lurqrun 0.1.6 → 0.1.8

package/dist/mcpScan-ULP626TQ.js

@@ -0,0 +1,1735 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  ReadBuffer,
+  serializeMessage
+} from "./chunk-NEZNAPPN.js";
+import {
+  analyzeServer,
+  analyzeStackScan,
+  diffSnapshots,
+  sortFindings,
+  worst
+} from "./chunk-IFNONGRQ.js";
+import {
+  isCrowded
+} from "./chunk-FDFPMBCA.js";
+import {
+  Client,
+  LIMITS,
+  addPrompts,
+  addTemplates,
+  addTools,
+  contentHash,
+  emptySnapshot
+} from "./chunk-XIFQIFSZ.js";
+import "./chunk-XLXPVN3Y.js";
+import {
+  readServerConfigs,
+  scrub,
+  scrubDeep
+} from "./chunk-XGOV6KV4.js";
+import "./chunk-63MUJNZL.js";
+import "./chunk-QKGYDMWB.js";
+import {
+  classifyError
+} from "./chunk-53SG6XWA.js";
+import {
+  SSEClientTransport,
+  StreamableHTTPClientTransport,
+  StreamableHTTPError
+} from "./chunk-X4W64MHU.js";
+import {
+  array,
+  looseObject,
+  string,
+  unknown
+} from "./chunk-D3K6IZVR.js";
+import "./chunk-6EQ3ARXA.js";
+import "./chunk-SHCEBP3J.js";
+import {
+  SEVERITY_RANK
+} from "./chunk-Q5VPF4WI.js";
+import {
+  pMap
+} from "./chunk-4ESO33J6.js";
+import "./chunk-WHX2ZFCG.js";
+import {
+  bold,
+  dim,
+  green,
+  red,
+  table,
+  yellow
+} from "./chunk-4KCPOMG6.js";
+import {
+  RemoteError,
+  uploadMcpScan
+} from "./chunk-OTJFHESY.js";
+import {
+  lurqHome,
+  resolveApiKey
+} from "./chunk-J6XQ7OPZ.js";
+import {
+  VERSION
+} from "./chunk-72Y2FDVS.js";
+import {
+  __commonJS,
+  __require,
+  __toESM,
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// node_modules/isexe/windows.js
+var require_windows = __commonJS({
+  "node_modules/isexe/windows.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    module.exports = isexe;
+    isexe.sync = sync;
+    var fs = __require("fs");
+    function checkPathExt(path, options) {
+      var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
+      if (!pathext) {
+        return true;
+      }
+      pathext = pathext.split(";");
+      if (pathext.indexOf("") !== -1) {
+        return true;
+      }
+      for (var i = 0; i < pathext.length; i++) {
+        var p = pathext[i].toLowerCase();
+        if (p && path.substr(-p.length).toLowerCase() === p) {
+          return true;
+        }
+      }
+      return false;
+    }
+    function checkStat(stat, path, options) {
+      if (!stat.isSymbolicLink() && !stat.isFile()) {
+        return false;
+      }
+      return checkPathExt(path, options);
+    }
+    function isexe(path, options, cb) {
+      fs.stat(path, function(er, stat) {
+        cb(er, er ? false : checkStat(stat, path, options));
+      });
+    }
+    function sync(path, options) {
+      return checkStat(fs.statSync(path), path, options);
+    }
+  }
+});
+
+// node_modules/isexe/mode.js
+var require_mode = __commonJS({
+  "node_modules/isexe/mode.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    module.exports = isexe;
+    isexe.sync = sync;
+    var fs = __require("fs");
+    function isexe(path, options, cb) {
+      fs.stat(path, function(er, stat) {
+        cb(er, er ? false : checkStat(stat, options));
+      });
+    }
+    function sync(path, options) {
+      return checkStat(fs.statSync(path), options);
+    }
+    function checkStat(stat, options) {
+      return stat.isFile() && checkMode(stat, options);
+    }
+    function checkMode(stat, options) {
+      var mod = stat.mode;
+      var uid = stat.uid;
+      var gid = stat.gid;
+      var myUid = options.uid !== void 0 ? options.uid : process.getuid && process.getuid();
+      var myGid = options.gid !== void 0 ? options.gid : process.getgid && process.getgid();
+      var u = parseInt("100", 8);
+      var g = parseInt("010", 8);
+      var o = parseInt("001", 8);
+      var ug = u | g;
+      var ret = mod & o || mod & g && gid === myGid || mod & u && uid === myUid || mod & ug && myUid === 0;
+      return ret;
+    }
+  }
+});
+
+// node_modules/isexe/index.js
+var require_isexe = __commonJS({
+  "node_modules/isexe/index.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var fs = __require("fs");
+    var core;
+    if (process.platform === "win32" || global.TESTING_WINDOWS) {
+      core = require_windows();
+    } else {
+      core = require_mode();
+    }
+    module.exports = isexe;
+    isexe.sync = sync;
+    function isexe(path, options, cb) {
+      if (typeof options === "function") {
+        cb = options;
+        options = {};
+      }
+      if (!cb) {
+        if (typeof Promise !== "function") {
+          throw new TypeError("callback not provided");
+        }
+        return new Promise(function(resolve2, reject) {
+          isexe(path, options || {}, function(er, is) {
+            if (er) {
+              reject(er);
+            } else {
+              resolve2(is);
+            }
+          });
+        });
+      }
+      core(path, options || {}, function(er, is) {
+        if (er) {
+          if (er.code === "EACCES" || options && options.ignoreErrors) {
+            er = null;
+            is = false;
+          }
+        }
+        cb(er, is);
+      });
+    }
+    function sync(path, options) {
+      try {
+        return core.sync(path, options || {});
+      } catch (er) {
+        if (options && options.ignoreErrors || er.code === "EACCES") {
+          return false;
+        } else {
+          throw er;
+        }
+      }
+    }
+  }
+});
+
+// node_modules/which/which.js
+var require_which = __commonJS({
+  "node_modules/which/which.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
+    var path = __require("path");
+    var COLON = isWindows ? ";" : ":";
+    var isexe = require_isexe();
+    var getNotFoundError = (cmd) => Object.assign(new Error(`not found: ${cmd}`), { code: "ENOENT" });
+    var getPathInfo = (cmd, opt) => {
+      const colon = opt.colon || COLON;
+      const pathEnv = cmd.match(/\//) || isWindows && cmd.match(/\\/) ? [""] : [
+        // windows always checks the cwd first
+        ...isWindows ? [process.cwd()] : [],
+        ...(opt.path || process.env.PATH || /* istanbul ignore next: very unusual */
+        "").split(colon)
+      ];
+      const pathExtExe = isWindows ? opt.pathExt || process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM" : "";
+      const pathExt = isWindows ? pathExtExe.split(colon) : [""];
+      if (isWindows) {
+        if (cmd.indexOf(".") !== -1 && pathExt[0] !== "")
+          pathExt.unshift("");
+      }
+      return {
+        pathEnv,
+        pathExt,
+        pathExtExe
+      };
+    };
+    var which = (cmd, opt, cb) => {
+      if (typeof opt === "function") {
+        cb = opt;
+        opt = {};
+      }
+      if (!opt)
+        opt = {};
+      const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
+      const found = [];
+      const step = (i) => new Promise((resolve2, reject) => {
+        if (i === pathEnv.length)
+          return opt.all && found.length ? resolve2(found) : reject(getNotFoundError(cmd));
+        const ppRaw = pathEnv[i];
+        const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
+        const pCmd = path.join(pathPart, cmd);
