inup 1.6.5 → 1.6.7

package/dist/shared/pnpm-catalogs.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PnpmCatalogs = exports.DEFAULT_CATALOG = exports.PNPM_WORKSPACE_FILE = void 0;
+exports.isCatalogReference = isCatalogReference;
+exports.writeCatalogUpdates = writeCatalogUpdates;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const yaml_1 = require("yaml");
+const debug_logger_1 = require("./debug-logger");
+exports.PNPM_WORKSPACE_FILE = 'pnpm-workspace.yaml';
+/** Name pnpm gives the top-level `catalog:` map (also addressable as `catalogs.default`). */
+exports.DEFAULT_CATALOG = 'default';
+/** `catalog:` (default) or `catalog:<name>` — the pnpm catalog protocol. */
+function isCatalogReference(version) {
+    return version.startsWith('catalog:');
+}
+/**
+ * The catalog definitions of the nearest `pnpm-workspace.yaml`.
+ *
+ * Catalogs (pnpm ≥ 9.5) hoist shared version ranges out of the member
+ * package.json files: a dependency declared as `"react": "catalog:"` gets its
+ * actual range from this file's `catalog:` map (or `catalogs.<name>` for
+ * `"catalog:<name>"` references). Upgrading such a dependency therefore means
+ * editing pnpm-workspace.yaml, not the referencing package.json.
+ */
+class PnpmCatalogs {
+    path;
+    catalogs;
+    constructor(
+    /** Absolute path of the pnpm-workspace.yaml the catalogs were read from. */
+    path, 
+    /** catalog name → (package name → range). */
+    catalogs) {
+        this.path = path;
+        this.catalogs = catalogs;
+    }
+    /**
+     * Load catalogs from the nearest pnpm-workspace.yaml at or above `startDir`.
+     * Returns null when there is no workspace file, it is unreadable, or it
+     * defines no catalogs — a broken file must never break a scan.
+     */
+    static load(startDir) {
+        const path = findPnpmWorkspaceFile(startDir);
+        if (!path)
+            return null;
+        try {
+            const raw = (0, yaml_1.parse)((0, node_fs_1.readFileSync)(path, 'utf8'));
+            if (!raw || typeof raw !== 'object')
+                return null;
+            const catalogs = new Map();
+            const addCatalog = (name, value) => {
+                if (!value || typeof value !== 'object' || Array.isArray(value))
+                    return;
+                const entries = new Map();
+                for (const [pkg, range] of Object.entries(value)) {
+                    if (typeof range === 'string')
+                        entries.set(pkg, range);
+                }
+                if (entries.size > 0)
+                    catalogs.set(name, entries);
+            };
+            addCatalog(exports.DEFAULT_CATALOG, raw.catalog);
+            if (raw.catalogs && typeof raw.catalogs === 'object' && !Array.isArray(raw.catalogs)) {
+                for (const [name, value] of Object.entries(raw.catalogs)) {
+                    addCatalog(name, value);
+                }
+            }
+            if (catalogs.size === 0)
+                return null;
+            return new PnpmCatalogs(path, catalogs);
+        }
+        catch (error) {
+            debug_logger_1.debugLog.warn('PnpmCatalogs', `failed to parse ${path}: ${error}`);
+            return null;
+        }
+    }
+    /**
+     * Resolve a `catalog:` / `catalog:<name>` version specifier for `packageName`
+     * to the range declared in the workspace file, or null when the reference
+     * points at a catalog (or entry) that does not exist.
+     */
+    resolve(packageName, versionSpecifier) {
+        if (!isCatalogReference(versionSpecifier))
+            return null;
+        const name = versionSpecifier.slice('catalog:'.length).trim() || exports.DEFAULT_CATALOG;
+        const range = this.catalogs.get(name)?.get(packageName);
+        return range === undefined ? null : { catalog: name, range };
+    }
+    /** Every entry declared in the given catalog (empty for unknown catalogs). */
+    entriesOf(catalogName) {
+        const entries = this.catalogs.get(catalogName);
+        if (!entries)
+            return [];
+        return Array.from(entries, ([name, range]) => ({ name, range }));
+    }
+}
+exports.PnpmCatalogs = PnpmCatalogs;
+/**
+ * Write new ranges for catalog entries back into pnpm-workspace.yaml.
+ *
+ * Edits go through the yaml Document API so comments, key order, and the
+ * formatting of untouched nodes survive the round-trip. Entries that no longer
+ * exist in the file (edited since the scan) are skipped, never invented.
+ */
+function writeCatalogUpdates(workspaceFilePath, updates) {
+    const raw = (0, node_fs_1.readFileSync)(workspaceFilePath, 'utf8');
+    const doc = (0, yaml_1.parseDocument)(raw);
+    for (const update of updates) {
+        // The default catalog may live under `catalog:` or `catalogs.default:`.
+        const candidatePaths = update.catalog === exports.DEFAULT_CATALOG
+            ? [
+                ['catalog', update.name],
+                ['catalogs', exports.DEFAULT_CATALOG, update.name],
+            ]
+            : [['catalogs', update.catalog, update.name]];
+        const keyPath = candidatePaths.find((path) => doc.hasIn(path));
+        if (!keyPath) {
+            debug_logger_1.debugLog.warn('PnpmCatalogs', `catalog entry ${update.catalog}:${update.name} no longer exists in ${workspaceFilePath} — skipping`);
+            continue;
+        }
+        doc.setIn(keyPath, update.range);
+    }
+    (0, node_fs_1.writeFileSync)(workspaceFilePath, doc.toString());
+}
+/** Nearest pnpm-workspace.yaml at or above `startDir`, or null. */
+function findPnpmWorkspaceFile(startDir) {
+    let dir = (0, node_path_1.resolve)(startDir);
+    for (;;) {
+        const candidate = (0, node_path_1.join)(dir, exports.PNPM_WORKSPACE_FILE);
+        if ((0, node_fs_1.existsSync)(candidate))
+            return candidate;
+        const parent = (0, node_path_1.dirname)(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+//# sourceMappingURL=pnpm-catalogs.js.map

