lurqrun 0.1.6 → 0.1.7

package/dist/chunk-CW5HJ3LX.js

@@ -0,0 +1,96 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  DEFAULT_ECOSYSTEM
+} from "./chunk-VLRHFMGJ.js";
+import {
+  compatEdges,
+  compatVerifyQueue,
+  packages
+} from "./chunk-LYMPYETA.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/db/compat.ts
+init_esm_shims();
+import { and, eq, inArray, sql } from "drizzle-orm";
+async function getCompatMetadata(db, names, ecosystem = DEFAULT_ECOSYSTEM) {
+  if (names.length === 0) return [];
+  return db.select({
+    name: packages.name,
+    latestVersion: packages.latestVersion,
+    peerDependencies: packages.peerDependencies,
+    peerDependenciesMeta: packages.peerDependenciesMeta,
+    engines: packages.engines
+  }).from(packages).where(and(inArray(packages.name, names), eq(packages.ecosystem, ecosystem)));
+}
+function canonicalPair(a, b) {
+  const [low, high] = a.name <= b.name ? [a, b] : [b, a];
+  return { packageA: low.name, versionA: low.version, packageB: high.name, versionB: high.version };
+}
+function provenanceRank(col) {
+  return sql`case ${col} when 'conflict' then 3 when 'verified' then 2 when 'observed' then 1 else 0 end`;
+}
+function conflictSet() {
+  const incomingWins = sql`${provenanceRank(sql`excluded.provenance`)} >= ${provenanceRank(compatEdges.provenance)}`;
+  return {
+    status: sql`case when ${incomingWins} then excluded.status else ${compatEdges.status} end`,
+    provenance: sql`case when ${incomingWins} then excluded.provenance else ${compatEdges.provenance} end`,
+    driver: sql`case when ${incomingWins} then excluded.driver else ${compatEdges.driver} end`,
+    ranAt: sql`case when ${incomingWins} then excluded.ran_at else ${compatEdges.ranAt} end`,
+    witnessCount: sql`${compatEdges.witnessCount} + excluded.witness_count`
+  };
+}
+var CONFLICT_TARGET = [
+  compatEdges.packageA,
+  compatEdges.versionA,
+  compatEdges.packageB,
+  compatEdges.versionB
+];
+async function upsertCompatEdge(db, edge) {
+  await db.insert(compatEdges).values(edge).onConflictDoUpdate({ target: [...CONFLICT_TARGET], set: conflictSet() });
+}
+async function getSandboxEdges(db, names) {
+  if (names.length === 0) return [];
+  return db.select().from(compatEdges).where(
+    and(
+      inArray(compatEdges.packageA, names),
+      inArray(compatEdges.packageB, names),
+      inArray(compatEdges.provenance, ["verified", "conflict"])
+    )
+  );
+}
+function pairKey(a, b) {
+  return a <= b ? `${a}|${b}` : `${b}|${a}`;
+}
+function compatSetKey(names) {
+  return [...new Set(names)].sort().join("|");
+}
+async function enqueueCompatVerify(db, names) {
+  const packages2 = [...new Set(names)].filter(Boolean);
+  if (packages2.length < 2) return false;
+  const inserted = await db.insert(compatVerifyQueue).values({ setKey: compatSetKey(packages2), packages: packages2 }).onConflictDoNothing({ target: compatVerifyQueue.setKey }).returning({ id: compatVerifyQueue.id });
+  return inserted.length > 0;
+}
+async function getPendingCompatVerify(db, limit) {
+  return db.select().from(compatVerifyQueue).orderBy(compatVerifyQueue.requestedAt).limit(limit);
+}
+async function deleteCompatVerify(db, id) {
+  await db.delete(compatVerifyQueue).where(eq(compatVerifyQueue.id, id));
+}
+async function bumpCompatVerifyAttempt(db, id) {
+  const [row] = await db.update(compatVerifyQueue).set({ attempts: sql`${compatVerifyQueue.attempts} + 1` }).where(eq(compatVerifyQueue.id, id)).returning({ attempts: compatVerifyQueue.attempts });
+  return row?.attempts ?? 0;
+}
+
+export {
+  getCompatMetadata,
+  canonicalPair,
+  upsertCompatEdge,
+  getSandboxEdges,
+  pairKey,
+  enqueueCompatVerify,
+  getPendingCompatVerify,
+  deleteCompatVerify,
+  bumpCompatVerifyAttempt
+};

package/dist/chunk-DB2VF5UD.js

@@ -0,0 +1,315 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  diffSurfaces