+        const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
+        resolve2(subStep(p, i, 0));
+      });
+      const subStep = (p, i, ii) => new Promise((resolve2, reject) => {
+        if (ii === pathExt.length)
+          return resolve2(step(i + 1));
+        const ext = pathExt[ii];
+        isexe(p + ext, { pathExt: pathExtExe }, (er, is) => {
+          if (!er && is) {
+            if (opt.all)
+              found.push(p + ext);
+            else
+              return resolve2(p + ext);
+          }
+          return resolve2(subStep(p, i, ii + 1));
+        });
+      });
+      return cb ? step(0).then((res) => cb(null, res), cb) : step(0);
+    };
+    var whichSync = (cmd, opt) => {
+      opt = opt || {};
+      const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
+      const found = [];
+      for (let i = 0; i < pathEnv.length; i++) {
+        const ppRaw = pathEnv[i];
+        const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
+        const pCmd = path.join(pathPart, cmd);
+        const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
+        for (let j = 0; j < pathExt.length; j++) {
+          const cur = p + pathExt[j];
+          try {
+            const is = isexe.sync(cur, { pathExt: pathExtExe });
+            if (is) {
+              if (opt.all)
+                found.push(cur);
+              else
+                return cur;
+            }
+          } catch (ex) {
+          }
+        }
+      }
+      if (opt.all && found.length)
+        return found;
+      if (opt.nothrow)
+        return null;
+      throw getNotFoundError(cmd);
+    };
+    module.exports = which;
+    which.sync = whichSync;
+  }
+});
+
+// node_modules/path-key/index.js
+var require_path_key = __commonJS({
+  "node_modules/path-key/index.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var pathKey = (options = {}) => {
+      const environment = options.env || process.env;
+      const platform = options.platform || process.platform;
+      if (platform !== "win32") {
+        return "PATH";
+      }
+      return Object.keys(environment).reverse().find((key) => key.toUpperCase() === "PATH") || "Path";
+    };
+    module.exports = pathKey;
+    module.exports.default = pathKey;
+  }
+});
+
+// node_modules/cross-spawn/lib/util/resolveCommand.js
+var require_resolveCommand = __commonJS({
+  "node_modules/cross-spawn/lib/util/resolveCommand.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var path = __require("path");
+    var which = require_which();
+    var getPathKey = require_path_key();
+    function resolveCommandAttempt(parsed, withoutPathExt) {
+      const env = parsed.options.env || process.env;
+      const cwd = process.cwd();
+      const hasCustomCwd = parsed.options.cwd != null;
+      const shouldSwitchCwd = hasCustomCwd && process.chdir !== void 0 && !process.chdir.disabled;
+      if (shouldSwitchCwd) {
+        try {
+          process.chdir(parsed.options.cwd);
+        } catch (err) {
+        }
+      }
+      let resolved;
+      try {
+        resolved = which.sync(parsed.command, {
+          path: env[getPathKey({ env })],
+          pathExt: withoutPathExt ? path.delimiter : void 0
+        });
+      } catch (e) {
+      } finally {
+        if (shouldSwitchCwd) {
+          process.chdir(cwd);
+        }
+      }
+      if (resolved) {
+        resolved = path.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
+      }
+      return resolved;
+    }
+    function resolveCommand(parsed) {
+      return resolveCommandAttempt(parsed) || resolveCommandAttempt(parsed, true);
+    }
+    module.exports = resolveCommand;
+  }
+});
+
+// node_modules/cross-spawn/lib/util/escape.js
+var require_escape = __commonJS({
+  "node_modules/cross-spawn/lib/util/escape.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var metaCharsRegExp = /([()\][%!^"`<>&|;, *?])/g;
+    function escapeCommand(arg) {
+      arg = arg.replace(metaCharsRegExp, "^$1");
+      return arg;
+    }
+    function escapeArgument(arg, doubleEscapeMetaChars) {
+      arg = `${arg}`;
+      arg = arg.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
+      arg = arg.replace(/(?=(\\+?)?)\1$/, "$1$1");
+      arg = `"${arg}"`;
+      arg = arg.replace(metaCharsRegExp, "^$1");
+      if (doubleEscapeMetaChars) {
+        arg = arg.replace(metaCharsRegExp, "^$1");
+      }
+      return arg;
+    }
+    module.exports.command = escapeCommand;
+    module.exports.argument = escapeArgument;
+  }
+});
+
+// node_modules/shebang-regex/index.js
+var require_shebang_regex = __commonJS({
+  "node_modules/shebang-regex/index.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    module.exports = /^#!(.*)/;
+  }
+});
+
+// node_modules/shebang-command/index.js
+var require_shebang_command = __commonJS({
+  "node_modules/shebang-command/index.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var shebangRegex = require_shebang_regex();
+    module.exports = (string2 = "") => {
+      const match = string2.match(shebangRegex);
+      if (!match) {
+        return null;
+      }
+      const [path, argument] = match[0].replace(/#! ?/, "").split(" ");
+      const binary = path.split("/").pop();
+      if (binary === "env") {
+        return argument;
+      }
+      return argument ? `${binary} ${argument}` : binary;
+    };
+  }
+});
+
+// node_modules/cross-spawn/lib/util/readShebang.js
+var require_readShebang = __commonJS({
+  "node_modules/cross-spawn/lib/util/readShebang.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var fs = __require("fs");
+    var shebangCommand = require_shebang_command();
+    function readShebang(command) {
+      const size = 150;
+      const buffer = Buffer.alloc(size);
+      let fd;
+      try {
+        fd = fs.openSync(command, "r");
+        fs.readSync(fd, buffer, 0, size, 0);
+        fs.closeSync(fd);
+      } catch (e) {
+      }
+      return shebangCommand(buffer.toString());
+    }
+    module.exports = readShebang;
+  }
+});
+
+// node_modules/cross-spawn/lib/parse.js
+var require_parse = __commonJS({
+  "node_modules/cross-spawn/lib/parse.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var path = __require("path");
+    var resolveCommand = require_resolveCommand();
+    var escape = require_escape();
+    var readShebang = require_readShebang();
+    var isWin = process.platform === "win32";
+    var isExecutableRegExp = /\.(?:com|exe)$/i;
+    var isCmdShimRegExp = /node_modules[\\/].bin[\\/][^\\/]+\.cmd$/i;
+    function detectShebang(parsed) {
+      parsed.file = resolveCommand(parsed);
+      const shebang = parsed.file && readShebang(parsed.file);
+      if (shebang) {
+        parsed.args.unshift(parsed.file);
+        parsed.command = shebang;
+        return resolveCommand(parsed);
+      }
+      return parsed.file;
+    }
+    function parseNonShell(parsed) {
+      if (!isWin) {
+        return parsed;
+      }
+      const commandFile = detectShebang(parsed);
+      const needsShell = !isExecutableRegExp.test(commandFile);
+      if (parsed.options.forceShell || needsShell) {
+        const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
+        parsed.command = path.normalize(parsed.command);
+        parsed.command = escape.command(parsed.command);
+        parsed.args = parsed.args.map((arg) => escape.argument(arg, needsDoubleEscapeMetaChars));
+        const shellCommand = [parsed.command].concat(parsed.args).join(" ");
+        parsed.args = ["/d", "/s", "/c", `"${shellCommand}"`];
+        parsed.command = process.env.comspec || "cmd.exe";
+        parsed.options.windowsVerbatimArguments = true;
+      }
+      return parsed;
+    }
+    function parse(command, args, options) {
+      if (args && !Array.isArray(args)) {
+        options = args;
+        args = null;
+      }
+      args = args ? args.slice(0) : [];
+      options = Object.assign({}, options);
+      const parsed = {
+        command,
+        args,
+        options,
+        file: void 0,
+        original: {
+          command,
+          args
+        }
+      };
+      return options.shell ? parsed : parseNonShell(parsed);
+    }
+    module.exports = parse;
+  }
+});
+
+// node_modules/cross-spawn/lib/enoent.js
+var require_enoent = __commonJS({
+  "node_modules/cross-spawn/lib/enoent.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var isWin = process.platform === "win32";
+    function notFoundError(original, syscall) {
+      return Object.assign(new Error(`${syscall} ${original.command} ENOENT`), {
+        code: "ENOENT",
+        errno: "ENOENT",
+        syscall: `${syscall} ${original.command}`,
+        path: original.command,
+        spawnargs: original.args
+      });
+    }
+    function hookChildProcess(cp, parsed) {
+      if (!isWin) {
+        return;
+      }
+      const originalEmit = cp.emit;
+      cp.emit = function(name, arg1) {
+        if (name === "exit") {
+          const err = verifyENOENT(arg1, parsed);
+          if (err) {
+            return originalEmit.call(cp, "error", err);
+          }
+        }
+        return originalEmit.apply(cp, arguments);
+      };
+    }
+    function verifyENOENT(status, parsed) {
+      if (isWin && status === 1 && !parsed.file) {
+        return notFoundError(parsed.original, "spawn");
+      }
+      return null;
+    }
+    function verifyENOENTSync(status, parsed) {
+      if (isWin && status === 1 && !parsed.file) {
+        return notFoundError(parsed.original, "spawnSync");
+      }
+      return null;
+    }
+    module.exports = {
+      hookChildProcess,
+      verifyENOENT,
+      verifyENOENTSync,
+      notFoundError
+    };
+  }
+});
+
+// node_modules/cross-spawn/index.js
+var require_cross_spawn = __commonJS({
+  "node_modules/cross-spawn/index.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var cp = __require("child_process");
+    var parse = require_parse();
+    var enoent = require_enoent();
+    function spawn2(command, args, options) {
+      const parsed = parse(command, args, options);
+      const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
+      enoent.hookChildProcess(spawned, parsed);
+      return spawned;
+    }
+    function spawnSync(command, args, options) {
+      const parsed = parse(command, args, options);
+      const result2 = cp.spawnSync(parsed.command, parsed.args, parsed.options);
+      result2.error = result2.error || enoent.verifyENOENTSync(result2.status, parsed);
+      return result2;
+    }
+    module.exports = spawn2;
+    module.exports.spawn = spawn2;
+    module.exports.sync = spawnSync;
+    module.exports._parse = parse;
+    module.exports._enoent = enoent;
+  }
+});
+
+// src/cli/mcpScan.ts
+init_esm_shims();
+import { resolve } from "path";
+
+// src/mcpScan/connect.ts
+init_esm_shims();
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/client/stdio.js
+init_esm_shims();
+var import_cross_spawn = __toESM(require_cross_spawn(), 1);
+import process2 from "process";
+import { PassThrough } from "stream";
+var DEFAULT_INHERITED_ENV_VARS = process2.platform === "win32" ? [
+  "APPDATA",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "LOCALAPPDATA",
+  "PATH",
+  "PROCESSOR_ARCHITECTURE",
+  "SYSTEMDRIVE",
+  "SYSTEMROOT",
+  "TEMP",
+  "USERNAME",
+  "USERPROFILE",
+  "PROGRAMFILES"
+] : (
+  /* list inspired by the default env inheritance of sudo */
+  ["HOME", "LOGNAME", "PATH", "SHELL", "TERM", "USER"]
+);
+function getDefaultEnvironment() {
+  const env = {};
+  for (const key of DEFAULT_INHERITED_ENV_VARS) {
+    const value = process2.env[key];
+    if (value === void 0) {
+      continue;
+    }
+    if (value.startsWith("()")) {
+      continue;
+    }
+    env[key] = value;
+  }
+  return env;
+}
+var StdioClientTransport = class {
+  constructor(server) {
+    this._readBuffer = new ReadBuffer();
+    this._stderrStream = null;
+    this._serverParams = server;
+    if (server.stderr === "pipe" || server.stderr === "overlapped") {
+      this._stderrStream = new PassThrough();
+    }
+  }
+  /**
+   * Starts the server process and prepares to communicate with it.
+   */
+  async start() {
+    if (this._process) {
+      throw new Error("StdioClientTransport already started! If using Client class, note that connect() calls start() automatically.");
+    }
+    return new Promise((resolve2, reject) => {
+      this._process = (0, import_cross_spawn.default)(this._serverParams.command, this._serverParams.args ?? [], {
+        // merge default env with server env because mcp server needs some env vars
+        env: {
+          ...getDefaultEnvironment(),
+          ...this._serverParams.env
+        },
+        stdio: ["pipe", "pipe", this._serverParams.stderr ?? "inherit"],
+        shell: false,
+        windowsHide: process2.platform === "win32",
+        cwd: this._serverParams.cwd
+      });
+      this._process.on("error", (error) => {
+        reject(error);
+        this.onerror?.(error);
+      });
+      this._process.on("spawn", () => {
+        resolve2();
+      });
+      this._process.on("close", (_code) => {
+        this._process = void 0;
+        this.onclose?.();
+      });
+      this._process.stdin?.on("error", (error) => {
+        this.onerror?.(error);
+      });
+      this._process.stdout?.on("data", (chunk) => {
+        this._readBuffer.append(chunk);
+        this.processReadBuffer();
+      });
+      this._process.stdout?.on("error", (error) => {
+        this.onerror?.(error);
+      });
+      if (this._stderrStream && this._process.stderr) {
+        this._process.stderr.pipe(this._stderrStream);
+      }
+    });
+  }
+  /**
+   * The stderr stream of the child process, if `StdioServerParameters.stderr` was set to "pipe" or "overlapped".
+   *
+   * If stderr piping was requested, a PassThrough stream is returned _immediately_, allowing callers to
+   * attach listeners before the start method is invoked. This prevents loss of any early
+   * error output emitted by the child process.
+   */
+  get stderr() {
+    if (this._stderrStream) {
+      return this._stderrStream;
+    }
+    return this._process?.stderr ?? null;
+  }
+  /**
+   * The child process pid spawned by this transport.
+   *
+   * This is only available after the transport has been started.
