coolhand-cli 0.11.1 → 0.13.0

package/dist/auto-update/index.js

@@ -0,0 +1,355 @@
+import { spawn } from 'child_process';
+import { readFileSync, realpathSync } from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { isAllowedBaseUrlScheme } from '../base-url.js';
+import { configDir, loadConfig } from '../config.js';
+import { ExitCode } from '../errors.js';
+import { logger } from '../logger.js';
+import { PACKAGE_NAME, PACKAGE_VERSION } from '../version.js';
+import { resolveWrapSpawn } from '../win-spawn.js';
+import { BAKE_PERIOD_MS, compareSemver, parseStable, selectUpdate } from './select.js';
+import { acquireLock, loadState, saveState } from './state.js';
+const DEFAULT_REGISTRY = 'https://registry.npmjs.org';
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 10000;
+const NPM_CONFIG_TIMEOUT_MS = 10000;
+const INSTALL_TIMEOUT_MS = 5 * 60 * 1000;
+/** A failed install blocks retrying the same version this long; transient causes (no `npm` on PATH, offline) shouldn't stick forever. */
+const FAILED_RETRY_MS = 7 * 24 * 60 * 60 * 1000;
+/**
+ * Working directory for every spawn. npm reads a project-level `.npmrc` from the cwd, even for `-g`, so a
+ * cloned repo could point the silent install at its own registry; the home directory only has the user's own config.
+ */
+function neutralCwd() {
+    return os.homedir();
+}
+/** Commands that must never trigger (or announce) an update: the updater itself, the other background job, and passive output. */
+const NO_AUTO_UPDATE = new Set(['__auto-update', '__flush-pending', 'capture-turn', 'update', 'help', 'version']);
+/** Package-manager layouts that own their own global installs; `npm install -g` would create a second copy instead of upgrading this one. */
+const FOREIGN_MANAGERS = ['_npx', '.volta', '.pnpm', 'pnpm', '.yarn', '.bun'];
+/**
+ * True when `scriptPath` looks like a global `npm install -g` of this package:
+ * `<prefix>/lib/node_modules/<pkg>/…` (macOS/Linux, nvm, Homebrew) or `<prefix>/node_modules/<pkg>/…`
+ * under an `npm` directory (Windows). A project-local install (`<project>/node_modules`), `npx` cache,
+ * `npm link` checkout, or another package manager's global dir does not match, so we never touch it.
+ */
+export function isGlobalNpmInstall(scriptPath) {
+    const parts = scriptPath.split(/[\\/]+/);
+    const at = parts.lastIndexOf(PACKAGE_NAME);
+    if (at < 2 || parts[at - 1] !== 'node_modules') {
+        return false;
+    }
+    if (parts.some((p) => FOREIGN_MANAGERS.includes(p.toLowerCase()))) {
+        return false;
+    }
+    const owner = (parts[at - 2] ?? '').toLowerCase();
+    return owner === 'lib' || owner === 'npm';
+}
+function runningScript() {
+    const argv1 = process.argv[1];
+    if (!argv1) {
+        return undefined;
+    }
+    try {
+        return realpathSync(argv1);
+    }
+    catch {
+        return argv1;
+    }
+}
+export function canSelfInstall() {
+    const script = runningScript();
+    return script !== undefined && isGlobalNpmInstall(script);
+}
+/** Set means non-empty and not an explicit "0"/"false", so `CI=false` in a dev shell doesn't disable updates. */
+function envFlag(name) {
+    const v = (process.env[name] ?? '').trim().toLowerCase();
+    return v !== '' && v !== '0' && v !== 'false';
+}
+function optedOutByEnv() {
+    return envFlag('COOLHAND_NO_AUTO_UPDATE') || envFlag('CI');
+}
+/**
+ * The validated `COOLHAND_UPDATE_REGISTRY` override, undefined when unset. A value that is set but rejected
+ * throws rather than falling back to the public registry, which someone using a private mirror may be avoiding.
+ */
+function registryOverride() {
+    const override = process.env.COOLHAND_UPDATE_REGISTRY;
+    if (!override) {
+        return undefined;
+    }
+    try {
+        const url = new URL(override);
+        // Credentials would end up in `npm`'s argv (visible in the process list); auth belongs in .npmrc.
+        if (isAllowedBaseUrlScheme(url) && !url.username && !url.password && !url.search && !url.hash) {
+            return url.href.replace(/\/+$/, '');
+        }
+    }
+    catch {
+        // fall through to the error below
+    }
+    throw new Error('COOLHAND_UPDATE_REGISTRY must be an https:// URL (http:// only for localhost) without credentials, query, or fragment');
+}
+function registryUrl() {
+    return registryOverride() ?? DEFAULT_REGISTRY;
+}
+export async function fetchPackument(fetchFn = fetch) {
+    const res = await fetchFn(`${registryUrl()}/${PACKAGE_NAME}`, {
+        headers: { accept: 'application/json' },
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (!res.ok) {
+        throw new Error(`registry responded ${res.status}`);
+    }
+    return (await res.json());
+}
+/** Newest version that has cleared the bake period and is newer than the running one, or null. */
+export async function findEligibleUpdate(now = Date.now(), fetchFn) {
+    return selectUpdate(await fetchPackument(fetchFn), { current: PACKAGE_VERSION, now });
+}
+/** Value of `npm config get <key>`, or undefined when unset or npm doesn't know the key. */
+function npmConfigValue(key, spawnFn) {
+    return new Promise((resolve) => {
+        const { cmd, spawnArgs, windowsVerbatimArguments } = resolveWrapSpawn('npm', ['config', 'get', key]);
+        try {
+            const child = spawnFn(cmd, spawnArgs, {
+                stdio: ['ignore', 'pipe', 'ignore'],
+                cwd: neutralCwd(),
+                windowsHide: true,
+                timeout: NPM_CONFIG_TIMEOUT_MS,
