inup 1.6.0 → 1.6.2

package/dist/services/http/resizable-semaphore.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResizableSemaphore = void 0;
+/**
+ * A counting semaphore whose limit can change at runtime.
+ *
+ * - `acquire()` resolves immediately if there is headroom, otherwise queues a
+ *   waiter (FIFO) until a `release()` opens a slot.
+ * - `setLimit()` may grow or shrink the limit at any time. Growing wakes as many
+ *   queued waiters as the new headroom allows. Shrinking never aborts in-flight
+ *   holders — it simply stops admitting new ones until natural releases drain
+ *   `inFlight` back below the new limit.
+ * - `release()` is guarded: it only wakes a waiter when `inFlight < limit`. This
+ *   is what makes a shrink actually take effect (an unconditional wake would
+ *   re-admit immediately and ignore the smaller limit).
+ *
+ * Invariant: `inFlight` never exceeds `limit` at the moment of admission. A prior
+ * shrink can leave `inFlight > limit` transiently; no new holder is admitted
+ * until it drains.
+ */
+class ResizableSemaphore {
+    limit;
+    inFlight = 0;
+    waiters = [];
+    constructor(initialLimit) {
+        this.limit = Math.max(1, Math.floor(initialLimit));
+    }
+    getLimit() {
+        return this.limit;
+    }
+    getInFlight() {
+        return this.inFlight;
+    }
+    getWaiterCount() {
+        return this.waiters.length;
+    }
+    setLimit(next) {
+        this.limit = Math.max(1, Math.floor(next));
+        // Growing may have opened headroom for queued waiters.
+        this.drainWaiters();
+    }
+    async acquire() {
+        // `inFlight` is the single authoritative counter and is incremented exactly
+        // once per admission, synchronously at the moment admission is decided —
+        // either here (fast path) or in `drainWaiters` (when a slot frees up). A
+        // woken waiter must NOT increment again, or a concurrent fast-path acquire
+        // reading a stale count could over-admit past the limit.
+        if (this.inFlight < this.limit) {
+            this.inFlight++;
+            return;
+        }
+        await new Promise((resolve) => this.waiters.push(resolve));
+    }
+    release() {
+        this.inFlight--;
+        this.drainWaiters();
+    }
+    /**
+     * Wakes queued waiters while there is headroom, incrementing `inFlight` for
+     * each as it is admitted so the count stays authoritative and synchronous.
+     */
+    drainWaiters() {
+        while (this.inFlight < this.limit && this.waiters.length > 0) {
+            const next = this.waiters.shift();
+            this.inFlight++;
+            next();
+        }
+    }
+}
+exports.ResizableSemaphore = ResizableSemaphore;
+//# sourceMappingURL=resizable-semaphore.js.map

package/dist/services/http/retry.js

@@ -1,10 +1,32 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTransientNetworkError = exports.isRetryableStatus = exports.sleep = void 0;
+exports.isTransientNetworkError = exports.parseRetryAfterMs = exports.isCongestionStatus = exports.isRetryableStatus = exports.sleep = void 0;
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 exports.sleep = sleep;
 const isRetryableStatus = (statusCode) => statusCode === 408 || statusCode === 429 || statusCode >= 500;
 exports.isRetryableStatus = isRetryableStatus;
+// Registry explicitly signaling congestion: the highest-quality back-off signal.
+const isCongestionStatus = (statusCode) => statusCode === 429 || statusCode === 503;
+exports.isCongestionStatus = isCongestionStatus;
+// Parse a Retry-After header (delta-seconds or HTTP-date) into milliseconds.
+// Returns null when absent or unparseable.
