lurqrun 0.1.6 → 0.1.7

package/dist/chunk-3N3Q3DSW.js

@@ -0,0 +1,214 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  loadStored,
+  rowsToSurface
+} from "./chunk-DB2VF5UD.js";
+import {
+  configRequestLine,
+  fetchServerManifest,
+  missingConfig
+} from "./chunk-LEGPB7DO.js";
+import {
+  MCP_TIER,
+  contractOf,
+  diffMcpSurfaces,
+  summarizeDrift
+} from "./chunk-6EQ3ARXA.js";
+import {
+  enqueueSurface
+} from "./chunk-LO35HLQZ.js";
+import {
+  cached
+} from "./chunk-HWBBVLOT.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/mcp/mcpHandlers.ts
+init_esm_shims();
+import { createHash } from "crypto";
+function ckey(parts) {
+  return createHash("sha1").update(JSON.stringify(parts)).digest("hex").slice(0, 24);
+}
+var MISS = (server, version) => ({
+  server,
+  version,
+  verdict: "unknown",
+  class: null,
+  tier: null,
+  tools: [],
+  requires: [],
+  configRequest: null,
+  coverageNote: "not yet probed, queued; retry shortly. This is NOT evidence that the server exposes no tools.",
+  observedAt: null
+});
+function toolViews(stored) {
+  const surface = rowsToSurface("", null, stored.rows, MCP_TIER);
+  return surface.symbols.map((s) => {
+    const c = contractOf(s);
+    const input = c?.input ?? null;
+    const props = input && typeof input.properties === "object" ? input.properties : {};
+    const required = Array.isArray(input?.required) ? input.required : [];
+    return {
+      name: s.path,
+      required: [...required].sort(),
+      params: Object.keys(props ?? {}).sort(),
+      annotations: c?.annotations ?? {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true
+      },
+      hasOutputSchema: c?.output != null,
+      deprecated: s.deprecated
+    };
+  }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+}
+async function handleMcpSurface(db, input) {
+  return cached(
+    "mcp_surface",
+    ckey([input.server, input.version ?? null]),
+    () => mcpSurfaceUncached(db, input),
+    { skipCache: (v) => v.verdict === "unknown" }
+  );
+}
+async function mcpSurfaceUncached(db, input) {
+  const version = input.version ?? null;
+  const [stored, manifest] = await Promise.all([
+    loadStored(db, input.server, version, 0, "mcp_server"),
+    // Best-effort and never fatal: the registry being down must not change what
+    // we say about a server.
+    fetchServerManifest(input.server).catch(() => null)
+  ]);
+  const requires = manifest?.env ?? [];
+  const missing = missingConfig(manifest);
+  const configRequest = missing.length ? configRequestLine(input.server, missing) : null;
+  const base = { server: input.server, version, requires, configRequest };
+  if (missing.length > 0 && (!stored || stored.rows.length === 0)) {
+    return {
+      ...base,
+      verdict: "unverifiable",
+      class: null,
+      tier: null,
+      tools: [],
+      coverageNote: "server declares required settings this environment does not have, so it was not probed. UNVERIFIABLE, not a fault: nothing here is evidence about whether the server works. Supply the values in `requires` and ask again.",
+      observedAt: null
+    };
+  }
+  if (manifest?.remoteOnly) {
+    return {
+      ...base,
+      verdict: "unverifiable",
+      class: null,
+      tier: null,
+      tools: [],
+      coverageNote: `server is published only as a remote ${manifest.transport ?? "endpoint"}; there is no package to install, so this stdio probe does not apply to it`,
+      observedAt: null
+    };
+  }
+  if (stored?.verdict === "verified_false") {
+    return {
+      ...base,
+      verdict: "verified_false",
+      class: stored.class,
