blun-king-cli 9.1.588 → 9.1.589

package/CHANGELOG.md

@@ -1,6 +1,6 @@
 # BLUN King Changelog
 
-## 9.1.588
+## 9.1.589
 
 - Bundle reviewed AgentSpine and Translate Native sources with verified update manifests.
 - Preserve the active King profile when loading agent context.

package/bin/update-notice.js

@@ -47,7 +47,7 @@ const SEMVER_PATTERN = new RegExp(
     + `(?:-(${SEMVER_IDENTIFIER}(?:\\.${SEMVER_IDENTIFIER})*))?`
     + '(?:\\+([0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*))?$',
 );
-const MANIFEST_KEYS = Object.freeze([
+const LEGACY_MANIFEST_KEYS = Object.freeze([
   'install',
   'latest',
   'minSupported',
@@ -55,6 +55,29 @@ const MANIFEST_KEYS = Object.freeze([
   'notesUrl',
   'releasedAt',
 ]);
+const RELEASE_NOTES_MANIFEST_KEYS = Object.freeze([
+  'install', 'latest', 'minSupported', 'name', 'notesUrl', 'releaseNotes', 'releasedAt',
+]);
+const MANIFEST_KEYS = Object.freeze([
+  'install', 'integrity', 'latest', 'minSupported', 'name', 'notesUrl', 'releaseNotes', 'releasedAt',
+]);
+
+function parseReleaseNotes(value) {
+  if (!Array.isArray(value) || value.length > 8) return undefined;
+  const notes = [];
+  for (const note of value) {
+    if (!isBoundedText(note, 240)) return undefined;
+    notes.push(note);
+  }
+  return Object.freeze(notes);
+}
+
+function validIntegrity(value) {
+  if (typeof value !== 'string') return false;
+  const match = /^sha512-([A-Za-z0-9+/]+={0,2})$/u.exec(value);
+  if (!match) return false;
+  return Buffer.from(match[1], 'base64').length === 64;
+}
 const ENDPOINT_LIMITS = new Map([
   [REGISTRY_URL, 1024 * 1024],
   [FALLBACK_MANIFEST_URL, 64 * 1024],
@@ -195,8 +218,13 @@ function isIsoTimestamp(value) {
 }
 
 function parseFallbackManifest(value) {
-  const record = exactDataRecord(value, MANIFEST_KEYS);
+  const record = exactDataRecord(value, MANIFEST_KEYS)
+    || exactDataRecord(value, RELEASE_NOTES_MANIFEST_KEYS)
+    || exactDataRecord(value, LEGACY_MANIFEST_KEYS);
   const notesUrl = record ? canonicalOfficialNotesUrl(record.notesUrl) : undefined;
+  const releaseNotes = record && Object.hasOwn(record, 'releaseNotes')
+    ? parseReleaseNotes(record.releaseNotes)
+    : undefined;
   if (!record
     || record.name !== PACKAGE_NAME
     || !parseSemver(record.latest)
@@ -204,6 +232,8 @@ function parseFallbackManifest(value) {
     || compareSemver(record.minSupported, record.latest) === 1
     || !isIsoTimestamp(record.releasedAt)
     || !notesUrl
+    || (Object.hasOwn(record, 'integrity') && !validIntegrity(record.integrity))
+    || (Object.hasOwn(record, 'releaseNotes') && releaseNotes === undefined)
     || !isBoundedText(record.install, 256)) {
     return undefined;
   }
@@ -213,6 +243,8 @@ function parseFallbackManifest(value) {
     minSupported: record.minSupported,
     releasedAt: record.releasedAt,
     notesUrl,
+    ...(Object.hasOwn(record, 'integrity') ? { integrity: record.integrity } : {}),
+    ...(releaseNotes === undefined ? {} : { releaseNotes }),
     install: record.install,
   });
 }
@@ -245,7 +277,9 @@ function resolveEffectiveRelease(currentVersion, registryTags, fallbackManifest)
   if (compareSemver(version, currentVersion) <= 0) return undefined;
 
   if (validFallback && compareSemver(validFallback.latest, version) === 0) {
-    return { channel: 'stable', version, notesUrl: validFallback.notesUrl };
+    return { channel: 'stable', version, notesUrl: validFallback.notesUrl,
+      ...(validFallback.releaseNotes === undefined ? {} : { releaseNotes: validFallback.releaseNotes }),
+    };
   }
   return { channel: 'stable', version };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.588",
+  "version": "9.1.589",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {