@monoes/monomindcli 1.11.14 → 1.12.0

package/dist/src/update/checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checker.d.ts","sourceRoot":"","sources":["../../../src/update/checker.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IACjD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE;QACV,KAAK,EAAE,OAAO,CAAC;QACf,KAAK,EAAE,OAAO,CAAC;QACf,KAAK,EAAE,OAAO,CAAC;KAChB,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC;IACjE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,QAAA,MAAM,cAAc,EAAE,YAiBrB,CAAC;AAkGF,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqCtE;AAED,wBAAsB,eAAe,CACnC,MAAM,GAAE,YAA6B,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyE9E;AAED,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,YAA6B,GACpC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA4BnC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"checker.d.ts","sourceRoot":"","sources":["../../../src/update/checker.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAqBH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IACjD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE;QACV,KAAK,EAAE,OAAO,CAAC;QACf,KAAK,EAAE,OAAO,CAAC;QACf,KAAK,EAAE,OAAO,CAAC;KAChB,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC;IACjE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,QAAA,MAAM,cAAc,EAAE,YAiBrB,CAAC;AAsIF,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqCtE;AAED,wBAAsB,eAAe,CACnC,MAAM,GAAE,YAA6B,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyE9E;AAED,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,YAA6B,GACpC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA4BnC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/src/update/checker.js

@@ -4,7 +4,19 @@
  */
 import { createRequire } from 'module';
 import { execFileSync } from 'child_process';
-import * as semver from 'semver';
+// Inline semver shim — avoids external dependency
+const semver = {
+    valid: (v) => /^\d+\.\d+\.\d+/.test(v || '') ? v : null,
+    eq: (a, b) => a === b,
+    major: (v) => parseInt((v || '0').split('.')[0], 10),
+    minor: (v) => parseInt((v || '0').split('.')[1] || '0', 10),
+    patch: (v) => parseInt(((v || '0').split('.')[2] || '0').replace(/[^0-9].*/, ''), 10),
+    gt: (a, b) => {
+        const [aMaj, aMin, aPat] = (a || '0').split('.').map(n => parseInt(n, 10) || 0);
+        const [bMaj, bMin, bPat] = (b || '0').split('.').map(n => parseInt(n, 10) || 0);
+        return aMaj !== bMaj ? aMaj > bMaj : aMin !== bMin ? aMin > bMin : aPat > bPat;
+    },
+};
 import { reserveCheck, recordCheck, getCachedVersions } from './rate-limiter.js';
 const require = createRequire(import.meta.url);
 const DEFAULT_CONFIG = {
@@ -45,6 +57,13 @@ const NPM_NAME_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i;
 function isValidNpmName(name) {
     return NPM_NAME_RE.test(name) && !name.includes('..') && name.length <= 214;
 }
+// Cap registry response at 5 MB. The full npm registry payload for a package
+// can include the entire `versions` object (dozens of version entries with
+// dist/scripts/dependencies for each). A spoofed or compromised registry
+// endpoint could stream an arbitrarily large body; AbortSignal.timeout(5000)
+// only enforces a wall-clock deadline and does NOT cap bytes. Without this
+// cap, fetchPackageInfo will buffer an unbounded body into memory (OOM).
+const MAX_REGISTRY_RESPONSE_BYTES = 5 * 1024 * 1024; // 5 MB
 async function fetchPackageInfo(packageName) {
     if (!isValidNpmName(packageName))
         return null;
@@ -56,7 +75,42 @@ async function fetchPackageInfo(packageName) {
         if (!response.ok) {
             return null;
         }
-        return (await response.json());
+        // Reject immediately if Content-Length header exceeds cap
+        const contentLength = response.headers.get('content-length');
+        if (contentLength) {
+            const declared = parseInt(contentLength, 10);
+            if (Number.isFinite(declared) && declared > MAX_REGISTRY_RESPONSE_BYTES) {
+                return null;
+            }
+        }
+        // Stream body and enforce byte cap — prevents OOM if the server streams
+        // a large body that evades the Content-Length check (missing/wrong header).
+        if (!response.body)
+            return null;
+        const reader = response.body.getReader();
+        const chunks = [];
+        let totalBytes = 0;
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (value) {
+                totalBytes += value.byteLength;
+                if (totalBytes > MAX_REGISTRY_RESPONSE_BYTES) {
+                    await reader.cancel();
+                    return null;
+                }
+                chunks.push(value);
+            }
+        }
+        const buf = new Uint8Array(totalBytes);
+        let offset = 0;
+        for (const chunk of chunks) {
+            buf.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        const text = new TextDecoder('utf-8').decode(buf);
+        return JSON.parse(text);
     }
     catch {
         return null;
@@ -66,7 +120,8 @@ function getUpdateType(current, latest) {
     if (!semver.valid(current) || !semver.valid(latest)) {
         return 'none';
     }
-    if (semver.eq(current, latest)) {
+    // Not an upgrade (equal or downgrade)
+    if (!semver.gt(latest, current)) {
         return 'none';
     }
     if (semver.major(latest) > semver.major(current)) {
@@ -75,10 +130,7 @@ function getUpdateType(current, latest) {
     if (semver.minor(latest) > semver.minor(current)) {
         return 'minor';
     }
-    if (semver.patch(latest) > semver.patch(current)) {
-        return 'patch';
-    }
-    return 'none';
+    return 'patch';
 }
 function shouldAutoUpdate(updateType, priority, config) {
     if (updateType === 'none')

