lurqrun 0.0.5 → 0.0.7

package/dist/index.d.ts

@@ -35,6 +35,16 @@ type Confidence = 'proven' | 'emerging' | 'promising' | 'unproven';
 type Runtime = 'browser' | 'node' | 'both';
 /** Result of co-installing two package versions in the sandbox (compat matrix). */
 type CompatStatus = 'compatible' | 'conflict';
+/**
+ * Evidence class behind a compat edge (§3, §4B). Ordered weakest→strongest for
+ * upsert precedence: a mined `observed` must never overwrite a sandbox `verified`
+ * or `conflict`. `declared` = Tier-0 peer/engine semver; `observed` = co-resolved
+ * in N real dependency graphs; `verified` = sandbox co-install passed; `conflict`
+ * = declared conflict or a sandbox co-install failed.
+ */
+type CompatProvenance = 'declared' | 'observed' | 'verified' | 'conflict';
+/** Upsert precedence: higher wins, so mining can't erase a proven verdict. */
+declare const PROVENANCE_RANK: Record<CompatProvenance, number>;
 /** Coarse post-install result an agent reports back via `report_outcome` — never
  *  source code, just whether the recommended package installed / compiled /
  *  passed tests, or failed. Feeds the recommendation→outcome flywheel (§3.1). */
@@ -61,6 +71,48 @@ interface CompatConflict {
     /** The packages involved in the conflict. */
     packages: string[];
     detail: string;
+    /** The same fact as `detail`, structured, so a consumer can lay it out without
+     *  parsing prose. Present on peer-range violations; absent for engine and
+     *  sandbox conflicts, which aren't about a single declared range. */
+    requirement?: {
+        /** The peer being asked for. */
+        peer: string;
+        /** The range the requirer declares. */
+        range: string;
+        /** What the set actually resolves that peer to, when it is in the set. */
+        resolved: string | null;
+    };
+}
+/**
+ * One unordered pair among the checked members.
+ *
+ * A verdict belongs to a pair, not to a package: the same package can sit in a
+ * held pair and a conflicting one, so grading packages would either contradict
+ * itself or paint the whole set red. `held` means no declared constraint between
+ * the two was violated — it does not mean the pair was executed. Nothing here
+ * has been executed.
+ */
+interface CompatPair {
+    a: string;
+    b: string;
+    status: 'held' | 'conflict';
+    /** Only on `conflict` — the conflict's own detail string. */
+    detail?: string;
+    /** Only on `conflict`, and only for peer-range violations. */
+    requirement?: CompatConflict['requirement'];
+}
+/** One stored compat edge surfaced to agents, with its evidence class (§4B). */
+interface CompatEvidence {
+    packages: [string, string];
+    versions: [string, string];
+    status: CompatStatus;
+    provenance: CompatProvenance;
+    /** Distinct resolved graphs an `observed` edge was witnessed in (0 otherwise).
+     *  Only a newly-fetched closure accrues one; the daily re-mine re-reads closures
+     *  it has already counted and deliberately does not. NOTE: rows minted before
+     *  that fix carry an inflated count (one per sync run, ~16× on average) and are
+     *  only corrected by a backfill, which has not been run. */
+    witnessCount: number;
 }
 /**
  * `compat` output: whole-architecture compatibility for a set of packages.
@@ -68,7 +120,13 @@ interface CompatConflict {
  */
 interface CompatOutput {
     packages: string[];
-    overall: 'compatible' | 'conflict' | 'unknown';
+    /** Evidence-graded verdict:
+     *  - `conflict`   — a proven incompatibility (peer-range violation or conflict edge).
+     *  - `compatible` — every pair is *positively evidenced* (verified/observed edge).
+     *  - `likely`     — no conflict found, but not proven; absence of a declared
+     *                   conflict is not proof, so an unverified set is never `compatible`.
+     *  - `unknown`    — a member has no metadata yet (not ingested). */
+    overall: 'compatible' | 'likely' | 'conflict' | 'unknown';
     conflicts: CompatConflict[];
     /** Packages lurq has no compatibility metadata for (counted toward `unknown`). */
     unverified: string[];
@@ -78,6 +136,60 @@ interface CompatOutput {
         name: string;
         version: string | null;
     }[];
+    /** Stored edges among these packages with their evidence strength (§4B) — lets
+     *  agents (and metrics) see *why* a pair is called compatible, not just that. */
+    evidence: CompatEvidence[];
+    /** Every unordered pair among `checked`, each with its own verdict — exactly
+     *  n(n−1)/2 entries. `conflicts` lists only what went wrong; this lists what
+     *  was compared, which is what lets a caller show coverage rather than just
+     *  failures. */
+    pairs: CompatPair[];
+}
+/** Kind of an exported symbol, from its `.d.ts` declaration. */
+type ExportKind = 'function' | 'class' | 'interface' | 'type' | 'enum' | 'variable' | 'namespace' | 'unknown';
+/** One normalized exported symbol of a package version's public API surface. */
+interface ExportSymbol {
+    name: string;
+    kind: ExportKind;
+    /** Single-line normalized signature (params/return for functions, etc.), or
+     *  null when the declaration carries no useful signature. */
+    signature: string | null;
+}
+/** What changed between two API surfaces (§4D). Deltas are computed, not guessed. */
+interface SurfaceDelta {
+    added: ExportSymbol[];
+    removed: ExportSymbol[];
+    /** A symbol that disappeared and a near-identical one that appeared — inferred
+     *  by signature similarity, so an agent sees a rename, not remove+add. */
+    renamed: {
+        from: ExportSymbol;
+        to: ExportSymbol;
+    }[];
+    /** Same name, changed signature. */
+    changed: {
+        name: string;
+        before: string | null;
+        after: string | null;
+    }[];
+}
+/** `usage` tool output: version-exact API surface + optional delta from a known
+ *  version the agent was trained/working on (§4D). */
+interface UsageOutput {
+    package: string;
+    version: string | null;
+    /** Extracted export list, or null when types are unavailable (falls back to
+     *  the README, which is already fetched). */
+    surface: ExportSymbol[] | null;
+    available: boolean;
+    /** Declared `engines` for this exact version (e.g. `{ node: ">=20" }`), or null
+     *  when the manifest declares none. Independent of `available` — the runtime
+     *  floor matters even for untyped packages. */
+    engines: Record<string, string> | null;
+    /** Present when a `knownVersion` was supplied and both surfaces resolved. */
+    delta?: SurfaceDelta & {
+        fromVersion: string;
+    };
+    note?: string;
 }
 type AdvisorySeverity = 'critical' | 'high' | 'moderate' | 'low' | 'info';
 interface Advisory {
@@ -178,7 +290,7 @@ declare const SERVER_NAME = "lurq";
  *  Keep in sync with package.json "name". */
 declare const PACKAGE_NAME = "lurqrun";
 /** Keep in sync with package.json "version". */
-declare const VERSION = "0.0.5";
+declare const VERSION = "0.0.7";
 /** Default hosted endpoint the install wizard writes into agent configs. The
  *  marketing site is `lurq.run`; the MCP service lives on the `api.` subdomain.
  *  Overridable per-invocation with `lurq install --url …` or `LURQ_ENDPOINT`. */
@@ -201,7 +313,15 @@ declare const CACHE_TTL: {
     readonly bundlephobia: number;
 };
 
