From 48dd462db96d1ee0fe97868a976ed66d8bcc0f66 Mon Sep 17 00:00:00 2001 From: Antonio Viggiano Date: Mon, 26 Oct 2026 19:33:34 +0000 Subject: [PATCH 1/3] fix: update vulnerable production dependencies --- docs/security.md | 4 +- packages/artifacts/package.json | 2 +- packages/config/package.json | 2 +- packages/evals/package.json | 2 +- packages/evmbench/package.json | 2 +- packages/modal/package.json | 2 +- packages/runtime/package.json | 2 +- packages/runtime/src/operator-npm.ts | 2 +- packages/runtime/test/operator-npm.test.ts | 6 +- patches/npm@11.19.0.patch | 818 ++++++++++++++++++--- pnpm-workspace.yaml | 6 + 11 files changed, 748 insertions(+), 100 deletions(-) diff --git a/docs/security.md b/docs/security.md index cee7e7d49..11e49b023 100644 --- a/docs/security.md +++ b/docs/security.md @@ -173,10 +173,10 @@ version to the same advisory endpoint. This matters for the private workflow controller's pinned npm: pnpm otherwise reports npm as one opaque package and omits the packages npm ships inside itself. The lockfile-bound npm patch bundles `brace-expansion` 5.0.12, `ip-address` 10.5.0, `tar` 7.5.22, and `undici` -6.28.1. The `ip-address` and `tar` versions mirror the green npm v11 upstream +6.29.1. The `ip-address` and `tar` versions mirror the green npm v11 upstream fixes in `npm/cli#9842` and `npm/cli#9872`. No npm release yet bundles the `brace-expansion` and `undici` fixes for GHSA-6j4f-fj2g-mc7p, -GHSA-qhr7-859c-m2p7, and GHSA-rfgv-xxqx-mfg5, so the patch carries those +GHSA-qhr7-859c-m2p7, GHSA-rfgv-xxqx-mfg5, and GHSA-xjj6-f33q-929c, so the patch carries those registry releases, limited to the files npm's own bundling keeps. The patch can be removed when an upstream npm release carries those versions; the operator npm closure digest and advisory inventory both fail if that diff --git a/packages/artifacts/package.json b/packages/artifacts/package.json index eb06fd038..6b7e96d4b 100644 --- a/packages/artifacts/package.json +++ b/packages/artifacts/package.json @@ -32,7 +32,7 @@ "@ultrafuzz/security": "workspace:*", "ajv": "^8.20.0", "ajv-formats": "^3.0.1", - "zod": "^4.4.3" + "zod": "^4.6.6" }, "homepage": "https://github.com/monad-developers/ultrafuzz#readme", "repository": { diff --git a/packages/config/package.json b/packages/config/package.json index 4cd0ef0e9..947979302 100644 --- a/packages/config/package.json +++ b/packages/config/package.json @@ -26,7 +26,7 @@ "@ultrafuzz/security": "workspace:*", "smol-toml": "^1.9.0", "yaml": "^2.8.0", - "zod": "^4.4.3" + "zod": "^4.6.6" }, "homepage": "https://github.com/monad-developers/ultrafuzz#readme", "repository": { diff --git a/packages/evals/package.json b/packages/evals/package.json index 770e0adda..608be5e2a 100644 --- a/packages/evals/package.json +++ b/packages/evals/package.json @@ -27,6 +27,6 @@ "@ultrafuzz/config": "workspace:*", "@ultrafuzz/runtime": "workspace:*", "yaml": "^2.8.0", - "zod": "^4.4.3" + "zod": "^4.6.6" } } diff --git a/packages/evmbench/package.json b/packages/evmbench/package.json index 9e80ee483..51794afb0 100644 --- a/packages/evmbench/package.json +++ b/packages/evmbench/package.json @@ -25,7 +25,7 @@ "dependencies": { "@ultrafuzz/artifacts": "workspace:*", "yaml": "^2.8.0", - "zod": "^4.4.3" + "zod": "^4.6.6" }, "homepage": "https://github.com/monad-developers/ultrafuzz#readme", "repository": { diff --git a/packages/modal/package.json b/packages/modal/package.json index abe83ea56..2d018bdc7 100644 --- a/packages/modal/package.json +++ b/packages/modal/package.json @@ -36,7 +36,7 @@ "proper-lockfile": "4.1.2", "smol-toml": "^1.9.0", "yaml": "^2.9.0", - "zod": "^4.4.3" + "zod": "^4.6.6" }, "devDependencies": { "@types/proper-lockfile": "^4.1.4" diff --git a/packages/runtime/package.json b/packages/runtime/package.json index 7fb49980b..da753c8b1 100644 --- a/packages/runtime/package.json +++ b/packages/runtime/package.json @@ -39,7 +39,7 @@ "proper-lockfile": "4.1.2", "smthrs": "0.35.0", "typescript": "6.0.3", - "zod": "4.4.3" + "zod": "4.6.6" }, "devDependencies": { "@moonshot-ai/kimi-code": "0.29.1", diff --git a/packages/runtime/src/operator-npm.ts b/packages/runtime/src/operator-npm.ts index 59de57d75..541a3f9ba 100644 --- a/packages/runtime/src/operator-npm.ts +++ b/packages/runtime/src/operator-npm.ts @@ -4,7 +4,7 @@ import { createRequire } from "node:module"; import path from "node:path"; const OPERATOR_NPM_VERSION = "11.19.0"; -const OPERATOR_NPM_CLOSURE_SHA256 = "4852a49e930ed235c056f19f9cfa6214f5d84dd4a0942f9403714e4603ef13e6"; +const OPERATOR_NPM_CLOSURE_SHA256 = "59715f52d005bdb07d45b5e52544af33ac198c0293e9bd9af837d75109b1fa1a"; const OPERATOR_NPM_MAX_FILES = 10_000; const OPERATOR_NPM_MAX_DIRECTORIES = 2_500; const OPERATOR_NPM_MAX_BYTES = 64 * 1024 * 1024; diff --git a/packages/runtime/test/operator-npm.test.ts b/packages/runtime/test/operator-npm.test.ts index b648477a5..6cac8e66f 100644 --- a/packages/runtime/test/operator-npm.test.ts +++ b/packages/runtime/test/operator-npm.test.ts @@ -10,8 +10,8 @@ import { bundledOperatorNpmClosureForValidation, resolveOperatorNpmAuthority } f test("the release-pinned operator npm closure is complete and reproducible", () => { assert.deepEqual(bundledOperatorNpmClosureForValidation(), { - bytes: 12_230_966, - digest: "4852a49e930ed235c056f19f9cfa6214f5d84dd4a0942f9403714e4603ef13e6", + bytes: 12_239_079, + digest: "59715f52d005bdb07d45b5e52544af33ac198c0293e9bd9af837d75109b1fa1a", directories: 460, files: 1_943 }); @@ -31,7 +31,7 @@ test("the operator npm backports retain their security behavior", () => { "brace-expansion": "5.0.12", "ip-address": "10.5.0", tar: "7.5.22", - undici: "6.28.1" + undici: "6.29.1" } ); const braceExpansion = require(path.join(npmRoot, "node_modules", "brace-expansion")) as { diff --git a/patches/npm@11.19.0.patch b/patches/npm@11.19.0.patch index 38ff4c7a6..f971131ba 100644 --- a/patches/npm@11.19.0.patch +++ b/patches/npm@11.19.0.patch @@ -1840,11 +1840,126 @@ index 9d082e4404947775276e0d6278516aadaab8bcbe..f19ece377d9da9d10a0b694ac6772a88 "repository": { "type": "git", "url": "https://github.com/isaacs/node-tar.git" +diff --git a/node_modules/undici/docs/docs/api/Client.md b/node_modules/undici/docs/docs/api/Client.md +index e0d41b47805ec238306e8df8779363e724fb3bf5..ca6e336f226e44065bf7f3659a6ea2c29c9a6d44 100644 +--- a/node_modules/undici/docs/docs/api/Client.md ++++ b/node_modules/undici/docs/docs/api/Client.md +@@ -29,6 +29,8 @@ Returns: `Client` + * **webSocket** `WebSocketOptions` (optional) - WebSocket-specific configuration options. + * **maxFragments** `number` (optional) - Default: `131072` - Maximum number of fragments in a message. Set to 0 to disable the limit. + * **maxPayloadSize** `number` (optional) - Default: `134217728` (128 MB) - Maximum allowed payload size in bytes for WebSocket messages. Applied to uncompressed messages, compressed frame payloads, and decompressed (permessage-deflate) messages. Set to 0 to disable the limit. ++* **eventSource** `EventSourceOptions` (optional) - EventSource-specific configuration options. ++ * **maxEventSize** `number` (optional) - The maximum total bytes of data and metadata field values retained for a pending EventSource event. Each unfinished line is separately limited to this value plus seven syntax bytes. The number of `data:` lines per event and input chunks buffered for an unfinished line are each limited to `min(131072, max(1024, floor(maxEventSize / 128)))` to bound object overhead. Set to `0` to disable these limits. Default: `buffer.kStringMaxLength`. + * **pipelining** `number | null` (optional) - Default: `1` - The amount of concurrent requests to be sent over the single TCP/TLS connection according to [RFC7230](https://tools.ietf.org/html/rfc7230#section-6.3.2). Carefully consider your workload and environment before enabling concurrent requests as pipelining may reduce performance if used incorrectly. Pipelining is sensitive to network stack settings as well as head of line blocking caused by e.g. long running requests. Set to `0` to disable keep-alive connections. + * **connect** `ConnectOptions | Function | null` (optional) - Default: `null`. + * **strictContentLength** `Boolean` (optional) - Default: `true` - Whether to treat request content length mismatches as errors. If true, an error is thrown when the request content-length header doesn't match the length of the request body. +diff --git a/node_modules/undici/docs/docs/api/DiagnosticsChannel.md b/node_modules/undici/docs/docs/api/DiagnosticsChannel.md +index 099c072f6c6ca7d833cb238920551be105ed85fc..aefb1009c63a4612c91ee28eaaae209b80c048fd 100644 +--- a/node_modules/undici/docs/docs/api/DiagnosticsChannel.md ++++ b/node_modules/undici/docs/docs/api/DiagnosticsChannel.md +@@ -40,7 +40,8 @@ diagnosticsChannel.channel('undici:request:bodySent').subscribe(({ request }) => + + ## `undici:request:headers` + +-This message is published after the response headers have been received, i.e. the response has been completed. ++This message is published after the response headers have been received. This includes a successful CONNECT or ++protocol upgrade response. + + ```js + import diagnosticsChannel from 'diagnostics_channel' +@@ -57,6 +58,7 @@ diagnosticsChannel.channel('undici:request:headers').subscribe(({ request, respo + ## `undici:request:trailers` + + This message is published after the response body and trailers have been received, i.e. the response has been completed. ++After an upgraded socket is passed to the request handler, this message is published with an empty `trailers` array. + + ```js + import diagnosticsChannel from 'diagnostics_channel' diff --git a/node_modules/undici/lib/core/request.js b/node_modules/undici/lib/core/request.js -index 4da60667ec2902642c9e7a1bf529245765b79afb..8e7ecc73084b8b9f0fbb9c8365f3284a9d260aae 100644 +index 4da60667ec2902642c9e7a1bf529245765b79afb..0b2b1a8d9d7b63e659013409624a86265d8ae391 100644 --- a/node_modules/undici/lib/core/request.js +++ b/node_modules/undici/lib/core/request.js -@@ -350,7 +350,13 @@ function processHeader (request, key, val) { +@@ -263,11 +263,77 @@ class Request { + } + } + +- onUpgrade (statusCode, headers, socket) { ++ /** ++ * @param {number|null} statusCode ++ * @param {Buffer[]|null} headers ++ * @param {import('node:stream').Duplex} socket ++ * @param {string} [statusText] ++ */ ++ onUpgrade (statusCode, headers, socket, statusText = '') { ++ this.onFinally() ++ + assert(!this.aborted) + assert(!this.completed) + +- return this[kHandler].onUpgrade(statusCode, headers, socket) ++ if (statusCode !== null) { ++ this.#publishUpgradeHeaders(statusCode, headers, statusText) ++ } ++ ++ const result = this[kHandler].onUpgrade(statusCode, headers, socket) ++ ++ if (!this.aborted) { ++ this.completed = true ++ if (statusCode !== null) { ++ this.#publishUpgradeTrailers() ++ } ++ } ++ ++ return result ++ } ++ ++ /** ++ * @param {number} statusCode ++ * @param {import('node:http2').IncomingHttpHeaders} headers ++ * @param {(headers: import('node:http2').IncomingHttpHeaders) => Buffer[]} parseHeaders ++ * @param {string} [statusText] ++ */ ++ onUpgradeResponse (statusCode, headers, parseHeaders, statusText = '') { ++ assert(!this.aborted) ++ assert(this.completed) ++ ++ if (channels.headers.hasSubscribers) { ++ this.#publishUpgradeHeaders(statusCode, parseHeaders(headers), statusText) ++ } ++ this.#publishUpgradeTrailers() ++ } ++ ++ /** ++ * @param {Error} error ++ */ ++ onUpgradeError (error) { ++ assert(!this.aborted) ++ assert(this.completed) ++ ++ if (channels.error.hasSubscribers) { ++ channels.error.publish({ request: this, error }) ++ } ++ } ++ ++ /** ++ * @param {number} statusCode ++ * @param {Buffer[]} headers ++ * @param {string} statusText ++ */ ++ #publishUpgradeHeaders (statusCode, headers, statusText) { ++ if (channels.headers.hasSubscribers) { ++ channels.headers.publish({ request: this, response: { statusCode, headers, statusText } }) ++ } ++ } ++ ++ #publishUpgradeTrailers () { ++ if (channels.trailers.hasSubscribers) { ++ channels.trailers.publish({ request: this, trailers: [] }) ++ } + } + + onComplete (trailers) { +@@ -350,7 +416,13 @@ function processHeader (request, key, val) { } else if (typeof val[i] === 'object') { throw new InvalidArgumentError(`invalid ${key} header`) } else { @@ -1859,7 +1974,7 @@ index 4da60667ec2902642c9e7a1bf529245765b79afb..8e7ecc73084b8b9f0fbb9c8365f3284a } } val = arr -@@ -361,7 +367,12 @@ function processHeader (request, key, val) { +@@ -361,7 +433,12 @@ function processHeader (request, key, val) { } else if (val === null) { val = '' } else { @@ -1870,10 +1985,40 @@ index 4da60667ec2902642c9e7a1bf529245765b79afb..8e7ecc73084b8b9f0fbb9c8365f3284a + throw new InvalidArgumentError(`invalid ${key} header`) + } } - + if (headerName === 'host') { +diff --git a/node_modules/undici/lib/dispatcher/agent.js b/node_modules/undici/lib/dispatcher/agent.js +index 90b46fe3aeb4b4bbb8af48d18a74dc73c9aaa1f8..416ab3edda301f7e5888cb7a1de28689bc18ce2d 100644 +--- a/node_modules/undici/lib/dispatcher/agent.js ++++ b/node_modules/undici/lib/dispatcher/agent.js +@@ -23,7 +23,7 @@ function defaultFactory (origin, opts) { + } + + class Agent extends DispatcherBase { +- constructor ({ factory = defaultFactory, maxRedirections = 0, connect, ...options } = {}) { ++ constructor ({ factory = defaultFactory, maxRedirections = 0, connect, tls, ...options } = {}) { + if (typeof factory !