@actuate-media/cms-core 0.46.0 → 0.47.0

package/dist/__tests__/api/updates-routes.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=updates-routes.test.d.ts.map

package/dist/__tests__/api/updates-routes.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"updates-routes.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/updates-routes.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/updates-routes.test.js

@@ -0,0 +1,248 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+import { generateApiKey } from '../../security/api-key-enhanced.js';
+/**
+ * Contract tests for the Settings → Updates endpoints:
+ *   - GET  /updates/check   → any authed session; admins additionally see the
+ *                              GitHub-integration config hints (`canManage`).
+ *   - GET  /updates/config  → admin only.
+ *   - PUT  /updates/config  → admin only; encrypts credentials at rest.
+ *   - POST /updates/apply   → admin only.
+ *
+ * Regression guard for the role-check bug where these routes compared
+ * `session.role !== 'admin'` (lowercase) while roles are stored uppercase
+ * (`'ADMIN'` / `'OWNER'`) — which 403'd every real admin. Admin auth here is
+ * exercised through an admin-scoped API key (the same path real admin sessions
+ * resolve through `requireAdminScope`).
+ */
+const VALID_SECRET = 'a'.repeat(48);
+const VALID_ENC_KEY = 'a'.repeat(64);
+function createMockDB(state, apiKey) {
+    return {
+        apiKey: {
+            findMany: async () => (apiKey ? [apiKey] : []),
+            findUnique: async ({ where }) => apiKey && apiKey.keyHash === where.keyHash ? apiKey : null,
+            update: async () => apiKey,
+        },
+        document: {
+            findFirst: async () => state.configDoc,
+            upsert: async (args) => {
+                state.upsertArgs = args;
+                return { id: 'cfg-doc' };
+            },
+        },
+        user: { count: async () => 1 },
+        auditLog: { create: async () => ({ id: 'log1' }) },
+        version: { create: async () => ({ id: 'v1' }) },
+    };
+}
+async function makeKey(scopes) {
+    const { key, keyHash, keyPrefix } = await generateApiKey({ prefix: 'act_sk', scopes });
+    return {
+        key,
+        record: {
+            id: 'apikey-1',
+            keyHash,
+            keyPrefix,
+            userId: 'user-1',
+            scopes,
+            ipRestrictions: null,
+            expiresAt: null,
+            lastUsedAt: null,
+            revokedAt: null,
+        },
+    };
+}
+function freshState() {
+    return { configDoc: null };
+}
+beforeEach(() => {
+    delete globalThis.__actuateConfig;
+    process.env.CMS_SECRET = VALID_SECRET;
+    process.env.CMS_ENCRYPTION_KEY = VALID_ENC_KEY;
+    delete process.env.ACTUATE_GITHUB_TOKEN;
+    delete process.env.ACTUATE_GITHUB_REPO;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+/**
+ * Stub the network so `checkForUpdates` (and the future update-server hybrid)
+ * resolve deterministically without hitting npm. The update-server URL is
+ * forced to fail so the npm-registry fallback path is what we assert.
+ */
+function stubUpdateNetwork(latest = '0.46.0') {
+    vi.spyOn(globalThis, 'fetch').mockImplementation(async (input) => {
+        const url = String(input);
+        if (url.includes('registry.npmjs.org')) {
+            return new Response(JSON.stringify({
+                'dist-tags': { latest },
+                time: { [latest]: '2026-01-01T00:00:00.000Z' },
+                versions: { [latest]: {} },
+            }), { status: 200, headers: { 'Content-Type': 'application/json' } });
+        }
+        // Any update-server call fails → exercises the npm fallback.
+        return new Response('unavailable', { status: 503 });
+    });
+}
+describe('GET /updates/check', () => {
+    it('requires authentication', async () => {
+        const db = createMockDB(freshState());
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/updates/check'));
+        expect(res.status).toBe(401);
+    });
+    it('returns version info to a non-admin session without GitHub config hints', async () => {
+        stubUpdateNetwork();
+        const { key, record } = await makeKey({ media: true });
+        const db = createMockDB(freshState(), record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/updates/check', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.canManage).toBe(false);
+        expect(body.data.githubRepo).toBeUndefined();
+        expect(body.data).not.toHaveProperty('hasGithubToken');
+        expect(typeof body.data.current).toBe('string');
+    });
+    it('exposes GitHub config hints to admins', async () => {
