@cogenta/cli 0.3.0 → 0.6.0

package/dist/update/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/update/index.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAEvD,OAAO,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAE5F,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAEjF,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAE7D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAErE,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,YAAY,GACb,MAAM,sBAAsB,CAAA"}

package/dist/update/list-restore-points.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The restore-point half of "historique des mises à jour et des points de
+ * restauration" (L22 task 9, point 5) — exactly `cogenta backup list`'s own
+ * directory scan (`.cogenta/backups`), reused rather than re-implemented,
+ * with one addition: `triggeredByUpdate` is read straight off the filename
+ * prefix `restore-point.ts` writes (`update-…zip` vs. `backup-…zip`), so the
+ * admin's history view can show *which* restore points exist because an
+ * update took them automatically, without a second manifest field.
+ */
+export interface RestorePointSummary {
+    readonly path: string;
+    readonly createdAt: string;
+    readonly rows: number;
+    readonly tables: number;
+    readonly checksum: string;
+    readonly encrypted: boolean;
+    readonly triggeredByUpdate: boolean;
+}
+export declare function listRestorePoints(dir: string): Promise<readonly RestorePointSummary[]>;
+//# sourceMappingURL=list-restore-points.d.ts.map

package/dist/update/list-restore-points.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-restore-points.d.ts","sourceRoot":"","sources":["../../src/update/list-restore-points.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AAEH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;CACpC;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CA6B5F"}

package/dist/update/list-restore-points.js

@@ -0,0 +1,35 @@
+import { readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { readBackupManifest } from '@cogenta/export';
+export async function listRestorePoints(dir) {
+    let files;
+    try {
+        files = (await readdir(dir)).filter((name) => name.endsWith('.zip'));
+    }
+    catch {
+        // No backup directory yet — nothing has ever been backed up.
+        return [];
+    }
+    const summaries = [];
+    for (const file of files) {
+        try {
+            const manifest = await readBackupManifest(join(dir, file));
+            summaries.push({
+                path: join(dir, file),
+                createdAt: manifest.createdAt,
+                rows: manifest.tables.reduce((sum, table) => sum + table.rows, 0),
+                tables: manifest.tables.length,
+                checksum: manifest.checksum,
+                encrypted: manifest.encrypted,
+                triggeredByUpdate: file.startsWith('update-'),
+            });
+        }
+        catch {
+            // A manifest that fails to read (corrupted, mid-write) is skipped
+            // rather than crashing the whole history view — `cogenta backup list`
+            // makes the same choice for the same reason.
+        }
+    }
+    return summaries.sort((a, b) => (a.createdAt < b.createdAt ? 1 : -1));
+}
+//# sourceMappingURL=list-restore-points.js.map

package/dist/update/list-restore-points.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-restore-points.js","sourceRoot":"","sources":["../../src/update/list-restore-points.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAsBpD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAW;IACjD,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,SAAS,GAA0B,EAAE,CAAA;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;YAC1D,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;gBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACjE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;aAC9C,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,sEAAsE;YACtE,6CAA6C;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACvE,CAAC"}

package/dist/update/npm-registry.d.ts

@@ -0,0 +1,11 @@
+export interface NpmPackageSummary {
+    readonly name: string;
+    /** `dist-tags.latest` — the version `npm install <name>` would resolve to today. */
+    readonly latest: string;
+    /** Every version the registry lists, in whatever order it returned them (usually publish order). */
+    readonly versions: readonly string[];
+    /** `dist.tarball` per version — only present for a version this response actually described. */
+    readonly tarballUrl: Readonly<Record<string, string>>;
+}
+export declare function fetchNpmPackageSummary(packageName: string, fetchImpl?: typeof fetch): Promise<NpmPackageSummary>;
+//# sourceMappingURL=npm-registry.d.ts.map

package/dist/update/npm-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-registry.d.ts","sourceRoot":"","sources":["../../src/update/npm-registry.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,gGAAgG;IAChG,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACtD;AAoBD,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CA0C5B"}

