lurqrun 0.1.6 → 0.1.7

package/dist/chunk-B43LCXBM.js

@@ -0,0 +1,223 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  PACKAGE_NAME,
+  VERSION
+} from "./chunk-GPTKSNR6.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/github/workflow.ts
+init_esm_shims();
+var WORKFLOW_PATH = ".github/workflows/lurq-upgrade.yml";
+function cliSpec(version = VERSION) {
+  const [major = "0", minor = "0"] = version.split(".");
+  return major === "0" ? `${PACKAGE_NAME}@${major}.${minor}` : `${PACKAGE_NAME}@${major}`;
+}
+var DEFAULT_CRON = "0 6 * * 1";
+function detectInstallCommand(lockfiles) {
+  if (lockfiles.includes("pnpm-lock.yaml")) return "pnpm install --frozen-lockfile";
+  if (lockfiles.includes("yarn.lock")) return "yarn install --frozen-lockfile";
+  if (lockfiles.includes("bun.lockb") || lockfiles.includes("bun.lock")) return "bun install";
+  if (lockfiles.includes("package-lock.json")) return "npm ci";
+  return "npm install";
+}
+function renderWorkflow(opts = {}) {
+  const cron = opts.cron ?? DEFAULT_CRON;
+  const install = opts.installCommand ?? "npm ci";
+  const max = opts.maxUpgrades ?? 3;
+  const mode = opts.armed ? "pr" : "comment";
+  const autoMerge = opts.autoMerge ?? false;
+  const cli = cliSpec();
+  return `# Managed by lurq, https://lurq.run
+#
+# Keeps this repository's dependencies current and rewrites the call sites an
+# upgrade breaks. lurq itself has read-only access to your code; every write
+# below is made by this workflow's own GITHUB_TOKEN, scoped by the permissions
+# block. Delete this file to turn the autopilot off.
+name: lurq upgrade
+
+on:
+  schedule:
+    - cron: "${cron}"
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: "comment = analyse only \xB7 pr = open pull requests"
+        type: choice
+        options: [comment, pr]
+        default: ${mode}
+
+# The blast radius. \`contents: write\` permits pushing a BRANCH; branch
+# protection on your default branch is what stops anything landing unreviewed.
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: lurq-upgrade-\${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  upgrade:
+    runs-on: ubuntu-latest
+    env:
+      LURQ_MODE: \${{ inputs.mode || vars.LURQ_MODE || '${mode}' }}
+      MAX_UPGRADES: "${max}"
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      # 1. What is behind, and what does each upgrade remove from its API?
+      #    Sends only the dependency ranges already public in package.json.
+      - name: Plan
+        env:
+          LURQ_API_KEY: \${{ secrets.LURQ_API_KEY }}
+        run: npx -y ${cli} upgrade-plan . --json > lurq-plan.json
+
+      # 2. Narrow that to symbols THIS repo references. Runs entirely locally
+      #    against both versions' npm tarballs, no API key, no test suite.
+      #
+      #    \`--report\` is the only part that talks to us, and it is additive: it
+      #    posts what this check concluded so your dashboard can show it. A
+      #    missing key or an unreachable API prints a line and changes nothing
+      #    else, so the gate keeps working exactly as it does without it.
+      - name: Check against this codebase
+        env:
+          LURQ_API_KEY: \${{ secrets.LURQ_API_KEY }}
+        run: npx -y ${cli} check-upgrade . --plan lurq-plan.json --report --json > lurq-brief.json
+
+      # The same report twice: once into the run summary, once as the body of
+      # the pull request. Fenced, because the report is aligned plain text and
+      # markdown would otherwise collapse its indentation into one paragraph.
+      - name: Summarise
+        run: |
+          npx -y ${cli} check-upgrade . --plan lurq-plan.json > lurq-report.txt
+          { echo '\`\`\`'; cat lurq-report.txt; echo '\`\`\`'; } > lurq-report.md
+          cat lurq-report.md >> "\${GITHUB_STEP_SUMMARY}"
+
+      # 3. Editing is opt-in. Until LURQ_MODE is 'pr', the job stops here having
+      #    changed nothing, the brief is in the run summary above, and no
+      #    Anthropic credential is needed to get this far.