+        stubUpdateNetwork();
+        const { key, record } = await makeKey({ admin: true });
+        const db = createMockDB(freshState(), record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/updates/check', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.canManage).toBe(true);
+        expect(body.data.hasGithubToken).toBe(false);
+        expect(body.data).toHaveProperty('githubRepo');
+    });
+});
+describe('GET /updates/config', () => {
+    it('rejects unauthenticated requests', async () => {
+        const db = createMockDB(freshState());
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/updates/config'));
+        expect(res.status).toBe(401);
+    });
+    it('rejects non-admin API keys', async () => {
+        const { key, record } = await makeKey({ media: true });
+        const db = createMockDB(freshState(), record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/updates/config', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(403);
+    });
+    it('allows admins (regression: uppercase ADMIN role must pass)', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const db = createMockDB(freshState(), record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/updates/config', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.hasGithubToken).toBe(false);
+        expect(body.data.githubRepo).toBe('');
+    });
+});
+describe('PUT /updates/config', () => {
+    it('rejects non-admin API keys', async () => {
+        const { key, record } = await makeKey({ media: true });
+        const db = createMockDB(freshState(), record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/updates/config', {
+            method: 'PUT',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ githubRepo: 'owner/repo' }),
+        }));
+        expect(res.status).toBe(403);
+    });
+    it('validates the repository format', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const db = createMockDB(freshState(), record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/updates/config', {
+            method: 'PUT',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ githubRepo: 'not a repo' }),
+        }));
+        expect(res.status).toBe(400);
+    });
+    it('encrypts credentials at rest (never persists plaintext)', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const state = freshState();
+        const db = createMockDB(state, record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/updates/config', {
+            method: 'PUT',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ githubToken: 'ghp_secret_token_value', githubRepo: 'owner/repo' }),
+        }));
+        expect(res.status).toBe(200);
+        const persisted = state.upsertArgs?.create?.data ?? {};
+        expect(persisted.githubToken).toBeTruthy();
+        expect(persisted.githubRepo).toBeTruthy();
+        // The raw token/repo must never be stored in plaintext.
+        expect(JSON.stringify(state.upsertArgs)).not.toContain('ghp_secret_token_value');
+        expect(persisted.githubRepo).not.toBe('owner/repo');
+    });
+});
+describe('POST /updates/apply', () => {
+    it('rejects non-admin API keys', async () => {
+        const { key, record } = await makeKey({ media: true });
+        const db = createMockDB(freshState(), record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/updates/apply', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ targetVersion: '1.0.0' }),
+        }));
+        expect(res.status).toBe(403);
+    });
+    it('lets admins through the role gate (then fails on missing GitHub config)', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const db = createMockDB(freshState(), record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/updates/apply', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ targetVersion: '1.0.0' }),
+        }));
+        // Not 403 — the admin passed the role check; it fails later (400) because
+        // no GitHub token/repo is configured in this test environment.
+        expect(res.status).toBe(400);
+        const body = (await res.json());
+        expect(String(body.error)).toMatch(/github/i);
+    });
+    it('rejects an invalid target version', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const db = createMockDB(freshState(), record);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+        const res = await handler(new Request('https://example.com/api/cms/updates/apply', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ targetVersion: 'not-a-version' }),
+        }));
+        expect(res.status).toBe(400);
+    });
+});
+//# sourceMappingURL=updates-routes.test.js.map

