vercel 58.9.2 → 58.9.3

package/dist/chunks/{chunk-YXFLKPDC.js → chunk-J4YKPKVD.js}

@@ -24,7 +24,7 @@ import {
   apiCommand,
   listSubcommand4 as listSubcommand,
   loginCommand
-} from "./chunk-QXXH6L46.js";
+} from "./chunk-FKN6MI3N.js";
 import {
   require_semver
 } from "./chunk-IB5L4LKZ.js";
@@ -32,7 +32,11 @@ import {
   help
 } from "./chunk-ZX2FSPWV.js";
 import {
-  login
+  login,
+  require_chownr,
+  require_mkdirp,
+  require_pump,
+  require_tar_stream
 } from "./chunk-J23MTK5H.js";
 import {
   TelemetryClient,
@@ -55,6 +59,10 @@ import {
 import {
   pkg_default
 } from "./chunk-P4QNYOFB.js";
+import {
+  fetch as fetch2,
+  toNodeReadable
+} from "./chunk-52QYYTM5.js";
 import {
   output_manager_default
 } from "./chunk-OX7KI3LF.js";
@@ -63,6 +71,7 @@ import {
 } from "./chunk-S7KYDPEM.js";
 import {
   __commonJS,
+  __require,
   __toESM
 } from "./chunk-TZ2YI2VH.js";
 
@@ -500,6 +509,347 @@ var require_ci_info = __commonJS({
   }
 });
 
+// ../../node_modules/.pnpm/tar-fs@1.16.5/node_modules/tar-fs/index.js
+var require_tar_fs = __commonJS({
+  "../../node_modules/.pnpm/tar-fs@1.16.5/node_modules/tar-fs/index.js"(exports) {
+    var chownr = require_chownr();
+    var tar2 = require_tar_stream();
+    var pump = require_pump();
+    var mkdirp = require_mkdirp();
+    var fs = __require("fs");
+    var path = __require("path");
+    var os = __require("os");
+    var win32 = os.platform() === "win32";
+    var noop = function() {
+    };
+    var echo = function(name) {
+      return name;
+    };
+    var normalize = !win32 ? echo : function(name) {
+      return name.replace(/\\/g, "/").replace(/[:?<>|]/g, "_");
+    };
+    var statAll = function(fs2, stat2, cwd, ignore, entries, sort) {
+      var queue = entries || ["."];
+      return function loop(callback) {
+        if (!queue.length)
+          return callback();
+        var next = queue.shift();
+        var nextAbs = path.join(cwd, next);
+        stat2(nextAbs, function(err, stat3) {
+          if (err)
+            return callback(err);
+          if (!stat3.isDirectory())
+            return callback(null, next, stat3);
+          fs2.readdir(nextAbs, function(err2, files) {
+            if (err2)
+              return callback(err2);
+            if (sort)
+              files.sort();
+            for (var i = 0; i < files.length; i++) {
+              if (!ignore(path.join(cwd, next, files[i])))
+                queue.push(path.join(next, files[i]));
+            }
+            callback(null, next, stat3);
+          });
+        });
+      };
+    };
+    var strip = function(map, level) {
+      return function(header) {
+        header.name = header.name.split("/").slice(level).join("/");
+        var linkname = header.linkname;
+        if (linkname && (header.type === "link" || path.isAbsolute(linkname))) {
+          header.linkname = linkname.split("/").slice(level).join("/");
+        }
+        return map(header);
+      };
+    };
+    exports.pack = function(cwd, opts) {
+      if (!cwd)
+        cwd = ".";
+      if (!opts)
+        opts = {};
+      var xfs = opts.fs || fs;
+      var ignore = opts.ignore || opts.filter || noop;
+      var map = opts.map || noop;
+      var mapStream = opts.mapStream || echo;
+      var statNext = statAll(xfs, opts.dereference ? xfs.stat : xfs.lstat, cwd, ignore, opts.entries, opts.sort);
+      var strict = opts.strict !== false;
+      var umask = typeof opts.umask === "number" ? ~opts.umask : ~processUmask();
+      var dmode = typeof opts.dmode === "number" ? opts.dmode : 0;
+      var fmode = typeof opts.fmode === "number" ? opts.fmode : 0;
+      var pack = opts.pack || tar2.pack();
+      var finish = opts.finish || noop;
+      if (opts.strip)
+        map = strip(map, opts.strip);
+      if (opts.readable) {
+        dmode |= parseInt(555, 8);
+        fmode |= parseInt(444, 8);
+      }
+      if (opts.writable) {
