From ed049079258c90fcd0015d625f0de172518da8ea Mon Sep 17 00:00:00 2001
From: Rajeh Taher <rajeh@reforward.dev>
Date: Fri, 2 Oct 2026 21:52:46 +0300
Subject: [PATCH] fix(cli): pin SDK 0.1.0-dev.20261002023214 for hybrid tier
 commands; prepare first npm prerelease

PR #35 merged hybrid tier commands that use SDK exports first published in
0.1.0-dev.20261002023214, so the dev head failed to build against the
previous pin. The release guard test now derives the pinned SDK from
package.json instead of hardcoding it, and the README documents the npm
dev-tag install.
---
 README.md                             | 14 +++++++++-----
 package-lock.json                     |  8 ++++----
 package.json                          |  2 +-
 test/release/check-prerelease.test.ts |  7 ++++++-
 4 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/README.md b/README.md
index 1ad40be..f83edf2 100644
--- a/README.md
+++ b/README.md
@@ -2,10 +2,13 @@
 
 The official command-line interface for Polymorfa.
 
-The package is under active development. `@polymorfa/cli` is not published to
-npm yet. When a development prerelease is available, install it explicitly with
-`npm install --global @polymorfa/cli@dev`. Until then, install from the private
-source repository, which requires repository access.
+The package is under active development and is published to npm as
+development prereleases on the `dev` tag:
+
+```shell
+npm install --global @polymorfa/cli@dev
+polymorfa version
+```
 
 ## Requirements
 
@@ -15,7 +18,8 @@ source repository, which requires repository access.
 
 ## Development installation
 
-Install the current private development branch globally:
+With access to the private source repository, install the current development
+branch globally:
 
 ```shell
 npm install --global github:polymorfa/cli#dev
diff --git a/package-lock.json b/package-lock.json
index 550a858..0ace622 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12,7 +12,7 @@
         "@modelcontextprotocol/server": "2.0.0",
         "@napi-rs/keyring": "1.3.0",
         "@oclif/core": "^4.13.5",
-        "@polymorfa/sdk": "0.1.0-dev.20261001215108",
+        "@polymorfa/sdk": "0.1.0-dev.20261002023214",
         "jq-wasm": "3.0.0-jq-1.8.2",
         "zod": "4.2.0"
       },
@@ -997,9 +997,9 @@
       }
     },
     "node_modules/@polymorfa/sdk": {
-      "version": "0.1.0-dev.20261001215108",
-      "resolved": "https://registry.npmjs.org/@polymorfa/sdk/-/sdk-0.1.0-dev.20261001215108.tgz",
-      "integrity": "sha512-Q0gmgGxUqC+HP3nzipqEZN6oD9QaH/z2LsmrGxDqmniMeBwDLLRAnxbYc5P/+3+QIOr/9FhQ8+GI7tkJ6s9Q+w==",
+      "version": "0.1.0-dev.20261002023214",
+      "resolved": "https://registry.npmjs.org/@polymorfa/sdk/-/sdk-0.1.0-dev.20261002023214.tgz",
+      "integrity": "sha512-ElS5mQaYHAoF53o77MZqD8ETXbR6qNNNgYNcEXfOBwQFw2reYqoIRtlS0QOKcTwTVIdaQbZtN7nBLyNymhtU0A==",
       "engines": {
         "node": ">=20"
       }
diff --git a/package.json b/package.json
index cf1c9a7..e36bc80 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "@modelcontextprotocol/server": "2.0.0",
     "@napi-rs/keyring": "1.3.0",
     "@oclif/core": "^4.13.5",
-    "@polymorfa/sdk": "0.1.0-dev.20261001215108",
+    "@polymorfa/sdk": "0.1.0-dev.20261002023214",
     "jq-wasm": "3.0.0-jq-1.8.2",
     "zod": "4.2.0"
   },
diff --git a/test/release/check-prerelease.test.ts b/test/release/check-prerelease.test.ts
index 89d1b60..dcae653 100644
--- a/test/release/check-prerelease.test.ts
+++ b/test/release/check-prerelease.test.ts
@@ -14,6 +14,11 @@ import {afterEach, describe, expect, test} from 'vitest'
 
 const root = fileURLToPath(new URL('../../', import.meta.url))
 const tempDirectories: string[] = []
+const pinnedSdk = (
+  JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')) as {
+    dependencies: Record<string, string>
+  }
+).dependencies['@polymorfa/sdk']
 type TestManifest = {
   version: string
   dependencies: Record<string, string>
@@ -56,7 +61,7 @@ describe('npm prerelease guard', () => {
   test('accepts the reviewed manifest and lockfile', () => {
     const result = runWith()
     expect(result.status).toBe(0)
-    expect(result.stdout).toContain('@polymorfa/sdk@0.1.0-dev.20261001215108')
+    expect(result.stdout).toContain(`@polymorfa/sdk@${pinnedSdk}`)
   })
 
   test('rejects the default latest tag', () => {