+                ...(windowsVerbatimArguments ? { windowsVerbatimArguments } : {}),
+            });
+            let out = '';
+            child.stdout?.on('data', (chunk) => {
+                out += chunk.toString();
+            });
+            child.on('error', () => resolve(undefined));
+            child.on('close', () => {
+                const v = out.trim();
+                resolve(v === '' || v === 'undefined' || v === 'null' || v === '0' ? undefined : v);
+            });
+        }
+        catch {
+            resolve(undefined);
+        }
+    });
+}
+async function npmConfigHasBake(spawnFn) {
+    const values = await Promise.all([npmConfigValue('min-release-age', spawnFn), npmConfigValue('before', spawnFn)]);
+    return values.some((v) => v !== undefined);
+}
+/**
+ * `npm install -g <pkg>@<exact version>`; resolves true on a zero exit. Pinned so the bake check is what
+ * gets installed, and `--before` holds every transitive dependency to the same 48-hour bake. If the user's
+ * npm config already sets `min-release-age` or `before`, ours is left off: npm rejects combining them, and
+ * their own bake then covers the dependencies.
+ */
+export async function installVersion(version, stdio = 'ignore', deps = {}) {
+    const spawnFn = deps.spawnFn ?? spawn;
+    // When the version was chosen from an overridden registry, install from that same one so the
+    // bake check and the installed bits agree; otherwise defer to the user's own npm config.
+    // Resolved first so an invalid override fails before any child process starts.
+    const registry = registryOverride();
+    const userBake = await (deps.userHasBake ?? (() => npmConfigHasBake(spawnFn)))();
+    const { cmd, spawnArgs, windowsVerbatimArguments } = resolveWrapSpawn('npm', [
+        'install',
+        '-g',
+        ...(registry ? ['--registry', registry] : []),
+        ...(userBake ? [] : [`--before=${new Date(Date.now() - BAKE_PERIOD_MS).toISOString()}`]),
+        `${PACKAGE_NAME}@${version}`,
+    ]);
+    return new Promise((resolve) => {
+        try {
+            const child = spawnFn(cmd, spawnArgs, {
+                stdio,
+                cwd: neutralCwd(),
+                windowsHide: true,
+                timeout: INSTALL_TIMEOUT_MS,
+                ...(windowsVerbatimArguments ? { windowsVerbatimArguments } : {}),
+            });
+            child.on('error', () => resolve(false));
+            child.on('close', (code) => resolve(code === 0));
+        }
+        catch {
+            resolve(false);
+        }
+    });
+}
+export function manualInstallHint(version) {
+    return `npm install -g ${PACKAGE_NAME}@${version}`;
+}
+/** How to update by hand; softened when this copy isn't a global npm install, where that command would add a second copy. */
+export function updateHint(version) {
+    return canSelfInstall()
+        ? `Run \`${manualInstallHint(version)}\` to update.`
+        : `Update with the package manager you installed it with (for npm: \`${manualInstallHint(version)}\`).`;
+}
+/** Version in the package.json of the install the running script belongs to, or undefined if it can't be read. */
+export function installedVersionOnDisk() {
+    const script = runningScript();
+    if (!script) {
+        return undefined;
+    }
+    for (let dir = path.dirname(script); dir !== path.dirname(dir); dir = path.dirname(dir)) {
+        try {
+            const pkg = JSON.parse(readFileSync(path.join(dir, 'package.json'), 'utf8'));
+            if (pkg.name === PACKAGE_NAME) {
+                return pkg.version;
+            }
+        }
+        catch {
+            // keep walking up
+        }
+    }
+    return undefined;
+}
+/**
+ * Hidden `__auto-update` command, run detached by `maybeAutoUpdate`. Checks the registry and, for a
+ * global npm install, installs the eligible version; otherwise records it so the next launch can
+ * mention it. Network and install failures are swallowed. A version whose install failed is not
+ * retried (a newer one is, and so is that version after a week), so a root-owned prefix doesn't re-run `npm install -g` every day.
+ */
+export async function run(deps = {}) {
+    // Two launches past the daily interval can both spawn this job; only one may touch the global install.
+    const release = await acquireLock();
+    if (!release) {
+        return ExitCode.OK;
+    }
+    try {
+        return await runLocked(deps);
+    }
+    finally {
+        // On Windows an antivirus/indexer can briefly hold the lock file; a stale lock is taken over later anyway.
+        await release().catch(() => undefined);
+    }
+}
+async function runLocked(deps) {
+    const checkedAt = new Date().toISOString();
+    // Fields this job owns; merged into a freshly re-read state at the end, because the install can take
+    // minutes and foreground launches write `notified`/`last_check` in the meantime.
+    const update = {};
+    let found = false;
+    try {
+        const priorFailed = (await loadState()).failed;
+        const target = selectUpdate(await fetchPackument(deps.fetchFn), { current: PACKAGE_VERSION, now: Date.now() });
+        found = true;
+        if (target) {
+            update.available = target;
+            const failedAt = priorFailed ? Date.parse(priorFailed.at) : NaN;
+            if (priorFailed?.version === target && Date.now() - failedAt < FAILED_RETRY_MS) {
+                update.failed = priorFailed;
+            }
+            else if (deps.selfInstall ?? canSelfInstall()) {
+                const ok = await (deps.install ?? installVersion)(target);
+                // Only trust the install if the files for the running copy now say so; npm may have
+                // targeted a different global prefix than the one holding this script.
+                if (ok && (deps.versionOnDisk ?? installedVersionOnDisk)() === target) {
+                    update.installed = target;
+                    delete update.available;
+                }
+                else {
+                    update.failed = { version: target, at: new Date().toISOString() };
+                }
+            }
+        }
+    }
+    catch {
+        // Offline or registry hiccup.
+    }
+    const state = await loadState();
+    state.last_check = checkedAt;
+    if (found) {
+        delete state.available;
+        delete state.failed;
+        Object.assign(state, update);
+    }
+    await saveState(state);
+    return ExitCode.OK;
+}
+function spawnBackgroundUpdate(deps = {}) {
+    const spawnFn = deps.spawnFn ?? spawn;
+    const cliPath = process.argv[1];
+    if (!cliPath) {
+        return;
+    }
+    try {
+        const child = spawnFn(process.execPath, [cliPath, '__auto-update'], {
+            detached: true,
+            stdio: 'ignore',
+            cwd: neutralCwd(),
+            // The child runs from another cwd, so hand it the absolute config dir a relative override would break.
+            env: { ...process.env, COOLHAND_CONFIG_DIR: path.resolve(configDir()) },
+            windowsHide: true,
+        });
+        child.on('error', () => {
+            // Best-effort; the next launch past the interval tries again.
+        });
+        child.unref();
+    }
+    catch {
+        // Same: never let the updater break the command the user asked for.
+    }
+}
+/**
+ * Called at the start of every command. Costs one small file read: it announces a finished or
+ * pending update (once, on stderr) and, at most daily, launches the detached background check.
+ * Quiet under `--json`, in CI, and when opted out (`COOLHAND_NO_AUTO_UPDATE=1` or `auto_update: false`
+ * in config.json). Best-effort — never throws.
+ */
+export async function maybeAutoUpdate(opts, deps = {}) {
+    try {
+        const passive = opts.command === undefined || NO_AUTO_UPDATE.has(opts.command) || opts.command.startsWith('-');
+        if (passive || optedOutByEnv()) {
+            return;
+        }
+        // `run` is a public export: a host program embedding it must not have its own script re-executed.
+        if (!(deps.ownScript ?? installedVersionOnDisk() !== undefined)) {
+            return;
+        }
+        if ((await loadConfig()).auto_update === false) {
+            return;
+        }
+        const now = deps.now ?? Date.now();
+        const state = await loadState();
+        let dirty = false;
+        const current = parseStable(PACKAGE_VERSION);
+        const installed = state.installed ? parseStable(state.installed) : null;
+        if (state.installed && current && installed && compareSemver(current, installed) >= 0) {
+            // Under --json the announcement is deferred (kept) rather than lost, unless it's already stale.
+            if (!opts.json && state.installed === PACKAGE_VERSION) {
+                logger.info(`${PACKAGE_NAME} updated to ${state.installed}.`);
+            }
+            if (!opts.json || state.installed !== PACKAGE_VERSION) {
+                delete state.installed;
+                dirty = true;
+            }
+        }
+        const available = state.available ? parseStable(state.available) : null;
+        if (state.available && current && available && compareSemver(available, current) > 0) {
+            if (!opts.json && state.notified !== state.available) {
+                logger.info(`${PACKAGE_NAME} ${state.available} is available. ${updateHint(state.available)}`);
+                state.notified = state.available;
+                dirty = true;
+            }
+        }
+        const last = state.last_check ? Date.parse(state.last_check) : NaN;
+        // A last_check in the future (clock change, hand-edited file) must not suppress checks indefinitely.
+        const due = Number.isNaN(last) || last > now || now - last >= CHECK_INTERVAL_MS;
+        if (due) {
+            // Stamp before spawning so concurrent launches don't each start a check.
+            state.last_check = new Date(now).toISOString();
+            dirty = true;
+        }
+        if (dirty) {
+            await saveState(state);
+        }
+        if (due) {
+            spawnBackgroundUpdate(deps);
+        }
+    }
+    catch {
+        // Never let the updater break the command the user asked for.
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/auto-update/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auto-update/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAkB,MAAM,aAAa,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAoB,MAAM,YAAY,CAAC;AAEjF,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AACtD,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9C,MAAM,gBAAgB,GAAG,KAAM,CAAC;AAChC,MAAM,qBAAqB,GAAG,KAAM,CAAC;AACrC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,yIAAyI;AACzI,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;GAGG;AACH,SAAS,UAAU;IACjB,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;AACtB,CAAC;AAED,kIAAkI;AAClI,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAElH,6IAA6I;AAC7I,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO,MAAM,KAAK,SAAS,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,iHAAiH;AACjH,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC;AAChD,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,yBAAyB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,kGAAkG;QAClG,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9F,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,uHAAuH,CACxH,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,gBAAgB,EAAE,IAAI,gBAAgB,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAwB,KAAK;IAChE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,WAAW,EAAE,IAAI,YAAY,EAAE,EAAE;QAC5D,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAc,CAAC;AACzC,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAsB;IAC/E,OAAO,YAAY,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;AACxF,CAAC;AAQD,4FAA4F;AAC5F,SAAS,cAAc,CAAC,GAAW,EAAE,OAAqB;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,wBAAwB,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE;gBACpC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,GAAG,EAAE,UAAU,EAAE;gBACjB,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,qBAAqB;gBAC9B,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC,CAAC;YACH,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtF,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAqB;IACnD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,iBAAiB,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,QAAsB,QAAQ,EAC9B,OAAoB,EAAE;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,6FAA6F;IAC7F,yFAAyF;IACzF,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,wBAAwB,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE;QAC3E,SAAS;QACT,IAAI;QACJ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACxF,GAAG,YAAY,IAAI,OAAO,EAAE;KAC7B,CAAC,CAAC;IACH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE;gBACpC,KAAK;gBACL,GAAG,EAAE,UAAU,EAAE;gBACjB,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,kBAAkB;gBAC3B,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,kBAAkB,YAAY,IAAI,OAAO,EAAE,CAAC;AACrD,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,cAAc,EAAE;QACrB,CAAC,CAAC,SAAS,iBAAiB,CAAC,OAAO,CAAC,eAAe;QACpD,CAAC,CAAC,qEAAqE,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC;AAC5G,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwC,CAAC;YACpH,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,OAAO,GAAG,CAAC,OAAO,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAuB,EAAE;IACjD,uGAAuG;IACvG,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,2GAA2G;QAC3G,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAoB;IAC3C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,qGAAqG;IACrG,iFAAiF;IACjF,MAAM,MAAM,GAA4D,EAAE,CAAC;IAC3E,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/G,KAAK,GAAG,IAAI,CAAC;QACb,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;YAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAChE,IAAI,WAAW,EAAE,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,eAAe,EAAE,CAAC;gBAC/E,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC;YAC9B,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,IAAI,cAAc,EAAE,EAAE,CAAC;gBAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC1D,oFAAoF;gBACpF,uEAAuE;gBACvE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,sBAAsB,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;oBACtE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;oBAC1B,OAAO,MAAM,CAAC,SAAS,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,MAAM,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,KAAK,CAAC,UAAU,GAAG,SAAS,CAAC;IAC7B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,SAAS,CAAC;QACvB,OAAO,KAAK,CAAC,MAAM,CAAC;QACpB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC;AAMD,SAAS,qBAAqB,CAAC,OAAkB,EAAE;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE;YAClE,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,QAAQ;YACf,GAAG,EAAE,UAAU,EAAE;YACjB,uGAAuG;YACvG,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE;YACvE,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,8DAA8D;QAChE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAoD,EACpD,OAA0D,EAAE;IAE5D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/G,IAAI,OAAO,IAAI,aAAa,EAAE,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,kGAAkG;QAClG,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,sBAAsB,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,KAAK,CAAC;QAElB,MAAM,OAAO,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,IAAI,KAAK,CAAC,SAAS,IAAI,OAAO,IAAI,SAAS,IAAI,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACtF,gGAAgG;YAChG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;gBACtD,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,eAAe,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;gBACtD,OAAO,KAAK,CAAC,SAAS,CAAC;gBACvB,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,IAAI,KAAK,CAAC,SAAS,IAAI,OAAO,IAAI,SAAS,IAAI,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACrF,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CACT,GAAG,YAAY,IAAI,KAAK,CAAC,SAAS,kBAAkB,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAClF,CAAC;gBACF,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC;gBACjC,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACnE,qGAAqG;QACrG,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,IAAI,IAAI,iBAAiB,CAAC;QAChF,IAAI,GAAG,EAAE,CAAC;YACR,yEAAyE;YACzE,KAAK,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/C,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC"}

