@starci/hfs 4.7.32 → 4.7.33

package/emit/operations.mjs

@@ -2,16 +2,19 @@
  * The versioned operations of an api app, read from its typed operation table and printed as OpenAPI 3.1.
  *
  * The table is the canon's one declaration of an app's operation surface (knowledge/patterns/be/api.yaml, BE-OPERATIONS-1):
- * `apps/<app>/src/operations.ts` exports `OPERATIONS`, made by `defineOperations({ "<id>@<version>": operation<Input, Output,
- * RefusalCode>("query" | "mutation") })`. The types come from the TypeScript checker; nothing is executed. An input, an output or a
- * refusal set the checker cannot express (`any`, `unknown`, `Record<string, unknown>`, an unbound generic, `string` as a refusal code)
- * is an error naming the operation.
+ * `apps/<app>/src/operations.ts` exports `OPERATIONS`, made by `defineOperations({ "<id>@<version>": query({ input, output }) })`.
+ * Input and output are exported zod schemas from *.schema.ts. Only schema modules are evaluated, never app modules; the app's
+ * z.toJSONSchema carries their constraints into OpenAPI. Open schemas and unrepresentable wire values are refused; the
+ * TypeScript checker separately proves closed parsed input/output types and refusal codes. A failure always names the operation.
  *
  * The wire is one route, `POST /operations`: the body is `{ operation, requestId, input }` and the answer is `{ operation, requestId,
  * outcome }`, `outcome` being `{ kind: "ok", value }` or `{ kind: "refused", code, params? }`. Each operation contributes one request
  * and one reply component carrying `x-operation: "<id>@<version>"`; the route's body and answer are the oneOf over them.
  */
 import { createSchemaBuilder, stable } from './type-schema.mjs';
+import { INPUT_BOUNDS_OPENAPI_EXTENSION, INPUT_BOUNDS_VERSION } from './input-bounds.mjs';
+import { operationSchemaReader } from './operation-schemas.mjs';
+import path from 'node:path';
 
 /** The export of `apps/<app>/src/operations.ts` that holds the table. */
 const OPERATIONS_EXPORT = 'OPERATIONS';
@@ -27,19 +30,32 @@ const ID = /^[a-z][A-Za-z0-9.]*@[1-9][0-9]*$/;
 /** The component name stem of an operation id: `sales.policy@1` gives `sales.policy.v1`. */
 const stemOf = (id) => id.replace('@', '.v');
 