+      - name: Check agent credentials
+        if: env.LURQ_MODE == 'pr'
+        env:
+          API_KEY: \${{ secrets.ANTHROPIC_API_KEY }}
+          OAUTH_TOKEN: \${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+        run: |
+          if [ -z "$API_KEY" ] && [ -z "$OAUTH_TOKEN" ]; then
+            echo "::error::pr mode needs one of ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN in this repository's secrets. A Claude Pro/Max subscription token works for the latter. Set LURQ_MODE=comment to run analysis only."
+            exit 1
+          fi
+
+      - name: Install dependencies
+        if: env.LURQ_MODE == 'pr'
+        run: ${install}
+
+      - name: Apply upgrades
+        if: env.LURQ_MODE == 'pr'
+        uses: anthropics/claude-code-action@v1
+        with:
+          # Either credential works; set whichever you have. An API key bills
+          # per token, an OAuth token uses an existing Claude Pro/Max plan.
+          # Unset secrets resolve to empty and are ignored by the action.
+          anthropic_api_key: \${{ secrets.ANTHROPIC_API_KEY }}
+          claude_code_oauth_token: \${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          prompt: |
+            REPO: \${{ github.repository }}
+
+            lurq-brief.json lists dependency upgrades this repository is behind
+            on. For each entry under "breaking", the "symbolsRemoved" array names
+            exports that DISAPPEAR at the target version, and each carries the
+            exact file and line where this repository uses it.
+
+            lurq-plan.json carries two more things per upgrade:
+              \xB7 "declaredIn", EVERY package.json declaring that dependency.
+                Bump all of them. Bumping only the root leaves a workspace
+                pinned to the old major, which typechecks and breaks on install.
+              \xB7 "hops", the migration sequence when the upgrade crosses two or
+                more majors, with what each step removes. Work the steps in
+                order; do not jump straight to the target version. When
+                "sequenceNote" is present, the sequence could not be planned,
+                treat that dependency as a migration and skip it.
+
+            Take at most \${{ env.MAX_UPGRADES }} entries, hardest first:
+
+            1. Bump the dependency's range in every manifest listed in
+               "declaredIn".
+            2. Run \`${install.split(" ")[0]} install\` so node_modules holds the
+               TARGET version. Until you do, the package on disk is the old one
+               and anything you read from it describes the API you are leaving.
+            3. Rewrite every listed call site. A removed symbol carrying
+               "renamedTo" has a replacement the package itself proves: at the
+               old version both names were exported from the same function, so
+               rename the call. Under "arityChanged", "callsBroken" names each
+               call whose argument count the new version no longer accepts, and
+               "unmeasured" names uses to read by hand. "typeErrors" lists the
+               compiler errors the new version introduces, at file and line;
+               after installing, \`tsc\` should report none of them.
+               "entriesRemoved" names deep imports the new version no longer
+               offers, and "moduleFormat" names require() uses that break
+               because the package is now an ES module. "requirements" names a
+               Node or peer version the new release needs and this repository
+               lacks: do not bump past it. For removed symbols
+               without "renamedTo", "newExports" on each entry names
+               the exports the target version ADDED, extracted from its shipped
+               JavaScript: that is where the replacement for a removed symbol
+               comes from. Confirm each one against the freshly installed package
+               under node_modules before you call it. You have NO network access
+               and no documentation: an API in neither the brief nor node_modules
+               is one you cannot verify, and writing it anyway is the failure
+               this whole job exists to prevent. Revert that dependency instead.
+            4. Run the repository's test script. If it fails and you cannot fix
+               it from the upgrade itself, revert that dependency and move on,
+               a reverted upgrade is a fine outcome, a broken build is not.
+            5. Leave the working tree with only the upgrades that pass.