+const parseRetryAfterMs = (header, now = Date.now()) => {
+    if (header === undefined)
+        return null;
+    const value = (Array.isArray(header) ? header[0] : header)?.toString().trim();
+    if (!value)
+        return null;
+    const asSeconds = Number(value);
+    if (Number.isFinite(asSeconds)) {
+        return asSeconds >= 0 ? Math.round(asSeconds * 1000) : null;
+    }
+    const asDate = Date.parse(value);
+    if (Number.isFinite(asDate)) {
+        return Math.max(0, asDate - now);
+    }
+    return null;
+};
+exports.parseRetryAfterMs = parseRetryAfterMs;
 const isTransientNetworkError = (error) => {
     if (!(error instanceof Error)) {
         return false;

package/dist/services/npm-registry.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fetchPackageVersions = fetchPackageVersions;
 exports.clearPackageCache = clearPackageCache;
-exports.closeRegistryPool = closeRegistryPool;
 const undici_1 = require("undici");
 const node_zlib_1 = require("node:zlib");
 const node_util_1 = require("node:util");
@@ -13,27 +12,41 @@ const config_1 = require("../config");
 const version_1 = require("../utils/version");
 const retry_1 = require("./http/retry");
 const inflight_1 = require("./http/inflight");
+const resizable_semaphore_1 = require("./http/resizable-semaphore");
+const adaptive_controller_1 = require("./http/adaptive-controller");
+const etag_store_1 = require("./http/etag-store");
 const inFlightLookups = new inflight_1.InflightMap();
 const registryOrigin = new URL(config_1.NPM_REGISTRY_URL).origin;
 const registryPathPrefix = new URL(config_1.NPM_REGISTRY_URL).pathname.replace(/\/$/, '');
-// Few connections + many requests per connection = maximum keep-alive reuse.
-// No per-request timeouts: correctness matters more than speed for a CLI that
-// runs on demand. Slow responses are tolerated; only true errors cause retry.
+// Connection count is kept == the adaptive controller's ceiling (POOL_CONNECTIONS)
+// so the controller is never silently throttled below its chosen limit. Idle
+// keep-alive connections are cheap.
+//
+// `headersTimeout` is intentionally non-zero (unlike the rest, where we tolerate
+// slow bodies): a stalled connection that never sends headers would otherwise be
+// consumed forever and stay invisible to the completion-based adaptive
+// controller. With a headers timeout, a stall surfaces as a transient error the
+// controller can react to (and retry handles). `bodyTimeout` stays 0 — large
+// packuments legitimately stream slowly.
 const registryPool = new undici_1.Pool(registryOrigin, {
-    connections: 6,
+    connections: config_1.POOL_CONNECTIONS,
     pipelining: 1,
     keepAliveTimeout: 30_000,
     keepAliveMaxTimeout: 600_000,
-    headersTimeout: 0,
+    headersTimeout: 30_000,
     bodyTimeout: 0,
     connectTimeout: 15_000,
     allowH2: false,
 });
 const MAX_REGISTRY_ATTEMPTS = 3;
 const RETRY_BACKOFF_MS = [500, 1500, 3000];
-async function getFreshPackageData(packageName, currentVersion) {
+// Fixed concurrency used when adaptive is disabled (INUP_ADAPTIVE=0, the A/B
+// control arm). Matches the production caller (PackageDetector) so the fixed path
+// reproduces the legacy behavior exactly.
+const DEFAULT_FIXED_CONCURRENCY = 10;
+async function getFreshPackageData(packageName, currentVersion, onAttempt) {
     const cacheKey = `${packageName}@${currentVersion ?? ''}`;
-    return inFlightLookups.dedupe(cacheKey, () => fetchPackageFromRegistry(packageName));
+    return inFlightLookups.dedupe(cacheKey, () => fetchPackageFromRegistry(packageName, onAttempt));
 }
 const encodeRegistryPath = (packageName) => {
     const encodedName = packageName.startsWith('@')
@@ -42,20 +55,40 @@ const encodeRegistryPath = (packageName) => {
     return `${registryPathPrefix}/${encodedName}`;
 };
 async function attemptRegistryFetch(path) {
+    const startedAt = Date.now();
+    // Conditional request: if we have a stored ETag for this packument, ask the
+    // registry to validate it. Unchanged → 304 (no body) and we reuse stored data.
