@brainst0rm/cli 0.14.1 → 0.14.3

package/dist/{dist-4JONNOLT.js → dist-U3G5HT5D.js}

@@ -22,24 +22,24 @@ import {
   scorePatch,
   scoreProbe,
   verifyTypeScriptCompiles
-} from "./chunk-UPP3TOCP.js";
+} from "./chunk-3RH5MKZF.js";
 import {
   exportCapabilityScores,
   getCapabilityScores,
   loadAllCapabilityScores
 } from "./chunk-XD7R5VUD.js";
-import "./chunk-SCGV333Z.js";
+import "./chunk-HKRUCBMI.js";
 import "./chunk-HUR6VPUJ.js";
 import "./chunk-352O4VPK.js";
 import "./chunk-ONBVQCTW.js";
-import "./chunk-RV3CJQGC.js";
+import "./chunk-2AXI2OPK.js";
 import "./chunk-TCFNCUKS.js";
 import "./chunk-5EIUWLBS.js";
 import "./chunk-WJSNOAGF.js";
 import "./chunk-VHDE7O6Y.js";
 import "./chunk-SBZAH54M.js";
 import "./chunk-AMFMFCC4.js";
-import "./chunk-NVA62I52.js";
+import "./chunk-6WGHIUWX.js";
 import "./chunk-QT7UUIL2.js";
 import "./chunk-DW32AG7H.js";
 import "./chunk-NHSYDOEK.js";
@@ -51,7 +51,7 @@ import "./chunk-AP3CWGS7.js";
 import "./chunk-N3KOFRHK.js";
 import "./chunk-RPHOZX72.js";
 import "./chunk-BX6MV3E5.js";
-import "./chunk-TLQVDPEQ.js";
+import "./chunk-DJ7WG6GZ.js";
 import "./chunk-KE4QKEOM.js";
 import "./chunk-FYJECSUZ.js";
 import "./chunk-PLDDJCW6.js";
@@ -83,4 +83,4 @@ export {
   scoreProbe,
   verifyTypeScriptCompiles
 };
-//# sourceMappingURL=dist-4JONNOLT.js.map
+//# sourceMappingURL=dist-U3G5HT5D.js.map

package/dist/{dist-IUVHFJV2.js → dist-UETKBS6A.js}

@@ -21,19 +21,19 @@ import {
   validateGateCommand,
   writeArtifact,
   writeManifest
-} from "./chunk-FGYEICUI.js";
-import "./chunk-SCGV333Z.js";
+} from "./chunk-6UFDBLUX.js";
+import "./chunk-HKRUCBMI.js";
 import "./chunk-HUR6VPUJ.js";
 import "./chunk-352O4VPK.js";
 import "./chunk-ONBVQCTW.js";
 import "./chunk-T5YPKB44.js";
-import "./chunk-RV3CJQGC.js";
+import "./chunk-2AXI2OPK.js";
 import "./chunk-TCFNCUKS.js";
 import "./chunk-5EIUWLBS.js";
 import "./chunk-WJSNOAGF.js";
 import "./chunk-VHDE7O6Y.js";
 import "./chunk-SBZAH54M.js";
-import "./chunk-NVA62I52.js";
+import "./chunk-6WGHIUWX.js";
 import "./chunk-QT7UUIL2.js";
 import "./chunk-DW32AG7H.js";
 import "./chunk-NHSYDOEK.js";
@@ -45,7 +45,7 @@ import "./chunk-AP3CWGS7.js";
 import "./chunk-N3KOFRHK.js";
 import "./chunk-RPHOZX72.js";
 import "./chunk-BX6MV3E5.js";
-import "./chunk-TLQVDPEQ.js";
+import "./chunk-DJ7WG6GZ.js";
 import "./chunk-KE4QKEOM.js";
 import "./chunk-FYJECSUZ.js";
 import "./chunk-PLDDJCW6.js";
@@ -73,4 +73,4 @@ export {
   writeArtifact,
   writeManifest
 };
-//# sourceMappingURL=dist-IUVHFJV2.js.map
+//# sourceMappingURL=dist-UETKBS6A.js.map

