@revturbine/cli 0.19.5 → 0.20.0

package/README.md

@@ -65,13 +65,13 @@ Commands that read a config name the version explicitly — there is no default:
 |---|---|
 | `init` (alias `create`) | Set up RevTurbine while preserving existing integrations: install missing packages, pin the CLI exactly, create a starter for a fresh integration, and install skills for one agent. Use `--scaffold` to create a missing root starter explicitly; existing files are never overwritten. `--agent claude-code\|cursor\|codex` overrides environment detection; an unknown agent skips skills and prints the selection command. Also supports `--dir`, `--dry-run`, `--no-skills`, `--json`. With no `package.json`, offers a new project (`--yes` for noninteractive creation). Runs the invoked CLI even inside a repo that pins a different one. |
 | `signup` | Create an account headlessly: email + password, then an emailed one-time code to verify, then a token is stored. |
-| `login` / `logout` | Device-flow auth; tokens stored at `~/.revturbine/credentials.json` (mode 0600). |
-| `whoami` | Authentication state first: not logged in, credentials accepted, credentials rejected for the selected instance/tenant, or verification unavailable. Then shows instance, tenant, and credentials source; configured tenant information alone does not prove login. Verification and subsequent telemetry each time out after 3 seconds. Status reports exit 0. `--json` retains its seven fields: `instance`, `tenant`, `tenant_source`, `credentials_dir`, `credentials_source`, `token_present` (boolean), and `token_valid` (`true` for 2xx, `false` for 401/403, `null` when absent or unverified, including redirects, other HTTP errors, timeouts and network failures). |
+| `login` / `logout` | Device-flow auth; tokens stored at `~/.revturbine/credentials.json` (mode 0600). For CI, skip login and set `REVTURBINE_TOKEN` (see [CI / non-interactive use](#ci--non-interactive-use)). |
+| `whoami` | Authentication state first: not logged in, credentials accepted, credentials rejected for the selected instance/tenant, or verification unavailable. Then shows instance, tenant, and credentials source; configured tenant information alone does not prove login. Verification and subsequent telemetry each time out after 3 seconds. Status reports exit 0. `--json` retains its seven fields: `instance`, `tenant` (`null` when `REVTURBINE_TOKEN` is set without `-t`: the server resolves the token user's own tenant, and `tenant_source` names the variable), `tenant_source`, `credentials_dir`, `credentials_source`, `token_present` (boolean), and `token_valid` (`true` for 2xx, `false` for 401/403, `null` when absent or unverified, including redirects, other HTTP errors, timeouts and network failures). |
 | `schema` | Emit the bundled `RevTurbineConfig` JSON schema (for agents to author against). |
 | `docs` | Print the canonical documentation URL. |
 | `download` | Fetch a config version (`--live` / `--draft` / `--release <id>`); `--save`. |
 | `validate` | Offline schema validation of a `<file>`, or the full server catalog against the open draft (`--draft`). |
-| `diff` | Compare any two versions (dry-run, no writes). A file vs `--draft`/`--live`/`--release` previews the launch — the server side is the base, so `+`/`-` read as created/pruned on launch. |
+| `diff` | Compare any two versions (dry-run, no writes). A file vs `--draft`/`--live`/`--release` previews the launch — the server side is the base, so `+`/`-` read as created/pruned on launch. `--exit-code` makes the status machine-readable: `0` no differences, `1` differences, anything else an error (an unexpected internal error exits `70` so `1` always means "differences"). Every top-level Playbook collection is compared. |
 | `show <kind>` | Summary tables: `plans` · `entitlements` · `segments` · `placements` · `trials` for any version. |
 | `upload` | Stage a Playbook file as the open draft. |
 | `launch` | Take a config live: validate (launch gate) → submit → approve → deploy. `launch <file>` or `launch --draft`. |
@@ -145,6 +145,33 @@ Public ingest tokens are intentionally embeddable but remain tenant-bound,
 origin-restricted, and optionally IP-restricted. They cannot mint other tokens
 or access private control-plane APIs.