+    // This still hits the registry every run, so data is never served stale.
+    const cached = (0, etag_store_1.readEtag)(path);
     try {
+        const requestHeaders = {
+            accept: 'application/vnd.npm.install-v1+json',
+            'accept-encoding': 'gzip, deflate, br',
+        };
+        if (cached) {
+            requestHeaders['if-none-match'] = cached.etag;
+        }
         const { statusCode, headers, body } = await registryPool.request({
             path,
             method: 'GET',
-            headers: {
-                accept: 'application/vnd.npm.install-v1+json',
-                'accept-encoding': 'gzip, deflate, br',
-            },
-            headersTimeout: 0,
+            headers: requestHeaders,
+            headersTimeout: 30_000,
             bodyTimeout: 0,
             blocking: false,
         });
+        // Registry confirmed our cached copy is current — reuse it, skip the download.
+        if (statusCode === 304 && cached) {
+            await body.dump().catch(() => undefined);
+            return { kind: 'success', data: cached.data, latencyMs: Date.now() - startedAt };
+        }
         if (statusCode < 200 || statusCode >= 300) {
             await body.dump().catch(() => undefined);
+            if ((0, retry_1.isCongestionStatus)(statusCode)) {
+                return {
+                    kind: 'congested',
+                    retryAfterMs: (0, retry_1.parseRetryAfterMs)(headers['retry-after']),
+                };
+            }
             if ((0, retry_1.isRetryableStatus)(statusCode)) {
                 return { kind: 'retryable' };
             }
@@ -79,7 +112,18 @@ async function attemptRegistryFetch(path) {
         else {
             decoded = raw;
         }
-        return { kind: 'success', data: (0, version_1.parseVersions)(decoded.toString('utf8')) };
+        const data = (0, version_1.parseVersions)(decoded.toString('utf8'));
+        // Persist the ETag for next run's conditional request.
+        const etagHeader = headers['etag'];
+        const etag = Array.isArray(etagHeader) ? etagHeader[0] : etagHeader;
+        if (etag) {
+            (0, etag_store_1.writeEtag)(path, etag.toString(), data);
+        }
+        return {
+            kind: 'success',
+            data,
+            latencyMs: Date.now() - startedAt,
+        };
     }
     catch (error) {
         if ((0, retry_1.isTransientNetworkError)(error)) {
@@ -90,24 +134,28 @@ async function attemptRegistryFetch(path) {
         return { kind: 'transient' };
     }
 }
-async function fetchFromRegistryWithRetries(path) {
+async function fetchFromRegistryWithRetries(path, onAttempt) {
     let lastOutcome = { kind: 'transient' };
     for (let attempt = 0; attempt < MAX_REGISTRY_ATTEMPTS; attempt++) {
         const outcome = await attemptRegistryFetch(path);
+        onAttempt?.(outcome);
         if (outcome.kind === 'success' || outcome.kind === 'not-found') {
             return outcome;
         }
         lastOutcome = outcome;
         if (attempt < MAX_REGISTRY_ATTEMPTS - 1) {
-            const backoff = RETRY_BACKOFF_MS[Math.min(attempt, RETRY_BACKOFF_MS.length - 1)];
+            // Honor Retry-After on congestion; otherwise exponential backoff. These
+            // sleeps are deliberately NOT timed into the controller's latency EWMA.
