lurqrun 0.1.6 → 0.1.7

package/dist/chunk-6EQ3ARXA.js

@@ -0,0 +1,304 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  diffSurfaces
+} from "./chunk-SHCEBP3J.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/surface/mcp.ts
+init_esm_shims();
+import { createHash } from "crypto";
+var MCP_TIER = "mcp_tools_list";
+var PROSE_KEYS = /* @__PURE__ */ new Set(["description", "title", "$comment", "examples", "$schema"]);
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value === null || typeof value !== "object") return value;
+  const src = value;
+  const out = {};
+  for (const k of Object.keys(src).sort()) {
+    if (PROSE_KEYS.has(k)) continue;
+    const v = canonicalize(src[k]);
+    if (v === void 0) continue;
+    out[k] = v;
+  }
+  if (Array.isArray(out.type) && out.type.every((t) => typeof t === "string")) {
+    const t = [...new Set(out.type)].sort();
+    out.type = t.length === 1 ? t[0] : t;
+  }
+  if (Array.isArray(out.required) && out.required.every((r) => typeof r === "string")) {
+    const r = [...new Set(out.required)].sort();
+    if (r.length === 0) delete out.required;
+    else out.required = r;
+  }
+  return out;
+}
+var ANNOTATION_DEFAULTS = {
+  readOnlyHint: false,
+  destructiveHint: true,
+  idempotentHint: false,
+  openWorldHint: true
+};
+function resolveAnnotations(a) {
+  const out = {};
+  for (const k of Object.keys(ANNOTATION_DEFAULTS)) {
+    const v = a?.[k];
+    out[k] = typeof v === "boolean" ? v : ANNOTATION_DEFAULTS[k];
+  }
+  return out;
+}
+var WIDENS_WHEN_FALSE = {
+  readOnlyHint: true,
+  // true → false: the tool started writing
+  destructiveHint: false,
+  // false → true: the tool started destroying
+  idempotentHint: true,
+  // true → false: retries are no longer safe
+  openWorldHint: false
+  // false → true: the tool started reaching outside
+};
+var sha = (s) => createHash("sha256").update(s).digest("hex");
+function toolContract(t) {
+  return {
+    input: canonicalize(t.inputSchema ?? null),
+    output: canonicalize(t.outputSchema ?? null),
+    annotations: resolveAnnotations(t.annotations),
+    prose: sha(`${t.title ?? ""}\0${t.description ?? ""}`).slice(0, 16)
+  };
+}
+function properties(c) {
+  const input = c?.input;
+  if (!input || typeof input !== "object") return {};
+  const props = input.properties;
+  return props && typeof props === "object" ? props : {};
+}
+function requiredSet(c) {
+  const input = c?.input;
+  if (!input || typeof input !== "object") return /* @__PURE__ */ new Set();
+  const req = input.required;
+  return new Set(Array.isArray(req) ? req.filter((r) => typeof r === "string") : []);
+}
+function requiredParams(t) {
+  return [...requiredSet(toolContract(t))].sort();
+}
+var DEPRECATED_RE = /^\s*[[(]?\s*(?:@)?deprecated\b/i;
+function looksDeprecated(t) {
+  return DEPRECATED_RE.test(t.description ?? "") || DEPRECATED_RE.test(t.title ?? "");
+}
+function toolToSymbol(t) {
+  return {
+    path: t.name,
+    kind: "function",
+    arity: requiredParams(t).length,
+    // MCP has no re-export mechanism: every tool a server lists is its own.