 
+## CI / non-interactive use
+
+`login` and `signup` are interactive. In CI, supply the token through the
+environment instead:
+
+| Variable | Meaning |
+|---|---|
+| `REVTURBINE_TOKEN` | Bearer token for every request. Wins over any stored credential (which is then ignored). With it set and no `-t/--tenant-id`, **no `x-tenant-id` header is sent** and the server resolves the token user's own tenant; `-t` still sends one (it must be that tenant). |
+| `REVTURBINE_HTTP_HEADERS` | A JSON object of extra headers added to every request to the RevTurbine instance, e.g. `{"x-vercel-protection-bypass":"…"}` to reach a protection-gated preview/staging deployment. It may not set `Authorization`, `x-tenant-id`, `x-rt-tenant-id` or `Content-Type`. A malformed value exits `2`. |
+
+Neither the token nor any header value is ever logged, echoed in an error, or
+sent as telemetry: diagnostics name only the variable and the header names, and
+any stderr line that would contain a registered secret shows `<redacted>`.
+
+```bash
+export REVTURBINE_TOKEN="$RT_TOKEN"
+export REVTURBINE_HTTP_HEADERS="{\"x-vercel-protection-bypass\":\"$VERCEL_BYPASS\"}"
+URL=https://staging.example.com/app
+if revturbine diff ./seed.playbook.json --live --url "$URL" --exit-code; then
+  echo "no changes: skip launch"
+else
+  status=$?
+  [ "$status" -eq 1 ] || exit "$status"   # 2-7 / 70 = a real error
+  revturbine launch ./seed.playbook.json --url "$URL"
+fi
+```
+
 ## Exit-code classes
 
 ```
@@ -158,6 +185,9 @@ or access private control-plane APIs.
 7  server error
 ```
 
+`diff --exit-code` is the one exception: `1` means "differences" there, and an
+unexpected internal error exits `70` instead.
+
 ## Schema validation
 
 Validation is **mandatory** and runs fully offline against a vendored,

package/dist/cli.js

@@ -15609,8 +15609,8 @@ function openBrowser(url) {
   } catch {
   }
 }
-async function deviceLogin(baseUrl, log = console.log) {
-  const start = await startDeviceAuth(baseUrl, os2.hostname(), fetch);
+async function deviceLogin(baseUrl, log = console.log, fetchImpl = fetch) {
+  const start = await startDeviceAuth(baseUrl, os2.hostname(), fetchImpl);
   log("");
   log(`To authorize this device, visit:
     ${start.verification_uri}`);
@@ -15622,7 +15622,7 @@ async function deviceLogin(baseUrl, log = console.log) {
     deviceCode: start.device_code,
     intervalSeconds: start.interval,
     expiresInSeconds: start.expires_in,
-    fetchImpl: fetch,
+    fetchImpl,
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
     onPending: () => process.stdout.write(".")
   });
@@ -15717,6 +15717,77 @@ Account created. Enter the verification code emailed to ${opts.email}.`);
   return { status: "signed_in", token };
 }
 
+// src/lib/env-auth.ts
+var TOKEN_ENV = "REVTURBINE_TOKEN";
+var HEADERS_ENV = "REVTURBINE_HTTP_HEADERS";
+var DEFAULT_TENANT_ID = "dev-tenant-001";
+function resolveAuth(params) {
+  const envToken = params.envToken?.trim();
+  const explicit = params.explicitTenantId;
+  if (envToken) {
+    return {
+      token: envToken,
+      tokenSource: "env",
+      tenantId: explicit ?? null,
+      tenantSource: explicit ? "--tenant-id" : `${TOKEN_ENV}; resolved server-side`
+    };
+  }
+  const stored = params.stored;
+  return {
+    token: stored?.token ?? null,
+    tokenSource: stored ? "stored" : "none",
+    tenantId: explicit ?? stored?.tenant_id ?? DEFAULT_TENANT_ID,
+    tenantSource: explicit ? "--tenant-id" : stored?.tenant_id ? "stored token" : "default"
+  };
+}
+var RESERVED = /* @__PURE__ */ new Map([
+  ["authorization", `use ${TOKEN_ENV}`],
+  ["x-tenant-id", "use -t/--tenant-id"],
+  ["x-rt-tenant-id", "use -t/--tenant-id"],
+  ["content-type", "set by the CLI"]
+]);
+var HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+function parseExtraHeaders(raw) {
