@askrjs/cli 0.0.7 → 0.0.9

package/dist/add.js

@@ -226,9 +226,18 @@ function renderServerActionRegistry(actions) {
 		...actions.map((action) => `import { ${action.handlerName} } from './actions/${action.slug}.js';`),
 		"import type { AppDependencies } from './dependencies.js';",
 		"",
+		"function csrfSecret(): string {",
+		"  const secret = process.env.CSRF_SECRET;",
+		"  if (process.env.NODE_ENV !== 'production') return secret ?? 'development-only-secret';",
+		"  if (!secret || secret.length < 32 || new Set(secret).size < 12) {",
+		"    throw new Error('Production requires a strong CSRF_SECRET (at least 32 varied characters).');",
+		"  }",
+		"  return secret;",
+		"}",
+		"",
 		"export function createActions(deps: AppDependencies) {",
 		"  return defineServerActions({ dependencies: deps,",
-		"    csrf: { secret: process.env.CSRF_SECRET ?? 'development-only-secret' },",
+		"    csrf: { secret: csrfSecret() },",
 		"  },",
 		...actions.map((action) => `    handleAction(${action.descriptorName}, ${action.handlerName}),`),
 		"  );",

package/dist/create.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { t as isDirectExecution } from "./is-direct-execution-Cdlr-ZUl.js";
-import { t as installBundledSkills } from "./skills-B7CbWur9.js";
+import { t as installBundledSkills } from "./skills-C2KzfTl9.js";
 import { n as publishStagedDirectory, t as createSiblingStage } from "./directory-swap-DWoHtx7C.js";
 import fs from "node:fs/promises";
 import path from "node:path";

package/dist/{discovery-Djq8TxJu.js → discovery-BX-lnFRK.js}

@@ -1,5 +1,4 @@
-import { t as analyzeRange } from "./range-YUs9eimn.js";
-import { t as parseDependencySpecification } from "./specification-DXnDOC-0.js";
+import { n as analyzeRange, t as parseDependencySpecification } from "./specification-BSlq_n9A.js";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { load } from "js-yaml";

package/dist/generate.js

@@ -1,6 +1,9 @@
-import { mkdir, mkdtemp, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { lookup } from "node:dns/promises";
+import { request } from "node:https";
+import { BlockList, isIP } from "node:net";
 import { load } from "js-yaml";
 //#region src/generate/generator.ts
 const OWNED = [
@@ -119,30 +122,202 @@ function parseOpenApiDocument(contents, source) {
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new GenerationError(`OpenAPI document must be an object: ${source}`);
 	return parsed;
 }
-async function readSource(uri) {
-	if (uri.startsWith("http://") || uri.startsWith("https://")) {
-		const response = await fetch(uri);
-		if (!response.ok) throw new GenerationError(`Unable to fetch OpenAPI reference ${uri}: ${response.status} ${response.statusText}`);
+const blockedAddresses = new BlockList();
+for (const [network, prefix] of [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.0.2.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["198.51.100.0", 24],
+	["203.0.113.0", 24],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4]
+]) blockedAddresses.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+	["::", 128],
+	["::1", 128],
+	["fc00::", 7],
+	["fe80::", 10],
+	["ff00::", 8],
+	["2001:db8::", 32],
+	["2001:2::", 48]
+]) blockedAddresses.addSubnet(network, prefix, "ipv6");
+function privateAddress(address) {
+	const family = isIP(address);
+	if (family === 4) return blockedAddresses.check(address, "ipv4");
+	if (family !== 6) return true;
+	const mappedSuffix = /^::ffff:(.+)$/i.exec(address)?.[1];
+	const mapped = mappedSuffix?.includes(".") ? mappedSuffix : mappedSuffix && /^[0-9a-f]{1,4}:[0-9a-f]{1,4}$/i.test(mappedSuffix) ? mappedSuffix.split(":").flatMap((part) => {
+		const value = Number.parseInt(part, 16);
+		return [value >> 8, value & 255];
+	}).join(".") : void 0;
+	return mapped ? privateAddress(mapped) : blockedAddresses.check(address, "ipv6");
+}
+function remaining(deadline, uri) {
+	const value = deadline - Date.now();
+	if (value <= 0) throw new GenerationError(`Timed out fetching OpenAPI reference ${uri}`);
