@hasna/recordings 0.2.14 → 0.3.2

package/scripts/ci-native-build.ts

@@ -0,0 +1,402 @@
+#!/usr/bin/env bun
+/**
+ * Compile the native half and compare the compiler's error SET against a recorded baseline.
+ *
+ * Why any of this exists: `main` does not compile. The first CI run this repository ever had
+ * discovered it, and the two obvious responses are both wrong.
+ *
+ *   Gate on a green build — the workflow is red on arrival for a defect it does not own, so it gets
+ *     ignored or bypassed, and this repository ends up back where it started.
+ *   Let the build fail softly (`continue-on-error`) — the native half then has NO regression
+ *     protection whatsoever, and a check that renders green while 87 Swift files went unverified is
+ *     the precise false assurance the workflow exists to end.
+ *
+ * So the recorded errors are baselined and everything they do NOT block is gated properly:
+ *
+ *   1. The whole package is built with --build-tests. A NEW error fails the job; a failure with no
+ *      diagnostic attributable to this repository also fails, since it cannot be compared to the
+ *      baseline at all; a success while the baseline is non-empty fails as stale.
+ *   2. Because that build stops scheduling after its first failure — measured: 41 of 140 tasks, all
+ *      of them third-party — step 1 alone proves nothing about the rest of the package. So every
+ *      target not transitively blocked by a baselined error is then built INDIVIDUALLY and required
+ *      to be clean, and required to show compile activity, because an exit status on its own does not
+ *      distinguish "compiled clean" from "did nothing".
+ *   3. Blocked targets are built too, and any that now builds cleanly fails the job as a stale
+ *      baseline entry. That is what stops the baseline being permanent by default.
+ *
+ * Usage: bun scripts/ci-native-build.ts [--package-path <dir>]
+ */
+import { readFileSync } from "node:fs";
+import { appendFileSync } from "node:fs";
+import { relative, resolve } from "node:path";
+
+export const KNOWN_ERRORS_FILE = ".github/native-known-errors.txt";
+
+/** Parse the baseline file: one `path: message` signature per line, `#` comments dropped. */
+export function parseKnownErrors(text: string): string[] {
+  return text
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0 && !line.startsWith("#"));
+}
+
+/**
+ * Normalize one clang/swift diagnostic message into a stable signature body.
+ *
+ * Truncated at the first `;` and stripped of the trailing `[-Wflag]`, because clang appends both the
+ * standards rationale and the controlling flag to the same message, and neither is a property of the
+ * defect. Keeping them would make the signature churn on a compiler upgrade.
+ */
+export function normalizeMessage(message: string): string {
+  return message
+    .replace(/\s*\[-[A-Za-z0-9=_-]+\]\s*$/, "")
+    .split(";")[0]!
+    .trim();
+}
+
+/**
+ * Extract error signatures from combined build output.
+ *
+ * Deduplicated: a header included by several targets reports the same error once per target, and a
+ * baseline that had to list each repetition would break whenever a target was added.
+ */
+export function errorSignatures(output: string, repoRoot: string): string[] {
+  const signatures = new Set<string>();
+  // Anchored on the whole line so that a message merely QUOTING the word "error:" — for instance a
+  // Swift string literal echoed back in a note — cannot be read as a diagnostic of its own.
+  //
+  // `[^:\n]` rather than `[^:]` for the path tail, and the newline exclusion is not cosmetic: with
+  // `[^:]` the class happily spans line breaks, so the path captured from real build output began at
+  // an unrelated progress line several lines earlier and produced a signature with a newline inside
+  // it. The contract test for this function caught exactly that.
+  const pattern = /^([^\s:][^:\n]*):(\d+):(\d+): error: (.+)$/gm;
+  for (const match of output.matchAll(pattern)) {
+    const [, rawPath, , , message] = match;
+    if (!rawPath || !message) continue;
+    const absolute = resolve(repoRoot, rawPath);
+    const path = relative(repoRoot, absolute).split("\\").join("/");
+    // A diagnostic from inside the SDK or the build cache is not this repository's source, and
+    // pinning one would make the baseline a function of the runner image. `.build` is matched as a
+    // path SEGMENT anywhere, not as a prefix: SwiftPM's cache sits at src/native/Recordings/.build,
+    // so a prefix test never fires.
