@celilo/cli 0.13.0 → 0.13.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celilo/cli",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "Celilo — home lab orchestration CLI",
   "type": "module",
   "bin": {

package/schemas/system_config.json

@@ -74,6 +74,22 @@
       "maximum": 4094,
       "description": "VLAN tag for internal zone (not defaulted; internal is untagged)"
     },
+    "network.secure-mgmt.subnet": {
+      "type": "string",
+      "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/\\d{1,2}$",
+      "description": "Control-plane subnet CIDR — the network celilo-mgr itself occupies when it does not sit on the internal LAN (not defaulted — discovered at celilo-mgmt install, or recorded by firewall onboarding). Derives the firewall's trusted sources and the internal resolver's split-horizon view for celilo's own traffic."
+    },
+    "network.secure-mgmt.gateway": {
+      "type": "string",
+      "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",
+      "description": "Control-plane gateway IP address (not defaulted — discovered from the default route)"
+    },
+    "network.secure-mgmt.vlan": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 4094,
+      "description": "VLAN tag for the control-plane zone (not defaulted)"
+    },
     "dns.primary": {
       "type": "string",
       "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$",

package/src/cli/commands/publish/consumer-pins.test.ts

@@ -152,4 +152,49 @@ describe('bumpUpdatesFor', () => {
       '@celilo/event-bus',
     ]);
   });
+
+  // #399: pins are now written during the version phase from WORKSPACE versions,
+  // which run ahead of npm until the publish lands. The publish-phase pass still
+  // reads npm-latest, so without a guard it would walk those pins BACKWARDS and
+  // ship modules bundling the previous capability code — the exact bundle/repo
+  // drift ISS-0104 exists to prevent.
+  describe('never downgrades a pin', () => {
+    test('an older npm-latest leaves a newer workspace pin alone', () => {
+      const pkg: PackageJson = { dependencies: { '@celilo/capabilities': '^0.7.1' } };
+      expect(bumpUpdatesFor(pkg, latest({ '@celilo/capabilities': '0.7.0' }))).toEqual([]);
+    });
+
+    test('across a minor and a major', () => {
+      expect(
+        bumpUpdatesFor(
+          { dependencies: { '@celilo/cli': '^0.13.0' } },
+          latest({ '@celilo/cli': '0.12.1' }),
+        ),
+      ).toEqual([]);
+      expect(
+        bumpUpdatesFor(
+          { dependencies: { '@celilo/cli': '^1.0.0' } },
+          latest({ '@celilo/cli': '0.99.9' }),
+        ),
+      ).toEqual([]);
+    });
+
+    test('still bumps forward', () => {
+      const updates = bumpUpdatesFor(
+        { dependencies: { '@celilo/capabilities': '^0.7.0' } },
+        latest({ '@celilo/capabilities': '0.7.1' }),
+      );
+      expect(updates).toHaveLength(1);
+      expect(updates[0].newSpec).toBe('^0.7.1');
+    });
+
+    test('a prerelease suffix does not confuse the comparison', () => {
+      expect(
+        bumpUpdatesFor(
+          { dependencies: { '@celilo/cli': '^0.13.0' } },
+          latest({ '@celilo/cli': '0.12.1-alpha.3' }),
+        ),
+      ).toEqual([]);
+    });
+  });
 });

package/src/cli/commands/publish/consumer-pins.ts

@@ -32,8 +32,8 @@ import type { ConsumerPinItem, PackageJson } from './types';
  * to current npm-latest. Returns the file paths + per-bucket update
  * lists; doesn't write anything.
  */
-export function planConsumerPins(): ConsumerPinItem[] {
-  const latestMap = fetchLatestVersions();
+export function planConsumerPins(versions?: Map<string, string>): ConsumerPinItem[] {
+  const latestMap = versions ?? fetchLatestVersions();
   if (latestMap.size === 0) return [];
 
