@tokenoftrust/cli 1.3.0-rc.0 → 1.3.0-rc.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "1.3.0-rc.0",
+  "version": "1.3.0-rc.1",
   "description": "Token of Trust developer CLI — check out a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/dev.mjs

@@ -386,7 +386,15 @@ export function pickRunnerVersion(meta, { cliVersion, explicitPin }) {
     return { version: distTags[explicitPin] || explicitPin, reason: `pinned ${explicitPin}` };
   }
 
-  // 2) CLI-minor match: highest published <major>.<minor>.* (numeric patch order).
+  // 2) EXACT CLI-version match — the primary path for a lockstep release: the runner
+  // is published at the SAME version as the CLI (incl. prereleases like 1.3.0-rc.0,
+  // which the stable-only minor match below deliberately skips). This is what makes
+  // `tot@1.3.0-rc.0` pull `runner@1.3.0-rc.0` instead of falling back to stale latest.
+  if (versions.includes(cliVersion)) {
+    return { version: cliVersion, reason: "exact CLI-version match" };
+  }
+
+  // 3) CLI-minor match: highest published <major>.<minor>.* (numeric patch order).
   const m = /^(\d+)\.(\d+)\./.exec(cliVersion || "");
   if (m) {
     const prefix = `${m[1]}.${m[2]}.`;
@@ -398,7 +406,7 @@ export function pickRunnerVersion(meta, { cliVersion, explicitPin }) {
     }
   }
 
-  // 3) Fallback: the `latest` dist-tag (pre-alignment safety net).
+  // 4) Fallback: the `latest` dist-tag (pre-alignment safety net).
   if (distTags.latest) return { version: distTags.latest, reason: "fell back to latest (no CLI-minor match)" };
   throw new Error("no publishable runner version (no CLI-minor match and no `latest` dist-tag)");
 }