+   */
+  get pid() {
+    return this._process?.pid ?? null;
+  }
+  processReadBuffer() {
+    while (true) {
+      try {
+        const message = this._readBuffer.readMessage();
+        if (message === null) {
+          break;
+        }
+        this.onmessage?.(message);
+      } catch (error) {
+        this.onerror?.(error);
+      }
+    }
+  }
+  async close() {
+    if (this._process) {
+      const processToClose = this._process;
+      this._process = void 0;
+      const closePromise = new Promise((resolve2) => {
+        processToClose.once("close", () => {
+          resolve2();
+        });
+      });
+      try {
+        processToClose.stdin?.end();
+      } catch {
+      }
+      await Promise.race([closePromise, new Promise((resolve2) => setTimeout(resolve2, 2e3).unref())]);
+      if (processToClose.exitCode === null) {
+        try {
+          processToClose.kill("SIGTERM");
+        } catch {
+        }
+        await Promise.race([closePromise, new Promise((resolve2) => setTimeout(resolve2, 2e3).unref())]);
+      }
+      if (processToClose.exitCode === null) {
+        try {
+          processToClose.kill("SIGKILL");
+        } catch {
+        }
+      }
+    }
+    this._readBuffer.clear();
+  }
+  send(message) {
+    return new Promise((resolve2) => {
+      if (!this._process?.stdin) {
+        throw new Error("Not connected");
+      }
+      const json = serializeMessage(message);
+      if (this._process.stdin.write(json)) {
+        resolve2();
+      } else {
+        this._process.stdin.once("drain", resolve2);
+      }
+    });
+  }
+};
+
+// src/mcpScan/connect.ts
+var DEFAULTS = {
+  connectTimeoutMs: 6e4,
+  requestTimeoutMs: 2e4,
+  serverBudgetMs: 12e4,
+  concurrency: 4
+};
+var STDERR_KEEP = 8e3;
+function childEnv(base, extra) {
+  const out = {};
+  for (const [k, v] of Object.entries(base)) {
+    if (v === void 0 || k.startsWith("LURQ_")) continue;
+    out[k] = v;
+  }
+  return { ...out, ...extra };
+}
+var Page = (key) => looseObject({ [key]: array(unknown()).optional(), nextCursor: string().optional() });
+var Deadline = class extends Error {
+  constructor(what, ms) {
+    super(`${what} did not finish within ${Math.round(ms / 1e3)}s`);
+    this.name = "Deadline";
+  }
+};
+function before(p, ms, what) {
+  let timer;
+  return Promise.race([
+    p,
+    new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Deadline(what, ms)), ms);
+      timer.unref();
+    })
+  ]).finally(() => clearTimeout(timer));
+}
+function openStdio(spec, opts) {
+  const transport = new StdioClientTransport({
+    command: spec.command,
+    args: spec.args,
+    env: childEnv(opts.env ?? process.env, spec.env),
+    cwd: spec.cwd ?? void 0,
+    stderr: "pipe"
+  });
+  let tail = "";
+  transport.stderr?.on("data", (chunk) => {
+    tail = (tail + chunk.toString("utf8")).slice(-STDERR_KEEP);
+  });
+  return wrap(transport, "stdio", () => tail);
+}
+function openHttp(spec, kind) {
+  const url = new URL(spec.url);
+  const requestInit = { headers: spec.headers };
+  const transport = kind === "http" ? new StreamableHTTPClientTransport(url, {
+    requestInit,
+    reconnectionOptions: {
+      maxRetries: 0,
+      initialReconnectionDelay: 1e3,
+      maxReconnectionDelay: 1e3,
+      reconnectionDelayGrowFactor: 1
+    }
+  }) : new SSEClientTransport(url, {
+    requestInit,
+    eventSourceInit: {
+      fetch: (u, init) => fetch(u, {
+        ...init,
+        headers: { ...init?.headers, ...spec.headers }
+      })
+    }
+  });
+  return wrap(transport, kind, () => "");
+}
+function wrap(transport, kind, stderr) {
+  const client = new Client({ name: "lurq-scan", version: VERSION }, { capabilities: {} });
+  let noise = 0;
+  client.onerror = (err) => {
+    if (err instanceof SyntaxError || err.name === "ZodError") noise++;
+  };
+  return { client, transport, kind, stderr, noise: () => noise };
+}
+async function close(conn) {
+  await before(conn.client.close(), 6e3, "close").catch(() => {
+  });
+}
+async function paginate(conn, method, key, list, snapshot, opts, onPage, maxPages = LIMITS.pages) {
+  const seen = /* @__PURE__ */ new Set();
+  let cursor;
+  for (let page = 0; ; page++) {
+    if (page >= maxPages) {
+      snapshot.issues.push({
+        list,
+        kind: "truncated",
+        detail: `still paginating after ${maxPages} pages`
+      });
+      return;
+    }
+    const result2 = await conn.client.request(
+      { method, params: cursor ? { cursor } : {} },
+      Page(key),
+      { timeout: opts.requestTimeoutMs, signal: opts.signal }
+    );
+    const entries = result2[key];
+    if (!onPage(Array.isArray(entries) ? entries : [])) return;
+    const next = result2.nextCursor;
+    if (!next) return;
+    if (seen.has(next)) {
+      snapshot.issues.push({
+        list,
+        kind: "truncated",
+        detail: "the server repeated a pagination cursor"
+      });
+      return;
+    }
+    seen.add(next);
+    cursor = next;
+  }
+}
+var isMethodNotFound = (err) => err?.code === -32601;
+async function readContract(conn, opts) {
+  const snapshot = emptySnapshot();
+  const caps = conn.client.getServerCapabilities() ?? {};
+  const info = conn.client.getServerVersion();
+  snapshot.serverInfo = {
+    name: typeof info?.name === "string" ? info.name.slice(0, LIMITS.name) : null,
+    version: typeof info?.version === "string" ? info.version.slice(0, 100) : null,
+    title: typeof info?.title === "string" ? info.title.slice(0, LIMITS.name) : null
+  };
+  snapshot.protocolVersion = conn.transport.protocolVersion ?? null;
+  snapshot.capabilities = {
+    tools: !!caps.tools,
+    prompts: !!caps.prompts,
+    resources: !!caps.resources,
+    logging: !!caps.logging,
+    completions: !!caps.completions,
+    toolsListChanged: !!caps.tools?.listChanged
+  };
+  const instructions = conn.client.getInstructions();
+  if (typeof instructions === "string" && instructions) {
+    snapshot.instructions = instructions.slice(0, LIMITS.instructions);
+    if (instructions.length > LIMITS.instructions) {
+      snapshot.issues.push({
+        list: "initialize",
+        kind: "oversized",
+        detail: `instructions are ${instructions.length} chars`
+      });
+    }
+  }
+  const tools = /* @__PURE__ */ new Map();
+  try {
+    await paginate(
+      conn,
+      "tools/list",
+      "tools",
+      "tools",
+      snapshot,
+      opts,
+      (e) => addTools(e, tools, snapshot.issues)
+    );
+  } catch (err) {
+    if (!(isMethodNotFound(err) && !caps.tools)) throw err;
+  }
+  snapshot.tools = [...tools.values()];
+  const secondary = async (list, run) => {
+    try {
+      await run();
+    } catch (err) {
+      if (isMethodNotFound(err)) return;
+      snapshot.issues.push({