+} from "./chunk-SHCEBP3J.js";
+import {
+  canonicalKey,
+  enqueueSurface,
+  mcpSurfaceRef,
+  surfaceRef
+} from "./chunk-LO35HLQZ.js";
+import {
+  cached
+} from "./chunk-HWBBVLOT.js";
+import {
+  UNBOUNDED_ARITY,
+  claims,
+  entities,
+  observations,
+  symbols
+} from "./chunk-LYMPYETA.js";
+import {
+  logger
+} from "./chunk-MYGSLK44.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/mcp/surfaceHandlers.ts
+init_esm_shims();
+import { createHash } from "crypto";
+import { and, desc, eq } from "drizzle-orm";
+
+// src/pipeline/fillSurface.ts
+init_esm_shims();
+import { sql } from "drizzle-orm";
+var TIER = "shipped_js_ast";
+var MAX_QUEUED = 32;
+var MAX_ATTEMPTED = 5e4;
+var BATCH = 500;
+var attempted = /* @__PURE__ */ new Set();
+var pending = /* @__PURE__ */ new Set();
+var queue = [];
+var draining = null;
+function needsFill(rows) {
+  const tierA = rows.filter((r) => r.tier === TIER);
+  return tierA.length > 0 && tierA.every((r) => r.sourceOffset === null && r.maxArity === null);
+}
+function scheduleFill(db, pkg, version, entityId, fill = fillOne) {
+  const key = `${pkg}@${version}`;
+  if (pending.has(key)) return true;
+  if (attempted.has(key) || queue.length >= MAX_QUEUED) return false;
+  if (attempted.size >= MAX_ATTEMPTED) attempted.clear();
+  attempted.add(key);
+  pending.add(key);
+  queue.push({ db, pkg, version, entityId, fill });
+  draining ??= drain().finally(() => {
+    draining = null;
+  });
+  return true;
+}
+async function drain() {
+  for (let job = queue.shift(); job; job = queue.shift()) {
+    const key = `${job.pkg}@${job.version}`;
+    try {
+      const updated = await job.fill(job.db, job.pkg, job.version, job.entityId);
+      logger.info(`surface fill ${key}: ${updated} symbol row(s) updated`);
+    } catch (err) {
+      logger.warn(`surface fill failed for ${key}: ${err instanceof Error ? err.message : String(err)}`);
+    } finally {
+      pending.delete(key);
+    }
+    await new Promise((resolve) => setImmediate(resolve));
+  }
+}
+async function fillOne(db, pkg, version, entityId) {
+  const { fetchAndExtract } = await import("./fetch-QYTUJVG2.js");
+  const fetched = await fetchAndExtract(pkg, version);
+  if (!fetched) return 0;
+  const values = fetched.surface.symbols.filter((s) => s.tier === TIER && (s.sourceRef?.offset !== void 0 || s.maxArity !== void 0)).map((s) => ({
+    path: s.path,
+    offset: s.sourceRef?.offset ?? null,
+    maxArity: s.maxArity === void 0 ? null : s.maxArity ?? UNBOUNDED_ARITY
+  }));
+  let updated = 0;
+  for (let i = 0; i < values.length; i += BATCH) {
+    const res = await db.execute(fillStatement(entityId, values.slice(i, i + BATCH)));
+    updated += res.count ?? 0;
+  }
+  return updated;
+}
+function fillStatement(entityId, values) {
+  const rows = sql.join(
+    values.map((v) => sql`(${v.path}, ${v.offset}::int, ${v.maxArity}::int)`),
+    sql`, `
+  );
+  return sql`
+    UPDATE symbols AS s
+    SET source_offset = v.new_offset, max_arity = v.new_max_arity
+    FROM (VALUES ${rows}) AS v(path, new_offset, new_max_arity)
+    WHERE s.entity_id = ${entityId}
+      AND s.tier = ${TIER}
+      AND s.path = v.path
+      AND s.source_offset IS NULL
+      AND s.max_arity IS NULL`;
+}
+
+// src/mcp/surfaceHandlers.ts
+function rowsToSurface(pkg, version, rows, tier) {
+  const symbolsOut = rows.map((r) => ({
+    path: r.path,
+    kind: r.kind,
+    arity: r.arity,
+    origin: r.origin,
+    deprecated: r.deprecated,
+    tier: r.tier,
+    // The signature was dropped on the way back out of the database, so every
+    // diff computed from STORED rows saw `signature: undefined` on both sides
+    // and reported no signature drift — for tier C, where signatures are the
+    // only thing that tier can report, and for the MCP tier, where the entire
+    // tool contract is serialized into this field.