+
+            Do not touch unrelated files. Do not change CI configuration. Do not
+            run git commands: the workflow handles version control.
+          claude_args: |
+            --allowedTools "Read,Edit,Write,Bash(${install.split(" ")[0]}:*)"
+
+      # 4. The workflow does version control, never the model.
+      - name: Open pull request
+        id: pr
+        if: env.LURQ_MODE == 'pr'
+        uses: peter-evans/create-pull-request@v7
+        with:
+          branch: lurq/upgrades
+          title: "chore(deps): lurq dependency upgrades"
+          commit-message: "chore(deps): upgrade dependencies and migrate call sites"
+          # The rendered report, not the raw JSON. A reviewer opening this PR
+          # reads what was removed and where it is used; the JSON is the agent's
+          # input, and pasting it here made the case for the change unreadable.
+          body-path: lurq-report.md
+          labels: dependencies
+          delete-branch: true
+${autoMerge ? MERGE_STEP : ""}`;
+}
+var MERGE_STEP = `
+      # 5. Auto-merge, per this repository's lurq policy. GitHub merges only
+      #    once the repo's OWN required checks pass; lurq never makes that call.
+      #    Requires "Allow auto-merge" in repository settings.
+      - name: Enable auto-merge
+        if: env.LURQ_MODE == 'pr' && steps.pr.outputs.pull-request-number
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: gh pr merge --auto --squash "\${{ steps.pr.outputs.pull-request-number }}"
+`;
+function newFileUrl(fullName, branch, content) {
+  const params = new URLSearchParams({ filename: WORKFLOW_PATH, value: content });
+  return `https://github.com/${fullName}/new/${encodeURIComponent(branch)}?${params.toString()}`;
+}
+
+export {
+  WORKFLOW_PATH,
+  cliSpec,
+  detectInstallCommand,
+  renderWorkflow,
+  newFileUrl
+};

package/dist/chunk-BCANRN5B.js

@@ -0,0 +1,33 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/github/types.ts
+init_esm_shims();
+var DEFAULT_REPO_POLICY = {
+  enabled: false,
+  scope: "blocking",
+  autoMerge: false
+};
+var UPGRADE_SEVERITIES = ["blocking", "warning", "ok", "unverified"];
+var UPGRADE_RUN_STATUSES = [
+  "checked",
+  "skipped",
+  "edited",
+  "pr_open",
+  "merged",
+  "failed"
+];
+var REPO_MANIFEST_CAP = 25;
+var REPO_DRIFT_DETAIL_CAP = 200;
+var TRANSITIVE_DETAIL_CAP = 100;
+
+export {
+  DEFAULT_REPO_POLICY,
+  UPGRADE_SEVERITIES,
+  UPGRADE_RUN_STATUSES,
+  REPO_MANIFEST_CAP,
+  REPO_DRIFT_DETAIL_CAP,
+  TRANSITIVE_DETAIL_CAP
+};

package/dist/chunk-BUALU27S.js

@@ -0,0 +1,123 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  require_semver
+} from "./chunk-3GHJR7XR.js";
+import {
+  __toESM,
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/compat/peerCompat.ts
+init_esm_shims();
+var import_semver = __toESM(require_semver(), 1);
+function satisfiesRange(version, range) {
+  if (!import_semver.default.validRange(range)) return null;
+  const v = import_semver.default.valid(version) ? version : import_semver.default.coerce(version)?.version;
+  if (!v) return null;
+  return import_semver.default.satisfies(v, range, { includePrerelease: true });
+}
+function rangesIntersect(a, b) {
+  if (!import_semver.default.validRange(a) || !import_semver.default.validRange(b)) return null;
+  try {
+    return import_semver.default.intersects(a, b, { includePrerelease: true });
+  } catch {
+    return null;
+  }
+}
+function resolveArchitectureCompat(members) {
+  const conflicts = [];
+  const pinned = /* @__PURE__ */ new Map();
+  for (const m of members) if (m.version) pinned.set(m.name, m.version);