+        dmode |= parseInt(333, 8);
+        fmode |= parseInt(222, 8);
+      }
+      var onsymlink = function(filename, header) {
+        xfs.readlink(path.join(cwd, filename), function(err, linkname) {
+          if (err)
+            return pack.destroy(err);
+          header.linkname = normalize(linkname);
+          pack.entry(header, onnextentry);
+        });
+      };
+      var onstat = function(err, filename, stat2) {
+        if (err)
+          return pack.destroy(err);
+        if (!filename) {
+          if (opts.finalize !== false)
+            pack.finalize();
+          return finish(pack);
+        }
+        if (stat2.isSocket())
+          return onnextentry();
+        var header = {
+          name: normalize(filename),
+          mode: (stat2.mode | (stat2.isDirectory() ? dmode : fmode)) & umask,
+          mtime: stat2.mtime,
+          size: stat2.size,
+          type: "file",
+          uid: stat2.uid,
+          gid: stat2.gid
+        };
+        if (stat2.isDirectory()) {
+          header.size = 0;
+          header.type = "directory";
+          header = map(header) || header;
+          return pack.entry(header, onnextentry);
+        }
+        if (stat2.isSymbolicLink()) {
+          header.size = 0;
+          header.type = "symlink";
+          header = map(header) || header;
+          return onsymlink(filename, header);
+        }
+        header = map(header) || header;
+        if (!stat2.isFile()) {
+          if (strict)
+            return pack.destroy(new Error("unsupported type for " + filename));
+          return onnextentry();
+        }
+        var entry = pack.entry(header, onnextentry);
+        if (!entry)
+          return;
+        var rs = mapStream(xfs.createReadStream(path.join(cwd, filename)), header);
+        rs.on("error", function(err2) {
+          entry.destroy(err2);
+        });
+        pump(rs, entry);
+      };
+      var onnextentry = function(err) {
+        if (err)
+          return pack.destroy(err);
+        statNext(onstat);
+      };
+      onnextentry();
+      return pack;
+    };
+    var head = function(list) {
+      return list.length ? list[list.length - 1] : null;
+    };
+    var processGetuid = function() {
+      return process.getuid ? process.getuid() : -1;
+    };
+    var processUmask = function() {
+      return process.umask ? process.umask() : 0;
+    };
+    exports.extract = function(cwd, opts) {
+      if (!cwd)
+        cwd = ".";
+      if (!opts)
+        opts = {};
+      var xfs = opts.fs || fs;
+      var ignore = opts.ignore || opts.filter || noop;
+      var map = opts.map || noop;
+      var mapStream = opts.mapStream || echo;
+      var own = opts.chown !== false && !win32 && processGetuid() === 0;
+      var extract = opts.extract || tar2.extract();
+      var stack = [];
+      var now = /* @__PURE__ */ new Date();
+      var umask = typeof opts.umask === "number" ? ~opts.umask : ~processUmask();
+      var dmode = typeof opts.dmode === "number" ? opts.dmode : 0;
+      var fmode = typeof opts.fmode === "number" ? opts.fmode : 0;
+      var strict = opts.strict !== false;
+      if (opts.strip)
+        map = strip(map, opts.strip);
+      if (opts.readable) {
+        dmode |= parseInt(555, 8);
+        fmode |= parseInt(444, 8);
+      }
+      if (opts.writable) {
+        dmode |= parseInt(333, 8);
+        fmode |= parseInt(222, 8);
+      }
+      var utimesParent = function(name, cb) {
+        var top;
+        while ((top = head(stack)) && name.slice(0, top[0].length) !== top[0])
+          stack.pop();
+        if (!top)
+          return cb();
+        xfs.utimes(top[0], now, top[1], cb);
+      };
+      var utimes = function(name, header, cb) {
+        if (opts.utimes === false)
+          return cb();
+        if (header.type === "directory")
+          return xfs.utimes(name, now, header.mtime, cb);
+        if (header.type === "symlink")
