lurqrun 0.1.6 → 0.1.8

package/dist/chunk-O4KHCV6I.js

@@ -0,0 +1,320 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  handleDiffSurface
+} from "./chunk-BJT2LHAR.js";
+import {
+  getPackageByName
+} from "./chunk-NPVN2THM.js";
+import {
+  enqueueSurface
+} from "./chunk-ONDVTXUO.js";
+import {
+  packages,
+  surfaceQueue
+} from "./chunk-4JHDSVIN.js";
+import {
+  require_semver
+} from "./chunk-3GHJR7XR.js";
+import {
+  logger
+} from "./chunk-MYGSLK44.js";
+import {
+  __toESM,
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/mcp/publicUpgrades.ts
+init_esm_shims();
+var import_semver = __toESM(require_semver(), 1);
+import { and as and2, count, desc as desc2, gte, isNotNull as isNotNull2, sql } from "drizzle-orm";
+
+// src/mcp/publicSet.ts
+init_esm_shims();
+import { and, desc, isNotNull } from "drizzle-orm";
+var PUBLIC_TOP_LIMIT = 5e3;
+var NPM_NAME = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i;
+function validPackageName(name) {
+  return name.length > 0 && name.length <= 214 && NPM_NAME.test(name);
+}
+var floor = null;
+async function publicDownloadFloor(db) {
+  if (floor && Date.now() - floor.at < 36e5) return floor.value;
+  const rows = await db.select({ downloads: packages.weeklyDownloads }).from(packages).where(and(isNotNull(packages.weeklyDownloads), isNotNull(packages.healthScore))).orderBy(desc(packages.weeklyDownloads)).offset(PUBLIC_TOP_LIMIT - 1).limit(1);
+  floor = { at: Date.now(), value: Number(rows[0]?.downloads ?? 0) };
+  return floor.value;
+}
+async function publicPackageRow(db, name) {
+  const [row, min] = await Promise.all([getPackageByName(db, name), publicDownloadFloor(db)]);
+  if (!row || row.healthScore === null || (row.weeklyDownloads ?? 0) < min) return null;
+  return row;
+}
+
+// src/mcp/publicUpgrades.ts
+var PAIRS_PER_PACKAGE = 3;
+var LIST_CAP = 500;
+function majorPairs(latest, keep = PAIRS_PER_PACKAGE) {
+  const sorted = [...latest].sort((a, b) => a.major - b.major);
+  const pairs = [];
+  for (let i = 1; i < sorted.length; i++) {
+    const from = sorted[i - 1];
+    const to = sorted[i];
+    pairs.push({
+      fromMajor: from.major,
+      toMajor: to.major,
+      fromVersion: from.version,
+      toVersion: to.version,
+      ready: from.stored && to.stored
+    });
+  }
+  return pairs.slice(-keep);
+}
+function unextractedSides(latest, keep = PAIRS_PER_PACKAGE) {
+  if (latest.length < 2) return [];
+  const involved = [...latest].sort((a, b) => a.major - b.major).slice(-(keep + 1));
+  return involved.reverse().filter((l) => !l.stored && !l.attempted).map((l) => l.version);
+}
+function upgradeVerdict(d) {
+  if (d.inconclusive) return "unknown";
+  if (d.removed.length > 0 || d.renamed.length > 0) return "removes-exports";
+  if (d.arityChanged.length > 0) return "arity-changed";
+  if (d.typeOnlyRemoved.length > 0) return "types-only";
+  return "clean";
+}
+function toPublicUpgrade(pkg, pair, diff) {
+  const renamedPaths = new Set(diff.renamed.map((r) => r.path));
+  const removed = diff.removed.filter((r) => !renamedPaths.has(r.path));
+  const lists = [
+    removed,
+    diff.renamed,
+    diff.arityChanged,
+    diff.typeOnlyRemoved,
+    diff.deprecated
+  ];
+  const cap = (xs) => xs.slice(0, LIST_CAP);
+  return {
+    package: pkg,
+    pair,
+    status: "ready",
+    verdict: upgradeVerdict({ ...diff, removed }),
+    removed: cap(removed.map((r) => ({ path: r.path, kind: r.kind }))),
+    renamed: cap(diff.renamed),
+    arityChanged: cap(diff.arityChanged),
+    typeOnlyRemoved: cap(diff.typeOnlyRemoved),
+    deprecated: cap(diff.deprecated),
+    added: diff.added.length,