+  const constraints = [];
+  for (const m of members) {
+    if (!m.peerDependencies) continue;
+    for (const [peer, range] of Object.entries(m.peerDependencies)) {
+      constraints.push({
+        requirer: m.name,
+        peer,
+        range,
+        optional: Boolean(m.peerDependenciesMeta?.[peer]?.optional)
+      });
+    }
+  }
+  for (const c of constraints) {
+    const pv = pinned.get(c.peer);
+    if (pv && satisfiesRange(pv, c.range) === false) {
+      conflicts.push({
+        source: "peer-deps",
+        packages: [c.requirer, c.peer],
+        detail: `${c.requirer} needs peer ${c.peer}@${c.range}, but the stack uses ${c.peer}@${pv}`,
+        requirement: { peer: c.peer, range: c.range, resolved: pv }
+      });
+    }
+  }
+  const byPeer = /* @__PURE__ */ new Map();
+  for (const c of constraints) {
+    if (pinned.has(c.peer) || c.optional) continue;
+    const arr = byPeer.get(c.peer);
+    if (arr) arr.push(c);
+    else byPeer.set(c.peer, [c]);
+  }
+  for (const [peer, cs] of byPeer) {
+    for (let i = 0; i < cs.length; i++) {
+      for (let j = i + 1; j < cs.length; j++) {
+        if (cs[i].range !== cs[j].range && rangesIntersect(cs[i].range, cs[j].range) === false) {
+          conflicts.push({
+            source: "peer-deps",
+            packages: [cs[i].requirer, cs[j].requirer],
+            detail: `${cs[i].requirer} needs ${peer}@${cs[i].range} but ${cs[j].requirer} needs ${peer}@${cs[j].range}, no overlapping version`,
+            // Two requirers disagreeing about a peer that isn't in the set: the
+            // peer has no resolved version to report.
+            requirement: { peer, range: cs[i].range, resolved: null }
+          });
+        }
+      }
+    }
+  }
+  const nodeReqs = members.map((m) => ({ name: m.name, range: m.engines?.node })).filter((r) => typeof r.range === "string");
+  for (let i = 0; i < nodeReqs.length; i++) {
+    for (let j = i + 1; j < nodeReqs.length; j++) {
+      if (rangesIntersect(nodeReqs[i].range, nodeReqs[j].range) === false) {
+        conflicts.push({
+          source: "engines",
+          packages: [nodeReqs[i].name, nodeReqs[j].name],
+          detail: `${nodeReqs[i].name} needs node ${nodeReqs[i].range} but ${nodeReqs[j].name} needs node ${nodeReqs[j].range}, no overlap`
+        });
+      }
+    }
+  }
+  return conflicts;
+}
+function resolveRuntimeEngineConflicts(members, nodeVersion) {
+  const runtime = normalizeNodeVersion(nodeVersion);
+  if (!runtime) return [];
+  const conflicts = [];
+  for (const m of members) {
+    const range = m.engines?.node;
+    if (!range) continue;
+    const ok = runtime.exact ? satisfiesRange(runtime.value, range) : rangesIntersect(runtime.value, range);
+    if (ok === false) {
+      conflicts.push({
+        source: "engines",
+        packages: [m.name],
+        detail: `${m.name}@${m.version ?? "?"} needs node ${range}, but the runtime is node ${runtime.label}`
+      });
+    }
+  }
+  return conflicts;
+}
+function normalizeNodeVersion(raw) {
+  const trimmed = raw.trim().replace(/^v/i, "");
+  if (!trimmed) return null;
+  if (import_semver.default.valid(trimmed)) return { value: trimmed, exact: true, label: trimmed };
+  if (/^\d+(\.\d+)?$/.test(trimmed)) {
+    return { value: `${trimmed}.x`, exact: false, label: trimmed };
+  }
+  const coerced = import_semver.default.coerce(trimmed);
+  return coerced ? { value: coerced.version, exact: true, label: coerced.version } : null;
+}
+
+export {
+  resolveArchitectureCompat,
+  resolveRuntimeEngineConflicts
+};