lurqrun 0.0.2 → 0.0.4

package/dist/index.d.ts

@@ -33,6 +33,52 @@ declare function isFrontendCategory(category: Category | null | undefined): bool
  */
 type Confidence = 'proven' | 'emerging' | 'promising' | 'unproven';
 type Runtime = 'browser' | 'node' | 'both';
+/** Result of co-installing two package versions in the sandbox (compat matrix). */
+type CompatStatus = 'compatible' | 'conflict';
+/** Coarse post-install result an agent reports back via `report_outcome` — never
+ *  source code, just whether the recommended package installed / compiled /
+ *  passed tests, or failed. Feeds the recommendation→outcome flywheel (§3.1). */
+type BuildSignal = 'installed' | 'compiled' | 'tests_passed' | 'failed';
+/** Sandbox verdict surfaced to agents: did this version actually install + load? */
+interface BuildVerified {
+    version: string;
+    installed: boolean;
+    loaded: boolean | null;
+    driver: string;
+    ranAt: string;
+}
+/** A map of dependency/peer/engine name → semver range (from a manifest). */
+type DependencyRanges = Record<string, string>;
+/** `peerDependenciesMeta`: per-peer flags, notably `{ optional: true }`. */
+type PeerMeta = Record<string, {
+    optional?: boolean;
+}>;
+/** One incompatibility found across a set of packages. */
+interface CompatConflict {
+    /** Where the conflict came from. `peer-deps`/`engines` are Tier-1 (metadata,
+     *  instant, deterministic); `sandbox` is Tier-2 (empirical co-install). */
+    source: 'peer-deps' | 'engines' | 'sandbox';
+    /** The packages involved in the conflict. */
+    packages: string[];
+    detail: string;
+}
+/**
+ * `compat` output: whole-architecture compatibility for a set of packages.
+ * Tier-1 peer-dependency/engine analysis + any Tier-2 sandbox conflicts.
+ */
+interface CompatOutput {
+    packages: string[];
+    overall: 'compatible' | 'conflict' | 'unknown';
+    conflicts: CompatConflict[];
+    /** Packages lurq has no compatibility metadata for (counted toward `unknown`). */
+    unverified: string[];
+    /** The exact members the check ran over, name + resolved version. Versions are
+     *  always surfaced here, and the structure is stable for later scraping. */
+    checked: {
+        name: string;
+        version: string | null;
+    }[];
+}
 type AdvisorySeverity = 'critical' | 'high' | 'moderate' | 'low' | 'info';
 interface Advisory {
     id: string;
@@ -91,7 +137,6 @@ interface EvaluateOutput {
     lastReleaseAt: string | null;
     weeklyDownloads: number | null;
     downloadGrowth90d: number | null;
-    dependentsCount: number | null;
     scorecard: number | null;
     bundleMinGzipKb: number | null;
     deprecated: boolean;
@@ -100,8 +145,17 @@ interface EvaluateOutput {
     summary: string | null;
     usageGuide: UsageGuide | null;
     repoUrl: string | null;
+    /** If this package is superseded, the recommended migration target (§1.2). */
+    replacedBy?: {
+        name: string;
+        reason: string;
+    } | null;
+    /** Latest sandbox verdict for this package, if one has been run. */
+    buildVerified?: BuildVerified | null;
 }
 /** `verify` output (§12.3.4). */
+/** Supply-chain risk gate: high = review before installing (see security/risk). */
+type RiskLevel = 'low' | 'medium' | 'high';
 interface VerifyOutput {
     exists: boolean;
     tracked: boolean;
@@ -110,6 +164,10 @@ interface VerifyOutput {
     latestVersion: string | null;
     weeklyDownloads: number | null;
     riskFlags: string[];
+    /** Overall supply-chain risk, rolled up from riskFlags. */
+    risk: RiskLevel;
+    /** Suspected typosquat target — a popular package this name closely mimics. */
+    typosquatOf: string | null;
     confidence: Confidence | null;
     advisoryCount: number;
 }
@@ -120,7 +178,7 @@ declare const SERVER_NAME = "lurq";
  *  Keep in sync with package.json "name". */
 declare const PACKAGE_NAME = "lurqrun";
 /** Keep in sync with package.json "version". */
-declare const VERSION = "0.0.2";
+declare const VERSION = "0.0.4";
 /** Default hosted endpoint the install wizard writes into agent configs. The
  *  marketing site is `lurq.run`; the MCP service lives on the `api.` subdomain.
  *  Overridable per-invocation with `lurq install --url …` or `LURQ_ENDPOINT`. */
@@ -151,9 +209,11 @@ declare const EnvSchema: z.ZodObject<{
     EMBEDDING_PROVIDER: z.ZodDefault<z.ZodEnum<["openai", "local"]>>;
     EMBEDDING_API_KEY: z.ZodOptional<z.ZodString>;
     EMBEDDING_MODEL: z.ZodDefault<z.ZodString>;
+    EMBEDDING_BASE_URL: z.ZodDefault<z.ZodString>;
     SUMMARY_PROVIDER: z.ZodDefault<z.ZodEnum<["openai", "none"]>>;
     SUMMARY_API_KEY: z.ZodOptional<z.ZodString>;
     SUMMARY_MODEL: z.ZodDefault<z.ZodString>;
+    SUMMARY_BASE_URL: z.ZodDefault<z.ZodString>;
     LURQ_SYNC_CONCURRENCY: z.ZodDefault<z.ZodNumber>;
     LOG_LEVEL: z.ZodDefault<z.ZodEnum<["error", "warn", "info", "debug"]>>;
     PORT: z.ZodDefault<z.ZodNumber>;
@@ -163,13 +223,23 @@ declare const EnvSchema: z.ZodObject<{
     LURQ_IP_RATE_LIMIT_MAX: z.ZodDefault<z.ZodNumber>;
     /** Rate-limit window, milliseconds (applies to both limiters). */
     LURQ_RATE_LIMIT_WINDOW_MS: z.ZodDefault<z.ZodNumber>;
+    /** Bearer token guarding `/metrics`. Unset → the endpoint is disabled (404). */
+    LURQ_METRICS_TOKEN: z.ZodOptional<z.ZodString>;
+    /** Shared secret for self-serve key issuance (`POST /keys`). The Clerk-
+     *  authenticated web app presents it to mint a key for a signed-in user. Unset
+     *  → the endpoint is disabled (404). Keep it server-side, never in the client. */
+    LURQ_ISSUER_SECRET: z.ZodOptional<z.ZodString>;
     LURQ_ENDPOINT: z.ZodOptional<z.ZodString>;
     LURQ_API_KEY: z.ZodOptional<z.ZodString>;
+    E2B_API_KEY: z.ZodOptional<z.ZodString>;
+    E2B_TEMPLATE: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     EMBEDDING_PROVIDER: "openai" | "local";
     EMBEDDING_MODEL: string;
+    EMBEDDING_BASE_URL: string;
     SUMMARY_PROVIDER: "openai" | "none";
     SUMMARY_MODEL: string;
+    SUMMARY_BASE_URL: string;
     LURQ_SYNC_CONCURRENCY: number;
     LOG_LEVEL: "info" | "error" | "warn" | "debug";
     PORT: number;
@@ -180,25 +250,35 @@ declare const EnvSchema: z.ZodObject<{
     GITHUB_TOKEN?: string | undefined;
     EMBEDDING_API_KEY?: string | undefined;
     SUMMARY_API_KEY?: string | undefined;
+    LURQ_METRICS_TOKEN?: string | undefined;
+    LURQ_ISSUER_SECRET?: string | undefined;
     LURQ_ENDPOINT?: string | undefined;
     LURQ_API_KEY?: string | undefined;
+    E2B_API_KEY?: string | undefined;
+    E2B_TEMPLATE?: string | undefined;
 }, {
     DATABASE_URL?: string | undefined;
     GITHUB_TOKEN?: string | undefined;
     EMBEDDING_PROVIDER?: "openai" | "local" | undefined;
     EMBEDDING_API_KEY?: string | undefined;
     EMBEDDING_MODEL?: string | undefined;
+    EMBEDDING_BASE_URL?: string | undefined;
     SUMMARY_PROVIDER?: "openai" | "none" | undefined;
     SUMMARY_API_KEY?: string | undefined;
     SUMMARY_MODEL?: string | undefined;
+    SUMMARY_BASE_URL?: string | undefined;
     LURQ_SYNC_CONCURRENCY?: number | undefined;
     LOG_LEVEL?: "info" | "error" | "warn" | "debug" | undefined;
     PORT?: number | undefined;
     LURQ_RATE_LIMIT_MAX?: number | undefined;
     LURQ_IP_RATE_LIMIT_MAX?: number | undefined;
     LURQ_RATE_LIMIT_WINDOW_MS?: number | undefined;
+    LURQ_METRICS_TOKEN?: string | undefined;
+    LURQ_ISSUER_SECRET?: string | undefined;
     LURQ_ENDPOINT?: string | undefined;
     LURQ_API_KEY?: string | undefined;
+    E2B_API_KEY?: string | undefined;
+    E2B_TEMPLATE?: string | undefined;
 }>;
 type Config = z.infer<typeof EnvSchema>;
 declare class ConfigError extends Error {
@@ -229,4 +309,4 @@ declare const logger: {
 