+    truncated: lists.some((l) => l.length > LIST_CAP),
+    tier: diff.tier ?? null,
+    inconclusive: diff.inconclusive ?? null,
+    observedAt: diff.observedAt ? new Date(diff.observedAt).toISOString() : null
+  };
+}
+function pendingUpgrade(pkg, pair) {
+  return {
+    package: pkg,
+    pair,
+    status: "pending",
+    verdict: "unknown",
+    removed: [],
+    renamed: [],
+    arityChanged: [],
+    typeOnlyRemoved: [],
+    deprecated: [],
+    added: 0,
+    truncated: false,
+    tier: null,
+    inconclusive: "Both versions are queued for extraction. NOT evidence that nothing changed.",
+    observedAt: null
+  };
+}
+function rowsOf(result) {
+  return result.rows ?? result;
+}
+async function latestOfMajors(db, names) {
+  const out = /* @__PURE__ */ new Map();
+  if (names.length === 0) return out;
+  const result = await db.execute(sql`
+    with stable as (
+      select package_name, version, (regexp_match(version, '^([0-9]+)\\.'))[1]::int as major
+      from package_versions
+      where package_name in (${sql.join(
+    names.map((n) => sql`${n}`),
+    sql`, `
+  )})
+        -- Stable releases only: an upgrade does not land on a prerelease.
+        and version ~ '^[0-9]+\\.[0-9]+\\.[0-9]+$'
+    ),
+    latest as (
+      select distinct on (package_name, major) package_name, major, version
+      from stable
+      -- Numeric, not lexical (16.10.0 is newer than 16.9.0), and numeric rather
+      -- than int so a date-stamped version cannot overflow the cast.
+      order by package_name, major, string_to_array(version, '.')::numeric[] desc
+    )
+    select
+      l.package_name,
+      l.major,
+      l.version,
+      exists (
+        select 1 from entities e
+        join symbols s on s.entity_id = e.id and s.tier = 'shipped_js_ast'
+        where e.canonical_key = 'package_surface:npm:' || l.package_name || ':' || l.version
+          and e.tenant_id = 0
+      ) as stored,
+      exists (
+        select 1 from entities e
+        where e.canonical_key = 'package_surface:npm:' || l.package_name || ':' || l.version
+          and e.tenant_id = 0
+      ) as attempted
+    from latest l
+  `);
+  for (const r of rowsOf(result)) {
+    const list = out.get(r.package_name) ?? [];
+    list.push({
+      major: Number(r.major),
+      version: r.version,
+      stored: Boolean(r.stored),
+      attempted: Boolean(r.attempted)
+    });
+    out.set(r.package_name, list);
+  }
+  return out;
+}
+async function upgradePairsFor(db, name) {
+  return majorPairs((await latestOfMajors(db, [name])).get(name) ?? []);
+}
+async function upgradeGuideFor(db, pkg, fromVersion, toVersion, webUrl) {
+  const from = import_semver.default.coerce(fromVersion)?.major;
+  const to = import_semver.default.coerce(toVersion)?.major;
+  if (from === void 0 || to === void 0 || to <= from) return null;
+  if (!await publicPackageRow(db, pkg)) return null;
+  const pair = (await upgradePairsFor(db, pkg)).find(
+    (p) => p.fromMajor === from && p.toMajor === to && p.ready
+  );
+  if (!pair) return null;
+  const path = `/npm/${pkg.split("/").map(encodeURIComponent).join("/")}/${from}-to-${to}`;
+  return {
+    url: `${webUrl.replace(/\/$/, "")}${path}`,
+    fromVersion: pair.fromVersion,
+    toVersion: pair.toVersion
+  };
+}
+async function publicNames(db, limit = PUBLIC_TOP_LIMIT) {
+  const min = await publicDownloadFloor(db);
+  const rows = await db.select({ name: packages.name }).from(packages).where(and2(isNotNull2(packages.healthScore), gte(packages.weeklyDownloads, min))).orderBy(desc2(packages.weeklyDownloads)).limit(limit);
+  return rows.map((r) => r.name);