+/** Preserve R95 on parsed values even when an input transform still has a closed JSON wire representation. */
+function assertParsedTypes(builder, member, fail) {
+  for (const label of ['input', 'output']) {
+    const type = member(label);
+    try {
+      builder.schemaOf(type, `parsed ${label}`);
+    } catch (error) {
+      fail(error.message);
+    }
+  }
+}
+
 /**
  * Reads the operation table of a source file of a program. Answers null when the file is not in the program; throws when it
  * exports no `OPERATIONS` or an operation is not decidable.
  */
-export function readOperations({ ts, program, file }) {
+export function readOperations({ ts, program, file, repoRoot = path.resolve(path.dirname(file), '../../..') }) {
   const checker = program.getTypeChecker();
   const sourceFile = program.getSourceFile(file);
   if (!sourceFile) return null;
   const moduleSymbol = checker.getSymbolAtLocation(sourceFile);
   const exported = moduleSymbol ? checker.getExportsOfModule(moduleSymbol).find((symbol) => symbol.getName() === OPERATIONS_EXPORT) : null;
   if (!exported) throw new Error(`${file} does not export ${OPERATIONS_EXPORT}, the app's operation table`);
-  const builder = createSchemaBuilder({ ts, checker });
-  const table = checker.getTypeOfSymbol(exported);
+  const readSchema = operationSchemaReader({ ts, program, repoRoot });
+  const parsedTypes = createSchemaBuilder({ ts, checker, schemaBacked: true });
+  const table = checker.getTypeOfSymbol(exported.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(exported) : exported);
   const operations = [];
   for (const prop of [...checker.getPropertiesOfType(table)].sort((a, b) => (a.getName() < b.getName() ? -1 : 1))) {
     const id = prop.getName();
@@ -47,6 +63,7 @@ export function readOperations({ ts, program, file }) {
       throw new Error(`operation ${id}: ${why}`);
     };
     if (!ID.test(id)) fail('the key must be "<name>@<positive version>", for example "sales.policy@1"');
+    if (id.length > 128) fail('the operation id exceeds the runtime envelope limit of 128 characters');
     const contract = checker.getTypeOfSymbol(prop);
     const kindType = contract.getProperty('kind') ? checker.getTypeOfSymbol(contract.getProperty('kind')) : null;
     const kind = kindType?.isStringLiteral() ? kindType.value : null;
@@ -59,15 +76,17 @@ export function readOperations({ ts, program, file }) {
       if (!symbol) fail(`the contract has no ${name} type`);
       return checker.getTypeOfSymbol(symbol);
     };
-    const guard = (label, type) => {
+    const schema = (label) => {
       try {
-        return builder.schemaOf(type, label);
+        return readSchema(prop, label);
       } catch (error) {
-        return fail(error.message);
+        return fail(`${label} schema: ${error.message}`);
       }
     };
-    const input = guard('input', member('input'));
-    const output = guard('output', member('output'));
+    const input = schema('input');
+    const output = schema('output');
+    // This check never supplies emitted schemas: z.toJSONSchema remains the wire authority.
+    assertParsedTypes(parsedTypes, member, fail);
     const refusalType = member('refusal');
     let refusal = [];
     if ((refusalType.flags & ts.TypeFlags.Never) === 0) {
@@ -78,12 +97,23 @@ export function readOperations({ ts, program, file }) {
     operations.push({ id, kind, input, output, refusal });
   }
   if (operations.length === 0) throw new Error(`${file}: ${OPERATIONS_EXPORT} declares no operation`);
-  return { operations, components: builder.components() };
+  return { operations, components: {} };
 }
 
 /** The OpenAPI 3.1 document of an app's operations, as sorted-key JSON text with one final newline. */
 export function openApiText({ app, operations, components }) {
   const schemas = { ...components };
+  schemas['Operation.InvalidRequest'] = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['code', 'kind', 'message', 'params'],
+    properties: {
+      code: { const: 'OPERATIONS_INVALID_REQUEST' },
+      kind: { const: 'invalid' },
+      message: { type: 'string', description: 'The localized canonical error message.' },
+      params: { type: 'object', additionalProperties: false },
+    },
+  };
   const requests = [];
   const replies = [];
   for (const operation of operations) {
@@ -92,15 +122,17 @@ export function openApiText({ app, operations, components }) {
     const refusedOutcome = { type: 'object', required: ['code', 'kind'], properties: { code: { enum: operation.refusal, type: 'string' }, kind: { const: 'refused' }, params: { type: 'object', additionalProperties: { type: ['string', 'number', 'boolean'] } } } };
     schemas[`Operation.${stem}.Request`] = {
       type: 'object',
+      additionalProperties: false,
       required: ['input', 'operation', 'requestId'],
-      properties: { input: operation.input, operation: { const: operation.id }, requestId: { type: 'string', minLength: 1 } },
+      properties: { input: operation.input, operation: { const: operation.id }, requestId: { type: 'string', minLength: 1, maxLength: 128 } },
       'x-kind': operation.kind,
       'x-operation': operation.id,
     };
     schemas[`Operation.${stem}.Reply`] = {
       type: 'object',
+      additionalProperties: false,
       required: ['operation', 'outcome', 'requestId'],
-      properties: { operation: { const: operation.id }, outcome: operation.refusal.length ? { oneOf: [okOutcome, refusedOutcome] } : okOutcome, requestId: { type: 'string' } },
+      properties: { operation: { const: operation.id }, outcome: operation.refusal.length ? { oneOf: [okOutcome, refusedOutcome] } : okOutcome, requestId: { type: 'string', minLength: 1, maxLength: 128 } },
       'x-kind': operation.kind,
       'x-operation': operation.id,
     };
@@ -109,6 +141,7 @@ export function openApiText({ app, operations, components }) {
   }
   const document = {
     openapi: '3.1.0',
+    [INPUT_BOUNDS_OPENAPI_EXTENSION]: INPUT_BOUNDS_VERSION,
     info: { title: `${app} operations`, version: '1' },
     'x-operations': operations.map((operation) => ({ id: operation.id, kind: operation.kind })),
     paths: {
@@ -116,7 +149,10 @@ export function openApiText({ app, operations, components }) {
         post: {
           operationId: 'invokeOperation',
           requestBody: { required: true, content: { 'application/json': { schema: { oneOf: requests } } } },
-          responses: { 200: { description: 'The reply of the invoked operation: its outcome is ok or a declared refusal.', content: { 'application/json': { schema: { oneOf: replies } } } } },
+          responses: {
+            200: { description: 'The reply of the invoked operation: its outcome is ok or a declared refusal.', content: { 'application/json': { schema: { oneOf: replies } } } },
+            400: { description: 'The envelope, operation id or input failed runtime schema validation before dispatch.', content: { 'application/json': { schema: { $ref: '#/components/schemas/Operation.InvalidRequest' } } } },
+          },
         },
       },
     },

