lurqrun 0.1.6 → 0.1.7

package/dist/chunk-LO35HLQZ.js

@@ -0,0 +1,219 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  UNBOUNDED_ARITY,
+  claims,
+  entities,
+  observations,
+  packages,
+  surfaceQueue,
+  symbols
+} from "./chunk-LYMPYETA.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/db/surface.ts
+init_esm_shims();
+import { and as and2, desc, eq as eq2, isNotNull, isNull as isNull2, sql } from "drizzle-orm";
+
+// src/db/graph.ts
+init_esm_shims();
+import { and, eq, isNull } from "drizzle-orm";
+import { createHash } from "crypto";
+
+// src/graph/types.ts
+init_esm_shims();
+function canonicalKey(ref) {
+  return `${ref.kind}:${ref.namespace}:${ref.name}:${ref.version ?? ""}`;
+}
+
+// src/db/graph.ts
+async function upsertEntity(db, ref, tenantId = 0) {
+  const key = canonicalKey(ref);
+  const [row] = await db.insert(entities).values({
+    kind: ref.kind,
+    namespace: ref.namespace,
+    name: ref.name,
+    version: ref.version ?? null,
+    canonicalKey: key,
+    tenantId
+  }).onConflictDoUpdate({
+    target: [entities.canonicalKey, entities.tenantId],
+    set: { canonicalKey: key }
+  }).returning();
+  return row;
+}
+async function upsertClaim(db, args) {
+  const objectId = args.objectId ?? null;
+  const envId = args.environmentId ?? null;
+  const tenantId = args.tenantId ?? 0;
+  const existing = await db.select().from(claims).where(
+    and(
+      eq(claims.subjectId, args.subjectId),
+      objectId === null ? isNull(claims.objectId) : eq(claims.objectId, objectId),
+      eq(claims.relation, args.relation),
+      envId === null ? isNull(claims.environmentId) : eq(claims.environmentId, envId),
+      eq(claims.tenantId, tenantId)
+    )
+  ).limit(1);
+  if (existing[0]) return existing[0];
+  const [row] = await db.insert(claims).values({ subjectId: args.subjectId, objectId, relation: args.relation, environmentId: envId, tenantId }).returning();
+  return row;
+}
+async function recordObservation(db, args) {
+  await db.insert(observations).values({
+    claimId: args.claimId,
+    verdict: args.verdict,
+    class: args.class ?? "executed",
+    tier: args.tier ?? null,
+    evidence: args.evidence ?? null,
+    oracleId: args.oracleId,
+    oracleVer: args.oracleVer,
+    costMillis: args.costMillis ?? null
+  });
+}
+
+// src/db/surface.ts
+function surfaceRef(pkg, version) {
+  return { kind: "package_surface", namespace: "npm", name: pkg, version };
+}
+function mcpSurfaceRef(server, version) {
+  return { kind: "mcp_server", namespace: "npm", name: server, version };
+}
+async function isExtractionCached(db, ref, artifactHash, extractorVersion, tier = "shipped_js_ast", tenantId = 0) {
+  const row = await upsertEntity(db, ref, tenantId);
+  if (row.artifactHash !== artifactHash) return false;
+  const existing = await db.select({ id: symbols.id }).from(symbols).where(and2(eq2(symbols.entityId, row.id), eq2(symbols.tier, tier))).limit(1);
+  if (existing.length === 0) return false;
+  const seen = await db.select({ oracleVer: observations.oracleVer }).from(observations).innerJoin(claims, eq2(claims.id, observations.claimId)).where(
+    and2(
+      eq2(claims.subjectId, row.id),
+      eq2(claims.relation, "exposes"),
+      eq2(observations.tier, tier)
+    )
+  ).orderBy(desc(observations.observedAt)).limit(1);
+  return seen[0]?.oracleVer === extractorVersion;
+}
+async function storeSurface(db, surface, opts = {
+  extractorVersion: "1"
+}) {
+  const tenantId = opts.tenantId ?? 0;
+  const ref = opts.ref ?? surfaceRef(surface.package, surface.version);
+  const entity = await upsertEntity(db, ref, tenantId);
+  if (opts.artifactHash) {
+    await db.update(entities).set({ artifactHash: opts.artifactHash }).where(eq2(entities.id, entity.id));
+  }
+  const claim = await upsertClaim(db, {
+    subjectId: entity.id,
+    relation: "exposes",
+    // Declared claims are environment-independent: a shipped-JS surface reads
+    // identically on every machine, so no fingerprint is attached (§5).
+    environmentId: null,
+    tenantId
+  });
+  const undeclared = surface.symbols.length === 0;
+  await recordObservation(db, {
+    claimId: claim.id,
+    verdict: undeclared ? "undeclared" : "verified_true",
+    class: "declared",
+    tier: surface.tier,
+    evidence: undeclared ? surface.undeclaredReason ?? "no symbols extracted" : `${surface.symbols.length} symbols from ${surface.filesWalked} file(s), entry ${surface.entry}`,