+}
+var QUEUE_HEADROOM = 20;
+async function enqueuePublicUpgrades(db, opts = {}) {
+  const [{ pending } = { pending: 0 }] = await db.select({ pending: count() }).from(surfaceQueue);
+  let budget = QUEUE_HEADROOM - Number(pending);
+  if (budget <= 0) return 0;
+  const names = await publicNames(db, opts.packages ?? 1e3);
+  let queued = 0;
+  for (let i = 0; i < names.length && budget > 0; i += 250) {
+    const chunk = names.slice(i, i + 250);
+    const latest = await latestOfMajors(db, chunk);
+    for (const name of chunk) {
+      for (const version of unextractedSides(latest.get(name) ?? [])) {
+        if (budget <= 0) break;
+        await enqueueSurface(db, name, version);
+        queued++;
+        budget--;
+      }
+      if (budget <= 0) break;
+    }
+  }
+  return queued;
+}
+function registerPublicUpgradeRoutes(app, db, limiter) {
+  const cacheable = (res) => res.setHeader("Cache-Control", "public, max-age=3600, s-maxage=86400");
+  app.get("/public/upgrade", limiter, async (req, res) => {
+    const name = typeof req.query.name === "string" ? req.query.name.trim() : "";
+    const from = Number(req.query.from);
+    const to = Number(req.query.to);
+    if (!validPackageName(name) || !Number.isInteger(from) || !Number.isInteger(to) || from < 0 || to <= from) {
+      res.status(400).json({ error: "Give an npm package name and two majors, from < to." });
+      return;
+    }
+    try {
+      if (!await publicPackageRow(db, name)) {
+        res.status(404).json({ error: "No public upgrade pages for that package." });
+        return;
+      }
+      const pairs = await upgradePairsFor(db, name);
+      const pair = pairs.find((p) => p.fromMajor === from && p.toMajor === to);
+      if (!pair) {
+        res.status(404).json({ error: "No upgrade page for that version jump.", pairs });
+        return;
+      }
+      if (!pair.ready) {
+        await Promise.all([
+          enqueueSurface(db, name, pair.fromVersion),
+          enqueueSurface(db, name, pair.toVersion)
+        ]).catch(() => {
+        });
+        res.setHeader("Cache-Control", "public, max-age=300, s-maxage=900");
+        res.json(pendingUpgrade(name, pair));
+        return;
+      }
+      const diff = await handleDiffSurface(db, {
+        package: name,
+        fromVersion: pair.fromVersion,
+        toVersion: pair.toVersion
+      });
+      const body = toPublicUpgrade(name, pair, diff);
+      if (body.verdict === "unknown")
+        res.setHeader("Cache-Control", "public, max-age=300, s-maxage=900");
+      else cacheable(res);
+      res.json(body);
+    } catch (err) {
+      logger.error("public upgrade read failed:", err instanceof Error ? err.message : String(err));
+      res.status(500).json({ error: "Could not read that upgrade." });
+    }
+  });
+  let index = null;
+  app.get("/public/upgrades", limiter, async (_req, res) => {
+    try {
+      if (!index || Date.now() - index.at > 36e5) {
+        const names = await publicNames(db);
+        const value = [];
+        for (let i = 0; i < names.length; i += 500) {
+          const chunk = names.slice(i, i + 500);
+          const latest = await latestOfMajors(db, chunk);
+          for (const name of chunk) {
+            const ready = majorPairs(latest.get(name) ?? []).filter((p) => p.ready);
+            if (ready.length) value.push({ package: name, pairs: ready });
+          }
+        }
+        index = { at: Date.now(), value };
+      }
+      cacheable(res);
+      res.json({ upgrades: index.value });
+    } catch (err) {
+      logger.error(
+        "public upgrade index failed:",