== 'function') { + throw new InvalidArgumentError('factory must be a function.') + } +@@ -42,11 +42,15 @@ class Agent extends DispatcherBase { + connect = { ...connect } + } + ++ if (tls && typeof tls !== 'function') { ++ tls = { ...tls } ++ } ++ + this[kInterceptors] = options.interceptors?.Agent && Array.isArray(options.interceptors.Agent) + ? options.interceptors.Agent + : [createRedirectInterceptor({ maxRedirections })] + +- this[kOptions] = { ...util.deepClone(options), connect } ++ this[kOptions] = { ...util.deepClone(options), connect, tls } + this[kOptions].interceptors = options.interceptors + ? { ...options.interceptors } + : undefined diff --git a/node_modules/undici/lib/dispatcher/client-h1.js b/node_modules/undici/lib/dispatcher/client-h1.js -index 9455517a19b15f78de88b3cd355cd47af69b87ae..6b28f60c06df563f9baee7580731da149c10cd34 100644 +index 9455517a19b15f78de88b3cd355cd47af69b87ae..7d1fdbdf6e7b811f3e399b6fbe46b94d57bb5d56 100644 --- a/node_modules/undici/lib/dispatcher/client-h1.js +++ b/node_modules/undici/lib/dispatcher/client-h1.js @@ -10,6 +10,7 @@ const { @@ -1884,17 +2029,49 @@ index 9455517a19b15f78de88b3cd355cd47af69b87ae..6b28f60c06df563f9baee7580731da14 HeadersTimeoutError, HeadersOverflowError, SocketError, -@@ -875,7 +876,7 @@ async function connectH1 (client, socket) { - +@@ -431,7 +432,7 @@ class Parser { + } + + onUpgrade (head) { +- const { upgrade, client, socket, headers, statusCode } = this ++ const { upgrade, client, socket, headers, statusCode, statusText } = this + + assert(upgrade) + assert(client[kSocket] === socket) +@@ -466,9 +467,10 @@ class Parser { + client.emit('disconnect', client[kUrl], [client], new InformationalError('upgrade')) + + try { +- request.onUpgrade(statusCode, headers, socket) +- } catch (err) { +- util.destroy(socket, err) ++ request.onUpgrade(statusCode, headers, socket, statusText) ++ } catch (error) { ++ util.errorRequest(client, request, error) ++ util.destroy(socket, error) + } + + client[kResume]() +@@ -725,8 +727,6 @@ async function connectH1 (client, socket) { + socket[kParser] = new Parser(client, socket, llhttpInstance) + + addListener(socket, 'error', function (err) { +- assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID') +- + const parser = this[kParser] + + // On Mac OS, we get an ECONNRESET even if there is a full body to be forwarded +@@ -875,7 +875,7 @@ async function connectH1 (client, socket) { + function clearIdleSocketValidation (socket) { if (socket[kIdleSocketValidationTimeout]) { - clearTimeout(socket[kIdleSocketValidationTimeout]) + clearImmediate(socket[kIdleSocketValidationTimeout]) socket[kIdleSocketValidationTimeout] = null } - -@@ -884,15 +885,23 @@ function clearIdleSocketValidation (socket) { - + +@@ -884,15 +884,23 @@ function clearIdleSocketValidation (socket) { + function scheduleIdleSocketValidation (client, socket) { socket[kIdleSocketValidation] = 1 - socket[kIdleSocketValidationTimeout] = setTimeout(() => { @@ -1910,7 +2087,7 @@ index 9455517a19b15f78de88b3cd355cd47af69b87ae..6b28f60c06df563f9baee7580731da14 + socket[kIdleSocketValidationTimeout] = setImmediate(() => { socket[kIdleSocketValidationTimeout] = null socket[kIdleSocketValidation] = 2 - + if (client[kSocket] === socket && !socket.destroyed) { client[kResume]() } @@ -1918,9 +2095,9 @@ index 9455517a19b15f78de88b3cd355cd47af69b87ae..6b28f60c06df563f9baee7580731da14 - socket[kIdleSocketValidationTimeout].unref?.() + }) } - + /** -@@ -993,8 +1002,16 @@ function writeH1 (client, request) { +@@ -993,8 +1001,16 @@ function writeH1 (client, request) { } body = bodyStream.stream contentLength = bodyStream.length @@ -1937,16 +2114,254 @@ index 9455517a19b15f78de88b3cd355cd47af69b87ae..6b28f60c06df563f9baee7580731da14 + headers.push('content-type', contentTypeValue) + } } - + if (body && typeof body.read === 'function') { +@@ -1033,12 +1049,22 @@ function writeH1 (client, request) { + const socket = client[kSocket] + clearIdleSocketValidation(socket) + +- const abort = (err) => { +- if (request.aborted || request.completed) { ++ /** ++ * @param {Error} [error] ++ */ ++ const abort = (error) => { ++ if (request.aborted) { ++ return ++ } ++ ++ if (request.completed) { ++ if (request.upgrade || request.method === 'CONNECT') { ++ util.destroy(socket, new InformationalError('aborted')) ++ } + return + } + +- util.errorRequest(client, request, err || new RequestAbortedError()) ++ util.errorRequest(client, request, error || new RequestAbortedError()) + + util.destroy(body) + util.destroy(socket, new InformationalError('aborted')) +diff --git a/node_modules/undici/lib/dispatcher/client-h2.js b/node_modules/undici/lib/dispatcher/client-h2.js +index 4a52effb1f3b14bacc122764a7e0a36a17ed93cc..f417aa3d1867ff21055ebb908da1915970613cf9 100644 +--- a/node_modules/undici/lib/dispatcher/client-h2.js ++++ b/node_modules/undici/lib/dispatcher/client-h2.js +@@ -1,6 +1,7 @@ + 'use strict' + + const assert = require('node:assert') ++const { errorMonitor } = require('node:events') + const { pipeline } = require('node:stream') + const util = require('../core/util.js') + const { +@@ -77,6 +78,15 @@ function parseH2Headers (headers) { + return result + } + ++/** ++ * @param {import('node:http2').IncomingHttpHeaders} headers ++ * @returns {Buffer[]} ++ */ ++function parseH2ResponseHeaders (headers) { ++ const { [HTTP2_HEADER_STATUS]: _statusCode, ...realHeaders } = headers ++ return parseH2Headers(realHeaders) ++} ++ + async function connectH2 (client, socket) { + client[kSocket] = socket + +@@ -126,8 +136,6 @@ async function connectH2 (client, socket) { + socket[kHTTP2Session] = session + + util.addListener(socket, 'error', function (err) { +- assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID') +- + this[kError] = err + + this[kClient][kOnError](err) +@@ -201,8 +209,6 @@ function resumeH2 (client) { + } + + function onHttp2SessionError (err) { +- assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID') +- + this[kSocket][kError] = err + this[kClient][kOnError](err) + } +@@ -297,22 +303,32 @@ function writeH2 (client, request) { + headers[HTTP2_HEADER_AUTHORITY] = host || `${hostname}${port ? `:${port}` : ''}` + headers[HTTP2_HEADER_METHOD] = method + +- const abort = (err) => { +- if (request.aborted || request.completed) { ++ /** ++ * @param {Error} [error] ++ */ ++ const abort = (error) => { ++ if (request.aborted) { + return + } + +- err = err || new RequestAbortedError() ++ if (request.completed) { ++ if (method === 'CONNECT' && stream != null) { ++ util.destroy(stream, error || new RequestAbortedError()) ++ } ++ return ++ } + +- util.errorRequest(client, request, err) ++ error = error || new RequestAbortedError() ++ ++ util.errorRequest(client, request, error) + + if (stream != null) { +- util.destroy(stream, err) ++ util.destroy(stream, error) + } + + // We do not destroy the socket as we can continue using the session + // the stream get's destroyed and the session remains to create new streams +- util.destroy(body, err) ++ util.destroy(body, error) + client[kQueue][client[kRunningIdx]++] = null + client[kResume]() + } +@@ -331,25 +347,57 @@ function writeH2 (client, request) { + + if (method === 'CONNECT') { + session.ref() +- // We are already connected, streams are pending, first request +- // will create a new stream. We trigger a request to create the stream and wait until +- // `ready` event is triggered + // We disabled endStream to allow the user to write to the stream + stream = session.request(headers, { endStream: false, signal }) ++ let upgradeResponseFinished = false ++ ++ /** ++ * @param {import('node:http2').IncomingHttpHeaders} headers ++ */ ++ const onResponse = (headers) => { ++ upgradeResponseFinished = true ++ stream.off(errorMonitor, onUpgradeError) ++ request.onUpgradeResponse(Number(headers[HTTP2_HEADER_STATUS]), headers, parseH2ResponseHeaders) ++ } + +- if (stream.id && !stream.pending) { +- request.onUpgrade(null, null, stream) +- ++session[kOpenStreams] +- client[kQueue][client[kRunningIdx]++] = null +- } else { +- stream.once('ready', () => { ++ /** ++ * @param {Error} error ++ */ ++ const onUpgradeError = (error) => { ++ upgradeResponseFinished = true ++ stream.off('response', onResponse) ++ request.onUpgradeError(error) ++ } ++ ++ const onReady = () => { ++ try { + request.onUpgrade(null, null, stream) +- ++session[kOpenStreams] +- client[kQueue][client[kRunningIdx]++] = null +- }) ++ } catch (error) { ++ stream.off('response', onResponse) ++ abort(error) ++ return ++ } ++ ++ if (request.aborted) { ++ return ++ } ++ ++ stream.off('error', abort) ++ stream.once(errorMonitor, onUpgradeError) ++ client[kQueue][client[kRunningIdx]++] = null + } + ++ stream.once('response', onResponse) ++ stream.once('error', abort) ++ ++session[kOpenStreams] ++ onReady() ++ + stream.once('close', () => { ++ if (!upgradeResponseFinished && request.completed) { ++ stream.off('response', onResponse) ++ stream.off(errorMonitor, onUpgradeError) ++ request.onUpgradeError(new InformationalError(`HTTP/2: "stream error" received - code ${stream.rstCode}`)) ++ } + session[kOpenStreams] -= 1 + if (session[kOpenStreams] === 0) session.unref() + }) +diff --git a/node_modules/undici/lib/dispatcher/client.js b/node_modules/undici/lib/dispatcher/client.js +index 18472fffd773fc168da898b142b41ea4417b77c3..9efe80e3002bcc170834e3121a22feb824ecc082 100644 +--- a/node_modules/undici/lib/dispatcher/client.js ++++ b/node_modules/undici/lib/dispatcher/client.js +@@ -107,9 +107,10 @@ class Client extends DispatcherBase { + // h2 + maxConcurrentStreams, + allowH2, +- webSocket ++ webSocket, ++ eventSource + } = {}) { +- super({ webSocket }) ++ super({ webSocket, eventSource }) + + if (keepAlive !== undefined) { + throw new InvalidArgumentError('unsupported keepAlive, use pipelining=0 instead') +diff --git a/node_modules/undici/lib/dispatcher/dispatcher-base.js b/node_modules/undici/lib/dispatcher/dispatcher-base.js +index 371a3ea1f6f1e013a3058953fa08206e1746b3a6..e90e4b379ef96dd541e57f9bc878f11c995cef55 100644 +--- a/node_modules/undici/lib/dispatcher/dispatcher-base.js ++++ b/node_modules/undici/lib/dispatcher/dispatcher-base.js +@@ -1,5 +1,6 @@ + 'use strict' + ++const buffer = require('node:buffer') + const Dispatcher = require('./dispatcher') + const { + ClientDestroyedError, +@@ -12,6 +13,7 @@ const kOnDestroyed = Symbol('onDestroyed') + const kOnClosed = Symbol('onClosed') + const kInterceptedDispatch = Symbol('Intercepted Dispatch') + const kWebSocketOptions = Symbol('webSocketOptions') ++const kEventSourceOptions = Symbol('eventSourceOptions') + + class DispatcherBase extends Dispatcher { + constructor (opts) { +@@ -22,6 +24,7 @@ class DispatcherBase extends Dispatcher { + this[kClosed] = false + this[kOnClosed] = [] + this[kWebSocketOptions] = opts?.webSocket ?? {} ++ this[kEventSourceOptions] = opts?.eventSource ?? {} + } + + get webSocketOptions () { +@@ -31,6 +34,12 @@ class DispatcherBase extends Dispatcher { + } + } + ++ get eventSourceOptions () { ++ return { ++ maxEventSize: this[kEventSourceOptions].maxEventSize ?? buffer.kStringMaxLength ++ } ++ } ++ + get destroyed () { + return this[kDestroyed] + } diff --git a/node_modules/undici/lib/handler/retry-handler.js b/node_modules/undici/lib/handler/retry-handler.js -index 5d1ccf00538766402b02fc2919c806e9541ee969..2e36ab31daf1192739dfd37f64b28da83e894019 100644 +index 5d1ccf00538766402b02fc2919c806e9541ee969..7084c2b5652066fe51b9d3651e7ded356da5bb65 100644 --- a/node_modules/undici/lib/handler/retry-handler.js +++ b/node_modules/undici/lib/handler/retry-handler.js @@ -15,6 +15,28 @@ function calculateRetryAfterHeader (retryAfter) { return new Date(retryAfter).getTime() - current } - + +function validatePartialResponseContentLength (headers, range, statusCode, retryCount) { + const contentLength = headers['content-length'] + if (contentLength == null) { @@ -1977,13 +2392,13 @@ index 5d1ccf00538766402b02fc2919c806e9541ee969..2e36ab31daf1192739dfd37f64b28da8 this.etag = null this.resume = null + this.headersSent = false - + // Handle possible onConnect duplication this.handler.onConnect(reason => { @@ -80,6 +103,20 @@ class RetryHandler { }) } - + + checkpointResponseEnd (headers, resume) { + if (this.end == null && this.opts.method !