+    oracleId: opts.oracleId ?? "surface.tier_a",
+    oracleVer: opts.extractorVersion
+  });
+  if (undeclared) return { entityId: entity.id, symbolsWritten: 0, verdict: "undeclared" };
+  await db.delete(symbols).where(and2(eq2(symbols.entityId, entity.id), eq2(symbols.tier, surface.tier)));
+  const rows = surface.symbols.map((s) => ({
+    entityId: entity.id,
+    path: s.path,
+    kind: s.kind,
+    arity: s.arity,
+    origin: s.origin,
+    deprecated: s.deprecated,
+    tier: s.tier,
+    signature: s.signature ?? null,
+    sourceFile: s.sourceRef?.file ?? null,
+    sourceLine: s.sourceRef?.line ?? null,
+    sourceOffset: s.sourceRef?.offset ?? null,
+    maxArity: s.maxArity === void 0 ? null : s.maxArity ?? UNBOUNDED_ARITY
+  }));
+  for (let i = 0; i < rows.length; i += 500) {
+    await db.insert(symbols).values(rows.slice(i, i + 500)).onConflictDoNothing();
+  }
+  return { entityId: entity.id, symbolsWritten: rows.length, verdict: "verified_true" };
+}
+function specKey(pkg, version, kind = "package_surface") {
+  const base = `${pkg}@${version ?? "latest"}`;
+  return kind === "package_surface" ? base : `${kind}:${base}`;
+}
+async function getPackagesMissingGraphSurface(db, limit, opts = {}) {
+  const order = opts.byDownloads ? sql`${packages.weeklyDownloads} desc nulls last` : sql`random()`;
+  const rows = await db.select({ name: packages.name, version: packages.latestVersion }).from(packages).leftJoin(
+    entities,
+    and2(
+      eq2(entities.kind, "package_surface"),
+      eq2(entities.name, packages.name),
+      eq2(entities.version, packages.latestVersion)
+    )
+  ).where(and2(isNotNull(packages.latestVersion), isNull2(entities.id))).orderBy(order).limit(limit);
+  return rows.filter((r) => r.version !== null);
+}
+async function enqueueSurface(db, pkg, version, kind = "package_surface") {
+  await db.insert(surfaceQueue).values({ packageName: pkg, version, kind, specKey: specKey(pkg, version, kind) }).onConflictDoNothing();
+}
+async function getPendingSurfaces(db, limit = 10, kind = "package_surface") {
+  return db.select().from(surfaceQueue).where(eq2(surfaceQueue.kind, kind)).orderBy(surfaceQueue.requestedAt).limit(limit);
+}
+async function dropSurfaceQueue(db, id) {
+  await db.delete(surfaceQueue).where(eq2(surfaceQueue.id, id));
+}
+async function bumpSurfaceAttempt(db, id) {
+  await db.update(surfaceQueue).set({ attempts: sql`${surfaceQueue.attempts} + 1` }).where(eq2(surfaceQueue.id, id));
+}
+async function hasStoredSurface(db, pkg, version, tier = "shipped_js_ast", tenantId = 0, kind = "package_surface") {
+  const key = canonicalKey(
+    kind === "mcp_server" ? mcpSurfaceRef(pkg, version) : surfaceRef(pkg, version)
+  );
+  const [row] = await db.select({ id: entities.id }).from(entities).where(and2(eq2(entities.canonicalKey, key), eq2(entities.tenantId, tenantId))).limit(1);
+  if (!row) return false;
+  const [sym] = await db.select({ id: symbols.id }).from(symbols).where(and2(eq2(symbols.entityId, row.id), eq2(symbols.tier, tier))).limit(1);
+  return sym !== void 0;
+}
+async function enqueuePreviousSurface(db, pkg, version, history, kind = "package_surface") {
+  const previous = previousVersion(history, version);
+  if (previous === null) return false;
+  const tier = kind === "mcp_server" ? "mcp_tools_list" : "shipped_js_ast";
+  if (await hasStoredSurface(db, pkg, previous, tier, 0, kind)) return false;
+  await enqueueSurface(db, pkg, previous, kind);
+  return true;
+}
+function previousVersion(history, version) {
+  const idx = history.findIndex((h) => h.version === version);
+  if (idx === -1 || idx + 1 >= history.length) return null;
+  return history[idx + 1].version ?? null;
+}
+async function getMcpServerNames(db, tenantId = 0) {
+  const rows = await db.selectDistinct({ name: entities.name }).from(entities).where(and2(eq2(entities.kind, "mcp_server"), eq2(entities.tenantId, tenantId)));
+  return rows.map((r) => r.name);
+}
+
+export {
+  canonicalKey,
+  upsertEntity,
+  upsertClaim,
+  recordObservation,
+  surfaceRef,
+  mcpSurfaceRef,
+  isExtractionCached,
+  storeSurface,
+  specKey,
+  getPackagesMissingGraphSurface,
+  enqueueSurface,
+  getPendingSurfaces,
+  dropSurfaceQueue,
+  bumpSurfaceAttempt,
+  hasStoredSurface,
+  enqueuePreviousSurface,
+  previousVersion,
+  getMcpServerNames
+};