+  if (raw === void 0 || raw.trim() === "") return { ok: true, headers: {} };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { ok: false, error: `${HEADERS_ENV} is not valid JSON (expected an object of header name \u2192 string value)` };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { ok: false, error: `${HEADERS_ENV} must be a JSON object of header name \u2192 string value` };
+  }
+  const headers = {};
+  for (const [name, value] of Object.entries(parsed)) {
+    if (!HEADER_NAME.test(name)) {
+      return { ok: false, error: `${HEADERS_ENV} has an invalid header name (${JSON.stringify(name.slice(0, 64))})` };
+    }
+    const reserved = RESERVED.get(name.toLowerCase());
+    if (reserved) {
+      return { ok: false, error: `${HEADERS_ENV} may not set ${name} (${reserved})` };
+    }
+    if (typeof value !== "string") {
+      return { ok: false, error: `${HEADERS_ENV} header ${name} must have a string value` };
+    }
+    if (/[\r\n\0]/.test(value)) {
+      return { ok: false, error: `${HEADERS_ENV} header ${name} has a value with a control character` };
+    }
+    headers[name] = value;
+  }
+  return { ok: true, headers };
+}
+function withExtraHeaders(fetchImpl, extra) {
+  if (Object.keys(extra).length === 0) return fetchImpl;
+  return (input, init) => {
+    const headers = new Headers(init?.headers);
+    for (const [name, value] of Object.entries(extra)) {
+      if (!headers.has(name)) headers.set(name, value);
+    }
+    return fetchImpl(input, { ...init, headers });
+  };
+}
+
 // src/lib/track.ts
 var CLI_UNTRACKED_COMMANDS = /* @__PURE__ */ new Set(["login", "signup", "logout"]);
 function shouldTrackCommandExecution(name, hasUrl) {
@@ -15725,14 +15796,16 @@ function shouldTrackCommandExecution(name, hasUrl) {
 async function trackEvent(rawUrl, explicitTenantId, eventType, payload, signal) {
   try {
     const url = normalizeBaseUrl(rawUrl);
-    const cred = getCredential(url);
-    if (!cred) return;
+    const auth = resolveAuth({ envToken: process.env[TOKEN_ENV], stored: getCredential(url), explicitTenantId });
+    if (!auth.token) return;
+    const extra = parseExtraHeaders(process.env[HEADERS_ENV]);
     await fetch(`${url}/api/events`, {
       method: "POST",
       headers: {
+        ...extra.ok ? extra.headers : {},
         "Content-Type": "application/json",
-        "x-tenant-id": explicitTenantId ?? cred.tenant_id ?? "dev-tenant-001",
-        Authorization: `Bearer ${cred.token}`
+        ...auth.tenantId ? { "x-tenant-id": auth.tenantId } : {},
+        Authorization: `Bearer ${auth.token}`
       },
       body: JSON.stringify({ event_type: eventType, payload }),
       ...signal ? { signal } : {}
@@ -15755,12 +15828,21 @@ var COLLECTIONS = [
   // BL-0176 / BL-0178: first-class objectives, keyed by handle.
   "objectives"
 ];
+function collectionsOf(current, next) {
+  const named = new Set(COLLECTIONS);
+  const extra = /* @__PURE__ */ new Set();
+  for (const side of [current, next]) {
+    if (!side || typeof side !== "object") continue;
+    for (const [k, v] of Object.entries(side)) if (Array.isArray(v) && !named.has(k)) extra.add(k);
+  }
+  return [...COLLECTIONS, ...[...extra].sort()];
+}
 function keyOf(item) {
   return item?.handle ?? item?.unique_handle ?? item?.name ?? item?.id ?? JSON.stringify(item);
 }
 function diffExportedConfig(current, next) {
   const diff = {};
-  for (const coll of COLLECTIONS) {
+  for (const coll of collectionsOf(current, next)) {
     const cur = Array.isArray(current?.[coll]) ? current[coll] : [];
     const nxt = Array.isArray(next?.[coll]) ? next[coll] : [];
     if (cur.length === 0 && nxt.length === 0) continue;
@@ -16814,11 +16896,21 @@ function isNetworkError(err) {
   return err instanceof TypeError || err instanceof Error && /fetch failed|ECONN|ENOTFOUND|ETIMEDOUT|EAI_AGAIN/i.test(err.message);
 }
 var LOG = "[revturbine]";
+var secrets = /* @__PURE__ */ new Set();
+function registerSecrets(values) {