+    origin: "local",
+    deprecated: looksDeprecated(t),
+    tier: MCP_TIER,
+    signature: JSON.stringify(toolContract(t))
+  };
+}
+function mcpSurface(server, version, tools) {
+  return {
+    package: server,
+    version,
+    tier: MCP_TIER,
+    entry: null,
+    symbols: tools.map(toolToSymbol),
+    filesWalked: 0,
+    externalReExports: [],
+    ...tools.length === 0 ? { undeclaredReason: "server listed no tools" } : {}
+  };
+}
+function surfaceHash(tools) {
+  const canon = [...tools].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0).map((t) => [t.name, toolContract(t)]);
+  return sha(JSON.stringify(canon));
+}
+function contractOf(s) {
+  if (!s.signature) return null;
+  try {
+    return JSON.parse(s.signature);
+  } catch {
+    return null;
+  }
+}
+var emptyDrift = (from, to, reason) => ({
+  server: from.package,
+  fromVersion: from.version,
+  toVersion: to.version,
+  tier: MCP_TIER,
+  removedTools: [],
+  addedTools: [],
+  requiredAdded: [],
+  requiredRelaxed: [],
+  paramsRemoved: [],
+  paramsAdded: [],
+  typeChanged: [],
+  outputChanged: [],
+  annotationFlips: [],
+  silentDrift: [],
+  prosePolished: [],
+  deprecated: [],
+  breaking: false,
+  inconclusive: reason
+});
+function typeSet(p) {
+  const t = p.type;
+  if (typeof t === "string") return /* @__PURE__ */ new Set([t]);
+  if (Array.isArray(t)) return new Set(t.filter((x) => typeof x === "string"));
+  return null;
+}
+function enumSet(p) {
+  return Array.isArray(p.enum) ? new Set(p.enum.map((v) => JSON.stringify(v))) : null;
+}
+function accepts(a, b) {
+  if (b === null) return true;
+  if (a === null) return false;
+  return [...a].every((v) => b.has(v));
+}
+var RELAXABLE = /* @__PURE__ */ new Set([
+  "type",
+  "enum",
+  "additionalProperties",
+  "required",
+  "properties",
+  "items"
+]);
+function isWidening(a, b) {
+  if (JSON.stringify(a) === JSON.stringify(b)) return true;
+  if (!a || typeof a !== "object" || !b || typeof b !== "object") return false;
+  if (Array.isArray(a) || Array.isArray(b)) return false;
+  const pa = a;
+  const pb = b;
+  for (const k of /* @__PURE__ */ new Set([...Object.keys(pa), ...Object.keys(pb)])) {
+    if (RELAXABLE.has(k)) continue;
+    if (JSON.stringify(pa[k]) !== JSON.stringify(pb[k])) return false;
+  }
+  if (!accepts(typeSet(pa), typeSet(pb))) return false;
+  if (!accepts(enumSet(pa), enumSet(pb))) return false;
+  if (JSON.stringify(pa.additionalProperties) !== JSON.stringify(pb.additionalProperties)) {
+    if (pa.additionalProperties !== false) return false;
+  }
+  const ra = new Set(Array.isArray(pa.required) ? pa.required : []);
+  const rb = new Set(Array.isArray(pb.required) ? pb.required : []);
+  for (const k of rb) if (!ra.has(k)) return false;
+  const propsA = pa.properties ?? {};
+  const propsB = pb.properties ?? {};
+  for (const k of Object.keys(propsA)) {
+    if (!(k in propsB)) {
+      if (pb.additionalProperties === false) return false;
+      continue;
+    }
+    if (!isWidening(propsA[k], propsB[k])) return false;
+  }
+  if ("items" in pa || "items" in pb) {
+    if (!isWidening(pa.items ?? {}, pb.items ?? {})) return false;
+  }
+  return true;
+}
+function diffMcpSurfaces(from, to) {
+  const base = diffSurfaces(from, to);
+  if (base.inconclusive) return emptyDrift(from, to, base.inconclusive);
+  const drift = emptyDrift(from, to, "");
+  delete drift.inconclusive;
+  drift.removedTools = base.removed.map((s) => s.path).sort();
+  drift.addedTools = base.added.map((s) => s.path).sort();
+  drift.deprecated = base.deprecated.map((s) => s.path).sort();
+  const fromByName = new Map(from.symbols.map((s) => [s.path, s]));
+  for (const toSym of to.symbols) {
+    const fromSym = fromByName.get(toSym.path);
+    if (!fromSym) continue;
+    const a = contractOf(fromSym);
+    const b = contractOf(toSym);
+    if (!a || !b) continue;
+    const tool = toSym.path;
+    const pa = properties(a);
+    const pb = properties(b);
+    const ra = requiredSet(a);
+    const rb = requiredSet(b);
+    const gone = Object.keys(pa).filter((k) => !(k in pb)).sort();
+    const fresh = Object.keys(pb).filter((k) => !(k in pa)).sort();
+    if (gone.length) drift.paramsRemoved.push({ tool, params: gone });
+    if (fresh.length) drift.paramsAdded.push({ tool, params: fresh });
+    const nowRequired = [...rb].filter((k) => !ra.has(k)).sort();
+    const nowOptional = [...ra].filter((k) => !rb.has(k) && k in pb).sort();
+    if (nowRequired.length) drift.requiredAdded.push({ tool, params: nowRequired });