package/dist/{services → shared/registry}/npm-registry.js

@@ -9,15 +9,18 @@ const gunzipAsync = (0, node_util_1.promisify)(node_zlib_1.gunzip);
 const inflateAsync = (0, node_util_1.promisify)(node_zlib_1.inflate);
 const brotliDecompressAsync = (0, node_util_1.promisify)(node_zlib_1.brotliDecompress);
 const config_1 = require("../config");
-const version_1 = require("../utils/version");
-const retry_1 = require("./http/retry");
-const inflight_1 = require("./http/inflight");
-const resizable_semaphore_1 = require("./http/resizable-semaphore");
-const adaptive_controller_1 = require("./http/adaptive-controller");
-const etag_store_1 = require("./http/etag-store");
+const registry_config_1 = require("./registry-config");
+const versions_1 = require("../versions");
+const retry_1 = require("../http/retry");
+const inflight_1 = require("../http/inflight");
+const resizable_semaphore_1 = require("../http/resizable-semaphore");
+const adaptive_controller_1 = require("../http/adaptive-controller");
+const etag_store_1 = require("../http/etag-store");
 const inFlightLookups = new inflight_1.InflightMap();
-const registryOrigin = new URL(config_1.NPM_REGISTRY_URL).origin;
-const registryPathPrefix = new URL(config_1.NPM_REGISTRY_URL).pathname.replace(/\/$/, '');
+// One pool per registry origin: scoped packages may resolve to different
+// registries (`@scope:registry` in .npmrc), and each origin keeps its own
+// keep-alive connections. Most runs still touch a single origin.
+//
 // Connection count is kept == the adaptive controller's ceiling (POOL_CONNECTIONS)
 // so the controller is never silently throttled below its chosen limit. Idle
 // keep-alive connections are cheap.
@@ -28,16 +31,24 @@ const registryPathPrefix = new URL(config_1.NPM_REGISTRY_URL).pathname.replace(/
 // controller. With a headers timeout, a stall surfaces as a transient error the
 // controller can react to (and retry handles). `bodyTimeout` stays 0 — large
 // packuments legitimately stream slowly.
-const registryPool = new undici_1.Pool(registryOrigin, {
-    connections: config_1.POOL_CONNECTIONS,
-    pipelining: 1,
-    keepAliveTimeout: 30_000,
-    keepAliveMaxTimeout: 600_000,
-    headersTimeout: 30_000,
-    bodyTimeout: 0,
-    connectTimeout: 15_000,
-    allowH2: false,
-});
+const poolByOrigin = new Map();
+function poolFor(origin) {
+    let pool = poolByOrigin.get(origin);
+    if (!pool) {
+        pool = new undici_1.Pool(origin, {
+            connections: config_1.POOL_CONNECTIONS,
+            pipelining: 1,
+            keepAliveTimeout: 30_000,
+            keepAliveMaxTimeout: 600_000,
+            headersTimeout: 30_000,
+            bodyTimeout: 0,
+            connectTimeout: 15_000,
+            allowH2: false,
+        });
+        poolByOrigin.set(origin, pool);
+    }
+    return pool;
+}
 const MAX_REGISTRY_ATTEMPTS = 3;
 const RETRY_BACKOFF_MS = [500, 1500, 3000];
 // Fixed concurrency used when adaptive is disabled (INUP_ADAPTIVE=0, the A/B
@@ -48,27 +59,32 @@ async function getFreshPackageData(packageName, currentVersion, onAttempt) {
     const cacheKey = `${packageName}@${currentVersion ?? ''}`;
     return inFlightLookups.dedupe(cacheKey, () => fetchPackageFromRegistry(packageName, onAttempt));
 }
-const encodeRegistryPath = (packageName) => {
+const encodeRegistryPath = (packageName, pathPrefix) => {
     const encodedName = packageName.startsWith('@')
         ? `@${encodeURIComponent(packageName.slice(1).split('/')[0])}/${encodeURIComponent(packageName.slice(packageName.indexOf('/') + 1))}`
