fix(release): use npm semver for cohort checks

package.json

@@ -139,6 +139,7 @@
     "miniflare": "4.20260722.0",
     "oxc-parser": "0.147.0",
     "publint": "catalog:",
+    "semver": "^7.8.5",
     "tsdown": "catalog:",
     "tsx": "catalog:",
     "typedoc": "0.28.20",

scripts/lib/packed-package-test.mjs

@@ -1,3 +1,4 @@
+import { satisfies, valid } from 'semver'
 import { sandboxCompatibilityVersions, sandboxPeerRange } from './dependency-contract.mjs'
 
 const unsupportedDependencyProtocol = /^(?:catalog|file|link|patch|portal|workspace):/
@@ -58,22 +59,9 @@ export function expectedPeerRange(version) {
   return Number(match[1]) >= 1 ? `^${version}` : currentMinorPeerRange(version)
 }
 
-/** A caret range admits a version when the major matches and the floor is at or below it. */
-export function caretAdmits(range, version) {
-  const floor = /^\^(\d+)\.(\d+)\.(\d+)$/.exec(range)
-  const found = /^(\d+)\.(\d+)\.(\d+)/.exec(version)
-  if (floor === null || found === null) return false
-  const [floorMajor, floorMinor, floorPatch] = floor.slice(1).map(Number)
-  const [major, minor, patch] = found.slice(1).map(Number)
-  if (floorMajor < 1 || major !== floorMajor) return false
-  return minor * 1_000_000 + patch >= floorMinor * 1_000_000 + floorPatch
-}
-
-const exactVersion = /^\d+\.\d+\.\d+(?:[-+].*)?$/
-
 /** True when a specifier names one version and admits no other. */
 export function isExactVersionSpec(spec) {
-  return typeof spec === 'string' && exactVersion.test(spec.trim())
+  return typeof spec === 'string' && valid(spec.trim()) !== null
 }
 
 /**
@@ -89,21 +77,9 @@ export function cohortRange(spec) {
   return isExactVersionSpec(spec) ? expectedPeerRange(spec.trim()) : spec
 }
 
-/** A `>=floor <ceiling` window admits a version at or above the floor and below the ceiling. */
-export function windowAdmits(range, version) {
-  const window = /^>=(\d+)\.(\d+)\.(\d+)\s+<(\d+)\.(\d+)\.(\d+)$/.exec(range)
-  const found = /^(\d+)\.(\d+)\.(\d+)/.exec(version)
-  if (window === null || found === null) return false
-  const parts = window.slice(1).map(Number)
-  const order = ([major, minor, patch]) =>
-    major * 1_000_000_000_000 + minor * 1_000_000 + patch
-  const target = order(found.slice(1).map(Number))
-  return target >= order(parts.slice(0, 3)) && target < order(parts.slice(3))
-}
-
-/** A range admits a version through either supported cohort shape. */
+/** Use npm's version rules while keeping the cohort's no-exact-pin policy. */
 export function rangeAdmits(range, version) {
-  return caretAdmits(range, version) || windowAdmits(range, version)
+  return typeof range === 'string' && !isExactVersionSpec(range) && satisfies(version, range)
 }
 
 /**

scripts/lib/packed-package-test.test.mjs

@@ -72,6 +72,24 @@ describe('rangeAdmits', () => {
   it('refuses an exact specifier, which states no range', () => {
     expect(rangeAdmits('0.145.21', '0.145.21')).toBe(false)
   })
+
+  it('does not admit prereleases through stable ranges', () => {
+    expect(rangeAdmits('>=0.36.4 <0.39.0', '0.38.2-develop.1')).toBe(false)
+    expect(rangeAdmits('^1.0.0', '1.4.2-rc.1')).toBe(false)
+  })
+
+  it('admits only the named snapshot beside the stable range', () => {
+    const range = '>=0.36.4 <0.39.0 || 0.39.0-develop.1'
+    expect(rangeAdmits(range, '0.38.2')).toBe(true)
+    expect(rangeAdmits(range, '0.39.0-develop.1')).toBe(true)
+    expect(rangeAdmits(range, '0.39.0-develop.2')).toBe(false)
+    expect(rangeAdmits(range, '0.39.0')).toBe(false)
+  })
+
+  it('compares multi-digit version components without collisions', () => {
+    expect(rangeAdmits('>=0.1.1000000 <0.2.0', '0.2.0')).toBe(false)
+    expect(rangeAdmits('>=0.1.1000000 <0.2.0', '0.1.1000000')).toBe(true)
+  })
 })
 
 describe('assertFirstPartyRangeSpecs', () => {