+    if (path.startsWith("..") || path.split("/").includes(".build")) continue;
+    signatures.add(`${path}: ${normalizeMessage(message)}`);
+  }
+  return [...signatures].sort();
+}
+
+export type Verdict =
+  | { kind: "clean" }
+  | { kind: "stale-baseline"; reason: string }
+  | { kind: "unattributable-failure" }
+  | { kind: "quarantined"; observed: string[] }
+  | { kind: "regression"; introduced: string[] };
+
+/**
+ * Decide the outcome from the build's exit status and its error set.
+ *
+ * `disappeared` is only reported when nothing new appeared. Compilation stops early, so a brand new
+ * error in an earlier translation unit can prevent a recorded one from ever being emitted; blaming
+ * the baseline in that case would bury the actual regression under a bookkeeping complaint.
+ */
+export function verdict(succeeded: boolean, observed: string[], known: string[]): Verdict {
+  const introduced = observed.filter((signature) => !known.includes(signature));
+  if (introduced.length > 0) return { kind: "regression", introduced };
+  // A failed build from which NO diagnostic could be attributed to this repository cannot be compared
+  // against the baseline at all, so it must fail rather than compare equal to it.
+  //
+  // This is not hypothetical. `errorSignatures` only recognises `path:line:col: error:`, so a linker
+  // failure ("ld: symbol(s) not found", "clang: error: linker command failed"), a swift-driver
+  // "error: emit-module command failed", or an out-of-disk abort all yield zero signatures. Without
+  // this branch, `verdict(false, [], [])` returned `quarantined` and the job exited 0 — a build that
+  // failed for a reason nobody parsed would have been GREEN, and green FOREVER once the baseline was
+  // emptied, which is exactly what this file's own remediation text tells you to do.
+  if (!succeeded && observed.length === 0) return { kind: "unattributable-failure" };
+  if (succeeded) {
+    if (known.length === 0) return { kind: "clean" };
+    return {
+      kind: "stale-baseline",
+      reason:
+        `The native build now SUCCEEDS while ${KNOWN_ERRORS_FILE} still records ${known.length} ` +
+        "error(s). Delete the file's entries so this becomes a plain build gate.",
+    };
+  }
+  // Deliberately NOT reporting recorded errors that failed to appear. The whole-package build stops
+  // scheduling after its first failure, so most recorded errors are never REACHED and their absence
+  // says nothing about whether they are fixed. An earlier version treated that as a stale baseline
+  // and failed the job for bookkeeping every single run. Staleness is detected per target instead,
+  // where a target that builds clean is real evidence its entries are gone.
+  return { kind: "quarantined", observed };
+}
+
+export type TargetInfo = { name: string; dir: string; dependencies: string[] };
+
+/**
+ * Read the package's targets and their internal dependencies from `swift package dump-package`.
+ *
+ * The manifest is evaluated rather than parsed, and dumping it works even when the package does not
+ * COMPILE, so this stays available in exactly the situation it is needed. A regex over Package.swift
+ * would have to re-implement target/path/dependency resolution and would drift the first time a
+ * target was declared in a way the regex did not anticipate.
+ */
+export function targetsFromDump(dump: unknown, packagePath: string): TargetInfo[] {
+  const raw = (dump as { targets?: unknown[] })?.targets;
+  if (!Array.isArray(raw)) throw new Error("dump-package produced no targets array");
+  return raw.map((entry) => {
+    const target = entry as {
+      name: string;
+      path?: string | null;
+      dependencies?: unknown[];
+    };
+    const dependencies: string[] = [];
+    for (const dependency of target.dependencies ?? []) {
+      // `byName` and `target` are internal references; `product` names a package dependency, which
+      // cannot be the thing blocked by an error in THIS repository's sources.
+      const named = dependency as { byName?: unknown[]; target?: unknown[] };
+      const reference = named.byName?.[0] ?? named.target?.[0];
+      if (typeof reference === "string") dependencies.push(reference);
+    }
+    return {
+      name: target.name,
+      // SwiftPM defaults an omitted path to Sources/<name>; every target in this package declares
+      // one, but relying on that would make the fallback silently wrong rather than absent.
+      dir: `${packagePath}/${target.path ?? `Sources/${target.name}`}`.replace(/\/+$/, ""),
+      dependencies,
+    };
+  });
+}
+
+/**
+ * Targets that cannot be built because a recorded error lives in them, plus everything that depends
+ * on those transitively.