+  for (const v of values) if (v.length >= 4) secrets.add(v);
+}
+function redact(message) {
+  if (secrets.size === 0) return message;
+  let out = message;
+  for (const s of [...secrets].sort((a, b) => b.length - a.length)) out = out.split(s).join("<redacted>");
+  return out;
+}
 function diag(message) {
-  console.error(`${LOG} ${message}`);
+  console.error(redact(`${LOG} ${message}`));
 }
 function diagRaw(message) {
-  console.error(message);
+  console.error(redact(message));
 }
 function emit(data, json, humanText) {
   if (json) {
@@ -16830,9 +16922,13 @@ function emit(data, json, humanText) {
   }
 }
 function fail(cls, message) {
-  console.error(`${LOG} \u2717 ${message}`);
+  console.error(redact(`${LOG} \u2717 ${message}`));
   process.exit(cls);
 }
+var DIFF_EXIT = { NO_DIFFERENCES: 0, DIFFERENCES: 1, UNEXPECTED: 70 };
+function diffExitCode(diff) {
+  return Object.keys(diff).length === 0 ? DIFF_EXIT.NO_DIFFERENCES : DIFF_EXIT.DIFFERENCES;
+}
 
 // src/lib/pin-drift.ts
 function isRecord7(value) {
@@ -17102,14 +17198,33 @@ function verifyConfig(file) {
   if (check.advisories.length > 0) diagRaw(formatFindings(check.advisories));
   return check.body;
 }
+var extraHeadersCache;
+function extraHeaders() {
+  if (extraHeadersCache) return extraHeadersCache;
+  const parsed = parseExtraHeaders(process.env[HEADERS_ENV]);
+  if (!parsed.ok) fail(EXIT.USAGE, parsed.error);
+  registerSecrets(Object.values(parsed.headers));
+  extraHeadersCache = parsed.headers;
+  return parsed.headers;
+}
+function instanceFetch() {
+  return withExtraHeaders(fetch, extraHeaders());
+}
 function connect(rawUrl, explicitTenantId, diagnostic = diag) {
   const url = normalizeBaseUrl(rawUrl);
   const { dir, source } = resolveConfigDir();
-  const cred = getCredential(url);
-  const tenantId = explicitTenantId ?? cred?.tenant_id ?? "dev-tenant-001";
-  const tenantSource = explicitTenantId ? "--tenant-id" : cred?.tenant_id ? "stored token" : "default";
-  diagnostic(`Tenant ${tenantId} (${tenantSource}); credentials: ${dir} [${source}].`);
-  if (source === "global") {
+  const extra = extraHeaders();
+  const envToken = process.env[TOKEN_ENV];
+  if (envToken?.trim()) registerSecrets([envToken.trim()]);
+  const auth = resolveAuth({ envToken, stored: getCredential(url), explicitTenantId });
+  const { tenantId, tenantSource } = auth;
+  const extraNote = Object.keys(extra).length ? `; extra headers: ${Object.keys(extra).join(", ")} [${HEADERS_ENV}, values redacted]` : "";
+  if (auth.tokenSource === "env") {
+    diagnostic(`Tenant ${tenantId ?? "(the token user's own)"} (${tenantSource}); token: ${TOKEN_ENV}${extraNote}.`);
+  } else {
+    diagnostic(`Tenant ${tenantId} (${tenantSource}); credentials: ${dir} [${source}]${extraNote}.`);
+  }
+  if (source === "global" && auth.tokenSource !== "env") {
     diagnostic(
       `WARNING: using the global ${dir} - NOT worktree-scoped. If this session is for a specific customer, run from that customer's worktree (with its own .revturbine/) so a stale login can't target the wrong tenant.`
     );
@@ -17120,20 +17235,27 @@ function connect(rawUrl, explicitTenantId, diagnostic = diag) {
     tenantSource,
     credentialsDir: dir,
     credentialsSource: source,
-    hasToken: Boolean(cred),
+    hasToken: auth.token !== null,
+    tokenSource: auth.tokenSource,
     headers: {
+      ...extra,
       "Content-Type": "application/json",
-      "x-tenant-id": tenantId,
-      ...cred ? { Authorization: `Bearer ${cred.token}` } : {}
+      ...tenantId ? { "x-tenant-id": tenantId } : {},
+      ...auth.token ? { Authorization: `Bearer ${auth.token}` } : {}
     }
   };
 }
 function uploadTenantFor(rawUrl, config, explicit) {
+  const embedded = config?.tenant_id;
+  if (process.env[TOKEN_ENV]?.trim()) {
+    if (!explicit && embedded) diag(`sending to the config's embedded tenant ${embedded} (pass -t to retarget).`);