+	return value;
+}
+async function withDeadline(promise, deadline, uri) {
+	let timer;
+	try {
+		return await Promise.race([promise, new Promise((_, reject) => {
+			timer = setTimeout(() => reject(new GenerationError(`Timed out fetching OpenAPI reference ${uri}`)), remaining(deadline, uri));
+		})]);
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+}
+async function vettedAddresses(url, options, deadline) {
+	const hostname = url.hostname.replace(/^\[|\]$/g, "");
+	const answers = isIP(hostname) ? [{
+		address: hostname,
+		family: isIP(hostname)
+	}] : await withDeadline(lookup(hostname, {
+		all: true,
+		verbatim: true
+	}), deadline, url.href);
+	if (answers.length === 0 || !options.allowPrivateHosts && answers.some(({ address }) => privateAddress(address))) throw new GenerationError(`OpenAPI reference resolves to a private, reserved, or link-local address: ${url.origin}`);
+	return answers.map(({ address, family }) => ({
+		address,
+		family
+	}));
+}
+function retryableConnectionError(error) {
+	if (!(error instanceof Error)) return false;
+	const code = error.code ?? "";
+	return !/^ERR_TLS_|^CERT_|SELF_SIGNED|CERTIFICATE/.test(code) && [
+		"ECONNREFUSED",
+		"ECONNRESET",
+		"EHOSTUNREACH",
+		"ENETUNREACH",
+		"ETIMEDOUT",
+		"EPIPE"
+	].includes(code);
+}
+function requestAddress(url, vetted, deadline) {
+	return new Promise((resolve, reject) => {
+		let receivedHeaders = false;
+		const request$1 = request(url, {
+			method: "GET",
+			headers: {
+				accept: "application/json, application/yaml, text/yaml, */*",
+				"accept-encoding": "identity"
+			},
+			servername: url.hostname,
+			lookup: (_hostname, _options, callback) => callback(null, vetted.address, vetted.family)
+		}, (message) => {
+			receivedHeaders = true;
+			resolve({
+				status: message.statusCode ?? 0,
+				statusText: message.statusMessage ?? "",
+				headers: message.headers,
+				message
+			});
+		});
+		request$1.setTimeout(remaining(deadline, url.href), () => {
+			request$1.destroy(Object.assign(/* @__PURE__ */ new Error("connection timed out"), { code: "ETIMEDOUT" }));
+		});
+		request$1.on("error", (error) => reject(Object.assign(error, { receivedHeaders })));
+		request$1.end();
+	});
+}
+async function requestVetted(url, addresses, deadline) {
+	let lastError;
+	for (const address of addresses) try {
+		return await withDeadline(requestAddress(url, address, deadline), deadline, url.href);
+	} catch (error) {
+		lastError = error;
+		if (!retryableConnectionError(error)) throw error;
+	}
+	throw lastError;
+}
+async function responseText(response, uri, maxBytes, deadline) {
+	const declared = Number(response.headers["content-length"]);
+	if (Number.isFinite(declared) && declared > maxBytes) throw new GenerationError(`OpenAPI reference exceeds ${maxBytes} bytes: ${uri}`);
+	const encoding = response.headers["content-encoding"];
+	if (encoding && encoding !== "identity") throw new GenerationError(`OpenAPI reference returned unsupported content encoding: ${encoding}`);
+	const chunks = [];
+	let size = 0;
+	try {
+		await withDeadline(new Promise((resolve, reject) => {
+			response.message.on("data", (value) => {
+				size += value.byteLength;
+				if (size > maxBytes) {
+					response.message.destroy();
+					reject(new GenerationError(`OpenAPI reference exceeds ${maxBytes} bytes: ${uri}`));
+					return;
+				}
+				chunks.push(value);
+			});
+			response.message.on("end", resolve);
+			response.message.on("error", reject);
+			response.message.on("aborted", () => reject(new GenerationError(`OpenAPI response body was aborted: ${uri}`)));
+		}), deadline, uri);
+	} catch (error) {
+		response.message.destroy();
+		throw error;
+	}
+	if (size > maxBytes) throw new GenerationError(`OpenAPI reference exceeds ${maxBytes} bytes: ${uri}`);
+	return Buffer.concat(chunks).toString("utf8");
+}
+async function fetchSource(uri, options) {
+	let current = new URL(uri);
