@catalyst-cloud/cli 0.8.0

package/dist/runtime-store.js

@@ -0,0 +1,135 @@
+// runtime-store.ts — CTC-2158, Tier 2. The pinned runtime this CLI manages itself.
+//
+// WHY THIS AND NOT A POSTINSTALL. A postinstall download is skipped by `--ignore-scripts` (which is
+// how this very container's own install ran: `bun install --frozen-lockfile --ignore-scripts`), is
+// skipped entirely by `npx`, and fetches-and-executes a binary the customer never asked for. This is
+// one explicit command instead — the command every unsupported-runtime message prints — and it never
+// touches the machine's default Node.
+//
+// The checksum is verified BEFORE anything is unpacked. `.tar.gz`, never `.tar.xz`: `tar -xzf` works
+// everywhere including macOS bsdtar, which cannot be assumed to carry liblzma.
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { join } from "node:path";
+import { CliError } from "./errors.js";
+const PLATFORM_ARCH = {
+    darwin: ["arm64", "x64"],
+    linux: ["x64", "arm64"],
+};
+/** Map a version/platform/arch onto a real nodejs.org `.tar.gz` name. win32 refuses by name — Windows
+ *  needs `.zip` extraction, a separate mechanism this ticket does not build (D7). */
+export function tarballFor(version, platform, arch) {
+    if (platform === "win32") {
+        throw new CliError("catalyst-skills runtime install does not support Windows yet — supported: darwin (arm64, x64) and linux (x64, arm64). Use whatever Node 22.15+ or bun 1.4+ you already have on Windows.", "runtime-unsupported-platform");
+    }
+    const arches = PLATFORM_ARCH[platform];
+    if (!arches || !arches.includes(arch)) {
+        throw new CliError(`catalyst-skills runtime install does not support ${platform}/${arch} — supported: darwin (arm64, x64) and linux (x64, arm64)`, "runtime-unsupported-platform");
+    }
+    const file = `node-v${version}-${platform}-${arch}.tar.gz`;
+    return { file, url: `https://nodejs.org/dist/v${version}/${file}`, shasums: `https://nodejs.org/dist/v${version}/SHASUMS256.txt` };
+}
+/** Pick our file's line out of a real SHASUMS256.txt body. A missing line is a named error — never a
+ *  skipped verification. */
+export function shasumFor(shasumsBody, file) {
+    for (const line of shasumsBody.split("\n")) {
+        const [sum, name] = line.trim().split(/\s+/);
+        if (name === file && sum)
+            return sum;
+    }
+    throw new CliError(`no line for ${file} in SHASUMS256.txt — refusing to install without a checksum to verify against`, "runtime-checksum-missing");
+}
+export function runtimesDir(home) {
+    return join(home, ".cache", "catalyst-cloud", "catalyst-skills", "runtimes");
+}
+export function pinPath(home) {
+    return join(runtimesDir(home), "pin.json");
+}
+export function pinnedNodePath(home, version, platform, arch) {
+    return join(runtimesDir(home), `node-v${version}-${platform}-${arch}`, "bin", platform === "win32" ? "node.exe" : "node");
+}
+export function readPin(home) {
+    const p = pinPath(home);
+    if (!existsSync(p))
+        return null;
+    try {
+        return JSON.parse(readFileSync(p, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function writePin(home, pin) {
+    mkdirSync(runtimesDir(home), { recursive: true });
+    writeFileSync(pinPath(home), JSON.stringify(pin, null, 2) + "\n", { mode: 0o600 });
+}
+async function defaultFetchText(url) {
+    const res = await fetch(url);