package/dist/update/npm-registry.js

@@ -0,0 +1,74 @@
+import { CogentaError } from '@cogenta/core';
+/**
+ * The one piece of real network access `cogenta update` needs: "what is the
+ * newest published version of this package, and where is its tarball" — the
+ * npm registry's own abbreviated packument
+ * (`Accept: application/vnd.npm.install-v1+json`), which is a small fraction
+ * of the full packument (no per-version readme, no full dependency graph)
+ * but still carries `dist-tags.latest` and, per version, `dist.tarball` —
+ * exactly what `contract-risk.ts` needs to fetch one tarball and read its
+ * `CHANGELOG.md`.
+ *
+ * `registry.npmjs.org` only — never a CDN mirror (unpkg, jsdelivr…), which
+ * would be a second external host this optional feature depends on for no
+ * real gain. Every caller degrades to "could not check" on failure (R1's
+ * spirit: checking for an update is optional infrastructure, never something
+ * the rest of the CMS needs to run).
+ */
+const REGISTRY_BASE = 'https://registry.npmjs.org';
+const FETCH_TIMEOUT_MS = 10_000;
+function registryUrl(packageName) {
+    // A scoped name (`@cogenta/core`) needs the whole name percent-encoded as
+    // one segment — `encodeURIComponent` turns `/` into `%2F`, which is what
+    // the registry expects for a scoped package's single-segment route.
+    return `${REGISTRY_BASE}/${encodeURIComponent(packageName)}`;
+}
+function checkFailed(packageName, reason, cause) {
+    const npmPage = `https://www.npmjs.com/package/${packageName}`;
+    return new CogentaError({
+        code: 'UPDATE_CHECK_FAILED',
+        message: `Could not check npm for the latest version of "${packageName}": ${reason}`,
+        hint: `This needs outbound network access to registry.npmjs.org. Everything else in this admin works without it (R1) — try again later, or check manually at ${npmPage}.`,
+        cause,
+        details: { packageName },
+    });
+}
+export async function fetchNpmPackageSummary(packageName, fetchImpl = fetch) {
+    let response;
+    try {
+        response = await fetchImpl(registryUrl(packageName), {
+            headers: { accept: 'application/vnd.npm.install-v1+json' },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        throw checkFailed(packageName, 'the request failed', error);
+    }
+    if (response.status === 404) {
+        throw checkFailed(packageName, 'npm has no package by this name');
+    }
+    if (!response.ok) {
+        throw checkFailed(packageName, `npm responded with HTTP ${response.status}`);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch (error) {
+        throw checkFailed(packageName, 'the response was not valid JSON', error);
+    }
+    const record = body;
+    const latest = record['dist-tags']?.latest;
+    if (typeof latest !== 'string' || latest === '') {
+        throw checkFailed(packageName, 'the response carried no "dist-tags.latest"');
+    }
+    const versions = record.versions ?? {};
+    const tarballUrl = {};
+    for (const [version, meta] of Object.entries(versions)) {
+        const tarball = meta.dist?.tarball;
+        if (typeof tarball === 'string' && tarball !== '')
+            tarballUrl[version] = tarball;
+    }
+    return { name: packageName, latest, versions: Object.keys(versions), tarballUrl };
+}
+//# sourceMappingURL=npm-registry.js.map

package/dist/update/npm-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-registry.js","sourceRoot":"","sources":["../../src/update/npm-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,aAAa,GAAG,4BAA4B,CAAA;AAClD,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAY/B,SAAS,WAAW,CAAC,WAAmB;IACtC,0EAA0E;IAC1E,yEAAyE;IACzE,oEAAoE;IACpE,OAAO,GAAG,aAAa,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAA;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,MAAc,EAAE,KAAe;IACvE,MAAM,OAAO,GAAG,iCAAiC,WAAW,EAAE,CAAA;IAC9D,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,kDAAkD,WAAW,MAAM,MAAM,EAAE;QACpF,IAAI,EAAE,yJAAyJ,OAAO,GAAG;QACzK,KAAK;QACL,OAAO,EAAE,EAAE,WAAW,EAAE;KACzB,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,SAAS,GAAiB,KAAK;IAE/B,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE;YACnD,OAAO,EAAE,EAAE,MAAM,EAAE,qCAAqC,EAAE;YAC1D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,WAAW,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,WAAW,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,WAAW,CAAC,WAAW,EAAE,2BAA2B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,WAAW,EAAE,iCAAiC,EAAE,KAAK,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,MAAM,GAAG,IAGd,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,WAAW,CAAC,WAAW,EAAE,4CAA4C,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;IACtC,MAAM,UAAU,GAA2B,EAAE,CAAA;IAC7C,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAA;QAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;YAAE,UAAU,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAClF,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAA;AACnF,CAAC"}

