@superblocksteam/vite-plugin-file-sync 2.0.149 → 2.0.150-next.0

package/dist/ai-service/types.js

@@ -90,6 +90,7 @@ export class NpmInstallBlocked extends Error {
     npmErrorCode;
     summary;
     hasAnyRegistryConfigured;
+    findings;
     constructor(details) {
         // Defense-in-depth: scrub auth secrets and prompt-injection structure at
         // construction time so this class is safe to instantiate from anywhere,
@@ -108,6 +109,23 @@ export class NpmInstallBlocked extends Error {
         const safeSummary = details.summary
             ? safeField(details.summary)
             : undefined;
+        const safeFindings = details.findings?.map((finding) => ({
+            advisoryId: safeField(finding.advisoryId),
+            ...(finding.details !== undefined
+                ? { details: safeField(finding.details) }
+                : {}),
+            kind: finding.kind,
+            package: safeField(finding.package),
+            ...(finding.severity !== undefined
+                ? { severity: safeField(finding.severity) }
+                : {}),
+            ...(finding.suggestedVersion !== undefined
+                ? { suggestedVersion: safeField(finding.suggestedVersion) }
+                : {}),
+            ...(finding.summary !== undefined
+                ? { summary: safeField(finding.summary) }
+                : {}),
+        }));
         // Render packages compactly for the Error.message string. Empty array
         // falls back to a generic phrase so the message still parses cleanly.
         const packagesPhrase = safePackages.length > 0 ? safePackages.join(", ") : "requested packages";
@@ -123,6 +141,7 @@ export class NpmInstallBlocked extends Error {
         this.npmErrorCode = safeNpmErrorCode;
         this.summary = safeSummary;
         this.hasAnyRegistryConfigured = details.hasAnyRegistryConfigured;
+        this.findings = safeFindings;
         Object.setPrototypeOf(this, new.target.prototype);
     }
     /** Plain-object projection suitable for inclusion in a tool result. Never
@@ -139,6 +158,7 @@ export class NpmInstallBlocked extends Error {
             npmErrorCode: this.npmErrorCode,
             summary: this.summary,
             hasAnyRegistryConfigured: this.hasAnyRegistryConfigured,
+            findings: this.findings,
         };
     }
 }

