Files
Dario LipicarandClaude Opus 4.8 973d54bf8a fix: order the catalog by semver precedence, not by release date (#4)
* fix: order the catalog by semver precedence, not by release date

sort_versions ordered each package's versions[] by the `releasedAt`
timestamp. Every client -- the downloader's resolver, the package-manager
UI's row builder, `index.py list` -- reads versions[0] as "latest". A
publish time is not a version, so:

  - publishing 2.0.0-alpha after 1.9.0 put the alpha at versions[0] and
    advertised an unreleased alpha to every user as the newest release;
  - a 1.2.1 backported after 2.0.0 shipped did the same;
  - so did a forced republish, which refreshes the asset's Last-Modified --
    and that is what `releasedAt` actually records.

Ordering is now SemVer 2.0.0 precedence, with releasedAt only breaking ties
between entries that share a version (the same version republished with a
different rootHash).

It is computed by `lgx semver sort` rather than reimplemented here. lgx owns
the single implementation the C++ clients also use, so the catalog cannot
disagree with them about which version is newest -- which is exactly how the
ordering drifted in the first place. This costs nothing: the script is
stdlib-only but already requires lgx on PATH for the only two subcommands
that sort (`build` / `add`). If lgx predates the subcommand we abort loudly
rather than falling back to a date sort, which is invisible in the output.

validate's ordering check had to change too, and not only because the sort
did: asserting descending releasedAt would now actively REJECT a correctly
ordered catalog, since a higher version legitimately carries an older
timestamp.

Adds the repo's first tests (stdlib unittest) and CI. Four of them fail
against the old implementation.

Requires the `lgx semver` subcommand from logos-package#30. CI builds lgx
from logos-package master, so it stays red until that merges.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix: guard validate against old lgx; correct the misleading ordering example

Addresses Copilot review on #4.

check_version_order only checked that lgx exists, not that it has the semver
subcommand, so an older lgx made semver_rank_desc() raise and crashed
validate. It now degrades to 'ordering not checked' both when lgx lacks the
subcommand and if the sort raises mid-run. Factored the probe into
_lgx_has_semver(), shared with the build/add preflight.

The '2.0.0-alpha after 1.9.0' example (docstring, catalog-format.md, and the
first case of test_orders_by_semver_not_by_release_date) was wrong: under
semver 2.0.0-alpha OUTRANKS 1.9.0, so date and precedence AGREE there and it
never demonstrated the bug. Replaced with cases where they genuinely disagree
-- 1.2.1 backported after 2.0.0, and 2.0.0-alpha published after 2.0.0. The
test now fails against the old date sort (verified), where before its first
assert passed under both.

Adds graceful-degradation tests that run without lgx.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 15:35:49 -03:00
..