lurqrun 0.1.6 → 0.1.7

package/dist/upgradePlan-A4LRKLEG.js

@@ -0,0 +1,146 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  parseManifest
+} from "./chunk-DWAGCNEL.js";
+import "./chunk-B43LCXBM.js";
+import "./chunk-BCANRN5B.js";
+import "./chunk-SJOVFF7B.js";
+import "./chunk-GRJXQBQZ.js";
+import "./chunk-WHX2ZFCG.js";
+import {
+  fetchUpgradePlan
+} from "./chunk-4ZYCIMY4.js";
+import "./chunk-MYGSLK44.js";
+import "./chunk-Y5GI7RL3.js";
+import "./chunk-GPTKSNR6.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/cli/upgradePlan.ts
+init_esm_shims();
+import { readFileSync, readdirSync, statSync } from "fs";
+import { join, relative } from "path";
+var SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "coverage", "vendor"]);
+var MAX_MANIFESTS = 25;
+var MAX_DEPTH = 4;
+function findManifests(dir, maxDepth = MAX_DEPTH) {
+  const found = [];
+  const walk = (current, depth) => {
+    if (found.length >= MAX_MANIFESTS || depth > maxDepth) return;
+    let entries;
+    try {
+      entries = readdirSync(current);
+    } catch {
+      return;
+    }
+    if (entries.includes("package.json")) found.push(join(current, "package.json"));
+    for (const entry of entries) {
+      if (SKIP.has(entry) || entry.startsWith(".")) continue;
+      const child = join(current, entry);
+      try {
+        if (statSync(child).isDirectory()) walk(child, depth + 1);
+      } catch {
+      }
+    }
+  };
+  walk(dir, 0);
+  return found;
+}
+function readManifests(dir) {
+  const out = [];
+  for (const file of findManifests(dir)) {
+    try {
+      const parsed = parseManifest(
+        relative(dir, file) || "package.json",
+        JSON.parse(readFileSync(file, "utf8"))
+      );
+      if (parsed) out.push(parsed);
+    } catch {
+    }
+  }
+  return out;
+}
+function mergedDeps(manifests) {
+  const out = {};
+  for (const manifest of manifests) {
+    for (const [name, range] of Object.entries(manifest.deps)) {
+      out[name] ??= range;
+    }
+  }
+  return out;
+}
+function detectRepoFullName(explicit) {
+  const value = explicit ?? process.env.GITHUB_REPOSITORY ?? null;
+  return value && /^[\w.-]+\/[\w.-]+$/.test(value) ? value : null;
+}
+async function buildUpgradePlan(dir, opts = {}) {
+  const manifests = readManifests(dir);
+  const deps = mergedDeps(manifests);
+  if (Object.keys(deps).length === 0) {
+    throw new Error(`No package.json with dependencies found under ${dir}`);
+  }
+  const plan = await fetchUpgradePlan(deps, { ...opts, repo: detectRepoFullName(opts.repo) });
+  return { ...plan, manifests: manifests.length, deps: Object.keys(deps).length };
+}
+var VERDICT_LABEL = {
+  "removes-exports": "REMOVES ",
+  "arity-changed": "ARITY   ",
+  clean: "CLEAN   ",
+  unknown: "UNKNOWN "
+};
+function formatUpgradePlan(plan) {
+  const out = [
+    `lurq upgrade plan (${plan.deps} dependencies across ${plan.manifests} manifest(s))`
+  ];
+  if (plan.scopeSource === "repo-policy") {
+    out.push(
+      `policy: scope=${plan.scope}` + (plan.outOfScope ? `, ${plan.outOfScope} upgrade(s) held back` : ", nothing held back")
+    );
+  }
+  out.push("");
+  if (plan.upgrades.length === 0) {
+    out.push("Everything lurq tracks is already on its latest release.");
+  }
+  for (const upgrade of plan.upgrades) {
+    const held = upgrade.inScope === false ? "  [HELD]" : "";
+    out.push(
+      `${VERDICT_LABEL[upgrade.verdict]}  ${upgrade.package}  ${upgrade.fromVersion} \u2192 ${upgrade.toVersion}` + (upgrade.advisories ? `  (${upgrade.advisories} advisory)` : "") + held
+    );
+    if (upgrade.scopeReason) out.push(`  held: ${upgrade.scopeReason}`);
+    if (upgrade.removed.length) {
+      const renamed = new Map((upgrade.renamed ?? []).map((r) => [r.path, r.to]));
+      const label = (path) => renamed.has(path) ? `${path} \u2192 ${renamed.get(path).join(" | ")}` : path;
+      out.push(`  removes ${upgrade.removed.length}: ${upgrade.removed.slice(0, 8).map(label).join(", ")}`);
+    }
+    for (const change of upgrade.arityChanged.slice(0, 5)) {
+      out.push(`  arity ${change.path}: ${change.from ?? "?"} \u2192 ${change.to ?? "?"}`);
+    }
+    if (upgrade.hops?.length) {
+      out.push(`  via ${[upgrade.fromVersion, ...upgrade.hops.map((h) => h.toVersion)].join(" \u2192 ")}`);
+      for (const hop of upgrade.hops) {
+        const detail = hop.removed.length ? `removes ${hop.removed.slice(0, 5).join(", ")}` : hop.verdict === "unknown" ? "not yet analysed" : "no removals";
+        out.push(`    ${hop.fromVersion} \u2192 ${hop.toVersion}: ${detail}`);
+      }
+    }
+    if (upgrade.sequenceNote) out.push(`  ${upgrade.sequenceNote}`);
+    if (upgrade.declaredIn?.length > 1) {
+      out.push(`  declared in ${upgrade.declaredIn.map((d) => d.path).join(", ")}`);
+    }
+    if (upgrade.inconclusive) out.push(`  ${upgrade.inconclusive}`);
+  }
+  const caveats = [];
+  if (plan.untracked > 0) caveats.push(`${plan.untracked} dependency(ies) not in the lurq index`);
+  if (plan.omitted > 0) caveats.push(`${plan.omitted} further upgrade(s) not shown`);
+  if (plan.pending > 0) caveats.push(`${plan.pending} awaiting surface extraction`);
+  if (caveats.length) out.push("", `NOT COVERED: ${caveats.join("; ")}.`);
+  return out.join("\n");
+}
+export {
+  buildUpgradePlan,
+  detectRepoFullName,
+  findManifests,
+  formatUpgradePlan,
+  mergedDeps,
+  readManifests
+};