+    if (nowOptional.length) drift.requiredRelaxed.push({ tool, params: nowOptional });
+    for (const param of Object.keys(pb)) {
+      if (!(param in pa)) continue;
+      const before = JSON.stringify(pa[param]);
+      const after = JSON.stringify(pb[param]);
+      if (before === after) continue;
+      drift.typeChanged.push({
+        tool,
+        param,
+        from: before,
+        to: after,
+        widened: isWidening(pa[param], pb[param])
+      });
+    }
+    if (JSON.stringify(a.output) !== JSON.stringify(b.output)) drift.outputChanged.push(tool);
+    for (const hint of Object.keys(ANNOTATION_DEFAULTS)) {
+      if (a.annotations[hint] === b.annotations[hint]) continue;
+      drift.annotationFlips.push({
+        tool,
+        hint,
+        from: a.annotations[hint],
+        to: b.annotations[hint],
+        widensPrivilege: b.annotations[hint] === !WIDENS_WHEN_FALSE[hint]
+      });
+    }
+    const contractMoved = JSON.stringify(a.input) !== JSON.stringify(b.input) || JSON.stringify(a.output) !== JSON.stringify(b.output) || JSON.stringify(a.annotations) !== JSON.stringify(b.annotations);
+    const proseMoved = a.prose !== b.prose;
+    if (contractMoved && !proseMoved) drift.silentDrift.push(tool);
+    if (proseMoved && !contractMoved) drift.prosePolished.push(tool);
+  }
+  drift.breaking = drift.removedTools.length > 0 || drift.requiredAdded.length > 0 || drift.paramsRemoved.length > 0 || drift.typeChanged.some((c) => !c.widened);
+  return drift;
+}
+function summarizeDrift(d) {
+  const alarming = [];
+  const benign = [];
+  const widened = d.annotationFlips.filter((f) => f.widensPrivilege);
+  if (widened.length) {
+    alarming.push(
+      `${widened.length} privilege widening(s): ` + widened.map((f) => `${f.tool}.${f.hint} ${f.from}\u2192${f.to}`).join(", ")
+    );
+  }
+  if (d.removedTools.length) alarming.push(`${d.removedTools.length} tool(s) removed`);
+  if (d.requiredAdded.length) {
+    alarming.push(`${d.requiredAdded.length} tool(s) gained required params`);
+  }
+  if (d.paramsRemoved.length) alarming.push(`${d.paramsRemoved.length} tool(s) dropped params`);
+  const narrowed = d.typeChanged.filter((c) => !c.widened);
+  if (narrowed.length) alarming.push(`${narrowed.length} param type(s) narrowed`);
+  if (d.silentDrift.length) {
+    alarming.push(
+      `${d.silentDrift.length} SILENT change(s) (contract moved, description unchanged): ${d.silentDrift.join(", ")}`
+    );
+  }
+  if (d.addedTools.length) benign.push(`${d.addedTools.length} tool(s) added`);
+  const relaxed = d.typeChanged.length - narrowed.length;
+  if (relaxed) benign.push(`${relaxed} param type(s) relaxed`);
+  if (d.requiredRelaxed.length) {
+    benign.push(`${d.requiredRelaxed.length} tool(s) made params optional`);
+  }
+  if (d.paramsAdded.length) benign.push(`${d.paramsAdded.length} tool(s) gained optional params`);
+  if (d.outputChanged.length) benign.push(`${d.outputChanged.length} output schema(s) changed`);
+  const safeFlips = d.annotationFlips.length - widened.length;
+  if (safeFlips) benign.push(`${safeFlips} annotation(s) narrowed`);
+  if (d.deprecated.length) benign.push(`${d.deprecated.length} tool(s) newly deprecated`);
+  if (d.prosePolished.length) benign.push(`${d.prosePolished.length} description(s) edited`);
+  if (alarming.length) return alarming.join("; ");
+  if (benign.length) return `compatible: ${benign.join(", ")}`;
+  return "no contract change";
+}
+
+export {
+  MCP_TIER,
+  resolveAnnotations,
+  mcpSurface,
+  surfaceHash,
+  contractOf,
+  diffMcpSurfaces,
+  summarizeDrift
+};

package/dist/chunk-6L3U7DZ5.js

@@ -0,0 +1,23 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  verificationRuns
+} from "./chunk-LYMPYETA.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/db/verification.ts
+init_esm_shims();
+import { desc, eq } from "drizzle-orm";
+async function storeVerificationRun(db, run) {
+  await db.insert(verificationRuns).values(run);
+}
+async function getLatestVerificationByName(db, packageName) {
+  const rows = await db.select().from(verificationRuns).where(eq(verificationRuns.packageName, packageName)).orderBy(desc(verificationRuns.ranAt)).limit(1);
+  return rows[0] ?? null;
+}
+
+export {
+  storeVerificationRun,
+  getLatestVerificationByName
+};

package/dist/chunk-AHBP533R.js

@@ -0,0 +1,220 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  httpGetJson
+} from "./chunk-SJOVFF7B.js";
+import {
+  CACHE_TTL