+            const congestedWait = outcome.kind === 'congested' && outcome.retryAfterMs !== null ? outcome.retryAfterMs : null;
+            const backoff = congestedWait ?? RETRY_BACKOFF_MS[Math.min(attempt, RETRY_BACKOFF_MS.length - 1)];
             await (0, retry_1.sleep)(backoff);
         }
     }
     return lastOutcome;
 }
-async function fetchPackageFromRegistry(packageName) {
+async function fetchPackageFromRegistry(packageName, onAttempt) {
     const path = encodeRegistryPath(packageName);
-    const outcome = await fetchFromRegistryWithRetries(path);
+    const outcome = await fetchFromRegistryWithRetries(path, onAttempt);
     if (outcome.kind === 'success') {
         return outcome.data;
     }
@@ -119,29 +167,48 @@ async function fetchPackageFromRegistry(packageName) {
  * Fetches version data for a list of packages from the npm registry.
  *
  * Concurrency model:
- * - `maxConcurrency` is a global cap on in-flight fetches at any moment.
- *   It doesn't interact with batch size — batches exist only to group
- *   emissions for the UI.
- * - No per-request timeouts: slow responses are allowed to finish. Real
- *   network errors are retried with exponential backoff; after the retry
- *   budget is exhausted the package is reported as unavailable
- *   (`latestVersion: 'unknown'`). A result is never silently dropped due to
- *   slowness.
+ * - A single resizable semaphore caps in-flight fetches. Package names are
+ *   pulled from a work queue and dispatched as slots free up (a lazy pump),
+ *   rather than pre-sliced into fixed batches.
+ * - `adaptive` (default true) enables an AIMD controller that ramps the limit to
+ *   the ceiling on a healthy link and backs off on congestion (429/503) or
+ *   errors. With `adaptive:false` the limit is fixed at `maxConcurrency` (the A/B
+ *   control arm), reproducing the legacy fixed path.
+ * - Tiny runs (<= ceil packages) skip the controller and run at a fixed
+ *   `min(ceil, count)` so they never crawl up from the floor and lose to fixed.
+ * - No body timeout: slow responses finish. Real network errors and header
+ *   stalls are retried with backoff; after the retry budget is exhausted the
+ *   package is reported unavailable (`latestVersion: 'unknown'`).
+ * - Unchanged packuments are revalidated via ETag (304), skipping re-download.
  *
  * Callbacks:
- * - `onBatchReady` fires once a whole emission batch has resolved, in
- *   original batch order.
+ * - `onBatchReady` fires once an emission window has resolved, in original order.
+ *   Emission windows are fixed-size groupings for UI progress only; they do not
+ *   gate concurrency.
+ * - `onControlTick` (optional) reports each adaptive control decision for
+ *   instrumentation.
  */
 async function fetchPackageVersions(packageNames, options = {}) {
     const packageData = new Map();
-    if (packageNames.length === 0) {
+    const total = packageNames.length;
+    if (total === 0) {
         return packageData;
     }
-    const batchSizes = options.batchSizes && options.batchSizes.length > 0
-        ? options.batchSizes.map((size) => Math.max(1, size))
-        : [Math.max(1, options.batchSize ?? 25)];
-    const maxConcurrency = Math.max(1, options.maxConcurrency ?? 10);
-    const total = packageNames.length;
+    const adaptive = options.adaptive ?? true;
+    // `maxConcurrency` is the fixed cap used only when adaptive is off; it never
+    // caps the adaptive start (the controller smart-starts near the work size and
+    // ramps to the ceiling, which beats a low fixed start on large runs).
+    const fixedConcurrency = Math.max(1, options.maxConcurrency ?? DEFAULT_FIXED_CONCURRENCY);
+    const controller = adaptive && adaptive_controller_1.AdaptiveController.shouldControl(total)
+        ? new adaptive_controller_1.AdaptiveController(total, options.onControlTick)
+        : null;
+    const initialLimit = controller
+        ? controller.getLimit()
+        : adaptive
+            ? Math.min(config_1.POOL_CONNECTIONS, total) // too small to control: smart fixed start
+            : fixedConcurrency;
+    const semaphore = new resizable_semaphore_1.ResizableSemaphore(initialLimit);
+    // --- emission ordering (unchanged contract) ---------------------------------
     let completedCount = 0;
     const pendingEmissions = new Map();
     let nextEmitIndex = 0;
@@ -153,68 +220,110 @@ async function fetchPackageVersions(packageNames, options = {}) {
             nextEmitIndex++;
         }
     };
-    // Global semaphore: `maxConcurrency` is the total in-flight cap across
-    // all batches. Batches don't gate concurrency — only emission order.
