fix(build): name canaries after the release, not after a prerelease

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@angular/fire",
-  "version": "21.0.0-rc.1",
+  "version": "21.0.0",
   "description": "Angular + Firebase = ❤️",
   "publishConfig": {
     "registry": "https://wombat-dressing-room.appspot.com",

sample/README.md

@@ -4,7 +4,7 @@ This project was generated using [Angular CLI](https://github.com/angular/angula
 
 ## AngularFire tarball
 
-The sample consumes the library as `file:../angular-fire-21.0.0-rc.1.tgz`. Produce that file from the repository root before installing here:
+The sample consumes the library as `file:../angular-fire-21.0.0.tgz`. Produce that file from the repository root before installing here:
 
 ```bash
 npm ci
@@ -16,7 +16,7 @@ The root build ends with `npm pack ./dist/packages-dist`, which writes `angular-
 Then, from this `sample/` folder, install the dependencies by naming the tarball explicitly:
 
 ```bash
-npm install ../angular-fire-21.0.0-rc.1.tgz
+npm install ../angular-fire-21.0.0.tgz
 ```
 
 A plain `npm install` is not reliable here. `package-lock.json` records the integrity hash of the tarball built by whoever committed the lockfile, and a tarball you build yourself can hash differently. With a cold npm cache the install then fails with an `EINTEGRITY` error. With a warm cache that holds the recorded hash, npm installs the stale cached copy and exits successfully, so you would be testing a library you did not build. Naming the tarball installs the file on disk and rewrites the recorded hash in your local `package-lock.json`. Leave that lockfile change uncommitted.

sample/package.json

@@ -14,7 +14,7 @@
     "@angular/common": "^21.0.0",
     "@angular/compiler": "^21.0.0",
     "@angular/core": "^21.0.0",
-    "@angular/fire": "file:../angular-fire-21.0.0-rc.1.tgz",
+    "@angular/fire": "file:../angular-fire-21.0.0.tgz",
     "@angular/forms": "^21.0.0",
     "@angular/platform-browser": "^21.0.0",
     "@angular/platform-server": "^21.0.0",

src/schematics/common.ts

@@ -146,9 +146,9 @@ const angularFireVersion = 'ANGULARFIRE2_VERSION';
 
 /**
  * Pins the workspace's `@angular/fire` entry to the exact installed version when `ng add` wrote a
- * prerelease range. A prerelease range like `^21.0.0-rc.0` also matches the canary build published
- * for every merge to main, so a later fresh install can silently replace the version the user
- * chose. Stable ranges are left untouched.
+ * prerelease range. A prerelease range like `^21.0.0-rc.0` also matches every later prerelease of
+ * the same release, so a later fresh install can silently replace the version the user chose.
+ * Stable ranges are left untouched.
  */
 export const pinInstalledPrereleaseVersion = (
   host: Tree,
@@ -181,7 +181,7 @@ export const pinInstalledPrereleaseVersion = (
     overwriteIfExists(host, 'package.json', stringifyFormatted(packageJson));
     context.logger.info(
       `Pinned @angular/fire to the exact version ${installedVersion} — a prerelease range like ` +
-      `${declaredAngularFireVersion} also matches unreviewed canary builds, so a later install ` +
+      `${declaredAngularFireVersion} also matches later prereleases, so a later install ` +
       'could silently change versions.'
     );
   }

tools/build.sh

@@ -10,7 +10,15 @@ if [[ $GITHUB_REF =~ $TAG_TEST ]]; then
         NPM_TAG=next
     fi;
 else
-    OVERRIDE_VERSION=$(node -e "console.log(require('./package.json').version)")-canary.$SHORT_SHA
+    FULL_VERSION=$(node -e "console.log(require('./package.json').version)")
+    # Name the canary after the release itself, never after a prerelease of it. A canary built on
+    # `21.0.0-rc.1` sorts above it, so the caret range `ng add` writes into a user's package.json
+    # resolves to the canary rather than to the release candidate they asked for.
+    BASE_VERSION=${FULL_VERSION%%-*}
+    if [[ $BASE_VERSION != "$FULL_VERSION" ]]; then
+        echo "package.json version is $FULL_VERSION. Naming this canary after $BASE_VERSION instead, so it does not outrank $FULL_VERSION on npm. Prereleases are published from their own git tag, so this field is meant to hold a plain release number." >&2
+    fi
+    OVERRIDE_VERSION=$BASE_VERSION-canary.$SHORT_SHA
     NPM_TAG=canary
 fi;