CLI runs on Node 20+: npx storebound (bunx keeps working)

- cli/lib/rt.ts: the runtime layer on node: modules (spawn / spawnSync with Bun's defaults, exit codes and
  "Executable not found", which with PATHEXT, sleep, serve, Glob, hasher, gunzip, stdin, SQLite, packageRoot,
  config imports with a type-stripping fallback for Node 20); every Bun.* use in cli/ goes through it
- tools/gen-embedded.ts -> cli/lib/embedded.ts: templates/, cli/shots/*.html and Play's Data safety form embedded
  (replaces Bun text imports; the bundle and the compiled sidecar carry them), checked fresh by bun run ci
- package.json: bin dist/storebound.mjs (Node ESM bundle, tools/build-node.ts, prepack), engines node >=20
- bun run ci: node bundle + node smoke (real node: --version, help, check same as Bun, scan, release plan --help,
  init, MCP handshake + tool call); Forgejo CI sets up Node 20; tests/node-compat.test.ts guards cli/
- install writes npx MCP commands when run with Node; bin/storebound falls back to Node
- docs: npx storebound init (Node 20+) or bunx storebound init

cli/play/build.ts

@@ -26,6 +26,7 @@ import { capacitorProject, webStep } from '../lib/web-assets';
 import { androidSdk, androidSdkEnv, androidSdkMissing } from '../lib/tools';
 import { playClient } from './client';
 import { usedVersionCodes } from './next-version-code';
+import * as rt from '../lib/rt';
 
 const TAG = 'build';
 
@@ -93,7 +94,7 @@ export async function run(ctx: Ctx): Promise<void> {
   log(TAG, `$ ${plan.command}`);
   const started = Date.now();
   mkdirSync(out, { recursive: true });
-  const p = Bun.spawn(argv, { cwd, stdout: 'pipe', stderr: 'pipe', env: { ...process.env, ...androidSdkEnv(sdk), ...signingEnv(signing) } });
+  const p = rt.spawn(argv, { cwd, stdout: 'pipe', stderr: 'pipe', env: { ...process.env, ...androidSdkEnv(sdk), ...signingEnv(signing) } });
   const lines: string[] = [];
   const each = (line: string): void => {
     lines.push(line);

cli/play/client.ts

@@ -4,6 +4,7 @@ import { tokenSource } from '../lib/google-auth';
 import { log, warn } from '../lib/log';
 import { errorBody } from '../lib/http';
 import { AmbiguousWriteError, isAmbiguous, retrySafe } from '../lib/upsert';
+import * as rt from '../lib/rt';
 
 export type PlayClient = Awaited<ReturnType<typeof playClient>>;
 
@@ -30,13 +31,13 @@ export async function playClient(root: string, packageName: string) {
           body: body === undefined ? undefined : bin ? (body as unknown as BodyInit) : JSON.stringify(body),
         });
       } catch (e) {
-        if (safe && attempt < 4) { await Bun.sleep(2000 * (attempt + 1)); continue; }
+        if (safe && attempt < 4) { await rt.sleep(2000 * (attempt + 1)); continue; }
         if (!safe) throw new AmbiguousWriteError(`${method} ${short()} -> no answer (${(e as Error).message})`);
         throw e;
       }
       const text = await r.text();
       if (r.ok) return (text ? JSON.parse(text) : {}) as T;
-      if ((r.status === 429 || (r.status >= 500 && safe)) && attempt < 4) { await Bun.sleep(2000 * (attempt + 1)); continue; }
+      if ((r.status === 429 || (r.status >= 500 && safe)) && attempt < 4) { await rt.sleep(2000 * (attempt + 1)); continue; }
       // A wrong path casing answers with an HTML 404 page, not JSON: say so instead of dumping the HTML.
       const msg = /^\s*</.test(text) ? `(HTML ${r.status} page: wrong path or casing?)` : errorBody(text);
       if (r.status >= 500 && !safe) throw new AmbiguousWriteError(`${method} ${short()} -> ${r.status} ${msg}`, r.status);

cli/play/data-safety.ts

@@ -13,11 +13,12 @@ import { dataSafetyCsv, dataSafetyProblem, dataSafetyRows } from '../lib/data-sa
 import { DATA_SAFETY_UPLOADED } from '../lib/declarations';
 import { done, log } from '../lib/log';
 import { playClient } from './client';
+import * as rt from '../lib/rt';
 
 export const DATA_SAFETY_HASH = '.storebound/data-safety.sha256';
 
 /** sha256 of the CSV for one package. Pure. */
-export const dataSafetyHash = (pkg: string, csv: string): string => new Bun.CryptoHasher('sha256').update(`${pkg}\n${csv}`).digest('hex');
+export const dataSafetyHash = (pkg: string, csv: string): string => rt.hasher('sha256').update(`${pkg}\n${csv}`).digest('hex');
 
 /** The hash of the last upload of this package, null when none is recorded. */
 export function lastUpload(root: string, pkg: string): { sha256: string; at: string } | null {

cli/play/google.ts

@@ -3,6 +3,7 @@
 import { playServiceAccount } from '../lib/credentials';
 import { tokenSource } from '../lib/google-auth';
 import { errorBody } from '../lib/http';
+import * as rt from '../lib/rt';
 
 export const REPORTING_API = 'https://playdeveloperreporting.googleapis.com/v1beta1';
 
@@ -12,7 +13,7 @@ export function googleClient(root: string, scope: string) {
     for (let attempt = 0; ; attempt++) {
       const r = await fetch(url, { method, headers: { Authorization: 'Bearer ' + (await token()), ...(body === undefined ? {} : { 'Content-Type': 'application/json' }) },
         body: body === undefined ? undefined : JSON.stringify(body) });
-      if ((r.status === 429 || r.status >= 500) && attempt < 4) { await r.body?.cancel(); await Bun.sleep(2000 * (attempt + 1)); continue; }
+      if ((r.status === 429 || r.status >= 500) && attempt < 4) { await r.body?.cancel(); await rt.sleep(2000 * (attempt + 1)); continue; }
       return r;
     }
   }