package/dist/ai-service/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/ai-service/types.ts"],"names":[],"mappings":"AA+HA,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAE9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AA8DD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,CACL,KAAK;QACH,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;SACtE,OAAO,CAAC,+BAA+B,EAAE,cAAc,CAAC;SACxD,OAAO,CAAC,yBAAyB,EAAE,cAAc,CAAC;SAClD,OAAO,CAAC,kBAAkB,EAAE,cAAc,CAAC;QAC5C,wEAAwE;QACxE,kEAAkE;QAClE,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;SACjE,OAAO,CACN,gFAAgF,EAChF,cAAc,CACf;QACD,mEAAmE;QACnE,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,aAAa;SACZ,OAAO,CACN,uDAAuD,EACvD,eAAe,CAChB,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,gEAAgE;IAChE,uEAAuE;IACvE,4EAA4E;IAC5E,gCAAgC;IAChC,0FAA0F;IAC1F,OAAO,KAAK,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAkDD;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,MAAM,CAA0B;IAChC,SAAS,CAA8B;IACvC,QAAQ,CAAW;IACnB,YAAY,CAAU;IACtB,UAAU,CAAU;IACpB,YAAY,CAAU;IACtB,OAAO,CAAU;IACjB,wBAAwB,CAAW;IAE5C,YAAY,OAAiC;QAC3C,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,8CAA8C;QAC9C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAC1C,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY;YAC3C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC;YACjC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY;YAC3C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC;YACjC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO;YACjC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;YAC5B,CAAC,CAAC,SAAS,CAAC;QAEd,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,cAAc,GAClB,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAE3E,KAAK,CACH,wBAAwB,OAAO,CAAC,MAAM,SAAS,cAAc,EAAE;YAC7D,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,gBAAgB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACrD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,gBAAgB,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,gBAAgB,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC3B,IAAI,CAAC,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;QAEjE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED;;sCAEkC;IAClC,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;SACxD,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/ai-service/types.ts"],"names":[],"mappings":"AAqJA,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAE9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AA+FD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,CACL,KAAK;QACH,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;SACtE,OAAO,CAAC,+BAA+B,EAAE,cAAc,CAAC;SACxD,OAAO,CAAC,yBAAyB,EAAE,cAAc,CAAC;SAClD,OAAO,CAAC,kBAAkB,EAAE,cAAc,CAAC;QAC5C,wEAAwE;QACxE,kEAAkE;QAClE,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;SACjE,OAAO,CACN,gFAAgF,EAChF,cAAc,CACf;QACD,mEAAmE;QACnE,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,aAAa;SACZ,OAAO,CACN,uDAAuD,EACvD,eAAe,CAChB,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,gEAAgE;IAChE,uEAAuE;IACvE,4EAA4E;IAC5E,gCAAgC;IAChC,0FAA0F;IAC1F,OAAO,KAAK,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAuDD;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,MAAM,CAA0B;IAChC,SAAS,CAA8B;IACvC,QAAQ,CAAW;IACnB,YAAY,CAAU;IACtB,UAAU,CAAU;IACpB,YAAY,CAAU;IACtB,OAAO,CAAU;IACjB,wBAAwB,CAAW;IACnC,QAAQ,CAA8B;IAE/C,YAAY,OAAiC;QAC3C,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,8CAA8C;QAC9C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAC1C,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY;YAC3C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC;YACjC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY;YAC3C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC;YACjC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO;YACjC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;YAC5B,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvD,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;gBAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;YACnC,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE;gBAC3D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;gBAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;gBACzC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC,CAAC;QAEJ,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,cAAc,GAClB,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAE3E,KAAK,CACH,wBAAwB,OAAO,CAAC,MAAM,SAAS,cAAc,EAAE;YAC7D,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,gBAAgB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACrD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,gBAAgB,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,gBAAgB,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC3B,IAAI,CAAC,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;QACjE,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC;QAE7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED;;sCAEkC;IAClC,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;YACvD,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;CACF"}

package/dist/migration/restructure.js

@@ -46,7 +46,7 @@ const BACKUP_TO_CLIENT_MAPPINGS = [
  *
  * `router.tsx` / `App.tsx` / `root.tsx` are critical here: the shadcn-demo-app
  * legacy template registers real user routes via `router.tsx`, and the
- * fullstack template's default router only wires up a blank `Page1` stub.
+ * fullstack template's default router only wires up a blank `Home` stub.
  * Without porting the user's router, the migrated `client/pages/*` files
  * exist on disk but are unrouted, so the live-edit tree looks like a
  * default/empty app and the editor falls through to the v2 UI.

package/dist/migration-templates/app-fullstack/client/pages/{Page1 → Home}/index.tsx

@@ -1,3 +1,3 @@
-export default function Page1Component() {
+export default function HomePage() {
   return <div className="min-h-svh overflow-auto"></div>;
 }

package/dist/migration-templates/app-fullstack/client/router.tsx

@@ -13,7 +13,7 @@ export const router = createBrowserRouter([
         path: "/",
         index: true,
         lazy: () =>
-          import("./pages/Page1/index.js").then((mod) => {
+          import("./pages/Home/index.js").then((mod) => {
             const Component = mod.default;
             return { Component };
           }),

package/dist/migration-templates/app-fullstack/package.json

@@ -65,13 +65,13 @@
     "eslint-plugin-react-hooks": "^7.0.1",
     "eslint-plugin-react-refresh": "^0.5.0",
     "globals": "^17.3.0",
-    "postcss": "^8.5.10",
+    "postcss": "^8.5.18",
     "tailwindcss": "^4.1.12",
     "tsx": "^4.0.0",
     "tw-animate-css": "^1.3.7",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.59.2",
-    "vite": "6.4.2"
+    "vite": "6.4.3"
   },
   "overrides": {
     "esbuild": "^0.27.0",