package/dist/src/update/checker.js.map

@@ -1 +1 @@
-{"version":3,"file":"checker.js","sourceRoot":"","sources":["../../../src/update/checker.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEjF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAwB/C,MAAM,cAAc,GAAiB;IACnC,OAAO,EAAE,IAAI;IACb,kBAAkB,EAAE,EAAE;IACtB,UAAU,EAAE;QACV,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,KAAK;KACb;IACD,QAAQ,EAAE;QACR,cAAc,EAAE,UAAU;QAC1B,qBAAqB,EAAE,MAAM;QAC7B,UAAU,EAAE,MAAM;QAClB,mBAAmB,EAAE,QAAQ;QAC7B,gBAAgB,EAAE,QAAQ;QAC1B,oBAAoB,EAAE,KAAK;KAC5B;IACD,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,wDAAwD;AACxD,2FAA2F;AAC3F,MAAM,iBAAiB,GAAG;IACxB,UAAU;IACV,qBAAqB;IACrB,cAAc;IACd,mBAAmB;IACnB,gBAAgB;IAChB,oBAAoB;IACpB,oBAAoB;IACpB,iBAAiB;IACjB,eAAe;IACf,mBAAmB;CACpB,CAAC;AAEF,qEAAqE;AACrE,+DAA+D;AAC/D,MAAM,WAAW,GAAG,yDAAyD,CAAC;AAE9E,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC;AAC9E,CAAC;AAOD,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACjD,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,8BAA8B,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAC/D;YACE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,OAAe,EACf,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAgD,EAChD,QAAgD,EAChD,MAAoB;IAEpB,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAExC,mEAAmE;IACnE,IAAI,QAAQ,KAAK,UAAU,IAAI,CAAC,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,OAAO,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,eAAe;IACf,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;IAC3D,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;IAC3D,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;IAE3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,sFAAsF;QACtF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,WAAW,eAAe,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC9B,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;QAEtC,8DAA8D;QAC9D,MAAM,QAAQ,GAAG;YACf,GAAG,WAAW,eAAe;YAC7B,sBAAsB,WAAW,eAAe;YAChD,yBAAyB,WAAW,eAAe;SACpD,CAAC;QACF,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACzE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC9B,IAAI,GAAG,CAAC,OAAO;oBAAE,OAAO,GAAG,CAAC,OAAO,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;QACvB,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACjG,MAAM,SAAS,GAAG,OAAO,CACvB,OAAO,CAAC,OAAO,CAAC,GAAG,WAAW,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAC1F,CAAC;YACF,IAAI,SAAS,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,OAAO,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;QAEtD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAuB,cAAc;IAErC,0DAA0D;IAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,qCAAqC;QACrC,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,YAAY,GAA2B,EAAE,CAAC;IAEhD,qBAAqB;IACrB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAC9C,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CACvC,CAAC;IAEF,oCAAoC;IACpC,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAClE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;QAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;QAC1C,OAAO,aAAa,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,GAAG,CACf,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;QACxC,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,8BAA8B;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAChD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,YAAY,CAAC,WAAW,CAAC,GAAG,aAAa,CAAC;QAE1C,MAAM,UAAU,GAAG,aAAa,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC;QAE1D,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,WAAW;YACpB,cAAc;YACd,aAAa;YACb,UAAU;YACV,QAAQ;YACR,gBAAgB,EAAE,gBAAgB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC;SACjE,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IAEF,oBAAoB;IACpB,WAAW,CAAC,YAAY,CAAC,CAAC;IAE1B,mCAAmC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC;IAE/D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,SAAuB,cAAc;IAErC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAChD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC;IAE1D,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,cAAc;QACd,aAAa;QACb,UAAU;QACV,QAAQ;QACR,gBAAgB,EAAE,gBAAgB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"checker.js","sourceRoot":"","sources":["../../../src/update/checker.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,kDAAkD;AAClD,MAAM,MAAM,GAAG;IACb,KAAK,EAAE,CAAC,CAA4B,EAAiB,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI;IAClG,EAAE,EAAE,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE,CAAC,CAAC,KAAK,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpE,KAAK,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;IAC3E,KAAK,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;IACrG,EAAE,EAAE,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;QACpC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACjF,CAAC;CACF,CAAC;AACF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEjF,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAwB/C,MAAM,cAAc,GAAiB;IACnC,OAAO,EAAE,IAAI;IACb,kBAAkB,EAAE,EAAE;IACtB,UAAU,EAAE;QACV,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,KAAK;KACb;IACD,QAAQ,EAAE;QACR,cAAc,EAAE,UAAU;QAC1B,qBAAqB,EAAE,MAAM;QAC7B,UAAU,EAAE,MAAM;QAClB,mBAAmB,EAAE,QAAQ;QAC7B,gBAAgB,EAAE,QAAQ;QAC1B,oBAAoB,EAAE,KAAK;KAC5B;IACD,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,wDAAwD;AACxD,2FAA2F;AAC3F,MAAM,iBAAiB,GAAG;IACxB,UAAU;IACV,qBAAqB;IACrB,cAAc;IACd,mBAAmB;IACnB,gBAAgB;IAChB,oBAAoB;IACpB,oBAAoB;IACpB,iBAAiB;IACjB,eAAe;IACf,mBAAmB;CACpB,CAAC;AAEF,qEAAqE;AACrE,+DAA+D;AAC/D,MAAM,WAAW,GAAG,yDAAyD,CAAC;AAE9E,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC;AAC9E,CAAC;AAOD,6EAA6E;AAC7E,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,yEAAyE;AACzE,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAE5D,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACjD,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,8BAA8B,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAC/D;YACE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0DAA0D;QAC1D,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7D,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,2BAA2B,EAAE,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,4EAA4E;QAC5E,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,KAAK,EAAE,CAAC;gBACV,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC/B,IAAI,UAAU,GAAG,2BAA2B,EAAE,CAAC;oBAC7C,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;oBACtB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;QAAC,CAAC;QACnF,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,OAAe,EACf,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sCAAsC;IACtC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAgD,EAChD,QAAgD,EAChD,MAAoB;IAEpB,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAExC,mEAAmE;IACnE,IAAI,QAAQ,KAAK,UAAU,IAAI,CAAC,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,OAAO,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,eAAe;IACf,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;IAC3D,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;IAC3D,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;IAE3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,sFAAsF;QACtF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,WAAW,eAAe,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC9B,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;QAEtC,8DAA8D;QAC9D,MAAM,QAAQ,GAAG;YACf,GAAG,WAAW,eAAe;YAC7B,sBAAsB,WAAW,eAAe;YAChD,yBAAyB,WAAW,eAAe;SACpD,CAAC;QACF,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACzE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC9B,IAAI,GAAG,CAAC,OAAO;oBAAE,OAAO,GAAG,CAAC,OAAO,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;QACvB,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACjG,MAAM,SAAS,GAAG,OAAO,CACvB,OAAO,CAAC,OAAO,CAAC,GAAG,WAAW,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAC1F,CAAC;YACF,IAAI,SAAS,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,OAAO,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;QAEtD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAuB,cAAc;IAErC,0DAA0D;IAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,qCAAqC;QACrC,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,YAAY,GAA2B,EAAE,CAAC;IAEhD,qBAAqB;IACrB,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAC9C,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CACvC,CAAC;IAEF,oCAAoC;IACpC,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAClE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;QAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;QAC1C,OAAO,aAAa,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,GAAG,CACf,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;QACxC,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,8BAA8B;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAChD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,YAAY,CAAC,WAAW,CAAC,GAAG,aAAa,CAAC;QAE1C,MAAM,UAAU,GAAG,aAAa,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC;QAE1D,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,WAAW;YACpB,cAAc;YACd,aAAa;YACb,UAAU;YACV,QAAQ;YACR,gBAAgB,EAAE,gBAAgB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC;SACjE,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IAEF,oBAAoB;IACpB,WAAW,CAAC,YAAY,CAAC,CAAC;IAE1B,mCAAmC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC;IAE/D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,SAAuB,cAAc;IAErC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAChD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC;IAE1D,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,cAAc;QACd,aAAa;QACb,UAAU;QACV,QAAQ;QACR,gBAAgB,EAAE,gBAAgB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/src/update/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../src/update/executor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAkB,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElE,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,gBAAgB,CAAC;CAC9B;AAYD,wBAAgB,WAAW,IAAI,kBAAkB,EAAE,CAUlD;AAiBD,wBAAsB,aAAa,CACjC,MAAM,EAAE,iBAAiB,EACzB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACzC,MAAM,UAAQ,GACb,OAAO,CAAC,qBAAqB,CAAC,CA2EhC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,iBAAiB,EAAE,EAC5B,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACzC,MAAM,UAAQ,GACb,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAoBlC;AAED,wBAAsB,cAAc,CAClC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAoDhD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,SAAK,GAAG,kBAAkB,EAAE,CAGjE;AAED,wBAAgB,YAAY,IAAI,IAAI,CAInC"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../src/update/executor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAkB,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAgClE,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,gBAAgB,CAAC;CAC9B;AAYD,wBAAgB,WAAW,IAAI,kBAAkB,EAAE,CA0BlD;AAiBD,wBAAsB,aAAa,CACjC,MAAM,EAAE,iBAAiB,EACzB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACzC,MAAM,UAAQ,GACb,OAAO,CAAC,qBAAqB,CAAC,CAgFhC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,iBAAiB,EAAE,EAC5B,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACzC,MAAM,UAAQ,GACb,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAoBlC;AAED,wBAAsB,cAAc,CAClC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAoDhD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,SAAK,GAAG,kBAAkB,EAAE,CAGjE;AAED,wBAAgB,YAAY,IAAI,IAAI,CAInC"}