-/** Load `.env` into process.env exactly once. Safe to call repeatedly. */
+/**
+ * Load env into process.env exactly once. Safe to call repeatedly.
+ *
+ * Layering: if `LURQ_ENV_FILE` is set (e.g. `.env.production`), that file loads
+ * *first* so its values win, then `.env` fills in the rest (dotenv never
+ * overrides an already-set key). This is how the explicit prod path works —
+ * `LURQ_ENV_FILE=.env.production` supplies the prod DATABASE_URL while `.env`
+ * still provides shared secrets — without prod ever being the ambient default.
+ */
 declare function loadEnv(): void;
 declare const EnvSchema: z.ZodObject<{
     DATABASE_URL: z.ZodOptional<z.ZodString>;
@@ -215,6 +335,12 @@ declare const EnvSchema: z.ZodObject<{
     SUMMARY_MODEL: z.ZodDefault<z.ZodString>;
     SUMMARY_BASE_URL: z.ZodDefault<z.ZodString>;
     LURQ_SYNC_CONCURRENCY: z.ZodDefault<z.ZodNumber>;
+    /** Stalest non-seed packages the daily sync refreshes on top of the seed list.
+     *  This is the rotation rate for everything discovery ingested: index size /
+     *  this = days to come all the way around. Raise it if the sync finishes well
+     *  inside the cron window; lower it if npm starts rate-limiting. 0 disables
+     *  the rotation (seeds only, the pre-rotation behaviour). */
+    LURQ_SYNC_REFRESH_CAP: z.ZodDefault<z.ZodNumber>;
     LOG_LEVEL: z.ZodDefault<z.ZodEnum<["error", "warn", "info", "debug"]>>;
     PORT: z.ZodDefault<z.ZodNumber>;
     /** Per-API-key rate limit: max requests per window. */
@@ -229,10 +355,15 @@ declare const EnvSchema: z.ZodObject<{
      *  authenticated web app presents it to mint a key for a signed-in user. Unset
      *  → the endpoint is disabled (404). Keep it server-side, never in the client. */
     LURQ_ISSUER_SECRET: z.ZodOptional<z.ZodString>;
+    /** Numeric App ID from the GitHub App settings page. */
+    LURQ_GITHUB_APP_ID: z.ZodOptional<z.ZodString>;
+    /** PEM private key. Accepts literal newlines or `\n` escapes (Railway/Vercel). */
+    LURQ_GITHUB_APP_PRIVATE_KEY: z.ZodOptional<z.ZodString>;
     LURQ_ENDPOINT: z.ZodOptional<z.ZodString>;
     LURQ_API_KEY: z.ZodOptional<z.ZodString>;
     E2B_API_KEY: z.ZodOptional<z.ZodString>;
     E2B_TEMPLATE: z.ZodOptional<z.ZodString>;
+    USE_LIVE_API: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     EMBEDDING_PROVIDER: "openai" | "local";
     EMBEDDING_MODEL: string;
@@ -241,6 +372,7 @@ declare const EnvSchema: z.ZodObject<{
     SUMMARY_MODEL: string;
     SUMMARY_BASE_URL: string;
     LURQ_SYNC_CONCURRENCY: number;
+    LURQ_SYNC_REFRESH_CAP: number;
     LOG_LEVEL: "info" | "error" | "warn" | "debug";
     PORT: number;
     LURQ_RATE_LIMIT_MAX: number;
@@ -252,10 +384,13 @@ declare const EnvSchema: z.ZodObject<{
     SUMMARY_API_KEY?: string | undefined;
     LURQ_METRICS_TOKEN?: string | undefined;
     LURQ_ISSUER_SECRET?: string | undefined;
+    LURQ_GITHUB_APP_ID?: string | undefined;
+    LURQ_GITHUB_APP_PRIVATE_KEY?: string | undefined;
     LURQ_ENDPOINT?: string | undefined;
     LURQ_API_KEY?: string | undefined;
     E2B_API_KEY?: string | undefined;
     E2B_TEMPLATE?: string | undefined;
+    USE_LIVE_API?: string | undefined;
 }, {
     DATABASE_URL?: string | undefined;
     GITHUB_TOKEN?: string | undefined;
@@ -268,6 +403,7 @@ declare const EnvSchema: z.ZodObject<{
     SUMMARY_MODEL?: string | undefined;
     SUMMARY_BASE_URL?: string | undefined;
     LURQ_SYNC_CONCURRENCY?: number | undefined;
+    LURQ_SYNC_REFRESH_CAP?: number | undefined;
     LOG_LEVEL?: "info" | "error" | "warn" | "debug" | undefined;
     PORT?: number | undefined;
     LURQ_RATE_LIMIT_MAX?: number | undefined;
@@ -275,10 +411,13 @@ declare const EnvSchema: z.ZodObject<{
     LURQ_RATE_LIMIT_WINDOW_MS?: number | undefined;
     LURQ_METRICS_TOKEN?: string | undefined;
     LURQ_ISSUER_SECRET?: string | undefined;
+    LURQ_GITHUB_APP_ID?: string | undefined;
+    LURQ_GITHUB_APP_PRIVATE_KEY?: string | undefined;
     LURQ_ENDPOINT?: string | undefined;
     LURQ_API_KEY?: string | undefined;
     E2B_API_KEY?: string | undefined;
     E2B_TEMPLATE?: string | undefined;
+    USE_LIVE_API?: string | undefined;
 }>;
 type Config = z.infer<typeof EnvSchema>;
 declare class ConfigError extends Error {
@@ -309,4 +448,4 @@ declare const logger: {
 
