@t2000/cli 0.22.21 → 0.22.23

package/dist/index.js

@@ -20,10 +20,10 @@ import {
   saveKey,
   truncateAddress,
   walletExists
-} from "./chunk-ZNF5QSAT.js";
-import "./chunk-AB65Y674.js";
-import "./chunk-IHPSFXUW.js";
-import "./chunk-3W7OQGNS.js";
+} from "./chunk-RN7Z6TWD.js";
+import "./chunk-V7PXDEKG.js";
+import "./chunk-KHIL2KNW.js";
+import "./chunk-3XUF7GM3.js";
 import {
   __commonJS,
   __require,
@@ -4471,17 +4471,23 @@ function getNestedValue(obj, path) {
   }
   return current;
 }
+var UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function setNestedValue(obj, path, value) {
   const parts = path.split(".");
+  if (parts.some((p) => UNSAFE_KEYS.has(p))) return;
+  const sanitized = parts.map((p) => p.replace(/[^a-zA-Z0-9_]/g, ""));
   let current = obj;
-  for (let i = 0; i < parts.length - 1; i++) {
-    const part = parts[i];
-    if (!(part in current) || typeof current[part] !== "object" || current[part] === null) {
+  for (let i = 0; i < sanitized.length - 1; i++) {
+    const part = sanitized[i];
+    if (!part) return;
+    if (!Object.hasOwn(current, part) || typeof current[part] !== "object" || current[part] === null) {
       current[part] = {};
     }
     current = current[part];
   }
-  current[parts[parts.length - 1]] = value;
+  const key = sanitized[sanitized.length - 1];
+  if (!key) return;
+  current[key] = value;
 }
 function loadConfig() {
   try {
@@ -4607,7 +4613,7 @@ function registerConfig(program3) {
   });
 }
 