+        list,
+        kind: "list_failed",
+        detail: (err instanceof Error ? err.message : String(err)).slice(0, 300)
+      });
+    }
+  };
+  if (caps.prompts) {
+    const prompts = /* @__PURE__ */ new Map();
+    await secondary(
+      "prompts",
+      () => paginate(
+        conn,
+        "prompts/list",
+        "prompts",
+        "prompts",
+        snapshot,
+        opts,
+        (e) => addPrompts(e, prompts, snapshot.issues)
+      )
+    );
+    snapshot.prompts = [...prompts.values()];
+  }
+  if (caps.resources) {
+    const templates = /* @__PURE__ */ new Map();
+    await secondary(
+      "resourceTemplates",
+      () => paginate(
+        conn,
+        "resources/templates/list",
+        "resourceTemplates",
+        "resourceTemplates",
+        snapshot,
+        opts,
+        (e) => addTemplates(e, templates, snapshot.issues)
+      )
+    );
+    snapshot.resourceTemplates = [...templates.values()];
+    let count = 0;
+    await secondary(
+      "resources",
+      () => paginate(
+        conn,
+        "resources/list",
+        "resources",
+        "resources",
+        snapshot,
+        opts,
+        (e) => {
+          count += e.length;
+          return true;
+        },
+        LIMITS.resourcePages
+      )
+    );
+    snapshot.resourceCount = count;
+  }
+  if (conn.noise() > 0) {
+    snapshot.issues.push({
+      list: "initialize",
+      kind: "stdout_noise",
+      detail: `${conn.noise()} non-protocol line(s) on stdout; some clients will fail on this`
+    });
+  }
+  return snapshot;
+}
+function shouldTrySse(err) {
+  if (err instanceof StreamableHTTPError)
+    return [400, 404, 405].includes(err.code ?? 0) || err.code === -1;
+  return false;
+}
+function result(spec, started, fields) {
+  return {
+    alias: spec.alias,
+    serverKey: spec.serverKey,
+    configFingerprint: spec.configFingerprint,
+    registry: spec.registry,
+    packageName: spec.packageName,
+    pinnedVersion: spec.pinnedVersion,
+    transport: spec.transport,
+    transportUsed: null,
+    error: null,
+    hint: null,
+    stderrTail: null,
+    snapshot: null,
+    durationMs: Date.now() - started,
+    ...fields
+  };
+}
+async function attempt(spec, kind, opts, started) {
+  const connectTimeoutMs = opts.connectTimeoutMs ?? (kind === "stdio" ? DEFAULTS.connectTimeoutMs : 2e4);
+  const requestTimeoutMs = opts.requestTimeoutMs ?? DEFAULTS.requestTimeoutMs;
+  const budget = opts.serverBudgetMs ?? DEFAULTS.serverBudgetMs;
+  let conn = null;
+  let stage = "connect";
+  try {
+    conn = kind === "stdio" ? openStdio(spec, opts) : openHttp(spec, kind);
+    const c = conn;
+    const work = (async () => {
+      await before(
+        c.client.connect(c.transport, { timeout: connectTimeoutMs, signal: opts.signal }),
+        connectTimeoutMs + 2e3,
+        "connect"
+      );
+      stage = "list";
+      return readContract(c, { requestTimeoutMs, signal: opts.signal });
+    })();
+    const snapshot = await before(work, Math.max(1e3, budget - (Date.now() - started)), "scan");
+    const clean = scrubDeep(snapshot, spec.secrets);
+    const partial = clean.issues.some((i) => i.kind === "list_failed" || i.kind === "truncated");
+    return result(spec, started, {
+      status: partial ? "partial" : "ok",
+      transportUsed: kind,
+      snapshot: clean,
+      stderrTail: tailOf(conn, spec)
+    });
+  } catch (err) {
+    if (kind === "http" && spec.transport === "auto" && shouldTrySse(err))
+      return { retrySse: true };
+    if (opts.signal?.aborted) {
+      return result(spec, started, {
+        status: "cancelled",
+        transportUsed: kind,
+        error: "scan interrupted"
+      });
+    }
+    const c = err instanceof Deadline ? {
+      status: "timeout",
+      error: err.message,
+      hint: stage === "connect" && kind === "stdio" ? "a first run of npx/uvx downloads the package; retry with a longer --timeout" : null
+    } : classifyError(err, {
+      stage,
+      transport: kind,
+      command: spec.command,
+      stderrTail: conn?.stderr() ?? "",
+      stdoutNoise: conn?.noise() ?? 0
+    });
+    return result(spec, started, {
+      status: c.status,
+      transportUsed: kind,
+      error: scrub(c.error, spec.secrets),
+      hint: c.hint,
+      stderrTail: tailOf(conn, spec)
+    });
+  } finally {
+    if (conn) await close(conn);
+  }
+}
+function tailOf(conn, spec) {
+  const t = conn?.stderr().trim();
+  return t ? scrub(t.split("\n").slice(-20).join("\n"), spec.secrets).slice(-2e3) : null;
+}
+async function scanServer(spec, opts = {}) {
+  const started = Date.now();
+  if (spec.disabled)
+    return result(spec, started, { status: "disabled", hint: "disabled in its config" });
+  if (!spec.trusted) return result(spec, started, { status: "untrusted", hint: spec.trustReason });
+  if (spec.unresolved.length) {
+    return result(spec, started, {
+      status: "needs_config",
+      error: `no value for ${spec.unresolved.join(", ")}`,
+      hint: `export ${spec.unresolved.filter((v) => !v.startsWith("input:")).join(", ") || "the missing values"} before scanning`
+    });
+  }
+  if (opts.signal?.aborted)
+    return result(spec, started, { status: "cancelled", error: "scan interrupted" });
+  try {
+    if (spec.transport === "stdio") {
+      if (!spec.command)
+        return result(spec, started, { status: "spawn_failed", error: "no command configured" });
+      return await attempt(spec, "stdio", opts, started);
+    }
+    if (!spec.url)
+      return result(spec, started, { status: "unreachable", error: "no url configured" });
+    try {
+      new URL(spec.url);
+    } catch {
+      return result(spec, started, {
+        status: "unreachable",
+        error: "the configured url is not valid",
+        hint: "check the url in the config"
+      });
+    }
+    const first = await attempt(spec, spec.transport === "sse" ? "sse" : "http", opts, started);
+    if ("retrySse" in first) return await attempt(spec, "sse", opts, started);
+    return first;
+  } catch (err) {
+    return result(spec, started, {
+      status: "protocol_error",
+      error: scrub(err instanceof Error ? err.message : String(err), spec.secrets)
+    });
+  }
+}
+async function scanServers(specs, opts = {}) {
+  return pMap(
+    specs,
+    async (spec) => {
+      const scan = await scanServer(spec, opts);
+      opts.onResult?.(scan);
+      return scan;
+    },
+    Math.max(1, opts.concurrency ?? DEFAULTS.concurrency)
+  );
+}
+
+// src/mcpScan/localHistory.ts
+init_esm_shims();
+import { createHash } from "crypto";
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { join } from "path";
+var dir = () => join(lurqHome(), "mcp-snapshots");