+	const deadline = Date.now() + options.timeoutMs;
+	for (let redirects = 0;; redirects += 1) {
+		if (current.protocol !== "https:") throw new GenerationError(`Remote OpenAPI references must use HTTPS: ${current.href}`);
+		if (current.username || current.password) throw new GenerationError(`Remote OpenAPI references must not include credentials: ${current.origin}`);
+		if (current.origin !== options.remoteRootOrigin && !options.allowedReferenceOrigins.has(current.origin)) throw new GenerationError(`Cross-origin OpenAPI reference is not allowed: ${current.origin}`);
+		const addresses = await vettedAddresses(current, options, deadline);
+		const response = await requestVetted(current, addresses, deadline);
+		if (response.status >= 300 && response.status < 400) {
+			if (redirects >= options.maxRedirects) throw new GenerationError(`Too many redirects while fetching OpenAPI reference ${uri}`);
+			response.message.resume();
+			const location = response.headers.location;
+			if (!location) throw new GenerationError(`OpenAPI redirect is missing Location: ${current.href}`);
+			current = new URL(location, current);
+			continue;
+		}
+		if (response.status < 200 || response.status >= 300) {
+			response.message.resume();
+			throw new GenerationError(`Unable to fetch OpenAPI reference ${current.href}: ${response.status} ${response.statusText}`);
+		}
 		return {
-			uri,
-			document: parseOpenApiDocument(await response.text(), uri)
+			uri: current.href,
+			document: parseOpenApiDocument(await responseText(response, current.href, options.maxBytes, deadline), current.href)
 		};
 	}
+}
+async function readSource(uri, options) {
+	if (uri.startsWith("http://") || uri.startsWith("https://")) return fetchSource(uri, options);
 	const path = fileURLToPath(uri);
+	const canonical = await realpath(path);
+	const relativePath = options.localRootDirectory ? relative(options.localRootDirectory, canonical) : "..";
+	if (!options.localRootDirectory || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) throw new GenerationError(`Local OpenAPI reference escapes the specification directory: ${path}`);
+	const contents = await readFile(canonical);
+	if (contents.byteLength > options.maxBytes) throw new GenerationError(`OpenAPI reference exceeds ${options.maxBytes} bytes: ${path}`);
 	return {
-		uri,
-		document: parseOpenApiDocument(await readFile(path, "utf8"), path)
+		uri: pathToFileURL(canonical).href,
+		document: parseOpenApiDocument(contents.toString("utf8"), canonical)
 	};
 }
 var OpenApiBundler = class {
 	root;
 	rootUri;
+	options;
 	sources = /* @__PURE__ */ new Map();
 	aliases = /* @__PURE__ */ new Map();
 	names = /* @__PURE__ */ new Map();
-	constructor(root, rootUri) {
+	constructor(root, rootUri, options) {
 		this.root = root;
 		this.rootUri = rootUri;
+		this.options = options;
 	}
 	async bundle() {
 		if (!this.root.components) this.root.components = {};
@@ -153,7 +328,7 @@ var OpenApiBundler = class {
 	async source(uri) {
 		let pending = this.sources.get(uri);
 		if (!pending) {
-			pending = readSource(uri);
+			pending = readSource(uri, this.options);
 			this.sources.set(uri, pending);
 		}
 		return pending;
@@ -175,6 +350,7 @@ var OpenApiBundler = class {
 		for (const [key, child] of Object.entries(value)) value[key] = await this.expand(child, uri, document, stack);
 	}
 	async expand(value, uri, document, stack) {
+		if (stack.size > this.options.maxDepth) throw new GenerationError(`OpenAPI reference depth exceeds ${this.options.maxDepth}`);
 		if (Array.isArray(value)) return Promise.all(value.map((item) => this.expand(item, uri, document, stack)));
 		if (!value || typeof value !== "object") return value;
 		const object = value;
@@ -215,9 +391,36 @@ var OpenApiBundler = class {
 		return this.expand(target, targetSource.uri, targetSource.document, new Set(stack).add(canonical));
 	}
 };
-async function loadOpenApi(input) {
-	const source = await readSource(/^https?:\/\//.test(input) ? input : pathToFileURL(resolve(input)).href);
