@celilo/cli 0.13.0 → 0.13.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/cli",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Celilo — home lab orchestration CLI",
   "type": "module",
   "bin": {

package/src/cli/commands/publish/consumer-pins.test.ts

@@ -152,4 +152,49 @@ describe('bumpUpdatesFor', () => {
       '@celilo/event-bus',
     ]);
   });
+
+  // #399: pins are now written during the version phase from WORKSPACE versions,
+  // which run ahead of npm until the publish lands. The publish-phase pass still
+  // reads npm-latest, so without a guard it would walk those pins BACKWARDS and
+  // ship modules bundling the previous capability code — the exact bundle/repo
+  // drift ISS-0104 exists to prevent.
+  describe('never downgrades a pin', () => {
+    test('an older npm-latest leaves a newer workspace pin alone', () => {
+      const pkg: PackageJson = { dependencies: { '@celilo/capabilities': '^0.7.1' } };
+      expect(bumpUpdatesFor(pkg, latest({ '@celilo/capabilities': '0.7.0' }))).toEqual([]);
+    });
+
+    test('across a minor and a major', () => {
+      expect(
+        bumpUpdatesFor(
+          { dependencies: { '@celilo/cli': '^0.13.0' } },
+          latest({ '@celilo/cli': '0.12.1' }),
+        ),
+      ).toEqual([]);
+      expect(
+        bumpUpdatesFor(
+          { dependencies: { '@celilo/cli': '^1.0.0' } },
+          latest({ '@celilo/cli': '0.99.9' }),
+        ),
+      ).toEqual([]);
+    });
+
+    test('still bumps forward', () => {
+      const updates = bumpUpdatesFor(
+        { dependencies: { '@celilo/capabilities': '^0.7.0' } },
+        latest({ '@celilo/capabilities': '0.7.1' }),
+      );
+      expect(updates).toHaveLength(1);
+      expect(updates[0].newSpec).toBe('^0.7.1');
+    });
+
+    test('a prerelease suffix does not confuse the comparison', () => {
+      expect(
+        bumpUpdatesFor(
+          { dependencies: { '@celilo/cli': '^0.13.0' } },
+          latest({ '@celilo/cli': '0.12.1-alpha.3' }),
+        ),
+      ).toEqual([]);
+    });
+  });
 });

package/src/cli/commands/publish/consumer-pins.ts

@@ -32,8 +32,8 @@ import type { ConsumerPinItem, PackageJson } from './types';
  * to current npm-latest. Returns the file paths + per-bucket update
  * lists; doesn't write anything.
  */
-export function planConsumerPins(): ConsumerPinItem[] {
-  const latestMap = fetchLatestVersions();
+export function planConsumerPins(versions?: Map<string, string>): ConsumerPinItem[] {
+  const latestMap = versions ?? fetchLatestVersions();
   if (latestMap.size === 0) return [];
 
   const externalPaths = readExternalProjectPaths();
@@ -68,6 +68,23 @@ export function planConsumerPins(): ConsumerPinItem[] {
  *   - deps already at the target bare version (operator-class match,
  *     `^1.0.0` and `1.0.0` both count as "at version 1.0.0").
  */
+/**
+ * Compare `major.minor.patch`, ignoring any prerelease suffix. Returns
+ * -1 / 0 / 1. Deliberately tiny: pins only ever move between released
+ * `@celilo/*` versions, so full semver precedence is not needed.
+ */
+function compareVersions(a: string, b: string): number {
+  const parse = (v: string) => (v.split('-')[0] ?? '').split('.').map(Number);
+  const pa = parse(a);
+  const pb = parse(b);
+  for (let i = 0; i < 3; i++) {
+    const x = pa[i] ?? 0;
+    const y = pb[i] ?? 0;
+    if (x !== y) return x < y ? -1 : 1;
+  }
+  return 0;
+}
+
 export function bumpUpdatesFor(
   pkg: PackageJson,
   published: Map<string, string>,
@@ -89,6 +106,12 @@ export function bumpUpdatesFor(
       if (oldSpec.startsWith('workspace:')) continue;
       if (/^[a-z]+:/.test(oldSpec) && !oldSpec.startsWith('npm:')) continue;
       if (bareVersion(oldSpec) === newVersion) continue;
+      // Never walk a pin backwards. Pins are now written during the version
+      // phase from WORKSPACE versions, which are ahead of npm until the publish
+      // lands. Without this, the publish-phase pass — which still reads
+      // npm-latest — would "helpfully" downgrade every pin the version PR just
+      // set, and ship modules bundling the previous capability code.
+      if (compareVersions(newVersion, bareVersion(oldSpec)) < 0) continue;
       const newSpec = withOperator(oldSpec, newVersion);
       if (newSpec === oldSpec) continue;
       updates.push({ bucket, depName: name, oldSpec, newSpec });