== 'HEAD') { + const contentLength = headers['content-length'] @@ -2001,19 +2416,24 @@ index 5d1ccf00538766402b02fc2919c806e9541ee969..2e36ab31daf1192739dfd37f64b28da8 onRequestSent () { if (this.handler.onRequestSent) { this.handler.onRequestSent() -@@ -169,6 +206,8 @@ class RetryHandler { - +@@ -168,7 +205,12 @@ class RetryHandler { + this.retryCount += 1 + if (statusCode >= 300) { - if (this.retryOpts.statusCodes.includes(statusCode) === false) { +- if (this.retryOpts.statusCodes.includes(statusCode) === false) { ++ // Only expose a response if no earlier attempt has reached the caller. ++ // Otherwise abort this attempt so the error settles the existing body ++ // instead of replacing it with a new response. ++ if (!this.headersSent && this.retryOpts.statusCodes.includes(statusCode) === false) { + this.headersSent = true + this.checkpointResponseEnd(headers, resume) return this.handler.onHeaders( statusCode, rawHeaders, -@@ -229,10 +268,23 @@ class RetryHandler { +@@ -229,10 +271,23 @@ class RetryHandler { return false } - + + const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount) + if (contentLengthError != null) { + this.abort(contentLengthError) @@ -2021,7 +2441,7 @@ index 5d1ccf00538766402b02fc2919c806e9541ee969..2e36ab31daf1192739dfd37f64b28da8 + } + const { start, size, end = size - 1 } = contentRange - + - assert(this.start === start, 'content-range mismatch') - assert(this.end == null || this.end === end, 'content-range mismatch') + if (this.start !== start || (this.end != null && this.end !== end)) { @@ -2033,21 +2453,21 @@ index 5d1ccf00538766402b02fc2919c806e9541ee969..2e36ab31daf1192739dfd37f64b28da8 + ) + return false + } - + this.resume = resume return true -@@ -244,6 +296,7 @@ class RetryHandler { +@@ -244,6 +299,7 @@ class RetryHandler { const range = parseRangeHeader(headers['content-range']) - + if (range == null) { + this.headersSent = true return this.handler.onHeaders( statusCode, rawHeaders, -@@ -252,6 +305,12 @@ class RetryHandler { +@@ -252,6 +308,12 @@ class RetryHandler { ) } - + + const contentLengthError = validatePartialResponseContentLength(headers, range, statusCode, this.retryCount) + if (contentLengthError != null) { + this.abort(contentLengthError) @@ -2057,29 +2477,29 @@ index 5d1ccf00538766402b02fc2919c806e9541ee969..2e36ab31daf1192739dfd37f64b28da8 const { start, size, end = size - 1 } = range assert( start != null && Number.isFinite(start), -@@ -276,6 +335,7 @@ class RetryHandler { +@@ -276,6 +338,7 @@ class RetryHandler { ) - + this.resume = resume + this.headersSent = true this.etag = headers.etag != null ? headers.etag : null - + // Weak etags are not useful for comparison nor cache -@@ -315,7 +375,7 @@ class RetryHandler { +@@ -315,7 +378,7 @@ class RetryHandler { } - + onError (err) { - if (this.aborted || isDisturbed(this.opts.body)) { + if (this.aborted || isDisturbed(this.opts.body) || (this.headersSent && this.resume == null)) { return this.handler.onError(err) } - + diff --git a/node_modules/undici/lib/web/cookies/util.js b/node_modules/undici/lib/web/cookies/util.js index 254f5419e905bbdbb8e1706bf87860d8157717d1..ca408e153abb2f4a1aa8d927bacc44dbd1d9958b 100644 --- a/node_modules/undici/lib/web/cookies/util.js +++ b/node_modules/undici/lib/web/cookies/util.js @@ -105,7 +105,7 @@ function validateCookiePath (path) { - + if ( code < 0x20 || // exclude CTLs (0-31) - code === 0x7F || // DEL @@ -2089,7 +2509,7 @@ index 254f5419e905bbdbb8e1706bf87860d8157717d1..ca408e153abb2f4a1aa8d927bacc44db throw new Error('Invalid cookie path') @@ -114,16 +114,80 @@ function validateCookiePath (path) { } - + /** - * I have no idea why these values aren't allowed to be honest, - * but Deno tests these. - Khafra @@ -2176,9 +2596,9 @@ index 254f5419e905bbdbb8e1706bf87860d8157717d1..ca408e153abb2f4a1aa8d927bacc44db } } @@ -266,7 +330,13 @@ function stringify (cookie) { - + const [key, ...value] = part.split('=') - + - out.push(`${key.trim()}=${value.join('=')}`) + const trimmedKey = key.trim() + const joinedValue = value.join('=') @@ -2188,21 +2608,35 @@ index 254f5419e905bbdbb8e1706bf87860d8157717d1..ca408e153abb2f4a1aa8d927bacc44db + + out.push(`${trimmedKey}=${joinedValue}`) } - + return out.join('; ') diff --git a/node_modules/undici/lib/web/eventsource/eventsource-stream.js b/node_modules/undici/lib/web/eventsource/eventsource-stream.js -index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c739a9e6bc 100644 +index 754934568d05626224eb1fce3e015f65a9b1e831..9172602ad0564d92e44448146af21f4ea05df3c5 100644 --- a/node_modules/undici/lib/web/eventsource/eventsource-stream.js +++ b/node_modules/undici/lib/web/eventsource/eventsource-stream.js -@@ -23,6 +23,49 @@ const COLON = 0x3A +@@ -1,4 +1,5 @@ + 'use strict' ++const buffer = require('node:buffer') + const { Transform } = require('node:stream') + const { isASCIINumber, isValidLastEventId } = require('./util') + +@@ -23,6 +24,63 @@ const COLON = 0x3A */ const SPACE = 0x20 - + ++const defaultMaxEventSize = buffer.kStringMaxLength ++ +const DATA = Buffer.from('data') +const EVENT = Buffer.from('event') +const ID = Buffer.from('id') +const RETRY = Buffer.from('retry') + ++// Each data field creates a string node, and each unconsumed input chunk keeps ++// a Buffer wrapper. The absolute ceiling protects the large default byte limit. ++const minParserItems = 1024 ++const maxParserItems = 131072 ++const bytesPerParserItem = 128 ++ +function isASCIINumberBytes (buffer, start) { + if (start >= buffer.length) { + return false @@ -2240,31 +2674,65 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 + + return true +} ++ ++function createMaxEventSizeExceededError () { ++ const error = new Error('EventSource message size exceeded') ++ error.aborted = false ++ return error ++} + /** * @typedef {object} EventSourceStreamEvent * @type {object} -@@ -63,11 +106,14 @@ class EventSourceStream extends Transform { +@@ -63,11 +121,21 @@ class EventSourceStream extends Transform { eventEndCheck = false - + /** - * @type {Buffer} + * @type {Buffer[]} */ - buffer = null + chunks = [] - + + chunkIndex = 0 pos = 0 + lineChunkIndex = 0 + linePos = 0 - ++ lineLength = 0 ++ eventSize = 0 ++ eventFieldSizes = { data: 0, event: 0, id: 0, retry: 0 } ++ dataLineCount = 0 ++ maxEventSize ++ maxDataLines ++ maxBufferedChunks + event = { data: undefined, -@@ -106,92 +152,20 @@ class EventSourceStream extends Transform { +@@ -78,6 +146,7 @@ class EventSourceStream extends Transform { + + /** + * @param {object} options ++ * @param {number} [options.maxEventSize] + * @param {eventSourceSettings} options.eventSourceSettings + * @param {Function} [options.push] + */ +@@ -89,6 +158,12 @@ class EventSourceStream extends Transform { + super(options) + + this.state = options.eventSourceSettings || {} ++ this.maxEventSize = options.maxEventSize ?? defaultMaxEventSize ++ const parserItemLimit = this.maxEventSize > 0 ++ ? Math.min(maxParserItems, Math.max(minParserItems, Math.floor(this.maxEventSize / bytesPerParserItem))) ++ : 0 ++ this.maxDataLines = parserItemLimit ++ this.maxBufferedChunks = parserItemLimit + if (options.push) { + this.push = options.push + } +@@ -106,92 +181,28 @@ class EventSourceStream extends Transform { return } - + - // Cache the chunk in the buffer, as the data might not be complete while - // processing it - // TODO: Investigate if there is a more performant way to handle @@ -2274,9 +2742,16 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 - this.buffer = Buffer.concat([this.buffer, chunk]) - } else { - this.buffer = chunk -- } ++ // A leading line ending can immediately release the currently buffered ++ // line, even when it uses the final allowed chunk slot. ++ if (this.maxEventSize > 0 && ++ this.chunks.length >= this.maxBufferedChunks && ++ chunk[0] !== LF && chunk[0] !== CR) { ++ callback(createMaxEventSizeExceededError()) ++ return + } + this.chunks.push(chunk) - + // Strip leading byte-order-mark if we opened the stream and started // the processing of the incoming data if (this.checkBOM) { @@ -2353,7 +2828,7 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 + return } } - + - while (this.pos < this.buffer.length) { + while (this.hasCurrentByte()) { + const byte = this.currentByte() @@ -2361,7 +2836,7 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 // If the previous line ended with an end-of-line, we need to check // if the next character is also an end-of-line. if (this.eventEndCheck) { -@@ -204,10 +178,9 @@ class EventSourceStream extends Transform { +@@ -204,10 +215,9 @@ class EventSourceStream extends Transform { if (this.crlfCheck) { // If the current character is a line feed, we can remove it // from the buffer and reset the crlfCheck flag @@ -2371,13 +2846,13 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 + if (byte === LF) { this.crlfCheck = false + this.consumeCurrentByte() - + // It is possible that the line feed is not the end of the // event. We need to check if the next character is an -@@ -223,19 +196,17 @@ class EventSourceStream extends Transform { +@@ -223,19 +233,17 @@ class EventSourceStream extends Transform { this.crlfCheck = false } - + - if (this.buffer[this.pos] === LF || this.buffer[this.pos] === CR) { + if (byte === LF || byte === CR) { // If the current character is a carriage return, we need to @@ -2388,7 +2863,7 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 + if (byte === CR) { this.crlfCheck = true } - + - this.buffer = this.buffer.subarray(this.pos + 1) - this.pos = 0 - if ( @@ -2398,8 +2873,8 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 this.processEvent(this.event) } this.clearEvent() -@@ -249,22 +220,18 @@ class EventSourceStream extends Transform { - +@@ -249,22 +257,23 @@ class EventSourceStream extends Transform { + // If the current character is an end-of-line, we can process the // line - if (this.buffer[this.pos] === LF || this.buffer[this.pos] === CR) { @@ -2411,7 +2886,7 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 + if (byte === CR) { this.crlfCheck = true } - + // In any case, we can process the line as we reached an // end-of-line character - this.parseLine(this.buffer.subarray(0, this.pos), this.event) @@ -2420,29 +2895,56 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 - this.buffer = this.buffer.subarray(this.pos + 1) - // Reset the position as we removed the processed line from the buffer - this.pos = 0 -+ this.parseLine(this.readLine(), this.event) ++ try { ++ this.parseLine(this.readLine(), this.event) ++ } catch (error) { ++ callback(error) ++ return ++ } + this.consumeCurrentByte() // A line was processed and this could be the end of the event. We need // to check if the next line is empty to determine if the event is // finished. -@@ -272,7 +239,7 @@ class EventSourceStream extends Transform { +@@ -272,15 +281,28 @@ class EventSourceStream extends Transform { continue } - + - this.pos++ ++ // readLine() is only called after CR or LF. Reject an unfinished line ++ // before it can retain an unbounded number of decoded chunks. The seven ++ // extra bytes allow the longest field prefix ("event: " or "retry: "). ++ if (this.maxEventSize > 0 && ++this.lineLength > this.maxEventSize + 7) { ++ callback(createMaxEventSizeExceededError()) ++ return ++ } + this.advanceCursor() } - + callback() -@@ -297,64 +264,53 @@ class EventSourceStream extends Transform { + } + ++ _destroy (error, callback) { ++ this.chunks.length = 0 ++ this.clearEvent() ++ super._destroy(error, callback) ++ } ++ + /** + * @param {Buffer} line +- * @param {EventStreamEvent} event ++ * @param {EventSourceStreamEvent} event + */ + parseLine (line, event) { + // If the line is empty (a blank line) +@@ -297,67 +319,74 @@ class EventSourceStream extends Transform { return } - + - let field = '' - let value = '' + let fieldLength = line.length + let valueStart = line.length - + // If the line contains a U+003A COLON character (:) if (colonPosition !== -1) { - // Collect the characters on the line before the first U+003A COLON @@ -2452,7 +2954,7 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 - // see: https://github.com/nodejs/undici/issues/2630 - field = line.subarray(0, colonPosition).toString('utf8') + fieldLength = colonPosition - + // Collect the characters on the line after the first U+003A COLON // character (:), and let value be that string. // If value starts with a U+0020 SPACE character, remove it from value. @@ -2474,7 +2976,7 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 - field = line.toString('utf8') - value = '' } - + - // Modify the event with the field name and value. The value is also - // decoded as UTF-8 - switch (field) { @@ -2501,6 +3003,13 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 - } - break + if (isFieldName(line, fieldLength, DATA)) { ++ if (this.maxEventSize > 0 && this.dataLineCount >= this.maxDataLines) { ++ throw createMaxEventSizeExceededError() ++ } ++ const valueBytes = line.length - valueStart ++ const dataSize = this.eventFieldSizes.data + (event.data === undefined ? 