package/dist/npm/apply-package-json-substitutions.d.ts

@@ -0,0 +1,19 @@
+import type { Logger } from "../util/logger.js";
+/** Declared deps/devDeps/optionalDeps (not peers) with their ranges. */
+export declare function readDeclaredDependencies(appRootDirPath: string): Promise<Array<{
+    name: string;
+    version?: string;
+}>>;
+/**
+ * Rewrite already-declared specs; never add packages. Returns names rewritten.
+ * Fail-open on FS/parse errors so a bad package.json cannot block install.
+ */
+export declare function applyPackageJsonSubstitutions(args: {
+    appRootDirPath: string;
+    logger?: Pick<Logger, "debug" | "info" | "warn">;
+    substitutions: Array<{
+        name: string;
+        toVersion: string;
+    }>;
+}): Promise<string[]>;
+//# sourceMappingURL=apply-package-json-substitutions.d.ts.map

package/dist/npm/apply-package-json-substitutions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-package-json-substitutions.d.ts","sourceRoot":"","sources":["../../src/npm/apply-package-json-substitutions.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAyBhD,wEAAwE;AACxE,wBAAsB,wBAAwB,CAC5C,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA2BpD;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC;IACjD,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgEpB"}

package/dist/npm/apply-package-json-substitutions.js

@@ -0,0 +1,108 @@
+// Mode 2 installs have no argv to rewrite — safe versions go into package.json.
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+// peers describe host requirements, not what this install resolves
+const DEPENDENCY_BUCKETS = [
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+];
+/** Keep `^`/`~`; anything else becomes an exact pin. */
+function applyDeclaredRangeOperator(declared, safeVersion) {
+    const operator = /^[\^~]/.exec(declared.trim())?.[0] ?? "";
+    return `${operator}${safeVersion}`;
+}
+/** Declared deps/devDeps/optionalDeps (not peers) with their ranges. */
+export async function readDeclaredDependencies(appRootDirPath) {
+    let raw;
+    try {
+        raw = await readFile(join(appRootDirPath, "package.json"), "utf8");
+    }
+    catch {
+        return [];
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    if (parsed == null || typeof parsed !== "object")
+        return [];
+    const manifest = parsed;
+    const declared = [];
+    const seen = new Set();
+    for (const bucket of DEPENDENCY_BUCKETS) {
+        const deps = manifest[bucket];
+        if (deps == null || typeof deps !== "object")
+            continue;
+        for (const [name, version] of Object.entries(deps)) {
+            if (typeof version !== "string" || seen.has(name))
+                continue;
+            seen.add(name);
+            declared.push({ name, version });
+        }
+    }
+    return declared;
+}
+/**
+ * Rewrite already-declared specs; never add packages. Returns names rewritten.
+ * Fail-open on FS/parse errors so a bad package.json cannot block install.
+ */
+export async function applyPackageJsonSubstitutions(args) {
+    const { appRootDirPath, logger, substitutions } = args;
+    if (substitutions.length === 0)
+        return [];
+    try {
+        const packageJsonPath = join(appRootDirPath, "package.json");
+        let raw;
+        try {
+            raw = await readFile(packageJsonPath, "utf8");
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return [];
+            throw err;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            logger?.warn(`[npm] Could not parse package.json to apply security substitutions: ${err instanceof Error ? err.message : String(err)}`);
+            return [];
+        }
+        const byName = new Map(substitutions.map((entry) => [entry.name, entry.toVersion]));
+        const rewritten = [];
+        for (const bucket of DEPENDENCY_BUCKETS) {
+            const deps = parsed[bucket];
+            if (deps == null || typeof deps !== "object")
+                continue;
+            for (const [name, declared] of Object.entries(deps)) {
+                const safeVersion = byName.get(name);
+                if (safeVersion === undefined || typeof declared !== "string")
+                    continue;
+                const next = applyDeclaredRangeOperator(declared, safeVersion);
+                if (next === declared)
+                    continue;
+                deps[name] = next;
+                rewritten.push(name);
+            }
+        }
+        if (rewritten.length === 0)
+            return [];
+        await writeFile(packageJsonPath, `${JSON.stringify(parsed, null, 2)}\n`, "utf8");
+        logger?.info("[pkg-security][mode2] upgraded declared packages", {
+            rewritten,
+        });
+        return rewritten;
+    }
+    catch (error) {
+        logger?.warn("[pkg-security] could not apply package.json security upgrades; installing declared versions", {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return [];
+    }
+}
+//# sourceMappingURL=apply-package-json-substitutions.js.map