package/emit/schema-worker.mjs

@@ -1,6 +1,6 @@
 // The child process of `starci app emit` for one app.
 // Prints the schema the app serves on stdout; exit 3 when the app's module graph has no GraphQL server.
-// Loads the repository's own typescript, @nestjs/* and graphql (resolved from the repository, never from hfs).
+// Loads the repository's own typescript, @nestjs/*, graphql and (when installed) class-validator (resolved from the repository, never from hfs).
 //
 // Two steps: (1) the module graph of the app root is read from source (static-graph.mjs) and yields the resolver classes the
 // GraphQL server would collect; (2) only those classes are loaded, and Nest's own GraphQLSchemaFactory builds the schema.
@@ -13,6 +13,7 @@ import path from 'node:path';
 import { aliasTarget, aliasesOf, appModulePath } from './contracts.mjs';
 import { compilerOptionsOf } from './compiler.mjs';
 import { createGraphReader } from './static-graph.mjs';
+import { graphqlInputBounds, withInputBounds } from './graphql-input-bounds.mjs';
 
 const [rootArgument, app] = process.argv.slice(2);
 const repoRoot = path.resolve(rootArgument);
@@ -94,7 +95,7 @@ const classOf = ({ file, name }) => {
 };
 
 // The packages of the repository under emission, resolved from it (never from hfs, which declares none of them).
-const FROM_REPOSITORY = { nestGraphql: '@nestjs/graphql', nestCore: '@nestjs/core', graphql: 'graphql' };
+const FROM_REPOSITORY = { nestGraphql: '@nestjs/graphql', nestCore: '@nestjs/core', graphql: 'graphql', classValidator: 'class-validator' };
 const graphql = require(FROM_REPOSITORY.nestGraphql);
 // the constants and the scalar factory are internals of the package: reached by file, its `exports` map hides them
 const graphqlDist = path.dirname(require.resolve(FROM_REPOSITORY.nestGraphql));
@@ -110,8 +111,20 @@ const includeModules = composition.include.map(classOf);
 