+        err instanceof Error ? err.message : String(err)
+      );
+      res.status(500).json({ error: "Could not list upgrade pages." });
+    }
+  });
+}
+
+export {
+  PUBLIC_TOP_LIMIT,
+  validPackageName,
+  publicDownloadFloor,
+  publicPackageRow,
+  PAIRS_PER_PACKAGE,
+  LIST_CAP,
+  majorPairs,
+  unextractedSides,
+  upgradeVerdict,
+  toPublicUpgrade,
+  pendingUpgrade,
+  latestOfMajors,
+  upgradePairsFor,
+  upgradeGuideFor,
+  QUEUE_HEADROOM,
+  enqueuePublicUpgrades,
+  registerPublicUpgradeRoutes
+};

package/dist/chunk-ONDVTXUO.js

@@ -0,0 +1,240 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  UNBOUNDED_ARITY,
+  claims,
+  entities,
+  observations,
+  packages,
+  surfaceQueue,
+  symbols
+} from "./chunk-4JHDSVIN.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/db/surface.ts
+init_esm_shims();
+import { and as and2, desc, eq as eq2, isNotNull, isNull as isNull2, sql } from "drizzle-orm";
+
+// src/db/graph.ts
+init_esm_shims();
+import { and, eq, isNull } from "drizzle-orm";
+import { createHash } from "crypto";
+
+// src/graph/types.ts
+init_esm_shims();
+function canonicalKey(ref) {
+  return `${ref.kind}:${ref.namespace}:${ref.name}:${ref.version ?? ""}`;
+}
+
+// src/db/graph.ts
+async function upsertEntity(db, ref, tenantId = 0) {
+  const key = canonicalKey(ref);
+  const [row] = await db.insert(entities).values({
+    kind: ref.kind,
+    namespace: ref.namespace,
+    name: ref.name,
+    version: ref.version ?? null,
+    canonicalKey: key,
+    tenantId
+  }).onConflictDoUpdate({
+    target: [entities.canonicalKey, entities.tenantId],
+    set: { canonicalKey: key }
+  }).returning();
+  return row;
+}
+async function upsertClaim(db, args) {
+  const objectId = args.objectId ?? null;
+  const envId = args.environmentId ?? null;
+  const tenantId = args.tenantId ?? 0;
+  const existing = await db.select().from(claims).where(
+    and(
+      eq(claims.subjectId, args.subjectId),
+      objectId === null ? isNull(claims.objectId) : eq(claims.objectId, objectId),
+      eq(claims.relation, args.relation),
+      envId === null ? isNull(claims.environmentId) : eq(claims.environmentId, envId),
+      eq(claims.tenantId, tenantId)
+    )
+  ).limit(1);
+  if (existing[0]) return existing[0];
+  const [row] = await db.insert(claims).values({
+    subjectId: args.subjectId,
+    objectId,
+    relation: args.relation,
+    environmentId: envId,
+    tenantId
+  }).returning();
+  return row;
+}
+async function recordObservation(db, args) {
+  await db.insert(observations).values({
+    claimId: args.claimId,
+    verdict: args.verdict,
+    class: args.class ?? "executed",
+    tier: args.tier ?? null,
+    evidence: args.evidence ?? null,
+    oracleId: args.oracleId,
+    oracleVer: args.oracleVer,
+    costMillis: args.costMillis ?? null
+  });
+}
+
+// src/db/surface.ts
+function surfaceRef(pkg, version) {
+  return { kind: "package_surface", namespace: "npm", name: pkg, version };
+}
+function mcpSurfaceRef(server, version) {
+  return { kind: "mcp_server", namespace: "npm", name: server, version };
+}
+async function isExtractionCached(db, ref, artifactHash, extractorVersion, tier = "shipped_js_ast", tenantId = 0) {
+  const row = await upsertEntity(db, ref, tenantId);
+  if (row.artifactHash !== artifactHash) return false;
+  const existing = await db.select({ id: symbols.id }).from(symbols).where(and2(eq2(symbols.entityId, row.id), eq2(symbols.tier, tier))).limit(1);
+  if (existing.length === 0) return false;
+  const seen = await db.select({ oracleVer: observations.oracleVer }).from(observations).innerJoin(claims, eq2(claims.id, observations.claimId)).where(