+      tier: stored.tier,
+      tools: [],
+      coverageNote: "server was probed and did not complete the MCP handshake, so it exposes no callable tools in a clean install. This is a verdict about the server, not a gap in our coverage.",
+      observedAt: stored.observedAt
+    };
+  }
+  if (!stored || stored.rows.length === 0) {
+    await enqueueSurface(db, input.server, version, "mcp_server").catch(() => {
+    });
+    return { ...MISS(input.server, version), requires, configRequest };
+  }
+  if (stored.verdict === "undeclared") {
+    return {
+      ...base,
+      verdict: "undeclared",
+      class: stored.class,
+      tier: stored.tier,
+      tools: [],
+      coverageNote: "server started and completed the handshake but listed no tools; UNDECLARED, which is a measurement gap, not proof it has none",
+      observedAt: stored.observedAt
+    };
+  }
+  const tools = toolViews(stored);
+  const noContract = tools.filter((t) => t.params.length === 0 && t.required.length === 0).length;
+  return {
+    ...base,
+    verdict: stored.verdict,
+    class: stored.class,
+    tier: stored.tier,
+    tools,
+    coverageNote: `${tools.length} tool(s) read from tools/list` + (noContract ? `; ${noContract} declare no input parameters (either genuinely nullary, or probed before schemas were captured)` : "") + (requires.length ? `; the server declares ${requires.length} setting(s) in \`requires\` that a caller must supply` : "") + ". Declared contract only: that a tool is listed is not evidence that calling it succeeds.",
+    observedAt: stored.observedAt
+  };
+}
+async function handleMcpDrift(db, input) {
+  return cached(
+    "mcp_drift",
+    ckey([input.server, input.fromVersion, input.toVersion]),
+    () => mcpDriftUncached(db, input),
+    { skipCache: (v) => v.verdict === "unknown" }
+  );
+}
+async function mcpDriftUncached(db, input) {
+  const [a, b] = await Promise.all([
+    loadStored(db, input.server, input.fromVersion, 0, "mcp_server"),
+    loadStored(db, input.server, input.toVersion, 0, "mcp_server")
+  ]);
+  const missing = [];
+  if (!a || a.rows.length === 0) missing.push(input.fromVersion);
+  if (!b || b.rows.length === 0) missing.push(input.toVersion);
+  if (missing.length) {
+    for (const v of missing) {
+      await enqueueSurface(db, input.server, v, "mcp_server").catch(() => {
+      });
+    }
+    const blank = diffMcpSurfaces(
+      {
+        package: input.server,
+        version: input.fromVersion,
+        tier: MCP_TIER,
+        entry: null,
+        symbols: [],
+        filesWalked: 0,
+        externalReExports: []
+      },
+      {
+        package: input.server,
+        version: input.toVersion,
+        tier: MCP_TIER,
+        entry: null,
+        symbols: [],
+        filesWalked: 0,
+        externalReExports: []
+      }
+    );
+    return {
+      ...blank,
+      inconclusive: `no probed surface for ${missing.join(", ")}, queued; retry shortly. NOT evidence that tools were removed.`,
+      verdict: "unknown",
+      class: null,
+      summary: "unknown: not yet probed",
+      observedAt: null
+    };
+  }
+  const drift = diffMcpSurfaces(
+    rowsToSurface(input.server, input.fromVersion, a.rows, MCP_TIER),
+    rowsToSurface(input.server, input.toVersion, b.rows, MCP_TIER)
+  );
+  return {
+    ...drift,
+    verdict: drift.inconclusive ? "unknown" : "verified_true",
+    class: drift.inconclusive ? null : "derived",
+    summary: drift.inconclusive ?? summarizeDrift(drift),
+    observedAt: b.observedAt
+  };
+}
+
+export {
+  handleMcpSurface,
+  handleMcpDrift
+};