+} from "./chunk-GPTKSNR6.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/ingestion/sources/npmRegistry.ts
+init_esm_shims();
+var HOST = "registry.npmjs.org";
+function encodeNpmName(name) {
+  return name.startsWith("@") ? name.replace("/", "%2F") : name;
+}
+function parseGithubRepo(url) {
+  if (!url) return null;
+  const match = url.match(/github\.com[/:]([^/]+)\/([^/#?]+?)(?:\.git)?(?:[/#?].*)?$/i);
+  if (!match) return null;
+  const owner = match[1];
+  const repo = match[2];
+  if (!owner || !repo) return null;
+  return { owner, repo };
+}
+function normalizeRepoUrl(repository, homepage) {
+  let raw = null;
+  if (typeof repository === "string") raw = repository;
+  else if (repository && typeof repository === "object" && "url" in repository) {
+    raw = String(repository.url);
+  }
+  const repo = parseGithubRepo(raw) ?? parseGithubRepo(homepage);
+  const repoUrl = repo ? `https://github.com/${repo.owner}/${repo.repo}` : cleanUrl(raw) ?? null;
+  return { repoUrl, repo };
+}
+function cleanUrl(url) {
+  if (!url) return null;
+  return url.replace(/^git\+/, "").replace(/^git:\/\//, "https://").replace(/\.git$/, "");
+}
+function pickLicense(value) {
+  if (!value) return null;
+  if (typeof value === "string") return value;
+  if (typeof value === "object" && "type" in value) return String(value.type);
+  return null;
+}
+function toDate(value) {
+  if (typeof value !== "string") return null;
+  const ms = Date.parse(value);
+  return Number.isNaN(ms) ? null : new Date(ms);
+}
+function parseNpmRegistry(json) {
+  const latest = json?.["dist-tags"]?.latest ?? null;
+  const latestManifest = latest ? json?.versions?.[latest] ?? {} : {};
+  const time = json?.time ?? {};
+  const repository = json?.repository ?? latestManifest?.repository;
+  const homepage = json?.homepage ?? latestManifest?.homepage ?? null;
+  const { repoUrl, repo } = normalizeRepoUrl(repository, homepage);
+  const deprecated = Boolean(latestManifest?.deprecated ?? json?.deprecated);
+  const maintainers = Array.isArray(json?.maintainers) ? json.maintainers.length : null;
+  const name = json?.name ?? "";
+  return {
+    name,
+    description: json?.description ?? latestManifest?.description ?? null,
+    latestVersion: latest,
+    license: pickLicense(json?.license ?? latestManifest?.license),
+    homepage,
+    repo,
+    repoUrl,
+    firstPublishedAt: toDate(time?.created),
+    lastReleaseAt: toDate(latest ? time?.[latest] : null) ?? toDate(time?.modified),
+    deprecated,
+    maintainersCount: maintainers,
+    readme: typeof json?.readme === "string" ? json.readme : null,
+    keywords: parseKeywords(json?.keywords ?? latestManifest?.keywords),
+    hasTypes: detectTypes(name, latestManifest),
+    hasTestScript: detectTestScript(latestManifest),
+    directDependenciesCount: countDeps(latestManifest?.dependencies),
+    hasProvenance: detectProvenance(latestManifest),
+    hasInstallScripts: detectInstallScripts(latestManifest),
+    hasBrowserField: latestManifest?.browser != null,
+    peerDependencies: parseDepMap(latestManifest?.peerDependencies),
+    peerDependenciesMeta: parsePeerMeta(latestManifest?.peerDependenciesMeta),
+    engines: parseDepMap(latestManifest?.engines),
+    versionTimeline: parseVersionTimeline(json)
+  };
+}
+function parseDepMap(value) {
+  if (!value || typeof value !== "object") return null;
+  const out = {};
+  for (const [name, range] of Object.entries(value)) {
+    if (typeof range === "string" && range.trim() !== "") out[name] = range;
+  }
+  return Object.keys(out).length ? out : null;
+}
+function parsePeerMeta(value) {
+  if (!value || typeof value !== "object") return null;
+  const out = {};
+  for (const [name, meta] of Object.entries(value)) {
+    if (meta && typeof meta === "object" && "optional" in meta) {
+      out[name] = { optional: Boolean(meta.optional) };
+    }
+  }
+  return Object.keys(out).length ? out : null;
+}
+function detectInstallScripts(manifest) {
+  const scripts = manifest?.scripts;
+  if (!scripts || typeof scripts !== "object") return false;
+  return ["preinstall", "install", "postinstall"].some(
+    (hook) => typeof scripts[hook] === "string" && scripts[hook].trim() !== ""
+  );
+}
+function parseVersionTimeline(json) {
+  const versions = json?.versions;
+  if (!versions || typeof versions !== "object") return [];
+  const time = json?.time ?? {};
+  return Object.keys(versions).map((version) => ({
+    version,
+    publishedAt: toDate(time?.[version]),
+    // Already in this document — no second fetch, no per-version round trip.