+var fileFor = (serverKey, fingerprint) => join(
+  dir(),
+  `${createHash("sha256").update(`${serverKey}#${fingerprint}`).digest("hex").slice(0, 32)}.json`
+);
+function loadLocal(serverKey, fingerprint) {
+  try {
+    const parsed = JSON.parse(
+      readFileSync(fileFor(serverKey, fingerprint), "utf8")
+    );
+    if (parsed?.version !== 1 || !Array.isArray(parsed.snapshot?.tools)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function saveLocal(entry) {
+  mkdirSync(dir(), { recursive: true, mode: 448 });
+  const target = fileFor(entry.serverKey, entry.configFingerprint);
+  const tmp = `${target}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(entry), { mode: 384 });
+  renameSync(tmp, target);
+  try {
+    chmodSync(target, 384);
+  } catch {
+  }
+}
+
+// src/cli/mcpScan.ts
+var THRESHOLDS = ["critical", "high", "moderate", "low", "info", "none"];
+function parseThreshold(v) {
+  const t = (v ?? "none").toLowerCase();
+  if (!THRESHOLDS.includes(t)) {
+    throw new Error(`--fail-on must be one of ${THRESHOLDS.join(", ")}; got "${v}"`);
+  }
+  return t === "none" ? null : t;
+}
+function parsePositive(v, name, fallback, max) {
+  if (v === void 0) return fallback;
+  const n = Number(v);
+  if (!Number.isFinite(n) || n <= 0)
+    throw new Error(`${name} must be a positive number; got "${v}"`);
+  return Math.min(n, max);
+}
+var canPrompt = (opts) => !!process.stdin.isTTY && !!process.stdout.isTTY && !process.env.CI && !opts.json;
+var commandLine = (s) => scrub([s.command ?? s.url ?? "", ...s.args].join(" "), s.secrets).slice(0, 200);
+async function confirmProjectServers(specs, opts) {
+  const pending = specs.filter(
+    (s) => !s.trusted && s.scope === "project" && !/declined/.test(s.trustReason)
+  );
+  if (!pending.length || !canPrompt(opts)) return;
+  console.error(
+    yellow(
+      `
+${pending.length} server(s) are committed to this repository and have not been approved:`
+    )
+  );
+  for (const s of pending) console.error(`  ${bold(s.alias)}  ${dim(commandLine(s))}`);
+  const { confirm } = await import("./dist-4XXIXHHZ.js");
+  const yes = await confirm({ message: "Launch them for this scan?", default: false });
+  if (!yes) return;
+  for (const s of pending) {
+    s.trusted = true;
+    s.trustReason = "approved for this run";
+  }
+}
+function comparable(prev, next) {
+  if (next.issues.some((i) => i.list === "tools" && i.kind === "truncated")) return null;
+  const failed = new Set(next.issues.filter((i) => i.kind === "list_failed").map((i) => i.list));
+  return {
+    tools: next.tools,
+    prompts: failed.has("prompts") ? prev.prompts : next.prompts,
+    resourceTemplates: failed.has("resourceTemplates") ? prev.resourceTemplates : next.resourceTemplates,
+    instructions: next.instructions
+  };
+}
+function withHistory(scan, analysis, useHistory) {
+  const report = { ...scan, analysis, sinceLastScan: null };
+  if (!useHistory || !scan.snapshot) return report;
+  const prev = loadLocal(scan.serverKey, scan.configFingerprint);
+  const next = scan.snapshot;
+  if (prev) {
+    const input = comparable(prev.snapshot, next);
+    if (input) {
+      const d = diffSnapshots(prev.snapshot, input, scan.alias);
+      report.sinceLastScan = {
+        ...d,
+        at: prev.scannedAt,
+        contract: {
+          breaking: d.contract.breaking,
+          removedTools: d.contract.removedTools,
+          addedTools: d.contract.addedTools,
+          silentDrift: d.contract.silentDrift,
+          annotationFlips: d.contract.annotationFlips
+        }
+      };
+    }
+  }
+  if (scan.status === "ok") {
+    saveLocal({
+      version: 1,
+      serverKey: scan.serverKey,
+      configFingerprint: scan.configFingerprint,
+      scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      contentHash: contentHash(next),
+      snapshot: next
+    });
+  }
+  return report;
+}
+async function collectScan(dir2, opts) {
+  const root = resolve(dir2 ?? process.cwd());
+  const cfg = readServerConfigs(root, {
+    projectOnly: opts.projectOnly,
+    trustProject: opts.trustProject
+  });
+  const notes = [...cfg.notes];
+  let specs = cfg.servers;
+  if (opts.only) {
+    const wanted = new Set(
+      opts.only.split(",").map((s) => s.trim()).filter(Boolean)
+    );
+    specs = specs.filter((s) => wanted.has(s.alias));
+    const missing = [...wanted].filter((w) => !specs.some((s) => s.alias === w));
+    if (missing.length) notes.push(`no configured server named ${missing.join(", ")}`);
+  }
+  await confirmProjectServers(specs, opts);
+  const timeoutMs = parsePositive(opts.timeout, "--timeout", DEFAULTS.connectTimeoutMs / 1e3, 600) * 1e3;
+  const concurrency = Math.floor(
+    parsePositive(opts.concurrency, "--concurrency", DEFAULTS.concurrency, 16)
+  );
+  const ctl = new AbortController();
+  const onSignal = () => {
+    if (ctl.signal.aborted) process.exit(130);
+    ctl.abort();
+    console.error(
+      yellow("\nstopping: closing the servers already running (Ctrl-C again to force)")
+    );
+  };
+  process.on("SIGINT", onSignal);
+  const progress = !opts.json && process.stderr.isTTY;
+  let scans;
+  try {
+    scans = await scanServers(specs, {
+      concurrency,
+      connectTimeoutMs: timeoutMs,
+      serverBudgetMs: Math.max(DEFAULTS.serverBudgetMs, timeoutMs + 6e4),
+      signal: ctl.signal,
+      onResult: (s) => {
+        if (!progress) return;
+        const mark = s.status === "ok" ? green("\u2713") : s.status === "partial" ? yellow("~") : dim("\xB7");
+        const what = s.snapshot ? `${s.snapshot.tools.length} tools` : s.status;
+        console.error(
+          `${mark} ${s.alias} ${dim(`${what} (${(s.durationMs / 1e3).toFixed(1)}s)`)}`
+        );
+      }
+    });
+  } finally {
+    process.off("SIGINT", onSignal);
+  }
+  const servers = scans.map(
+    (s) => withHistory(s, s.snapshot ? analyzeServer(s.snapshot) : null, opts.history !== false)
+  );
+  const stackScan = analyzeStackScan(
+    // Servers the user chose not to run are not part of the namespace being
+    // assembled; servers that failed are, and make the stack unknown.
+    servers.filter((s) => s.status !== "disabled" && s.status !== "untrusted").map((s) => ({ alias: s.alias, snapshot: s.snapshot }))
+  );
+  const severities = [
+    ...servers.flatMap((s) => s.analysis?.findings ?? []),
+    ...stackScan.findings,
+    ...servers.flatMap(
+      (s) => s.sinceLastScan && !s.sinceLastScan.unchanged ? [s.sinceLastScan] : []
+    )
+  ];
+  return {
+    root,
+    filesRead: cfg.filesRead,
+    notes,
+    servers,
+    stack: stackScan.stack,
+    findings: stackScan.findings,
+    // First source per alias: an alias declared in two files is still one
+    // server, and the first declaration is the one that won.