+          return utimesParent(name, cb);
+        xfs.utimes(name, now, header.mtime, function(err) {
+          if (err)
+            return cb(err);
+          utimesParent(name, cb);
+        });
+      };
+      var chperm = function(name, header, cb) {
+        var link = header.type === "symlink";
+        var chmod2 = link ? xfs.lchmod : xfs.chmod;
+        var chown = link ? xfs.lchown : xfs.chown;
+        if (!chmod2)
+          return cb();
+        var mode = (header.mode | (header.type === "directory" ? dmode : fmode)) & umask;
+        chmod2(name, mode, function(err) {
+          if (err)
+            return cb(err);
+          if (!own)
+            return cb();
+          if (!chown)
+            return cb();
+          chown(name, header.uid, header.gid, cb);
+        });
+      };
+      extract.on("entry", function(header, stream, next) {
+        header = map(header) || header;
+        header.name = normalize(header.name);
+        var name = path.join(cwd, path.join("/", header.name));
+        if (ignore(name, header)) {
+          stream.resume();
+          return next();
+        }
+        var stat2 = function(err) {
+          if (err)
+            return next(err);
+          utimes(name, header, function(err2) {
+            if (err2)
+              return next(err2);
+            if (win32)
+              return next();
+            chperm(name, header, next);
+          });
+        };
+        var onsymlink = function() {
+          if (win32)
+            return next();
+          xfs.unlink(name, function() {
+            var dst = path.resolve(path.dirname(name), header.linkname);
+            if (!dst.startsWith(path.resolve(cwd)))
+              return next(new Error(name + " is not a valid symlink"));
+            xfs.symlink(header.linkname, name, stat2);
+          });
+        };
+        var onlink = function() {
+          if (win32)
+            return next();
+          xfs.unlink(name, function() {
+            var srcpath = path.join(cwd, path.join("/", header.linkname));
+            xfs.realpath(srcpath, function(err, dst) {
+              if (err || !dst.startsWith(path.resolve(cwd)))
+                return next(new Error(name + " is not a valid hardlink"));
+              xfs.link(dst, name, function(err2) {
+                if (err2 && err2.code === "EPERM" && opts.hardlinkAsFilesFallback) {
+                  stream = xfs.createReadStream(srcpath);
+                  return onfile();
+                }
+                stat2(err2);
+              });
+            });
+          });
+        };
+        var onfile = function() {
+          var ws = xfs.createWriteStream(name);
+          var rs = mapStream(stream, header);
+          ws.on("error", function(err) {
+            rs.destroy(err);
+          });
+          pump(rs, ws, function(err) {
+            if (err)
+              return next(err);
+            ws.on("close", stat2);
+          });
+        };
+        if (header.type === "directory") {
+          stack.push([name, header.mtime]);
+          return mkdirfix(name, {
+            fs: xfs,
+            own,
+            uid: header.uid,
+            gid: header.gid
+          }, stat2);
+        }
+        var dir = path.dirname(name);
+        validate(xfs, dir, path.join(cwd, "."), function(err, valid) {
+          if (err)
+            return next(err);
+          if (!valid)
+            return next(new Error(dir + " is not a valid path"));
+          mkdirfix(dir, {
+            fs: xfs,
+            own,
+            uid: header.uid,
+            gid: header.gid
+          }, function(err2) {
+            if (err2)
+              return next(err2);
+            switch (header.type) {
+              case "file":
+                return onfile();
+              case "link":
+                return onlink();
+              case "symlink":
+                return onsymlink();