-// ../../node_modules/.pnpm/@hono+node-server@1.19.11_hono@4.12.5/node_modules/@hono/node-server/dist/index.mjs
+// ../../node_modules/.pnpm/@hono+node-server@1.19.11_hono@4.12.9/node_modules/@hono/node-server/dist/index.mjs
 import { createServer as createServerHTTP } from "http";
 import { Http2ServerRequest as Http2ServerRequest2 } from "http2";
 import { Http2ServerRequest } from "http2";
@@ -5178,7 +5184,7 @@ var serve = (options, listeningListener) => {
   return server;
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/compose.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
   return (context, next) => {
     let index = -1;
@@ -5222,10 +5228,10 @@ var compose = (middleware, onError, onNotFound) => {
   };
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/request/constants.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/utils/body.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/utils/body.js
 var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
   const headers = request instanceof HonoRequest ? request.raw.headers : request.headers;
@@ -5280,6 +5286,9 @@ var handleParsingAllValues = (form, key, value) => {
   }
 };
 var handleParsingNestedValues = (form, key, value) => {
+  if (/(?:^|\.)__proto__\./.test(key)) {
+    return;
+  }
   let nestedForm = form;
   const keys = key.split(".");
   keys.forEach((key2, index) => {
@@ -5294,7 +5303,7 @@ var handleParsingNestedValues = (form, key, value) => {
   });
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/utils/url.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/utils/url.js
 var splitPath = (path) => {
   const paths = path.split("/");
   if (paths[0] === "") {
@@ -5498,7 +5507,7 @@ var getQueryParams = (url, key) => {
 };
 var decodeURIComponent_ = decodeURIComponent;
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/request.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/request.js
 var tryDecodeURIComponent = (str) => tryDecode(str, decodeURIComponent_);
 var HonoRequest = class {
   /**
@@ -5579,7 +5588,7 @@ var HonoRequest = class {
     return headerData;
   }
   async parseBody(options) {
-    return this.bodyCache.parsedBody ??= await parseBody(this, options);
+    return parseBody(this, options);
   }
   #cachedBody = (key) => {
     const { bodyCache, raw: raw2 } = this;
@@ -5766,7 +5775,7 @@ var HonoRequest = class {
   }
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/utils/html.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/utils/html.js
 var HtmlEscapedCallbackPhase = {
   Stringify: 1,
   BeforeStream: 2,
@@ -5808,7 +5817,7 @@ var resolveCallback = async (str, phase, preserveCallbacks, context, buffer) =>
   }
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/context.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/context.js
 var TEXT_PLAIN = "text/plain; charset=UTF-8";
 var setDefaultContentType = (contentType, headers) => {
   return {
@@ -6215,7 +6224,7 @@ var Context = class {
   };
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/router.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/router.js
 var METHOD_NAME_ALL = "ALL";
 var METHOD_NAME_ALL_LOWERCASE = "all";
 var METHODS = ["get", "post", "put", "delete", "options", "patch"];
@@ -6223,10 +6232,10 @@ var MESSAGE_MATCHER_IS_ALREADY_BUILT = "Can not add a route since the matcher is
 var UnsupportedPathError = class extends Error {
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/utils/constants.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/utils/constants.js
 var COMPOSED_HANDLER = "__COMPOSED_HANDLER";
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/hono-base.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/hono-base.js
 var notFoundHandler = (c) => {
   return c.text("404 Not Found", 404);
 };
@@ -6597,7 +6606,7 @@ var Hono = class _Hono {
   };
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/router/reg-exp-router/matcher.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/router/reg-exp-router/matcher.js
 var emptyParam = [];
 function match(method, path) {
   const matchers = this.buildAllMatchers();
@@ -6618,7 +6627,7 @@ function match(method, path) {
   return match2(method, path);
 }
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/router/reg-exp-router/node.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/router/reg-exp-router/node.js
 var LABEL_REG_EXP_STR = "[^/]+";
 var ONLY_WILDCARD_REG_EXP_STR = ".*";
 var TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
@@ -6726,7 +6735,7 @@ var Node = class _Node {
   }
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/router/reg-exp-router/trie.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/router/reg-exp-router/trie.js
 var Trie = class {
   #context = { varIndex: 0 };
   #root = new Node();
@@ -6782,7 +6791,7 @@ var Trie = class {
   }
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/router/reg-exp-router/router.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/router/reg-exp-router/router.js
 var nullMatcher = [/^$/, [], /* @__PURE__ */ Object.create(null)];
 var wildcardRegExpCache = /* @__PURE__ */ Object.create(null);
 function buildWildcardRegExp(path) {
@@ -6961,7 +6970,7 @@ var RegExpRouter = class {
   }
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/router/smart-router/router.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/router/smart-router/router.js
 var SmartRouter = class {
   name = "SmartRouter";
   #routers = [];
@@ -7016,7 +7025,7 @@ var SmartRouter = class {
   }
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/router/trie-router/node.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/router/trie-router/node.js
 var emptyParams = /* @__PURE__ */ Object.create(null);
 var hasChildren = (children) => {
   for (const _ in children) {
@@ -7191,7 +7200,7 @@ var Node2 = class _Node2 {
   }
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/router/trie-router/router.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/router/trie-router/router.js
 var TrieRouter = class {
   name = "TrieRouter";
   #node;
@@ -7213,7 +7222,7 @@ var TrieRouter = class {
   }
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/hono.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/hono.js
 var Hono2 = class extends Hono {
   /**
    * Creates an instance of the Hono class.
@@ -7228,7 +7237,7 @@ var Hono2 = class extends Hono {
   }
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/middleware/cors/index.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/middleware/cors/index.js
 var cors = (options) => {
   const defaults = {
     origin: "*",
@@ -7243,6 +7252,9 @@ var cors = (options) => {
   const findAllowOrigin = ((optsOrigin) => {
     if (typeof optsOrigin === "string") {
       if (optsOrigin === "*") {
+        if (opts.credentials) {
+          return (origin) => origin || null;
+        }
         return () => optsOrigin;
       } else {
         return (origin) => optsOrigin === origin ? origin : null;
@@ -7277,7 +7289,7 @@ var cors = (options) => {
       set("Access-Control-Expose-Headers", opts.exposeHeaders.join(","));
     }
     if (c.req.method === "OPTIONS") {
-      if (opts.origin !== "*") {
+      if (opts.origin !== "*" || opts.credentials) {
         set("Vary", "Origin");
       }
       if (opts.maxAge != null) {
@@ -7307,7 +7319,7 @@ var cors = (options) => {
       });
     }
     await next();
-    if (opts.origin !== "*") {
+    if (opts.origin !== "*" || opts.credentials) {
       c.header("Vary", "Origin", { append: true });
     }
   };
@@ -7319,7 +7331,7 @@ import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSy
 import { join as join3 } from "path";
 import { homedir as homedir5 } from "os";
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/utils/stream.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/utils/stream.js
 var StreamingApi = class {
   writer;
   encoder;
@@ -7396,7 +7408,7 @@ var StreamingApi = class {
   }
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/helper/streaming/utils.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/helper/streaming/utils.js
 var isOldBunVersion = () => {
   const version = typeof Bun !== "undefined" ? Bun.version : void 0;
   if (version === void 0) {
@@ -7407,7 +7419,7 @@ var isOldBunVersion = () => {
   return result;
 };
 
-// ../../node_modules/.pnpm/hono@4.12.5/node_modules/hono/dist/helper/streaming/sse.js
+// ../../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/helper/streaming/sse.js
 var SSEStreamingApi = class extends StreamingApi {
   constructor(writable, readable) {
     super(writable, readable);
@@ -7860,7 +7872,7 @@ function registerLock(program3) {
   });
   program3.command("unlock").description("Unlock agent \u2014 resume operations").action(async () => {
     try {
-      const { T2000: T20003 } = await import("./dist-IANNA5N7.js");
+      const { T2000: T20003 } = await import("./dist-G5YKLWC5.js");
       const MAX_ATTEMPTS2 = 3;
       let pin;
       for (let attempt = 1; attempt <= MAX_ATTEMPTS2; attempt++) {
@@ -8494,7 +8506,7 @@ function registerMcp(program3) {
   mcp.command("start", { isDefault: true }).description("Start MCP server (stdio transport)").option("--key <path>", "Key file path").action(async (opts) => {
     let mod;
     try {
-      mod = await import("./dist-73ESA7QZ.js");
+      mod = await import("./dist-FDS4MNUV.js");
     } catch {
       console.error(
         "MCP server not installed. Run:\n  npm install -g @t2000/mcp"