package/dist/chunk-4ESO33J6.js

@@ -0,0 +1,34 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/core/concurrency.ts
+init_esm_shims();
+function withBudget(task, ms) {
+  let timer;
+  return Promise.race([
+    task,
+    new Promise((resolve) => {
+      timer = setTimeout(resolve, ms, null);
+    })
+  ]).finally(() => clearTimeout(timer));
+}
+async function pMap(items, mapper, concurrency) {
+  const results = new Array(items.length);
+  let cursor = 0;
+  const workerCount = Math.max(1, Math.min(concurrency, items.length));
+  const workers = Array.from({ length: workerCount }, async () => {
+    while (cursor < items.length) {
+      const index = cursor++;
+      results[index] = await mapper(items[index], index);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}
+
+export {
+  withBudget,
+  pMap
+};

package/dist/chunk-4F7ZESPO.js

@@ -0,0 +1,132 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  classifyRuntimeTarget,
+  inferCategory
+} from "./chunk-FW6BD2NO.js";
+import {
+  DEFAULT_ECOSYSTEM
+} from "./chunk-VLRHFMGJ.js";
+import {
+  packages
+} from "./chunk-LYMPYETA.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/mcp/diagram.ts
+init_esm_shims();
+import { and, eq, inArray } from "drizzle-orm";
+var UNCLASSIFIED = "Unclassified";
+var LAYER_OF = {
+  framework: "Presentation",
+  "meta-framework": "Presentation",
+  "ui-component-library": "Presentation",
+  styling: "Presentation",
+  animation: "Presentation",
+  charts: "Presentation",
+  "state-management": "Client Logic",
+  routing: "Client Logic",
+  forms: "Client Logic",
+  validation: "Client Logic",
+  "data-fetching": "Client Logic",
+  "http-client": "Client Logic",
+  i18n: "Client Logic",
+  "date-time": "Client Logic",
+  utility: "Client Logic",
+  auth: "Backend",
+  orm: "Data",
+  "database-client": "Data",
+  "build-tool": "Tooling",
+  bundler: "Tooling",
+  linting: "Tooling",
+  testing: "Tooling"
+};
+var FLOW_LAYERS = ["Presentation", "Client Logic", "Backend", "Data"];
+function layerFor(item) {
+  if (!item.category) return UNCLASSIFIED;
+  if (item.category === "framework" && item.runtimeTarget === "node") return "Backend";
+  return LAYER_OF[item.category] ?? UNCLASSIFIED;
+}
+function nodeId(label, i) {
+  return `n${i}_${label.replace(/[^a-zA-Z0-9]/g, "_")}`;
+}
+function buildMermaid(items) {
+  const byLayer = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const layer = layerFor(item);
+    const list = byLayer.get(layer) ?? [];
+    list.push(item);
+    byLayer.set(layer, list);
+  }
+  const lines = ["flowchart TD", "  user([User])"];
+  const ids = /* @__PURE__ */ new Map();
+  let counter = 0;
+  const repNode = /* @__PURE__ */ new Map();
+  const emitLayer = (layer) => {
+    const list = byLayer.get(layer);
+    if (!list?.length) return;
+    lines.push(`  subgraph ${layer.replace(/\s+/g, "_")}["${layer}"]`);
+    for (const item of list) {
+      const id = nodeId(item.label, counter++);
+      ids.set(item.label, id);
+      if (!repNode.has(layer)) repNode.set(layer, id);
+      const text = layer === UNCLASSIFIED ? item.label : `${item.category}: ${item.label}`;
+      lines.push(`    ${id}["${text}"]`);
+    }
+    lines.push("  end");
+  };
+  for (const layer of FLOW_LAYERS) emitLayer(layer);
+  emitLayer("Tooling");
+  emitLayer(UNCLASSIFIED);
+  const present = FLOW_LAYERS.filter((l) => byLayer.has(l));
+  let prev = "user";
+  for (const layer of present) {
+    lines.push(`  ${prev} --> ${repNode.get(layer)}`);
+    prev = repNode.get(layer);
+  }
+  if (byLayer.has("Data")) lines.push(`  ${repNode.get("Data")} --> db[(Database)]`);
+  return lines.join("\n");
+}
+async function handleDiagram(db, input) {
+  if (!input.stack?.length) {
+    return {
+      mermaid: "flowchart TD\n  user([User]) --> app[Application]",
+      note: "Provide a `stack` of package names to diagram. lurq labels a stack you choose; it does not infer an architecture from a description."
+    };
+  }
+  const rows = await db.select({
+    name: packages.name,
+    category: packages.category,
+    runtimeTarget: packages.runtimeTarget
+  }).from(packages).where(
+    and(inArray(packages.name, input.stack), eq(packages.ecosystem, DEFAULT_ECOSYSTEM))
+  );
+  const known = new Map(rows.map((r) => [r.name, r]));
+  const items = input.stack.map((name) => {
+    const row = known.get(name);
+    return {
+      label: name,
+      category: row?.category ?? inferCategory(name),
+      // Fall back to the name-only classifier for a package that predates the
+      // column or is not indexed at all: the curated overrides still resolve the
+      // frameworks people actually diagram, and an unclassifiable one keeps the
+      // old Presentation default rather than moving on a null.
+      runtimeTarget: row?.runtimeTarget ?? classifyRuntimeTarget({
+        name,
+        hasBrowserField: false,
+        keywords: [],
+        engines: null,
+        peerDependencies: null
+      })
+    };
+  });
+  const unclassified = items.filter((i) => layerFor(i) === UNCLASSIFIED).map((i) => i.label);
+  const note = unclassified.length ? `Reference pattern derived from the provided stack: partial, not authoritative. Could not place ${unclassified.length} package(s): ${unclassified.join(", ")} (not in lurq's index and no category match), shown under Unclassified, outside the flow.` : "Reference pattern derived from the provided stack. A labeled starting point, not a validated architecture.";
+  return { mermaid: buildMermaid(items), note };
+}
+
+export {
+  layerFor,
+  buildMermaid,
+  handleDiagram
+};