0 : 1) + valueBytes ++ this.setEventFieldSize('data', dataSize) ++ + const value = line.toString('utf8', valueStart) + + if (event.data === undefined) { @@ -2508,11 +3017,13 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 + } else { + event.data += `\n${value}` + } ++ this.dataLineCount++ + return + } + + if (isFieldName(line, fieldLength, RETRY)) { + if (isASCIINumberBytes(line, valueStart)) { ++ this.setEventFieldSize('retry', line.length - valueStart) + event.retry = line.toString('utf8', valueStart) + } + return @@ -2520,23 +3031,35 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 + + if (isFieldName(line, fieldLength, ID)) { + if (isValidLastEventIdBytes(line, valueStart)) { ++ this.setEventFieldSize('id', line.length - valueStart) + event.id = line.toString('utf8', valueStart) + } + return + } + + if (isFieldName(line, fieldLength, EVENT)) { -+ const value = line.toString('utf8', valueStart) -+ -+ if (value.length > 0) { -+ event.event = value ++ if (valueStart < line.length) { ++ this.setEventFieldSize('event', line.length - valueStart) ++ event.event = line.toString('utf8', valueStart) + } } } - -@@ -384,12 +340,151 @@ class EventSourceStream extends Transform { + ++ setEventFieldSize (field, size) { ++ const eventSize = this.eventSize - this.eventFieldSizes[field] + size ++ if (this.maxEventSize > 0 && eventSize > this.maxEventSize) { ++ throw createMaxEventSizeExceededError() ++ } ++ this.eventSize = eventSize ++ this.eventFieldSizes[field] = size ++ } ++ + /** + * @param {EventSourceStreamEvent} event + */ +@@ -384,13 +413,160 @@ class EventSourceStream extends Transform { } - + clearEvent () { - this.event = { - data: undefined, @@ -2547,6 +3070,12 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 + this.event.event = undefined + this.event.id = undefined + this.event.retry = undefined ++ this.eventSize = 0 ++ this.dataLineCount = 0 ++ this.eventFieldSizes.data = 0 ++ this.eventFieldSizes.event = 0 ++ this.eventFieldSizes.id = 0 ++ this.eventFieldSizes.retry = 0 + } + + hasPendingEvent () { @@ -2582,14 +3111,16 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 + syncLineStartToCursor () { + this.lineChunkIndex = this.chunkIndex + this.linePos = this.pos ++ this.lineLength = 0 + this.dropConsumedChunks() + } + + dropConsumedChunks () { -+ while (this.lineChunkIndex > 0) { -+ this.chunks.shift() -+ this.lineChunkIndex-- -+ this.chunkIndex-- ++ if (this.lineChunkIndex > 0) { ++ const consumed = this.lineChunkIndex ++ this.chunks.splice(0, consumed) ++ this.lineChunkIndex = 0 ++ this.chunkIndex -= consumed + } + + if (this.chunkIndex === this.chunks.length) { @@ -2598,8 +3129,8 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 + this.pos = 0 + this.lineChunkIndex = 0 + this.linePos = 0 -+ } -+ } + } + } + + readLine () { + if (this.lineChunkIndex === this.chunkIndex) { @@ -2680,7 +3211,7 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 + + this.checkBOM = false + return false - } ++ } + + if (first === BOM[0] && second === BOM[1] && third === BOM[2]) { + this.discardLeadingBytes(3) @@ -2688,9 +3219,95 @@ index 754934568d05626224eb1fce3e015f65a9b1e831..af04e16322cc6af0bbb1eb92876235c7 + + this.checkBOM = false + return !this.hasCurrentByte() - } ++ } } - + + module.exports = { +diff --git a/node_modules/undici/lib/web/eventsource/eventsource.js b/node_modules/undici/lib/web/eventsource/eventsource.js +index 5a488ffce276a0a5feb44ae8f29c38dbf5e3b235..6092645bf2c761b04b20c944b070a72f10ee8f5b 100644 +--- a/node_modules/undici/lib/web/eventsource/eventsource.js ++++ b/node_modules/undici/lib/web/eventsource/eventsource.js +@@ -11,6 +11,7 @@ const { isNetworkError } = require('../fetch/response') + const { delay } = require('./util') + const { kEnumerableProperty } = require('../../core/util') + const { environmentSettingsObject } = require('../fetch/util') ++const { getGlobalDispatcher } = require('../../global') + + let experimentalWarned = false + +@@ -292,6 +293,7 @@ class EventSource extends EventTarget { + + const eventSourceStream = new EventSourceStream({ + eventSourceSettings: this.#state, ++ maxEventSize: this.#dispatcher.eventSourceOptions?.maxEventSize, + push: (event) => { + this.dispatchEvent(createFastMessageEvent( + event.type, +@@ -470,7 +472,8 @@ webidl.converters.EventSourceInitDict = webidl.dictionaryConverter([ + }, + { + key: 'dispatcher', // undici only +- converter: webidl.converters.any ++ converter: webidl.converters.any, ++ defaultValue: () => getGlobalDispatcher() + } + ]) + +diff --git a/node_modules/undici/lib/web/fetch/index.js b/node_modules/undici/lib/web/fetch/index.js +index 9a685d680a1c36ff67041d4d200eb28493f866f5..b3b21873dcd58a19ca354f2649b166143917200b 100644 +--- a/node_modules/undici/lib/web/fetch/index.js ++++ b/node_modules/undici/lib/web/fetch/index.js +@@ -1950,8 +1950,10 @@ async function httpNetworkFetch ( + // 19. Run these steps in parallel: + + // 1. Run these steps, but abort when fetchParams is canceled: +- fetchParams.controller.onAborted = onAborted +- fetchParams.controller.on('terminated', onAborted) ++ if (!fetchParams.controller.resume) { ++ fetchParams.controller.on('terminated', onAborted) ++ } ++ + fetchParams.controller.resume = async () => { + // 1. While true + while (true) { +@@ -2120,8 +2122,6 @@ async function httpNetworkFetch ( + } + location = headersList.get('location', true) + +- this.body = new Readable({ read: resume }) +- + const decoders = [] + + const willFollow = location && request.redirect === 'follow' && +@@ -2139,7 +2139,7 @@ async function httpNetworkFetch ( + // CVE fix similar to urllib3 (GHSA-gm62-xv2j-4w53) and curl (CVE-2022-32206). + const maxContentEncodings = 5 + if (codings.length > maxContentEncodings) { +- reject(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`)) ++ this.abort(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`)) + return true + } + +@@ -2172,6 +2172,8 @@ async function httpNetworkFetch ( + } + } + ++ this.body = new Readable({ read: resume }) ++ + const onError = this.onError.bind(this) + + resolve({ +@@ -2218,10 +2220,6 @@ async function httpNetworkFetch ( + fetchParams.controller.off('terminated', this.abort) + } + +- if (fetchParams.controller.onAborted) { +- fetchParams.controller.off('terminated', fetchParams.controller.onAborted) +- } +- + fetchParams.controller.ended = true + + this.body.push(null) diff --git a/node_modules/undici/lib/web/websocket/connection.js b/node_modules/undici/lib/web/websocket/connection.js index bb87d361e4b743150506f312dd13c39beac3fa21..1197b9b650c273a62e84aa8d9db987ef2f6485b7 100644 --- a/node_modules/undici/lib/web/websocket/connection.js @@ -2709,7 +3326,7 @@ index 6a6e43899c5a959908f11f6388850fc54f8ef2b6..0b3d493db8204efe9c2fc75b371240b0 --- a/node_modules/undici/lib/web/websocket/permessage-deflate.js +++ b/node_modules/undici/lib/web/websocket/permessage-deflate.js @@ -63,7 +63,12 @@ class PerMessageDeflate { - + if (this.#maxPayloadSize > 0 && this.#inflate[kLength] > this.#maxPayloadSize) { callback(new MessageSizeExceededError()) + // The inflater may still hold buffered input that can emit a late @@ -2721,15 +3338,40 @@ index 6a6e43899c5a959908f11f6388850fc54f8ef2b6..0b3d493db8204efe9c2fc75b371240b0 this.#inflate = null return } +diff --git a/node_modules/undici/lib/web/websocket/receiver.js b/node_modules/undici/lib/web/websocket/receiver.js +index a7dea7fae1c1fcd60906d3cc464bfcb3c87fadf0..b36ef9f93781ec2e97b81d8b5f76c97fd4270b70 100644 +--- a/node_modules/undici/lib/web/websocket/receiver.js ++++ b/node_modules/undici/lib/web/websocket/receiver.js +@@ -249,6 +249,20 @@ class ByteParser extends Writable { + if (isControlFrame(this.#info.opcode)) { + this.#loop = this.parseControlFrame(body) + this.#state = parserStates.INFO ++ ++ // If the automatic PONG/CLOSE reply filled the socket's write buffer, ++ // stop parsing and resume on drain so a PING flood cannot grow the ++ // outbound queue without bound. ++ const socket = this.ws[kResponse].socket ++ if (this.#loop && socket.writableNeedDrain) { ++ this.#loop = false ++ socket.once('drain', () => { ++ if (this.destroyed) return ++ this.#loop = true ++ this.run(callback) ++ }) ++ return ++ } + } else { + if (!this.#info.compressed) { + if (!this.writeFragments(body)) { diff --git a/node_modules/undici/package.json b/node_modules/undici/package.json -index 3c2001f391e3f82925f23342075e215b4d603aa0..ce7be625a4de34c13e5a1df3d0d92db4a415083a 100644 +index 3c2001f391e3f82925f23342075e215b4d603aa0..4bccc5455b894670b56604e99e45d29ded0dc3fe 100644 --- a/node_modules/undici/package.json +++ b/node_modules/undici/package.json @@ -1,6 +1,6 @@ { "name": "undici", - "version": "6.27.0", -+ "version": "6.28.1", ++ "version": "6.29.1", "description": "An HTTP/1.1 client, written from scratch for Node.js", "homepage": "https://undici.nodejs.org", "bugs": { diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index a2456698e..720f608d7 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -31,6 +31,12 @@ overrides: "@effect/platform-node-shared": "4.0.0-beta.105" "@effect/sql-sqlite-bun": "4.0.0-beta.105" "@smthrs/cli>@toon-format/toon": "2.3.1" + # Pin the patched releases across Smithers' transitive dependency graph. + # The operator npm's bundled Undici is updated in patches/npm@11.19.0.patch. + "@modelcontextprotocol/sdk": "1.32.0" + "body-parser": "2.4.0" + "dompurify": "3.4.17" + "zod": "4.6.6" allowBuilds: "@moonshot-ai/kimi-code": false "@parcel/watcher": false From 38f7eb627a16e8160b326e92868e73068235869e Mon Sep 17 00:00:00 2001 From: Antonio Viggiano Date: Mon, 26 Oct 2026 19:40:51 +0000 Subject: [PATCH 2/3] fix: pin generated controller dependencies and migrate manifests --- docs/security.md | 5 ++ packages/runtime/src/smithers-package.ts | 81 ++++++++++++------- packages/runtime/test/fake-npm-installer.ts | 2 +- packages/runtime/test/runtime.test.ts | 44 +++++++--- .../runtime/test/smithers-package.test.ts | 41 +++++++--- pnpm-workspace.yaml | 4 +- 6 files changed, 123 insertions(+), 54 deletions(-) diff --git a/docs/security.md b/docs/security.md index 11e49b023..3ea0d3771 100644 --- a/docs/security.md +++ b/docs/security.md @@ -187,6 +187,11 @@ that no such shim directory is copied. Socket's duplicate obfuscated-code warnings refer to npm's official bundled/minified distribution; no warning is suppressed, and registry integrity plus the closure digest cover those bytes. +The controller's generated `.smithers/package.json` is installed separately by +npm, so it also pins the fixed MCP SDK, body-parser, DOMPurify, and Zod versions. +Its fixed resolution cutoff follows those releases. Non-force init upgrades the +exact prior generated manifest to the new pins while preserving project runs. + ## Agent process environment The workflow controller receives only the active agents' configured API-key diff --git a/packages/runtime/src/smithers-package.ts b/packages/runtime/src/smithers-package.ts index f5d73284f..48b9a2241 100644 --- a/packages/runtime/src/smithers-package.ts +++ b/packages/runtime/src/smithers-package.ts @@ -19,14 +19,11 @@ export const KIMI_CODE_VERSION = "0.29.1"; // manifest does not preserve the Ultrafuzz run ID or the Smithers run ID the // durable run is keyed on. // -// A listed version only migrates when the rest of the manifest still matches the -// current generated document exactly (see `migrateGeneratedSmithersManifest`), -// so the list is fail-safe under drift: if a future bump also moves Kimi, Zod, -// TypeScript or the Effect override family, manifests from that release stop -// matching and are rejected rather than silently rewritten to a shape they were -// never installed against. That makes a stale entry inert, not dangerous -- -// but it also means an entry is only useful while its release differed from the -// current one in `smthrs` alone, which is true of 0.34.0 -> 0.35.0. +// A listed version only migrates when the rest of the manifest still matches +// the recorded generated document exactly (see +// `migrateGeneratedSmithersManifest`), so the list is fail-safe under drift. +// The 0.34.0 and pre-security 0.35.0 documents shared the old Zod and Effect +// pins; both are recognized explicitly and migrate to today's security pins. // // Only versions this repository actually pinned belong here. `0.34.0` is the // sole `smthrs` pin ever committed (the release before it pinned @@ -53,12 +50,15 @@ const SMITHERS_EFFECT_PACKAGE_NAMES = [ "@effect/sql-sqlite-bun" ] as const; -export const REQUIRED_SMITHERS_OVERRIDES: Readonly> = { +const LEGACY_SMITHERS_OVERRIDES = { effect: SMITHERS_EFFECT_VERSION, ...Object.fromEntries(SMITHERS_EFFECT_PACKAGE_NAMES.map((name) => [name, SMITHERS_EFFECT_VERSION])) }; -const REQUIRED_SMITHERS_DEPENDENCIES = { +// These were the exact generated pins before the October dependency fixes. A +// project can carry this manifest across upgrades, so keep its shape available +// solely for authenticated migration to the current document. +const LEGACY_GENERATED_SMITHERS_DEPENDENCIES = { dependencies: { "@moonshot-ai/kimi-code": KIMI_CODE_VERSION, smthrs: SMITHERS_VERSION, @@ -67,6 +67,23 @@ const REQUIRED_SMITHERS_DEPENDENCIES = { devDependencies: { typescript: "6.0.3" }, + overrides: LEGACY_SMITHERS_OVERRIDES +} as const; + +export const REQUIRED_SMITHERS_OVERRIDES: Readonly> = { + ...LEGACY_SMITHERS_OVERRIDES, + "@modelcontextprotocol/sdk": "1.32.0", + "body-parser": "2.4.0", + dompurify: "3.4.17", + zod: "4.6.6" +}; + +const REQUIRED_SMITHERS_DEPENDENCIES = { + ...LEGACY_GENERATED_SMITHERS_DEPENDENCIES, + dependencies: { + ...LEGACY_GENERATED_SMITHERS_DEPENDENCIES.dependencies, + zod: "4.6.6" + }, overrides: REQUIRED_SMITHERS_OVERRIDES } as const; @@ -95,11 +112,14 @@ const SMITHERS_PIN_PUBLISH_TIMES: Readonly> = { "@effect/platform-bun@4.0.0-beta.105": "2026-08-07T01:13:10.227Z", "@effect/platform-node-shared@4.0.0-beta.105": "2026-08-07T01:16:00.798Z", "@effect/sql-sqlite-bun@4.0.0-beta.105": "2026-08-07T01:13:00.629Z", + "@modelcontextprotocol/sdk@1.32.0": "2026-10-02T17:32:51.427Z", "@moonshot-ai/kimi-code@0.29.1": "2026-07-24T05:27:08.545Z", + "body-parser@2.4.0": "2026-10-22T11:39:38.614Z", + "dompurify@3.4.17": "2026-10-12T12:41:28.880Z", "effect@4.0.0-beta.105": "2026-08-07T01:37:58.225Z", "smthrs@0.35.0": "2026-08-17T20:35:37.787Z", "typescript@6.0.3": "2026-04-16T23:38:27.905Z", - "zod@4.4.3": "2026-05-04T07:06:40.819Z" + "zod@4.6.6": "2026-10-11T16:18:23.878Z" }; // The pin list above closes the hazard one package at a time, and only for @@ -126,11 +146,9 @@ const SMITHERS_PIN_PUBLISH_TIMES: Readonly> = { // runs -- npm does not freeze a future `--before` view. The cutoff also decides // which transitive releases launch installs, so it is also what moves a security // fix in an open range into the launched engine; `pnpm-lock.yaml` does not reach -// this install. This instant is about ten hours after `source-map-js@1.2.2` -// (2026-09-30T14:08:09Z), the newest of the releases that fix the October 2026 -// advisories in `proxy-addr`, `@vue/server-renderer`, `source-map-js` and -// `prosemirror-view`, and well after every pin. -export const SMITHERS_DEPENDENCY_RESOLUTION_CUTOFF = "2026-10-01T00:00:00Z"; +// this install. The current instant is more than two days after the newest +// pinned security release, body-parser 2.4.0, reached the registry. +export const SMITHERS_DEPENDENCY_RESOLUTION_CUTOFF = "2026-10-25T00:00:00Z"; /** * Fails when a pinned version has no recorded publish instant, or when the @@ -223,17 +241,16 @@ export function renderSmithersPackageJson(): string { * replacement text, or `undefined` when the manifest is not one this runtime is * willing to rewrite on the project's behalf. * - * Two shapes migrate, and nothing else does. + * Three shapes migrate, and nothing else does. * * 1. The frozen 0.32 shape (`smithers-orchestrator@0.32.0` plus the * `4.0.0-beta.102` override family). Extra packages in the three dependency * extension maps are preserved and only the generated pins are rewritten. - * 2. A manifest identical to `renderSmithersPackageJson()` apart from - * `dependencies.smthrs`, which must name a version in - * `MIGRATABLE_PRIOR_SMITHERS_VERSIONS`. This one is strict on purpose: it - * rewrites nothing it did not itself generate, so a hand-edited or corrupted - * manifest is still rejected and surfaces as a launch failure the operator - * resolves deliberately, rather than being quietly overwritten. + * 2. The exact previously generated `smthrs@0.35.0` manifest, before the + * security pins and cutoff moved forward. + * 3. That same generated shape with `dependencies.smthrs` at a version in + * `MIGRATABLE_PRIOR_SMITHERS_VERSIONS`. Both are strict on purpose: hand + * edits or corruption are rejected instead of silently overwritten. * * The name is historical -- it predates case 2 -- and is kept so the three call * sites and the durable behaviour they encode stay put across the pin bump. @@ -243,11 +260,11 @@ export function migrateStockSmithers032PackageManifest(value: unknown): string | } /** - * Case 2 above. Accepts only the exact generated document for a superseded pin: + * Cases 2 and 3 above. Accepts only the exact old generated document: * the same six top-level keys, the same `name`/`private`/`type`, and dependency - * sections whose key sets and values match the current ones entry for entry, - * with `smthrs` at the prior version. Any extra dependency, any missing one, any - * other version drift and any override outside `REQUIRED_SMITHERS_OVERRIDES` + * sections whose key sets and values match the recorded legacy ones entry for entry, + * with `smthrs` at the current or recorded prior version. Any extra dependency, + * any missing one, any other version drift and any override outside the legacy set * rejects. The replacement is the canonical current document, so a manifest that * only reordered keys is normalised rather than refused. */ @@ -256,7 +273,10 @@ function migrateGeneratedSmithersManifest(value: unknown): string | undefined { const dependencies = value.dependencies; if (!isRecord(dependencies)) return undefined; const pinned = dependencies[SMITHERS_PACKAGE_NAME]; - if (typeof pinned !== "string" || !MIGRATABLE_PRIOR_SMITHERS_VERSIONS.some((prior) => prior === pinned)) { + if ( + typeof pinned !== "string" || + (pinned !== SMITHERS_VERSION && !MIGRATABLE_PRIOR_SMITHERS_VERSIONS.some((prior) => prior === pinned)) + ) { return undefined; } return matchesGeneratedSmithersManifest(value, pinned) ? renderSmithersPackageJson() : undefined; @@ -265,9 +285,9 @@ function migrateGeneratedSmithersManifest(value: unknown): string | undefined { function matchesGeneratedSmithersManifest(value: Record, priorSmithersVersion: string): boolean { const expected: Record = { ...GENERATED_SMITHERS_MANIFEST_IDENTITY, - ...REQUIRED_SMITHERS_DEPENDENCIES, + ...LEGACY_GENERATED_SMITHERS_DEPENDENCIES, dependencies: { - ...REQUIRED_SMITHERS_DEPENDENCIES.dependencies, + ...LEGACY_GENERATED_SMITHERS_DEPENDENCIES.dependencies, [SMITHERS_PACKAGE_NAME]: priorSmithersVersion } }; @@ -311,6 +331,7 @@ function migrateStock032SmithersManifest(value: unknown): string | undefined { } delete dependencies["smithers-orchestrator"]; dependencies[SMITHERS_PACKAGE_NAME] = SMITHERS_VERSION; + dependencies.zod = REQUIRED_SMITHERS_DEPENDENCIES.dependencies.zod; const overrides = migratedSections.overrides!; for (const [name, version] of Object.entries(REQUIRED_SMITHERS_OVERRIDES)) overrides[name] = version; return `${JSON.stringify( diff --git a/packages/runtime/test/fake-npm-installer.ts b/packages/runtime/test/fake-npm-installer.ts index 00504237c..06313d281 100644 --- a/packages/runtime/test/fake-npm-installer.ts +++ b/packages/runtime/test/fake-npm-installer.ts @@ -33,7 +33,7 @@ export function writeFakeNpmInstaller( ["@smthrs/tool-context", SMITHERS_VERSION], ["react", "19.2.4"], ["smthrs", SMITHERS_VERSION], - ["zod", "4.4.3"] + ["zod", "4.6.6"] ]; fs.writeFileSync( npm, diff --git a/packages/runtime/test/runtime.test.ts b/packages/runtime/test/runtime.test.ts index b830e2ec2..571fb1d8c 100644 --- a/packages/runtime/test/runtime.test.ts +++ b/packages/runtime/test/runtime.test.ts @@ -1808,7 +1808,7 @@ function writeFakeInstalledSmithersDependencies(project: string): void { ["@moonshot-ai/kimi-code", KIMI_CODE_VERSION], ["@smthrs/tool-context", SMITHERS_VERSION], ["react", "19.2.4"], - ["zod", "4.4.3"] + ["zod", "4.6.6"] ] as const; for (const [name, version] of dependencies) { writeFakeInstalledSmithersDependency(project, name, version); @@ -3638,10 +3638,7 @@ test("non-force init migrates a superseded generated manifest so the project kee const project = tempProject(); assert.equal(initProject({ projectRoot: project, force: true }).ok, true); const manifestPath = path.join(project, ".smithers", "package.json"); - const current = JSON.parse(renderSmithersPackageJson()) as { - dependencies: Record; - }; - const superseded = { ...current, dependencies: { ...current.dependencies, smthrs: "0.34.0" } }; + const superseded = legacySmithersPackageManifest("0.34.0"); fs.writeFileSync(manifestPath, `${JSON.stringify(superseded, null, 2)}\n`, "utf8"); // Without `--force`, so the run directory, the Ultrafuzz run ID and the @@ -3653,6 +3650,32 @@ test("non-force init migrates a superseded generated manifest so the project kee assert.doesNotThrow(() => assertSmithersPackageManifest(JSON.parse(fs.readFileSync(manifestPath, "utf8")))); }); +test("non-force init upgrades the prior 0.35 manifest's dependency pins", () => { + const project = tempProject(); + assert.equal(initProject({ projectRoot: project, force: true }).ok, true); + const manifestPath = path.join(project, ".smithers", "package.json"); + fs.writeFileSync(manifestPath, `${JSON.stringify(legacySmithersPackageManifest(SMITHERS_VERSION), null, 2)}\n`); + + const upgraded = initProject({ projectRoot: project }); + + assert.equal(upgraded.ok, true, JSON.stringify(upgraded.diagnostics)); + assert.equal(fs.readFileSync(manifestPath, "utf8"), renderSmithersPackageJson()); +}); + +function legacySmithersPackageManifest(smithersVersion: string): Record { + const current = JSON.parse(renderSmithersPackageJson()) as { + dependencies: Record; + overrides: Record; + }; + return { + ...current, + dependencies: { ...current.dependencies, smthrs: smithersVersion, zod: "4.4.3" }, + overrides: Object.fromEntries( + Object.entries(current.overrides).filter(([name]) => name === "effect" || name.startsWith("@effect/")) + ) + }; +} + test("non-force init preserves a manifest that is not one Ultrafuzz generated", () => { const project = tempProject(); assert.equal(initProject({ projectRoot: project, force: true }).ok, true); @@ -18710,7 +18733,9 @@ test("every runner compatibility patch still anchors in the pinned Smithers rele ); // Every override must land on one Effect version, or the pinned set is not // internally consistent and npm reintroduces a second copy. - for (const [name, version] of Object.entries(REQUIRED_SMITHERS_OVERRIDES)) { + for (const [name, version] of Object.entries(REQUIRED_SMITHERS_OVERRIDES).filter( + ([name]) => name === "effect" || name.startsWith("@effect/") + )) { assert.equal(version, SMITHERS_EFFECT_VERSION, `override ${name} must track Effect ${SMITHERS_EFFECT_VERSION}`); } }); @@ -28250,12 +28275,7 @@ test("resume continues under a superseded generated manifest without changing ei // Roll the project back to what a pre-bump `init` wrote. const manifestPath = path.join(project, ".smithers", "package.json"); - const current = JSON.parse(renderSmithersPackageJson()) as { dependencies: Record }; - const superseded = `${JSON.stringify( - { ...current, dependencies: { ...current.dependencies, smthrs: "0.34.0" } }, - null, - 2 - )}\n`; + const superseded = `${JSON.stringify(legacySmithersPackageManifest("0.34.0"), null, 2)}\n`; fs.writeFileSync(manifestPath, superseded, "utf8"); fs.writeFileSync(env.SMITHERS_FAKE_LOG!, "", "utf8"); diff --git a/packages/runtime/test/smithers-package.test.ts b/packages/runtime/test/smithers-package.test.ts index 653cbc2c4..049bb2a37 100644 --- a/packages/runtime/test/smithers-package.test.ts +++ b/packages/runtime/test/smithers-package.test.ts @@ -3,6 +3,7 @@ import test from "node:test"; import { MIGRATABLE_PRIOR_SMITHERS_VERSIONS, + REQUIRED_SMITHERS_OVERRIDES, SMITHERS_VERSION, assertSmithersPackageManifest, migrateStockSmithers032PackageManifest, @@ -13,18 +14,35 @@ function currentManifest(): Record { return JSON.parse(renderSmithersPackageJson()) as Record; } -/** The document `renderSmithersPackageJson` produced under a superseded pin. */ +/** The exact generated document before the October dependency security pins. */ function priorPinManifest(priorSmithersVersion: string): Record { const manifest = currentManifest(); manifest.dependencies = { ...