package/dist/auto-update/select.d.ts

@@ -0,0 +1,28 @@
+/** A release must have been on the registry at least this long before we install it. */
+export declare const BAKE_PERIOD_MS: number;
+/** The subset of the npm registry packument (`GET /<package>`) that selection needs. */
+export interface Packument {
+    'dist-tags'?: Record<string, string>;
+    time?: Record<string, string>;
+    versions?: Record<string, {
+        deprecated?: string;
+    }>;
+}
+export type Semver = readonly [number, number, number];
+/** Parses `MAJOR.MINOR.PATCH`; returns null for prereleases, build metadata, or anything else. */
+export declare function parseStable(version: string): Semver | null;
+export declare function compareSemver(a: Semver, b: Semver): number;
+export interface SelectOptions {
+    current: string;
+    now: number;
+    bakeMs?: number;
+}
+/**
+ * Pick the version to upgrade to: the highest stable release that is newer than `current`,
+ * has been published for at least the bake period, is not deprecated, and is not above the
+ * registry's `latest` dist-tag. Capping at `latest` means rolling that tag back is enough to
+ * stop a bad release from spreading; a version that was unpublished is no longer in `versions`.
+ * Returns null when nothing qualifies (including when `current` is itself ahead of `latest`).
+ */
+export declare function selectUpdate(packument: Packument, opts: SelectOptions): string | null;
+//# sourceMappingURL=select.d.ts.map

