lurqrun 0.0.1 → 0.0.3

package/dist/index.d.ts

@@ -9,6 +9,16 @@ import { Command } from 'commander';
 declare const CATEGORIES: readonly ["framework", "meta-framework", "state-management", "routing", "orm", "database-client", "ui-component-library", "styling", "forms", "validation", "data-fetching", "http-client", "auth", "testing", "build-tool", "bundler", "linting", "date-time", "animation", "charts", "i18n", "utility", "other"];
 type Category = (typeof CATEGORIES)[number];
 declare function isCategory(value: string): value is Category;
+/** Provenance of a package's stored category (§2A). `curated` comes from the
+ *  seed file or a manual arg; `inferred` was assigned automatically at ingest
+ *  and is safe for a later curation pass to override. */
+type CategorySource = 'curated' | 'inferred';
+/** How a candidate entered the discovery queue (§2B). `dependency-graph` and
+ *  `recent` are the long-tail channels; `category-search` is keyword-seeded;
+ *  `reactive` is an on-demand query that wasn't tracked yet. */
+type DiscoverySource = 'dependency-graph' | 'category-search' | 'recent' | 'reactive';
+/** Lifecycle of a discovery-queue candidate (§2B). */
+type DiscoveryStatus = 'pending' | 'ingested' | 'rejected';
 /**
  * Categories for which bundle size is meaningful and Bundlephobia is consulted
  * (§9.5). Backend-only categories get a null bundle size, and their efficiency
@@ -16,9 +26,55 @@ declare function isCategory(value: string): value is Category;
  */
 declare const FRONTEND_CATEGORIES: readonly ["ui-component-library", "styling", "state-management", "forms", "validation", "data-fetching", "charts", "animation", "date-time", "utility"];
 declare function isFrontendCategory(category: Category | null | undefined): boolean;
-/** Evidence-trustworthiness label, independent of the numeric score (§10). */
-type Confidence = 'proven' | 'emerging' | 'unproven';
+/**
+ * Evidence-trustworthiness label, independent of the numeric score (§10, §1).
+ * Two-dimensional: `proven`/`emerging` are adoption ladders; `promising` is
+ * adoption-independent (high intrinsic quality, new package).
+ */
+type Confidence = 'proven' | 'emerging' | 'promising' | 'unproven';
 type Runtime = 'browser' | 'node' | 'both';
+/** Result of co-installing two package versions in the sandbox (compat matrix). */
+type CompatStatus = 'compatible' | 'conflict';
+/** Sandbox verdict surfaced to agents: did this version actually install + load? */
+interface BuildVerified {
+    version: string;
+    installed: boolean;
+    loaded: boolean | null;
+    driver: string;
+    ranAt: string;
+}
+/** A map of dependency/peer/engine name → semver range (from a manifest). */
+type DependencyRanges = Record<string, string>;
+/** `peerDependenciesMeta`: per-peer flags, notably `{ optional: true }`. */
+type PeerMeta = Record<string, {
+    optional?: boolean;
+}>;
+/** One incompatibility found across a set of packages. */
+interface CompatConflict {
+    /** Where the conflict came from. `peer-deps`/`engines` are Tier-1 (metadata,
+     *  instant, deterministic); `sandbox` is Tier-2 (empirical co-install). */
+    source: 'peer-deps' | 'engines' | 'sandbox';
+    /** The packages involved in the conflict. */
+    packages: string[];
+    detail: string;
+}
+/**
+ * `compat` output: whole-architecture compatibility for a set of packages.
+ * Tier-1 peer-dependency/engine analysis + any Tier-2 sandbox conflicts.
+ */
+interface CompatOutput {
+    packages: string[];
+    overall: 'compatible' | 'conflict' | 'unknown';
+    conflicts: CompatConflict[];
+    /** Packages lurq has no compatibility metadata for (counted toward `unknown`). */
+    unverified: string[];
+    /** The exact members the check ran over, name + resolved version. Versions are
+     *  always surfaced here, and the structure is stable for later scraping. */
+    checked: {
+        name: string;
+        version: string | null;
+    }[];
+}
 type AdvisorySeverity = 'critical' | 'high' | 'moderate' | 'low' | 'info';
 interface Advisory {
     id: string;
@@ -26,12 +82,16 @@ interface Advisory {
     summary: string;
 }
 /** Sub-scores composing the health score (§10). `efficiency` is null when not
- *  size-based (backend categories) — its weight is redistributed. */
+ *  size-based (backend categories) — its weight is redistributed.
+ *  `quality` (§1) is a standalone, adoption-independent axis — it does NOT feed
+ *  the health composite; it blends with health only at ranking time. Null when
+ *  no manifest signals were available. */
 interface ScoreBreakdown {
     maintenance: number;
     adoption: number;
     reliability: number;
     efficiency: number | null;
+    quality: number | null;
 }
 /**
  * Structured usage guide generated at ingest (product refinement: lurq explains,
@@ -51,6 +111,7 @@ interface Candidate {
     name: string;
     category: Category | null;
     healthScore: number;
+    qualityScore: number | null;
     confidence: Confidence;
     why: string;
     latestVersion: string | null;
@@ -65,13 +126,13 @@ interface EvaluateOutput {
     name: string;
     category: Category | null;
     healthScore: number;
+    qualityScore: number | null;
     confidence: Confidence;
     scoreBreakdown: ScoreBreakdown;
     latestVersion: string | null;
     lastReleaseAt: string | null;
     weeklyDownloads: number | null;
     downloadGrowth90d: number | null;
-    dependentsCount: number | null;
     scorecard: number | null;
     bundleMinGzipKb: number | null;
     deprecated: boolean;
@@ -80,8 +141,12 @@ interface EvaluateOutput {
     summary: string | null;
     usageGuide: UsageGuide | null;
     repoUrl: string | null;
+    /** Latest sandbox verdict for this package, if one has been run. */
+    buildVerified?: BuildVerified | null;
 }
 /** `verify` output (§12.3.4). */
+/** Supply-chain risk gate: high = review before installing (see security/risk). */
+type RiskLevel = 'low' | 'medium' | 'high';
 interface VerifyOutput {
     exists: boolean;
     tracked: boolean;
@@ -90,6 +155,10 @@ interface VerifyOutput {
     latestVersion: string | null;
     weeklyDownloads: number | null;
     riskFlags: string[];
+    /** Overall supply-chain risk, rolled up from riskFlags. */
+    risk: RiskLevel;
+    /** Suspected typosquat target — a popular package this name closely mimics. */
+    typosquatOf: string | null;
     confidence: Confidence | null;
     advisoryCount: number;
 }
@@ -100,7 +169,13 @@ declare const SERVER_NAME = "lurq";
  *  Keep in sync with package.json "name". */
 declare const PACKAGE_NAME = "lurqrun";
 /** Keep in sync with package.json "version". */
-declare const VERSION = "0.0.1";
+declare const VERSION = "0.0.2";
+/** Default hosted endpoint the install wizard writes into agent configs. The
+ *  marketing site is `lurq.run`; the MCP service lives on the `api.` subdomain.
+ *  Overridable per-invocation with `lurq install --url …` or `LURQ_ENDPOINT`. */
+declare const DEFAULT_ENDPOINT = "https://api.lurq.run/mcp";
+/** Prefix for issued API keys (the rest is high-entropy random). */
+declare const API_KEY_PREFIX = "lurq_live_";
 /** Embedding vector dimensionality (OpenAI text-embedding-3-small). The local
  *  fallback embedder produces vectors of the same length so the DB column and
  *  pgvector index never need to change. */
@@ -130,6 +205,15 @@ declare const EnvSchema: z.ZodObject<{
     SUMMARY_MODEL: z.ZodDefault<z.ZodString>;
     LURQ_SYNC_CONCURRENCY: z.ZodDefault<z.ZodNumber>;
     LOG_LEVEL: z.ZodDefault<z.ZodEnum<["error", "warn", "info", "debug"]>>;
+    PORT: z.ZodDefault<z.ZodNumber>;
+    /** Per-API-key rate limit: max requests per window. */
+    LURQ_RATE_LIMIT_MAX: z.ZodDefault<z.ZodNumber>;
+    /** Coarser per-IP rate limit (blunts unauthenticated floods before auth). */
+    LURQ_IP_RATE_LIMIT_MAX: z.ZodDefault<z.ZodNumber>;
+    /** Rate-limit window, milliseconds (applies to both limiters). */
+    LURQ_RATE_LIMIT_WINDOW_MS: z.ZodDefault<z.ZodNumber>;
+    LURQ_ENDPOINT: z.ZodOptional<z.ZodString>;
+    LURQ_API_KEY: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     EMBEDDING_PROVIDER: "openai" | "local";
     EMBEDDING_MODEL: string;
@@ -137,10 +221,16 @@ declare const EnvSchema: z.ZodObject<{
     SUMMARY_MODEL: string;
     LURQ_SYNC_CONCURRENCY: number;
     LOG_LEVEL: "info" | "error" | "warn" | "debug";
+    PORT: number;
+    LURQ_RATE_LIMIT_MAX: number;
+    LURQ_IP_RATE_LIMIT_MAX: number;
+    LURQ_RATE_LIMIT_WINDOW_MS: number;
     DATABASE_URL?: string | undefined;
     GITHUB_TOKEN?: string | undefined;
     EMBEDDING_API_KEY?: string | undefined;
     SUMMARY_API_KEY?: string | undefined;
+    LURQ_ENDPOINT?: string | undefined;
+    LURQ_API_KEY?: string | undefined;
 }, {
     DATABASE_URL?: string | undefined;
     GITHUB_TOKEN?: string | undefined;
@@ -152,6 +242,12 @@ declare const EnvSchema: z.ZodObject<{
     SUMMARY_MODEL?: string | undefined;
     LURQ_SYNC_CONCURRENCY?: number | undefined;
     LOG_LEVEL?: "info" | "error" | "warn" | "debug" | undefined;
+    PORT?: number | undefined;
+    LURQ_RATE_LIMIT_MAX?: number | undefined;
+    LURQ_IP_RATE_LIMIT_MAX?: number | undefined;
+    LURQ_RATE_LIMIT_WINDOW_MS?: number | undefined;
+    LURQ_ENDPOINT?: string | undefined;
+    LURQ_API_KEY?: string | undefined;
 }>;
 type Config = z.infer<typeof EnvSchema>;
 declare class ConfigError extends Error {
@@ -182,4 +278,4 @@ declare const logger: {
 
 declare function buildProgram(): Command;
 
-export { type Advisory, type AdvisorySeverity, CACHE_TTL, CATEGORIES, type Candidate, type Category, type Confidence, type Config, ConfigError, EMBEDDING_DIM, type EvaluateOutput, FRONTEND_CATEGORIES, PACKAGE_NAME, type Runtime, SERVER_NAME, STALENESS_DAYS, type ScoreBreakdown, type UsageGuide, VERSION, type VerifyOutput, buildProgram, getConfig, isCategory, isFrontendCategory, loadEnv, logger, requireConfig };
+export { API_KEY_PREFIX, type Advisory, type AdvisorySeverity, type BuildVerified, CACHE_TTL, CATEGORIES, type Candidate, type Category, type CategorySource, type CompatConflict, type CompatOutput, type CompatStatus, type Confidence, type Config, ConfigError, DEFAULT_ENDPOINT, type DependencyRanges, type DiscoverySource, type DiscoveryStatus, EMBEDDING_DIM, type EvaluateOutput, FRONTEND_CATEGORIES, PACKAGE_NAME, type PeerMeta, type RiskLevel, type Runtime, SERVER_NAME, STALENESS_DAYS, type ScoreBreakdown, type UsageGuide, VERSION, type VerifyOutput, buildProgram, getConfig, isCategory, isFrontendCategory, loadEnv, logger, requireConfig };