package/dist/{dist-ODBEXWTS.js → dist-WLMQD6I5.js}

@@ -9,17 +9,17 @@ import "./chunk-IDXF3KM7.js";
 import "./chunk-DE2JCWS3.js";
 import {
   MemoryManager
-} from "./chunk-SCGV333Z.js";
+} from "./chunk-HKRUCBMI.js";
 import "./chunk-HUR6VPUJ.js";
 import "./chunk-352O4VPK.js";
 import "./chunk-ONBVQCTW.js";
-import "./chunk-RV3CJQGC.js";
+import "./chunk-2AXI2OPK.js";
 import "./chunk-TCFNCUKS.js";
 import "./chunk-5EIUWLBS.js";
 import "./chunk-WJSNOAGF.js";
 import "./chunk-VHDE7O6Y.js";
 import "./chunk-SBZAH54M.js";
-import "./chunk-NVA62I52.js";
+import "./chunk-6WGHIUWX.js";
 import "./chunk-QT7UUIL2.js";
 import "./chunk-DW32AG7H.js";
 import "./chunk-NHSYDOEK.js";
@@ -31,7 +31,7 @@ import "./chunk-AP3CWGS7.js";
 import "./chunk-N3KOFRHK.js";
 import "./chunk-RPHOZX72.js";
 import "./chunk-BX6MV3E5.js";
-import "./chunk-TLQVDPEQ.js";
+import "./chunk-DJ7WG6GZ.js";
 import {
   createLogger
 } from "./chunk-KE4QKEOM.js";
@@ -1838,4 +1838,4 @@ export {
   runStaticAnalysis,
   runVerification
 };
-//# sourceMappingURL=dist-ODBEXWTS.js.map
+//# sourceMappingURL=dist-WLMQD6I5.js.map

package/dist/{dist-GNYSGXLR.js → dist-XFJ337R7.js}

@@ -10,7 +10,7 @@ import {
   retryChangeSet,
   setAuditPersister
 } from "./chunk-DRGJETWE.js";
-import "./chunk-RV3CJQGC.js";
+import "./chunk-2AXI2OPK.js";
 import {
   defineTool
 } from "./chunk-TCFNCUKS.js";
@@ -1162,8 +1162,27 @@ function signEvent(event, masterSecret) {
   return createHmac("sha256", key).update(payload).digest("hex");
 }
 var MAX_EVENT_AGE_SECONDS = 300;
+var seenEventIds = /* @__PURE__ */ new Map();
+var MAX_SEEN_IDS = 1e5;
+var FRESHNESS_MS = MAX_EVENT_AGE_SECONDS * 1e3;
+function checkAndRecordEventId(eventId, now) {
+  const cutoff = now - FRESHNESS_MS;
+  for (const [id, ts] of seenEventIds) {
+    if (ts < cutoff) seenEventIds.delete(id);
+  }
+  if (seenEventIds.has(eventId)) {
+    return false;
+  }
+  if (seenEventIds.size >= MAX_SEEN_IDS) {
+    const oldestKey = seenEventIds.keys().next().value;
+    if (oldestKey !== void 0) seenEventIds.delete(oldestKey);
+  }
+  seenEventIds.set(eventId, now);
+  return true;
+}
 function verifyEvent(event, masterSecret) {
   if (!event.signature) return false;
+  if (!event.id) return false;
   if (!event.timestamp) return false;
   const eventTime = new Date(event.timestamp).getTime();
   if (Number.isNaN(eventTime)) return false;
@@ -1174,7 +1193,8 @@ function verifyEvent(event, masterSecret) {
   const sigBuf = Buffer.from(signature, "hex");
   const expectedBuf = Buffer.from(expected, "hex");
   if (sigBuf.length !== expectedBuf.length) return false;
-  return timingSafeEqual(sigBuf, expectedBuf);
+  if (!timingSafeEqual(sigBuf, expectedBuf)) return false;
+  return checkAndRecordEventId(event.id, Date.now());
 }
 function createSignedEvent(type, tenantId, product, data, masterSecret, opts) {
   const unsigned = {
@@ -1510,4 +1530,4 @@ export {
   verifyJWT,
   verifyProductContract
 };
-//# sourceMappingURL=dist-GNYSGXLR.js.map
+//# sourceMappingURL=dist-XFJ337R7.js.map