+    and2(
+      eq2(claims.subjectId, row.id),
+      eq2(claims.relation, "exposes"),
+      eq2(observations.tier, tier)
+    )
+  ).orderBy(desc(observations.observedAt)).limit(1);
+  return seen[0]?.oracleVer === extractorVersion;
+}
+async function storeSurface(db, surface, opts = {
+  extractorVersion: "1"
+}) {
+  const tenantId = opts.tenantId ?? 0;
+  const ref = opts.ref ?? surfaceRef(surface.package, surface.version);
+  const entity = await upsertEntity(db, ref, tenantId);
+  if (opts.artifactHash) {
+    await db.update(entities).set({ artifactHash: opts.artifactHash }).where(eq2(entities.id, entity.id));
+  }
+  const claim = await upsertClaim(db, {
+    subjectId: entity.id,
+    relation: "exposes",
+    // Declared claims are environment-independent: a shipped-JS surface reads
+    // identically on every machine, so no fingerprint is attached (§5).
+    environmentId: null,
+    tenantId
+  });
+  const undeclared = surface.symbols.length === 0;
+  await recordObservation(db, {
+    claimId: claim.id,
+    verdict: undeclared ? "undeclared" : "verified_true",
+    class: "declared",
+    tier: surface.tier,
+    evidence: undeclared ? surface.undeclaredReason ?? "no symbols extracted" : `${surface.symbols.length} symbols from ${surface.filesWalked} file(s), entry ${surface.entry}`,
+    oracleId: opts.oracleId ?? "surface.tier_a",
+    oracleVer: opts.extractorVersion
+  });
+  if (undeclared) return { entityId: entity.id, symbolsWritten: 0, verdict: "undeclared" };
+  await db.delete(symbols).where(and2(eq2(symbols.entityId, entity.id), eq2(symbols.tier, surface.tier)));
+  const rows = surface.symbols.map((s) => ({
+    entityId: entity.id,
+    path: s.path,
+    kind: s.kind,
+    arity: s.arity,
+    origin: s.origin,
+    deprecated: s.deprecated,
+    tier: s.tier,
+    signature: s.signature ?? null,
+    sourceFile: s.sourceRef?.file ?? null,
+    sourceLine: s.sourceRef?.line ?? null,
+    sourceOffset: s.sourceRef?.offset ?? null,
+    maxArity: s.maxArity === void 0 ? null : s.maxArity ?? UNBOUNDED_ARITY
+  }));
+  for (let i = 0; i < rows.length; i += 500) {
+    await db.insert(symbols).values(rows.slice(i, i + 500)).onConflictDoNothing();
+  }
+  return { entityId: entity.id, symbolsWritten: rows.length, verdict: "verified_true" };
+}
+function specKey(pkg, version, kind = "package_surface") {
+  const base = `${pkg}@${version ?? "latest"}`;
+  return kind === "package_surface" ? base : `${kind}:${base}`;
+}
+async function getPackagesMissingGraphSurface(db, limit, opts = {}) {
+  const order = opts.byDownloads ? sql`${packages.weeklyDownloads} desc nulls last` : sql`random()`;
+  const rows = await db.select({ name: packages.name, version: packages.latestVersion }).from(packages).leftJoin(
+    entities,
+    and2(
+      eq2(entities.kind, "package_surface"),
+      eq2(entities.name, packages.name),
+      eq2(entities.version, packages.latestVersion)
+    )
+  ).where(and2(isNotNull(packages.latestVersion), isNull2(entities.id))).orderBy(order).limit(limit);
+  return rows.filter((r) => r.version !== null);
+}
+async function enqueueSurface(db, pkg, version, kind = "package_surface") {
+  await db.insert(surfaceQueue).values({ packageName: pkg, version, kind, specKey: specKey(pkg, version, kind) }).onConflictDoNothing();
+}
+async function getPendingSurfaces(db, limit = 10, kind = "package_surface") {
+  return db.select().from(surfaceQueue).where(
+    and2(
+      eq2(surfaceQueue.kind, kind),
+      // Specs backing off after a failure wait their turn instead of sitting
+      // at the head of an oldest-first queue every cycle.