+            }
+            if (strict)
+              return next(new Error("unsupported type for " + name + " (" + header.type + ")"));
+            stream.resume();
+            next();
+          });
+        });
+      });
+      if (opts.finish)
+        extract.on("finish", opts.finish);
+      return extract;
+    };
+    function validate(fs2, name, root, cb) {
+      if (name === root)
+        return cb(null, true);
+      fs2.lstat(name, function(err, st) {
+        if (err && err.code !== "ENOENT")
+          return cb(err);
+        if (err || st.isDirectory())
+          return validate(fs2, path.join(name, ".."), root, cb);
+        cb(null, false);
+      });
+    }
+    function mkdirfix(name, opts, cb) {
+      mkdirp(name, { fs: opts.fs }, function(err, made) {
+        if (!err && made && opts.own) {
+          chownr(made, opts.uid, opts.gid, cb);
+        } else {
+          cb(err);
+        }
+      });
+    }
+  }
+});
+
 // ../../node_modules/.pnpm/jaro-winkler@0.2.8/node_modules/jaro-winkler/index.js
 var require_jaro_winkler = __commonJS({
   "../../node_modules/.pnpm/jaro-winkler@0.2.8/node_modules/jaro-winkler/index.js"(exports, module) {
@@ -2889,7 +3239,7 @@ function renderUpgradeProgress(current, total, phase) {
   );
 }
 function execFileStdout(command, args) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     execFile(
       command,
       args,
@@ -2899,7 +3249,7 @@ function execFileStdout(command, args) {
           reject(error);
           return;
         }
-        resolve3(stdout.toString());
+        resolve4(stdout.toString());
       }
     );
   });
@@ -2967,7 +3317,7 @@ async function executeUpgrade(targetVersion) {
   }
   output_manager_default.debug(`Executing: ${updateCommand} (cwd: ${cwd})`);
   renderUpgradeProgress(targetVersion ? 1 : 2, totalSteps, "Installing\u2026");
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const stdout = [];
     const stderr = [];
     const upgradeProcess = spawn(command, args, {
@@ -2987,7 +3337,7 @@ async function executeUpgrade(targetVersion) {
       output_manager_default.stopSpinner();
       output_manager_default.error(`Failed to execute upgrade command: ${err.message}`);
       output_manager_default.log(`You can try running the command manually: ${updateCommand}`);
-      resolve3(1);
+      resolve4(1);
     });
     upgradeProcess.on("close", (code) => {
       if (code !== 0) {
@@ -3004,7 +3354,7 @@ async function executeUpgrade(targetVersion) {
         output_manager_default.log(
           `You can try running the command manually: ${updateCommand}`
         );
-        resolve3(code ?? 1);
+        resolve4(code ?? 1);
         return;
       }
       renderUpgradeProgress(totalSteps, totalSteps);
@@ -3013,17 +3363,412 @@ async function executeUpgrade(targetVersion) {
         output_manager_default.success(
           `Vercel CLI has been upgraded to v${resolvedTargetVersion} successfully!`
         );
-        resolve3(0);
+        resolve4(0);
         return;
       }
       output_manager_default.success("Vercel CLI has been upgraded successfully!");
-      resolve3(0);
+      resolve4(0);
     });
   });
 }
 
 // src/util/updates.ts
 var import_ci_info = __toESM(require_ci_info(), 1);
+
+// src/util/native-self-update.ts
+var import_tar_fs = __toESM(require_tar_fs(), 1);
+var import_semver2 = __toESM(require_semver(), 1);
+import { createGunzip } from "zlib";
+import { createHash as createHash2 } from "crypto";
+import { createWriteStream } from "fs";
+import { homedir, tmpdir as tmpdir2 } from "os";
+import { join as join2, resolve as resolve3, sep } from "path";
+import { pipeline } from "stream/promises";
+import {
+  chmod,
+  copyFile,
+  mkdir as mkdir2,
+  mkdtemp,
+  readdir,
+  readFile as readFile4,
+  readlink,
+  realpath,
+  rename,
+  rm,
+  stat,
+  symlink,
+  unlink,
+  writeFile as writeFile2
+} from "fs/promises";