         : encodeURIComponent(packageName);
-    return `${registryPathPrefix}/${encodedName}`;
+    return `${pathPrefix}/${encodedName}`;
 };
-async function attemptRegistryFetch(path) {
+async function attemptRegistryFetch(target, path) {
     const startedAt = Date.now();
     // Conditional request: if we have a stored ETag for this packument, ask the
     // registry to validate it. Unchanged → 304 (no body) and we reuse stored data.
     // This still hits the registry every run, so data is never served stale.
-    const cached = (0, etag_store_1.readEtag)(path);
+    // Keys are origin-qualified so two registries can never collide on a path.
+    const cacheKey = `${target.origin}${path}`;
+    const cached = (0, etag_store_1.readEtag)(cacheKey);
     try {
         const requestHeaders = {
             accept: 'application/vnd.npm.install-v1+json',
             'accept-encoding': 'gzip, deflate, br',
         };
+        if (target.authHeader) {
+            requestHeaders['authorization'] = target.authHeader;
+        }
         if (cached) {
             requestHeaders['if-none-match'] = cached.etag;
         }
-        const { statusCode, headers, body } = await registryPool.request({
+        const { statusCode, headers, body } = await poolFor(target.origin).request({
             path,
             method: 'GET',
             headers: requestHeaders,
@@ -112,12 +128,12 @@ async function attemptRegistryFetch(path) {
         else {
             decoded = raw;
         }
-        const data = (0, version_1.parseVersions)(decoded.toString('utf8'));
+        const data = (0, versions_1.parseVersions)(decoded.toString('utf8'));
         // Persist the ETag for next run's conditional request.
         const etagHeader = headers['etag'];
         const etag = Array.isArray(etagHeader) ? etagHeader[0] : etagHeader;
         if (etag) {
-            (0, etag_store_1.writeEtag)(path, etag.toString(), data);
+            (0, etag_store_1.writeEtag)(cacheKey, etag.toString(), data);
         }
         return {
             kind: 'success',
@@ -134,10 +150,10 @@ async function attemptRegistryFetch(path) {
         return { kind: 'transient' };
     }
 }
-async function fetchFromRegistryWithRetries(path, onAttempt) {
+async function fetchFromRegistryWithRetries(target, path, onAttempt) {
     let lastOutcome = { kind: 'transient' };
     for (let attempt = 0; attempt < MAX_REGISTRY_ATTEMPTS; attempt++) {
-        const outcome = await attemptRegistryFetch(path);
+        const outcome = await attemptRegistryFetch(target, path);
         onAttempt?.(outcome);
         if (outcome.kind === 'success' || outcome.kind === 'not-found') {
             return outcome;
@@ -154,8 +170,11 @@ async function fetchFromRegistryWithRetries(path, onAttempt) {
     return lastOutcome;
 }
 async function fetchPackageFromRegistry(packageName, onAttempt) {
-    const path = encodeRegistryPath(packageName);
-    const outcome = await fetchFromRegistryWithRetries(path, onAttempt);
+    // Scoped packages may live on a different registry (with credentials) than
+    // unscoped ones — resolved from the npm config chain, memoized per scope.
+    const target = (0, registry_config_1.registryTargetFor)(packageName);
+    const path = encodeRegistryPath(packageName, target.pathPrefix);
+    const outcome = await fetchFromRegistryWithRetries(target, path, onAttempt);
     if (outcome.kind === 'success') {
         return outcome.data;
     }