package/dist/src/update/executor.js

@@ -6,11 +6,32 @@ import { execFile } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import * as semver from 'semver';
+import { validateUpdate } from './validator.js';
+// Inline semver shim — avoids external dependency (semver is not in package.json)
+const semver = {
+    valid: (v) => /^\d+\.\d+\.\d+/.test(v || '') ? v : null,
+};
+/**
+ * Validate a npm package name.
+ * Allows scoped (@scope/name) and unscoped names; rejects path-traversal,
+ * shell metacharacters, and names that are too long to be legitimate.
+ * See https://docs.npmjs.com/cli/v9/configuring-npm/package-json#name
+ */
+function isValidPackageName(name) {
+    if (typeof name !== 'string' || name.length === 0 || name.length > 214)
+        return false;
+    // Scoped: @scope/name — both parts: lowercase alnum + hyphens + underscores + dots
+    if (name.startsWith('@')) {
+        return /^@[a-z0-9][a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*$/.test(name);
+    }
+    // Unscoped: must not start with . or _ (legacy rule)
+    return /^[a-z0-9][a-z0-9_.-]*$/.test(name);
+}
+/** Max bytes we will read from the on-disk update history file. */
+const MAX_HISTORY_FILE_BYTES = 1 * 1024 * 1024; // 1 MB
 function execFileAsync(cmd, args) {
     return new Promise((resolve, reject) => execFile(cmd, args, (err) => (err ? reject(err) : resolve())));
 }
-import { validateUpdate } from './validator.js';
 const HISTORY_FILE = path.join(os.homedir(), '.monomind', 'update-history.json');
 const MAX_HISTORY_ENTRIES = 100;
 function ensureDir() {
@@ -22,8 +43,29 @@ function ensureDir() {
 export function loadHistory() {
     try {
         if (fs.existsSync(HISTORY_FILE)) {
+            // Guard against a bloated or attacker-crafted history file causing OOM.
+            const stat = fs.statSync(HISTORY_FILE);
+            if (stat.size > MAX_HISTORY_FILE_BYTES) {
+                return [];
+            }
             const content = fs.readFileSync(HISTORY_FILE, 'utf-8');
-            return JSON.parse(content);
+            const raw = JSON.parse(content);
+            if (!Array.isArray(raw))
+                return [];
+            // Sanitize each entry: reject any entry whose package name or version
+            // fails validation so that a tampered history file cannot inject
+            // arbitrary arguments into a subsequent npm install via rollbackUpdate().
+            return raw.filter((e) => {
+                if (typeof e !== 'object' || e === null)
+                    return false;
+                if (typeof e.package !== 'string' || !isValidPackageName(e.package))
+                    return false;
+                if (typeof e.fromVersion !== 'string' || !semver.valid(e.fromVersion))
+                    return false;
+                if (typeof e.toVersion !== 'string' || !semver.valid(e.toVersion))
+                    return false;
+                return true;
+            });
         }
     }
     catch {
@@ -68,6 +110,11 @@ export async function executeUpdate(update, installedPackages, dryRun = false) {
         // Execute npm install — use execFile to avoid shell injection
         const pkg = update.package;
         const version = update.latestVersion;
+        // Validate both package name and version before constructing the npm arg
+        // to prevent argument injection via a crafted UpdateCheckResult.
+        if (!isValidPackageName(pkg)) {
+            throw new Error(`Invalid package name: ${pkg}`);
+        }
         if (!semver.valid(version)) {
             throw new Error(`Invalid version: ${version}`);
         }