(manifest.dependencies as Record), - smthrs: priorSmithersVersion + smthrs: priorSmithersVersion, + zod: "4.4.3" }; + manifest.overrides = Object.fromEntries( + Object.entries(manifest.overrides as Record).filter( + ([name]) => name === "effect" || name.startsWith("@effect/") + ) + ); return manifest; } test("the generated Smithers package manifest is the one accepted current document", () => { - assert.doesNotThrow(() => assertSmithersPackageManifest(currentManifest())); + const manifest = currentManifest(); + assert.doesNotThrow(() => assertSmithersPackageManifest(manifest)); + assert.equal((manifest.dependencies as Record).zod, "4.6.6"); + assert.deepEqual(manifest.overrides, REQUIRED_SMITHERS_OVERRIDES); + for (const [name, version] of Object.entries({ + "@modelcontextprotocol/sdk": "1.32.0", + "body-parser": "2.4.0", + dompurify: "3.4.17", + zod: "4.6.6" + })) { + assert.equal((manifest.overrides as Record)[name], version); + } }); test("non-stock historical Smithers dependency manifests fail instead of being migrated", () => { @@ -69,17 +87,13 @@ test("the exact 0.32 generated manifest migrates once and preserves package exte // this path into a wholesale regeneration. assert.deepEqual(migrated.dependencies, { "@moonshot-ai/kimi-code": "0.29.1", - zod: "4.4.3", + zod: "4.6.6", "custom-agent-package": "1.2.3", smthrs: SMITHERS_VERSION }); assert.deepEqual(migrated.devDependencies, { typescript: "6.0.3" }); assert.deepEqual(migrated.overrides, { - effect: "4.0.0-beta.105", - "@effect/opentelemetry": "4.0.0-beta.105", - "@effect/platform-bun": "4.0.0-beta.105", - "@effect/platform-node-shared": "4.0.0-beta.105", - "@effect/sql-sqlite-bun": "4.0.0-beta.105", + ...REQUIRED_SMITHERS_OVERRIDES, "custom-transitive-package": "3.4.5" }); @@ -107,6 +121,15 @@ test("a superseded generated manifest migrates forward in place so a durable run } }); +test("the prior 0.35.0 manifest migrates its vulnerable pins without changing the runner", () => { + const old = priorPinManifest(SMITHERS_VERSION); + assert.throws(() => assertSmithersPackageManifest(old), /must retain Ultrafuzz's exact runner versions/u); + const migratedText = migrateStockSmithers032PackageManifest(old); + assert.equal(migratedText, renderSmithersPackageJson()); + assert.doesNotThrow(() => assertSmithersPackageManifest(JSON.parse(migratedText as string))); + assert.equal(migrateStockSmithers032PackageManifest(currentManifest()), undefined); +}); + test("the current generated manifest is left alone rather than rewritten", () => { assert.equal(migrateStockSmithers032PackageManifest(currentManifest()), undefined); assert.doesNotThrow(() => assertSmithersPackageManifest(currentManifest())); diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 720f608d7..e73148b0c 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -11,7 +11,7 @@ packages: - "packages/evmbench" - "packages/modal" - "packages/cli" -# The Effect entries mirror REQUIRED_SMITHERS_OVERRIDES in +# The Effect entries mirror the Effect pins in REQUIRED_SMITHERS_OVERRIDES in # packages/runtime/src/smithers-package.ts. Launch's generated controller # workspace pins these so its npm install cannot mix two Effect builds; pinning # them here too means the installed runner that resume and the other lifecycle @@ -31,7 +31,7 @@ overrides: "@effect/platform-node-shared": "4.0.0-beta.105" "@effect/sql-sqlite-bun": "4.0.0-beta.105" "@smthrs/cli>@toon-format/toon": "2.3.1" - # Pin the patched releases across Smithers' transitive dependency graph. + # Mirror generated-controller security pins across the repository install. # The operator npm's bundled Undici is updated in patches/npm@11.19.0.patch. "@modelcontextprotocol/sdk": "1.32.0" "body-parser": "2.4.0" From 8f2e2be4f53fcd94ca7ec6eb7d59553b3324e1e4 Mon Sep 17 00:00:00 2001 From: Antonio Viggiano Date: Mon, 26 Oct 2026 19:46:41 +0000 Subject: [PATCH 3/3] chore: refresh security lockfile after process fixes --- pnpm-lock.yaml | 267 ++++++++++++++++++++++++++----------------------- 1 file changed, 143 insertions(+), 124 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index bb5276102..0d660dcea 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -11,6 +11,10 @@ overrides: '@effect/platform-node-shared': 4.0.0-beta.105 '@effect/sql-sqlite-bun': 4.0.0-beta.105 '@smthrs/cli>@toon-format/toon': 2.3.1 + '@modelcontextprotocol/sdk': 1.32.0 + body-parser: 2.4.0 + dompurify: 3.4.17 + zod: 4.6.6 patchedDependencies: '@smthrs/agents@0.35.0': 6c7e092e67112f48e5901c085270115738882b26d5257d8c6e1c6666e05509f4 @@ -19,7 +23,7 @@ patchedDependencies: '@smthrs/engine@0.35.0': 9636619be48fce9e041208f6f520c44e34f8996b85db5a842c276db650d8a9d4 '@smthrs/scheduler@0.35.0': 41661e581dddd4dcfd3da5982c0756e0e381b6de61a2502fef634d75ba41f293 '@smthrs/time-travel@0.35.0': 12738e9080e479e9daa123bf485b77990910c69a03cedab8cbd8551565aa3ac7 - npm@11.19.0: cb8c755821fe95a7872b93902d79f4626a7591f7c83cd1b74647c2d658c5bcba + npm@11.19.0: 4e6b97c4ab80ef545461631af055931f906841498546ed4922d1492b8a43ab62 smthrs@0.35.0: 15a6e1dbcb4965e517f85607dc8a86b29a75effab6ea9cb541e73654f4eee1b5 importers: @@ -81,8 +85,8 @@ importers: specifier: ^3.0.1 version: 3.0.1(ajv@8.20.0) zod: - specifier: ^4.4.3 - version: 4.4.3 + specifier: 4.6.6 + version: 4.6.6 packages/cli: dependencies: @@ -145,8 +149,8 @@ importers: specifier: ^2.8.0 version: 2.9.0 zod: - specifier: ^4.4.3 - version: 4.4.3 + specifier: 4.6.6 + version: 4.6.6 packages/dashboard: dependencies: @@ -212,8 +216,8 @@ importers: specifier: ^2.8.0 version: 2.9.0 zod: - specifier: ^4.4.3 - version: 4.4.3 + specifier: 4.6.6 + version: 4.6.6 packages/evmbench: dependencies: @@ -224,8 +228,8 @@ importers: specifier: ^2.8.0 version: 2.9.0 zod: - specifier: ^4.4.3 - version: 4.4.3 + specifier: 4.6.6 + version: 4.6.6 packages/modal: dependencies: @@ -260,8 +264,8 @@ importers: specifier: ^2.9.0 version: 2.9.0 zod: - specifier: ^4.4.3 - version: 4.4.3 + specifier: 4.6.6 + version: 4.6.6 devDependencies: '@types/proper-lockfile': specifier: ^4.1.4 @@ -322,19 +326,19 @@ importers: version: 2.0.3 npm: specifier: 11.19.0 - version: 11.19.0(patch_hash=cb8c755821fe95a7872b93902d79f4626a7591f7c83cd1b74647c2d658c5bcba) + version: 11.19.0(patch_hash=4e6b97c4ab80ef545461631af055931f906841498546ed4922d1492b8a43ab62) proper-lockfile: specifier: 4.1.2 version: 4.1.2 smthrs: specifier: 0.35.0 - version: 0.35.0(patch_hash=15a6e1dbcb4965e517f85607dc8a86b29a75effab6ea9cb541e73654f4eee1b5)(@cfworker/json-schema@4.1.1)(@codemirror/language@6.12.4)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(@shikijs/themes@4.3.1)(@tanstack/query-core@5.101.2)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(esbuild@0.28.1)(postgres@3.4.9)(prosemirror-model@1.25.11)(prosemirror-state@1.4.4)(prosemirror-view@1.42.3)(react-dom@19.2.7(react@19.2.7))(react-is@19.2.8)(redux@5.0.1)(typescript@6.0.3) + version: 0.35.0(patch_hash=15a6e1dbcb4965e517f85607dc8a86b29a75effab6ea9cb541e73654f4eee1b5)(@cfworker/json-schema@4.1.1)(@codemirror/language@6.12.4)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(@shikijs/themes@4.3.1)(@tanstack/query-core@5.101.2)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(esbuild@0.28.1)(postgres@3.4.9)(prosemirror-model@1.25.11)(prosemirror-state@1.4.4)(prosemirror-view@1.42.3)(react-dom@19.2.7(react@19.2.7))(react-is@19.2.8)(redux@5.0.1)(typescript@6.0.3) typescript: specifier: 6.0.3 version: 6.0.3 zod: - specifier: 4.4.3 - version: 4.4.3 + specifier: 4.6.6 + version: 4.6.6 devDependencies: '@moonshot-ai/kimi-code': specifier: 0.29.1 @@ -376,25 +380,25 @@ packages: resolution: {integrity: sha512-rvWzefSJiDLBswGFn0oWM7D8p8eo2tKey2anSM2IxaFd/4tLfolWAWP6Zp+82YUURZUoX6f01NI/txF6ekbC4Q==} engines: {node: '>=22'} peerDependencies: - zod: ^3.25.76 || ^4.1.8 + zod: 4.6.6 '@ai-sdk/gateway@4.0.28': resolution: {integrity: sha512-ee9TsNO3mkgHDWmTmJ8Fvltr6PFh52zhrV2+FaKJY3F3iu7kWZi5tCRJCR1HVhhlpj6lHniUb28nLQdPHkA/1Q==} engines: {node: '>=22'} peerDependencies: - zod: ^3.25.76 || ^4.1.8 + zod: 4.6.6 '@ai-sdk/openai@4.0.20': resolution: {integrity: sha512-/Hu+btLIO2zuYqCp//vBBAGdM/BeN4gds+NWrlv7Y9WrcTXwnEEwh6P3QZIWh2Tt1I1lswuDIpAJ4t/c/rws3Q==} engines: {node: '>=22'} peerDependencies: - zod: ^3.25.76 || ^4.1.8 + zod: 4.6.6 '@ai-sdk/provider-utils@5.0.12': resolution: {integrity: sha512-bbhlOgHeYwrIGheLkM6fhS8hVger8uFPmcOLg+kxc9EFh7y30XYorWhthlYAgpadO3SJhFZrIcEknN7qEqEVvA==} engines: {node: '>=22'} peerDependencies: - zod: ^3.25.76 || ^4.1.8 + zod: 4.6.6 '@ai-sdk/provider@4.0.3': resolution: {integrity: sha512-e0CpNWJUY7OxAFAnCZkw+ri9QOHWwTs1tXP42782KFGCU07qt8NiXCrCVowyCB5dP2r5/Uls+g2oPd8kOJn9dw==} @@ -1199,12 +1203,12 @@ packages: '@milkdown/utils@7.21.2': resolution: {integrity: sha512-m1ZJDnh+/tnIBxLhh5euNGr1WXvsGnJkaGctsd/an5+73HqHOdtWD6L7oJF8+DQG4Kksr4WPNNZutqYGb6OAxw==} - '@modelcontextprotocol/sdk@1.31.0': - resolution: {integrity: sha512-UvTMgnNlnIBO/22ob2RcVGDlcvOslQs8T59+FTGdA0L27a39fdGF/EDETNtDVK4DZGpwomlsYpRdA8UXcVL/pw==} + '@modelcontextprotocol/sdk@1.32.0': + resolution: {integrity: sha512-8BviX/hK4Gd2eL1KdTwm0gfl4d3wdoErW0Jd00h6nomUAtk6IJk5vwQJc6kfWtJTzN5OEV/lgIiJKI8fiDGAlA==} engines: {node: '>=18'} peerDependencies: '@cfworker/json-schema': ^4.1.1 - zod: ^3.25 || ^4.0 + zod: 4.6.6 peerDependenciesMeta: '@cfworker/json-schema': optional: true @@ -2370,7 +2374,7 @@ packages: resolution: {integrity: sha512-Oz94PP5RrPApDhyCjYCP4ZbQnjwPHeyJyvhUeEzHrakGWLESGcb8VSq7fH0aTsuEIxgnp4vTl6QJYqjBkMG7TA==} engines: {bun: '>=1.3.0', node: '>=22'} peerDependencies: - '@modelcontextprotocol/sdk': ^1.29.0 + '@modelcontextprotocol/sdk': 1.32.0 peerDependenciesMeta: '@modelcontextprotocol/sdk': optional: true @@ -2964,7 +2968,7 @@ packages: resolution: {integrity: sha512-stF+SEQJgKY3Qfe3FwNzqUrehHviOp2l7LemoI8YMOa0Zk5PxKsRNgUk3cHXz0RAue9RRyCAis2fz6LSCP6EKw==} engines: {node: '>=22'} peerDependencies: - zod: ^3.25.76 || ^4.1.8 + zod: 4.6.6 ajv-formats@3.0.1: resolution: {integrity: sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==} @@ -3079,8 +3083,8 @@ packages: peerDependencies: react: '>=17.0.1' - body-parser@2.3.0: - resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} + body-parser@2.4.0: + resolution: {integrity: sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==} engines: {node: '>=18'} boundary@2.0.0: @@ -3197,6 +3201,10 @@ packages: resolution: {integrity: sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==} engines: {node: '>=18'} + content-type@2.1.0: + resolution: {integrity: sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==} + engines: {node: '>=18'} + content-type@3.1.1: resolution: {integrity: sha512-GW4qUsfFo59d0HbUibDlWv5wPz+vAAcaTWbKIuKCf0JkC7wWkSyf8f13IpXn5JkeMlB2P8iTSSIjwXljorg2vA==} engines: {node: '>=22'} @@ -3348,8 +3356,8 @@ packages: resolution: {integrity: sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw==} engines: {node: '>=0.3.1'} - dompurify@3.4.13: - resolution: {integrity: sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==} + dompurify@3.4.17: + resolution: {integrity: sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==} drizzle-orm@0.45.2: resolution: {integrity: sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q==} @@ -3447,7 +3455,7 @@ packages: resolution: {integrity: sha512-66yVOuvGhKJnTdiqj1/Xaaz9/qzOdRJADpDa68enqS6g3t0kpNkwNYjUuaeXgZfO/UWuIM9HIhSlJ6C5ZraMww==} peerDependencies: drizzle-orm: '>=0.36.0' - zod: ^3.25.0 || ^4.0.0 + zod: 4.6.6 dunder-proto@1.0.1: resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==} @@ -4538,6 +4546,10 @@ packages: resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==} engines: {node: '>=0.6'} + qs@6.16.1: + resolution: {integrity: sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==} + engines: {node: '>=0.6'} + radix-ui@1.6.7: resolution: {integrity: sha512-QBdhh1arIEUvPC0dQ5+nwWAxt7+N+oP/9jPwjJkGFoSk/sqxg32gJtSXGtFh8frAIcS6oC9cx2Q+7KYCQLOAeA==} peerDependencies: @@ -5184,10 +5196,10 @@ packages: zod-to-json-schema@3.25.2: resolution: {integrity: sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==} peerDependencies: - zod: ^3.25.28 || ^4 + zod: 4.6.6 - zod@4.4.3: - resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==} + zod@4.6.6: + resolution: {integrity: sha512-4UmzQUF5fxvfcYHlbjBmejU+w+hbDnWFx4aS8kBx7nPBHcO2SqPbpAG8snbdg+Xse4pRefR98hgjFgIMCI/UhA==} zustand@4.5.7: resolution: {integrity: sha512-CHOUy7mu3lbD6o6LJLfllpjkzhHXSBlX8B9+qPddUsIfeF5S/UZ5q0kmCsnRqT1UHFQZchNFDDzMbQsuesHWlw==} @@ -5209,32 +5221,32 @@ packages: snapshots: - '@ai-sdk/anthropic@4.0.21(zod@4.4.3)': + '@ai-sdk/anthropic@4.0.21(zod@4.6.6)': dependencies: '@ai-sdk/provider': 4.0.3 - '@ai-sdk/provider-utils': 5.0.12(zod@4.4.3) - zod: 4.4.3 + '@ai-sdk/provider-utils': 5.0.12(zod@4.6.6) + zod: 4.6.6 - '@ai-sdk/gateway@4.0.28(zod@4.4.3)': + '@ai-sdk/gateway@4.0.28(zod@4.6.6)': dependencies: '@ai-sdk/provider': 4.0.3 - '@ai-sdk/provider-utils': 5.0.12(zod@4.4.3) + '@ai-sdk/provider-utils': 5.0.12(zod@4.6.6) '@vercel/oidc': 3.2.0 - zod: 4.4.3 + zod: 4.6.6 - '@ai-sdk/openai@4.0.20(zod@4.4.3)': + '@ai-sdk/openai@4.0.20(zod@4.6.6)': dependencies: '@ai-sdk/provider': 4.0.3 - '@ai-sdk/provider-utils': 5.0.12(zod@4.4.3) - zod: 4.4.3 + '@ai-sdk/provider-utils': 5.0.12(zod@4.6.6) + zod: 4.6.6 - '@ai-sdk/provider-utils@5.0.12(zod@4.4.3)': + '@ai-sdk/provider-utils@5.0.12(zod@4.6.6)': dependencies: '@ai-sdk/provider': 4.0.3 '@standard-schema/spec': 1.1.0 '@workflow/serde': 4.1.0 eventsource-parser: 3.1.0 - zod: 4.4.3 + zod: 4.6.6 '@ai-sdk/provider@4.0.3': dependencies: @@ -6115,7 +6127,7 @@ snapshots: '@milkdown/utils': 7.21.2 '@types/lodash-es': 4.17.12 clsx: 2.1.1 - dompurify: 3.4.13 + dompurify: 3.4.17 lodash-es: 4.18.1 nanoid: 5.1.16 unist-util-visit: 5.1.0 @@ -6148,7 +6160,7 @@ snapshots: '@types/lodash-es': 4.17.12 clsx: 2.1.1 codemirror: 6.0.2 - dompurify: 3.4.13 + dompurify: 3.4.17 katex: 0.17.0 lodash-es: 4.18.1 prosemirror-virtual-cursor: 0.4.2(prosemirror-model@1.25.11)(prosemirror-state@1.4.4)(prosemirror-view@1.42.3) @@ -6380,7 +6392,7 @@ snapshots: transitivePeerDependencies: - supports-color - '@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3)': + '@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6)': dependencies: '@hono/node-server': 1.19.15(hono@4.12.34) ajv: 8.20.0 @@ -6397,8 +6409,8 @@ snapshots: json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 raw-body: 3.0.2 - zod: 4.4.3 - zod-to-json-schema: 3.25.2(zod@4.4.3) + zod: 4.6.6 + zod-to-json-schema: 3.25.2(zod@4.6.6) optionalDependencies: '@cfworker/json-schema': 4.1.1 transitivePeerDependencies: @@ -6406,7 +6418,7 @@ snapshots: '@modelcontextprotocol/server@2.0.0-alpha.4': dependencies: - zod: 4.4.3 + zod: 4.6.6 '@moonshot-ai/kimi-code@0.29.1': optionalDependencies: @@ -7532,20 +7544,20 @@ snapshots: dependencies: '@smthrs/errors': 0.35.0 - '@smthrs/agents@0.35.0(patch_hash=6c7e092e67112f48e5901c085270115738882b26d5257d8c6e1c6666e05509f4)(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9)': + '@smthrs/agents@0.35.0(patch_hash=6c7e092e67112f48e5901c085270115738882b26d5257d8c6e1c6666e05509f4)(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9)': dependencies: - '@ai-sdk/anthropic': 4.0.21(zod@4.4.3) - '@ai-sdk/openai': 4.0.20(zod@4.4.3) + '@ai-sdk/anthropic': 4.0.21(zod@4.6.6) + '@ai-sdk/openai': 4.0.20(zod@4.6.6) '@smthrs/accounts': 0.35.0 '@smthrs/driver': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/errors': 0.35.0 '@smthrs/observability': 0.35.0(@opentelemetry/semantic-conventions@1.43.0) '@smthrs/usage': 0.35.0 - ai: 7.0.37(zod@4.4.3) + ai: 7.0.37(zod@4.6.6) effect: 4.0.0-beta.105 - zod: 4.4.3 + zod: 4.6.6 optionalDependencies: - '@modelcontextprotocol/sdk': 1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3) + '@modelcontextprotocol/sdk': 1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6) transitivePeerDependencies: - '@aws-sdk/client-rds-data' - '@cloudflare/workers-types' @@ -7638,26 +7650,26 @@ snapshots: '@clack/prompts': 1.7.0 '@mdx-js/esbuild': 3.1.1(esbuild@0.28.1) '@mdx-js/mdx': 3.1.1 - '@modelcontextprotocol/sdk': 1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3) + '@modelcontextprotocol/sdk': 1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6) '@pierre/diffs': 1.2.12(@shikijs/themes@4.3.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) '@smthrs/accounts': 0.35.0 - '@smthrs/agents': 0.35.0(patch_hash=6c7e092e67112f48e5901c085270115738882b26d5257d8c6e1c6666e05509f4)(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/components': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/agents': 0.35.0(patch_hash=6c7e092e67112f48e5901c085270115738882b26d5257d8c6e1c6666e05509f4)(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/components': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/db': 0.35.0(patch_hash=3d6ab391da1469d46217fad8d8eeebd47900f3c7f439214d51cb72313c7182a2)(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/devtools': 0.35.0 '@smthrs/driver': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/engine': 0.35.0(patch_hash=9636619be48fce9e041208f6f520c44e34f8996b85db5a842c276db650d8a9d4)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(postgres@3.4.9) + '@smthrs/engine': 0.35.0(patch_hash=9636619be48fce9e041208f6f520c44e34f8996b85db5a842c276db650d8a9d4)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(postgres@3.4.9) '@smthrs/errors': 0.35.0 '@smthrs/graph': 0.35.0(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) '@smthrs/herdr': 0.35.0 - '@smthrs/integrations': 0.35.0(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/integrations': 0.35.0(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/memory': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/observability': 0.35.0(@opentelemetry/semantic-conventions@1.43.0) '@smthrs/openapi': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/protocol': 0.35.0 '@smthrs/scheduler': 0.35.0(patch_hash=41661e581dddd4dcfd3da5982c0756e0e381b6de61a2502fef634d75ba41f293)(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/scorers': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/server': 0.35.0(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/scorers': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/server': 0.35.0(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/time-travel': 0.35.0(patch_hash=12738e9080e479e9daa123bf485b77990910c69a03cedab8cbd8551565aa3ac7)(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/usage': 0.35.0 '@smthrs/vcs': 0.35.0(@opentelemetry/semantic-conventions@1.43.0) @@ -7671,9 +7683,9 @@ snapshots: incur: 0.4.19 picocolors: 1.1.1 react: 19.2.7 - smthrs: 0.35.0(patch_hash=15a6e1dbcb4965e517f85607dc8a86b29a75effab6ea9cb541e73654f4eee1b5)(@cfworker/json-schema@4.1.1)(@codemirror/language@6.12.4)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(@shikijs/themes@4.3.1)(@tanstack/query-core@5.101.2)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(esbuild@0.28.1)(postgres@3.4.9)(prosemirror-model@1.25.11)(prosemirror-state@1.4.4)(prosemirror-view@1.42.3)(react-dom@19.2.7(react@19.2.7))(react-is@19.2.8)(redux@5.0.1)(typescript@6.0.3) + smthrs: 0.35.0(patch_hash=15a6e1dbcb4965e517f85607dc8a86b29a75effab6ea9cb541e73654f4eee1b5)(@cfworker/json-schema@4.1.1)(@codemirror/language@6.12.4)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(@shikijs/themes@4.3.1)(@tanstack/query-core@5.101.2)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(esbuild@0.28.1)(postgres@3.4.9)(prosemirror-model@1.25.11)(prosemirror-state@1.4.4)(prosemirror-view@1.42.3)(react-dom@19.2.7(react@19.2.7))(react-is@19.2.8)(redux@5.0.1)(typescript@6.0.3) yaml: 2.9.0 - zod: 4.4.3 + zod: 4.6.6 transitivePeerDependencies: - '@aws-sdk/client-cloudwatch-logs' - '@aws-sdk/client-codebuild' @@ -7797,9 +7809,9 @@ snapshots: - sqlite3 - utf-8-validate - '@smthrs/components@0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9)': + '@smthrs/components@0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9)': dependencies: - '@smthrs/agents': 0.35.0(patch_hash=6c7e092e67112f48e5901c085270115738882b26d5257d8c6e1c6666e05509f4)(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/agents': 0.35.0(patch_hash=6c7e092e67112f48e5901c085270115738882b26d5257d8c6e1c6666e05509f4)(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/db': 0.35.0(patch_hash=3d6ab391da1469d46217fad8d8eeebd47900f3c7f439214d51cb72313c7182a2)(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/driver': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/errors': 0.35.0 @@ -7811,7 +7823,7 @@ snapshots: bippy: 0.5.43(react@19.2.7) react: 19.2.7 react-dom: 19.2.7(react@19.2.7) - zod: 4.4.3 + zod: 4.6.6 transitivePeerDependencies: - '@aws-sdk/client-rds-data' - '@cloudflare/workers-types' @@ -7910,9 +7922,9 @@ snapshots: '@smthrs/observability': 0.35.0(@opentelemetry/semantic-conventions@1.43.0) '@smthrs/scheduler': 0.35.0(patch_hash=41661e581dddd4dcfd3da5982c0756e0e381b6de61a2502fef634d75ba41f293)(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) drizzle-orm: 0.45.2(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) - drizzle-zod: 0.8.3(drizzle-orm@0.45.2(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9))(zod@4.4.3) + drizzle-zod: 0.8.3(drizzle-orm@0.45.2(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9))(zod@4.6.6) effect: 4.0.0-beta.105 - zod: 4.4.3 + zod: 4.6.6 transitivePeerDependencies: - '@aws-sdk/client-rds-data' - '@cloudflare/workers-types' @@ -7964,7 +7976,7 @@ snapshots: '@smthrs/observability': 0.35.0(@opentelemetry/semantic-conventions@1.43.0) '@smthrs/scheduler': 0.35.0(patch_hash=41661e581dddd4dcfd3da5982c0756e0e381b6de61a2502fef634d75ba41f293)(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) effect: 4.0.0-beta.105 - zod: 4.4.3 + zod: 4.6.6 transitivePeerDependencies: - '@aws-sdk/client-rds-data' - '@cloudflare/workers-types' @@ -8010,13 +8022,13 @@ snapshots: dependencies: '@smthrs/gateway': 0.35.0 - '@smthrs/engine@0.35.0(patch_hash=9636619be48fce9e041208f6f520c44e34f8996b85db5a842c276db650d8a9d4)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(postgres@3.4.9)': + '@smthrs/engine@0.35.0(patch_hash=9636619be48fce9e041208f6f520c44e34f8996b85db5a842c276db650d8a9d4)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(postgres@3.4.9)': dependencies: '@effect/platform-bun': 4.0.0-beta.105(effect@4.0.0-beta.105) '@effect/platform-node-shared': 4.0.0-beta.105(effect@4.0.0-beta.105) '@effect/sql-sqlite-bun': 4.0.0-beta.105(effect@4.0.0-beta.105) - '@smthrs/agents': 0.35.0(patch_hash=6c7e092e67112f48e5901c085270115738882b26d5257d8c6e1c6666e05509f4)(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/components': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/agents': 0.35.0(patch_hash=6c7e092e67112f48e5901c085270115738882b26d5257d8c6e1c6666e05509f4)(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/components': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/db': 0.35.0(patch_hash=3d6ab391da1469d46217fad8d8eeebd47900f3c7f439214d51cb72313c7182a2)(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/driver': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/errors': 0.35.0 @@ -8025,17 +8037,17 @@ snapshots: '@smthrs/react-reconciler': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/sandbox': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/scheduler': 0.35.0(patch_hash=41661e581dddd4dcfd3da5982c0756e0e381b6de61a2502fef634d75ba41f293)(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/scorers': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/scorers': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/time-travel': 0.35.0(patch_hash=12738e9080e479e9daa123bf485b77990910c69a03cedab8cbd8551565aa3ac7)(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/tool-context': 0.35.0 '@smthrs/vcs': 0.35.0(@opentelemetry/semantic-conventions@1.43.0) - ai: 7.0.37(zod@4.4.3) + ai: 7.0.37(zod@4.6.6) diff: 9.0.0 drizzle-orm: 0.45.2(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) effect: 4.0.0-beta.105 react: 19.2.7 react-dom: 19.2.7(react@19.2.7) - zod: 4.4.3 + zod: 4.6.6 optionalDependencies: '@electric-sql/pglite': 0.5.4 '@electric-sql/pglite-socket': 0.2.6(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4) @@ -8201,7 +8213,7 @@ snapshots: dependencies: '@smthrs/errors': 0.35.0 drizzle-orm: 0.45.2(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) - zod: 4.4.3 + zod: 4.6.6 transitivePeerDependencies: - '@aws-sdk/client-rds-data' - '@cloudflare/workers-types' @@ -8235,18 +8247,18 @@ snapshots: '@smthrs/herdr@0.35.0': {} - '@smthrs/integrations@0.35.0(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9)': + '@smthrs/integrations@0.35.0(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9)': dependencies: - '@smthrs/components': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/components': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/db': 0.35.0(patch_hash=3d6ab391da1469d46217fad8d8eeebd47900f3c7f439214d51cb72313c7182a2)(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/engine': 0.35.0(patch_hash=9636619be48fce9e041208f6f520c44e34f8996b85db5a842c276db650d8a9d4)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(postgres@3.4.9) + '@smthrs/engine': 0.35.0(patch_hash=9636619be48fce9e041208f6f520c44e34f8996b85db5a842c276db650d8a9d4)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(postgres@3.4.9) '@smthrs/errors': 0.35.0 '@smthrs/observability': 0.35.0(@opentelemetry/semantic-conventions@1.43.0) '@smthrs/react-reconciler': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/scheduler': 0.35.0(patch_hash=41661e581dddd4dcfd3da5982c0756e0e381b6de61a2502fef634d75ba41f293)(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) effect: 4.0.0-beta.105 react: 19.2.7 - zod: 4.4.3 + zod: 4.6.6 transitivePeerDependencies: - '@aws-sdk/client-rds-data' - '@cloudflare/workers-types' @@ -8322,7 +8334,7 @@ snapshots: '@vectorize-io/hindsight-client': 0.8.4 drizzle-orm: 0.45.2(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) effect: 4.0.0-beta.105 - zod: 4.4.3 + zod: 4.6.6 transitivePeerDependencies: - '@aws-sdk/client-rds-data' - '@cloudflare/workers-types' @@ -8433,10 +8445,10 @@ snapshots: '@smthrs/errors': 0.35.0 '@smthrs/observability': 0.35.0(@opentelemetry/semantic-conventions@1.43.0) '@smthrs/scheduler': 0.35.0(patch_hash=41661e581dddd4dcfd3da5982c0756e0e381b6de61a2502fef634d75ba41f293)(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) - ai: 7.0.37(zod@4.4.3) + ai: 7.0.37(zod@4.6.6) effect: 4.0.0-beta.105 yaml: 2.9.0 - zod: 4.4.3 + zod: 4.6.6 transitivePeerDependencies: - '@aws-sdk/client-rds-data' - '@cloudflare/workers-types' @@ -8615,9 +8627,9 @@ snapshots: - sql.js - sqlite3 - '@smthrs/scorers@0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9)': + '@smthrs/scorers@0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9)': dependencies: - '@smthrs/agents': 0.35.0(patch_hash=6c7e092e67112f48e5901c085270115738882b26d5257d8c6e1c6666e05509f4)(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/agents': 0.35.0(patch_hash=6c7e092e67112f48e5901c085270115738882b26d5257d8c6e1c6666e05509f4)(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/db': 