package/dist/update/restore-point.d.ts

@@ -0,0 +1,26 @@
+import { type Logger } from '@cogenta/core';
+/**
+ * "Un point de restauration obligatoire avant toute mise à jour" (L22 task
+ * 9, point 2) — this is the *entire* implementation: one call into
+ * `createSiteBackup`, the exact function `cogenta backup create` itself
+ * calls, tagged with the `update-` filename prefix so it shows up
+ * identifiably in `cogenta backup list` and in the admin's own history view
+ * without a second backup format or a second directory. Never a smaller,
+ * update-specific backup — a restore point has to be able to put the whole
+ * site back, and `createSiteBackup` already is that.
+ */
+export interface CreateUpdateRestorePointOptions {
+    readonly cwd?: string;
+    readonly env?: Record<string, string | undefined>;
+    readonly logger?: Logger;
+    readonly dir?: string;
+}
+export interface UpdateRestorePoint {
+    readonly path: string;
+    readonly createdAt: string;
+    readonly tableCount: number;
+    readonly rowCount: number;
+    readonly checksum: string;
+}
+export declare function createUpdateRestorePoint(options: CreateUpdateRestorePointOptions): Promise<UpdateRestorePoint>;
+//# sourceMappingURL=restore-point.d.ts.map

package/dist/update/restore-point.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore-point.d.ts","sourceRoot":"","sources":["../../src/update/restore-point.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,eAAe,CAAA;AAGzD;;;;;;;;;GASG;AAEH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,kBAAkB,CAAC,CAkB7B"}

package/dist/update/restore-point.js

@@ -0,0 +1,23 @@
+import { CogentaError } from '@cogenta/core';
+import { createSiteBackup } from '../commands/backup.js';
+export async function createUpdateRestorePoint(options) {
+    try {
+        const { path, manifest } = await createSiteBackup({ ...options, filenamePrefix: 'update-' });
+        return {
+            path,
+            createdAt: manifest.createdAt,
+            tableCount: manifest.tables.length,
+            rowCount: manifest.tables.reduce((sum, table) => sum + table.rows, 0),
+            checksum: manifest.checksum,
+        };
+    }
+    catch (error) {
+        throw new CogentaError({
+            code: 'UPDATE_RESTORE_POINT_FAILED',
+            message: 'Could not create a restore point before the update — nothing was changed.',
+            hint: 'This update was refused rather than applied without a safety net. Check the underlying error, free up disk space if that is the cause, and try again.',
+            cause: error,
+        });
+    }
+}
+//# sourceMappingURL=restore-point.js.map

package/dist/update/restore-point.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore-point.js","sourceRoot":"","sources":["../../src/update/restore-point.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,eAAe,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AA4BxD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAwC;IAExC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAA;QAC5F,OAAO;YACL,IAAI;YACJ,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;YAClC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,2EAA2E;YACpF,IAAI,EAAE,uJAAuJ;YAC7J,KAAK,EAAE,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/update/tar.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A minimal, read-only ustar/pax reader — just enough to pull one small,
+ * short-named text file (`package/CHANGELOG.md`) out of an npm tarball,
+ * fetched straight from `registry.npmjs.org`'s own `dist.tarball` URL.
+ *
+ * No `tar` dependency (R9): npm tarballs are always ustar/pax, and the one
+ * thing this needs from that format — "walk 512-byte header blocks, read a
+ * file's name/size, skip to the next block" — is a couple dozen lines.
+ * `readTarEntries` is deliberately **not** a general-purpose extractor: it
+ * does not honour a pax extended header's own `path`/`size` overrides (typeflag
+ * `x`), it only skips past them by their own declared size and reads the
+ * *following* ustar header's `name`/`size` fields directly. That is exactly
+ * enough for a path like `package/CHANGELOG.md` — well under the 100-byte
+ * ustar name field, so no pax override is ever needed to represent it — and
+ * deliberately not extended further than that real, verified need.
+ */
+export interface TarEntry {
+    readonly name: string;
+    readonly content: Buffer;
+}
+/** Parses an already-decompressed tar archive. */
+export declare function readTarEntries(tar: Buffer): readonly TarEntry[];
+/** Gunzips, then parses — the shape an npm registry `dist.tarball` download actually arrives in. */
+export declare function readTarGz(gzipped: Buffer): readonly TarEntry[];
+/** `package/<relativePath>` — every npm tarball's own file entries are rooted at `package/`. */
+export declare function findPackageFile(entries: readonly TarEntry[], relativePath: string): Buffer | null;
+//# sourceMappingURL=tar.d.ts.map