package/dist/userConfig-Z3GQE776.js

@@ -0,0 +1,20 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  clearUserConfig,
+  lurqHome,
+  readUserConfig,
+  resolveApiKey,
+  resolveEndpoint,
+  userConfigPath,
+  writeUserConfig
+} from "./chunk-Y5GI7RL3.js";
+import "./chunk-I3M2KJXB.js";
+export {
+  clearUserConfig,
+  lurqHome,
+  readUserConfig,
+  resolveApiKey,
+  resolveEndpoint,
+  userConfigPath,
+  writeUserConfig
+};

package/dist/watch-DGFMWUDL.js

@@ -0,0 +1,214 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  enqueueSurface,
+  getMcpServerNames
+} from "./chunk-LO35HLQZ.js";
+import {
+  syncOnePackage
+} from "./chunk-FW6BD2NO.js";
+import "./chunk-BUALU27S.js";
+import "./chunk-LRD4GBYE.js";
+import "./chunk-BCANRN5B.js";
+import "./chunk-2VMOWSRY.js";
+import "./chunk-4ESO33J6.js";
+import "./chunk-CW5HJ3LX.js";
+import "./chunk-AHBP533R.js";
+import "./chunk-SJOVFF7B.js";
+import "./chunk-HWBBVLOT.js";
+import {
+  getAllPackageNames
+} from "./chunk-NH5I4KHH.js";
+import "./chunk-VLRHFMGJ.js";
+import "./chunk-WQ23REYT.js";
+import {
+  discoveryQueue,
+  watchState
+} from "./chunk-LYMPYETA.js";
+import "./chunk-3GHJR7XR.js";
+import "./chunk-GRJXQBQZ.js";
+import "./chunk-WHX2ZFCG.js";
+import "./chunk-LUAKDHLZ.js";
+import {
+  logger
+} from "./chunk-MYGSLK44.js";
+import "./chunk-GPTKSNR6.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/pipeline/watch.ts
+init_esm_shims();
+
+// src/db/discovery.ts
+init_esm_shims();
+import { eq, sql } from "drizzle-orm";
+async function getQueuedNames(db) {
+  const rows = await db.select({ name: discoveryQueue.name }).from(discoveryQueue);
+  return new Set(rows.map((r) => r.name));
+}
+async function enqueueCandidates(db, candidates) {
+  if (candidates.length === 0) return 0;
+  const rows = candidates.map((c) => ({ name: c.name, discoveredVia: c.via }));
+  const inserted = await db.insert(discoveryQueue).values(rows).onConflictDoNothing({ target: discoveryQueue.name }).returning({ id: discoveryQueue.id });
+  return inserted.length;
+}
+
+// src/db/watch.ts
+init_esm_shims();
+import { eq as eq2 } from "drizzle-orm";
+async function getWatchCursor(db, id) {
+  const rows = await db.select({ seq: watchState.seq }).from(watchState).where(eq2(watchState.id, id)).limit(1);
+  return rows[0]?.seq ?? null;
+}
+async function setWatchCursor(db, id, seq) {
+  await db.insert(watchState).values({ id, seq, updatedAt: /* @__PURE__ */ new Date() }).onConflictDoUpdate({ target: watchState.id, set: { seq, updatedAt: /* @__PURE__ */ new Date() } });
+}
+
+// src/pipeline/watch.ts
+var FEED_ID = "npm-changes";
+var FEED_URL = "https://replicate.npmjs.com/_changes";
+var PAGE_SIZE = 1e3;
+var IDLE_POLL_MS = 3e4;
+var TRACKED_REFRESH_MS = 5 * 6e4;
+var MAX_BACKOFF_MS = 3e4;
+var ENQUEUE_BATCH = 200;
+function parseChange(obj) {
+  if (typeof obj !== "object" || obj === null) return null;
+  const rec = obj;
+  if (typeof rec.id !== "string" || rec.seq == null) return null;
+  if (typeof rec.seq !== "number" && typeof rec.seq !== "string") return null;
+  return { seq: rec.seq, id: rec.id, deleted: Boolean(rec.deleted) };
+}
+function parseChangesPage(body) {
+  if (typeof body !== "object" || body === null) return { changes: [], lastSeq: null };
+  const { results, last_seq: lastSeq } = body;
+  const changes = Array.isArray(results) ? results.map(parseChange).filter((c) => c !== null) : [];
+  return {
+    changes,