+    if (!res.ok)
+        throw new CliError(`GET ${url} -> ${res.status}`, "runtime-fetch-failed");
+    return res.text();
+}
+async function defaultFetchBytes(url) {
+    const res = await fetch(url);
+    if (!res.ok)
+        throw new CliError(`GET ${url} -> ${res.status}`, "runtime-fetch-failed");
+    return new Uint8Array(await res.arrayBuffer());
+}
+async function defaultExtract(tarPath, dest) {
+    mkdirSync(dest, { recursive: true });
+    const res = spawnSync("tar", ["-xzf", tarPath, "-C", dest, "--strip-components=1"]);
+    if (res.status !== 0) {
+        throw new CliError(`tar -xzf ${tarPath} failed: ${res.stderr?.toString().trim() || `exit ${String(res.status)}`}`, "runtime-extract-failed");
+    }
+}
+/** Download the pinned Node, verify it against that release's own SHASUMS256.txt, and unpack it
+ *  under the CLI's own cache. Refuses (never unpacks) on a checksum mismatch. Re-installing a
+ *  version already present short-circuits without touching the network. */
+export async function installPinnedRuntime(o) {
+    const tb = tarballFor(o.version, o.platform, o.arch);
+    const nodePath = pinnedNodePath(o.home, o.version, o.platform, o.arch);
+    const existing = readPin(o.home);
+    if (existing?.version === o.version && existsSync(nodePath)) {
+        return { version: o.version, nodePath, alreadyPresent: true };
+    }
+    const fetchText = o.fetchText ?? defaultFetchText;
+    const fetchBytes = o.fetchBytes ?? defaultFetchBytes;
+    const extract = o.extract ?? defaultExtract;
+    const shasumsBody = await fetchText(tb.shasums);
+    const want = shasumFor(shasumsBody, tb.file);
+    const bytes = await fetchBytes(tb.url);
+    const got = createHash("sha256").update(bytes).digest("hex");
+    if (got !== want) {
+        throw new CliError(`checksum mismatch for ${tb.file}: expected ${want}, got ${got} — refusing to unpack`, "runtime-checksum-mismatch");
+    }
+    const tmpDir = join(runtimesDir(o.home), ".tmp");
+    mkdirSync(tmpDir, { recursive: true });
+    const tmpTar = join(tmpDir, tb.file);
+    writeFileSync(tmpTar, bytes);
+    const dest = join(runtimesDir(o.home), `node-v${o.version}-${o.platform}-${o.arch}`);
+    try {
+        await extract(tmpTar, dest);
+    }
+    finally {
+        rmSync(tmpTar, { force: true });
+    }
+    if (!existsSync(nodePath)) {
+        throw new CliError(`extraction did not produce ${nodePath} — the tarball's layout may have changed`, "runtime-extract-failed");
+    }
+    try {
+        chmodSync(nodePath, 0o755);
+    }
+    catch {
+        // best-effort: platforms without exec bits (e.g. a fake in tests) still count as installed
+    }
+    writePin(o.home, { version: o.version, nodePath });
+    return { version: o.version, nodePath, alreadyPresent: false };
+}
+export function uninstallPinnedRuntime(home) {
+    const pin = readPin(home);
+    if (!pin)
+        return false;
+    rmSync(runtimesDir(home), { recursive: true, force: true });
+    return true;
+}

package/dist/runtime-verb.js

@@ -0,0 +1,66 @@
+// runtime-verb.ts — CTC-2158, Tier 2. `catalyst-skills runtime status|install|path|uninstall`: the
+// verb every unsupported-runtime message points at. It downloads the pinned Node named by
+// package.json's `catalystCloud.pinnedNode`, verifies it, and unpacks it under this CLI's own
+// cache — it never touches the machine's default Node and needs no admin rights.