package/dist/src/update/executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/update/executor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,SAAS,aAAa,CAAC,GAAW,EAAE,IAAc;IAChD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAC3C,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,cAAc,EAAoB,MAAM,gBAAgB,CAAC;AAoBlE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;AACjF,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAyB,CAAC;QACrD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,OAA6B;IAChD,SAAS,EAAE,CAAC;IACZ,2BAA2B;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,YAAY,GAAG,MAAM,CAAC;IAClC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB;IAC7C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,WAAW,CAAC,OAAO,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB,EACzB,iBAAyC,EACzC,MAAM,GAAG,KAAK;IAEd,iBAAiB;IACjB,MAAM,UAAU,GAAG,cAAc,CAC/B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,aAAa,EACpB,iBAAiB,CAClB,CAAC;IAEF,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,aAAa;YAC7B,KAAK,EAAE,sBAAsB,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACtE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,aAAa;YAC7B,UAAU;SACX,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QAE7E,2BAA2B;QAC3B,YAAY,CAAC;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,cAAc;YAClC,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,aAAa;YAC7B,UAAU;SACX,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAc,CAAC;QAE3B,uBAAuB;QACvB,YAAY,CAAC;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,cAAc;YAClC,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,GAAG,CAAC,OAAO;YAClB,iBAAiB,EAAE,KAAK;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,aAAa;YAC7B,KAAK,EAAE,GAAG,CAAC,OAAO;YAClB,UAAU;SACX,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA4B,EAC5B,iBAAyC,EACzC,MAAM,GAAG,KAAK;IAEd,MAAM,OAAO,GAA4B,EAAE,CAAC;IAE5C,kDAAkD;IAClD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAErB,gDAAgD;QAChD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3D,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAoB;IAEpB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACpE,CAAC;IAED,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,WAAW;QAC5B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,iBAAiB,CAAC;QACrF,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,WAAW;gBAClB,CAAC,CAAC,6BAA6B,WAAW,EAAE;gBAC5C,CAAC,CAAC,uBAAuB;SAC5B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,uEAAuE;QACvE,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC;QAC/B,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QAE7E,sBAAsB;QACtB,YAAY,CAAC;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,WAAW,EAAE,UAAU,CAAC,SAAS;YACjC,SAAS,EAAE,UAAU,CAAC,WAAW;YACjC,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,KAAK,EAAE,4BAA4B;SACvD,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,eAAe,UAAU,CAAC,OAAO,SAAS,UAAU,CAAC,SAAS,OAAO,UAAU,CAAC,WAAW,EAAE;SACvG,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAc,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,oBAAoB,GAAG,CAAC,OAAO,EAAE;SAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAK,GAAG,EAAE;IACzC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC"}
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/update/executor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EAAE,cAAc,EAAoB,MAAM,gBAAgB,CAAC;AAElE,kFAAkF;AAClF,MAAM,MAAM,GAAG;IACb,KAAK,EAAE,CAAC,CAA4B,EAAiB,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI;CACnG,CAAC;AAEF;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IACrF,mFAAmF;IACnF,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,qDAAqD;IACrD,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,mEAAmE;AACnE,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAEvD,SAAS,aAAa,CAAC,GAAW,EAAE,IAAc;IAChD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAC3C,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAoBD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;AACjF,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,wEAAwE;YACxE,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,IAAI,GAAG,sBAAsB,EAAE,CAAC;gBACvC,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;YACnC,sEAAsE;YACtE,iEAAiE;YACjE,0EAA0E;YAC1E,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAA2B,EAAE;gBAC/C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,KAAK,CAAC;gBACtD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAClF,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACpF,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAChF,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,OAA6B;IAChD,SAAS,EAAE,CAAC;IACZ,2BAA2B;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,YAAY,GAAG,MAAM,CAAC;IAClC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB;IAC7C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,WAAW,CAAC,OAAO,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB,EACzB,iBAAyC,EACzC,MAAM,GAAG,KAAK;IAEd,iBAAiB;IACjB,MAAM,UAAU,GAAG,cAAc,CAC/B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,aAAa,EACpB,iBAAiB,CAClB,CAAC;IAEF,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,aAAa;YAC7B,KAAK,EAAE,sBAAsB,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACtE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,aAAa;YAC7B,UAAU;SACX,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC;QACrC,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QAE7E,2BAA2B;QAC3B,YAAY,CAAC;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,cAAc;YAClC,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,aAAa;YAC7B,UAAU;SACX,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAc,CAAC;QAE3B,uBAAuB;QACvB,YAAY,CAAC;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,cAAc;YAClC,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,GAAG,CAAC,OAAO;YAClB,iBAAiB,EAAE,KAAK;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,aAAa;YAC7B,KAAK,EAAE,GAAG,CAAC,OAAO;YAClB,UAAU;SACX,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA4B,EAC5B,iBAAyC,EACzC,MAAM,GAAG,KAAK;IAEd,MAAM,OAAO,GAA4B,EAAE,CAAC;IAE5C,kDAAkD;IAClD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAErB,gDAAgD;QAChD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3D,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAoB;IAEpB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACpE,CAAC;IAED,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,WAAW;QAC5B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,iBAAiB,CAAC;QACrF,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,WAAW;gBAClB,CAAC,CAAC,6BAA6B,WAAW,EAAE;gBAC5C,CAAC,CAAC,uBAAuB;SAC5B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,uEAAuE;QACvE,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC;QAC/B,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QAE7E,sBAAsB;QACtB,YAAY,CAAC;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,WAAW,EAAE,UAAU,CAAC,SAAS;YACjC,SAAS,EAAE,UAAU,CAAC,WAAW;YACjC,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,KAAK,EAAE,4BAA4B;SACvD,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,eAAe,UAAU,CAAC,OAAO,SAAS,UAAU,CAAC,SAAS,OAAO,UAAU,CAAC,WAAW,EAAE;SACvG,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAc,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,oBAAoB,GAAG,CAAC,OAAO,EAAE;SAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAK,GAAG,EAAE;IACzC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC"}

package/dist/src/update/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/update/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAI/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAKtD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAY/D;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7C,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;IACtC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC,CAqDD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/update/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAI/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAoBtD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAY/D;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7C,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;IACtC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC,CAqDD"}

package/dist/src/update/index.js

@@ -16,7 +16,24 @@ export { executeUpdate, executeMultipleUpdates, rollbackUpdate, getUpdateHistory
 import { checkForUpdates, DEFAULT_CONFIG, getInstalledVersion } from './checker.js';
 import { executeMultipleUpdates } from './executor.js';
 import { getCachedVersions } from './rate-limiter.js';
-import * as semver from 'semver';
+// Inline semver shim — avoids external dependency (semver is not listed in package.json)
+const semver = {
+    valid: (v) => /^\d+\.\d+\.\d+/.test(v || '') ? v : null,
+    gt: (a, b) => {
+        const [aMaj, aMin, aPat] = (a || '0').split('.').map(n => parseInt(n, 10) || 0);
+        const [bMaj, bMin, bPat] = (b || '0').split('.').map(n => parseInt(n, 10) || 0);
+        return aMaj !== bMaj ? aMaj > bMaj : aMin !== bMin ? aMin > bMin : aPat > bPat;
+    },
+    lte: (a, b) => {
+        const [aMaj, aMin, aPat] = (a || '0').split('.').map(n => parseInt(n, 10) || 0);
+        const [bMaj, bMin, bPat] = (b || '0').split('.').map(n => parseInt(n, 10) || 0);
+        if (aMaj !== bMaj)
+            return aMaj < bMaj;
+        if (aMin !== bMin)
+            return aMin < bMin;
+        return aPat <= bPat;
+    },
+};
 /**
  * Synchronous — reads cached state from last check.
  * Returns a short inline string for the CLI version tagline, e.g.