-	return new OpenApiBundler(source.document, source.uri).bundle();
+async function loadOpenApi(input, options = {}) {
+	const remote = /^https?:\/\//.test(input);
+	const localPath = remote ? void 0 : await realpath(resolve(input));
+	const uri = remote ? new URL(input).href : pathToFileURL(localPath).href;
+	const rootUrl = new URL(uri);
+	if (remote && rootUrl.protocol !== "https:") throw new GenerationError("Remote OpenAPI roots must use HTTPS.");
+	const positiveOption = (name, value) => {
+		if (!Number.isSafeInteger(value) || value <= 0) throw new GenerationError(`${name} must be a positive safe integer.`);
+		return value;
+	};
+	const resolved = {
+		allowedReferenceOrigins: new Set((options.allowedReferenceOrigins ?? []).map((origin) => {
+			let parsed;
+			try {
+				parsed = new URL(origin);
+			} catch {
+				throw new GenerationError(`Allowed reference origin must be an HTTPS origin: ${origin}`);
+			}
+			if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.href !== parsed.origin + "/") throw new GenerationError(`Allowed reference origin must be an HTTPS origin: ${origin}`);
+			return parsed.origin;
+		})),
+		allowPrivateHosts: options.allowPrivateHosts ?? false,
+		maxBytes: positiveOption("maxBytes", options.maxBytes ?? 5 * 1024 * 1024),
+		maxDepth: positiveOption("maxDepth", options.maxDepth ?? 32),
+		maxRedirects: positiveOption("maxRedirects", options.maxRedirects ?? 5),
+		timeoutMs: positiveOption("timeoutMs", options.timeoutMs ?? 1e4),
+		...remote ? { remoteRootOrigin: rootUrl.origin } : { localRootDirectory: await realpath(dirname(localPath)) }
+	};
+	const source = await readSource(uri, resolved);
+	return new OpenApiBundler(source.document, source.uri, resolved).bundle();
 }
 function generateFiles(document) {
 	const version = String(document.openapi ?? "");
@@ -392,13 +595,13 @@ async function writeGenerated(directory, files, check) {
 		});
 	}
 }
-async function generate(input, output, check = false) {
+async function generate(input, output, check = false, loadOptions = {}) {
 	if (!/^https?:\/\//.test(input)) {
 		const resolvedInput = resolve(input);
 		const inputWithinOutput = relative(resolve(output), resolvedInput);
 		if (!inputWithinOutput.startsWith("..") && !isAbsolute(inputWithinOutput)) throw new GenerationError("Generated output must not contain its OpenAPI input document");
 	}
-	const files = generateFiles(await loadOpenApi(input));
+	const files = generateFiles(await loadOpenApi(input, loadOptions));
 	await mkdir(dirname(resolve(output)), { recursive: true });
 	await writeGenerated(output, files, check);
 }
@@ -410,13 +613,65 @@ async function runGenerateCli(args, io = console) {
 	let check = false;
 	let json = false;
 	let help = false;
+	const allowedReferenceOrigins = [];
+	const referenceLimits = {};
 	const inputs = [];
 	for (let i = 0; i < args.length; i++) {
 		const arg = args[i];
 		if (arg === "--check") check = true;
 		else if (arg === "--json") json = true;
 		else if (arg === "--help" || arg === "-h") help = true;
-		else if (arg === "-o" || arg === "--output") {
+		else if (arg === "--allow-ref-origin") {
+			const value = args[i + 1];
+			if (!value || value.startsWith("-")) {
+				const message = `${arg} requires an HTTPS origin`;
+				io.error(wantsJson ? JSON.stringify({
+					status: "error",
+					error: message
+				}) : message);
+				return 1;
+			}
+			allowedReferenceOrigins.push(value);
+			i += 1;
+		} else if (arg.startsWith("--allow-ref-origin=")) allowedReferenceOrigins.push(arg.slice(19));
+		else if (arg === "--ref-timeout-ms" || arg === "--ref-max-bytes" || arg === "--ref-max-depth" || arg === "--ref-max-redirects") {
+			const value = args[i + 1];
+			const parsed = Number(value);
+			if (!value || value.startsWith("-") || !Number.isSafeInteger(parsed) || parsed <= 0) {
+				const message = `${arg} requires a positive safe integer`;
+				io.error(wantsJson ? JSON.stringify({
+					status: "error",
