lurqrun 0.1.6 → 0.1.7

package/dist/compat-R3UTFQ5Q.js

@@ -0,0 +1,201 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  getSandbox
+} from "./chunk-I2JUKN6Z.js";
+import "./chunk-C6GLE626.js";
+import "./chunk-GE37NVLN.js";
+import {
+  getStackResolution,
+  recordStackResolution,
+  resolveSet,
+  stackKey
+} from "./chunk-J5FZYN4A.js";
+import {
+  bumpCompatVerifyAttempt,
+  canonicalPair,
+  deleteCompatVerify,
+  getPendingCompatVerify,
+  pairKey,
+  upsertCompatEdge
+} from "./chunk-CW5HJ3LX.js";
+import {
+  getPackageByName,
+  getTopPackageNames
+} from "./chunk-NH5I4KHH.js";
+import "./chunk-VLRHFMGJ.js";
+import "./chunk-LYMPYETA.js";
+import "./chunk-GRJXQBQZ.js";
+import "./chunk-WHX2ZFCG.js";
+import {
+  logger
+} from "./chunk-MYGSLK44.js";
+import "./chunk-GPTKSNR6.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/pipeline/compat.ts
+init_esm_shims();
+function pairwiseEdges(resolved, success) {
+  const edges = [];
+  if (success) {
+    for (let i = 0; i < resolved.length; i++) {
+      for (let j = i + 1; j < resolved.length; j++) {
+        edges.push({
+          a: resolved[i].name,
+          aVersion: resolved[i].version,
+          b: resolved[j].name,
+          bVersion: resolved[j].version,
+          status: "compatible"
+        });
+      }
+    }
+  } else if (resolved.length === 2) {
+    edges.push({
+      a: resolved[0].name,
+      aVersion: resolved[0].version,
+      b: resolved[1].name,
+      bVersion: resolved[1].version,
+      status: "conflict"
+    });
+  }
+  return edges;
+}
+function deriveCompatEdges(resolved, result) {
+  return pairwiseEdges(resolved, result.installed && result.loaded.every((l) => l.loaded === true));
+}
+async function verifyCompatibility(db, packages, opts = {}) {
+  const resolved = await Promise.all(
+    packages.map(async (name) => ({
+      name,
+      version: (await getPackageByName(db, name))?.latestVersion ?? "latest"
+    }))
+  );
+  const result = await (await getSandbox()).verifySet(
+    resolved.map((r) => ({ name: r.name, version: r.version === "latest" ? null : r.version })),
+    { allowScripts: opts.allowScripts }
+  );
+  const edges = deriveCompatEdges(resolved, result);
+  await persistCompatEdges(db, edges, "verified", result.driver);
+  const failed = !result.installed || !result.loaded.every((l) => l.loaded === true);
+  return { result, edges, unattributedConflict: failed && edges.length === 0 };
+}
+async function persistCompatEdges(db, edges, compatibleProvenance, driver) {
+  const now = /* @__PURE__ */ new Date();
+  for (const e of edges) {
+    const pair = canonicalPair(
+      { name: e.a, version: e.aVersion },
+      { name: e.b, version: e.bVersion }
+    );
+    await upsertCompatEdge(db, {
+      ...pair,
+      status: e.status,
+      provenance: e.status === "conflict" ? "conflict" : compatibleProvenance,
+      // Witness accrues for co-resolution evidence (`observed`); ignored otherwise.