+ *
+ * This is what makes the per-target gate honest. `swift build --build-tests` stops scheduling work
+ * after the first failure, and measured on run 30303366777 it reached 41 of 140 tasks and compiled
+ * only third-party dependencies — not one of this package's own Swift targets. So "the build failed
+ * with only known errors" proves nothing about the other targets: the compiler never looked at them.
+ * Everything not blocked is therefore built individually and required to be clean.
+ */
+export function blockedTargets(targets: TargetInfo[], errorFiles: string[]): string[] {
+  const blocked = new Set<string>();
+  for (const target of targets) {
+    if (errorFiles.some((file) => file === target.dir || file.startsWith(`${target.dir}/`))) {
+      blocked.add(target.name);
+    }
+  }
+  // Transitive closure. Iterate to a fixed point rather than recursing, so a dependency cycle in a
+  // malformed manifest cannot turn this into a stack overflow.
+  for (let changed = true; changed; ) {
+    changed = false;
+    for (const target of targets) {
+      if (blocked.has(target.name)) continue;
+      if (target.dependencies.some((dependency) => blocked.has(dependency))) {
+        blocked.add(target.name);
+        changed = true;
+      }
+    }
+  }
+  return [...blocked].sort();
+}
+
+/** The source file part of a `<path>: <message>` signature. */
+export function signatureFile(signature: string): string {
+  return signature.split(": ")[0]!;
+}
+
+/**
+ * Target names SwiftPM reported doing compile work for.
+ *
+ * This turns "the build exited 0" into evidence that something was actually compiled. Without it a
+ * per-target build that did nothing at all is indistinguishable from one that compiled the target
+ * clean — and "did nothing" is the normal outcome when the target is already up to date, so the
+ * distinction is not hypothetical. Found by reading run 30305889651's log and discovering it contains
+ * no `Compiling RecordingsLib` line anywhere, because successful output was being discarded: three
+ * targets were reported `ok` on no recorded evidence whatsoever.
+ *
+ * Accumulated across every phase of the job rather than per invocation, because building one target
+ * warms its dependencies, so a dependency's own later invocation legitimately prints nothing.
+ */
+export function compiledTargets(output: string): string[] {
+  const seen = new Set<string>();
+  for (const match of output.matchAll(/^(?:\[\d+\/\d+\] )?(?:Compiling|Emitting module) (\w+)\b/gm)) {
+    if (match[1]) seen.add(match[1]);
+  }
+  return [...seen].sort();
+}
+
+/** Emit a GitHub Actions step output when running under Actions; a no-op elsewhere. */
+function setOutput(name: string, value: string): void {
+  const file = process.env.GITHUB_OUTPUT;
+  if (file) appendFileSync(file, `${name}=${value}\n`);
+}
+
+/** Run a command, streaming nothing, returning combined output and exit status. */
+async function run(command: string[]): Promise<{ output: string; exitCode: number }> {
+  const proc = Bun.spawn(command, { stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+  return { output: `${stdout}\n${stderr}`, exitCode };
+}
+
+async function main(argv: string[]): Promise<void> {
+  const repoRoot = process.cwd();
+  const pathIndex = argv.indexOf("--package-path");
+  const packagePath = pathIndex >= 0 ? argv[pathIndex + 1]! : "src/native/Recordings";
+
+  // --build-tests compiles the test targets as well as the products, so one invocation covers every
+  // line of native code the package knows about — WHEN it succeeds. When it fails it stops early,
+  // which is why the per-target pass below exists.