+    peerDependencies: parseDepMap(versions[version]?.peerDependencies),
+    engines: parseDepMap(versions[version]?.engines)
+  })).sort((a, b) => (b.publishedAt?.getTime() ?? 0) - (a.publishedAt?.getTime() ?? 0));
+}
+function parseKeywords(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((k) => typeof k === "string");
+}
+function detectTypes(name, manifest) {
+  if (typeof manifest?.types === "string" || typeof manifest?.typings === "string") return true;
+  if (name.startsWith("@types/")) return true;
+  const exportsField = manifest?.exports;
+  if (exportsField && typeof exportsField === "object") {
+    const serialized = JSON.stringify(exportsField);
+    if (serialized.includes('"types"')) return true;
+  }
+  return false;
+}
+function detectTestScript(manifest) {
+  const test = manifest?.scripts?.test;
+  if (typeof test !== "string" || test.trim() === "") return false;
+  return !/no test specified/i.test(test);
+}
+function countDeps(deps) {
+  if (!deps || typeof deps !== "object") return 0;
+  return Object.keys(deps).length;
+}
+function detectProvenance(manifest) {
+  return Boolean(manifest?.dist?.attestations);
+}
+async function fetchNpmRegistry(name, fetchImpl) {
+  const url = `https://${HOST}/${encodeNpmName(name)}`;
+  const { data } = await httpGetJson(url, {
+    host: HOST,
+    ttlMs: CACHE_TTL.npmRegistry,
+    fetchImpl
+  });
+  return parseNpmRegistry(data);
+}
+async function fetchNpmCompatAtVersion(name, version, fetchImpl) {
+  const url = `https://${HOST}/${encodeNpmName(name)}`;
+  try {
+    const { data } = await httpGetJson(url, {
+      host: HOST,
+      ttlMs: CACHE_TTL.npmRegistry,
+      fetchImpl
+    });
+    const latest = data?.["dist-tags"]?.latest ?? null;
+    const wanted = version ? data?.versions?.[version] ? version : null : latest && data?.versions?.[latest] ? latest : null;
+    if (!wanted) return null;
+    const manifest = data.versions[wanted] ?? {};
+    return {
+      version: wanted,
+      peerDependencies: parseDepMap(manifest.peerDependencies),
+      peerDependenciesMeta: parsePeerMeta(manifest.peerDependenciesMeta),
+      engines: parseDepMap(manifest.engines)
+    };
+  } catch {
+    return null;
+  }
+}
+async function npmVersionExists(name, version, fetchImpl) {
+  const url = `https://${HOST}/${encodeNpmName(name)}`;
+  try {
+    const { data } = await httpGetJson(url, {
+      host: HOST,
+      ttlMs: CACHE_TTL.npmRegistry,
+      fetchImpl
+    });
+    if (!data?.versions || typeof data.versions !== "object") return null;
+    return Object.prototype.hasOwnProperty.call(data.versions, version);
+  } catch {
+    return null;
+  }
+}
+async function npmPackageExists(name, fetchImpl) {
+  const url = `https://${HOST}/${encodeNpmName(name)}`;
+  try {
+    const { status } = await httpGetJson(url, {
+      host: HOST,
+      ttlMs: 0,
+      retries: 1,
+      fetchImpl
+    });
+    return status === 200;
+  } catch (err) {
+    if (err && typeof err === "object" && "status" in err && err.status === 404) {
+      return false;
+    }
+    throw err;
+  }
+}
+
+export {
+  encodeNpmName,
+  fetchNpmRegistry,
+  fetchNpmCompatAtVersion,
+  npmVersionExists,
+  npmPackageExists
+};