promptdock 1.2.1 → 1.2.2

package/dist/semver.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Semver precedence for CLI versions (burn-down A2): the CLI's copy of `lib/validation/cli-semver.ts`.
+ * The CLI is a standalone build that cannot import `lib/`, so the code below the header is kept
+ * BYTE-IDENTICAL to that file, and `test/semver-parity.test.ts` fails when the two drift.
+ *
+ * A pre-release sorts before its release: `1.2.0 < 1.2.1-rc.15.1 < 1.2.1`. The old inline compare
+ * split on "." and read `1.2.1-rc.15.1` as 1.2.0.
+ */
+export type ParsedSemver = {
+    core: [number, number, number];
+    pre: string[];
+};
+/** `1.2.3`, `v1.2.3`, `1.2.3-rc.15.1`, `1.2.3+build.7` → its parts; anything else → null. */
+export declare function parseSemver(version: string): ParsedSemver | null;
+/**
+ * Semver 2.0.0 precedence (section 11): negative when `a` sorts first, 0 when equal, positive when
+ * `b` does. Build metadata is ignored. Null when either side does not parse.
+ */
+export declare function compareSemverStrict(a: string, b: string): number | null;

package/dist/semver.js

@@ -0,0 +1,54 @@
+/**
+ * Semver precedence for CLI versions (burn-down A2): the CLI's copy of `lib/validation/cli-semver.ts`.
+ * The CLI is a standalone build that cannot import `lib/`, so the code below the header is kept
+ * BYTE-IDENTICAL to that file, and `test/semver-parity.test.ts` fails when the two drift.
+ *
+ * A pre-release sorts before its release: `1.2.0 < 1.2.1-rc.15.1 < 1.2.1`. The old inline compare
+ * split on "." and read `1.2.1-rc.15.1` as 1.2.0.
+ */
+/** `1.2.3`, `v1.2.3`, `1.2.3-rc.15.1`, `1.2.3+build.7` → its parts; anything else → null. */
+export function parseSemver(version) {
+    const m = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(version.trim());
+    if (!m)
+        return null;
+    return { core: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] ? m[4].split(".") : [] };
+}
+/**
+ * Semver 2.0.0 precedence (section 11): negative when `a` sorts first, 0 when equal, positive when
+ * `b` does. Build metadata is ignored. Null when either side does not parse.
+ */
+export function compareSemverStrict(a, b) {
+    const pa = parseSemver(a);
+    const pb = parseSemver(b);
+    if (!pa || !pb)
+        return null;
+    for (let i = 0; i < 3; i++) {
+        if (pa.core[i] !== pb.core[i])
+            return pa.core[i] - pb.core[i];
+    }
+    // A pre-release sorts BEFORE the release it precedes.
+    if (pa.pre.length === 0 || pb.pre.length === 0)
+        return (pa.pre.length === 0 ? 1 : 0) - (pb.pre.length === 0 ? 1 : 0);
+    for (let i = 0; i < Math.max(pa.pre.length, pb.pre.length); i++) {
+        const x = pa.pre[i];
+        const y = pb.pre[i];
+        if (x === undefined)
+            return -1;
+        if (y === undefined)
+            return 1;
+        const xNum = /^\d+$/.test(x);
+        const yNum = /^\d+$/.test(y);
+        if (xNum && yNum) {
+            if (Number(x) !== Number(y))
+                return Number(x) - Number(y);
+        }
+        else if (xNum !== yNum) {
+            // A numeric identifier sorts before an alphanumeric one.
+            return xNum ? -1 : 1;
+        }
+        else if (x !== y) {
+            return x < y ? -1 : 1;
+        }
+    }
+    return 0;
+}