package/dist/shared/registry/registry-config.js

@@ -0,0 +1,76 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scopeOfPackage = scopeOfPackage;
+exports.registryTargetFor = registryTargetFor;
+exports.clearRegistryTargetCache = clearRegistryTargetCache;
+const registry_auth_token_1 = __importDefault(require("registry-auth-token"));
+const registry_url_1 = __importDefault(require("registry-auth-token/registry-url"));
+const config_1 = require("../config");
+// The submodule's .d.ts declares the second parameter as `{ npmrc?: … }`, but the
+// implementation consumes the plain npmrc key/value record directly.
+const getRegistryUrl = registry_url_1.default;
+/** Scope of a package name (`@scope/pkg` → `@scope`), or undefined when unscoped. */
+function scopeOfPackage(packageName) {
+    if (!packageName.startsWith('@'))
+        return undefined;
+    const slash = packageName.indexOf('/');
+    return slash > 0 ? packageName.slice(0, slash) : undefined;
+}
+// Config files are re-read on every resolution inside registry-auth-token, so
+// memoize per scope: one resolution per distinct scope per process.
+const targetByScope = new Map();
+function registryTargetFor(packageName, npmrc) {
+    const scope = scopeOfPackage(packageName) ?? '';
+    if (!npmrc) {
+        const cached = targetByScope.get(scope);
+        if (cached)
+            return cached;
+    }
+    const target = resolveTarget(scope || undefined, npmrc);
+    if (!npmrc) {
+        targetByScope.set(scope, target);
+    }
+    return target;
+}
+function resolveTarget(scope, npmrc) {
+    let registryHref = config_1.NPM_REGISTRY_URL;
+    try {
+        registryHref = getRegistryUrl(scope, npmrc);
+    }
+    catch {
+        // Unreadable npm config must never break a run — fall back to the public registry.
+    }
+    let parsed;
+    try {
+        parsed = new URL(registryHref);
+    }
+    catch {
+        parsed = new URL(config_1.NPM_REGISTRY_URL);
+    }
+    let authHeader;
+    try {
+        const auth = (0, registry_auth_token_1.default)(parsed.href, { recursive: true, ...(npmrc ? { npmrc } : {}) });
+        // registry-auth-token stringifies an unset ${ENV_VAR} reference into the
+        // literal "undefined". Sending `Bearer undefined` guarantees a 401 where an
+        // anonymous request might succeed, so treat it as no credentials.
+        if (auth?.token && auth.token !== 'undefined') {
+            authHeader = `${auth.type} ${auth.token}`;
+        }
+    }
+    catch {
+        // No credentials (or unreadable config) → anonymous requests, matching npm.
+    }
+    return {
+        origin: parsed.origin,
+        pathPrefix: parsed.pathname.replace(/\/$/, ''),
+        authHeader,
+    };
+}
+/** Test helper: forget memoized resolutions so npmrc overrides take effect. */
+function clearRegistryTargetCache() {
+    targetByScope.clear();
+}
+//# sourceMappingURL=registry-config.js.map