package/dist/chunk-4KCPOMG6.js

@@ -0,0 +1,68 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/cli/format.ts
+init_esm_shims();
+var ESC = "\x1B[";
+function colorEnabled() {
+  if (process.env.NO_COLOR) return false;
+  const force = process.env.FORCE_COLOR;
+  if (force !== void 0) return force !== "0" && force !== "false";
+  return process.stdout.isTTY === true;
+}
+var wrap = (code, s) => colorEnabled() ? `${ESC}${code}m${s}${ESC}0m` : s;
+var bold = (s) => wrap("1", s);
+var dim = (s) => wrap("2", s);
+var red = (s) => wrap("31", s);
+var green = (s) => wrap("32", s);
+var yellow = (s) => wrap("33", s);
+var ANSI_RE = /\[[0-9;]*m/g;
+var width = (s) => s.replace(ANSI_RE, "").length;
+function table(headers, rows) {
+  const widths = headers.map((h, i) => Math.max(width(h), ...rows.map((r) => width(r[i] ?? ""))));
+  const pad = (s, w) => s + " ".repeat(Math.max(0, w - width(s)));
+  const line = (cells) => cells.map((c, i) => pad(c, widths[i])).join("  ");
+  const out = [bold(line(headers)), dim(widths.map((w) => "\u2500".repeat(w)).join("  "))];
+  for (const r of rows) out.push(line(r));
+  return out.join("\n");
+}
+function detail(pairs) {
+  const labelWidth = Math.max(...pairs.map(([k]) => k.length));
+  return pairs.map(([k, v]) => `${dim((k + ":").padEnd(labelWidth + 1))} ${v}`).join("\n");
+}
+function formatNumber(n) {
+  if (n == null) return "-";
+  if (n >= 1e6) return `${Math.round(n / 1e5) / 10}M`;
+  if (n >= 1e3) return `${Math.round(n / 100) / 10}k`;
+  return String(n);
+}
+function formatDate(iso) {
+  return iso ? iso.slice(0, 10) : "-";
+}
+function formatPercent(fraction) {
+  if (fraction == null) return "-";
+  const pct = Math.round(fraction * 1e3) / 10;
+  return `${pct > 0 ? "+" : ""}${pct}%`;
+}
+function confidenceLabel(c) {
+  if (c === "proven") return green(c);
+  if (c === "emerging") return yellow(c);
+  if (c === "promising") return green(c);
+  return red(c);
+}
+
+export {
+  bold,
+  dim,
+  red,
+  green,
+  yellow,
+  table,
+  detail,
+  formatNumber,
+  formatDate,
+  formatPercent,
+  confidenceLabel
+};