+    configSources: Object.fromEntries(
+      specs.flatMap((s) => s.sources[0] ? [[s.alias, s.sources[0]]] : [])
+    ),
+    worst: worst(severities),
+    account: null,
+    uploadProblem: null
+  };
+}
+var sevColour = (s) => s === "critical" || s === "high" ? red : s === "moderate" ? yellow : dim;
+function ago(iso) {
+  const mins = Math.round((Date.now() - Date.parse(iso)) / 6e4);
+  if (!Number.isFinite(mins)) return iso;
+  if (mins < 60) return `${Math.max(mins, 1)}m ago`;
+  if (mins < 60 * 48) return `${Math.round(mins / 60)}h ago`;
+  return `${Math.round(mins / 1440)}d ago`;
+}
+function does(a) {
+  const caps = Object.entries(a?.stats.capabilities ?? {}).sort((x, y) => (y[1] ?? 0) - (x[1] ?? 0)).map(([c]) => c);
+  if (!caps.length) return dim("\u2014");
+  return caps.length > 2 ? `${caps.slice(0, 2).join(", ")} +${caps.length - 2}` : caps.join(", ");
+}
+function statusCell(s) {
+  if (s.status === "ok") return green("ok");
+  if (s.status === "partial") return yellow("partial");
+  if (s.status === "untrusted" || s.status === "disabled") return dim(s.status);
+  return red(s.status);
+}
+function render(report) {
+  console.log(bold(report.root));
+  console.log(
+    dim(`read ${report.filesRead.length} config file(s): ${report.filesRead.join(", ") || "\u2014"}`)
+  );
+  console.log("");
+  console.log(
+    table(
+      ["Server", "Via", "Status", "Tools", "Writes", "Destroys", "Does"],
+      report.servers.map((s) => [
+        s.alias,
+        s.transportUsed ?? s.transport,
+        statusCell(s),
+        s.analysis ? String(s.analysis.stats.tools) : "\u2014",
+        s.analysis ? String(s.analysis.stats.writes) : "\u2014",
+        s.analysis ? s.analysis.stats.destroys ? red(String(s.analysis.stats.destroys)) : "0" : "\u2014",
+        does(s.analysis)
+      ])
+    )
+  );
+  const accountSince = new Map(
+    (report.account?.results ?? []).filter((r) => r.since).map((r) => [r.alias, r.since])
+  );
+  const changes = report.servers.flatMap((s) => {
+    const acc2 = accountSince.get(s.alias);
+    if (acc2)
+      return [
+        { alias: s.alias, severity: acc2.severity, at: acc2.at, summary: acc2.summary }
+      ];
+    const d = s.sinceLastScan;
+    return d && !d.unchanged ? [{ alias: s.alias, severity: d.severity, at: d.at, summary: d.summary }] : [];
+  });
+  if (changes.length) {
+    console.log(`
+${bold("Since the last scan")}`);
+    for (const c of changes) {
+      console.log(
+        `  ${sevColour(c.severity)(c.severity.toUpperCase().padEnd(8))} ${bold(c.alias)} ${dim(ago(c.at))}  ${c.summary}`
+      );
+    }
+  }
+  const findings = sortFindings([
+    ...report.servers.flatMap(
+      (s) => (s.analysis?.findings ?? []).map((f) => ({ ...f, server: s.alias }))
+    ),
+    ...report.findings
+  ]).filter((f) => f.severity !== "info");
+  if (findings.length) {
+    console.log(`
+${bold("Findings")}`);
+    for (const f of findings.slice(0, 40)) {
+      const where = [f.server, f.tool].filter(Boolean).join(" \u203A ");
+      console.log(
+        `  ${sevColour(f.severity)(f.severity.toUpperCase().padEnd(8))} ${bold(where || f.where)}  ${f.detail}`
+      );
+      if (f.evidence) console.log(`           ${dim(f.evidence)}`);
+    }
+    if (findings.length > 40) console.log(dim(`  \u2026 ${findings.length - 40} more (use --json)`));
+  }
+  const unread = report.servers.filter((s) => !s.snapshot);
+  if (unread.length) {
+    console.log(`
+${bold("Not read")}`);
+    for (const s of unread) {
+      console.log(`  ${bold(s.alias)} ${statusCell(s)}${s.error ? `  ${s.error}` : ""}`);
+      if (s.hint) console.log(`    ${dim(s.hint)}`);
+    }
+  }
+  console.log("");
+  console.log(dim(report.stack.note));
+  if (isCrowded(report.stack)) {
+    console.log(
+      yellow(
+        `~${report.stack.estimatedContextTokens.toLocaleString()} tokens of tool schema ride in every request \u2014 worth trimming`
+      )
+    );
+  }
+  for (const n of report.notes) console.log(dim(`\xB7 ${n}`));
+  const acc = report.account;
+  if (acc) {
+    if (acc.recorded) {
+      console.log(
+        dim(
+          `recorded ${acc.recorded} server(s) to your account${acc.changed ? `, ${acc.changed} changed since the last upload` : ""}`
+        )
+      );
+    }
+    for (const r of acc.rejected)
+      console.log(yellow(`not recorded: ${r.alias ?? "a server"}: ${r.reason}`));
+    if (acc.error) console.log(yellow(`could not record this scan to your account: ${acc.error}`));
+  } else if (!resolveApiKey()) {
+    console.log(
+      dim("run `lurq setup` to keep this history across machines and see it in the dashboard")
+    );
+  }
+}
+function toJson(report) {
+  return {
+    ...report,
+    servers: report.servers.map(({ snapshot, ...rest }) => ({
+      ...rest,
+      serverInfo: snapshot?.serverInfo ?? null,
+      tools: snapshot?.tools.map((t) => t.name) ?? null,
+      issues: snapshot?.issues ?? []
+    }))
+  };
+}
+var NOT_UPLOADED = /* @__PURE__ */ new Set(["untrusted", "disabled", "cancelled"]);
+function toUpload(s) {
+  return {
+    alias: s.alias,
+    serverKey: s.serverKey,
+    configFingerprint: s.configFingerprint,
+    registry: s.registry,
+    packageName: s.packageName,
+    pinnedVersion: s.pinnedVersion,
+    transport: s.transport,
+    status: s.status,
+    error: s.error,
+    snapshot: s.snapshot ? {
+      serverInfo: s.snapshot.serverInfo,
+      instructions: s.snapshot.instructions,
+      tools: s.snapshot.tools,
+      prompts: s.snapshot.prompts,
+      resourceTemplates: s.snapshot.resourceTemplates
+    } : null
+  };
+}
+function chunkUploads(items, maxBytes = 3e6, maxCount = 50) {
+  const chunks = [];
+  let current = [];
+  let bytes = 0;
+  for (const item of items) {
+    const size = JSON.stringify(item).length;
+    if (current.length && (bytes + size > maxBytes || current.length >= maxCount)) {
+      chunks.push(current);
+      current = [];
+      bytes = 0;
+    }
+    current.push(item);
+    bytes += size;
+  }
+  if (current.length) chunks.push(current);
+  return chunks;
+}
+async function syncToAccount(report, opts) {
+  if (opts.upload === false || !resolveApiKey()) return null;
+  const servers = report.servers.filter((s) => !NOT_UPLOADED.has(s.status)).map(toUpload);
+  if (!servers.length) return null;
+  const out = { recorded: 0, changed: 0, results: [], rejected: [], error: null };
+  for (const chunk of chunkUploads(servers)) {
+    try {
+      const r = await uploadMcpScan({
+        source: process.env.CI ? "ci" : "cli",
+        clientVersion: VERSION,
+        contribute: opts.contribute !== false,
+        servers: chunk
+      });
+      out.results.push(...r.servers);
+      out.rejected.push(...r.rejected.map((x) => ({ alias: x.alias, reason: x.reason })));
+    } catch (err) {
+      out.error = err instanceof RemoteError ? err.message : err instanceof Error ? err.message : String(err);
+      break;
+    }
+  }
+  out.recorded = out.results.length;
+  out.changed = out.results.filter((r) => r.change === "changed").length;
+  return out;
+}
+function uploadProblem(report, opts) {
+  if (!opts.requireUpload) return null;
+  if (!resolveApiKey()) return "no API key is configured; set LURQ_API_KEY";
+  const acc = report.account;
+  if (!acc) return null;
+  if (acc.error) return `the upload failed: ${acc.error}`;
+  if (acc.rejected.length) {
+    return `${acc.rejected.length} server(s) were not recorded: ${acc.rejected.map((r) => `${r.alias ?? "a server"} (${r.reason})`).join(", ")}`;
+  }