+import { positionals } from "./args.js";
+import { readManifest } from "./config.js";
+import { UsageError } from "./errors.js";
+import { FIX_COMMAND, detectRuntime, runtimeVerdict } from "./runtime.js";
+import { installPinnedRuntime, readPin, uninstallPinnedRuntime } from "./runtime-store.js";
+export async function cmdRuntime(args, ctx, deps = {}) {
+    const [sub = "status"] = positionals(args);
+    const home = deps.home ?? ctx.home;
+    const platform = deps.platform ?? process.platform;
+    const arch = deps.arch ?? process.arch;
+    const manifest = readManifest();
+    switch (sub) {
+        case "status": {
+            const pin = readPin(home);
+            const ambient = detectRuntime();
+            const ambientVerdict = runtimeVerdict(ambient, manifest.enginesNode);
+            const supported = pin ? true : ambientVerdict.supported;
+            if (args.json) {
+                ctx.stdout(JSON.stringify({ pinned: pin, ambient, supported }));
+                return supported ? 0 : 1;
+            }
+            if (!pin) {
+                ctx.stdout(`no pinned runtime installed — ambient: ${ambientVerdict.line}`);
+                if (!ambientVerdict.supported)
+                    ctx.stdout(`fix: ${FIX_COMMAND}`);
+                return ambientVerdict.supported ? 0 : 1;
+            }
+            ctx.stdout(`pinned: Node ${pin.version} at ${pin.nodePath}`);
+            ctx.stdout(`ambient: ${ambientVerdict.line}`);
+            return 0;
+        }
+        case "install": {
+            const result = await installPinnedRuntime({
+                home,
+                version: manifest.pinnedNode,
+                platform,
+                arch,
+                fetchText: deps.fetchText,
+                fetchBytes: deps.fetchBytes,
+                extract: deps.extract,
+            });
+            ctx.stdout(result.alreadyPresent
+                ? `Node ${result.version} is already installed at ${result.nodePath}`
+                : `Installed Node ${result.version} at ${result.nodePath} — this CLI now runs on it regardless of your machine's default Node`);
+            return 0;
+        }
+        case "path": {
+            const pin = readPin(home);
+            if (!pin)
+                return 1;
+            ctx.stdout(pin.nodePath);
+            return 0;
+        }
+        case "uninstall": {
+            const removed = uninstallPinnedRuntime(home);
+            ctx.stdout(removed ? "removed the pinned runtime" : "no pinned runtime to remove");
+            return 0;
+        }
+        default:
+            throw new UsageError(`unknown runtime subcommand: ${sub} (expected: status | install | path | uninstall)`);
+    }
+}

package/dist/runtime.js

@@ -0,0 +1,87 @@
+// runtime.ts — CTC-2158. The ONE place that answers "can this runtime run this CLI, and if not,
+// what is the one command that fixes it without touching the machine's default Node?"
+//
+// Two floors, and they come from different places on purpose:
+//   • Node: `engines.node` in package.json, read through readManifest(). Declared and publishable.
+//     MEASURED: Node 22.14.0 has no node:module.registerHooks, so the type-stripping loader cannot
+//     install and the SDK cannot load — `>=22` admitted a runtime this package does not work on.
+//   • bun: BUN_MIN below. `engines` has no bun key bun enforces, so it lives here with its own
+//     measurement. MEASURED: bun 1.3.14 has no `node:sqlite` at all (`bun -e 'import "node:sqlite"'`
+//     -> "Could not resolve"), so the CLI could not even finish loading; bun 1.4.2 has it and runs
+//     everything including the SDK. Anything that offers bun as a fallback MUST name this floor —
+//     an unqualified bun recommendation sent a customer to a runtime that cannot even start.