-    let inFlight = 0;
-    const waiters = [];
-    const acquire = async () => {
-        if (inFlight < maxConcurrency) {
-            inFlight++;
-            return;
+    // Emission windows group results for UI progress only (decoupled from
+    // concurrency). Sizes come from `batchSizes` (a sequence, last value repeats)
+    // or a uniform `batchSize`. We precompute, per package index, which window it
+    // belongs to and its position within that window, so a window can flush as soon
+    // as all its items resolve — preserving original order via `flushPending`.
+    const windowSizes = options.batchSizes && options.batchSizes.length > 0
+        ? options.batchSizes.map((size) => Math.max(1, size))
+        : [Math.max(1, options.batchSize ?? 25)];
+    const windowIdByIndex = new Array(total);
+    const itemIndexByIndex = new Array(total);
+    const windowRemaining = [];
+    {
+        let cursorIndex = 0;
+        let windowId = 0;
+        while (cursorIndex < total) {
+            const size = windowSizes[Math.min(windowId, windowSizes.length - 1)];
+            const end = Math.min(cursorIndex + size, total);
+            windowRemaining[windowId] = end - cursorIndex;
+            for (let i = cursorIndex; i < end; i++) {
+                windowIdByIndex[i] = windowId;
+                itemIndexByIndex[i] = i - cursorIndex;
+            }
+            cursorIndex = end;
+            windowId++;
         }
-        await new Promise((resolve) => waiters.push(resolve));
-        inFlight++;
-    };
-    const release = () => {
-        inFlight--;
-        const next = waiters.shift();
-        if (next)
-            next();
+    }
+    const windowResults = windowRemaining.map(() => []);
+    // --- per-attempt observer ---------------------------------------------------
+    // Feeds the adaptive controller AND (optionally) reports per-package latency
+    // for diagnostics. Built per package so the timing callback knows the name.
+    const observerFor = (packageName) => {
+        if (!controller && !options.onPackageTiming)
+            return undefined;
+        return (outcome) => {
+            if (outcome.kind === 'success') {
+                controller?.record('success', outcome.latencyMs);
+                options.onPackageTiming?.(packageName, outcome.latencyMs);
+            }
+            else if (outcome.kind === 'congested') {
+                const next = controller?.record('congested');
+                if (next != null)
+                    semaphore.setLimit(next);
+            }
+            else if (outcome.kind === 'retryable') {
+                controller?.record('retryable');
+            }
+            else if (outcome.kind === 'transient') {
+                controller?.record('transient');
+            }
+        };
     };
-    const batchPromises = [];
-    let batchStart = 0;
-    let batchIndex = 0;
-    while (batchStart < packageNames.length) {
-        const batchSize = batchSizes[Math.min(batchIndex, batchSizes.length - 1)];
-        const batchNames = packageNames.slice(batchStart, batchStart + batchSize);
-        const capturedBatchIndex = batchIndex;
-        const batchResults = new Array(batchNames.length);
-        const batchPromise = Promise.all(batchNames.map(async (packageName, itemIndex) => {
-            await acquire();
-            try {
-                const data = await getFreshPackageData(packageName, options.currentVersions?.get(packageName));
-                packageData.set(packageName, data);
-                completedCount++;
-                batchResults[itemIndex] = {
-                    packageName,
-                    data,
-                    completed: completedCount,
-                    total,
-                    batchIndex: capturedBatchIndex,
-                    itemIndex,
-                };
+    // --- worker: pull from the queue until exhausted ----------------------------
+    let cursor = 0;
+    const runOne = async (index) => {
+        const packageName = packageNames[index];
+        await semaphore.acquire();
+        try {
+            const data = await getFreshPackageData(packageName, options.currentVersions?.get(packageName), observerFor(packageName));
+            packageData.set(packageName, data);
+            completedCount++;
+            const w = windowIdByIndex[index];
+            const itemIndex = itemIndexByIndex[index];
+            // Index by position (not push) so items keep their original in-window order
+            // even when they resolve out of order.