+  const whole = ["swift", "build", "--build-tests", "--package-path", packagePath];
+  console.log(`$ ${whole.join(" ")}`);
+  const { output, exitCode } = await run(whole);
+  process.stdout.write(output);
+
+  const known = parseKnownErrors(readFileSync(`${repoRoot}/${KNOWN_ERRORS_FILE}`, "utf8"));
+  const observed = errorSignatures(output, repoRoot);
+  const result = verdict(exitCode === 0, observed, known);
+  setOutput("compiled", exitCode === 0 ? "true" : "false");
+
+  if (result.kind === "clean") {
+    console.log("\nNative build is clean: every target and every test target compiles, fully gated.");
+    return;
+  }
+  if (result.kind === "regression") {
+    console.log(
+      `\n::error title=New native compile error::${result.introduced.length} compile error(s) ` +
+        `not recorded in ${KNOWN_ERRORS_FILE} appeared in this change: ` +
+        result.introduced.join(" | "),
+    );
+    process.exit(1);
+  }
+  if (result.kind === "unattributable-failure") {
+    console.log(
+      "\n::error title=Native build failed for an unparsed reason::The build exited non-zero but no " +
+        "compile diagnostic could be attributed to a file in this repository, so the failure cannot " +
+        `be compared against ${KNOWN_ERRORS_FILE}. A linker error, a driver error or an aborted ` +
+        "build all look like this. Read the log above; do NOT record anything in the baseline for it.",
+    );
+    process.exit(1);
+  }
+  if (result.kind === "stale-baseline") {
+    console.log(`\n::error title=Stale native baseline::${result.reason}`);
+    process.exit(1);
+  }
+
+  // The whole-package build failed with exactly the recorded errors. That alone is NOT evidence about
+  // any other target, because the build aborted before reaching them: measured on run 30303366777 it
+  // got to 41 of 140 tasks and compiled only third-party dependencies. So build every target that is
+  // not blocked by a recorded error, individually, and require each to be clean. This is the
+  // difference between "no new error appeared in the 30% that compiled" and a real gate.
+  const dump = await run(["swift", "package", "dump-package", "--package-path", packagePath]);
+  if (dump.exitCode !== 0) {
+    console.log(`\n::error title=Cannot read the package manifest::${dump.output.trim().slice(0, 400)}`);
+    process.exit(1);
+  }
+  const targets = targetsFromDump(JSON.parse(dump.output), packagePath);
+  // Blocked is derived from the BASELINE, not from what this build happened to report. The build
+  // aborts early, so `observed` names only the errors in whatever compiled first — on this package
+  // that is the C launcher, and deriving from it left the four recorded Swift errors in
+  // Updater/Protocol unblocked, so the gate demanded that a known-broken target build cleanly.
+  const blocked = blockedTargets(targets, known.map(signatureFile));
+  const gated = targets.filter((target) => !blocked.includes(target.name)).map((t) => t.name);
+
+  console.log(
+    `\nWhole-package build stopped at the recorded errors. Building each target individually: ` +
+      `${gated.length} gated, ${blocked.length} blocked by the baseline.\n` +
+      `  blocked: ${blocked.join(", ") || "(none)"}\n`,
+  );
+  if (gated.length === 0) {
+    console.log(
+      "\n::error title=Nothing could be gated::Every target is blocked by a recorded error, so this " +
+        "job proves nothing at all. Fix the recorded errors rather than keeping the baseline.",
+    );
+    process.exit(1);
+  }
+
+  // Surfaced so the `scope` job can name what went uncompiled instead of saying "the native half"
+  // and leaving a reader to guess how much of it that is.
+  setOutput("blocked", blocked.join(", "));
+  setOutput("gatedTargets", String(gated.length));
+
+  // Compile activity from every phase, starting with the whole-package attempt.
+  const compiled = new Set<string>(compiledTargets(output));
+
+  const buildTarget = async (name: string) => {
+    const attempt = await run(["swift", "build", "--target", name, "--package-path", packagePath]);
+    for (const seen of compiledTargets(attempt.output)) compiled.add(seen);
+    return {
+      clean: attempt.exitCode === 0,
+      introduced: errorSignatures(attempt.output, repoRoot).filter((s) => !known.includes(s)),
+      output: attempt.output,
+    };
+  };
+
+  const failures: string[] = [];
+  for (const name of gated) {
+    const { clean, introduced, output: targetOutput } = await buildTarget(name);
+    if (clean && introduced.length === 0) {
+      // Print the compile lines rather than a bare "ok". An `ok` with no evidence behind it is the
+      // same species of claim this whole workflow exists to stop accepting.
+      const evidence = targetOutput
+        .split("\n")
+        .filter((line) => /(?:Compiling|Emitting module) /.test(line))
+        .length;
+      console.log(`  ok        ${name} (${evidence} compile step(s))`);
+      continue;
+    }
+    console.log(`  FAILED    ${name}`);
+    process.stdout.write(targetOutput);
+    failures.push(name);
+  }
+
+  // A gated target that never appeared in any compile line was not verified, whatever its exit
+  // status said. Reported as a hard failure: a gate that cannot show its work is not a gate.
