs/api/README.md

@@ -51,7 +51,7 @@ tells you which source file to read next.
 | `Imanager\Enum` | `FieldType` (the 16 built-in enum cases), `SqliteAffinity` (storage class hint), `InputErrorCode` (validation error codes). | `src/Enum/` |
 | `Imanager\Files` | File-storage abstraction (`FileStorage` interface, `LocalFileStorage`), upload validation, and `ImageProcessor` for on-demand thumbnails. `FileRepository` (under `Storage`) tracks file *metadata*; this subsystem moves the bytes. | `src/Files/` |
 | `Imanager\Http` | Small request-layer toolkit: `SessionStore` (with `NativeSessionStore` default), `Csrf` (per-form tokens, capped LRU), and request/URL helpers. iManager does *not* ship a router. | `src/Http/` |
-| `Imanager\Cache` | PSR-16 cache contract and `FilesystemCache` (hash-keyed, two-level directory fanout, TTL metadata in-file). Used by Scriptor for section-cache; library itself stays uncached for predictability. | `src/Cache/` |
+| `Imanager\Cache` | PSR-16 cache contract and `FilesystemCache` (hash-keyed, two-level directory fanout, TTL metadata in-file). Hosts wire it to whatever they want to cache (rendered fragments, query results, …); the library itself stays uncached for predictability. | `src/Cache/` |
 | `Imanager\Search` | `FullTextSearch` over a SQLite FTS5 mirror of `items`. CLI command `fts:rebuild` rebuilds the index from scratch. | `src/Search/` |
 | `Imanager\Templating` | Single-purpose `{{var}}` substitution for short strings (pagination links, alerts). Caller is responsible for escaping. **Not** a view layer. | `src/Templating/` |
 | `Imanager\Validation` | `Sanitizer` facade over HTMLPurifier (sanitize) and Parsedown (markdown). Pure functions; safe to call repeatedly. | `src/Validation/` |

docs/api/domain.md

@@ -375,8 +375,9 @@ $provider->subscribe(ItemDeleted::class, function (ItemDeleted $event): void {
 ```
 
 Listener instantiation can be lazy — wrap the closure body in a
-`static $listener = null` guard if construction is expensive
-(Scriptor's `ImanagerBootstrap` does this for `PageCacheInvalidationListener`).
+`static $listener = null` guard if construction is expensive (e.g.
+the listener queries the DB on construct to learn which category id
+it watches).
 
 ---
 

docs/api/field-types.md

@@ -7,7 +7,7 @@ Field types are the plugin layer that decides:
 2. What **SQLite affinity** the value uses if it's promoted to a hot
    column.
 3. How the value is **rendered** as an HTML form input — for hosts
-   that lean on the library's rendering, like Scriptor's Editor.
+   that lean on the library's rendering for their editor UI.
 
 This page is the **reference**: enum cases, the plugin interface,
 the registry, and a table of the built-in plugins. A step-by-step