+      witnessCount: e.status === "compatible" && compatibleProvenance === "observed" ? 1 : 0,
+      driver,
+      ranAt: now
+    }).catch(() => {
+    });
+  }
+}
+async function resolveVerifyCompatibility(db, packages) {
+  const resolved = await Promise.all(
+    packages.map(async (name) => ({
+      name,
+      version: (await getPackageByName(db, name))?.latestVersion ?? "latest"
+    }))
+  );
+  const res = await resolveSet(
+    resolved.map((r) => ({ name: r.name, version: r.version === "latest" ? null : r.version }))
+  );
+  const pinned = resolved.filter((r) => r.version !== "latest");
+  if (pinned.length === resolved.length && pinned.length >= 2) {
+    await recordStackResolution(db, {
+      members: pinned.map((r) => ({ name: r.name, version: r.version })),
+      resolved: res.resolved,
+      reason: res.reason,
+      detail: res.detail ?? null
+    }).catch((err) => logger.warn(`compat: caching resolution failed: ${String(err)}`));
+  }
+  return { edges: pairwiseEdges(resolved, res.resolved), resolved: res.resolved };
+}
+async function alreadyResolved(db, names) {
+  const members = [];
+  for (const name of [...new Set(names)]) {
+    const version = (await getPackageByName(db, name))?.latestVersion;
+    if (!version) return false;
+    members.push({ name, version });
+  }
+  if (members.length < 2) return true;
+  return await getStackResolution(db, stackKey(members)).catch(() => null) !== null;
+}
+async function runBackfill(db, opts, runner, label) {
+  const topN = opts.topN ?? 50;
+  const batchSize = Math.max(2, opts.batchSize ?? 5);
+  const names = await getTopPackageNames(db, topN);
+  let verified = 0;
+  let batches = 0;
+  let skipped = 0;
+  for (let i = 0; i < names.length; i += batchSize) {
+    const batch = names.slice(i, i + batchSize);
+    if (batch.length < 2) continue;
+    if (await alreadyResolved(db, batch)) {
+      skipped++;
+      continue;
+    }
+    logger.info(`${label}: ${batch.join(", ")}`);
+    const { edges } = await runner(db, batch).catch((err) => {
+      logger.warn(`${label} batch failed (${batch.join(", ")}): ${String(err)}`);
+      return { edges: [] };
+    });
+    verified += edges.length;
+    batches++;
+  }
+  logger.info(`${label}: ${verified} edges across ${batches} runs, ${skipped} batches skipped`);
+  return { batches, verified, skipped };
+}
+async function backfillVerify(db, opts = {}) {
+  return runBackfill(db, opts, verifyCompatibility, "backfill(sandbox)");
+}
+async function resolveBackfill(db, opts = {}) {
+  return runBackfill(db, opts, resolveVerifyCompatibility, "backfill(resolve)");
+}
+var MAX_COMPAT_VERIFY_ATTEMPTS = 3;
+async function drainCompatVerifyQueue(db, opts = {}) {
+  const limit = Math.max(1, opts.limit ?? 10);
+  const pending = await getPendingCompatVerify(db, limit);
+  let verified = 0;
+  let dropped = 0;
+  for (const req of pending) {
+    const names = req.packages;
+    if (await alreadyResolved(db, names)) {
+      await deleteCompatVerify(db, req.id);
+      continue;
+    }
+    try {
+      const { edges } = await verifyCompatibility(db, names, {});
+      verified += edges.length;
+      await deleteCompatVerify(db, req.id);
+    } catch (err) {
+      logger.warn(`compat-verify drain failed for ${names.join(", ")}: ${String(err)}`);
+      const attempts = await bumpCompatVerifyAttempt(db, req.id);
+      if (attempts >= MAX_COMPAT_VERIFY_ATTEMPTS) {
+        await deleteCompatVerify(db, req.id);