+            windowResults[w][itemIndex] = {
+                packageName,
+                data,
+                completed: completedCount,
+                total,
+                batchIndex: w,
+                itemIndex,
+            };
+            if (--windowRemaining[w] === 0) {
+                pendingEmissions.set(w, windowResults[w]);
+                flushPending();
             }
-            finally {
-                release();
+            if (controller) {
+                const next = controller.maybeTick();
+                if (next !== null)
+                    semaphore.setLimit(next);
             }
-        })).then(() => {
-            pendingEmissions.set(capturedBatchIndex, batchResults.filter(Boolean));
-            flushPending();
-        });
-        batchPromises.push(batchPromise);
-        batchStart += batchSize;
-        batchIndex++;
+        }
+        finally {
+            semaphore.release();
+        }
+    };
+    // The pump: keep enough workers running to saturate the (possibly growing)
+    // limit. We dispatch all indices as promises but each one waits on the
+    // semaphore before doing work, so the semaphore — not the dispatch loop —
+    // enforces the limit. Growing the limit lets queued acquirers through.
+    const workers = [];
+    while (cursor < total) {
+        workers.push(runOne(cursor));
+        cursor++;
     }
-    await Promise.all(batchPromises);
+    await Promise.all(workers);
     return packageData;
 }
 /**
- * Retained for backward compatibility. Registry responses are fresh-by-default.
+ * Clears the in-run in-flight dedupe map. Only meaningful within a single run
+ * (the map collapses duplicate concurrent lookups); registry data itself is
+ * never cached in memory across runs. Used by tests to isolate fetches.
  */
 function clearPackageCache() {
     inFlightLookups.clear();
 }
-async function closeRegistryPool() {
-    await registryPool.close();
-}
 //# sourceMappingURL=npm-registry.js.map

package/dist/utils/debug-logger.js

@@ -5,6 +5,7 @@ exports.enableDebugLogging = enableDebugLogging;
 exports.isDebugEnabled = isDebugEnabled;
 exports.getDebugLogPath = getDebugLogPath;
 const fs_1 = require("fs");
+const os_1 = require("os");
 const path_1 = require("path");
 let _enabled = false;
 let _logFile = null;
@@ -18,7 +19,13 @@ function getLogFile() {
     if (!_logFile) {
         const d = new Date();
         const dateStr = `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
-        _logFile = (0, path_1.join)(`inup-debug-${dateStr}.log`);
+        // Write to the OS temp dir (matches the path advertised in --help), not the
+        // current working directory — a debug log must never litter the user's repo.
+        const dir = (0, path_1.join)((0, os_1.tmpdir)(), 'inup');
+        if (!(0, fs_1.existsSync)(dir)) {
+            (0, fs_1.mkdirSync)(dir, { recursive: true });
+        }
+        _logFile = (0, path_1.join)(dir, `inup-debug-${dateStr}.log`);
         // Write a header so the file is easy to identify
         (0, fs_1.writeFileSync)(_logFile, `=== inup debug log started at ${timestamp()} ===\n`, { flag: 'a' });
     }

package/dist/utils/index.js

@@ -23,6 +23,7 @@ __exportStar(require("./exec"), exports);
 __exportStar(require("./git"), exports);
 __exportStar(require("./version"), exports);
 __exportStar(require("./debug-logger"), exports);
+__exportStar(require("./local-env"), exports);
 __exportStar(require("./color"), exports);
 __exportStar(require("./engines"), exports);
 __exportStar(require("./manifest"), exports);

package/dist/utils/local-env.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadInupLocalEnv = loadInupLocalEnv;
+const fs_1 = require("fs");
+const path_1 = require("path");
+/**
+ * Loads a gitignored `.env.local` from the inup repo itself (NOT the cwd), so
+ * developer-only toggles can be "set once" and apply to every `inup` run in any
+ * project — without committing anything or touching the shell profile.