+					error: message
+				}) : message);
+				return 1;
+			}
+			const key = {
+				"--ref-timeout-ms": "timeoutMs",
+				"--ref-max-bytes": "maxBytes",
+				"--ref-max-depth": "maxDepth",
+				"--ref-max-redirects": "maxRedirects"
+			}[arg];
+			referenceLimits[key] = parsed;
+			i += 1;
+		} else if (/^--ref-(?:timeout-ms|max-bytes|max-depth|max-redirects)=/.test(arg)) {
+			const [flag, value = ""] = arg.split("=", 2);
+			const parsed = Number(value);
+			if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+				const message = `${flag} requires a positive safe integer`;
+				io.error(wantsJson ? JSON.stringify({
+					status: "error",
+					error: message
+				}) : message);
+				return 1;
+			}
+			const key = {
+				"--ref-timeout-ms": "timeoutMs",
+				"--ref-max-bytes": "maxBytes",
+				"--ref-max-depth": "maxDepth",
+				"--ref-max-redirects": "maxRedirects"
+			}[flag];
+			referenceLimits[key] = parsed;
+		} else if (arg === "-o" || arg === "--output") {
 			const value = args[i + 1];
 			if (!value || value.startsWith("-")) {
 				const message = `${arg} requires a path`;
@@ -438,7 +693,7 @@ async function runGenerateCli(args, io = console) {
 			return 1;
 		} else inputs.push(arg);
 	}
-	const usage = "Usage: askr generate <input> -o <output-directory> [--check] [--json]";
+	const usage = "Usage: askr generate <input> -o <output-directory> [--check] [--json] [--allow-ref-origin <https-origin>] [--ref-timeout-ms <n>] [--ref-max-bytes <n>] [--ref-max-depth <n>] [--ref-max-redirects <n>]";
 	if (help) {
 		io.log(usage);
 		return 0;
@@ -451,7 +706,10 @@ async function runGenerateCli(args, io = console) {
 		return 1;
 	}
 	try {
-		await generate(inputs[0], output, check);
+		await generate(inputs[0], output, check, {
+			allowedReferenceOrigins,
+			...referenceLimits
+		});
 		io.log(json ? JSON.stringify({
 			status: "ok",
 			action: check ? "checked" : "generated",

package/dist/{planner-ZAX9SFjY.js → planner-BDfYDKnI.js}

@@ -1,5 +1,4 @@
-import { n as isBreakingChange, r as rewriteRange, t as analyzeRange } from "./range-YUs9eimn.js";
-import { t as parseDependencySpecification } from "./specification-DXnDOC-0.js";
+import { i as rewriteRange, n as analyzeRange, r as isBreakingChange, t as parseDependencySpecification } from "./specification-BSlq_n9A.js";
 import semver from "semver";
 //#region src/update/planner.ts
 const STATUS_PRIORITY = {
@@ -123,12 +122,13 @@ function planOne(occurrence, packument, failure, tag, mode, chosen, blocker) {
 			reason: blocker
 		}
 	};
-	if (semver.satisfies(selected, occurrence.currentSpecification) || !semver.gt(selected, allowed)) return {
+	const declared = semver.minVersion(occurrence.currentSpecification)?.version ?? allowed;
+	if (!semver.gt(selected, declared)) return {
 		targetVersion: target,
 		occurrence: {
 			...withVersions,
 			status: "current",
-			reason: blocker ?? "selected version is already covered by the current specification"
+			reason: blocker ?? "the declared version is current"
 		}
 	};
 	const analysis = analyzeRange(occurrence.currentSpecification);
@@ -149,11 +149,20 @@ function planOne(occurrence, packument, failure, tag, mode, chosen, blocker) {
 			reason: "breaking update is available via askr upgrade"
 		}
 	};
+	const proposedSpecification = rewriteRange(analysis.shape, selected, breaking);
+	if (proposedSpecification === occurrence.currentSpecification) return {
+		targetVersion: target,
+		occurrence: {
+			...withVersions,
+			status: "current",
+			reason: "the selected version cannot further rebase this range style"
+		}
+	};
 	return {
 		targetVersion: target,
 		occurrence: {
 			...withVersions,
-			proposedSpecification: rewriteRange(analysis.shape, selected, breaking),
+			proposedSpecification,
 			status: breaking ? "breaking" : "safe",
 			reason: selected === target ? "selected tag target is eligible" : `compatible version ${selected} selected below ${tag}@${target}`
 		}