+export const BUN_MIN = "1.4.0";
+/** The ONE copy-pasteable command. Installs a pinned Node under the CLI's own cache and pins it;
+ *  it never touches the machine's default Node and needs no admin rights. See src/runtime-store.ts. */
+export const FIX_COMMAND = "npx -y @catalyst-cloud/catalyst-skills runtime install";
+/** Detect the runtime this process is running on. `process.versions.bun` is present only under bun. */
+export function detectRuntime(versions = process.versions) {
+    if (versions.bun)
+        return { kind: "bun", version: versions.bun, nodeCompat: versions.node ?? "0.0.0" };
+    if (versions.node)
+        return { kind: "node", version: versions.node, nodeCompat: versions.node };
+    return { kind: "unknown", version: "0", nodeCompat: "0" };
+}
+const RANGE_RE = /^>=\s*(\d+)\.(\d+)(?:\.(\d+))?$/;
+/** Parse the one range form this package declares (">=X.Y" or ">=X.Y.Z"). A range this cannot parse
+ *  is a loud, named error — a CLI that cannot read its own declared floor must not conclude
+ *  "everything is supported". */
+export function parseNodeFloor(range) {
+    const m = RANGE_RE.exec(range.trim());
+    if (!m) {
+        throw new Error(`engines.node is "${range}", which this package's own range parser does not understand (it only reads ">=X.Y" or ">=X.Y.Z")`);
+    }
+    return { major: Number(m[1]), minor: Number(m[2]), patch: Number(m[3] ?? 0) };
+}
+function parseVersionTriple(v) {
+    const core = v.split("-")[0].split("+")[0];
+    const [maj, min, pat] = core.split(".");
+    return [Number(maj) || 0, Number(min) || 0, Number(pat) || 0];
+}
+export function versionAtLeast(version, floor) {
+    const [a, b, c] = parseVersionTriple(version);
+    if (a !== floor.major)
+        return a > floor.major;
+    if (b !== floor.minor)
+        return b > floor.minor;
+    return c >= floor.patch;
+}
+/** The one range text every message reads, instead of writing "22.15" or "1.4" a second time. */
+export function supportedRangeText(range) {
+    const floor = parseNodeFloor(range);
+    return `Node ${floor.major}.${floor.minor} or newer, or bun ${BUN_MIN} or newer`;
+}
+/** Can this runtime run the CLI, and if not, what is the one command? */
+export function runtimeVerdict(facts, range) {
+    const floor = parseNodeFloor(range);
+    const rangeText = supportedRangeText(range);
+    if (facts.kind === "node") {
+        if (versionAtLeast(facts.version, floor)) {
+            return { supported: true, line: `runtime: Node ${facts.version} (supported: ${rangeText})` };
+        }
+        return {
+            supported: false,
+            line: `runtime: Node ${facts.version} is too old (supported: ${rangeText})`,
+            reason: `node:module has no registerHooks on Node ${facts.version}; Node ${floor.major}.${floor.minor} or newer is required`,
+            fix: FIX_COMMAND,
+        };
+    }
+    if (facts.kind === "bun") {
+        const bunFloor = parseNodeFloor(`>=${BUN_MIN}`);
+        if (versionAtLeast(facts.version, bunFloor)) {
+            return { supported: true, line: `runtime: bun ${facts.version} (supported: ${rangeText})` };
+        }
+        return {
+            supported: false,
+            line: `runtime: bun ${facts.version} is too old (supported: ${rangeText})`,
+            reason: `bun ${facts.version} has no node:sqlite, which the replica needs; bun ${BUN_MIN} or newer is required`,
+            fix: FIX_COMMAND,
+        };
+    }
+    return {
+        supported: false,
+        line: `runtime: unrecognised runtime (supported: ${rangeText})`,
+        reason: "could not detect a Node or bun version on this process",
+        fix: FIX_COMMAND,
+    };
+}

package/dist/sdk.js

@@ -0,0 +1,29 @@
+import { CliError } from "./errors.js";
+import { installTsDepsLoader } from "./ts-deps-loader.js";
+import { readManifest } from "./config.js";
+import { FIX_COMMAND, supportedRangeText } from "./runtime.js";
+let cached = null;
+const realImport = () => import("@catalyst-cloud/sdk/node");
+/** Import the SDK's node entry, installing the type-stripping loader first. Cached per process. */
+export function loadSdk(importer = realImport) {
+    if (!cached) {
+        cached = (async () => {
+            const verdict = installTsDepsLoader();
+            try {
+                return await importer();
+            }
+            catch (err) {
+                cached = null;
+                const detail = err instanceof Error ? err.message.split("\n")[0] : String(err);
+                const why = verdict.installed ? "" : ` (${verdict.reason})`;
+                throw new CliError(`the Catalyst Cloud SDK could not be loaded on Node ${process.version}${why}: ${detail} — this verb needs the SDK. ` +
+                    `Supported: ${supportedRangeText(readManifest().enginesNode)}. One command fixes it without changing your default Node: ${FIX_COMMAND}`, "sdk-unavailable");
+            }
+        })();
+    }
+    return cached;
+}
+/** Test seam: forget the cached import. */
+export function resetSdkCache() {
+    cached = null;
+}

package/dist/secret.js

@@ -0,0 +1,190 @@
+// secret.ts — `catalyst-skills secret set|import`: put a repository's secrets into the cloud from the
+// terminal, as the person who is logged in (CTC-3549). The cloud gates both on an admin or owner seat,
+// encrypts the value, and records who wrote it and where it came from, never the value itself.