package/dist/auto-update/select.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"select.d.ts","sourceRoot":"","sources":["../../src/auto-update/select.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,eAAO,MAAM,cAAc,QAAsB,CAAC;AAElD,wFAAwF;AACxF,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAED,MAAM,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAIvD,kGAAkG;AAClG,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG1D;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CA0BrF"}

package/dist/auto-update/select.js

@@ -0,0 +1,45 @@
+/** A release must have been on the registry at least this long before we install it. */
+export const BAKE_PERIOD_MS = 48 * 60 * 60 * 1000;
+const STABLE_SEMVER = /^(\d+)\.(\d+)\.(\d+)$/;
+/** Parses `MAJOR.MINOR.PATCH`; returns null for prereleases, build metadata, or anything else. */
+export function parseStable(version) {
+    const m = STABLE_SEMVER.exec(version);
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+export function compareSemver(a, b) {
+    return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+}
+/**
+ * Pick the version to upgrade to: the highest stable release that is newer than `current`,
+ * has been published for at least the bake period, is not deprecated, and is not above the
+ * registry's `latest` dist-tag. Capping at `latest` means rolling that tag back is enough to
+ * stop a bad release from spreading; a version that was unpublished is no longer in `versions`.
+ * Returns null when nothing qualifies (including when `current` is itself ahead of `latest`).
+ */
+export function selectUpdate(packument, opts) {
+    const current = parseStable(opts.current);
+    const latest = parseStable(packument['dist-tags']?.latest ?? '');
+    if (!current || !latest) {
+        return null;
+    }
+    const bakeMs = opts.bakeMs ?? BAKE_PERIOD_MS;
+    let best = null;
+    for (const [version, meta] of Object.entries(packument.versions ?? {})) {
+        const semver = parseStable(version);
+        if (!semver || meta?.deprecated) {
+            continue;
+        }
+        if (compareSemver(semver, current) <= 0 || compareSemver(semver, latest) > 0) {
+            continue;
+        }
+        const published = Date.parse(packument.time?.[version] ?? '');
+        if (Number.isNaN(published) || opts.now - published < bakeMs) {
+            continue;
+        }
+        if (!best || compareSemver(semver, best.semver) > 0) {
+            best = { version, semver };
+        }
+    }
+    return best?.version ?? null;
+}
+//# sourceMappingURL=select.js.map

package/dist/auto-update/select.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"select.js","sourceRoot":"","sources":["../../src/auto-update/select.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAWlD,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C,kGAAkG;AAClG,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,SAAoB,EAAE,IAAmB;IACpE,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAE7C,IAAI,IAAI,GAA+C,IAAI,CAAC;IAC5D,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;AAC/B,CAAC"}

package/dist/auto-update/state.d.ts

@@ -0,0 +1,25 @@
+/** Bookkeeping for the background updater; lives next to config.json. */
+export interface UpdateState {
+    /** ISO time of the last registry check (success or failure) — throttles checks. */
+    last_check?: string;
+    /** Newest eligible version found that we did not install (not a global npm install, or the install failed). */
+    available?: string;
+    /** Version `available` was last announced to the user, so the notice prints once. */
+    notified?: string;
+    /** Version a background `npm install -g` last completed for; announced after the next launch picks it up. */
+    installed?: string;
+    /** Last version we tried and failed to install, with when — that version is not retried; a newer one is. */
+    failed?: {
+        version: string;
+        at: string;
+    };
+}
+export declare function statePath(): string;
+export declare function loadState(): Promise<UpdateState>;
+export declare function saveState(state: UpdateState): Promise<void>;
+/**
+ * Exclusive lock so only one background job (and so one `npm install -g`) runs at a time. Returns a release
+ * function, or null when another job holds it. A lock left by a crashed job is taken over once stale.
+ */
+export declare function acquireLock(): Promise<(() => Promise<void>) | null>;
+//# sourceMappingURL=state.d.ts.map