package/dist/src/update/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/update/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GACf,MAAM,cAAc,CAAC;AAItB,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,SAAS,GACV,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAIpE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,WAAW,GACZ,MAAM,eAAe,CAAC;AAIvB,+CAA+C;AAC/C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAsB;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,iFAAiF;QACjF,2EAA2E;QAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;YAAE,OAAO,EAAE,CAAC;QACjF,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC;YAAE,OAAO,gBAAgB,CAAC;QAChE,OAAO,QAAQ,MAAM,YAAY,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAI3C;IAMC,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,KAAK;QACd,gBAAgB,EAAE,EAAyB;QAC3C,cAAc,EAAE,EAAc;QAC9B,aAAa,EAAE,SAA+B;KAC/C,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,CAAC;QAE3E,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,MAAM,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAElC,yBAAyB;QACzB,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YAEjE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,2CAA2C;gBAC3C,OAAO,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;gBAEnF,iCAAiC;gBACjC,MAAM,iBAAiB,GAA2B,EAAE,CAAC;gBACrD,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;oBACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBACpD,IAAI,OAAO,EAAE,CAAC;wBACZ,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;oBAC9C,CAAC;gBACH,CAAC;gBAED,kBAAkB;gBAClB,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAChD,cAAc,EACd,iBAAiB,CAClB,CAAC;gBAEF,MAAM,CAAC,cAAc,GAAG,aAAa;qBAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;qBACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/update/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GACf,MAAM,cAAc,CAAC;AAItB,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,SAAS,GACV,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAIpE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,WAAW,GACZ,MAAM,eAAe,CAAC;AAIvB,+CAA+C;AAC/C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,yFAAyF;AACzF,MAAM,MAAM,GAAG;IACb,KAAK,EAAE,CAAC,CAA4B,EAAiB,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI;IAClG,EAAE,EAAE,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;QACpC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACjF,CAAC;IACD,GAAG,EAAE,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;QACrC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,GAAG,IAAI,CAAC;QACtC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,GAAG,IAAI,CAAC;QACtC,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAsB;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,iFAAiF;QACjF,2EAA2E;QAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;YAAE,OAAO,EAAE,CAAC;QACjF,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC;YAAE,OAAO,gBAAgB,CAAC;QAChE,OAAO,QAAQ,MAAM,YAAY,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAI3C;IAMC,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,KAAK;QACd,gBAAgB,EAAE,EAAyB;QAC3C,cAAc,EAAE,EAAc;QAC9B,aAAa,EAAE,SAA+B;KAC/C,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,CAAC;QAE3E,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,MAAM,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAElC,yBAAyB;QACzB,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YAEjE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,2CAA2C;gBAC3C,OAAO,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;gBAEnF,iCAAiC;gBACjC,MAAM,iBAAiB,GAA2B,EAAE,CAAC;gBACrD,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;oBACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBACpD,IAAI,OAAO,EAAE,CAAC;wBACZ,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;oBAC9C,CAAC;gBACH,CAAC;gBAED,kBAAkB;gBAClB,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAChD,cAAc,EACd,iBAAiB,CAClB,CAAC;gBAEF,MAAM,CAAC,cAAc,GAAG,aAAa;qBAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;qBACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/src/update/rate-limiter.d.ts

@@ -20,6 +20,12 @@ export declare function shouldCheckForUpdates(intervalHours?: number): {
  * only after a successful reserveCheck, so that limit enforcement and
  * increment happen in the same synchronous turn (no await gap between
  * them), preventing two concurrent callers both seeing "allowed".
+ *
+ * IMPORTANT: performs a single loadState() → check → increment → saveState()
+ * cycle to eliminate the TOCTOU window that existed when this function
+ * delegated to shouldCheckForUpdates() (which called loadState() itself)
+ * and then called loadState() a second time to increment. Two callers
+ * sharing that gap could both see allowed=true and both increment.
  */
 export declare function reserveCheck(intervalHours?: number): {
     allowed: boolean;

package/dist/src/update/rate-limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/update/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAsBD,wBAAgB,SAAS,IAAI,cAAc,CAmB1C;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAKrD;AAED,wBAAgB,qBAAqB,CACnC,aAAa,GAAE,MAA+B,GAC7C;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAuCvC;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,aAAa,GAAE,MAA+B,GAC7C;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAYvC;AAED,wBAAgB,WAAW,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAKzE;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE1D;AAED,wBAAgB,UAAU,IAAI,IAAI,CAIjC"}
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/update/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AA4BD,wBAAgB,SAAS,IAAI,cAAc,CA4C1C;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAKrD;AAED,wBAAgB,qBAAqB,CACnC,aAAa,GAAE,MAA+B,GAC7C;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAuCvC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,aAAa,GAAE,MAA+B,GAC7C;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAqCvC;AAED,wBAAgB,WAAW,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAazE;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE1D;AAED,wBAAgB,UAAU,IAAI,IAAI,CAIjC"}