+//
+// ⛔ A VALUE NEVER REACHES STDOUT, STDERR OR AN ERROR MESSAGE. It is read (stdin, a hidden prompt, or
+// the output of a local command), sent in one request body, and dropped. The cloud's responses carry
+// names and versions only, and every line this verb prints is built from those. A command's own
+// stdout is the value, so it is captured and never echoed; its stderr passes through untouched (a
+// sign-in prompt from `op` has to reach the person).
+//
+// ⭐ `--command` RUNS ON THIS MACHINE, in the person's own shell, with their own environment. That is
+// the point: `op read op://…` resolves against the 1Password session on the laptop, and the cloud
+// only ever sees the result. The command TEXT goes to the cloud as the audit `source`, so the log can
+// say where a value came from without holding it. Do not put a value in the command line itself.
+//
+// The routes are the browser's own (`/me/secrets`, `/me/secrets/import`): the cloud admits a personal
+// key or CLI login on them under the same gates as a session. They are not in the contract's
+// `routes[]` table (that table is the /api/v1/agent/* family), so the path is fixed here, and an
+// older cloud that still wants a session answers 401 — which this verb names as "needs a newer cloud".
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { basename } from "node:path";
+import { flagList, flagString, positionals } from "./args.js";
+import { requireConfig } from "./config.js";
+import { CliError, UsageError } from "./errors.js";
+import { promptSecret, stdinIsTty } from "./prompt.js";
+import { apiClient } from "./transport.js";
+export const SECRETS_PATH = "/me/secrets";
+export const SECRETS_IMPORT_PATH = "/me/secrets/import";
+const NAME_RE = /^[A-Z][A-Z0-9_]*$/;
+const REPO_RE = /^[^/\s]+\/[^/\s]+$/;
+/** Why an import line was not stored, in words a person can act on. */
+const IMPORT_REASONS = {
+    name_exists: "already set for this repository; pass --rotate <NAME> to replace it",
+    name_taken_by_env_var: "already a plain environment variable; a name is a secret or a variable, never both",
+    invalid_name: "not an env-style name (A-Z, 0-9 and _, starting with a letter)",
+    invalid_value: "the value is empty",
+    config_rotation_unconfirmed: "the existing entry is a readable config value; change it in the app",
+    probe_refused: "the value failed this kind's check",
+};
+/** A command's stdout, minus the one trailing newline almost every command prints after a value. */
+export function trimOneNewline(s) {
+    return s.endsWith("\r\n") ? s.slice(0, -2) : s.endsWith("\n") ? s.slice(0, -1) : s;
+}
+/** Run `command` through the person's shell. Stdout is captured (it is the value); stderr passes
+ *  through so an interactive sign-in can reach them. A non-zero exit stores nothing. */
+export function runLocalCommand(command, env) {
+    return new Promise((resolve, reject) => {
+        const shell = env.SHELL && env.SHELL.length > 0 ? env.SHELL : "/bin/sh";
+        const child = spawn(shell, ["-c", command], { env, stdio: ["inherit", "pipe", "inherit"] });
+        const chunks = [];
+        child.stdout.on("data", (c) => chunks.push(c));
+        child.on("error", (err) => reject(new CliError(`could not run the command: ${err.message}; nothing was stored`, "command-failed", 1)));
+        child.on("close", (code, signal) => {
+            if (code === 0)
+                resolve(Buffer.concat(chunks).toString("utf8"));
+            else
+                reject(new CliError(`the command ${signal ? `was killed by ${signal}` : `exited ${code}`}; nothing was stored`, "command-failed", 1));