+        dropped++;
+      }
+    }
+  }
+  logger.info(
+    `compat-verify(sandbox): ${verified} edge(s) from ${pending.length} queued set(s), ${dropped} dropped`
+  );
+  return { processed: pending.length, verified, dropped };
+}
+export {
+  backfillVerify,
+  deriveCompatEdges,
+  drainCompatVerifyQueue,
+  pairKey,
+  resolveBackfill,
+  verifyCompatibility
+};

package/dist/dashboardIssue-WYYMBFIB.js

@@ -0,0 +1,192 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/github/dashboardIssue.ts
+init_esm_shims();
+import { createHash } from "crypto";
+var DASHBOARD_MARKER = "<!-- lurq:dashboard -->";
+var DASHBOARD_LABEL = "lurq";
+var DASHBOARD_TITLE = "lurq dashboard";
+var MAX_ALERTED_KEYS = 200;
+var MAX_ROWS = 25;
+var sha = (s) => createHash("sha256").update(s).digest("hex");
+function md(s, max = 200) {
+  const flat = s.replace(/\s+/g, " ").trim();
+  const clipped = flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
+  return clipped.replace(/[\\`*_[\]<>|~]/g, (c) => `\\${c}`).replace(/@/g, "@\u200B").replace(/#(?=\d)/g, "#\u200B").replace(/:\/\//g, ":\u200B//");
+}
+var code = (s) => `\`${s.replace(/[`\r\n]/g, "").slice(0, 120)}\``;
+var RANK = { critical: 0, high: 1, moderate: 2, low: 3, info: 4 };
+function mcpSection(scan, urgent) {
+  const lines = ["### MCP servers", ""];
+  if (!scan.servers.length) return [...lines, "No MCP servers are committed to this repository.", ""];
+  lines.push("| Server | Status | Tools | Can modify | Findings |", "| --- | --- | --- | --- | --- |");
+  for (const s of scan.servers.slice(0, MAX_ROWS)) {
+    const f = s.analysis?.findings.filter((x) => RANK[x.severity] <= RANK.moderate) ?? [];
+    const worst = f.sort((a, b) => RANK[a.severity] - RANK[b.severity])[0]?.severity;
+    lines.push(
+      `| ${code(s.alias)} | ${s.status.replace(/_/g, " ")} | ${s.analysis?.stats.tools ?? "\u2014"} | ${s.analysis?.stats.writes ?? "\u2014"} | ${f.length ? `${f.length}${worst ? ` (worst ${worst})` : ""}` : "\u2014"} |`
+    );
+  }
+  lines.push("");
+  const account = new Map((scan.account?.results ?? []).filter((r) => r.since).map((r) => [r.alias, r.since]));
+  const changes = scan.servers.flatMap((s) => {
+    const acc = account.get(s.alias);
+    if (acc) return [{ alias: s.alias, key: s.serverKey, severity: acc.severity, summary: acc.summary, rug: acc.rugPull.length > 0 }];
+    const d = s.sinceLastScan;
+    return d && !d.unchanged ? [{ alias: s.alias, key: s.serverKey, severity: d.severity, summary: d.summary, rug: d.rugPull.length > 0 || d.contract.annotationFlips.some((x) => x.widensPrivilege) }] : [];
+  });
+  if (changes.length) {
+    lines.push("**Changed since the last scan**", "");
+    for (const c of changes.sort((a, b) => RANK[a.severity] - RANK[b.severity])) {
+      const line = `- **${c.severity}** ${code(c.alias)}: ${md(c.summary, 300)}`;
+      lines.push(line);
+      if (c.rug || c.severity === "critical") urgent.push({ key: sha(`change|${c.key}|${c.summary}`).slice(0, 16), line });
+    }
+    lines.push("");
+  }
+  const findings = scan.servers.flatMap((s) => (s.analysis?.findings ?? []).map((f) => ({ ...f, alias: s.alias, serverKey: s.serverKey }))).concat(scan.findings.map((f) => ({ ...f, alias: f.server ?? "stack", serverKey: `stack:${f.server ?? ""}` }))).filter((f) => RANK[f.severity] <= RANK.high).sort((a, b) => RANK[a.severity] - RANK[b.severity]);
+  if (findings.length) {
+    lines.push("**Needs attention**", "");