 const { NestFactory } = require(FROM_REPOSITORY.nestCore);
 const { GraphQLSchemaBuilderModule, GraphQLSchemaFactory } = graphql;
-const { lexicographicSortSchema, printSchema } = require(FROM_REPOSITORY.graphql);
+const { lexicographicSortSchema, parse, print, printSchema } = require(FROM_REPOSITORY.graphql);
 const context = await NestFactory.createApplicationContext(GraphQLSchemaBuilderModule, { logger: false });
 const schema = await context.get(GraphQLSchemaFactory).create(resolvers, { scalarsMap, includeModules });
-process.stdout.write(printSchema(lexicographicSortSchema(schema)));
+const printed = printSchema(lexicographicSortSchema(schema));
+const { TypeMetadataStorage } = require(path.join(graphqlDist, 'schema-builder', 'storages', 'type-metadata.storage.js'));
+// A repository without class-validator has no validators, hence no bounds: only that package's absence is tolerated.
+let validationStorage = { getTargetValidationMetadatas: () => [] };
+try {
+  validationStorage = require(FROM_REPOSITORY.classValidator).getMetadataStorage();
+} catch (error) {
+  if (error?.code !== 'MODULE_NOT_FOUND' || !String(error.message).includes(`'${FROM_REPOSITORY.classValidator}'`)) throw error;
+}
+const bounds = graphqlInputBounds({ schema, typeStorage: TypeMetadataStorage, validationStorage });
+const document = parse(printed);
+const bounded = withInputBounds(document, bounds);
+process.stdout.write(bounded === document ? printed : print(bounded));
 await context.close();

package/emit/type-schema.mjs

@@ -18,8 +18,12 @@ export function stable(value) {
 
 const canonical = (value) => JSON.stringify(stable(value));
 
-/** A builder over one checker; `components` fills as named object types are met. */
-export function createSchemaBuilder({ ts, checker }) {
+/**
+ * A builder over one checker; `components` fills as named object types are met. A schema-backed caller has already proved
+ * the wire schema is closed, so its inferred empty object is meaningful (for example z.strictObject({})). Other callers
+ * retain the strict type-only rule: an empty object type alone proves no wire shape.
+ */
+export function createSchemaBuilder({ ts, checker, schemaBacked = false }) {
   const F = ts.TypeFlags;
   const components = new Map();
   const nameOf = new Map();
@@ -98,6 +102,12 @@ export function createSchemaBuilder({ ts, checker }) {
     return { $ref: `#/components/schemas/${name}` };
   }
 
+  function indexSchema(index, path) {
+    // z.strictObject({}) infers Record<string, never>: this index forbids keys rather than admitting a never-valued field.
+    if (schemaBacked && (index.type.flags & F.Never) !== 0) return false;
+    return schemaOf(index.type, `${path}[key]`);
+  }
+
   function plainObject(type, path) {
     const properties = {};
     const required = [];
@@ -109,15 +119,17 @@ export function createSchemaBuilder({ ts, checker }) {
       const kept = withoutUndefined(propType);
       if (kept.length === 0) fail(`${path}.${prop.getName()}`, 'undefined is not a wire value');
       const hadUndefined = kept.length < members.length;
-      properties[prop.getName()] = !hadUndefined ? schemaOf(propType, `${path}.${prop.getName()}`) : kept.length === 1 ? schemaOf(kept[0], `${path}.${prop.getName()}`) : membersSchema(kept, `${path}.${prop.getName()}`);
+      const propertyPath = `${path}.${prop.getName()}`;
+      const schema = !hadUndefined ? schemaOf(propType, propertyPath) : kept.length === 1 ? schemaOf(kept[0], propertyPath) : membersSchema(kept, propertyPath);
+      properties[prop.getName()] = schema;
       if (!optional && !hadUndefined) required.push(prop.getName());
     }
     const index = checker.getIndexInfosOfType(type).find((info) => info.keyType.flags & F.String);
-    if (props.length === 0 && !index) fail(path, 'an object type with no members and no index signature says nothing');
+    if (props.length === 0 && !index && !schemaBacked) fail(path, 'an object type with no members and no index signature says nothing');
     const result = { type: 'object' };
     if (props.length) result.properties = properties;
     if (required.length) result.required = required;
-    if (index) result.additionalProperties = schemaOf(index.type, `${path}[key]`);
+    if (index) result.additionalProperties = indexSchema(index, path);
     return result;
   }
 