 declare function buildProgram(): Command;
 
-export { API_KEY_PREFIX, type Advisory, type AdvisorySeverity, CACHE_TTL, CATEGORIES, type Candidate, type Category, type CategorySource, type Confidence, type Config, ConfigError, DEFAULT_ENDPOINT, type DiscoverySource, type DiscoveryStatus, EMBEDDING_DIM, type EvaluateOutput, FRONTEND_CATEGORIES, PACKAGE_NAME, type Runtime, SERVER_NAME, STALENESS_DAYS, type ScoreBreakdown, type UsageGuide, VERSION, type VerifyOutput, buildProgram, getConfig, isCategory, isFrontendCategory, loadEnv, logger, requireConfig };
+export { API_KEY_PREFIX, type Advisory, type AdvisorySeverity, type BuildSignal, type BuildVerified, CACHE_TTL, CATEGORIES, type Candidate, type Category, type CategorySource, type CompatConflict, type CompatOutput, type CompatStatus, type Confidence, type Config, ConfigError, DEFAULT_ENDPOINT, type DependencyRanges, type DiscoverySource, type DiscoveryStatus, EMBEDDING_DIM, type EvaluateOutput, FRONTEND_CATEGORIES, PACKAGE_NAME, type PeerMeta, type RiskLevel, type Runtime, SERVER_NAME, STALENESS_DAYS, type ScoreBreakdown, type UsageGuide, VERSION, type VerifyOutput, buildProgram, getConfig, isCategory, isFrontendCategory, loadEnv, logger, requireConfig };