   const externalPaths = readExternalProjectPaths();
@@ -68,6 +68,23 @@ export function planConsumerPins(): ConsumerPinItem[] {
  *   - deps already at the target bare version (operator-class match,
  *     `^1.0.0` and `1.0.0` both count as "at version 1.0.0").
  */
+/**
+ * Compare `major.minor.patch`, ignoring any prerelease suffix. Returns
+ * -1 / 0 / 1. Deliberately tiny: pins only ever move between released
+ * `@celilo/*` versions, so full semver precedence is not needed.
+ */
+function compareVersions(a: string, b: string): number {
+  const parse = (v: string) => (v.split('-')[0] ?? '').split('.').map(Number);
+  const pa = parse(a);
+  const pb = parse(b);
+  for (let i = 0; i < 3; i++) {
+    const x = pa[i] ?? 0;
+    const y = pb[i] ?? 0;
+    if (x !== y) return x < y ? -1 : 1;
+  }
+  return 0;
+}
+
 export function bumpUpdatesFor(
   pkg: PackageJson,
   published: Map<string, string>,
@@ -89,6 +106,12 @@ export function bumpUpdatesFor(
       if (oldSpec.startsWith('workspace:')) continue;
       if (/^[a-z]+:/.test(oldSpec) && !oldSpec.startsWith('npm:')) continue;
       if (bareVersion(oldSpec) === newVersion) continue;
+      // Never walk a pin backwards. Pins are now written during the version
+      // phase from WORKSPACE versions, which are ahead of npm until the publish
+      // lands. Without this, the publish-phase pass — which still reads
+      // npm-latest — would "helpfully" downgrade every pin the version PR just
+      // set, and ship modules bundling the previous capability code.
+      if (compareVersions(newVersion, bareVersion(oldSpec)) < 0) continue;
       const newSpec = withOperator(oldSpec, newVersion);
       if (newSpec === oldSpec) continue;
       updates.push({ bucket, depName: name, oldSpec, newSpec });

package/src/cli/generate-zsh-completion.ts

@@ -355,6 +355,8 @@ _celilo_system_config_keys() {
     'network.secure.gateway:Secure gateway IP'
     'network.internal.subnet:Internal subnet'
     'network.internal.gateway:Internal gateway IP'
+    'network.secure-mgmt.subnet:Control-plane subnet (celilo-mgr own network)'
+    'network.secure-mgmt.gateway:Control-plane gateway IP'
     'dns.primary:Primary DNS server'
     'dns.fallback:Fallback DNS servers'
     'routing.internal_gateway:Internal gateway IP'

package/src/services/system-config-validator.test.ts

@@ -1,4 +1,6 @@
 import { describe, expect, it } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import type { SystemConfigProperty, SystemConfigSchema } from './system-config-schema-types';
 import { validateKey, validateValue } from './system-config-validator';
 
@@ -158,3 +160,26 @@ describe('validateKey', () => {
     expect(result.error).toContain('network.bridge');
   });
 });
+
+// The shipped schema is what `celilo system config set` validates against, and it
+// is a hand-maintained enumeration of zones. `secure-mgmt` was added to
+// NETWORK_ZONES, IPAM, zone detection and the manifest schema but NOT here, so the
+// zone existed everywhere except the one place its subnet could be RECORDED — and
+// recording it is what derives firewall trust and the resolver's split-horizon
+// view. It failed only on the live box, at `system config set`.
+describe('shipped system_config.json covers every placement zone', () => {
+  const shipped = JSON.parse(
+    readFileSync(join(import.meta.dir, '../../schemas/system_config.json'), 'utf-8'),
+  ) as SystemConfigSchema;
+
+  // `external` is deliberately absent: cloud/VPS systems carry their own
+  // addressing and celilo allocates nothing for them.
+  const ADDRESSABLE_ZONES = ['internal', 'dmz', 'app', 'secure', 'secure-mgmt'] as const;
+
+  for (const zone of ADDRESSABLE_ZONES) {
+    it(`accepts network.${zone}.subnet and .gateway`, () => {
+      expect(validateKey(`network.${zone}.subnet`, shipped).valid).toBe(true);
+      expect(validateKey(`network.${zone}.gateway`, shipped).valid).toBe(true);
+    });
+  }
+});