+    for (const f of findings.slice(0, MAX_ROWS)) {
+      const line = `- **${f.severity}** ${code(f.alias)}${f.tool ? ` \u203A ${code(f.tool)}` : ""}: ${md(f.detail, 240)}`;
+      lines.push(line);
+      if (f.severity === "critical") urgent.push({ key: sha(`finding|${f.serverKey}|${f.kind}|${f.tool}|${f.where}|${f.evidence}`).slice(0, 16), line });
+    }
+    lines.push("");
+  }
+  const unread = scan.servers.filter((s) => !s.snapshot);
+  if (unread.length) {
+    lines.push(`<details><summary>${unread.length} server(s) could not be read</summary>`, "");
+    for (const s of unread.slice(0, MAX_ROWS)) lines.push(`- ${code(s.alias)}: ${s.status.replace(/_/g, " ")}${s.error ? `, ${md(s.error, 160)}` : ""}`);
+    lines.push("", "</details>", "");
+  }
+  return lines;
+}
+function dependencySection(plan, note) {
+  const lines = ["### Dependencies", ""];
+  if (!plan) return [...lines, note ?? "Not checked on this run.", ""];
+  if (!plan.upgrades.length) {
+    return [...lines, `Everything lurq tracks is on its latest release${plan.untracked ? ` (${plan.untracked} not yet indexed)` : ""}.`, ""];
+  }
+  lines.push("| Package | Upgrade | What it removes | Advisories |", "| --- | --- | --- | --- |");
+  const order = { "removes-exports": 0, "arity-changed": 1, unknown: 2, clean: 3 };
+  for (const u of [...plan.upgrades].sort((a, b) => order[a.verdict] - order[b.verdict] || b.advisories - a.advisories).slice(0, MAX_ROWS)) {
+    const removes = u.verdict === "removes-exports" ? `${u.removed.length} export(s)` : u.verdict === "arity-changed" ? "changed signatures" : u.verdict === "clean" ? "nothing" : "unknown";
+    lines.push(`| ${code(u.package)} | ${md(u.fromVersion, 40)} \u2192 ${md(u.toVersion, 40)}${u.majorsBehind ? ` (${u.majorsBehind} major)` : ""} | ${removes} | ${u.advisories || "\u2014"} |`);
+  }
+  if (plan.upgrades.length > MAX_ROWS) lines.push("", `and ${plan.upgrades.length - MAX_ROWS} more.`);
+  if (plan.untracked) lines.push("", `${plan.untracked} dependencies are not indexed yet, so they are not covered here.`);
+  lines.push("");
+  return lines;
+}
+function renderDashboardIssue(input) {
+  const urgent = [];
+  const content = [
+    ...input.scan ? mcpSection(input.scan, urgent) : ["### MCP servers", "", "Not scanned on this run.", ""],
+    ...dependencySection(input.plan, input.planNote)
+  ].join("\n");
+  const stamp = `Updated ${input.generatedAt.toISOString().slice(0, 16).replace("T", " ")} UTC${input.runUrl ? ` by [this run](${input.runUrl})` : ""}.`;
+  const body = [
+    DASHBOARD_MARKER,
+    `## ${DASHBOARD_TITLE}`,
+    "",
+    `${stamp} This issue is edited in place; lurq comments only when something needs a look today. [Open the dashboard](${input.dashboardUrl}).`,
+    "",
+    content,
+    "<sub>Close this issue to stop lurq updating it. Remove `--github-issue` from the workflow to stop creating it.</sub>"
+  ].join("\n");
+  return { title: DASHBOARD_TITLE, body, hash: sha(content).slice(0, 24), urgent };
+}
+var HASH_RE = /<!-- lurq:hash:([0-9a-f]+) -->/;
+var ALERTED_RE = /<!-- lurq:alerted:([A-Za-z0-9,]*) -->/;
+function readMarkers(body) {
+  return {
+    hash: HASH_RE.exec(body)?.[1] ?? null,
+    alerted: (ALERTED_RE.exec(body)?.[1] ?? "").split(",").filter(Boolean)
+  };
+}
+function withMarkers(body, hash, alerted) {
+  const keys = alerted.slice(-MAX_ALERTED_KEYS).join(",");
+  return body.replace(DASHBOARD_MARKER, `${DASHBOARD_MARKER}
+<!-- lurq:hash:${hash} -->
+<!-- lurq:alerted:${keys} -->`);