@@ -185,10 +194,8 @@ function solveWorkspace(workspace, selectedOccurrences, context, packuments, tag
 	}
 	const variables = [...states.entries()].filter(([, state]) => state.selected && state.candidates.length > 0).sort(([a], [b]) => a.localeCompare(b));
 	const fixed = new Map([...states].flatMap(([name, state]) => state.selected ? [] : state.current ? [[name, state.current]] : []));
-	let best = null;
-	let bestChanged = -1;
-	let firstFailure = "no jointly peer-compatible published version set exists";
-	const validate = (choices) => {
+	const currentChoices = new Map(variables.flatMap(([name, state]) => state.current ? [[name, state.current]] : []));
+	const validate = (choices, domains) => {
 		const installed = new Map([...fixed, ...choices]);
 		for (const [name, version] of installed) {
 			const packument = packuments.get(name);
@@ -198,10 +205,12 @@ function solveWorkspace(workspace, selectedOccurrences, context, packuments, tag
 			for (const [peer, requirement] of Object.entries(meta.peerDependencies ?? {}).sort(([a], [b]) => a.localeCompare(b))) {
 				if (typeof requirement !== "string") continue;
 				const providerChanged = states.get(name)?.current !== version;
-				const peerChanged = states.get(peer)?.selected && states.get(peer)?.current !== installed.get(peer);
+				const assignedPeer = choices.get(peer);
+				const peerChanged = assignedPeer !== void 0 && states.get(peer)?.current !== assignedPeer;
 				if (!providerChanged && !peerChanged) continue;
-				const peerVersion = installed.get(peer) ?? localVersions.get(peer);
+				const peerVersion = assignedPeer ?? (states.get(peer)?.selected ? void 0 : installed.get(peer));
 				if (!peerVersion) {
+					if ((domains?.get(peer))?.some((candidate) => semver.satisfies(candidate, requirement, { includePrerelease: true }))) continue;
 					if (optionalPeer(meta, peer)) continue;
 					return `${name}@${version} requires missing peer ${peer}@${requirement}`;
 				}
@@ -210,31 +219,103 @@ function solveWorkspace(workspace, selectedOccurrences, context, packuments, tag
 		}
 		return null;
 	};
-	const visit = (index, choices) => {
-		if (index === variables.length) {
-			const failure = validate(choices);
+	const edges = new Map(variables.map(([name]) => [name, /* @__PURE__ */ new Set()]));
+	for (const [name, state] of variables) for (const version of state.candidates) {
+		const peers = metadata(packuments.get(name), version)?.peerDependencies ?? {};
+		for (const peer of Object.keys(peers)) {
+			if (!edges.has(peer)) continue;
+			edges.get(name).add(peer);
+			edges.get(peer).add(name);
+		}
+	}
+	const components = [];
+	const unseen = new Set(edges.keys());
+	while (unseen.size > 0) {
+		const start = [...unseen].sort()[0];
+		const component = [];
+		const pending = [start];
+		unseen.delete(start);
+		while (pending.length > 0) {
+			const name = pending.pop();
+			component.push(name);
+			for (const neighbor of [...edges.get(name)].sort().reverse()) {
+				if (!unseen.delete(neighbor)) continue;
+				pending.push(neighbor);
+			}
+		}
+		components.push(component.sort());
+	}
+	const choices = new Map(currentChoices);
+	const blockers = /* @__PURE__ */ new Map();
+	for (const component of components) {
+		const componentSet = new Set(component);
+		const baseChoices = new Map([...choices].filter(([name]) => !componentSet.has(name)));
+		const domains = new Map(component.map((name) => [name, states.get(name).candidates]));
+		let best = null;
+		let bestChanged = -1;
+		let bestVector = [];
+		let statesVisited = 0;
+		let exhausted = false;
+		let firstFailure = "no jointly peer-compatible published version set exists";
+		const memo = /* @__PURE__ */ new Set();
+		const visit = (assigned) => {
+			if (exhausted) return;
+			statesVisited += 1;
+			if (statesVisited > 5e4) {
+				exhausted = true;
+				return;
+			}
+			const merged = new Map([...baseChoices, ...assigned]);
+			const remaining = component.filter((name) => !assigned.has(name));