+    lastSeq: typeof lastSeq === "number" || typeof lastSeq === "string" ? String(lastSeq) : null
+  };
+}
+function routeChange(change, tracked, queued) {
+  if (change.deleted) return "skip";
+  if (tracked.has(change.id)) return "resync";
+  if (queued.has(change.id)) return "skip";
+  return "enqueue";
+}
+async function getJson(url, fetchImpl, signal) {
+  const res = await fetchImpl(url, { signal });
+  if (!res.ok) throw new Error(`feed responded ${res.status}`);
+  return res.json();
+}
+async function fetchHeadSeq(fetchImpl = fetch, signal) {
+  const body = await getJson(`${FEED_URL}?descending=true&limit=1`, fetchImpl, signal);
+  return parseChangesPage(body).lastSeq;
+}
+async function loadSeenSets(db) {
+  const [tracked, queued, mcp] = await Promise.all([
+    getAllPackageNames(db),
+    getQueuedNames(db),
+    // Derived from what has actually been probed, so the roster grows with real
+    // demand instead of with a curated list somebody has to maintain. Failure
+    // is non-fatal: the npm half of the loop must keep running regardless.
+    getMcpServerNames(db).catch(() => [])
+  ]);
+  return [new Set(tracked), queued, new Set(mcp)];
+}
+async function watchNpmChanges(db, opts = {}) {
+  const { signal, fetchImpl = fetch } = opts;
+  let backoff = 1e3;
+  let [tracked, queued, mcpServers] = await loadSeenSets(db);
+  let seenAt = Date.now();
+  let cursor = await getWatchCursor(db, FEED_ID) ?? opts.since ?? await fetchHeadSeq(fetchImpl, signal).catch(() => null);
+  if (cursor == null) {
+    logger.warn("watch: could not establish a starting sequence; giving up.");
+    return;
+  }
+  logger.info(
+    `watch: following from seq=${cursor} (${tracked.size} tracked, ${queued.size} queued, ${mcpServers.size} mcp)`
+  );
+  while (!signal?.aborted) {
+    try {
+      const url = `${FEED_URL}?since=${encodeURIComponent(cursor)}&limit=${PAGE_SIZE}`;
+      const { changes, lastSeq } = parseChangesPage(await getJson(url, fetchImpl, signal));
+      backoff = 1e3;
+      if (Date.now() - seenAt > TRACKED_REFRESH_MS) {
+        [tracked, queued, mcpServers] = await loadSeenSets(db);
+        seenAt = Date.now();
+      }
+      const buffered = [];
+      const flush = async () => {
+        if (buffered.length === 0) return;
+        const batch = buffered.map((name) => ({ name, via: "npm-changes" }));
+        const inserted = await enqueueCandidates(db, batch).catch((err) => {
+          logger.warn(`watch: enqueue of ${batch.length} candidate(s) failed: ${String(err)}`);
+          return 0;
+        });
+        if (inserted > 0) logger.info(`watch: queued ${inserted} new discovery candidate(s)`);
+        buffered.length = 0;
+      };
+      let resynced = 0;
+      let mcpQueued = 0;
+      for (const change of changes) {
+        if (signal?.aborted) break;
+        const route = routeChange(change, tracked, queued);
+        if (route === "resync") {
+          await syncOnePackage(db, change.id).catch(
+            (err) => logger.warn(`watch: re-sync failed for ${change.id}: ${String(err)}`)
+          );
+          resynced++;
+          await enqueueSurface(db, change.id, null).catch(
+            (err) => logger.warn(`watch: surface enqueue failed for ${change.id}: ${String(err)}`)
+          );
+          if (mcpServers.has(change.id)) {
+            await enqueueSurface(db, change.id, null, "mcp_server").catch(
+              (err) => logger.warn(`watch: mcp probe enqueue failed for ${change.id}: ${String(err)}`)