+    ...r.signature !== null ? { signature: r.signature } : {},
+    // Offset and maximum arity come back too. Without them a diff computed from
+    // stored rows could never find a proven rename or a dropped trailing
+    // parameter, and every consumer of the index would see less than the CLI.
+    ...r.sourceFile ? {
+      sourceRef: {
+        file: r.sourceFile,
+        line: r.sourceLine ?? 0,
+        ...r.sourceOffset !== null ? { offset: r.sourceOffset } : {}
+      }
+    } : {},
+    ...r.maxArity !== null ? { maxArity: r.maxArity === UNBOUNDED_ARITY ? null : r.maxArity } : {}
+  }));
+  return {
+    package: pkg,
+    version,
+    tier,
+    entry: null,
+    symbols: symbolsOut,
+    filesWalked: 0,
+    externalReExports: []
+  };
+}
+async function loadStored(db, pkg, version, tenantId = 0, kind = "package_surface") {
+  let entity;
+  if (version === null) {
+    const rows2 = await db.select({ e: entities, at: observations.observedAt }).from(entities).innerJoin(claims, eq(claims.subjectId, entities.id)).innerJoin(observations, eq(observations.claimId, claims.id)).where(and(eq(entities.kind, kind), eq(entities.name, pkg))).orderBy(desc(observations.observedAt)).limit(1);
+    entity = rows2.find((r) => r.e.tenantId === tenantId)?.e;
+  } else {
+    const key = canonicalKey(
+      kind === "mcp_server" ? mcpSurfaceRef(pkg, version) : surfaceRef(pkg, version)
+    );
+    const ents = await db.select().from(entities).where(eq(entities.canonicalKey, key)).limit(2);
+    entity = ents.find((e) => e.tenantId === tenantId);
+  }
+  if (!entity) return null;
+  const obs = await db.select({ o: observations }).from(observations).innerJoin(claims, eq(observations.claimId, claims.id)).where(eq(claims.subjectId, entity.id)).orderBy(desc(observations.observedAt)).limit(1);
+  const latest = obs[0]?.o ?? null;
+  const rows = await db.select().from(symbols).where(eq(symbols.entityId, entity.id));
+  return {
+    entityId: entity.id,
+    rows,
+    verdict: latest?.verdict ?? "unknown",
+    class: latest?.class ?? null,
+    tier: latest?.tier ?? null,
+    observedAt: latest?.observedAt ? latest.observedAt.toISOString() : null
+  };
+}
+var MISS = {
+  verdict: "unknown",
+  class: null,
+  tier: null,
+  symbols: [],
+  coverageNote: "not yet extracted, queued; retry shortly. This is NOT evidence of absence.",
+  observedAt: null
+};
+function ckey(parts) {
+  return createHash("sha1").update(JSON.stringify(parts)).digest("hex").slice(0, 24);
+}
+async function handleResolveSurface(db, input) {
+  return cached(
+    "resolve_surface",
+    ckey([input.package, input.version ?? null]),
+    () => resolveSurfaceUncached(db, input),
+    { skipCache: (v) => v.verdict === "unknown" }
+  );
+}
+async function resolveSurfaceUncached(db, input) {
+  const version = input.version ?? null;
+  let stored = await loadStored(db, input.package, version);
+  if (!stored || stored.verdict === "unknown" && stored.rows.length === 0) {
+    const { firstTouchSurface } = await import("./firstTouch-QQTJH4QX.js");
+    if (await firstTouchSurface(db, input.package, version)) {