package/dist/auto-update/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/auto-update/state.ts"],"names":[],"mappings":"AAOA,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+GAA+G;IAC/G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6GAA6G;IAC7G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4GAA4G;IAC5G,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,CA0BtD;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAIjE;AAMD;;;GAGG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CA4BzE"}

package/dist/auto-update/state.js

@@ -0,0 +1,81 @@
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import { atomicWriteFile, configDir } from '../config.js';
+import { parseStable } from './select.js';
+const STATE_FILENAME = 'update-state.json';
+export function statePath() {
+    return path.join(configDir(), STATE_FILENAME);
+}
+export async function loadState() {
+    try {
+        const parsed = JSON.parse(await fs.readFile(statePath(), 'utf8'));
+        const raw = typeof parsed === 'object' && parsed !== null ? parsed : {};
+        const state = {};
+        for (const key of ['last_check', 'notified']) {
+            if (typeof raw[key] === 'string') {
+                state[key] = raw[key];
+            }
+        }
+        // Versions we act on must be plain stable semver; anything else is dropped.
+        for (const key of ['available', 'installed']) {
+            const v = raw[key];
+            if (typeof v === 'string' && parseStable(v)) {
+                state[key] = v;
+            }
+        }
+        const failed = raw.failed;
+        if (typeof failed?.version === 'string' && typeof failed.at === 'string') {
+            state.failed = { version: failed.version, at: failed.at };
+        }
+        return state;
+    }
+    catch {
+        // Missing or corrupt: start fresh. The state only throttles; losing it costs one extra check.
+        return {};
+    }
+}
+export async function saveState(state) {
+    const file = statePath();
+    await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    await atomicWriteFile(file, `${JSON.stringify(state, null, 2)}\n`);
+}
+const LOCK_FILENAME = 'update.lock';
+/** Longer than the install timeout, so a live install's lock is never taken over. */
+const LOCK_STALE_MS = 10 * 60 * 1000;
+/**
+ * Exclusive lock so only one background job (and so one `npm install -g`) runs at a time. Returns a release
+ * function, or null when another job holds it. A lock left by a crashed job is taken over once stale.
+ */
+export async function acquireLock() {
+    const file = path.join(configDir(), LOCK_FILENAME);
+    try {
+        await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+        for (let attempt = 0; attempt < 2; attempt++) {
+            try {
+                await (await fs.open(file, 'wx', 0o600)).close();
+                return () => fs.rm(file, { force: true });
+            }
+            catch (err) {
+                if (err.code !== 'EEXIST') {
+                    return null;
+                }
+                let mtimeMs;
+                try {
+                    mtimeMs = (await fs.stat(file)).mtimeMs;
+                }
+                catch {
+                    continue; // released between open and stat: try to take it
+                }
+                if (Date.now() - mtimeMs < LOCK_STALE_MS) {
+                    return null;
+                }
+                await fs.rm(file, { force: true });
+            }
+        }
+    }
+    catch {
+        // Can't lock (read-only dir, race with release): skip this run rather than risk a double install.
+    }
+    return null;
+}
+//# sourceMappingURL=state.js.map

package/dist/auto-update/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/auto-update/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAgB3C,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,cAAc,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAmC,CAAC;QACpG,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,KAAK,GAAgB,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,CAAU,EAAE,CAAC;YACtD,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACjC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,4EAA4E;QAC5E,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,CAAU,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAwE,CAAC;QAC5F,IAAI,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACzE,KAAK,CAAC,MAAM,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,8FAA8F;QAC9F,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAkB;IAChD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,qFAAqF;AACrF,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;gBACjD,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,iDAAiD;gBAC7D,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,aAAa,EAAE,CAAC;oBACzC,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kGAAkG;IACpG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA6DA,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;CACpD;AAmZD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAgE7F;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAiDpD;AA6xBD,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAwJzD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAsFA,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;CACpD;AA4hBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAgE7F;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAiDpD;AAsnCD,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAiMzD"}