 declare function buildProgram(): Command;
 
-export { API_KEY_PREFIX, type Advisory, type AdvisorySeverity, type BuildSignal, type BuildVerified, CACHE_TTL, CATEGORIES, type Candidate, type Category, type CategorySource, type CompatConflict, type CompatOutput, type CompatStatus, type Confidence, type Config, ConfigError, DEFAULT_ENDPOINT, type DependencyRanges, type DiscoverySource, type DiscoveryStatus, EMBEDDING_DIM, type EvaluateOutput, FRONTEND_CATEGORIES, PACKAGE_NAME, type PeerMeta, type RiskLevel, type Runtime, SERVER_NAME, STALENESS_DAYS, type ScoreBreakdown, type UsageGuide, VERSION, type VerifyOutput, buildProgram, getConfig, isCategory, isFrontendCategory, loadEnv, logger, requireConfig };
+export { API_KEY_PREFIX, type Advisory, type AdvisorySeverity, type BuildSignal, type BuildVerified, CACHE_TTL, CATEGORIES, type Candidate, type Category, type CategorySource, type CompatConflict, type CompatEvidence, type CompatOutput, type CompatPair, type CompatProvenance, type CompatStatus, type Confidence, type Config, ConfigError, DEFAULT_ENDPOINT, type DependencyRanges, type DiscoverySource, type DiscoveryStatus, EMBEDDING_DIM, type EvaluateOutput, type ExportKind, type ExportSymbol, FRONTEND_CATEGORIES, PACKAGE_NAME, PROVENANCE_RANK, type PeerMeta, type RiskLevel, type Runtime, SERVER_NAME, STALENESS_DAYS, type ScoreBreakdown, type SurfaceDelta, type UsageGuide, type UsageOutput, VERSION, type VerifyOutput, buildProgram, getConfig, isCategory, isFrontendCategory, loadEnv, logger, requireConfig };