package/dist/terminal-text.d.ts

@@ -202,9 +202,10 @@ export declare const SERVER_MESSAGE_MAX = 500;
  * headroom rather than a round number.
  *
  * ARITHMETIC (server side, lib/cli-auth/protocol.ts `upgradeRemedy`): the prefix
- * "Run: npx promptdock@latest " is 27 characters and the echoed args are already
- * allowlisted and sliced to 120 there, so a legitimate remedy tops out at 147. 256
- * leaves room for the prefix to grow without ever truncating an honest command.
+ * "Run: npx promptdock@latest " is 27 characters, the echoed args are already
+ * allowlisted and sliced to 120 there, and since the 2026-10-04 sweep (DX-A6) the line
+ * ends " (installed globally? npm i -g promptdock@latest)", 49 more, so a legitimate
+ * remedy tops out at 196. 256 still leaves room without truncating an honest command.
  *
  * WARNING: AND THE CAP IS APPLIED TO THE REMEDY ALONE, BEFORE api.ts joins it to the
  * message. Applied after the join it would be measured against about 215 characters

package/dist/terminal-text.js

@@ -357,9 +357,10 @@ export const SERVER_MESSAGE_MAX = 500;
  * headroom rather than a round number.
  *
  * ARITHMETIC (server side, lib/cli-auth/protocol.ts `upgradeRemedy`): the prefix
- * "Run: npx promptdock@latest " is 27 characters and the echoed args are already
- * allowlisted and sliced to 120 there, so a legitimate remedy tops out at 147. 256
- * leaves room for the prefix to grow without ever truncating an honest command.
+ * "Run: npx promptdock@latest " is 27 characters, the echoed args are already
+ * allowlisted and sliced to 120 there, and since the 2026-10-04 sweep (DX-A6) the line
+ * ends " (installed globally? npm i -g promptdock@latest)", 49 more, so a legitimate
+ * remedy tops out at 196. 256 still leaves room without truncating an honest command.
  *
  * WARNING: AND THE CAP IS APPLIED TO THE REMEDY ALONE, BEFORE api.ts joins it to the
  * message. Applied after the join it would be measured against about 215 characters

package/dist/verdicts.d.ts

@@ -3,5 +3,7 @@ import type { ResolveResponse } from "./contract.js";
  *  tells them their plan is too low — the one link most likely to be clicked under
  *  friction, so it must not spend a redirect hop. */
 export declare const UPGRADE_URL = "https://www.promptdock.ai/pricing";
+/** What a paid plan unlocks for the CLI, stated with no price (see `insufficient_tier`). */
+export declare const PREMIUM_SKILLS_SENTENCE = "Premium skills come with any paid plan.";
 /** Throws the DX3-copy CliError for a deny verdict; returns for ok/already_entitled. */
 export declare function assertInstallable(resolve: ResolveResponse, refString: string, cliVersion: string): void;