+ *
+ * The repo is located by walking UP from this file's own directory until a
+ * `.env.local` is found, so it works regardless of nesting depth (src/utils when
+ * type-stripped, dist/utils when compiled) and resolves the inup repo even when
+ * the binary is linked and invoked from a different project directory.
+ *
+ * Fully optional and best-effort: if the file is absent or unreadable, nothing
+ * happens and the run proceeds exactly as before. Existing process env always
+ * wins, so a one-off `INUP_PERF=0 inup` still overrides the file.
+ */
+const ENV_FILE_NAME = '.env.local';
+/** Walk upward from this file's dir to find the .env.local; null if none. */
+function findEnvFile() {
+    let dir = __dirname;
+    const root = (0, path_1.parse)(dir).root;
+    // Cap the walk so a missing file can never loop unbounded.
+    for (let i = 0; i < 12; i++) {
+        const candidate = (0, path_1.join)(dir, ENV_FILE_NAME);
+        if ((0, fs_1.existsSync)(candidate))
+            return candidate;
+        if (dir === root)
+            break;
+        dir = (0, path_1.dirname)(dir);
+    }
+    return null;
+}
+/** Parse a minimal KEY=VALUE env file. Ignores blanks and `#` comments. */
+function parseEnv(contents) {
+    const out = {};
+    for (const rawLine of contents.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = line.slice(0, eq).trim();
+        if (!key)
+            continue;
+        let value = line.slice(eq + 1).trim();
+        // Strip a single layer of matching quotes.
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        out[key] = value;
+    }
+    return out;
+}
+/**
+ * Apply `<inup-repo>/.env.local` into process.env. Existing values are never
+ * overwritten (real env / one-off overrides win). Returns the path if loaded.
+ */
+function loadInupLocalEnv() {
+    try {
+        const file = findEnvFile();
+        if (!file)
+            return null;
+        const parsed = parseEnv((0, fs_1.readFileSync)(file, 'utf8'));
+        for (const [key, value] of Object.entries(parsed)) {
+            if (process.env[key] === undefined) {
+                process.env[key] = value;
+            }
+        }
+        return file;
+    }
+    catch {
+        // Best-effort: never let a dev convenience break a real run.
+        return null;
+    }
+}
+//# sourceMappingURL=local-env.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inup",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "Interactive dependency upgrader for npm, yarn, pnpm & bun. Zero-config, monorepo-ready. Upgrade-interactive for every package manager.",
   "main": "dist/index.js",
   "bin": {
@@ -43,20 +43,20 @@
     "README.md"
   ],
   "devDependencies": {
-    "@types/node": "^25.9.1",
+    "@types/node": "^25.9.4",
     "@types/semver": "^7.7.1",
-    "@vitest/coverage-v8": "^4.1.7",
-    "prettier": "^3.8.3",
+    "@vitest/coverage-v8": "^4.1.9",
+    "prettier": "^3.9.4",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.9"
   },
   "dependencies": {
     "chalk": "^5.6.2",
     "commander": "^15.0.0",
     "env-paths": "^4.0.0",
     "nanospinner": "^1.2.2",
-    "semver": "^7.8.1",
-    "undici": "^8.3.0"
+    "semver": "^7.8.5",
+    "undici": "^8.5.0"
   },
   "engines": {
     "node": ">=20.0.0"