+        });
+    });
+}
+function requireRepo(args, verb) {
+    const repo = flagString(args, "repo");
+    if (repo === undefined)
+        throw new UsageError(`secret ${verb} needs --repo <owner/name>`);
+    if (!REPO_RE.test(repo))
+        throw new UsageError(`--repo must be owner/name (got "${repo}")`);
+    return repo;
+}
+/** The cloud's refusal, in its own words, plus what to do for the two we can explain. */
+function refusalLine(status, body, repo) {
+    if (status === 401) {
+        return "refused (401): the cloud did not accept your credential here. If `catalyst-skills me` works, this cloud predates secret writes from the CLI and needs a newer release; otherwise log in again.";
+    }
+    if (status === 404)
+        return `refused (404): ${repo} is not a repository of this tenant (register it in the app first)`;
+    if (status === 409 && body.error === "registry_not_migrated") {
+        return "refused (409): the cloud's secret audit is not set up yet, so nothing was stored. Tell your Catalyst operator.";
+    }
+    return `refused (${status}): ${body.message ?? body.error ?? "no reason given"}`;
+}
+function renderDeclared(declared, repo) {
+    if (declared === undefined)
+        return [];
+    if (declared === null)
+        return [`${repo} has no approved environment declaration, so there is no declared list to check against`];
+    if (declared.declared.length === 0)
+        return [`${repo}'s approved declaration names no secrets`];
+    if (declared.missing.length === 0)
+        return [`every declared secret has a value (${declared.declared.length})`];
+    return [`declared but still without a value (${declared.missing.length}): ${declared.missing.join(", ")}`];
+}
+const ACCEPT = [400, 401, 403, 404, 409, 422];
+async function readStdinText() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString("utf8");
+}
+export async function cmdSecret(args, ctx, deps = {}) {
+    const [sub, ...rest] = positionals(args);
+    if (sub !== "set" && sub !== "import")
+        throw new UsageError(`unknown secret subcommand "${sub ?? ""}": set | import`);
+    if (rest.length !== 1) {
+        throw new UsageError(sub === "set" ? "secret set takes one NAME" : "secret import takes one file (a .env file)");
+    }
+    const repo = requireRepo(args, sub);
+    return sub === "set" ? setOne(args, ctx, deps, rest[0], repo) : importFile(args, ctx, rest[0], repo);
+}
+async function setOne(args, ctx, deps, name, repo) {
+    if (!NAME_RE.test(name))
+        throw new UsageError(`"${name}" is not an env-style name (A-Z, 0-9 and _, starting with a letter)`);
+    if (flagList(args, "rotate").length > 0)
+        throw new UsageError("--rotate belongs to secret import; secret set always replaces the value");
+    const command = flagString(args, "command");
+    const cfg = requireConfig(ctx);
+    let value;
+    let source;
+    if (command !== undefined) {
+        if (command.trim() === "")
+            throw new UsageError("--command is empty");
+        value = trimOneNewline(await (deps.runCommand ?? runLocalCommand)(command, ctx.env));
+        source = `command: ${command}`;
+    }
+    else if ((deps.isTty ?? stdinIsTty)()) {
+        value = await (deps.prompt ?? ((q) => promptSecret(q)))(`Value for ${name} (input hidden): `);
+        source = "prompt";
+    }
+    else {
+        value = trimOneNewline(await (deps.readStdin ?? readStdinText)());
+        source = "stdin";
+    }
+    if (value === "")