+      stored = await loadStored(db, input.package, version);
+    }
+  }
+  if (!stored || stored.verdict === "unknown" && stored.rows.length === 0) {
+    await enqueueSurface(db, input.package, version).catch(() => {
+    });
+    return { package: input.package, version, ...MISS };
+  }
+  if (stored.verdict === "undeclared") {
+    return {
+      package: input.package,
+      version,
+      verdict: "undeclared",
+      class: stored.class,
+      tier: stored.tier,
+      symbols: [],
+      coverageNote: "package ships no artifact this tier can read, UNDECLARED, which is a measurement gap, not an empty API",
+      observedAt: stored.observedAt
+    };
+  }
+  const runtime = stored.rows.filter((r) => r.kind !== "type_only" && r.origin === "local");
+  const excluded = stored.rows.length - runtime.length;
+  return {
+    package: input.package,
+    version,
+    verdict: stored.verdict,
+    class: stored.class,
+    tier: stored.tier,
+    symbols: runtime.map((r) => ({
+      path: r.path,
+      kind: r.kind,
+      arity: r.arity,
+      deprecated: r.deprecated
+    })),
+    coverageNote: `${runtime.length} runtime symbol(s)` + (excluded ? `; ${excluded} excluded as type-only or re-exported from another package` : "") + (stored.tier === "shipped_js_ast" ? ". Runtime existence only, signatures require tier C." : ""),
+    observedAt: stored.observedAt
+  };
+}
+async function handleDiffSurface(db, input) {
+  let filling = false;
+  return cached(
+    "diff_surface",
+    ckey([input.package, input.fromVersion, input.toVersion]),
+    () => diffSurfaceUncached(db, input, () => filling = true),
+    { skipCache: (v) => v.verdict === "unknown" || filling }
+  );
+}
+async function diffSurfaceUncached(db, input, onFill) {
+  let [a, b] = await Promise.all([
+    loadStored(db, input.package, input.fromVersion),
+    loadStored(db, input.package, input.toVersion)
+  ]);
+  if (!a || !b || a.rows.length === 0 || b.rows.length === 0) {
+    const { firstTouchPair } = await import("./firstTouch-QQTJH4QX.js");
+    if (await firstTouchPair(db, input.package, input.fromVersion, input.toVersion)) {
+      [a, b] = await Promise.all([
+        loadStored(db, input.package, input.fromVersion),
+        loadStored(db, input.package, input.toVersion)
+      ]);
+    }
+  }
+  const missing = [];
+  if (!a || a.rows.length === 0) missing.push(input.fromVersion);
+  if (!b || b.rows.length === 0) missing.push(input.toVersion);
+  if (missing.length) {
+    for (const v of missing) await enqueueSurface(db, input.package, v).catch(() => {
+    });
+    return {
+      package: input.package,
+      fromVersion: input.fromVersion,
+      toVersion: input.toVersion,
+      verdict: "unknown",
+      inconclusive: `no extracted surface for ${missing.join(", ")}, queued; retry shortly. NOT evidence that symbols were removed.`,
+      removed: [],
+      added: [],
+      arityChanged: [],
+      typeOnlyRemoved: [],
+      // Present-but-empty like every other list above, so a miss and a hit have
+      // the same shape and callers never have to branch on which one they got.