package/dist/__tests__/api/updates-routes.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"updates-routes.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/updates-routes.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAExE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAGnE;;;;;;;;;;;;;GAaG;AACH,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AACnC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAsBpC,SAAS,YAAY,CAAC,KAAgB,EAAE,MAAyB;IAC/D,OAAO;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAkC,EAAE,EAAE,CAC9D,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAC5D,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM;SAC3B;QACD,QAAQ,EAAE;YACR,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS;YACtC,MAAM,EAAE,KAAK,EAAE,IAA6B,EAAE,EAAE;gBAC9C,KAAK,CAAC,UAAU,GAAG,IAAI,CAAA;gBACvB,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,CAAA;YAC1B,CAAC;SACF;QACD,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE;QAC9B,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE;QAClD,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;KACzC,CAAA;AACV,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAmB;IACxC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,EAAE,EAAE,UAAU;YACd,OAAO;YACP,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB;KACF,CAAA;AACH,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAC5B,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;IAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,CAAA;IACrC,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,aAAa,CAAA;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAA;IACvC,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;AACxC,CAAC,CAAC,CAAA;AAEF,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,eAAe,EAAE,CAAA;AACtB,CAAC,CAAC,CAAA;AAEF;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAAM,GAAG,QAAQ;IAC1C,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAU,EAAE,EAAE;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QACzB,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,WAAW,EAAE,EAAE,MAAM,EAAE;gBACvB,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE;gBAC9C,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;aAC3B,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAA;QACH,CAAC;QACD,6DAA6D;QAC7D,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAA;QACrC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,2CAA2C,CAAC,CAAC,CAAA;QACnF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,iBAAiB,EAAE,CAAA;QACnB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,2CAA2C,EAAE;YACvD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAA;QACtD,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,iBAAiB,EAAE,CAAA;QACnB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,2CAA2C,EAAE;YACvD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAA;QACrC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,4CAA4C,CAAC,CAAC,CAAA;QACpF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,4CAA4C,EAAE;YACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,4CAA4C,EAAE;YACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,4CAA4C,EAAE;YACxD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;SACnD,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,4CAA4C,EAAE;YACxD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;SACnD,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,4CAA4C,EAAE;YACxD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,wBAAwB,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;SAC1F,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAA;QACtD,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,CAAA;QAC1C,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,CAAA;QACzC,wDAAwD;QACxD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAA;QAChF,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;SACjD,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;SACjD,CAAC,CACH,CAAA;QACD,0EAA0E;QAC1E,+DAA+D;QAC/D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,2CAA2C,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;SACzD,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/upgrade/version-check.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=version-check.test.d.ts.map