package/dist/{services → shared/registry}/version-checker.js

@@ -35,21 +35,32 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkForUpdate = checkForUpdate;
 exports.checkForUpdateAsync = checkForUpdateAsync;
-const child_process_1 = require("child_process");
 const semver = __importStar(require("semver"));
 const config_1 = require("../config");
+/** Cap for the self-update check; it must never hold up an interactive session. */
+const UPDATE_CHECK_TIMEOUT_MS = 5000;
 /**
- * Check if the current package version is outdated compared to npm registry
+ * Check if the current package version is outdated compared to npm registry.
+ *
+ * One small registry request (`{registry}/{name}/latest`) instead of spawning
+ * the npm CLI — `npm view` paid a few hundred ms of process startup for the
+ * same answer.
  */
 async function checkForUpdate(packageName, currentVersion) {
     try {
-        // Use npm view to get the latest version from registry
-        const result = (0, child_process_1.execSync)(`npm view ${packageName} version`, {
-            encoding: 'utf-8',
-            timeout: config_1.REQUEST_TIMEOUT,
-            stdio: ['pipe', 'pipe', 'pipe'],
+        const response = await fetch(`${config_1.NPM_REGISTRY_URL}/${encodeURIComponent(packageName)}/latest`, {
+            method: 'GET',
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(UPDATE_CHECK_TIMEOUT_MS),
         });
-        const latestVersion = result.trim();
+        if (!response.ok) {
+            return null;
+        }
+        const manifest = (await response.json());
+        const latestVersion = typeof manifest.version === 'string' ? manifest.version.trim() : '';
+        if (!semver.valid(latestVersion)) {
+            return null;
+        }
         // Compare versions
         const isOutdated = semver.lt(currentVersion, latestVersion);
         // Determine update command based on how the tool was likely invoked
@@ -69,24 +80,12 @@ async function checkForUpdate(packageName, currentVersion) {
     }
 }
 /**
- * Check for updates in the background without blocking
- * Resolves immediately, result available via promise
+ * Check for updates in the background without blocking.
+ *
+ * `checkForUpdate` self-caps at UPDATE_CHECK_TIMEOUT_MS and never rejects
+ * (every failure resolves to null), so no extra timeout race is needed here.
  */
 function checkForUpdateAsync(packageName, currentVersion) {
-    return new Promise((resolve) => {
-        // Set a timeout to prevent hanging
-        const timeout = setTimeout(() => {
-            resolve(null);
-        }, 5000);
-        checkForUpdate(packageName, currentVersion)
-            .then((result) => {
-            clearTimeout(timeout);
-            resolve(result);
-        })
-            .catch(() => {
-            clearTimeout(timeout);
-            resolve(null);
-        });
-    });
+    return checkForUpdate(packageName, currentVersion);
 }
 //# sourceMappingURL=version-checker.js.map