+            );
+            mcpQueued++;
+          }
+        } else if (route === "enqueue") {
+          queued.add(change.id);
+          buffered.push(change.id);
+          if (buffered.length >= ENQUEUE_BATCH) await flush();
+        }
+      }
+      await flush();
+      if (lastSeq !== null && lastSeq !== cursor) {
+        cursor = lastSeq;
+        await setWatchCursor(db, FEED_ID, cursor);
+      }
+      if (changes.length > 0) {
+        logger.info(
+          `watch: ${changes.length} change(s), ${resynced} re-synced` + (mcpQueued ? `, ${mcpQueued} mcp re-probe(s)` : "") + `, seq=${cursor}`
+        );
+      }
+      if (changes.length < PAGE_SIZE) await sleep(IDLE_POLL_MS, signal);
+    } catch (err) {
+      if (signal?.aborted) break;
+      logger.warn(`watch: ${String(err)}, retrying in ${backoff}ms`);
+      await sleep(backoff, signal);
+      backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
+    }
+  }
+  logger.info("watch: stopped.");
+}
+function sleep(ms, signal) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(timer);
+        resolve();
+      },
+      { once: true }
+    );
+  });
+}
+export {
+  fetchHeadSeq,
+  parseChange,
+  parseChangesPage,
+  routeChange,
+  watchNpmChanges
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lurqrun",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Verify npm packages before your AI coding agent installs them: hallucinated and typosquatted names, advisories, API drift and version conflicts. MCP server, CLI and agent skill for Claude Code, Cursor and VS Code.",
   "type": "module",
   "license": "MIT",
@@ -40,13 +40,32 @@
   ],
   "files": [
     "dist",
-    "src/data/seed.json",
     "templates",
-    "drizzle",
     "README.md"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=20.17.0"
+  },
+  "lurq": {
+    "inlinedDependencies": [
+      "@inquirer/prompts",
+      "@modelcontextprotocol/sdk",
+      "commander",
+      "dotenv",
+      "semver",
+      "yaml",
+      "zod"
+    ],
+    "selfHostDependencies": [
+      "drizzle-orm",
+      "express",
+      "express-rate-limit",
+      "helmet",
+      "ioredis",
+      "postgres",
+      "rate-limit-redis",
+      "stripe"
+    ]
   },
   "scripts": {
     "build": "tsup",
@@ -66,29 +85,15 @@
     "db:migrate": "tsx src/bin/operator.ts db migrate",
     "operator": "tsx src/bin/operator.ts",
     "operator:prod": "LURQ_ENV_FILE=.env.production tsx src/bin/operator.ts",
+    "prepack": "node scripts/publish-manifest.mjs strip",
+    "postpack": "node scripts/publish-manifest.mjs restore",
     "prepublishOnly": "node scripts/assert-publish-from-main.mjs && npm test && npm run build",
     "content:drift": "tsx scripts/gen-drift.ts",
     "content:landing": "tsx scripts/build-landing-content.mts",
     "content:releases": "tsx scripts/gen-releases.ts"
   },
   "dependencies": {
-    "@inquirer/prompts": "^8.5.2",
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "commander": "^12.1.0",
-    "dotenv": "^16.4.5",
-    "drizzle-orm": "^0.45.2",
-    "express": "^5.2.1",
-    "express-rate-limit": "^8.5.2",
-    "helmet": "^8.2.0",
-    "ioredis": "^5.11.1",
-    "postgres": "^3.4.9",
-    "rate-limit-redis": "^4.3.1",
-    "semver": "^7.8.5",
-    "stripe": "^22.6.0",
-    "typescript": "^5.5.4",
-    "update-notifier": "^7.3.1",
-    "yaml": "^2.9.0",
-    "zod": "^3.23.8"
+    "typescript": "^5.5.4"
   },
   "devDependencies": {
     "@eslint/js": "^9.9.0",