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.32",
+  "version": "4.7.33",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",
   "private": false,
   "exports": {
     ".": "./src/main.mjs",
+    "./form-bounds": "./emit/form-bounds.mjs",
     "./package.json": "./package.json",
     "./runtime/*": "./runtime/*"
   },
@@ -15,13 +16,19 @@
     "smol-toml": "1.9.0"
   },
   "devDependencies": {
+    "@graphql-codegen/cli": "7.4.6",
+    "@graphql-codegen/client-preset": "6.2.3",
     "@nestjs/common": "11.2.5",
     "@nestjs/core": "11.2.5",
+    "@nestjs/graphql": "13.4.5",
     "@nestjs/testing": "11.2.5",
+    "class-validator": "0.15.1",
+    "graphql": "16.14.2",
     "prettier": "3.9.6",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2",
-    "typescript": "5.9.3"
+    "typescript": "5.9.3",
+    "zod": "4.6.7"
   },
   "files": [
     "LICENSE",

package/release/gate.mjs

@@ -16,7 +16,9 @@ import { sonarQualityGate } from './sonar-quality-gate.mjs';
 export const RELEASE_CODE = 'RELEASE_CONFIG_INVALID';
 const SONAR_UNREACHABLE = 'SONAR_UNREACHABLE';
 
-const FIELDS = new Set(['gates', 'tagPrefix', 'defaultBranch', 'tagMatchesVersion', 'requireCi']);
+const FIELDS = new Set(['gates', 'tagPrefix', 'defaultBranch', 'requireCi']);
+/** Release-block keys that no longer exist, each with what replaced it. */
+const REMOVED_FIELDS = new Map([['tagMatchesVersion', 'the release tag is always <tagPrefix><package.json version>; delete the key']]);
 /** The note a release that does not wait for CI carries in its L4 record and its push output (owner ruling release-require-ci-per-project). */
 export const CI_NOT_REQUIRED = 'CI not required by release.requireCi=false (owner ruling release-require-ci-per-project): the local release gate, this L4 record and the annotated tag, is the release proof';
 const GATE_FIELDS = new Set(['name', 'command', 'summary', 'env']);
@@ -36,7 +38,6 @@ const SCRIPT_GATES = ['format:check', 'typecheck', 'build:be', 'lint', 'db:lint'
 const WORLD_SCRIPTS = ['test:integration', 'test:e2e', 'test:contract'];
 const DB_TYPES_SCRIPTS = ['db:start', 'db:reset', 'db:types', 'db:stop'];
 const DB_TYPES_COMMITTED = { name: 'db-types-committed', command: ['git', 'diff', '--exit-code', '--', 'supabase/types/database.types.ts'], summary: null, env: {} };
-const MAX_PATCH = 100;
 