+  return null;
+}
+async function runMcpScan(dir2, opts) {
+  const threshold = parseThreshold(opts.failOn);
+  if (opts.requireUpload && opts.upload === false) {
+    throw new Error("--require-upload and --no-upload contradict each other");
+  }
+  const report = await collectScan(dir2, opts);
+  report.account = await syncToAccount(report, opts);
+  if (report.account) {
+    report.worst = worst([
+      ...report.worst ? [{ severity: report.worst }] : [],
+      ...report.account.results.flatMap(
+        (r) => r.since ? [{ severity: r.since.severity }] : []
+      )
+    ]);
+  }
+  report.uploadProblem = uploadProblem(report, opts);
+  if (opts.sarif) {
+    const { writeFileSync: writeFileSync2 } = await import("fs");
+    const { scanFindings } = await import("./mcpConfig-3LYPRY5Q.js");
+    const { toSarif } = await import("./sarif-WLVJFJ7U.js");
+    const doc = toSarif(scanFindings(report), { version: VERSION, read: () => null });
+    writeFileSync2(opts.sarif, `${JSON.stringify(doc, null, 2)}
+`, "utf8");
+    console.error(`wrote ${opts.sarif}`);
+  }
+  if (opts.json) console.log(JSON.stringify(toJson(report), null, 2));
+  else if (report.servers.length === 0) {
+    console.log(dim(`no MCP servers configured for ${report.root}`));
+    for (const n of report.notes) console.log(dim(`\xB7 ${n}`));
+  } else render(report);
+  if (threshold && report.worst && SEVERITY_RANK[report.worst] <= SEVERITY_RANK[threshold]) {
+    process.exitCode = 1;
+  }
+  if (report.uploadProblem) {
+    console.error(
+      red(`upload required, and the scan was not fully recorded: ${report.uploadProblem}`)
+    );
+    process.exitCode = 1;
+  }
+  if (opts.githubIssue) await syncDashboardIssue(report);
+}
+async function syncDashboardIssue(report, env = process.env) {
+  const { githubEnvFrom, renderDashboardIssue, upsertDashboardIssue } = await import("./dashboardIssue-KBKLQMGC.js");
+  const gh = githubEnvFrom(env);
+  if (!gh) {
+    console.error(
+      yellow("--github-issue needs GITHUB_TOKEN and GITHUB_REPOSITORY; set by GitHub Actions")
+    );
+    return;
+  }
+  let plan = null;
+  let planNote = null;
+  if (resolveApiKey()) {
+    try {
+      const { buildUpgradePlan } = await import("./upgradePlan-ZS5IOVMZ.js");
+      plan = await buildUpgradePlan(report.root, { repo: gh.repo });
+    } catch (err) {
+      planNote = `Not checked: ${err instanceof Error ? err.message : String(err)}`.slice(0, 200);
+    }
+  } else {
+    planNote = "Add a LURQ_API_KEY secret to include dependency upgrades here.";
+  }
+  const runUrl = env.GITHUB_RUN_ID ? `${env.GITHUB_SERVER_URL ?? "https://github.com"}/${gh.repo}/actions/runs/${env.GITHUB_RUN_ID}` : null;
+  const rendered = renderDashboardIssue({
+    repo: gh.repo,
+    generatedAt: /* @__PURE__ */ new Date(),
+    runUrl,
+    dashboardUrl: "https://lurq.run/dashboard/mcp",
+    scan: report,
+    plan,
+    planNote
+  });
+  try {
+    const r = await upsertDashboardIssue(gh, rendered);
+    const what = r.action === "closed" ? "is closed, so it was left alone" : r.action;
+    console.error(
+      dim(
+        `dashboard issue ${what}${r.url ? `: ${r.url}` : ""}${r.commented ? " (commented on new urgent findings)" : ""}`
+      )
+    );
+  } catch (err) {
+    console.error(
+      yellow(
+        `::warning::could not update the lurq dashboard issue: ${err instanceof Error ? err.message : String(err)}`
+      )
+    );
+  }
+}
+async function runMcpStackLive(dir2, opts) {
+  const report = await collectScan(dir2, { ...opts, history: false });
+  if (opts.json) {
+    console.log(JSON.stringify({ ...report.stack, findings: report.findings }, null, 2));
+    return;
+  }
+  if (report.servers.length === 0) {
+    console.log(dim(`no MCP servers configured for ${report.root}`));
+    return;
+  }
+  const colour = report.stack.overall === "conflict" ? red : report.stack.overall === "unknown" ? yellow : green;
+  console.log(`${bold(report.root)}  ${colour(report.stack.overall)}`);
+  for (const c of report.stack.collisions) {
+    const tag = c.writes ? red("writes") : yellow("read-only");
+    console.log(`${red("\u2717")} ${bold(c.tool)} exposed by ${c.servers.join(" and ")}  [${tag}]`);
+  }
+  for (const f of report.findings.filter((x) => x.kind === "cross_server_reference")) {
+    console.log(`${sevColour(f.severity)("!")} ${bold(`${f.server} \u203A ${f.tool}`)} ${f.detail}`);
+  }
+  console.log(
+    table(
+      ["Server", "Status", "Tools", "Writes", "Destroys"],
+      report.servers.map((s) => [
+        s.alias,
+        statusCell(s),
+        s.analysis ? String(s.analysis.stats.tools) : "\u2014",
+        s.analysis ? String(s.analysis.stats.writes) : "\u2014",
+        s.analysis ? s.analysis.stats.destroys ? red(String(s.analysis.stats.destroys)) : "0" : "\u2014"
+      ])
+    )
+  );
+  console.log(dim(report.stack.note));
+  if (isCrowded(report.stack)) {
+    console.log(
+      yellow(
+        `~${report.stack.estimatedContextTokens.toLocaleString()} tokens of tool schema ride in every request \u2014 worth trimming`
+      )
+    );
+  }
+}
+async function runMcpCi(dir2, opts) {
+  const threshold = parseThreshold(opts.failOn ?? "high");
+  const root = resolve(dir2 ?? process.cwd());
+  const cfg = readServerConfigs(root, { projectOnly: true, trustProject: true, env: {} });
+  const { MCP_SCAN_WORKFLOW_PATH, renderMcpScanWorkflow, secretNameFor } = await import("./mcpScanWorkflow-27O44FOE.js");
+  const secrets = [
+    ...new Set(cfg.servers.flatMap((s) => s.unresolved.filter((v) => !v.startsWith("input:"))))
+  ];
+  const needsUv = cfg.servers.some(
+    (s) => s.registry === "pypi" || /^(uvx|uv|pipx)$/.test((s.command ?? "").split(/[\\/]/).pop() ?? "")
+  );
+  const yaml = renderMcpScanWorkflow({
+    cron: opts.cron,
+    failOn: threshold ?? "none",
+    secrets,
+    needsUv,
+    githubIssue: opts.issue !== false,
+    sarif: opts.sarif === true
+  });
+  if (opts.print) {
+    process.stdout.write(yaml);
+    return;
+  }
+  const { existsSync, mkdirSync: mkdirSync2, writeFileSync: writeFileSync2 } = await import("fs");
+  const { dirname, join: join2 } = await import("path");
+  const target = join2(root, MCP_SCAN_WORKFLOW_PATH);
+  if (existsSync(target) && !opts.force) {
+    throw new Error(`${MCP_SCAN_WORKFLOW_PATH} already exists; pass --force to replace it`);
+  }
+  mkdirSync2(dirname(target), { recursive: true });
+  writeFileSync2(target, yaml);
+  console.log(`wrote ${MCP_SCAN_WORKFLOW_PATH}`);
+  if (cfg.servers.length === 0) {
+    console.log(
+      yellow(
+        "no MCP servers are committed to this repository yet; the workflow scans only committed configs (.mcp.json)"
+      )
+    );
+  } else {
+    console.log(
+      dim(
+        `scans ${cfg.servers.length} committed server(s): ${cfg.servers.map((s) => s.alias).join(", ")}`
+      )
+    );
+  }
+  if (opts.sarif) {
+    console.log(
+      dim(
+        "findings upload to code scanning; enable it under Settings \u2192 Code security, or drop --sarif"
+      )
+    );
+  }
+  console.log("add these repository secrets:");
+  console.log(
+    `  ${bold("LURQ_API_KEY")}  ${dim("your lurq key, so scans are recorded to your account")}`
+  );
+  for (const s of secrets.sort())
+    console.log(
+      `  ${bold(secretNameFor(s))}${secretNameFor(s) !== s ? dim(`  (read by the server as ${s})`) : ""}`
+    );
+}
+export {
+  chunkUploads,
+  collectScan,
+  runMcpCi,
+  runMcpScan,
+  runMcpStackLive,
+  syncDashboardIssue,
+  syncToAccount,
+  uploadProblem
+};