package/dist/{ui/utils → shared/terminal}/index.js

@@ -1,11 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.wrapPlainText = exports.truncatePlainText = exports.stripAnsi = exports.getVisualLength = exports.TerminalInput = exports.RAW_SHOW_CURSOR = exports.RAW_EXIT_ALT_SCREEN = exports.ConsoleUtils = exports.CursorUtils = exports.formatVersionDiff = exports.truncateMiddle = exports.applyVersionPrefix = exports.VersionUtils = void 0;
-var version_1 = require("./version");
-Object.defineProperty(exports, "VersionUtils", { enumerable: true, get: function () { return version_1.VersionUtils; } });
-Object.defineProperty(exports, "applyVersionPrefix", { enumerable: true, get: function () { return version_1.applyVersionPrefix; } });
-Object.defineProperty(exports, "truncateMiddle", { enumerable: true, get: function () { return version_1.truncateMiddle; } });
-Object.defineProperty(exports, "formatVersionDiff", { enumerable: true, get: function () { return version_1.formatVersionDiff; } });
+exports.shouldDisableColor = exports.applyColorSetting = exports.wrapPlainText = exports.truncatePlainText = exports.stripAnsi = exports.getVisualLength = exports.TerminalInput = exports.RAW_SHOW_CURSOR = exports.RAW_EXIT_ALT_SCREEN = exports.ConsoleUtils = exports.CursorUtils = void 0;
 var cursor_1 = require("./cursor");
 Object.defineProperty(exports, "CursorUtils", { enumerable: true, get: function () { return cursor_1.CursorUtils; } });
 Object.defineProperty(exports, "ConsoleUtils", { enumerable: true, get: function () { return cursor_1.ConsoleUtils; } });
@@ -18,4 +13,7 @@ Object.defineProperty(exports, "getVisualLength", { enumerable: true, get: funct
 Object.defineProperty(exports, "stripAnsi", { enumerable: true, get: function () { return text_1.stripAnsi; } });
 Object.defineProperty(exports, "truncatePlainText", { enumerable: true, get: function () { return text_1.truncatePlainText; } });
 Object.defineProperty(exports, "wrapPlainText", { enumerable: true, get: function () { return text_1.wrapPlainText; } });
+var color_1 = require("./color");
+Object.defineProperty(exports, "applyColorSetting", { enumerable: true, get: function () { return color_1.applyColorSetting; } });
+Object.defineProperty(exports, "shouldDisableColor", { enumerable: true, get: function () { return color_1.shouldDisableColor; } });
 //# sourceMappingURL=index.js.map

package/dist/{ui/utils → shared/terminal}/terminal-input.js

@@ -85,7 +85,8 @@ exports.TerminalInput = {
     promptForImmediateConfirmation(prompt, defaultValue = true) {
         return new Promise((resolve) => {
             process.stdout.write(prompt);
-            let cleanup = () => { };
+            // Replaced synchronously below before any keypress can call finish().
+            let cleanup = /* v8 ignore next */ () => { };
             const finish = (value) => {
                 cleanup();
                 process.stdout.write('\n');

package/dist/shared/terminal/text.js

@@ -0,0 +1,48 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripAnsi = stripAnsi;
+exports.getVisualLength = getVisualLength;
+exports.truncatePlainText = truncatePlainText;
+exports.wrapPlainText = wrapPlainText;
+const string_width_1 = __importDefault(require("string-width"));
+const strip_ansi_1 = __importDefault(require("strip-ansi"));
+const wrap_ansi_1 = __importDefault(require("wrap-ansi"));
+const cli_truncate_1 = __importDefault(require("cli-truncate"));
+// Thin wrappers over the battle-tested terminal-string stack (string-width,
+// strip-ansi, wrap-ansi, cli-truncate). The previous hand-rolled versions
+// handled emoji but had no East Asian Width tables, so CJK text was counted at
+// width 1 and misaligned every column that contained it.
+function stripAnsi(text) {
+    return (0, strip_ansi_1.default)(text);
+}
+/** Terminal columns `text` occupies: ANSI-aware, emoji- and CJK-correct. */
+function getVisualLength(text) {
+    return (0, string_width_1.default)(text);
+}
+function truncatePlainText(text, maxWidth) {
+    if (maxWidth <= 0) {
+        return '';
+    }
+    if (getVisualLength(text) <= maxWidth) {
+        return text;
+    }
+    if (maxWidth <= 3) {
+        return '.'.repeat(maxWidth);
+    }
+    return (0, cli_truncate_1.default)(text, maxWidth, { truncationCharacter: '...' });
+}
+function wrapPlainText(text, maxWidth) {
+    if (!text) {
+        return [];
+    }
+    if (maxWidth <= 0 || getVisualLength(text) <= maxWidth) {
+        return [text];
+    }
+    // Soft wrap: words longer than maxWidth get their own (overflowing) line,
+    // matching the previous behavior. ANSI codes are re-balanced per line.
+    return (0, wrap_ansi_1.default)(text, maxWidth).split('\n');
+}
+//# sourceMappingURL=text.js.map

package/dist/shared/types/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./domain"), exports);
+__exportStar(require("./ui"), exports);
+__exportStar(require("./streaming"), exports);
+//# sourceMappingURL=index.js.map