package/dist/npm/apply-package-json-substitutions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-package-json-substitutions.js","sourceRoot":"","sources":["../../src/npm/apply-package-json-substitutions.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAWjC,mEAAmE;AACnE,MAAM,kBAAkB,GAAG;IACzB,cAAc;IACd,iBAAiB;IACjB,sBAAsB;CACd,CAAC;AAEX,wDAAwD;AACxD,SAAS,0BAA0B,CACjC,QAAgB,EAChB,WAAmB;IAEnB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,OAAO,GAAG,QAAQ,GAAG,WAAW,EAAE,CAAC;AACrC,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,cAAsB;IAEtB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAqB,CAAC;IACvC,MAAM,QAAQ,GAA8C,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC5D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,IAInD;IACC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IACvD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QAC7D,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAChE,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,IAAI,CACV,uEACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAC5D,CAAC;QACF,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACvD,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ;oBAAE,SAAS;gBACxE,MAAM,IAAI,GAAG,0BAA0B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBAC/D,IAAI,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAChC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;gBAClB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEtC,MAAM,SAAS,CACb,eAAe,EACf,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACtC,MAAM,CACP,CAAC;QACF,MAAM,EAAE,IAAI,CAAC,kDAAkD,EAAE;YAC/D,SAAS;SACV,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,IAAI,CACV,6FAA6F,EAC7F;YACE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/policy-gate-callback-mapper.d.ts

@@ -3,7 +3,7 @@ type PolicyGateMode = "advisory" | "blocking";
 /** Matches POST /api/v1/policy-gates/review-runs/state finding objects (server writer). */
 interface PolicyGateCallbackFinding {
     blocking: boolean;
-    category: "external_policy" | "misconfiguration" | "security_agent" | "secret" | "sensitive_data" | "vulnerability";
+    category: "external_policy" | "misconfiguration" | "security_agent" | "secret" | "sensitive_data" | "static_analysis" | "vulnerability";
     clarkRemediable: boolean;
     confidence?: "high" | "low" | "medium" | null;
     evidenceJson?: Record<string, unknown>;

package/dist/policy-gate-callback-mapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-gate-callback-mapper.d.ts","sourceRoot":"","sources":["../src/policy-gate-callback-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAEjG,KAAK,cAAc,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9C,2FAA2F;AAC3F,UAAU,yBAAyB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EACJ,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,QAAQ,GACR,gBAAgB,GAChB,eAAe,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1D,WAAW,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,KAAK,YAAY,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,YAAY,CAAC,UAAU,CAAC,GAAG,MAAM,GAC/C,yBAAyB,CAAC,UAAU,CAAC,CAiBvC;AAMD,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,YAAY,EAAE,EACxB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,cAAc,GACzB,yBAAyB,EAAE,CAsC7B"}
+{"version":3,"file":"policy-gate-callback-mapper.d.ts","sourceRoot":"","sources":["../src/policy-gate-callback-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAEjG,KAAK,cAAc,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9C,2FAA2F;AAC3F,UAAU,yBAAyB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EACJ,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,QAAQ,GACR,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC1D,WAAW,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,KAAK,YAAY,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,YAAY,CAAC,UAAU,CAAC,GAAG,MAAM,GAC/C,yBAAyB,CAAC,UAAU,CAAC,CAiBvC;AAMD,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,YAAY,EAAE,EACxB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,cAAc,GACzB,yBAAyB,EAAE,CAsC7B"}