+			const changed = component.filter((name) => assigned.has(name) && assigned.get(name) !== states.get(name).current).length;
+			if (changed + remaining.length < bestChanged) return;
+			const pruned = /* @__PURE__ */ new Map();
+			for (const name of remaining) {
+				const viable = domains.get(name).filter((version) => validate(new Map([...merged, [name, version]]), domains) === null);
+				if (viable.length === 0) {
+					firstFailure = validate(merged, domains) ?? firstFailure;
+					return;
+				}
+				pruned.set(name, viable);
+			}
+			const failure = validate(merged, new Map([...domains, ...pruned]));
 			if (failure) {
 				firstFailure = failure;
 				return;
 			}
-			const changed = variables.filter(([name, state]) => choices.get(name) !== state.current).length;
-			if (changed > bestChanged) {
-				best = new Map(choices);
-				bestChanged = changed;
+			if (remaining.length === 0) {
+				const vector = component.map((name) => states.get(name).candidates.indexOf(assigned.get(name)));
+				const newer = vector.some((value, index) => value < (bestVector[index] ?? Number.POSITIVE_INFINITY) && vector.slice(0, index).every((prior, priorIndex) => prior === bestVector[priorIndex]));
+				if (changed > bestChanged || changed === bestChanged && newer) {
+					best = new Map(assigned);
+					bestChanged = changed;
+					bestVector = vector;
+				}
+				return;
 			}
-			return;
-		}
-		const [name, state] = variables[index];
-		for (const version of state.candidates) {
-			choices.set(name, version);
-			visit(index + 1, choices);
-		}
-	};
-	visit(0, /* @__PURE__ */ new Map());
-	const blockers = /* @__PURE__ */ new Map();
-	if (!best) for (const [name] of variables) blockers.set(name, firstFailure);
-	const choices = best ?? new Map(variables.flatMap(([name, state]) => state.current ? [[name, state.current]] : []));
+			const next = remaining.map((name) => [name, pruned.get(name)]).sort(([leftName, left], [rightName, right]) => left.length - right.length || leftName.localeCompare(rightName))[0];
+			const signature = component.map((name) => {
+				const assignedVersion = assigned.get(name);
+				if (assignedVersion !== void 0) return `${name}=assigned:${assignedVersion}`;
+				return `${name}=domain:${(pruned.get(name) ?? []).join(",")}`;
+			}).join("|");
+			if (memo.has(signature)) return;
+			memo.add(signature);
+			for (const version of next[1]) {
+				assigned.set(next[0], version);
+				visit(assigned);
+				assigned.delete(next[0]);
+			}
+		};
+		visit(/* @__PURE__ */ new Map());
+		if (exhausted) {
+			const reason = "peer compatibility search exceeded the 50,000-state budget; resolve this component manually";
+			for (const name of component) blockers.set(name, reason);
+		} else if (!best) for (const name of component) blockers.set(name, firstFailure);
+		else for (const [name, version] of best) choices.set(name, version);
+	}
 	for (const [name, state] of variables) {
+		if (blockers.has(name)) continue;
 		if (choices.get(name) !== state.current || state.candidates[0] === state.current) continue;
 		const attempted = new Map(choices).set(name, state.candidates[0]);
 		blockers.set(name, validate(attempted) ?? "no jointly peer-compatible update advances this dependency");
@@ -271,7 +352,7 @@ function summarize(decisions) {
 function planUpdates(options) {
 	const failures = options.failures ?? /* @__PURE__ */ new Map();
 	const tags = options.tags ?? {};
-	const mode = options.mode ?? (options.force ? "upgrade" : "update");
+	const mode = options.mode ?? "update";
 	const context = options.contextOccurrences ?? options.occurrences;
 	const workspaceSolutions = /* @__PURE__ */ new Map();
 	if (mode !== "force") for (const workspace of new Set(options.occurrences.map((entry) => entry.workspace))) workspaceSolutions.set(workspace, solveWorkspace(workspace, options.occurrences.filter((entry) => entry.workspace === workspace), context, options.packuments, tags, options.cliTag, options.localVersions ?? /* @__PURE__ */ new Map(), mode));