+  const unproven = gated.filter((name) => !compiled.has(name));
+  if (unproven.length > 0) {
+    console.log(
+      `\n::error title=Target reported clean without compiling::${unproven.join(", ")} exited 0 but ` +
+        "SwiftPM never reported compiling or emitting a module for them, so nothing was verified. " +
+        `Targets observed compiling: ${[...compiled].sort().join(", ") || "(none)"}`,
+    );
+    process.exit(1);
+  }
+
+  // The baseline's expiry date, and the reason it is checked HERE. A blocked target that now builds
+  // clean is real evidence that its recorded errors are gone, unlike their mere absence from an
+  // early-aborting whole-package build. Without this the baseline is permanent by default.
+  const revived: string[] = [];
+  for (const name of blocked) {
+    const { clean } = await buildTarget(name);
+    console.log(`  ${clean ? "NOW CLEAN" : "blocked  "} ${name}`);
+    if (clean) revived.push(name);
+  }
+
+  if (failures.length > 0) {
+    console.log(
+      `\n::error title=Native target failed to compile::${failures.join(", ")}. Not blocked by any ` +
+        `error recorded in ${KNOWN_ERRORS_FILE}, so this is a break introduced by this change.`,
+    );
+    process.exit(1);
+  }
+  if (revived.length > 0) {
+    console.log(
+      `\n::error title=Stale native baseline::${revived.join(", ")} now build cleanly. Delete their ` +
+        `entries from ${KNOWN_ERRORS_FILE} so these targets become gated instead of exempt.`,
+    );
+    process.exit(1);
+  }
+
+  console.log(
+    `\n::warning title=Native half only PARTLY verified::${gated.length} target(s) compile cleanly ` +
+      `(${gated.join(", ")}), but ${blocked.length} could NOT be compiled at all ` +
+      `(${blocked.join(", ")}) because of ${known.length} pre-existing error(s) recorded in ` +
+      `${KNOWN_ERRORS_FILE}. Nothing in those blocked targets is verified by this run.`,
+  );
+}
+
+if (import.meta.main) {
+  await main(process.argv.slice(2));
+}

package/scripts/enforce_identity_migration.sh

@@ -0,0 +1,110 @@
+# shellcheck shell=bash
+# Shared enforcement for the designated-requirement (code identity) migration gate,
+# sourced by scripts/install_macos_app.sh.
+#
+# Replacing an installed app whose designated requirement the candidate does not
+# satisfy is what makes macOS treat the candidate as a different program: the
+# Microphone and Accessibility grants recorded against the installed requirement stop
+# applying. That is true for every artifact policy, not only for release. Local-only
+# artifacts are ad-hoc signed (src/native/Recordings/build.sh sets CODESIGN_IDENTITY="-"),
+# so their designated requirement is CDHash-based and a local-only install over a
+# certificate-rooted bundle always destroys the grant. This gate therefore lives in one
+# function that the installer calls unconditionally, rather than in policy-gated
+# conditionals that a new policy can silently escape.
+#
+# It is deliberately a pure function of already-computed values with no side effects and
+# no macOS-only tools, so the whole decision table is executable on any host — see
+# src/__tests__/identity-migration-guard.test.ts. Every input is validated before it is
+# interpreted: an empty, unset, or unrecognised value denies. There is no default-allow
+# branch.
+#
+# The two approvals are distinct on purpose. --allow-signing-identity-migration approves a
+# release signer rotation and is bound to exact operator-supplied old/new digests;
+# --allow-adhoc-identity-migration approves an ad-hoc local-only replacement. Approving
+# one is not approving the other, so neither flag is honoured for the other policy.
+
+# recordings_enforce_identity_migration <artifact-policy> <identity-migration> \
+#   <allow-release-migration> <allow-adhoc-migration> <previous-identity-sha256> \
+#   <candidate-identity-sha256> <expected-old-identity-sha256> <expected-new-identity-sha256>
+# Returns 0 only when replacing the installed app is explicitly permitted, and non-zero
+# with a message on stderr in every other case, including malformed input.