package/dist/__tests__/upgrade/version-check.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-check.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/upgrade/version-check.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/upgrade/version-check.test.js

@@ -0,0 +1,98 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { checkForUpdatesViaServer, getUpdateStatus } from '../../upgrade/version-check.js';
+const SERVER = 'https://updates.test.example';
+function serverPayload() {
+    return {
+        latestVersion: '0.46.0',
+        currentVersion: '0.45.0',
+        severity: 'security',
+        changelog: [
+            {
+                version: '0.46.0',
+                date: '2026-01-02',
+                summary: 'Patch a security issue',
+                type: 'security',
+            },
+        ],
+        hasMigrations: true,
+        breakingChanges: ['Removed legacy API'],
+        pluginCompatibility: [
+            { name: '@actuate-media/plugin-seo', compatible: true, minVersion: '0.46.0' },
+        ],
+        updateCommand: 'npm update ...',
+    };
+}
+function npmPayload(latest = '0.46.0') {
+    return {
+        'dist-tags': { latest },
+        time: { [latest]: '2026-01-02T00:00:00.000Z' },
+        versions: { '0.45.0': {}, [latest]: {} },
+    };
+}
+beforeEach(() => {
+    process.env.ACTUATE_UPDATE_SERVER_URL = SERVER;
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+    delete process.env.ACTUATE_UPDATE_SERVER_URL;
+});
+describe('checkForUpdatesViaServer', () => {
+    it('maps a rich server response into VersionInfo', async () => {
+        vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(JSON.stringify(serverPayload()), { status: 200 }));
+        const info = await checkForUpdatesViaServer('0.45.0', SERVER);
+        expect(info).not.toBeNull();
+        expect(info.updateAvailable).toBe(true);
+        expect(info.severity).toBe('security');
+        expect(info.hasMigrations).toBe(true);
+        expect(info.breakingChanges).toEqual(['Removed legacy API']);
+        expect(info.changelog?.[0]?.type).toBe('security');
+        expect(info.source).toBe('update-server');
+    });
+    it('returns null on a non-2xx response (caller falls back)', async () => {
+        vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response('nope', { status: 503 }));
+        expect(await checkForUpdatesViaServer('0.45.0', SERVER)).toBeNull();
+    });
+    it('returns null on a network error', async () => {
+        vi.spyOn(globalThis, 'fetch').mockRejectedValue(new Error('boom'));
+        expect(await checkForUpdatesViaServer('0.45.0', SERVER)).toBeNull();
+    });
+    it('returns null for an unparseable current version', async () => {
+        expect(await checkForUpdatesViaServer('garbage', SERVER)).toBeNull();
+    });
+    it('reports no update when the server says up-to-date', async () => {
+        vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(JSON.stringify({ latestVersion: '0.45.0', currentVersion: '0.45.0', upToDate: true }), {
+            status: 200,
+        }));
+        const info = await checkForUpdatesViaServer('0.45.0', SERVER);
+        expect(info.updateAvailable).toBe(false);
+    });
+});
+describe('getUpdateStatus (hybrid)', () => {
+    it('prefers the update server when available', async () => {
+        vi.spyOn(globalThis, 'fetch').mockImplementation(async (input) => {
+            if (String(input).includes(SERVER)) {
+                return new Response(JSON.stringify(serverPayload()), { status: 200 });
+            }
+            throw new Error('npm should not be called');
+        });
+        const info = await getUpdateStatus('0.45.0');
+        expect(info.source).toBe('update-server');
+        expect(info.severity).toBe('security');
+    });
+    it('falls back to the npm registry when the server fails', async () => {
+        vi.spyOn(globalThis, 'fetch').mockImplementation(async (input) => {
+            const url = String(input);
+            if (url.includes(SERVER))
+                return new Response('down', { status: 502 });
+            if (url.includes('registry.npmjs.org')) {
+                return new Response(JSON.stringify(npmPayload('0.46.0')), { status: 200 });
+            }
+            throw new Error(`unexpected fetch: ${url}`);
+        });
+        const info = await getUpdateStatus('0.45.0');
+        expect(info.source).toBe('npm');
+        expect(info.latest).toBe('0.46.0');
+        expect(info.updateAvailable).toBe(true);
+    });
+});
+//# sourceMappingURL=version-check.test.js.map

package/dist/__tests__/upgrade/version-check.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-check.test.js","sourceRoot":"","sources":["../../../src/__tests__/upgrade/version-check.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAExE,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAE1F,MAAM,MAAM,GAAG,8BAA8B,CAAA;AAE7C,SAAS,aAAa;IACpB,OAAO;QACL,aAAa,EAAE,QAAQ;QACvB,cAAc,EAAE,QAAQ;QACxB,QAAQ,EAAE,UAAmB;QAC7B,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,QAAQ;gBACjB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,wBAAwB;gBACjC,IAAI,EAAE,UAAmB;aAC1B;SACF;QACD,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,CAAC,oBAAoB,CAAC;QACvC,mBAAmB,EAAE;YACnB,EAAE,IAAI,EAAE,2BAA2B,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE;SAC9E;QACD,aAAa,EAAE,gBAAgB;KAChC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAM,GAAG,QAAQ;IACnC,OAAO;QACL,WAAW,EAAE,EAAE,MAAM,EAAE;QACvB,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE;QAC9C,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;KACzC,CAAA;AACH,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,MAAM,CAAA;AAChD,CAAC,CAAC,CAAA;AAEF,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,eAAe,EAAE,CAAA;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAA;AAC9C,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAC/D,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC7D,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;QAC3B,MAAM,CAAC,IAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,MAAM,CAAC,IAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACvC,MAAM,CAAC,IAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,CAAC,IAAK,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAA;QAC7D,MAAM,CAAC,IAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACnD,MAAM,CAAC,IAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACtF,MAAM,CAAC,MAAM,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAClE,MAAM,CAAC,MAAM,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,CAAC,MAAM,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAC7C,IAAI,QAAQ,CACV,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EACrF;YACE,MAAM,EAAE,GAAG;SACZ,CACF,CACF,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC7D,MAAM,CAAC,IAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAU,EAAE,EAAE;YACpE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACvE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACzC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAU,EAAE,EAAE;YACpE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;YACzB,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACtE,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC5E,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA+lC5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAiVD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA8uYzD"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA+lC5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAiVD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAsvYzD"}