package/dist/{utils/version.js → shared/versions.js}

@@ -40,6 +40,7 @@ exports.parseVersions = parseVersions;
 exports.isVersionOutdated = isVersionOutdated;
 exports.getOptimizedRangeVersion = getOptimizedRangeVersion;
 exports.findClosestMinorVersion = findClosestMinorVersion;
+exports.applyVersionPrefix = applyVersionPrefix;
 const semver = __importStar(require("semver"));
 const manifest_1 = require("./manifest");
 function extractMajorVersion(version) {
@@ -98,10 +99,14 @@ function getOptimizedRangeVersion(_packageName, currentRange, allVersions, lates
         const satisfyingVersions = allVersions.filter((version) => {
             try {
                 return semver.satisfies(version, currentRange);
+                // semver.satisfies swallows invalid input internally (returns false);
+                // safety net for future semver behavior changes only.
+                /* v8 ignore start */
             }
             catch {
                 return false;
             }
+            /* v8 ignore stop */
         });
         if (satisfyingVersions.length === 0) {
             return latestVersion;
@@ -169,4 +174,10 @@ function findClosestMinorVersion(installedVersion, allVersions) {
         return null;
     }
 }
-//# sourceMappingURL=version.js.map
+/** Re-apply the original specifier's range prefix (^, ~, >=, …) to a new version. */
+function applyVersionPrefix(originalSpecifier, targetVersion) {
+    const prefixMatch = originalSpecifier.match(/^([^\d]+)/);
+    const prefix = prefixMatch ? prefixMatch[1] : '';
+    return prefix + targetVersion;
+}
+//# sourceMappingURL=versions.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inup",
-  "version": "1.6.5",
+  "version": "1.6.7",
   "description": "Interactive dependency upgrader for npm, yarn, pnpm & bun. Zero-config, monorepo-ready. Upgrade-interactive for every package manager.",
   "main": "dist/index.js",
   "bin": {
@@ -46,17 +46,24 @@
     "@types/node": "^25.9.4",
     "@types/semver": "^7.7.1",
     "@vitest/coverage-v8": "^4.1.9",
+    "dependency-cruiser": "^18.0.0",
     "prettier": "^3.9.4",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9"
   },
   "dependencies": {
     "chalk": "^5.6.2",
+    "cli-truncate": "^6.1.0",
     "commander": "^15.0.0",
     "env-paths": "^4.0.0",
     "nanospinner": "^1.2.2",
+    "registry-auth-token": "^5.1.1",
     "semver": "^7.8.5",
-    "undici": "^8.5.0"
+    "string-width": "^8.2.1",
+    "strip-ansi": "^7.2.0",
+    "undici": "^8.6.0",
+    "wrap-ansi": "^10.0.0",
+    "yaml": "^2.9.0"
   },
   "engines": {
     "node": ">=22.19.0"
@@ -66,13 +73,15 @@
     "dev": "tsc --watch",
     "start": "node dist/cli.js",
     "link": "pnpm build && pnpm add -g .",
-    "format": "prettier --write src/**/*.ts",
-    "format:check": "prettier --check src/**/*.ts",
+    "format": "prettier --write \"src/**/*.ts\"",
+    "format:check": "prettier --check \"src/**/*.ts\"",
     "demo:record": "bash docs/demo/record-demo.sh",
     "demo:setup": "cd docs/demo-project && pnpm install",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "docs:keys": "UPDATE_README=1 vitest run keymap-readme"
+    "test:coverage": "vitest run --coverage --reporter=default --reporter=json --outputFile.json=coverage/test-results.json",
+    "lint:deps": "depcruise src --config .dependency-cruiser.cjs",
+    "docs:keys": "UPDATE_README=1 vitest run keymap-readme",
+    "docs:badges": "pnpm test:coverage && UPDATE_README=1 vitest run badges-readme"
   }
 }

package/dist/core/index.js

@@ -1,23 +0,0 @@
-"use strict";
-/**
- * Core business logic
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./upgrade-runner"), exports);
-__exportStar(require("./package-detector"), exports);
-__exportStar(require("./upgrader"), exports);
-//# sourceMappingURL=index.js.map

package/dist/features/changelog/types/changelog.types.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=changelog.types.js.map

package/dist/features/debug/types/debug.types.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=debug.types.js.map