 /** True for a branch or remote name git can take as one argument (no leading dash, only path-like characters). */
 export const refName = (value) => typeof value === 'string' && REF_NAME.test(value);
@@ -133,21 +134,23 @@ function gatesOf(list, problems) {
 export function normalizeRelease(block, scripts = {}, services = {}, options = {}) {
   const raw = block ?? {};
   if (!plain(raw)) return { problems: ['release: must be a mapping'] };
-  const problems = Object.keys(raw).filter((key) => !FIELDS.has(key)).map((key) => `release.${key}: is not a field of the release block`);
+  const problems = [];
+  for (const key of Object.keys(raw)) {
+    if (REMOVED_FIELDS.has(key)) problems.push(`release.${key}: is removed (${REMOVED_FIELDS.get(key)})`);
+    else if (!FIELDS.has(key)) problems.push(`release.${key}: is not a field of the release block`);
+  }
   const tagPrefix = raw.tagPrefix ?? 'v';
   const defaultBranch = raw.defaultBranch ?? 'main';
-  const tagMatchesVersion = raw.tagMatchesVersion ?? false;
   // The candidate CI of `release push` is an app's choice and off by default (owner ruling release-require-ci-per-project); the local gate never is.
   const requireCi = raw.requireCi ?? false;
   if (typeof tagPrefix !== 'string' || !PREFIX.test(tagPrefix)) problems.push(`release.tagPrefix: must match ${PREFIX}`);
   if (!refName(defaultBranch)) problems.push(`release.defaultBranch: must match ${REF_NAME}`);
-  if (typeof tagMatchesVersion !== 'boolean') problems.push('release.tagMatchesVersion: must be true or false');
   if (typeof requireCi !== 'boolean') problems.push('release.requireCi: must be true or false');
   const quality = releaseServices(services, options);
   const audit = auditGate(quality.audit);
   const gates = raw.gates === undefined ? defaultGates(scripts, audit) : gatesOf(raw.gates, problems);
   if (raw.gates !== undefined && audit && !gates.some((gate) => gate.name === 'audit')) gates.push(audit);
-  return problems.length === 0 ? { config: { gates, tagPrefix, defaultBranch, tagMatchesVersion, requireCi, services: quality } } : { problems };
+  return problems.length === 0 ? { config: { gates, tagPrefix, defaultBranch, requireCi, services: quality } } : { problems };
 }
 
 /* ---- git through the seam */
@@ -169,6 +172,9 @@ export function annotatedOnHead(ctx, prefix) {
   return names.filter((name) => git(ctx, ['cat-file', '-t', `refs/tags/${name}`], { allowFail: true }).stdout === 'tag');
 }
 
+/** Every tag on HEAD whose name ends in a version, annotated or not, under any prefix: a release commit carries exactly one. */
+const versionTagsOnHead = (ctx) => lines(git(ctx, ['tag', '--points-at', 'HEAD']).stdout).filter((name) => /[0-9]+[.][0-9]+[.][0-9]+$/u.test(name));
+
 const dirtyPaths = (ctx) => lines(git(ctx, ['status', '--porcelain', '--untracked-files=normal']).stdout);
 
 /** Tag names that exist locally or on the remote. */
@@ -179,24 +185,11 @@ function takenTags(ctx, prefix, remote) {
   return new Set([...local, ...remoteNames]);
 }
 
-/** Next free `<prefix><major>.<minor>.<n>` for the package version. */
-function nextFree(prefix, version, taken) {
-  const [, major, minor] = VERSION.exec(version);
-  for (let patch = 0; patch < MAX_PATCH; patch += 1) {
-    const candidate = `${prefix}${major}.${minor}.${patch}`;
-    if (!taken.has(candidate)) return candidate;
-  }
-  throw refusal('RELEASE_NO_FREE_TAG', `no free tag ${prefix}${major}.${minor}.0 to ${prefix}${major}.${minor}.${MAX_PATCH - 1}`);
-}
-
-/** The tag this release uses and its state: on-head (reused), free (will be created) or taken (exists on another commit). */
+/** The tag this release uses is `<prefix><package version>`; its state is on-head (reused), free (will be created) or taken (exists on another commit). */
 function chooseTag(ctx, config, { prefix, remote }) {
-  const onHead = annotatedOnHead(ctx, prefix);
-  const taken = takenTags(ctx, prefix, remote);
-  const exact = `${prefix}${config.version}`;
-  const tag = config.tagMatchesVersion ? exact : (onHead[0] ?? nextFree(prefix, config.version, taken));
-  if (onHead.includes(tag)) return { tag, state: 'on-head' };
-  return { tag, state: taken.has(tag) ? 'taken' : 'free' };
+  const tag = `${prefix}${config.version}`;
+  if (annotatedOnHead(ctx, prefix).includes(tag)) return { tag, state: 'on-head' };
+  return { tag, state: takenTags(ctx, prefix, remote).has(tag) ? 'taken' : 'free' };
 }
 