package/templates/agent-rules.md

@@ -8,13 +8,13 @@ Use it instead of recalling package facts:
 
 - `verify <pkg>` before adding any dependency. Catches hallucinated, typosquatted,
   deprecated, and advisory-carrying names. Cheapest and highest-value call.
-- `recommend "<need>"` before picking a library or hand-rolling something that may already
-  exist. Returns scored candidates with `proven` / `emerging` / `unproven` labels.
-- `compare <pkgs>` to choose between options; `evaluate <pkg>` for the full evidence read.
+- `compare <pkgs>` to choose between candidate libraries you already know of; `evaluate <pkg>`
+  for the full evidence read. lurq checks candidates, it does not search for them.
 - `compat <pkgs>` before committing to a multi-package stack. Healthy packages can still
   refuse to install together.
 - `usage <pkg> --known <version-you-remember>` before writing code against an API that may
-  have moved. Returns real exported symbols plus the delta from the version you know.
+  have moved. Returns real exported symbols plus the delta from the version you know. Large
+  surfaces are paged: pass `query` with part of a name to find a symbol directly.
 - `resolve_surface <pkg>` when you need to know whether a symbol exists at runtime, not
   just in the types. A removed type breaks `tsc`; a removed runtime export breaks the
   program. UNKNOWN means "not extracted yet", never "absent".

package/templates/skill-instructions.md

@@ -16,12 +16,10 @@ reads like a guess.
 