package/dist/verdicts.js

@@ -1,16 +1,27 @@
 import { CliError, EXIT } from "./errors.js";
 import { SERVER_LABEL_MAX, terminalLine } from "./terminal-text.js";
 import { retryHours } from "./ui.js";
+import { compareSemverStrict } from "./semver.js";
 import { CANONICAL_INSTALL_COMMAND, CANONICAL_ORIGIN, CLI_DOS_MAX_SKILL_FILES, CLI_DOS_MAX_SKILL_TOTAL_BYTES, } from "./generated/constants.js";
 /** ⚠️ DERIVED from `CANONICAL_ORIGIN`. This is the CTA a user follows the moment the CLI
  *  tells them their plan is too low — the one link most likely to be clicked under
  *  friction, so it must not spend a redirect hop. */
 export const UPGRADE_URL = `${CANONICAL_ORIGIN}/pricing`;
-/** Numeric semver compare; mirrors compareCliVersions in lib/validation/skills.ts. */
-function cmpVersion(a, b) {
-    const pa = a.split(".").map((n) => Number(n) || 0);
-    const pb = b.split(".").map((n) => Number(n) || 0);
-    return (pa[0] - pb[0]) || (pa[1] - pb[1]) || (pa[2] - pb[2]);
+/** What a paid plan unlocks for the CLI, stated with no price (see `insufficient_tier`). */
+export const PREMIUM_SKILLS_SENTENCE = "Premium skills come with any paid plan.";
+/**
+ * True when this CLI (`cliVersion`) is too old for `min`, by semver precedence (./semver.ts, the
+ * byte-identical twin of lib/validation/cli-semver.ts): a pre-release sorts before its release, so
+ * 1.2.1-rc.15.1 is below 1.2.1 (the old split-on-"." compare read it as 1.2.0).
+ *
+ * ⚠️ An UNREADABLE `min` counts as too old. This is the opposite of the server's floor check,
+ * deliberately: the server must never brick a client over a header it cannot parse, but here the
+ * SERVER is stating a requirement this CLI cannot evaluate, and installing anyway would skip the
+ * protections a newer CLI may carry. Real servers only ever send a valid version.
+ */
+function belowRequirement(cliVersion, min) {
+    const cmp = compareSemverStrict(cliVersion, min);
+    return cmp === null || cmp < 0;
 }
 /**
  * PACKAGE-SCOPED compatibility, checked BEFORE the metered install POST.
@@ -40,7 +51,7 @@ function assertPackageCompatible(resolve, refString, cliVersion) {
     const safeTitle = terminalLine(resolve.title, SERVER_LABEL_MAX);
     const title = safeTitle ? `"${safeTitle}"` : "This skill";
     const min = resolve.min_cli_version;
-    if (typeof min === "string" && min.length > 0 && cmpVersion(cliVersion, min) < 0) {
+    if (typeof min === "string" && min.length > 0 && belowRequirement(cliVersion, min)) {
         throw new CliError(`${title} needs promptdock CLI ${terminalLine(min, SERVER_LABEL_MAX)} or newer — you are on ${cliVersion}.`, EXIT.DENIED, { footer: "upgrade_required", hint: upgrade });
     }
     // Belt and braces for a server too old to send min_cli_version: compare the shape
@@ -67,10 +78,14 @@ export function assertInstallable(resolve, refString, cliVersion) {
         case "insufficient_tier": {
             const safe = terminalLine(resolve.title, SERVER_LABEL_MAX);
             const title = safe ? `"${safe}"` : "This skill";
-            throw new CliError(`${title} is a premium skill. Premium skills need the Explorer plan ($10/mo) or higher` +
+            // ⚠️ NO PRICE, EVER: a hand-typed "$10/mo" was wrong for every account billed in
+            // euros or rupees, and this binary cannot know the reader's currency. "Any paid plan"
+            // is true in every currency; /pricing shows the amounts.
+            throw new CliError(`${title} is a premium skill` +
                 (resolve.current
-                    ? ` — your account is on the ${terminalLine(resolve.current, SERVER_LABEL_MAX)} tier.`
-                    : "."), EXIT.DENIED, { footer: "insufficient_tier", hint: `Upgrade: ${UPGRADE_URL}` });
+                    ? ` and your account is on the ${terminalLine(resolve.current, SERVER_LABEL_MAX)} tier`
+                    : "") +
+                `. ${PREMIUM_SKILLS_SENTENCE} See ${UPGRADE_URL}.`, EXIT.DENIED, { footer: "insufficient_tier", hint: `Upgrade: ${UPGRADE_URL}` });
         }
         case "cap_hit": {
             const wait = retryHours(Number(resolve.retry_after_secs) || 3600);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "promptdock",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "Install AI agent skills from PromptDock — npx promptdock@latest install <handle>/<slug>",
   "keywords": [
     "promptdock",
@@ -43,5 +43,5 @@
     "typescript": "^5",
     "vitest": "^4.1.8"
   },
-  "gitHead": "46e6b02fe045e9b803f748b32b9443995a40b1ac"
+  "gitHead": "63be7ca7ef9c9a0e64b4ebc98c4a9c0d25e6cbd9"
 }