@tokenoftrust/cli 1.3.4-rc.0 → 1.3.4-rc.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "1.3.4-rc.0",
+  "version": "1.3.4-rc.1",
   "description": "Token of Trust developer CLI — check out a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/dev.mjs

@@ -425,12 +425,15 @@ export async function resolveRendererSource(args, { client } = {}) {
  * is keyed by version, upgrading the CLI busts the stale-runner cache automatically
  * (the 2026-07-14 "cached runner (prior tot dev)" staleness).
  *
- * GRACEFUL + SEQUENCING-SAFE: an explicit pin (`--renderer-version` / TOT_RUNNER_VERSION)
- * always wins. Otherwise we prefer the CLI-minor match, and FALL BACK to the `latest`
- * dist-tag when no aligned version is published yet — so this is safe to ship BEFORE
- * the runner is republished at CLI-aligned versions (today runner=0.1.x, cli=1.2.x →
- * no 1.2 match → falls back to latest). Once the coupled publish lands, the pin
- * activates on its own with no further code change.
+ * EXACT-FIRST (the CLI requests its OWN version): with lockstep publishing the runner
+ * is published at the SAME version as the CLI, so the exact match (step 2) is the normal
+ * path. An explicit pin (`--renderer-version` / TOT_RUNNER_VERSION) always wins. When no
+ * exact match exists we degrade ONLY DOWNWARD — a runner at or below the CLI's major.minor
+ * (never ahead) — and NEVER to a floating dist-tag like `latest` (a channel can point at a
+ * version this CLI doesn't expect; that floating-tag drift is the exact bug this avoids).
+ * The caller emits a LOUD skew warning whenever the resolved version isn't the exact CLI
+ * version, so a mismatch is visible, not silent. If nothing exact/minor/≤-ceiling is
+ * published, we THROW — a release gap to fix by publishing the aligned runner, not paper over.
  *
  * Pure (no I/O) for testability.
  * @param {any} meta npm packument (`dist-tags` + `versions`)
@@ -493,10 +496,12 @@ export function pickRunnerVersion(meta, { cliVersion, explicitPin }) {
     const version = capped[capped.length - 1];
     return { version, reason: `highest ≤ CLI major.minor ${cliMM ? `${cliMM.major}.${cliMM.minor}` : "?"}` };
   }
-  // Last resort: `latest`, but ONLY if it doesn't breach the ceiling.
-  if (distTags.latest && withinCeiling(distTags.latest)) {
-    return { version: distTags.latest, reason: "fell back to latest (within CLI ceiling)" };
-  }
+  // NO floating-tag last resort. We deliberately do NOT fall back to the `latest`
+  // dist-tag: a channel can drift behind/ahead of what THIS CLI expects (the exact
+  // failure mode that shipped stale CLIs — see the copy-paste pin in the storefront
+  // cockpit). If nothing exact/minor/≤-ceiling is published, that's a release gap to
+  // fix by publishing the runner at the CLI's version — not something to paper over
+  // with whatever `latest` happens to point at.
   throw new Error(
     `no runner version at or below the CLI's major.minor (${cliMM ? `${cliMM.major}.${cliMM.minor}` : cliVersion})`,
   );
@@ -536,7 +541,17 @@ export async function resolvePublicRendererSource(args, env = process.env) {
     throw new Error(`npm metadata for ${pkg} failed: HTTP ${res.status} ${res.statusText}`);
   }
   const meta = await res.json();
-  const { version } = pickRunnerVersion(meta, { cliVersion: CLI_VERSION, explicitPin });
+  const { version, reason } = pickRunnerVersion(meta, { cliVersion: CLI_VERSION, explicitPin });
+  // Exact is the goal (lockstep publish → runner@CLI_VERSION always present). If we
+  // resolved something ELSE, the versions are skewed — surface it LOUDLY instead of
+  // silently running a mismatched runner (the class of bug this whole change targets).
+  if (!explicitPin && version !== CLI_VERSION) {
+    console.warn(
+      `  ⚠ runner ${version} — no exact @${CLI_VERSION} published (${reason}). ` +
+        `CLI/runner versions are SKEWED; publish the runner at ${CLI_VERSION} to align ` +
+        `(or pin with --renderer-version to silence).`,
+    );
+  }
   const tarball = meta?.versions?.[version]?.dist?.tarball;
   if (!tarball) throw new Error(`no published ${pkg}@${version} on npm`);
   return { kind: "public", version, url: tarball, strip: 1, cacheKey: `public-${version}` };