+recordings_enforce_identity_migration() {
+  if [ "$#" -ne 8 ]; then
+    echo "Identity-migration enforcement received ${#} arguments instead of 8." >&2
+    return 1
+  fi
+  local artifact_policy="$1"
+  local identity_migration="$2"
+  local allow_release_migration="$3"
+  local allow_adhoc_migration="$4"
+  local previous_identity_sha256="$5"
+  local candidate_identity_sha256="$6"
+  local expected_old_identity_sha256="$7"
+  local expected_new_identity_sha256="$8"
+
+  # `[ x -eq y ]` on a non-numeric value is a fatal syntax error under `set -e` in some
+  # shells and a silent 0 in others, so the three state bits are shape-checked here
+  # instead of being fed straight to an arithmetic test.
+  case "$identity_migration" in
+    0 | 1) ;;
+    *)
+      echo "Identity-migration state ${identity_migration:-<empty>} is not a 0/1 decision; refusing to replace the installed app." >&2
+      return 1
+      ;;
+  esac
+  case "$allow_release_migration" in
+    0 | 1) ;;
+    *)
+      echo "Release identity-migration approval ${allow_release_migration:-<empty>} is not a 0/1 decision." >&2
+      return 1
+      ;;
+  esac
+  case "$allow_adhoc_migration" in
+    0 | 1) ;;
+    *)
+      echo "Ad-hoc identity-migration approval ${allow_adhoc_migration:-<empty>} is not a 0/1 decision." >&2
+      return 1
+      ;;
+  esac
+
+  # An unrecognised policy — including an empty one — has no approval flag and therefore
+  # cannot be approved. Denying here is what keeps a future policy from inheriting the
+  # release-only gating that made this gate unenforced for local_only.
+  local approval
+  case "$artifact_policy" in
+    release) approval="$allow_release_migration" ;;
+    local_only) approval="$allow_adhoc_migration" ;;
+    *)
+      echo "Identity-migration enforcement does not recognise the artifact policy ${artifact_policy:-<empty>}." >&2
+      return 1
+      ;;
+  esac
+
+  if [ "$identity_migration" -eq 1 ] && [ "$approval" -ne 1 ]; then
+    if [ "$artifact_policy" = "release" ]; then
+      echo "Candidate and existing app designated requirements are not mutually compatible; review the signer change and rerun once with --allow-signing-identity-migration." >&2
+    else
+      echo "Candidate and existing app designated requirements are not mutually compatible (installed ${previous_identity_sha256} -> candidate ${candidate_identity_sha256}); this local-only artifact is ad-hoc signed, so replacing the installed app voids its Microphone and Accessibility grants. Rerun once with --allow-adhoc-identity-migration to accept that." >&2
+    fi
+    return 1
+  fi
+  # An approval that is not needed means the operator and the installer disagree about
+  # what is being replaced, and one of them is wrong. It also stops automation from
+  # carrying the flag permanently, which would turn the gate back into a no-op.
+  if [ "$identity_migration" -eq 0 ] && [ "$approval" -eq 1 ]; then
+    echo "Identity migration approval was supplied but no identity migration is required." >&2
+    return 1
+  fi
+  # Release migrations are additionally pinned to the exact operator-approved pair. A
+  # local-only candidate is ad-hoc, so its digest is derived from a CDHash that changes
+  # with every build; pinning it would only restate the artifact in hand. The distinct
+  # approval flag carries that consent instead.
+  if [ "$artifact_policy" = "release" ] && [ "$identity_migration" -eq 1 ] && {
+       [ "$previous_identity_sha256" != "$expected_old_identity_sha256" ] ||
+       [ "$candidate_identity_sha256" != "$expected_new_identity_sha256" ];
+     }; then
+    echo "Signing identity migration does not match the exact operator-approved old/new identities." >&2
+    return 1
+  fi
+  return 0
+}

package/scripts/generate-sdk.ts

@@ -20,7 +20,7 @@ const { code, operations, warnings } = generateSdkFromOpenApi(spec as never, {
   apiKeyHeader: "x-api-key",
 });
 
-// @hasna/contracts 0.4.2 stringifies query arrays. Preserve OpenAPI's
+// @hasna/contracts 0.8.4 stringifies query arrays. Preserve OpenAPI's
 // form+explode semantics until the package generator ships array support.
 const scalarQuerySerialization =
   "        if (value !== undefined && value !== null) url.searchParams.set(key, String(value));";