 ## Call lurq when you are about to:
 
-- **Pick a library for a need** → `recommend` with a natural-language description
-  (e.g. "a form library for React", "an ORM for Postgres"). Returns up to 5 scored
-  candidates. Do this *before* settling on a dependency from memory.
-- **Hand-roll something that might already exist** → `recommend` first
-  (e.g. "debounce a function", "deep clone an object", "parse dates"). Don't rebuild a
-  well-maintained, proven package.
+- **Pick a library for a need** → name the candidates you know and `compare` them, then
+  `verify` the one you choose. lurq checks candidates against evidence; it does not
+  search for them, so the list is yours to bring. The same applies before hand-rolling
+  something a well-maintained package may already do.
 - **Install a specific package** → `verify` with the exact name *before* adding it.
   This catches hallucinated, deprecated, and typosquatted names (e.g. `lodahs` vs
   `lodash`) and packages with known advisories. Cheap, and the highest-value call here.
@@ -31,17 +29,21 @@ reads like a guess.
   and a usage guide (what it is, when to use it, how it fits).
 - **Adding dependencies in a team codebase** → `policy` once, before choosing. It lists
   the packages and thresholds the team's policy refuses, so you pick an allowed package
-  first instead of being refused after. `recommend` and `evaluate` enforce it either way.
+  first instead of being refused after. `evaluate` enforces it either way.
 - **Commit to a multi-package stack** → `compat` with the whole set. Individually healthy
   packages can still refuse to install together; this returns the exact clashing peer or
-  engine constraints, plus any conflicts already proven in a sandbox. Read-only and
-  instant — it does not run an install.
+  engine constraints, plus any conflicts already proven in a sandbox. Read-only — it never
+  runs an install. A set checked before answers immediately; a new one is resolved live
+  from registry metadata and can take up to ~25 seconds.
 - **Write code against a package whose API may have moved** → `usage` with the package
   and, if you know it, `knownVersion`. Returns the real exported symbols and signatures
   extracted from that version's shipped `.d.ts`, plus the precise delta from the version
   you remember: what was added, removed, renamed, or changed. None of this is in your
   training data, and it is the difference between calling a function that exists and one
-  that used to.
+  that used to. Large surfaces are paged 80 symbols at a time: pass `query` with part of a
+  name to go straight to a symbol, or `offset` for the next page. `shallow: true` means the
+  API lives on an interface's members that are not listed (DefinitelyTyped's `export =`
+  shape, e.g. lodash); read its type declarations or use `resolve_surface`.
 - **Check whether a symbol actually exists at runtime** → `resolve_surface` with the
   package (and version, if you have one). `usage` reads the shipped `.d.ts`; this reads
   the shipped JavaScript, and the difference matters: a removed *type* breaks `tsc`, a
@@ -82,16 +84,13 @@ reads like a guess.
   can catch it, and the symptom is a malformed call that looks like a model mistake.
   **Privilege widening** is a tool that stopped being read-only or started being
   destructive; nothing breaks, which is what makes it worse than a break.
-- **Build a whole project from a spec** → `plan` with the program description. Returns a
-  scored package per component plus a Mermaid roadmap. It recommends building blocks
-  slot-by-slot from the index; it does not invent an architecture from a bare prompt.
 - **Visualize a stack you have already chosen** → `diagram` with the package names. A
   labeled starting point by layer — not a validated architecture.
 - **Unsure whether lurq covers the situation** → `capabilities` with what you are trying
   to do, in plain words. Returns the matching tools and commands rather than prose, so a
   capability you did not know about becomes a call you can make. Cheaper than guessing,
   and far cheaper than skipping a check that exists.
-- **After you act on a recommendation** → `report_outcome` (optional) with whether you
+- **After you act on lurq's evidence about a package** → `report_outcome` (optional) with whether you
   used the package and whether it built. No source code, just the coarse decision and a
   build signal. It is how lurq learns which packages agents actually succeed with.