+    return explicit ?? embedded ?? void 0;
+  }
   const cred = getCredential(normalizeBaseUrl(rawUrl));
   const target = resolveUploadTarget({
-    embedded: config?.tenant_id,
+    embedded,
     explicit,
-    session: cred?.tenant_id ?? "dev-tenant-001"
+    session: cred?.tenant_id ?? DEFAULT_TENANT_ID
   });
   if (!target.ok) fail(EXIT.VALIDATION, target.error);
   if (target.note) diag(target.note);
@@ -17141,8 +17263,10 @@ function uploadTenantFor(rawUrl, config, explicit) {
 }
 function authHint(url, status) {
   if (status === 401 || status === 403) {
-    diag(`Authentication required for ${url}. Log in with:
-  revturbine login ${url}`);
+    diag(
+      process.env[TOKEN_ENV]?.trim() ? `Authentication failed for ${url} with ${TOKEN_ENV}: check the token and its tenant membership.` : `Authentication required for ${url}. Log in with:
+  revturbine login ${url}`
+    );
   }
 }
 function httpFail(conn, what, status, detail) {
@@ -17378,6 +17502,16 @@ Auth:
   ~/.revturbine/credentials.json (0600); the token's tenant is used by default,
   override with -t/--tenant-id. Mutating commands (discard, restore) prompt
   for confirmation unless --yes.
+
+CI / non-interactive:
+  REVTURBINE_TOKEN          bearer token; wins over the stored credential. Without
+                            -t no x-tenant-id is sent (the server resolves the
+                            token user's own tenant).
+  REVTURBINE_HTTP_HEADERS   JSON object of extra headers for every request, e.g.
+                            {"x-vercel-protection-bypass":"..."}.
+  Neither the token nor any header value is ever logged or echoed.
+  \`diff ... --exit-code\` exits 0 = no differences, 1 = differences, other = error
+  (an unexpected error exits 70 there).
   \`whoami\` leads with absent, accepted, rejected, or unverifiable credentials;
   a configured tenant alone does not prove login. Verification and subsequent
   telemetry each time out after 3 seconds. Status reports exit 0; --json keeps
@@ -17392,6 +17526,7 @@ SDK updates:
 Full reference: ${DOCS_URL}
 `;
 var program = new Command();
+var unexpectedExit = EXIT.UNEXPECTED;
 program.hook("postAction", async (_thisCommand, actionCommand) => {
   const opts = actionCommand.opts();
   if (actionCommand.name() === "validate" && !opts.draft) return;
@@ -17564,7 +17699,7 @@ program.command("init").alias("create").description("Set up RevTurbine while pre
 program.command("login").description("Authorize this machine via the browser (device flow) and store a token for the instance (default: the production instance).").argument("[url]", `RevTurbine instance URL (default: ${DEFAULT_URL})`).action(async (url) => {
   try {
     const base = normalizeBaseUrl(url ?? DEFAULT_URL);
-    await deviceLogin(base);
+    await deviceLogin(base, console.log, instanceFetch());
     await trackEvent(base, void 0, "cli_signed_in");
   } catch (err) {
     fail(EXIT.AUTH, `Login failed: ${err.message}`);
@@ -17635,7 +17770,8 @@ program.command("signup").description("Create a RevTurbine account and log in (e
       name,
       email,
       password,
-      promptOtp: (attempt) => promptLine(attempt > 1 ? "Verification code (try again): " : "Verification code: ")
+      promptOtp: (attempt) => promptLine(attempt > 1 ? "Verification code (try again): " : "Verification code: "),
+      fetchImpl: instanceFetch()
     });
     if (result.status === "awaiting_invitation") process.exit(0);
     await trackEvent(baseUrl, void 0, "cli_signed_up");
@@ -17679,8 +17815,8 @@ program.command("whoami").description("Show authentication state first (absent,
     [
       formatAuthentication(conn.hasToken, tokenValid),
       `instance:    ${data.instance}`,
-      `tenant:      ${data.tenant} (${data.tenant_source})`,
-      `credentials: ${data.credentials_dir} [${data.credentials_source}]`