+      sql`(${surfaceQueue.nextAttemptAt} is null or ${surfaceQueue.nextAttemptAt} <= now())`
+    )
+  ).orderBy(surfaceQueue.requestedAt).limit(limit);
+}
+async function surfaceQueueDepth(db) {
+  const [row] = await db.select({ n: sql`count(*)::int` }).from(surfaceQueue);
+  return Number(row?.n ?? 0);
+}
+async function dropSurfaceQueue(db, id) {
+  await db.delete(surfaceQueue).where(eq2(surfaceQueue.id, id));
+}
+async function bumpSurfaceAttempt(db, id) {
+  await db.update(surfaceQueue).set({
+    attempts: sql`${surfaceQueue.attempts} + 1`,
+    nextAttemptAt: sql`now() + interval '15 minutes' * power(4, ${surfaceQueue.attempts})`
+  }).where(eq2(surfaceQueue.id, id));
+}
+async function hasStoredSurface(db, pkg, version, tier = "shipped_js_ast", tenantId = 0, kind = "package_surface") {
+  const key = canonicalKey(
+    kind === "mcp_server" ? mcpSurfaceRef(pkg, version) : surfaceRef(pkg, version)
+  );
+  const [row] = await db.select({ id: entities.id }).from(entities).where(and2(eq2(entities.canonicalKey, key), eq2(entities.tenantId, tenantId))).limit(1);
+  if (!row) return false;
+  const [sym] = await db.select({ id: symbols.id }).from(symbols).where(and2(eq2(symbols.entityId, row.id), eq2(symbols.tier, tier))).limit(1);
+  return sym !== void 0;
+}
+async function enqueuePreviousSurface(db, pkg, version, history, kind = "package_surface") {
+  const previous = previousVersion(history, version);
+  if (previous === null) return false;
+  const tier = kind === "mcp_server" ? "mcp_tools_list" : "shipped_js_ast";
+  if (await hasStoredSurface(db, pkg, previous, tier, 0, kind)) return false;
+  await enqueueSurface(db, pkg, previous, kind);
+  return true;
+}
+function previousVersion(history, version) {
+  const idx = history.findIndex((h) => h.version === version);
+  if (idx === -1 || idx + 1 >= history.length) return null;
+  return history[idx + 1].version ?? null;
+}
+async function getMcpServerNames(db, tenantId = 0) {
+  const rows = await db.selectDistinct({ name: entities.name }).from(entities).where(and2(eq2(entities.kind, "mcp_server"), eq2(entities.tenantId, tenantId)));
+  return rows.map((r) => r.name);
+}
+
+export {
+  canonicalKey,
+  upsertEntity,
+  upsertClaim,
+  recordObservation,
+  surfaceRef,
+  mcpSurfaceRef,
+  isExtractionCached,
+  storeSurface,
+  specKey,
+  getPackagesMissingGraphSurface,
+  enqueueSurface,
+  getPendingSurfaces,
+  surfaceQueueDepth,
+  dropSurfaceQueue,
+  bumpSurfaceAttempt,
+  hasStoredSurface,
+  enqueuePreviousSurface,
+  previousVersion,
+  getMcpServerNames
+};