+var REGISTRY = "https://registry.npmjs.org";
+async function moveFile(source, destination) {
+  try {
+    await rename(source, destination);
+  } catch (err) {
+    if (err.code !== "EXDEV") {
+      throw err;
+    }
+    await copyFile(source, destination);
+    await rm(source, { force: true });
+  }
+}
+var CURL_INSTALL_COMMAND = "curl -fsSL https://api-frameworks.vercel.sh/install | sh";
+var SUPPORTED_PLATFORMS = /* @__PURE__ */ new Set([
+  "darwin-arm64",
+  "darwin-x64",
+  "linux-arm64",
+  "linux-x64"
+]);
+function getInstallRoot() {
+  const root = process.env.VERCEL_INSTALL_DIR;
+  return root ? resolve3(root) : join2(homedir(), ".vercel");
+}
+function platformTarget() {
+  return `${process.platform}-${process.arch}`;
+}
+function isSupportedPlatform() {
+  return SUPPORTED_PLATFORMS.has(platformTarget());
+}
+function unsupportedPlatformMessage() {
+  const supported = Array.from(SUPPORTED_PLATFORMS).join(", ");
+  return `The native Vercel CLI binary is not available for your platform (${platformTarget()}). Supported platforms: ${supported}. You can install the CLI with a package manager instead: npm i -g vercel@latest`;
+}
+function nativePackageSuffix() {
+  return `vc-native-${platformTarget()}`;
+}
+function nativePackageName() {
+  return `@vercel/${nativePackageSuffix()}`;
+}
+async function isCurlInstall() {
+  if (!isNativeBinaryInstall()) {
+    return false;
+  }
+  const versionsPrefix = join2(getInstallRoot(), "versions") + sep;
+  if (process.execPath.startsWith(versionsPrefix)) {
+    return true;
+  }
+  try {
+    const real = await realpath(process.execPath);
+    return real.startsWith(versionsPrefix);
+  } catch {
+    return false;
+  }
+}
+async function resolveLatestVersion(pkgName) {
+  const res = await fetch2(`${REGISTRY}/${pkgName}/latest`);
+  if (!res.ok) {
+    throw new Error(
+      `Failed to fetch package metadata from the npm registry (HTTP ${res.status})`
+    );
+  }
+  const manifest = await res.json();
+  if (!manifest.version || !import_semver2.default.valid(manifest.version)) {
+    throw new Error("Could not resolve the latest native binary version");
+  }
+  return manifest.version;
+}
+async function resolveLatestNativeVersion() {
+  return resolveLatestVersion(nativePackageName());
+}
+async function listAvailableVersions(pkgName) {
+  const res = await fetch2(`${REGISTRY}/${pkgName}`, {
+    headers: {
+      // Abbreviated metadata: much smaller response.
+      accept: "application/vnd.npm.install-v1+json"
+    }
+  });
+  if (!res.ok) {
+    throw new Error(
+      `Failed to fetch package metadata from the npm registry (HTTP ${res.status})`
+    );
+  }
+  const manifest = await res.json();
+  const versions = Object.keys(manifest.versions ?? {}).filter(
+    (v) => import_semver2.default.valid(v)
+  );
+  return versions.sort(import_semver2.default.rcompare);
+}
+async function downloadAndExtractBinary(version, destination) {
+  if (!isSupportedPlatform()) {
+    throw new Error(unsupportedPlatformMessage());
+  }
+  const suffix = nativePackageSuffix();
+  const tarballUrl = `${REGISTRY}/@vercel/${suffix}/-/${suffix}-${version}.tgz`;
+  const res = await fetch2(tarballUrl);
+  if (res.status === 404) {
+    throw new Error(
+      `No native binary is available for Vercel CLI v${version} on ${platformTarget()}. Older versions may predate native binary builds. You can install that version with a package manager instead: npm i -g vercel@${version}`
+    );
+  }
+  if (!res.ok) {
+    throw new Error(`Failed to download ${tarballUrl} (HTTP ${res.status})`);
+  }
+  const tmpDir = await mkdtemp(join2(tmpdir2(), "vercel-upgrade-"));
+  try {
+    await pipeline(
+      toNodeReadable(res.body),
+      createGunzip(),
+      import_tar_fs.default.extract(tmpDir, {
+        // Drop symlink/hardlink entries: they're the tar link-following
+        // traversal vector (CVE-2024-12905 / CVE-2025-48387).