package/dist/update/tar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.d.ts","sourceRoot":"","sources":["../../src/update/tar.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAyBD,kDAAkD;AAClD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,QAAQ,EAAE,CA4B/D;AAED,oGAAoG;AACpG,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,QAAQ,EAAE,CAE9D;AAED,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIjG"}

package/dist/update/tar.js

@@ -0,0 +1,56 @@
+import { gunzipSync } from 'node:zlib';
+const BLOCK_SIZE = 512;
+/** Type flags this reader treats as "a real file to read", per the ustar spec. `'0'` and `'\0'` both mean "regular file". */
+const REGULAR_FILE_TYPEFLAGS = new Set(['0', '\0']);
+function readNullPaddedField(header, offset, length) {
+    const raw = header.subarray(offset, offset + length);
+    const nul = raw.indexOf(0);
+    const trimmed = (nul === -1 ? raw : raw.subarray(0, nul)).toString('utf8');
+    return trimmed.trim();
+}
+function readOctalSize(header, offset, length) {
+    const raw = readNullPaddedField(header, offset, length);
+    if (raw === '')
+        return 0;
+    const parsed = Number.parseInt(raw, 8);
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+function roundUpToBlock(size) {
+    return Math.ceil(size / BLOCK_SIZE) * BLOCK_SIZE;
+}
+/** Parses an already-decompressed tar archive. */
+export function readTarEntries(tar) {
+    const entries = [];
+    let offset = 0;
+    while (offset + BLOCK_SIZE <= tar.length) {
+        const header = tar.subarray(offset, offset + BLOCK_SIZE);
+        // Two consecutive all-zero blocks mark the end of the archive.
+        if (header.every((byte) => byte === 0))
+            break;
+        const name = readNullPaddedField(header, 0, 100);
+        const size = readOctalSize(header, 124, 12);
+        const typeflag = String.fromCharCode(header[156] ?? 0);
+        const dataStart = offset + BLOCK_SIZE;
+        const dataEnd = dataStart + size;
+        if (REGULAR_FILE_TYPEFLAGS.has(typeflag) && name !== '') {
+            entries.push({ name, content: Buffer.from(tar.subarray(dataStart, dataEnd)) });
+        }
+        // Every other typeflag (pax extended header 'x'/'g', directory '5',
+        // symlink '2', GNU long-name 'L'…) is skipped the same way: its data is
+        // exactly `size` bytes, block-padded, whether or not this reader
+        // understands what the bytes mean.
+        offset = dataStart + roundUpToBlock(size);
+    }
+    return entries;
+}
+/** Gunzips, then parses — the shape an npm registry `dist.tarball` download actually arrives in. */
+export function readTarGz(gzipped) {
+    return readTarEntries(gunzipSync(gzipped));
+}
+/** `package/<relativePath>` — every npm tarball's own file entries are rooted at `package/`. */
+export function findPackageFile(entries, relativePath) {
+    const wanted = `package/${relativePath}`;
+    const found = entries.find((entry) => entry.name === wanted);
+    return found === undefined ? null : found.content;
+}
+//# sourceMappingURL=tar.js.map

package/dist/update/tar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.js","sourceRoot":"","sources":["../../src/update/tar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAwBtC,MAAM,UAAU,GAAG,GAAG,CAAA;AAEtB,6HAA6H;AAC7H,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;AAEnD,SAAS,mBAAmB,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc;IACzE,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;IACpD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1E,OAAO,OAAO,CAAC,IAAI,EAAE,CAAA;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IACvD,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,CAAC,CAAA;IACxB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACtC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,UAAU,CAAA;AAClD,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,OAAO,GAAe,EAAE,CAAA;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAA;IAEd,OAAO,MAAM,GAAG,UAAU,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,CAAA;QAExD,+DAA+D;QAC/D,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,MAAK;QAE7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;QAChD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;QACtD,MAAM,SAAS,GAAG,MAAM,GAAG,UAAU,CAAA;QACrC,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAAA;QAEhC,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;QAChF,CAAC;QACD,oEAAoE;QACpE,wEAAwE;QACxE,iEAAiE;QACjE,mCAAmC;QAEnC,MAAM,GAAG,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IAC3C,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;AAC5C,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,OAA4B,EAAE,YAAoB;IAChF,MAAM,MAAM,GAAG,WAAW,YAAY,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAA;IAC5D,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;AACnD,CAAC"}