package/dist/policy-gate-callback-mapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-gate-callback-mapper.js","sourceRoot":"","sources":["../src/policy-gate-callback-mapper.ts"],"names":[],"mappings":"AA8BA,MAAM,UAAU,kBAAkB,CAChC,aAAgD;IAEhD,QAAQ,aAAa,EAAE,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,WAAW,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,eAAe,CAAC;QACzB,KAAK,eAAe;YAClB,OAAO,gBAAgB,CAAC;QAC1B,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,kBAAkB,CAAC;QAC5B,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb;YACE,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC;AACD,yEAAyE;AACzE,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,uDAAuD;AACvD,MAAM,UAAU,oCAAoC,CAClD,QAAwB,EACxB,YAAoB,EACpB,UAA0B;IAE1B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,UAAU,KAAK,UAAU,CAAC;QAC3C,MAAM,QAAQ,GAA4B;YACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;SAChC,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxC,CAAC;QAED,MAAM,eAAe,GAA8B;YACjD,QAAQ;YACR,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC9C,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B;YACD,WAAW,EAAE,GAAG,YAAY,IAAI,OAAO,CAAC,EAAE,EAAE;YAC5C,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,aAAa,EAAE,CAAC,QAAQ,CAAC;YACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,eAAe;YAC5B,UAAU,EAAE,2BAA2B;YACvC,gBAAgB,EAAE,OAAO,CAAC,WAAW;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC;QACF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,eAAe,CAAC,mBAAmB,GAAG;gBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"policy-gate-callback-mapper.js","sourceRoot":"","sources":["../src/policy-gate-callback-mapper.ts"],"names":[],"mappings":"AA+BA,MAAM,UAAU,kBAAkB,CAChC,aAAgD;IAEhD,QAAQ,aAAa,EAAE,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,WAAW,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,eAAe,CAAC;QACzB,KAAK,eAAe;YAClB,OAAO,gBAAgB,CAAC;QAC1B,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,kBAAkB,CAAC;QAC5B,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb;YACE,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC;AACD,yEAAyE;AACzE,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,uDAAuD;AACvD,MAAM,UAAU,oCAAoC,CAClD,QAAwB,EACxB,YAAoB,EACpB,UAA0B;IAE1B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,UAAU,KAAK,UAAU,CAAC;QAC3C,MAAM,QAAQ,GAA4B;YACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;SAChC,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxC,CAAC;QAED,MAAM,eAAe,GAA8B;YACjD,QAAQ;YACR,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC9C,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B;YACD,WAAW,EAAE,GAAG,YAAY,IAAI,OAAO,CAAC,EAAE,EAAE;YAC5C,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,aAAa,EAAE,CAAC,QAAQ,CAAC;YACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,eAAe;YAC5B,UAAU,EAAE,2BAA2B;YACvC,gBAAgB,EAAE,OAAO,CAAC,WAAW;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC;QACF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,eAAe,CAAC,mBAAmB,GAAG;gBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superblocksteam/vite-plugin-file-sync",
-  "version": "2.0.149",
+  "version": "2.0.150-next.0",
   "keywords": [
     "vite-plugin"
   ],
@@ -117,13 +117,13 @@
     "yaml": "^2.8.3",
     "yauzl": "^3.2.0",
     "zod": "3.25.76",
-    "@superblocksteam/clark": "2.0.149",
-    "@superblocksteam/ai-service-templates": "2.0.149",
-    "@superblocksteam/library-shared": "2.0.149",
-    "@superblocksteam/shared": "0.9603.3",
-    "@superblocksteam/sdk-api": "2.0.149",
-    "@superblocksteam/telemetry": "2.0.149",
-    "@superblocksteam/util": "2.0.149"
+    "@superblocksteam/ai-service-templates": "2.0.150-next.0",
+    "@superblocksteam/clark": "2.0.150-next.0",
+    "@superblocksteam/sdk-api": "2.0.150-next.0",
+    "@superblocksteam/library-shared": "2.0.150-next.0",
+    "@superblocksteam/shared": "0.9604.0",
+    "@superblocksteam/telemetry": "2.0.150-next.0",
+    "@superblocksteam/util": "2.0.150-next.0"
   },
   "devDependencies": {
     "@dotenvx/dotenvx": "^1.59.1",