From f33f0ee0d93a9368ca49d4e3434b9c6d3968e56c Mon Sep 17 00:00:00 2001
From: Or Dvir <ordvir24@gmail.com>
Date: Mon, 13 Jul 2026 12:31:44 +0300
Subject: [PATCH 1/3] chore: sync package-lock.json with package.json (0.13.0,
 node >=20)

Lockfile on main lagged the 0.13.0 version bump; regenerated to match.
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 9b71cf4..3fe42d8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@gethookmyapp/cli",
-  "version": "0.12.12",
+  "version": "0.13.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@gethookmyapp/cli",
-      "version": "0.12.12",
+      "version": "0.13.0",
       "license": "MIT",
       "dependencies": {
         "@inquirer/prompts": "^7.0.0",
@@ -37,7 +37,7 @@
         "vitest": "^3.0.0"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=20"
       }
     },
     "node_modules/@ampproject/remapping": {

From ac0f8a29b7932f68600b33f9f785c7bdb9e57253 Mon Sep 17 00:00:00 2001
From: Or Dvir <ordvir24@gmail.com>
Date: Mon, 13 Jul 2026 16:39:07 +0300
Subject: [PATCH 2/3] chore: bump to 0.13.1 + prepublishOnly gate (AIT-177)

Publish-readiness gate for the next npm release: lockfile synced with
package.json (0.13.0/node>=20 drift), version bumped to 0.13.1 so the
already-merged AIT-164/AIT-151 fixes can ship, and prepublishOnly runs
build + unit tests so a stale dist or red suite can't be published.
---
 package-lock.json | 4 ++--
 package.json      | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 3fe42d8..b42cbdd 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@gethookmyapp/cli",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@gethookmyapp/cli",
-      "version": "0.13.0",
+      "version": "0.13.1",
       "license": "MIT",
       "dependencies": {
         "@inquirer/prompts": "^7.0.0",
diff --git a/package.json b/package.json
index 07f9980..7947b44 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gethookmyapp/cli",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "HookMyApp CLI, No BS. Just go live.",
   "type": "module",
   "bin": {
@@ -8,6 +8,7 @@
   },
   "scripts": {
     "build": "node build.mjs",
+    "prepublishOnly": "npm run build && npm run test:unit",
     "dev": "tsx src/index.ts",
     "test": "vitest run --reporter=verbose",
     "test:unit": "vitest run --reporter=verbose",

From 1f10b1518a70f10150d4d25829b886514c3abc11 Mon Sep 17 00:00:00 2001
From: Or Dvir <ordvir24@gmail.com>
Date: Tue, 14 Jul 2026 13:01:40 +0300
Subject: [PATCH 3/3] fix: pass release env to npm publish step so
 prepublishOnly rebuild keeps baked values (AIT-177)

---
 .github/workflows/publish.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3201d50..403d38e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -31,7 +31,14 @@ jobs:
       - name: Verify build
         run: node bin/hookmyapp.js --version
       - name: Publish to npm (OIDC + provenance)
+        # prepublishOnly reruns the build during `npm publish`; keep the same
+        # env as the Build step so the rebuild bakes identical release values.
         run: npm publish --provenance --access public
+        env:
+          HOOKMYAPP_SENTRY_DSN: ${{ secrets.HOOKMYAPP_CLI_SENTRY_DSN }}
+          HOOKMYAPP_CLI_RELEASE: ${{ github.ref_name }}
+          HOOKMYAPP_POSTHOG_TOKEN: ${{ secrets.HOOKMYAPP_POSTHOG_TOKEN }}
+          HOOKMYAPP_POSTHOG_HOST: ${{ secrets.HOOKMYAPP_POSTHOG_HOST }}
 
   notify-failure:
     needs: [publish]