package/dist/src/update/rate-limiter.js

@@ -8,6 +8,12 @@ import * as os from 'os';
 const STATE_FILE = path.join(os.homedir(), '.monomind', 'update-state.json');
 const DEFAULT_INTERVAL_HOURS = 24;
 const MAX_CHECKS_PER_DAY = 10;
+// Hard cap on how many package version entries we persist. Prevents an
+// attacker who can write to the state file from inflating it unboundedly,
+// and protects recordCheck() from DoS via a huge incoming packageVersions map.
+const MAX_PACKAGE_VERSIONS = 100;
+// Hard cap on the state file size we are willing to read into memory.
+const MAX_STATE_FILE_BYTES = 1 * 1024 * 1024; // 1 MB
 function ensureDir() {
     const dir = path.dirname(STATE_FILE);
     if (!fs.existsSync(dir)) {
@@ -25,8 +31,36 @@ function getDefaultState() {
 export function loadState() {
     try {
         if (fs.existsSync(STATE_FILE)) {
+            // Guard against oversized state files (DoS / OOM) before reading
+            const stat = fs.statSync(STATE_FILE);
+            if (stat.size > MAX_STATE_FILE_BYTES) {
+                // State file is unreasonably large — discard and start fresh
+                try {
+                    fs.unlinkSync(STATE_FILE);
+                }
+                catch { /* ignore */ }
+                return getDefaultState();
+            }
             const content = fs.readFileSync(STATE_FILE, 'utf-8');
-            const state = JSON.parse(content);
+            // Block prototype pollution via JSON.parse reviver
+            const state = JSON.parse(content, (key, value) => {
+                if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+                    return undefined;
+                return value;
+            });
+            // Validate that packageVersions is a plain object (not an array/primitive)
+            if (!state.packageVersions || typeof state.packageVersions !== 'object' || Array.isArray(state.packageVersions)) {
+                state.packageVersions = {};
+            }
+            // Cap the number of package version entries to prevent bloat
+            const versionKeys = Object.keys(state.packageVersions);
+            if (versionKeys.length > MAX_PACKAGE_VERSIONS) {
+                const capped = {};
+                for (const k of versionKeys.slice(0, MAX_PACKAGE_VERSIONS)) {
+                    capped[k] = state.packageVersions[k];
+                }
+                state.packageVersions = capped;
+            }
             // Reset counter if new day
             const today = new Date().toISOString().split('T')[0];
             if (state.date !== today) {
@@ -86,14 +120,41 @@ export function shouldCheckForUpdates(intervalHours = DEFAULT_INTERVAL_HOURS) {
  * only after a successful reserveCheck, so that limit enforcement and
  * increment happen in the same synchronous turn (no await gap between
  * them), preventing two concurrent callers both seeing "allowed".
+ *
+ * IMPORTANT: performs a single loadState() → check → increment → saveState()
+ * cycle to eliminate the TOCTOU window that existed when this function
+ * delegated to shouldCheckForUpdates() (which called loadState() itself)
+ * and then called loadState() a second time to increment. Two callers
+ * sharing that gap could both see allowed=true and both increment.
  */
 export function reserveCheck(intervalHours = DEFAULT_INTERVAL_HOURS) {
-    const decision = shouldCheckForUpdates(intervalHours);
-    if (!decision.allowed)
-        return decision;
-    // Increment immediately, before any async work, so concurrent callers
-    // see an updated count on their next tick.
+    // Fast-path: environment gates that don't need file I/O
+    if (process.env.CI === 'true' || process.env.CONTINUOUS_INTEGRATION === 'true') {
+        return { allowed: false, reason: 'CI environment detected' };
+    }
+    if (process.env.MONOMIND_AUTO_UPDATE === 'false') {
+        return { allowed: false, reason: 'Auto-update disabled via environment' };
+    }
+    // Single load — check and increment in one synchronous cycle
     const state = loadState();
+    if (process.env.MONOMIND_FORCE_UPDATE !== 'true') {
+        // Daily limit
+        if (state.checksToday >= MAX_CHECKS_PER_DAY) {
+            return { allowed: false, reason: `Daily check limit (${MAX_CHECKS_PER_DAY}) reached` };
+        }
+        // Time interval
+        if (state.lastCheck) {
+            const hoursSinceLastCheck = (Date.now() - new Date(state.lastCheck).getTime()) / (1000 * 60 * 60);
+            if (hoursSinceLastCheck < intervalHours) {
+                const nextCheck = Math.ceil(intervalHours - hoursSinceLastCheck);
+                return {
+                    allowed: false,
+                    reason: `Last check was ${Math.floor(hoursSinceLastCheck)}h ago (next check in ~${nextCheck}h)`,
+                };
+            }
+        }
+    }
+    // Reserve the slot: increment and persist before any async work begins
     state.checksToday += 1;
     state.lastCheck = new Date().toISOString();
     saveState(state);
@@ -102,7 +163,18 @@ export function reserveCheck(intervalHours = DEFAULT_INTERVAL_HOURS) {
 export function recordCheck(packageVersions) {
     // Update only package versions; count/timestamp already incremented by reserveCheck
     const state = loadState();
-    state.packageVersions = { ...state.packageVersions, ...packageVersions };
+    // Merge only string-valued keys to block prototype pollution and type confusion.
+    // Also enforce the total cap so a large incoming map cannot bloat the state file.
+    const FORBIDDEN = new Set(['__proto__', 'constructor', 'prototype']);
+    for (const [k, v] of Object.entries(packageVersions)) {
+        if (FORBIDDEN.has(k))
+            continue;
+        if (typeof k !== 'string' || typeof v !== 'string')
+            continue;
+        if (Object.keys(state.packageVersions).length >= MAX_PACKAGE_VERSIONS)
+            break;
+        state.packageVersions[k] = v;
+    }
     saveState(state);
 }
 export function getCachedVersions() {

package/dist/src/update/rate-limiter.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/update/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AASzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;AAC7E,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO;QACL,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,CAAC;QACd,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5C,eAAe,EAAE,EAAE;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;YAEpD,2BAA2B;YAC3B,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;gBACnB,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC;YACxB,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IACD,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,SAAS,EAAE,CAAC;IACZ,MAAM,GAAG,GAAG,UAAU,GAAG,MAAM,CAAC;IAChC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,gBAAwB,sBAAsB;IAE9C,0BAA0B;IAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM,EAAE,CAAC;QAC/E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/D,CAAC;IAED,8BAA8B;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,OAAO,EAAE,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IAC5E,CAAC;IAED,4BAA4B;IAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAE1B,oBAAoB;IACpB,IAAI,KAAK,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,kBAAkB,WAAW,EAAE,CAAC;IACzF,CAAC;IAED,sBAAsB;IACtB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,mBAAmB,GAAG,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAErE,IAAI,mBAAmB,GAAG,aAAa,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,kBAAkB,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,SAAS,IAAI;aAChG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,gBAAwB,sBAAsB;IAE9C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAEvC,sEAAsE;IACtE,2CAA2C;IAC3C,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;IACvB,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,SAAS,CAAC,KAAK,CAAC,CAAC;IAEjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,eAAuC;IACjE,oFAAoF;IACpF,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,KAAK,CAAC,eAAe,GAAG,EAAE,GAAG,KAAK,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC;IACzE,SAAS,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC"}
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/update/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AASzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;AAC7E,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,uEAAuE;AACvE,0EAA0E;AAC1E,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAErD,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,OAAO;QACL,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,CAAC;QACd,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5C,eAAe,EAAE,EAAE;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,iEAAiE;YACjE,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,IAAI,GAAG,oBAAoB,EAAE,CAAC;gBACrC,6DAA6D;gBAC7D,IAAI,CAAC;oBAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBACzD,OAAO,eAAe,EAAE,CAAC;YAC3B,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACrD,mDAAmD;YACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAC/C,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW;oBAAE,OAAO,SAAS,CAAC;gBAC1F,OAAO,KAAK,CAAC;YACf,CAAC,CAAmB,CAAC;YAErB,2EAA2E;YAC3E,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;gBAChH,KAAK,CAAC,eAAe,GAAG,EAAE,CAAC;YAC7B,CAAC;YACD,6DAA6D;YAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACvD,IAAI,WAAW,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAA2B,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,EAAE,CAAC;oBAC3D,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;gBACvC,CAAC;gBACD,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC;YACjC,CAAC;YAED,2BAA2B;YAC3B,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;gBACnB,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC;YACxB,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IACD,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,SAAS,EAAE,CAAC;IACZ,MAAM,GAAG,GAAG,UAAU,GAAG,MAAM,CAAC;IAChC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,gBAAwB,sBAAsB;IAE9C,0BAA0B;IAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM,EAAE,CAAC;QAC/E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/D,CAAC;IAED,8BAA8B;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,OAAO,EAAE,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IAC5E,CAAC;IAED,4BAA4B;IAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAE1B,oBAAoB;IACpB,IAAI,KAAK,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,kBAAkB,WAAW,EAAE,CAAC;IACzF,CAAC;IAED,sBAAsB;IACtB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,mBAAmB,GAAG,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAErE,IAAI,mBAAmB,GAAG,aAAa,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,kBAAkB,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,SAAS,IAAI;aAChG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAC1B,gBAAwB,sBAAsB;IAE9C,wDAAwD;IACxD,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM,EAAE,CAAC;QAC/E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,OAAO,EAAE,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IAC5E,CAAC;IAED,6DAA6D;IAC7D,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAE1B,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;QACjD,cAAc;QACd,IAAI,KAAK,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,kBAAkB,WAAW,EAAE,CAAC;QACzF,CAAC;QAED,gBAAgB;QAChB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,mBAAmB,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAClG,IAAI,mBAAmB,GAAG,aAAa,EAAE,CAAC;gBACxC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,CAAC;gBACjE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,kBAAkB,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,SAAS,IAAI;iBAChG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;IACvB,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,SAAS,CAAC,KAAK,CAAC,CAAC;IAEjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,eAAuC;IACjE,oFAAoF;IACpF,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,iFAAiF;IACjF,kFAAkF;IAClF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACrD,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC7D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,IAAI,oBAAoB;YAAE,MAAM;QAC7E,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,SAAS,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/src/update/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../src/update/validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAmCD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,gBAAgB,CA6ElB;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,EAC7D,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,gBAAgB,CAsClB"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../src/update/validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkBH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AA0DD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,gBAAgB,CA0FlB;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,EAC7D,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,gBAAgB,CA+ClB"}