package/dist/update/version-compare.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Classifies the difference between two real version strings. Built on
+ * `@cogenta/plugins`'s own `parseVersion`/`compareVersions` (the semver
+ * comparator L8's fleet package already reuses for its own version-drift
+ * detection) rather than a second implementation, and rather than a new
+ * `semver` dependency (R9) — `@cogenta/cli` already depends on
+ * `@cogenta/plugins`.
+ */
+export type UpdateBump = 'none' | 'patch' | 'minor' | 'major' | 'unknown';
+export declare function classifyBump(from: string, to: string): UpdateBump;
+/** Every closed choice `updates.autoUpdatePolicy` (the site-settings registry entry) may hold. */
+export declare const AUTO_UPDATE_POLICIES: readonly ['off', 'patch', 'patch-minor', 'patch-minor-major'];
+export type AutoUpdatePolicy = (typeof AUTO_UPDATE_POLICIES)[number];
+/** Whether `bump` is one this policy allows to apply unattended. `'unknown'` and `'none'` are never allowed — nothing to apply, or nothing safely comparable. */
+export declare function policyAllows(policy: AutoUpdatePolicy, bump: UpdateBump): boolean;
+export declare function higherRiskBump(a: UpdateBump, b: UpdateBump): UpdateBump;
+//# sourceMappingURL=version-compare.d.ts.map

package/dist/update/version-compare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-compare.d.ts","sourceRoot":"","sources":["../../src/update/version-compare.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAA;AAEzE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU,CAUjE;AAED,kGAAkG;AAClG,eAAO,MAAM,oBAAoB,YAAI,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,mBAAmB,CAAU,CAAA;AACjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpE,iKAAiK;AACjK,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAWhF;AAWD,wBAAgB,cAAc,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,UAAU,CAEvE"}

package/dist/update/version-compare.js

@@ -0,0 +1,42 @@
+import { compareVersions, parseVersion } from '@cogenta/plugins';
+export function classifyBump(from, to) {
+    const fromVersion = parseVersion(from);
+    const toVersion = parseVersion(to);
+    if (fromVersion === null || toVersion === null)
+        return 'unknown';
+    const cmp = compareVersions(toVersion, fromVersion);
+    if (cmp <= 0)
+        return 'none';
+    if (toVersion.major !== fromVersion.major)
+        return 'major';
+    if (toVersion.minor !== fromVersion.minor)
+        return 'minor';
+    return 'patch';
+}
+/** Every closed choice `updates.autoUpdatePolicy` (the site-settings registry entry) may hold. */
+export const AUTO_UPDATE_POLICIES = ['off', 'patch', 'patch-minor', 'patch-minor-major'];
+/** Whether `bump` is one this policy allows to apply unattended. `'unknown'` and `'none'` are never allowed — nothing to apply, or nothing safely comparable. */
+export function policyAllows(policy, bump) {
+    switch (policy) {
+        case 'off':
+            return false;
+        case 'patch':
+            return bump === 'patch';
+        case 'patch-minor':
+            return bump === 'patch' || bump === 'minor';
+        case 'patch-minor-major':
+            return bump === 'patch' || bump === 'minor' || bump === 'major';
+    }
+}
+/** The higher-risk of two bumps, `'unknown'` treated as higher risk than `'major'` since it means "could not tell". */
+const BUMP_RANK = {
+    none: 0,
+    patch: 1,
+    minor: 2,
+    major: 3,
+    unknown: 4,
+};
+export function higherRiskBump(a, b) {
+    return BUMP_RANK[a] >= BUMP_RANK[b] ? a : b;
+}
+//# sourceMappingURL=version-compare.js.map

package/dist/update/version-compare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-compare.js","sourceRoot":"","sources":["../../src/update/version-compare.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAYhE,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,EAAU;IACnD,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;IAClC,IAAI,WAAW,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAEhE,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACnD,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,MAAM,CAAA;IAC3B,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK;QAAE,OAAO,OAAO,CAAA;IACzD,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK;QAAE,OAAO,OAAO,CAAA;IACzD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,mBAAmB,CAAU,CAAA;AAGjG,iKAAiK;AACjK,MAAM,UAAU,YAAY,CAAC,MAAwB,EAAE,IAAgB;IACrE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK;YACR,OAAO,KAAK,CAAA;QACd,KAAK,OAAO;YACV,OAAO,IAAI,KAAK,OAAO,CAAA;QACzB,KAAK,aAAa;YAChB,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAA;QAC7C,KAAK,mBAAmB;YACtB,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAA;IACnE,CAAC;AACH,CAAC;AAED,uHAAuH;AACvH,MAAM,SAAS,GAAyC;IACtD,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,CAAC;CACX,CAAA;AAED,MAAM,UAAU,cAAc,CAAC,CAAa,EAAE,CAAa;IACzD,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7C,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `@cogenta/cli`'s own installed version — self-describing, read from this
+ * package's own `package.json`, never bundled into a constant at build
+ * time. See `@cogenta/core`'s `readOwnPackageVersion` for why, and its own
+ * `getCoreVersion` for the sibling function — lazy for the exact same
+ * reason: never touch the filesystem merely because a module was imported.
+ *
+ * Kept in its own module (not `index.ts`) so `commands/update.ts` can import
+ * it directly without a circular import through `index.ts`, which re-exports
+ * this same function for external callers.
+ */
+export declare function getCliVersion(): string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAGtC"}

