Versions and dependency sync

The published baseline is CLI 0.1.8 with SDK/contract 0.2.0. SDK/contract 0.3.0 are also published. The prepared CLI 0.1.10 pins SDK/contract 0.3.0 and includes skill installation; use it after publication. Inspect shoplifter --version, the project’s vendored packages and package lock when diagnosing compatibility.

Initialization uses the runtime pair pinned by the CLI. Existing projects change runtime only through explicit synchronization:

export SHOPLIFTER_API_URL=https://YOUR-PLATFORM-API-HOST
shoplifter dependencies sync
npm ci --ignore-scripts
shoplifter validate
npm run build
shoplifter validate output

Replace the API host with your platform origin. Synchronization downloads the platform-approved public runtime without a dashboard session, verifies hashes and updates archives and the dependency lock. Authored files are preserved.

Offline or unreleased development can supply both absolute .tgz paths to dependencies sync or init. This does not make an unreleased runtime eligible for production. Production validates exact runtime bytes, locks and built output. Retained revisions preserve their original archives; new npm releases do not silently change them.

Skill bundle versions are independent too. The CLI installer selects compatibility using its own version and its pinned SDK runtime version, not an arbitrary project’s dependencies.