+        ignore: (_name, header) => header?.type !== "file" && header?.type !== "directory"
+      })
+    );
+    const binary = join2(tmpDir, "package", "bin", "vercel");
+    const stats = await stat(binary).catch(() => null);
+    if (!stats?.isFile()) {
+      throw new Error(
+        "Downloaded tarball did not contain the expected binary (package/bin/vercel)"
+      );
+    }
+    await mkdir2(destination, { recursive: true });
+    await chmod(binary, 493);
+    await moveFile(binary, join2(destination, "vercel"));
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true });
+  }
+}
+async function forceSymlink(target, linkPath) {
+  await unlink(linkPath).catch(() => {
+  });
+  await symlink(target, linkPath);
+}
+async function linkVersion(version) {
+  const installRoot = getInstallRoot();
+  const binaryPath = join2(installRoot, "versions", version, "vercel");
+  const binDir = join2(installRoot, "bin");
+  await mkdir2(binDir, { recursive: true });
+  await forceSymlink(binaryPath, join2(binDir, "vercel"));
+  await forceSymlink(binaryPath, join2(binDir, "vc"));
+}
+async function installAndLinkVersion(version) {
+  const installRoot = getInstallRoot();
+  const versionDir = join2(installRoot, "versions", version);
+  const binaryPath = join2(versionDir, "vercel");
+  const existing = await stat(binaryPath).catch(() => null);
+  if (!existing?.isFile()) {
+    output_manager_default.spinner(`Downloading Vercel CLI v${version}\u2026`, 0);
+    await downloadAndExtractBinary(version, versionDir);
+  }
+  await linkVersion(version);
+}
+var PR_BINARIES_URL = process.env.VERCEL_PR_BINARIES_URL || "https://api-frameworks.vercel.sh/pr-binaries";
+function parsePrTarget(target) {
+  const match = /^pr[/-](\d+)$/i.exec(target.trim());
+  if (!match) {
+    return void 0;
+  }
+  const pr = Number(match[1]);
+  return Number.isSafeInteger(pr) && pr > 0 ? pr : void 0;
+}
+function prVersionDirName(pr) {
+  return `pr-${pr}`;
+}
+function isPrVersionName(name) {
+  return /^pr-\d+$/.test(name);
+}
+async function fetchPrChecksum(pr) {
+  const url = `${PR_BINARIES_URL}/${pr}/vercel-${platformTarget()}.sha256`;
+  const res = await fetch2(url);
+  if (res.status === 404) {
+    throw new Error(
+      `No binary found for PR #${pr} on ${platformTarget()}. The PR may not have a build yet, or the build may still be running.`
+    );
+  }
+  if (!res.ok) {
+    throw new Error(
+      `Failed to fetch checksum for PR #${pr} (HTTP ${res.status})`
+    );
+  }
+  const text = (await res.text()).trim();
+  const sha = text.split(/\s+/)[0]?.toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(sha ?? "")) {
+    throw new Error(`Unexpected checksum format for PR #${pr}`);
+  }
+  return sha;
+}
+async function downloadPrBinary(pr, expectedSha, destination) {
+  if (!isSupportedPlatform()) {
+    throw new Error(unsupportedPlatformMessage());
+  }
+  const url = `${PR_BINARIES_URL}/${pr}/vercel-${platformTarget()}`;
+  const res = await fetch2(url);
+  if (res.status === 404) {
+    throw new Error(
+      `No binary found for PR #${pr} on ${platformTarget()}. The PR may not have a build yet, or the build may still be running.`
+    );
+  }
+  if (!res.ok) {
+    throw new Error(`Failed to download ${url} (HTTP ${res.status})`);
+  }
+  const tmpDir = await mkdtemp(join2(tmpdir2(), "vercel-pr-"));
+  try {
+    const tmpBinary = join2(tmpDir, "vercel");
+    const hash = createHash2("sha256");
+    const body = toNodeReadable(res.body);