package/dist/src/update/validator.js

@@ -2,9 +2,42 @@
  * Package validator for update compatibility
  * Ensures updates don't break the ecosystem
  */
-import * as semver from 'semver';
+// Inline semver shim — avoids external dependency (semver is not listed in package.json)
+const semver = {
+    valid: (v) => /^\d+\.\d+\.\d+/.test(v || '') ? v : null,
+    major: (v) => parseInt((v || '0').split('.')[0], 10),
+    gt: (a, b) => {
+        const [aMaj, aMin, aPat] = (a || '0').split('.').map(n => parseInt(n, 10) || 0);
+        const [bMaj, bMin, bPat] = (b || '0').split('.').map(n => parseInt(n, 10) || 0);
+        return aMaj !== bMaj ? aMaj > bMaj : aMin !== bMin ? aMin > bMin : aPat > bPat;
+    },
+    lt: (a, b) => {
+        const [aMaj, aMin, aPat] = (a || '0').split('.').map(n => parseInt(n, 10) || 0);
+        const [bMaj, bMin, bPat] = (b || '0').split('.').map(n => parseInt(n, 10) || 0);
+        return aMaj !== bMaj ? aMaj < bMaj : aMin !== bMin ? aMin < bMin : aPat < bPat;
+    },
+};
+// Maximum number of updates accepted in a single validateBulkUpdate call.
+// Without this cap a caller can DoS the validator by passing thousands of
+// update entries — each entry triggers validateUpdate which iterates over
+// COMPATIBILITY_MATRIX and BREAKING_CHANGES.
+const MAX_BULK_UPDATES = 50;
+// Version strings must look like semver (major.minor.patch with optional pre-release)
+// before we use them in string interpolation or comparisons.
+const SEMVER_RE = /^\d+\.\d+\.\d+(-[\w.]+)?(\+[\w.]+)?$/;
+// Package names: scoped (@scope/name) or plain, no shell-special chars.
+const PKG_NAME_RE = /^(@[a-zA-Z0-9][a-zA-Z0-9_.-]*\/)?[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
+function isSafeVersion(v) {
+    return typeof v === 'string' && v.length <= 64 && SEMVER_RE.test(v);
+}
+function isSafePackageName(p) {
+    return typeof p === 'string' && p.length <= 200 && PKG_NAME_RE.test(p);
+}
 // Known compatibility matrix between monomind packages
 const COMPATIBILITY_MATRIX = {
+    '@monomind/cli': {
+        '@monomind/security': { minVersion: '3.0.0-alpha.1' },
+    },
     '@monoes/monomindcli': {
         'monofence-ai': { minVersion: '1.0.0' },
     },
@@ -35,6 +68,18 @@ export function validateUpdate(packageName, fromVersion, toVersion, installedPac
         warnings: [],
         requiredPeerUpdates: [],
     };
+    // Guard inputs: reject untrusted or malformed strings before they flow into
+    // error messages or semver comparisons (which assume well-formed input).
+    if (!isSafePackageName(packageName)) {
+        result.valid = false;
+        result.incompatibilities.push('Invalid package name');
+        return result;
+    }
+    if (!isSafeVersion(fromVersion) || !isSafeVersion(toVersion)) {
+        result.valid = false;
+        result.incompatibilities.push('Invalid version string(s)');
+        return result;
+    }
     // Check if this is a major version bump
     if (semver.valid(fromVersion) && semver.valid(toVersion)) {
         const fromMajor = semver.major(fromVersion);
@@ -93,6 +138,12 @@ export function validateBulkUpdate(updates, currentPackages) {
         warnings: [],
         requiredPeerUpdates: [],
     };
+    // Cap the number of updates to prevent DoS via large arrays
+    if (!Array.isArray(updates) || updates.length > MAX_BULK_UPDATES) {
+        combinedResult.valid = false;
+        combinedResult.incompatibilities.push(`Too many updates: max ${MAX_BULK_UPDATES} allowed per call`);
+        return combinedResult;
+    }
     // Create a simulated state after all updates
     const simulatedPackages = { ...currentPackages };
     for (const update of updates) {