+}
+var GithubIssueError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "GithubIssueError";
+  }
+  status;
+};
+function githubEnvFrom(env) {
+  const token = env.GITHUB_TOKEN;
+  const repo = env.GITHUB_REPOSITORY;
+  if (!token || !repo || !/^[\w.-]+\/[\w.-]+$/.test(repo)) return null;
+  return { token, repo, apiUrl: (env.GITHUB_API_URL ?? "https://api.github.com").replace(/\/$/, "") };
+}
+async function gh(env, method, path, body) {
+  const res = await (env.fetchImpl ?? fetch)(`${env.apiUrl}${path}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${env.token}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "lurq",
+      ...body ? { "Content-Type": "application/json" } : {}
+    },
+    body: body ? JSON.stringify(body) : void 0
+  });
+  const data = await res.json().catch(() => null);
+  if (!res.ok && !(method === "POST" && path.endsWith("/labels") && res.status === 422)) {
+    const message = data?.message ?? `HTTP ${res.status}`;
+    throw new GithubIssueError(
+      res.status === 403 || res.status === 404 ? `GitHub refused (${message}); the workflow needs \`permissions: issues: write\`` : `GitHub ${res.status}: ${message}`,
+      res.status
+    );
+  }
+  return { status: res.status, data };
+}
+async function upsertDashboardIssue(env, rendered) {
+  const { data: issues } = await gh(env, "GET", `/repos/${env.repo}/issues?labels=${DASHBOARD_LABEL}&state=all&per_page=100`);
+  const mine = (issues ?? []).filter((i) => !i.pull_request && (i.body ?? "").includes(DASHBOARD_MARKER));
+  const open = mine.find((i) => i.state === "open");
+  if (!open) {
+    if (mine.length) return { action: "closed", url: mine[0].html_url, commented: 0 };
+    await gh(env, "POST", `/repos/${env.repo}/labels`, { name: DASHBOARD_LABEL, color: "6e40c9", description: "lurq dependency and MCP dashboard" });
+    const { data } = await gh(env, "POST", `/repos/${env.repo}/issues`, {
+      title: rendered.title,
+      body: withMarkers(rendered.body, rendered.hash, rendered.urgent.map((u) => u.key)),
+      labels: [DASHBOARD_LABEL]
+    });
+    return { action: "created", url: data.html_url, commented: 0 };
+  }
+  const markers = readMarkers(open.body ?? "");
+  const fresh = rendered.urgent.filter((u) => !markers.alerted.includes(u.key));
+  if (markers.hash === rendered.hash && !fresh.length) return { action: "unchanged", url: open.html_url, commented: 0 };
+  await gh(env, "PATCH", `/repos/${env.repo}/issues/${open.number}`, {
+    body: withMarkers(rendered.body, rendered.hash, [...markers.alerted, ...fresh.map((u) => u.key)])
+  });
+  if (fresh.length) {
+    await gh(env, "POST", `/repos/${env.repo}/issues/${open.number}/comments`, {
+      body: [`lurq found ${fresh.length === 1 ? "something" : `${fresh.length} things`} that need a look today:`, "", ...fresh.map((u) => u.line)].join("\n")
+    });
+  }
+  return { action: "updated", url: open.html_url, commented: fresh.length ? 1 : 0 };
+}
+export {
+  DASHBOARD_LABEL,
+  DASHBOARD_MARKER,
+  DASHBOARD_TITLE,
+  GithubIssueError,
+  code,
+  githubEnvFrom,
+  md,
+  readMarkers,
+  renderDashboardIssue,
+  upsertDashboardIssue,
+  withMarkers
+};

package/dist/diff-GZA2774U.js

@@ -0,0 +1,13 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  checkApi,
+  diffApiSurfaces,
+  formatApiCheck
+} from "./chunk-CIDWNUAP.js";
+import "./chunk-3GHJR7XR.js";
+import "./chunk-I3M2KJXB.js";
+export {
+  checkApi,
+  diffApiSurfaces,
+  formatApiCheck
+};