+    body.on("data", (chunk) => hash.update(chunk));
+    await pipeline(body, createWriteStream(tmpBinary));
+    const actualSha = hash.digest("hex");
+    if (actualSha !== expectedSha) {
+      throw new Error(
+        `Checksum mismatch for PR #${pr} binary. The build may have been updated mid-download; try again.`
+      );
+    }
+    await mkdir2(destination, { recursive: true });
+    await chmod(tmpBinary, 493);
+    await moveFile(tmpBinary, join2(destination, "vercel"));
+    await writeFile2(join2(destination, "vercel.sha256"), `${actualSha}
+`);
+  } finally {
+    await rm(tmpDir, { recursive: true, force: true });
+  }
+}
+async function installAndLinkPrBinary(pr) {
+  const installRoot = getInstallRoot();
+  const versionDir = join2(installRoot, "versions", prVersionDirName(pr));
+  const binaryPath = join2(versionDir, "vercel");
+  const shaPath = join2(versionDir, "vercel.sha256");
+  output_manager_default.spinner(`Checking latest build for PR #${pr}\u2026`, 0);
+  const remoteSha = await fetchPrChecksum(pr);
+  const existing = await stat(binaryPath).catch(() => null);
+  const localSha = existing?.isFile() ? (await readFile4(shaPath, "utf8").catch(() => "")).trim().split(/\s+/)[0] : void 0;
+  if (existing?.isFile() && localSha === remoteSha) {
+    await linkVersion(prVersionDirName(pr));
+    return { updated: false, sha: remoteSha };
+  }
+  output_manager_default.spinner(`Downloading Vercel CLI build for PR #${pr}\u2026`, 0);
+  await downloadPrBinary(pr, remoteSha, versionDir);
+  await linkVersion(prVersionDirName(pr));
+  return { updated: true, sha: remoteSha };
+}
+async function listInstalledVersions() {
+  const versionsDir = join2(getInstallRoot(), "versions");
+  const entries = await readdir(versionsDir, { withFileTypes: true }).catch(
+    () => []
+  );
+  const versions = [];
+  const prBuilds = [];
+  for (const entry of entries) {
+    const isPr = isPrVersionName(entry.name);
+    if (!entry.isDirectory() || !import_semver2.default.valid(entry.name) && !isPr) {
+      continue;
+    }
+    const binary = join2(versionsDir, entry.name, "vercel");
+    const stats = await stat(binary).catch(() => null);
+    if (stats?.isFile()) {
+      (isPr ? prBuilds : versions).push(entry.name);
+    }
+  }
+  return [...versions.sort(import_semver2.default.rcompare), ...prBuilds.sort()];
+}
+async function getLinkedVersion() {
+  const link = join2(getInstallRoot(), "bin", "vercel");
+  try {
+    const target = await readlink(link);
+    const segments = target.split(sep);
+    const versionsIdx = segments.lastIndexOf("versions");
+    const version = versionsIdx >= 0 ? segments[versionsIdx + 1] : void 0;
+    return version && (import_semver2.default.valid(version) || isPrVersionName(version)) ? version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function isLinkedToPrBuild() {
+  const linked = await getLinkedVersion();
+  return linked !== void 0 && isPrVersionName(linked);
+}
+function pinFilePath() {
+  return join2(getInstallRoot(), "pinned");
+}
+async function setPinnedVersion(version) {
+  await writeFile2(pinFilePath(), `${version}
+`);
+}
+async function clearPinnedVersion() {
+  await unlink(pinFilePath()).catch(() => {
+  });
+}
+async function getPinnedVersion() {
+  const pinned = (await readFile4(pinFilePath(), "utf8").catch(() => "")).trim().split(/\s+/)[0];
+  if (!pinned) {
+    return void 0;
+  }
+  const linked = await getLinkedVersion();