package/dist/api/handlers.js

@@ -35,7 +35,7 @@ import { validateSubmissionFiles, FORM_UPLOAD_ALLOWED_MIME_TYPES, DEFAULT_MAX_FI
 import { resolveSubmissionFields } from '../forms/submission.js';
 import { createFormWebhook, listFormWebhooks, updateFormWebhook, deleteFormWebhook, testFormWebhook, FormWebhookError, } from '../forms/webhooks.js';
 import { sendFormNotifications } from '../forms/notify.js';
-import { checkForUpdates } from '../upgrade/version-check.js';
+import { getUpdateStatus } from '../upgrade/version-check.js';
 import { createUpgradePR } from '../upgrade/upgrade-pr.js';
 import { encryptField, decryptField } from '../security/encrypted-fields.js';
 import { encryptSecret, decryptSecret, encryptStringArray, decryptStringArray, } from '../security/secret-storage.js';
@@ -3408,11 +3408,19 @@ export function registerCMSRoutes(router) {
             if (!session)
                 return errorResponse('Unauthorized', 401);
             const coreVersion = getActuateCoreVersion() ?? '0.1.0';
-            const info = await checkForUpdates(coreVersion);
+            const info = await getUpdateStatus(coreVersion);
+            // GitHub integration config is only relevant to (and only exposed to)
+            // admins — the repo name shouldn't leak to non-admin sessions. The
+            // version/changelog payload itself is safe for any authenticated user.
+            const isAdmin = requireAdminScope(session) === null;
+            if (!isAdmin) {
+                return json({ data: { ...info, canManage: false } });
+            }
             const saved = await getUpdateConfig();
             return json({
                 data: {
                     ...info,
+                    canManage: true,
                     hasGithubToken: !!(saved.githubToken || process.env.ACTUATE_GITHUB_TOKEN),
                     githubRepo: saved.githubRepo || process.env.ACTUATE_GITHUB_REPO || '',
                 },
@@ -3425,9 +3433,11 @@ export function registerCMSRoutes(router) {
     router.get('/updates/config', async (request) => {
         try {
             const session = await extractSession(request);
-            if (!session || session.role !== 'admin') {
-                return errorResponse('Unauthorized — admin only', 403);
-            }
+            if (!session)
+                return errorResponse('Unauthorized', 401);
+            const adminErr = requireAdminScope(session);
+            if (adminErr)
+                return adminErr;
             const saved = await getUpdateConfig();
             return json({
                 data: {
@@ -3443,9 +3453,11 @@ export function registerCMSRoutes(router) {
     router.put('/updates/config', async (request) => {
         try {
             const session = await extractSession(request);
-            if (!session || session.role !== 'admin') {
-                return errorResponse('Unauthorized — admin only', 403);
-            }
+            if (!session)
+                return errorResponse('Unauthorized', 401);
+            const adminErr = requireAdminScope(session);
+            if (adminErr)
+                return adminErr;
             const encKey = process.env.CMS_ENCRYPTION_KEY;
             if (!encKey) {
                 return errorResponse('CMS_ENCRYPTION_KEY is required to store encrypted credentials.', 400);
@@ -3489,9 +3501,11 @@ export function registerCMSRoutes(router) {
     router.post('/updates/apply', async (request) => {
         try {
             const session = await extractSession(request);
-            if (!session || session.role !== 'admin') {
-                return errorResponse('Unauthorized — admin only', 403);
-            }
+            if (!session)
+                return errorResponse('Unauthorized', 401);
+            const adminErr = requireAdminScope(session);
+            if (adminErr)
+                return adminErr;
             const body = (await request.json());
             if (!body.targetVersion) {
                 return errorResponse('targetVersion is required', 400);