package/dist/version.js

@@ -0,0 +1,18 @@
+import { readOwnPackageVersion } from '@cogenta/core';
+let cachedCliVersion;
+/**
+ * `@cogenta/cli`'s own installed version — self-describing, read from this
+ * package's own `package.json`, never bundled into a constant at build
+ * time. See `@cogenta/core`'s `readOwnPackageVersion` for why, and its own
+ * `getCoreVersion` for the sibling function — lazy for the exact same
+ * reason: never touch the filesystem merely because a module was imported.
+ *
+ * Kept in its own module (not `index.ts`) so `commands/update.ts` can import
+ * it directly without a circular import through `index.ts`, which re-exports
+ * this same function for external callers.
+ */
+export function getCliVersion() {
+    cachedCliVersion ??= readOwnPackageVersion(new URL('../', import.meta.url));
+    return cachedCliVersion;
+}
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAErD,IAAI,gBAAoC,CAAA;AAExC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa;IAC3B,gBAAgB,KAAK,qBAAqB,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3E,OAAO,gBAAgB,CAAA;AACzB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cogenta/cli",
-  "version": "0.3.0",
+  "version": "0.6.0",
   "description": "The Cogenta command line: diagnose an install, run migrations, inspect drivers.",
   "license": "MPL-2.0",
   "type": "module",
@@ -14,7 +14,8 @@
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "CHANGELOG.md"
   ],
   "engines": {
     "node": ">=22.11.0"
@@ -30,17 +31,36 @@
   },
   "dependencies": {
     "graphql": "^17.0.2",
-    "@cogenta/agents": "0.2.0",
-    "@cogenta/blocks": "0.1.3",
-    "@cogenta/channels": "0.2.0",
-    "@cogenta/api": "1.0.0",
-    "@cogenta/auth": "0.2.0",
-    "@cogenta/core": "0.3.0",
-    "@cogenta/import": "0.1.3",
-    "@cogenta/schema": "0.2.0",
-    "@cogenta/seo": "0.2.0",
-    "@cogenta/render": "0.1.3",
-    "@cogenta/theme-canonical": "0.2.0"
+    "@cogenta/agents": "0.4.0",
+    "@cogenta/agents-builtin": "0.3.0",
+    "@cogenta/analytics": "0.3.1",
+    "@cogenta/auth": "0.5.0",
+    "@cogenta/api": "2.1.0",
+    "@cogenta/blocks": "1.0.1",
+    "@cogenta/comments": "0.2.1",
+    "@cogenta/commerce": "0.4.0",
+    "@cogenta/core": "0.6.0",
+    "@cogenta/forms": "0.2.1",
+    "@cogenta/import": "0.2.1",
+    "@cogenta/channels": "0.3.1",
+    "@cogenta/mcp": "0.3.0",
+    "@cogenta/schema": "0.4.1",
+    "@cogenta/observability": "0.2.1",
+    "@cogenta/plugins": "0.3.1",
+    "@cogenta/export": "0.2.1",
+    "@cogenta/seo": "0.3.1",
+    "@cogenta/render": "0.2.1",
+    "@cogenta/theme-blog": "0.3.0",
+    "@cogenta/theme-association": "0.3.0",
+    "@cogenta/theme-canonical": "1.1.0",
+    "@cogenta/theme-ecommerce": "1.1.0",
+    "@cogenta/theme-entreprise": "1.1.0",
+    "@cogenta/theme-kit": "0.3.0",
+    "@cogenta/theme-docs": "0.3.0",
+    "@cogenta/theme-magazine": "1.1.0",
+    "@cogenta/theme-portfolio": "1.1.0",
+    "@cogenta/theme-saas": "0.3.0",
+    "@cogenta/theme-restaurant": "0.3.0"
   },
   "devDependencies": {
     "typescript": "^7.0.2",