+        throw new CliError(`the value for ${name} is empty; nothing was stored`, "empty-value", 1);
+    const res = await apiClient(cfg, ctx).postJson(SECRETS_PATH, { name, value, scope: "repo", repo, source }, { accept: ACCEPT });
+    const body = res.body;
+    if (res.status !== 200 && res.status !== 201) {
+        if (args.json)
+            ctx.stdout(JSON.stringify({ status: res.status, error: body.error ?? null, message: body.message ?? null }));
+        else
+            ctx.stdout(refusalLine(res.status, body, repo));
+        return 1;
+    }
+    if (args.json) {
+        ctx.stdout(JSON.stringify({ name, repo, version: body.version ?? null, created: body.created ?? null, declared: body.declared ?? null }));
+        return 0;
+    }
+    ctx.stdout(`stored ${name} for ${repo} (version ${body.version ?? "?"}, ${body.created ? "new" : "replaced"}; from ${command !== undefined ? "the command" : source})`);
+    for (const line of renderDeclared(body.declared, repo))
+        ctx.stdout(line);
+    return 0;
+}
+async function importFile(args, ctx, file, repo) {
+    if (flagString(args, "command") !== undefined)
+        throw new UsageError("--command belongs to secret set");
+    let text;
+    try {
+        text = readFileSync(file, "utf8");
+    }
+    catch (err) {
+        throw new UsageError(`could not read ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const cfg = requireConfig(ctx);
+    const rotate = flagList(args, "rotate");
+    const res = await apiClient(cfg, ctx).postJson(SECRETS_IMPORT_PATH, { repo, text, rotateExisting: rotate, source: `import: ${basename(file)}` }, { accept: ACCEPT });
+    const body = res.body;
+    if (res.status !== 200) {
+        if (args.json)
+            ctx.stdout(JSON.stringify({ status: res.status, error: body.error ?? null, message: body.message ?? null }));
+        else
+            ctx.stdout(refusalLine(res.status, body, repo));
+        return 1;
+    }
+    const created = body.created ?? [];
+    const rotated = body.rotated ?? [];
+    const errors = body.errors ?? [];
+    if (args.json) {
+        ctx.stdout(JSON.stringify({ repo, created, rotated, errors, declared: body.declared ?? null }));
+        return errors.length > 0 ? 1 : 0;
+    }
+    const stored = created.length + rotated.length;
+    ctx.stdout(stored === 0 ? `stored nothing for ${repo}` : `stored ${stored} for ${repo}: ${[...created, ...rotated].join(", ")}`);
+    if (rotated.length > 0)
+        ctx.stdout(`  replaced: ${rotated.join(", ")}`);
+    for (const e of errors)
+        ctx.stdout(`not stored: ${e.name} (${IMPORT_REASONS[e.reason] ?? e.reason})`);
+    for (const line of renderDeclared(body.declared, repo))
+        ctx.stdout(line);
+    return errors.length > 0 ? 1 : 0;
+}

package/dist/semver.js

@@ -0,0 +1,18 @@
+// semver.ts — the one three-field comparator every version-drift check in this package shares
+// (the tenant-minimum bundle check, and CTC-2160's published-release checks).
+/** True when `a` is a semver-older release than `b`. Prerelease/build metadata is ignored; a segment
+ *  that does not parse counts as 0. A tiny compare on purpose — no dependency for three fields. */
+export function semverOlder(a, b) {
+    const parse = (v) => {
+        const core = v.split("-")[0].split("+")[0];
+        const p = core.split(".");
+        return [Number(p[0]) || 0, Number(p[1]) || 0, Number(p[2]) || 0];
+    };
+    const [a0, a1, a2] = parse(a);
+    const [b0, b1, b2] = parse(b);
+    if (a0 !== b0)
+        return a0 < b0;
+    if (a1 !== b1)
+        return a1 < b1;
+    return a2 < b2;
+}