 /* ---- gate results */
@@ -344,6 +337,8 @@ function inspect(ctx, config, options) {
   if (!PREFIX.test(prefix)) throw refusal('RELEASE_USAGE', `--tag-prefix must match ${PREFIX}`);
   const chosen = chooseTag(ctx, config, { prefix, remote: 'origin' });
   if (chosen.state === 'taken') red.push(`tag ${chosen.tag} already exists on another commit (local or remote)`);
+  const stray = versionTagsOnHead(ctx).filter((name) => name !== chosen.tag);
+  if (stray.length > 0) red.push(`HEAD already carries the release tag ${stray[0]} but package.json version ${config.version} gives ${chosen.tag}: a release commit carries exactly one tag, so set the version to match the tag or release a new commit`);
   out.push(tagLine(chosen));
   return { head, chosen, red, out };
 }

package/release/index.mjs

@@ -53,7 +53,7 @@ function readPackage(root) {
   try { return JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')); } catch { throw refusal('RELEASE_PACKAGE_UNREADABLE', 'package.json is not readable JSON'); }
 }
 
-/** The normalised `release:` block (tolerant of absence) with the package version: { root, version, gates, tagPrefix, defaultBranch, tagMatchesVersion, requireCi }. */
+/** The normalised `release:` block (tolerant of absence) with the package version: { root, version, gates, tagPrefix, defaultBranch, requireCi }. */
 function loadReleaseConfig(root) {
   const pkg = readPackage(root);
   if (typeof pkg.version !== 'string' || !VERSION.test(pkg.version)) throw refusal(RELEASE_CODE, 'package.json needs a version like 1.2.3 (the release tag derives from it)');

package/release/push.mjs

@@ -22,14 +22,13 @@ const greenRecord = (record, head, tag) => record?.head === head && record?.tag
   && Array.isArray(record.gates) && record.gates.length > 0 && record.gates.every((gate) => gate?.pass === true);
 
 /** The release gate as the hook reads it: the annotated tag on HEAD whose L4 record names head and tag. Returns { tag } or { reason }. */
-function gateState(ctx, head, prefix) {
+function gateState(ctx, head, prefix, expected) {
   const tags = annotatedOnHead(ctx, prefix);
-  if (tags.length === 0) return { reason: `no ANNOTATED tag ${prefix}[0-9]* on HEAD: run starci app release gate --execute first` };
+  if (!tags.includes(expected)) return { reason: `no ANNOTATED tag ${expected} (the package.json version) on HEAD${tags.length > 0 ? `, which carries ${tags.join(', ')}` : ''}: run starci app release gate --execute first` };
   const file = path.join(releaseDir(ctx), `${head}.l4.json`);
   if (!fs.existsSync(file)) return { reason: `no L4 record ${file}: run starci app release gate --execute first` };
   const record = readRecord(file);
-  const tag = tags.find((name) => greenRecord(record, head, name));
-  return tag ? { tag } : { reason: `the L4 record does not name head ${head.slice(0, 10)} and one of ${tags.join(', ')} with every gate green` };
+  return greenRecord(record, head, expected) ? { tag: expected } : { reason: `the L4 record does not name head ${head.slice(0, 10)} and ${expected} with every gate green` };
 }
 
 /** The remote branch tip, or null on an empty remote; an unreachable remote is a failure (the state cannot be judged). */
@@ -93,7 +92,7 @@ export async function releasePush(ctx, config, options = {}) {
   const branch = config.defaultBranch;
   assertNames(remote, branch);
   const head = git(ctx, ['rev-parse', 'HEAD']).stdout;
-  const gate = gateState(ctx, head, config.tagPrefix);
+  const gate = gateState(ctx, head, config.tagPrefix, `${config.tagPrefix}${config.version}`);
   const out = [`HEAD           ${head}`, gateLine(gate)];
   const data = { head, tag: gate.tag ?? null, remote, branch, refs: [], hook: null, pushed: false };
   if (!gate.tag) return refuse(out, [gate.reason], data, 'nothing pushed.');