+  return pinned === linked ? pinned : void 0;
+}
+async function getPrBuildSha(name) {
+  const shaPath = join2(getInstallRoot(), "versions", name, "vercel.sha256");
+  const sha = (await readFile4(shaPath, "utf8").catch(() => "")).trim().split(/\s+/)[0];
+  return /^[0-9a-f]{64}$/.test(sha) ? sha : void 0;
+}
+function packageManagerRemovalCommand() {
+  const segments = process.execPath.split(sep);
+  if (segments.includes("pnpm") || segments.includes(".pnpm")) {
+    return "pnpm rm -g vercel";
+  }
+  if (segments.includes("yarn") || segments.includes(".yarn")) {
+    return "yarn global remove vercel";
+  }
+  return "npm rm -g vercel";
+}
+async function printMigrationCleanup() {
+  if (await isCurlInstall()) {
+    return;
+  }
+  const removalCommand = packageManagerRemovalCommand();
+  const binDir = join2(getInstallRoot(), "bin");
+  output_manager_default.print("\n");
+  output_manager_default.log(
+    `The Vercel CLI now updates itself in ${binDir} and no longer needs your package manager.`
+  );
+  output_manager_default.log(
+    `Remove the old install so the new binary takes effect: ${removalCommand}`
+  );
+  output_manager_default.log(
+    "Then open a new terminal (or run `hash -r`) so your shell picks up the new binary."
+  );
+}
+async function executeNativeSelfUpdate(targetVersion) {
+  try {
+    output_manager_default.spinner("Checking for updates\u2026", 0);
+    const version = targetVersion ?? await resolveLatestNativeVersion();
+    const onPrBuild = await isLinkedToPrBuild();
+    if (!targetVersion && !onPrBuild && import_semver2.default.valid(version) && import_semver2.default.valid(pkg_default.version) && import_semver2.default.gte(pkg_default.version, version)) {
+      output_manager_default.stopSpinner();
+      output_manager_default.log(
+        `No upgrade available. Vercel CLI is already up to date (v${pkg_default.version}).`
+      );
+      return 0;
+    }
+    if (onPrBuild) {
+      output_manager_default.stopSpinner();
+      output_manager_default.log(
+        `Currently on a PR build (${await getLinkedVersion()}). Switching back to the latest release\u2026`
+      );
+    }
+    await installAndLinkVersion(version);
+    await clearPinnedVersion();
+    output_manager_default.stopSpinner();
+    output_manager_default.success(`Vercel CLI has been upgraded to v${version} successfully!`);
+    await printMigrationCleanup();
+    return 0;
+  } catch (error) {
+    output_manager_default.stopSpinner();
+    output_manager_default.error(
+      `Upgrade failed: ${error instanceof Error ? error.message : String(error)}`
+    );
+    output_manager_default.log(`You can try reinstalling manually: ${CURL_INSTALL_COMMAND}`);
+    return 1;
+  }
+}
+
+// src/util/updates.ts
+async function isVersionPinned() {
+  if (!isNativeBinaryInstall()) {
+    return false;
+  }
+  return await getPinnedVersion() !== void 0;
+}
 function isAutoUpdateEnabled(config) {
   return config.updates?.auto === true;
 }
@@ -3206,6 +3951,21 @@ export {
   tryOpenApiFallback,
   executeUpgrade,
   require_ci_info,
+  require_tar_fs,
+  CURL_INSTALL_COMMAND,
+  isCurlInstall,
+  listAvailableVersions,
+  installAndLinkVersion,
+  parsePrTarget,
+  installAndLinkPrBinary,
+  listInstalledVersions,
+  getLinkedVersion,
+  isLinkedToPrBuild,
+  setPinnedVersion,
+  getPinnedVersion,
+  getPrBuildSha,
+  executeNativeSelfUpdate,
+  isVersionPinned,
   isAutoUpdateEnabled,
   hasAutoUpdatePreference,
   setAutoUpdate,