+      `tenant:      ${data.tenant ?? "(the token user's own)"} (${data.tenant_source})`,
+      conn.tokenSource === "env" ? `credentials: ${TOKEN_ENV} (env; stored credentials ignored)` : `credentials: ${data.credentials_dir} [${data.credentials_source}]`
     ].join("\n")
   );
   for (const message of diagnostics) diag(message);
@@ -17765,15 +17901,18 @@ program.command("validate").description("Validate a Playbook file offline (schem
   }
   diag("\u2713 No blocking findings.");
 });
-program.command("diff").description("Compare two config versions (first \u2192 second; a file vs --draft/--live/--release previews the launch \u2014 the server side is the base). Dry-run, no writes.").argument("[file...]", "Local Playbook file path(s)").option("--draft", "The tenant's open draft").option("--live", "The current live Release").option("--release <id>", "A specific playbook version / Release").option("-u, --url <url>", "RevTurbine instance URL", DEFAULT_URL).option("-t, --tenant-id <id>", "x-tenant-id (defaults to the stored token tenant)").action(async (files, opts) => {
+program.command("diff").description("Compare two config versions (first \u2192 second; a file vs --draft/--live/--release previews the launch \u2014 the server side is the base). Dry-run, no writes.").argument("[file...]", "Local Playbook file path(s)").option("--draft", "The tenant's open draft").option("--live", "The current live Release").option("--release <id>", "A specific playbook version / Release").option("-u, --url <url>", "RevTurbine instance URL", DEFAULT_URL).option("-t, --tenant-id <id>", "x-tenant-id (defaults to the stored token tenant)").option("--exit-code", "Exit 0 when there are no differences, 1 when there are (any other code is an error); for CI no-op detection").action(async (files, opts) => {
+  if (opts.exitCode) unexpectedExit = DIFF_EXIT.UNEXPECTED;
   const sels = requireSelectors(opts, files, { count: 2, allowed: ["file", "draft", "live", "release"], command: "diff" });
   const ordered = orderDiffSelectors(sels);
   const needsServer = ordered.some((s) => s.kind !== "file");
   const conn = needsServer ? connect(opts.url, opts.tenantId) : null;
   const [a, b] = await Promise.all(ordered.map((s) => loadVersion(conn, s)));
   diag(`Diff (${ordered.map((s) => s.kind === "file" ? s.path : s.kind === "release" ? `--release ${s.id}` : `--${s.kind}`).join(" \u2192 ")}):`);
-  process.stdout.write(`${formatDiff(diffExportedConfig(a, b))}
+  const diff = diffExportedConfig(a, b);
+  process.stdout.write(`${formatDiff(diff)}
 `);
+  if (opts.exitCode) process.exitCode = diffExitCode(diff);
 });
 program.command("show").description(`Render a summary view of a config version. <kind> \u2208 ${SHOW_KINDS.join(" | ")}.`).argument("<kind>", `One of: ${SHOW_KINDS.join(", ")}`).option("--file <path>", "A local Playbook file").option("--draft", "The tenant's open draft").option("--live", "The current live Release").option("--release <id>", "A specific playbook version / Release").option("-u, --url <url>", "RevTurbine instance URL", DEFAULT_URL).option("-t, --tenant-id <id>", "x-tenant-id (defaults to the stored token tenant)").option("--json", "Machine-readable output").action(
   async (kind, opts) => {
@@ -18365,7 +18504,7 @@ if (process.argv.includes("-V") || process.argv.includes("--version")) {
       console.error(`[revturbine] \u2717 ${err.message}`);
       process.exit(EXIT.USAGE);
     }
-    console.error(`[revturbine] \u2717 ${err.message}`);
-    process.exit(EXIT.UNEXPECTED);
+    console.error(redact(`[revturbine] \u2717 ${err.message}`));
+    process.exit(unexpectedExit);
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revturbine/cli",
-  "version": "0.19.5",
+  "version": "0.20.0",
   "description": "revturbine — validate RevTurbine Playbooks and ship them to a RevTurbine instance through the playbook-version lifecycle (draft → Release).",
   "license": "MIT",
   "repository": {