package/dist/chunk-LRD4GBYE.js

@@ -0,0 +1,73 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  httpRequest
+} from "./chunk-SJOVFF7B.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/ingestion/sources/osv.ts
+init_esm_shims();
+var HOST = "api.osv.dev";
+var URL = `https://${HOST}/v1/querybatch`;
+var BATCH = 250;
+var CONCURRENCY = 4;
+function installKey(name, version) {
+  return `${name}@${version}`;
+}
+async function queryVulnerableInstalls(installs, fetchImpl) {
+  const affected = /* @__PURE__ */ new Map();
+  if (installs.length === 0) return { affected, complete: true };
+  const unique = [...new Map(installs.map((i) => [installKey(i.name, i.version), i])).values()];
+  const batches = [];
+  for (let i = 0; i < unique.length; i += BATCH) batches.push(unique.slice(i, i + BATCH));
+  let complete = true;
+  let cursor = 0;
+  const worker = async () => {
+    for (let i = cursor++; i < batches.length; i = cursor++) {
+      const batch = batches[i];
+      try {
+        const { data } = await httpRequest(URL, {
+          host: HOST,
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            queries: batch.map((q) => ({
+              version: q.version,
+              package: { name: q.name, ecosystem: "npm" }
+            }))
+          }),
+          // Uncached on purpose. The shared cache keys on the URL, and every
+          // batch here posts to the same one with a different body — a cache hit
+          // would answer one tree's question with another tree's vulnerabilities.
+          ttlMs: 0,
+          // Best-effort by contract: the caller keeps its coarser answer when
+          // this fails, so exhausting the default retry ladder would only stall
+          // a scheduled scan behind an outage nobody is waiting on.
+          retries: 1,
+          fetchImpl
+        });
+        const results = data?.results ?? [];
+        if (results.length !== batch.length) {
+          complete = false;
+          continue;
+        }
+        results.forEach((result, j) => {
+          const ids = (result?.vulns ?? []).map((v) => v?.id).filter((id) => typeof id === "string");
+          if (ids.length === 0) return;
+          const q = batch[j];
+          affected.set(installKey(q.name, q.version), ids);
+        });
+      } catch {
+        complete = false;
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(CONCURRENCY, batches.length) }, worker));
+  return { affected, complete };
+}
+
+export {
+  installKey,
+  queryVulnerableInstalls
+};

package/dist/chunk-LUAKDHLZ.js

@@ -0,0 +1,40 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/core/paths.ts
+init_esm_shims();
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+var cachedRoot;
+function packageRoot() {
+  if (cachedRoot) return cachedRoot;
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (; ; ) {
+    if (existsSync(join(dir, "package.json"))) {
+      cachedRoot = dir;
+      return dir;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  cachedRoot = process.cwd();
+  return cachedRoot;
+}
+function userWeightsPath() {
+  const base = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+  return join(base, "lurq", "weights.json");
+}
+function projectWeightsPath() {
+  return join(process.cwd(), ".lurq", "weights.json");
+}
+
+export {
+  packageRoot,
+  userWeightsPath,
+  projectWeightsPath
+};