+      deprecated: [],
+      renamed: [],
+      observedAt: null
+    };
+  }
+  for (const [stored, version] of [
+    [a, input.fromVersion],
+    [b, input.toVersion]
+  ]) {
+    if (needsFill(stored.rows) && scheduleFill(db, input.package, version, stored.entityId)) onFill();
+  }
+  const diff = diffSurfaces(
+    rowsToSurface(input.package, input.fromVersion, a.rows, a.tier ?? "shipped_js_ast"),
+    rowsToSurface(input.package, input.toVersion, b.rows, b.tier ?? "shipped_js_ast")
+  );
+  return {
+    package: input.package,
+    fromVersion: input.fromVersion,
+    toVersion: input.toVersion,
+    verdict: diff.inconclusive ? "unknown" : "verified_true",
+    class: "derived",
+    tier: diff.tier,
+    ...diff.inconclusive ? { inconclusive: diff.inconclusive } : {},
+    /** Breaks `node`. */
+    removed: diff.removed.map((s) => ({ path: s.path, kind: s.kind, arity: s.arity })),
+    added: diff.added.map((s) => ({ path: s.path, kind: s.kind })),
+    arityChanged: diff.arityChanged,
+    /** Breaks `tsc`, NOT `node` — returned separately on purpose (§8.1). */
+    typeOnlyRemoved: diff.typeOnlyRemoved.map((s) => s.path),
+    deprecated: diff.deprecated.map((s) => s.path),
+    /** Removed names whose implementation the package still exports under another
+     *  name. Empty for surfaces stored before declaration offsets were recorded. */
+    renamed: diff.renamed,
+    observedAt: b.observedAt
+  };
+}
+
+export {
+  rowsToSurface,
+  loadStored,
+  handleResolveSurface,
+  handleDiffSurface
+};

package/dist/chunk-DWAGCNEL.js

@@ -0,0 +1,210 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  detectInstallCommand
+} from "./chunk-B43LCXBM.js";
+import {
+  REPO_MANIFEST_CAP
+} from "./chunk-BCANRN5B.js";
+import {
+  HttpError,
+  httpRequest
+} from "./chunk-SJOVFF7B.js";
+import {
+  getConfig
+} from "./chunk-GRJXQBQZ.js";
+import {
+  logger
+} from "./chunk-MYGSLK44.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/github/app.ts
+init_esm_shims();
+import { createSign } from "crypto";
+var API_HOST = "api.github.com";
+var API = `https://${API_HOST}`;
+var JWT_TTL_S = 9 * 60;
+var TOKEN_SKEW_MS = 6e4;
+var GithubAppError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "GithubAppError";
+  }
+  status;
+};
+function githubAppCredentials() {
+  const config = getConfig();
+  const appId = config.LURQ_GITHUB_APP_ID;
+  const rawKey = config.LURQ_GITHUB_APP_PRIVATE_KEY;
+  if (!appId || !rawKey) return null;
+  const privateKey = rawKey.includes("\\n") ? rawKey.replace(/\\n/g, "\n") : rawKey;
+  return { appId, privateKey };
+}
+function b64url(input) {
+  return Buffer.from(input).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function appJwt(creds, now = /* @__PURE__ */ new Date()) {
+  const issued = Math.floor(now.getTime() / 1e3) - 60;
+  const header = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+  const payload = b64url(
+    JSON.stringify({ iat: issued, exp: issued + JWT_TTL_S, iss: creds.appId })
+  );
+  const signature = createSign("RSA-SHA256").update(`${header}.${payload}`).sign(creds.privateKey);
+  return `${header}.${payload}.${b64url(signature)}`;
+}
+var tokenCache = /* @__PURE__ */ new Map();
+async function installationToken(installationId) {
+  const cached = tokenCache.get(installationId);
+  if (cached && cached.expiresAt - TOKEN_SKEW_MS > Date.now()) return cached.token;
+  const creds = githubAppCredentials();
+  if (!creds) throw new GithubAppError("GitHub App is not configured.", 503);
+  let res;
+  try {
+    res = await httpRequest(
+      `${API}/app/installations/${installationId}/access_tokens`,
+      {
+        host: API_HOST,
+        ttlMs: 0,
+        // never cache credentials to disk
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${appJwt(creds)}`,
+          Accept: "application/vnd.github+json",
+          "X-GitHub-Api-Version": "2022-11-28"
+        }
+      }
+    );
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      throw new GithubAppError("This GitHub installation no longer exists.", 404);
+    }
+    throw new GithubAppError(
+      err instanceof Error ? err.message : "Could not authenticate with GitHub.",
+      502
+    );
+  }
+  const token = res.data?.token;
+  if (!token) throw new GithubAppError("GitHub returned no installation token.", 502);
+  const expiresAt = res.data.expires_at ? Date.parse(res.data.expires_at) : NaN;
+  tokenCache.set(installationId, {
+    token,
+    // A token with an unparseable expiry is still valid; treat it as short-lived
+    // rather than caching it forever on a malformed timestamp.