package/dist/src/update/validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../../src/update/validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAejC,uDAAuD;AACvD,MAAM,oBAAoB,GAAyD;IACjF,qBAAqB,EAAE;QACrB,cAAc,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE;KACxC;IACD,UAAU,EAAE;QACV,qBAAqB,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;KAChD;CACF,CAAC;AAEF,oCAAoC;AACpC,MAAM,gBAAgB,GAA6C;IACjE,UAAU,EAAE;QACV,OAAO,EAAE;YACP,sDAAsD;YACtD,mDAAmD;YACnD,4CAA4C;SAC7C;KACF;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,4CAA4C;YAC5C,gCAAgC;SACjC;KACF;CACF,CAAC;AAEF,MAAM,UAAU,cAAc,CAC5B,WAAmB,EACnB,WAAmB,EACnB,SAAiB,EACjB,iBAAyC;IAEzC,MAAM,MAAM,GAAqB;QAC/B,KAAK,EAAE,IAAI;QACX,iBAAiB,EAAE,EAAE;QACrB,QAAQ,EAAE,EAAE;QACZ,mBAAmB,EAAE,EAAE;KACxB,CAAC;IAEF,wCAAwC;IACxC,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAExC,IAAI,OAAO,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,yBAAyB,SAAS,MAAM,OAAO,gCAAgC,CAChF,CAAC;YAEF,mCAAmC;YACnC,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC;YAClE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B,OAAO,GAAG,CAAC,CAAC;gBAC/D,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9D,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAEpD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,wBAAwB;gBACxB,IACE,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;oBAC9B,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,EAC9C,CAAC;oBACD,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAC3B,GAAG,WAAW,IAAI,SAAS,aAAa,OAAO,OAAO,MAAM,CAAC,UAAU,gBAAgB,gBAAgB,GAAG,CAC3G,CAAC;oBACF,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,OAAO,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;oBACrE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACvB,CAAC;gBAED,wBAAwB;gBACxB,IACE,MAAM,CAAC,UAAU;oBACjB,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;oBAC9B,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,EAC9C,CAAC;oBACD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,GAAG,WAAW,IAAI,SAAS,+BAA+B,OAAO,IAAI,gBAAgB,UAAU,MAAM,CAAC,UAAU,GAAG,CACpH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACnE,IAAI,OAAO,KAAK,WAAW;YAAE,SAAS;QAEtC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QAClC,IAAI,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,kEAAkE;YAClE,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxE,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAC3B,GAAG,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,aAAa,WAAW,OAAO,OAAO,CAAC,UAAU,EAAE,CAC5F,CAAC;gBACF,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAA6D,EAC7D,eAAuC;IAEvC,MAAM,cAAc,GAAqB;QACvC,KAAK,EAAE,IAAI;QACX,iBAAiB,EAAE,EAAE;QACrB,QAAQ,EAAE,EAAE;QACZ,mBAAmB,EAAE,EAAE;KACxB,CAAC;IAEF,6CAA6C;IAC7C,MAAM,iBAAiB,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;IAChD,CAAC;IAED,+CAA+C;IAC/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,cAAc,CAC3B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,EAAE,EACT,iBAAiB,CAClB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,cAAc,CAAC,KAAK,GAAG,KAAK,CAAC;QAC/B,CAAC;QAED,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACnE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,cAAc;IACd,cAAc,CAAC,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAClF,cAAc,CAAC,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChE,cAAc,CAAC,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAEtF,OAAO,cAAc,CAAC;AACxB,CAAC"}
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../../src/update/validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,yFAAyF;AACzF,MAAM,MAAM,GAAG;IACb,KAAK,EAAE,CAAC,CAA4B,EAAiB,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI;IAClG,KAAK,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpE,EAAE,EAAE,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;QACpC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACjF,CAAC;IACD,EAAE,EAAE,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;QACpC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACjF,CAAC;CACF,CAAC;AAeF,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,6CAA6C;AAC7C,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,sFAAsF;AACtF,6DAA6D;AAC7D,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,wEAAwE;AACxE,MAAM,WAAW,GAAG,8DAA8D,CAAC;AAEnF,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU;IACnC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,uDAAuD;AACvD,MAAM,oBAAoB,GAAyD;IACjF,eAAe,EAAE;QACf,oBAAoB,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE;KACtD;IACD,qBAAqB,EAAE;QACrB,cAAc,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE;KACxC;IACD,UAAU,EAAE;QACV,qBAAqB,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;KAChD;CACF,CAAC;AAEF,oCAAoC;AACpC,MAAM,gBAAgB,GAA6C;IACjE,UAAU,EAAE;QACV,OAAO,EAAE;YACP,sDAAsD;YACtD,mDAAmD;YACnD,4CAA4C;SAC7C;KACF;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,4CAA4C;YAC5C,gCAAgC;SACjC;KACF;CACF,CAAC;AAEF,MAAM,UAAU,cAAc,CAC5B,WAAmB,EACnB,WAAmB,EACnB,SAAiB,EACjB,iBAAyC;IAEzC,MAAM,MAAM,GAAqB;QAC/B,KAAK,EAAE,IAAI;QACX,iBAAiB,EAAE,EAAE;QACrB,QAAQ,EAAE,EAAE;QACZ,mBAAmB,EAAE,EAAE;KACxB,CAAC;IAEF,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wCAAwC;IACxC,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAExC,IAAI,OAAO,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,yBAAyB,SAAS,MAAM,OAAO,gCAAgC,CAChF,CAAC;YAEF,mCAAmC;YACnC,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC;YAClE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,8BAA8B,OAAO,GAAG,CAAC,CAAC;gBAC/D,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9D,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAEpD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,wBAAwB;gBACxB,IACE,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;oBAC9B,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,EAC9C,CAAC;oBACD,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAC3B,GAAG,WAAW,IAAI,SAAS,aAAa,OAAO,OAAO,MAAM,CAAC,UAAU,gBAAgB,gBAAgB,GAAG,CAC3G,CAAC;oBACF,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,OAAO,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;oBACrE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACvB,CAAC;gBAED,wBAAwB;gBACxB,IACE,MAAM,CAAC,UAAU;oBACjB,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;oBAC9B,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,EAC9C,CAAC;oBACD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,GAAG,WAAW,IAAI,SAAS,+BAA+B,OAAO,IAAI,gBAAgB,UAAU,MAAM,CAAC,UAAU,GAAG,CACpH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACnE,IAAI,OAAO,KAAK,WAAW;YAAE,SAAS;QAEtC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QAClC,IAAI,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,kEAAkE;YAClE,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxE,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAC3B,GAAG,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,aAAa,WAAW,OAAO,OAAO,CAAC,UAAU,EAAE,CAC5F,CAAC;gBACF,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAA6D,EAC7D,eAAuC;IAEvC,MAAM,cAAc,GAAqB;QACvC,KAAK,EAAE,IAAI;QACX,iBAAiB,EAAE,EAAE;QACrB,QAAQ,EAAE,EAAE;QACZ,mBAAmB,EAAE,EAAE;KACxB,CAAC;IAEF,4DAA4D;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACjE,cAAc,CAAC,KAAK,GAAG,KAAK,CAAC;QAC7B,cAAc,CAAC,iBAAiB,CAAC,IAAI,CACnC,yBAAyB,gBAAgB,mBAAmB,CAC7D,CAAC;QACF,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,6CAA6C;IAC7C,MAAM,iBAAiB,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;IAChD,CAAC;IAED,+CAA+C;IAC/C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,cAAc,CAC3B,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,EAAE,EACT,iBAAiB,CAClB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,cAAc,CAAC,KAAK,GAAG,KAAK,CAAC;QAC/B,CAAC;QAED,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACnE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACzE,CAAC;IAED,cAAc;IACd,cAAc,CAAC,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAClF,cAAc,CAAC,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChE,cAAc,CAAC,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAEtF,OAAO,cAAc,CAAC;AACxB,CAAC"}