package/dist/chunk-4ZYCIMY4.js

@@ -0,0 +1,155 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  resolveApiKey,
+  resolveEndpoint
+} from "./chunk-Y5GI7RL3.js";
+import {
+  DEFAULT_ENDPOINT
+} from "./chunk-GPTKSNR6.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/cli/remote.ts
+init_esm_shims();
+var RemoteError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "RemoteError";
+  }
+  status;
+};
+var MissingKeyError = class extends RemoteError {
+  constructor(message = "No API key configured. Run `lurq setup` to connect this machine.") {
+    super(message, 401);
+    this.name = "MissingKeyError";
+  }
+};
+function endpoint(override) {
+  const base = resolveEndpoint(override) ?? DEFAULT_ENDPOINT;
+  return base.replace(/\/mcp\/?$/, "").replace(/\/$/, "");
+}
+function mcpUrl(override) {
+  return `${endpoint(override)}/mcp`;
+}
+function apiKey(override) {
+  const key = resolveApiKey(override);
+  if (!key) throw new MissingKeyError();
+  return key;
+}
+function errorText(body) {
+  const err = body?.error;
+  if (typeof err === "string") return err;
+  const message = err?.message;
+  return typeof message === "string" ? message : void 0;
+}
+async function postJson(url, body, headers, timeoutMs = 6e4, method = "POST") {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url, {
+      method,
+      headers: { "Content-Type": "application/json", ...headers },
+      // fetch rejects a GET that carries a body, even an empty one.
+      body: method === "GET" ? void 0 : JSON.stringify(body),
+      signal: controller.signal
+    });
+  } catch (err) {
+    const aborted = err instanceof Error && err.name === "AbortError";
+    throw new RemoteError(aborted ? `Timed out calling ${url}` : `Could not reach ${url}`, 0);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var post = (path, body, opts = {}) => request("POST", path, body, opts);
+async function request(method, path, body, opts = {}) {
+  const url = `${endpoint(opts.url)}${path}`;
+  const res = await postJson(
+    url,
+    body,
+    { Authorization: `Bearer ${apiKey(opts.apiKey)}` },
+    opts.timeoutMs,
+    method
+  );
+  if (!res.ok) {
+    const detail = await res.json().then(errorText).catch(() => void 0);
+    throw new RemoteError(detail ?? `${path} failed with HTTP ${res.status}`, res.status);
+  }
+  return await res.json();
+}
+async function callTool(tool, args, opts = {}) {
+  const url = mcpUrl(opts.url);
+  const res = await postJson(
+    url,
+    { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: tool, arguments: args } },
+    {
+      // The streamable-HTTP transport rejects a request that doesn't accept
+      // both, even when it has already decided to answer with plain JSON.
+      Accept: "application/json, text/event-stream",
+      Authorization: `Bearer ${apiKey(opts.apiKey)}`
+    },
+    opts.timeoutMs
+  );
+  const body = parseRpcBody(await res.text());
+  if (!res.ok) {
+    throw new RemoteError(errorText(body) ?? `${tool} failed with HTTP ${res.status}`, res.status);
+  }
+  const message = errorText(body);
+  if (message) throw new RemoteError(message, 200);
+  const result = body?.result;
+  const text = result?.content?.find((c) => c.type === "text")?.text;
+  if (text === void 0) throw new RemoteError(`${tool} returned no content.`, 502);
+  if (result?.isError) throw new RemoteError(text, 200);
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new RemoteError(`${tool} returned a non-JSON result: ${text.slice(0, 200)}`, 502);
+  }
+}
+function parseRpcBody(raw) {
+  const text = raw.trimStart().startsWith("{") ? raw : (raw.split("\n").filter((l) => l.startsWith("data:")).pop() ?? "").slice(5);
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function fetchUpgradePlan(deps, opts = {}) {
+  const body = opts.repo ? { deps, repo: opts.repo } : { deps };
+  return post("/upgrade-plan", body, opts);
+}
+function reportUpgradeRuns(runs, opts = {}) {
+  return post("/upgrade-runs", { runs }, opts);
+}
+async function getPolicy(opts = {}) {
+  return (await request("GET", "/policy", void 0, opts)).policy;
+}
+function putPolicy(policy, opts = {}) {
+  return request("PUT", "/policy", { policy }, opts);
+}
+async function getPolicyHistory(opts = {}) {
+  return (await request("GET", "/policy/history", void 0, opts)).changes;
+}
+async function getPolicyDecisions(days, opts = {}) {
+  const path = `/policy/decisions?days=${encodeURIComponent(days)}`;
+  return (await request("GET", path, void 0, opts)).decisions;
+}
+function uploadMcpScan(body, opts = {}) {
+  return post("/mcp-scans", body, { timeoutMs: 12e4, ...opts });
+}
+
+export {
+  RemoteError,
+  MissingKeyError,
+  endpoint,
+  apiKey,
+  callTool,
+  fetchUpgradePlan,
+  reportUpgradeRuns,
+  getPolicy,
+  putPolicy,
+  getPolicyHistory,
+  getPolicyDecisions,
+  uploadMcpScan
+};