+    expiresAt: Number.isNaN(expiresAt) ? Date.now() + 5 * 6e4 : expiresAt
+  });
+  return token;
+}
+async function installationGet(installationId, path) {
+  const token = await installationToken(installationId);
+  const res = await httpRequest(`${API}${path}`, {
+    host: API_HOST,
+    ttlMs: 0,
+    // repo state changes under us; a cached manifest is a wrong answer
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28"
+    }
+  });
+  return res.data;
+}
+
+// src/github/manifests.ts
+init_esm_shims();
+var PAGE_SIZE = 100;
+var MAX_PAGES = 20;
+async function listInstallationRepos(installationId) {
+  const out = [];
+  for (let page = 1; page <= MAX_PAGES; page++) {
+    const data = await installationGet(
+      installationId,
+      `/installation/repositories?per_page=${PAGE_SIZE}&page=${page}`
+    );
+    const batch = data.repositories ?? [];
+    for (const repo of batch) {
+      out.push({
+        fullName: repo.full_name,
+        defaultBranch: repo.default_branch,
+        isPrivate: repo.private,
+        pushedAt: repo.pushed_at ?? null
+      });
+    }
+    if (batch.length < PAGE_SIZE) break;
+  }
+  return out;
+}
+function manifestPaths(tree) {
+  return tree.filter(
+    (node) => node.type === "blob" && (node.path === "package.json" || node.path.endsWith("/package.json")) && // A committed node_modules is rare but real, and its manifests are not
+    // this project's dependencies — counting them would invent drift.
+    !node.path.split("/").includes("node_modules")
+  ).sort((a, b) => a.path.split("/").length - b.path.split("/").length).map((node) => node.path);
+}
+function parseManifest(path, json) {
+  if (!json || typeof json !== "object") return null;
+  const pkg = json;
+  const deps = {};
+  for (const block of ["dependencies", "devDependencies"]) {
+    const entry = pkg[block];
+    if (!entry || typeof entry !== "object") continue;
+    for (const [name, range] of Object.entries(entry)) {
+      if (typeof range !== "string") continue;
+      if (/^(file|link|workspace|git|github|https?|portal):/i.test(range)) continue;
+      if (range.includes("/") && !range.startsWith(">") && !range.startsWith("<")) continue;
+      deps[name] = range;
+    }
+  }
+  return Object.keys(deps).length > 0 ? { path, deps } : null;
+}
+async function fetchManifests(installationId, fullName, branch) {
+  let tree;
+  try {
+    tree = await installationGet(
+      installationId,
+      `/repos/${fullName}/git/trees/${encodeURIComponent(branch)}?recursive=1`
+    );
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 409) {
+      return { manifests: [], installCommand: detectInstallCommand([]), partial: false, empty: true };
+    }
+    throw err;
+  }
+  const nodes = tree.tree ?? [];
+  const allPaths = manifestPaths(nodes);
+  const lockfiles = nodes.filter((n) => !n.path.includes("/")).map((n) => n.path);
+  const paths = allPaths.slice(0, REPO_MANIFEST_CAP);
+  const manifests = [];
+  for (const path of paths) {
+    try {
+      const res = await installationGet(
+        installationId,
+        `/repos/${fullName}/contents/${path.split("/").map(encodeURIComponent).join("/")}?ref=${encodeURIComponent(branch)}`
+      );
+      if (!res.content || res.encoding !== "base64") continue;
+      const parsed = parseManifest(
+        path,
+        JSON.parse(Buffer.from(res.content, "base64").toString("utf8"))
+      );
+      if (parsed) manifests.push(parsed);
+    } catch (err) {
+      logger.debug(`manifest read failed for ${fullName}/${path}: ${err.message}`);
+    }
+  }
+  return {
+    manifests,
+    installCommand: detectInstallCommand(lockfiles),
+    partial: Boolean(tree.truncated) || allPaths.length > paths.length,
+    empty: false
+  };
+}
+
+export {
+  GithubAppError,
+  githubAppCredentials,
+  installationGet,
+  listInstallationRepos,
+  parseManifest,
+  fetchManifests
+};