0.35.0(patch_hash=3d6ab391da1469d46217fad8d8eeebd47900f3c7f439214d51cb72313c7182a2)(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/errors': 0.35.0 '@smthrs/graph': 0.35.0(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) @@ -8626,7 +8638,7 @@ snapshots: drizzle-orm: 0.45.2(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) effect: 4.0.0-beta.105 typescript: 6.0.3 - zod: 4.4.3 + zod: 4.6.6 transitivePeerDependencies: - '@aws-sdk/client-rds-data' - '@cloudflare/workers-types' @@ -8669,18 +8681,18 @@ snapshots: - sqlite3 - utf-8-validate - '@smthrs/server@0.35.0(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9)': + '@smthrs/server@0.35.0(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9)': dependencies: '@smthrs/accounts': 0.35.0 - '@smthrs/components': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/components': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/db': 0.35.0(patch_hash=3d6ab391da1469d46217fad8d8eeebd47900f3c7f439214d51cb72313c7182a2)(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/devtools': 0.35.0 '@smthrs/driver': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/engine': 0.35.0(patch_hash=9636619be48fce9e041208f6f520c44e34f8996b85db5a842c276db650d8a9d4)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(postgres@3.4.9) + '@smthrs/engine': 0.35.0(patch_hash=9636619be48fce9e041208f6f520c44e34f8996b85db5a842c276db650d8a9d4)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(postgres@3.4.9) '@smthrs/errors': 0.35.0 '@smthrs/gateway': 0.35.0 '@smthrs/graph': 0.35.0(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/integrations': 0.35.0(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/integrations': 0.35.0(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/observability': 0.35.0(@opentelemetry/semantic-conventions@1.43.0) '@smthrs/protocol': 0.35.0 '@smthrs/scheduler': 0.35.0(patch_hash=41661e581dddd4dcfd3da5982c0756e0e381b6de61a2502fef634d75ba41f293)(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) @@ -8746,20 +8758,20 @@ snapshots: '@smthrs/telegram@0.35.0': {} - '@smthrs/testing@0.35.0(184c351c21e9f2157edeacc843c3a528)': + '@smthrs/testing@0.35.0(ae040f979f55f7a68eb21f200c66f448)': dependencies: - '@smthrs/components': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/components': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/db': 0.35.0(patch_hash=3d6ab391da1469d46217fad8d8eeebd47900f3c7f439214d51cb72313c7182a2)(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/driver': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/engine': 0.35.0(patch_hash=9636619be48fce9e041208f6f520c44e34f8996b85db5a842c276db650d8a9d4)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(postgres@3.4.9) + '@smthrs/engine': 0.35.0(patch_hash=9636619be48fce9e041208f6f520c44e34f8996b85db5a842c276db650d8a9d4)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(postgres@3.4.9) '@smthrs/graph': 0.35.0(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) '@smthrs/herdr': 0.35.0 '@smthrs/react-reconciler': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/scheduler': 0.35.0(patch_hash=41661e581dddd4dcfd3da5982c0756e0e381b6de61a2502fef634d75ba41f293)(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) effect: 4.0.0-beta.105 - zod: 4.4.3 + zod: 4.6.6 optionalDependencies: - smthrs: 0.35.0(patch_hash=15a6e1dbcb4965e517f85607dc8a86b29a75effab6ea9cb541e73654f4eee1b5)(@cfworker/json-schema@4.1.1)(@codemirror/language@6.12.4)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(@shikijs/themes@4.3.1)(@tanstack/query-core@5.101.2)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(esbuild@0.28.1)(postgres@3.4.9)(prosemirror-model@1.25.11)(prosemirror-state@1.4.4)(prosemirror-view@1.42.3)(react-dom@19.2.7(react@19.2.7))(react-is@19.2.8)(redux@5.0.1)(typescript@6.0.3) + smthrs: 0.35.0(patch_hash=15a6e1dbcb4965e517f85607dc8a86b29a75effab6ea9cb541e73654f4eee1b5)(@cfworker/json-schema@4.1.1)(@codemirror/language@6.12.4)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(@shikijs/themes@4.3.1)(@tanstack/query-core@5.101.2)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(esbuild@0.28.1)(postgres@3.4.9)(prosemirror-model@1.25.11)(prosemirror-state@1.4.4)(prosemirror-view@1.42.3)(react-dom@19.2.7(react@19.2.7))(react-is@19.2.8)(redux@5.0.1)(typescript@6.0.3) transitivePeerDependencies: - '@aws-sdk/client-rds-data' - '@cloudflare/workers-types' @@ -8868,8 +8880,8 @@ snapshots: '@smthrs/tool-context@0.35.0': dependencies: - ai: 7.0.37(zod@4.4.3) - zod: 4.4.3 + ai: 7.0.37(zod@4.6.6) + zod: 4.6.6 '@smthrs/ui-styleguide@0.35.0': {} @@ -9465,12 +9477,12 @@ snapshots: adm-zip@0.6.1: {} - ai@7.0.37(zod@4.4.3): + ai@7.0.37(zod@4.6.6): dependencies: - '@ai-sdk/gateway': 4.0.28(zod@4.4.3) + '@ai-sdk/gateway': 4.0.28(zod@4.6.6) '@ai-sdk/provider': 4.0.3 - '@ai-sdk/provider-utils': 5.0.12(zod@4.4.3) - zod: 4.4.3 + '@ai-sdk/provider-utils': 5.0.12(zod@4.6.6) + zod: 4.6.6 ajv-formats@3.0.1(ajv@8.20.0): optionalDependencies: @@ -9557,15 +9569,15 @@ snapshots: dependencies: react: 19.2.7 - body-parser@2.3.0: + body-parser@2.4.0: dependencies: bytes: 3.1.2 - content-type: 2.0.0 + content-type: 2.1.0 debug: 4.4.3(supports-color@8.1.1) http-errors: 2.0.1 iconv-lite: 0.7.3 on-finished: 2.4.1 - qs: 6.15.3 + qs: 6.16.1 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: @@ -9681,6 +9693,8 @@ snapshots: content-type@2.0.0: {} + content-type@2.1.0: {} + content-type@3.1.1: {} convert-source-map@2.0.0: {} @@ -9814,7 +9828,7 @@ snapshots: diff@9.0.0: {} - dompurify@3.4.13: + dompurify@3.4.17: optionalDependencies: '@types/trusted-types': 2.0.7 @@ -9824,10 +9838,10 @@ snapshots: pg: 8.22.0 postgres: 3.4.9 - drizzle-zod@0.8.3(drizzle-orm@0.45.2(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9))(zod@4.4.3): + drizzle-zod@0.8.3(drizzle-orm@0.45.2(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9))(zod@4.6.6): dependencies: drizzle-orm: 0.45.2(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) - zod: 4.4.3 + zod: 4.6.6 dunder-proto@1.0.1: dependencies: @@ -10056,7 +10070,7 @@ snapshots: express@5.2.1: dependencies: accepts: 2.0.0 - body-parser: 2.3.0 + body-parser: 2.4.0 content-disposition: 1.1.0 content-type: 1.0.5 cookie: 0.7.2 @@ -10309,7 +10323,7 @@ snapshots: '@toon-format/toon': 2.3.1 tokenx: 1.3.0 yaml: 2.9.0 - zod: 4.4.3 + zod: 4.6.6 incur@0.4.25: dependencies: @@ -10319,7 +10333,7 @@ snapshots: '@toon-format/toon': 2.3.1 tokenx: 1.3.0 yaml: 2.9.0 - zod: 4.4.3 + zod: 4.6.6 indent-string@4.0.0: {} @@ -10987,7 +11001,7 @@ snapshots: node-releases@2.0.50: {} - npm@11.19.0(patch_hash=cb8c755821fe95a7872b93902d79f4626a7591f7c83cd1b74647c2d658c5bcba): {} + npm@11.19.0(patch_hash=4e6b97c4ab80ef545461631af055931f906841498546ed4922d1492b8a43ab62): {} object-assign@4.1.1: {} @@ -11254,6 +11268,11 @@ snapshots: es-define-property: 1.0.1 side-channel: 1.1.1 + qs@6.16.1: + dependencies: + es-define-property: 1.0.1 + side-channel: 1.1.1 + radix-ui@1.6.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7): dependencies: '@radix-ui/primitive': 1.1.7 @@ -11661,20 +11680,20 @@ snapshots: smol-toml@1.9.0: {} - ? smthrs@0.35.0(patch_hash=15a6e1dbcb4965e517f85607dc8a86b29a75effab6ea9cb541e73654f4eee1b5)(@cfworker/json-schema@4.1.1)(@codemirror/language@6.12.4)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(@shikijs/themes@4.3.1)(@tanstack/query-core@5.101.2)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(esbuild@0.28.1)(postgres@3.4.9)(prosemirror-model@1.25.11)(prosemirror-state@1.4.4)(prosemirror-view@1.42.3)(react-dom@19.2.7(react@19.2.7))(react-is@19.2.8)(redux@5.0.1)(typescript@6.0.3) + ? smthrs@0.35.0(patch_hash=15a6e1dbcb4965e517f85607dc8a86b29a75effab6ea9cb541e73654f4eee1b5)(@cfworker/json-schema@4.1.1)(@codemirror/language@6.12.4)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(@shikijs/themes@4.3.1)(@tanstack/query-core@5.101.2)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(esbuild@0.28.1)(postgres@3.4.9)(prosemirror-model@1.25.11)(prosemirror-state@1.4.4)(prosemirror-view@1.42.3)(react-dom@19.2.7(react@19.2.7))(react-is@19.2.8)(redux@5.0.1)(typescript@6.0.3) : dependencies: '@effect/platform-node-shared': 4.0.0-beta.105(effect@4.0.0-beta.105) '@mdx-js/esbuild': 3.1.1(esbuild@0.28.1) - '@smthrs/agents': 0.35.0(patch_hash=6c7e092e67112f48e5901c085270115738882b26d5257d8c6e1c6666e05509f4)(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/agents': 0.35.0(patch_hash=6c7e092e67112f48e5901c085270115738882b26d5257d8c6e1c6666e05509f4)(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/aws': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/cli': 0.35.0(patch_hash=a356f2e48bb57af73a975b6d78fd97691224b1e8422fe598c926f5bcb08f46f1)(@cfworker/json-schema@4.1.1)(@codemirror/language@6.12.4)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(@shikijs/themes@4.3.1)(@tanstack/query-core@5.101.2)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(pg@8.22.0)(postgres@3.4.9)(prosemirror-model@1.25.11)(prosemirror-state@1.4.4)(prosemirror-view@1.42.3)(react-dom@19.2.7(react@19.2.7))(react-is@19.2.8)(redux@5.0.1)(typescript@6.0.3) '@smthrs/cloudflare': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/components': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/components': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/control-plane': 0.35.0 '@smthrs/daytona': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/db': 0.35.0(patch_hash=3d6ab391da1469d46217fad8d8eeebd47900f3c7f439214d51cb72313c7182a2)(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/driver': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/engine': 0.35.0(patch_hash=9636619be48fce9e041208f6f520c44e34f8996b85db5a842c276db650d8a9d4)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(postgres@3.4.9) + '@smthrs/engine': 0.35.0(patch_hash=9636619be48fce9e041208f6f520c44e34f8996b85db5a842c276db650d8a9d4)(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(postgres@3.4.9) '@smthrs/errors': 0.35.0 '@smthrs/gateway-client': 0.35.0(@tanstack/query-core@5.101.2)(react@19.2.7)(typescript@6.0.3) '@smthrs/gateway-react': 0.35.0(@tanstack/query-core@5.101.2)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3) @@ -11688,23 +11707,23 @@ snapshots: '@smthrs/react-reconciler': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/sandbox': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/scheduler': 0.35.0(patch_hash=41661e581dddd4dcfd3da5982c0756e0e381b6de61a2502fef634d75ba41f293)(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/scorers': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) - '@smthrs/server': 0.35.0(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.31.0(@cfworker/json-schema@4.1.1)(zod@4.4.3))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/scorers': 0.35.0(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) + '@smthrs/server': 0.35.0(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4)(@modelcontextprotocol/sdk@1.32.0(@cfworker/json-schema@4.1.1)(zod@4.6.6))(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/telegram': 0.35.0 - '@smthrs/testing': 0.35.0(184c351c21e9f2157edeacc843c3a528) + '@smthrs/testing': 0.35.0(ae040f979f55f7a68eb21f200c66f448) '@smthrs/time-travel': 0.35.0(patch_hash=12738e9080e479e9daa123bf485b77990910c69a03cedab8cbd8551565aa3ac7)(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/tool-context': 0.35.0 '@smthrs/ui': 0.35.0(@codemirror/language@6.12.4)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)(@shikijs/themes@4.3.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(prosemirror-model@1.25.11)(prosemirror-state@1.4.4)(prosemirror-view@1.42.3)(react-dom@19.2.7(react@19.2.7))(react-is@19.2.8)(react@19.2.7)(redux@5.0.1)(typescript@6.0.3) '@smthrs/vcs': 0.35.0(@opentelemetry/semantic-conventions@1.43.0) '@smthrs/vercel': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) '@smthrs/xstate': 0.35.0(@electric-sql/pglite@0.5.4)(@opentelemetry/semantic-conventions@1.43.0)(pg@8.22.0)(postgres@3.4.9) - ai: 7.0.37(zod@4.4.3) + ai: 7.0.37(zod@4.6.6) diff: 9.0.0 drizzle-orm: 0.45.2(@electric-sql/pglite@0.5.4)(pg@8.22.0)(postgres@3.4.9) effect: 4.0.0-beta.105 incur: 0.4.19 react: 19.2.7 - zod: 4.4.3 + zod: 4.6.6 optionalDependencies: '@electric-sql/pglite': 0.5.4 '@electric-sql/pglite-socket': 0.2.6(@electric-sql/pglite-age@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_hashids@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_ivm@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_textsearch@0.0.5(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pg_uuidv7@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgtap@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite-pgvector@0.0.4(@electric-sql/pglite@0.5.4))(@electric-sql/pglite@0.5.4) @@ -12141,11 +12160,11 @@ snapshots: yocto-queue@0.1.0: {} - zod-to-json-schema@3.25.2(zod@4.4.3): + zod-to-json-schema@3.25.2(zod@4.6.6): dependencies: - zod: 4.4.3 + zod: 4.6.6 - zod@4.4.3: {} + zod@4.6.6: {} zustand@4.5.7(@types/react@19.2.17)(immer@11.1.15)(react@19.2.7): dependencies: