lurqrun 0.1.7 → 0.1.8

package/dist/{dashboardIssue-WYYMBFIB.js → dashboardIssue-KBKLQMGC.js}

@@ -21,8 +21,12 @@ var code = (s) => `\`${s.replace(/[`\r\n]/g, "").slice(0, 120)}\``;
 var RANK = { critical: 0, high: 1, moderate: 2, low: 3, info: 4 };
 function mcpSection(scan, urgent) {
   const lines = ["### MCP servers", ""];
-  if (!scan.servers.length) return [...lines, "No MCP servers are committed to this repository.", ""];
-  lines.push("| Server | Status | Tools | Can modify | Findings |", "| --- | --- | --- | --- | --- |");
+  if (!scan.servers.length)
+    return [...lines, "No MCP servers are committed to this repository.", ""];
+  lines.push(
+    "| Server | Status | Tools | Can modify | Findings |",
+    "| --- | --- | --- | --- | --- |"
+  );
   for (const s of scan.servers.slice(0, MAX_ROWS)) {
     const f = s.analysis?.findings.filter((x) => RANK[x.severity] <= RANK.moderate) ?? [];
     const worst = f.sort((a, b) => RANK[a.severity] - RANK[b.severity])[0]?.severity;
@@ -31,36 +35,74 @@ function mcpSection(scan, urgent) {
     );
   }
   lines.push("");
-  const account = new Map((scan.account?.results ?? []).filter((r) => r.since).map((r) => [r.alias, r.since]));
+  const account = new Map(
+    (scan.account?.results ?? []).filter((r) => r.since).map((r) => [r.alias, r.since])
+  );
   const changes = scan.servers.flatMap((s) => {
     const acc = account.get(s.alias);
-    if (acc) return [{ alias: s.alias, key: s.serverKey, severity: acc.severity, summary: acc.summary, rug: acc.rugPull.length > 0 }];
+    if (acc)
+      return [
+        {
+          alias: s.alias,
+          key: s.serverKey,
+          severity: acc.severity,
+          summary: acc.summary,
+          rug: acc.rugPull.length > 0
+        }
+      ];
     const d = s.sinceLastScan;
-    return d && !d.unchanged ? [{ alias: s.alias, key: s.serverKey, severity: d.severity, summary: d.summary, rug: d.rugPull.length > 0 || d.contract.annotationFlips.some((x) => x.widensPrivilege) }] : [];
+    return d && !d.unchanged ? [
+      {
+        alias: s.alias,
+        key: s.serverKey,
+        severity: d.severity,
+        summary: d.summary,
+        rug: d.rugPull.length > 0 || d.contract.annotationFlips.some((x) => x.widensPrivilege)
+      }
+    ] : [];
   });
   if (changes.length) {
     lines.push("**Changed since the last scan**", "");
     for (const c of changes.sort((a, b) => RANK[a.severity] - RANK[b.severity])) {
       const line = `- **${c.severity}** ${code(c.alias)}: ${md(c.summary, 300)}`;
       lines.push(line);
-      if (c.rug || c.severity === "critical") urgent.push({ key: sha(`change|${c.key}|${c.summary}`).slice(0, 16), line });
+      if (c.rug || c.severity === "critical")
+        urgent.push({ key: sha(`change|${c.key}|${c.summary}`).slice(0, 16), line });
     }
     lines.push("");
   }
-  const findings = scan.servers.flatMap((s) => (s.analysis?.findings ?? []).map((f) => ({ ...f, alias: s.alias, serverKey: s.serverKey }))).concat(scan.findings.map((f) => ({ ...f, alias: f.server ?? "stack", serverKey: `stack:${f.server ?? ""}` }))).filter((f) => RANK[f.severity] <= RANK.high).sort((a, b) => RANK[a.severity] - RANK[b.severity]);
+  const findings = scan.servers.flatMap(
+    (s) => (s.analysis?.findings ?? []).map((f) => ({ ...f, alias: s.alias, serverKey: s.serverKey }))
+  ).concat(
+    scan.findings.map((f) => ({
+      ...f,
+      alias: f.server ?? "stack",
+      serverKey: `stack:${f.server ?? ""}`
+    }))
+  ).filter((f) => RANK[f.severity] <= RANK.high).sort((a, b) => RANK[a.severity] - RANK[b.severity]);
   if (findings.length) {
     lines.push("**Needs attention**", "");
     for (const f of findings.slice(0, MAX_ROWS)) {
       const line = `- **${f.severity}** ${code(f.alias)}${f.tool ? ` \u203A ${code(f.tool)}` : ""}: ${md(f.detail, 240)}`;
       lines.push(line);
-      if (f.severity === "critical") urgent.push({ key: sha(`finding|${f.serverKey}|${f.kind}|${f.tool}|${f.where}|${f.evidence}`).slice(0, 16), line });
+      if (f.severity === "critical")
+        urgent.push({
+          key: sha(`finding|${f.serverKey}|${f.kind}|${f.tool}|${f.where}|${f.evidence}`).slice(
+            0,
+            16
+          ),
+          line
+        });
     }
     lines.push("");
   }
   const unread = scan.servers.filter((s) => !s.snapshot);
   if (unread.length) {
     lines.push(`<details><summary>${unread.length} server(s) could not be read</summary>`, "");
-    for (const s of unread.slice(0, MAX_ROWS)) lines.push(`- ${code(s.alias)}: ${s.status.replace(/_/g, " ")}${s.error ? `, ${md(s.error, 160)}` : ""}`);
+    for (const s of unread.slice(0, MAX_ROWS))
+      lines.push(
+        `- ${code(s.alias)}: ${s.status.replace(/_/g, " ")}${s.error ? `, ${md(s.error, 160)}` : ""}`
+      );
     lines.push("", "</details>", "");
   }
   return lines;
@@ -69,16 +111,27 @@ function dependencySection(plan, note) {
   const lines = ["### Dependencies", ""];
   if (!plan) return [...lines, note ?? "Not checked on this run.", ""];
   if (!plan.upgrades.length) {
-    return [...lines, `Everything lurq tracks is on its latest release${plan.untracked ? ` (${plan.untracked} not yet indexed)` : ""}.`, ""];
+    return [
+      ...lines,
+      `Everything lurq tracks is on its latest release${plan.untracked ? ` (${plan.untracked} not yet indexed)` : ""}.`,
+      ""
+    ];
   }
   lines.push("| Package | Upgrade | What it removes | Advisories |", "| --- | --- | --- | --- |");
   const order = { "removes-exports": 0, "arity-changed": 1, unknown: 2, clean: 3 };
   for (const u of [...plan.upgrades].sort((a, b) => order[a.verdict] - order[b.verdict] || b.advisories - a.advisories).slice(0, MAX_ROWS)) {
     const removes = u.verdict === "removes-exports" ? `${u.removed.length} export(s)` : u.verdict === "arity-changed" ? "changed signatures" : u.verdict === "clean" ? "nothing" : "unknown";
-    lines.push(`| ${code(u.package)} | ${md(u.fromVersion, 40)} \u2192 ${md(u.toVersion, 40)}${u.majorsBehind ? ` (${u.majorsBehind} major)` : ""} | ${removes} | ${u.advisories || "\u2014"} |`);
+    lines.push(
+      `| ${code(u.package)} | ${md(u.fromVersion, 40)} \u2192 ${md(u.toVersion, 40)}${u.majorsBehind ? ` (${u.majorsBehind} major)` : ""} | ${removes} | ${u.advisories || "\u2014"} |`
+    );
   }
-  if (plan.upgrades.length > MAX_ROWS) lines.push("", `and ${plan.upgrades.length - MAX_ROWS} more.`);
-  if (plan.untracked) lines.push("", `${plan.untracked} dependencies are not indexed yet, so they are not covered here.`);
+  if (plan.upgrades.length > MAX_ROWS)
+    lines.push("", `and ${plan.upgrades.length - MAX_ROWS} more.`);
+  if (plan.untracked)
+    lines.push(
+      "",
+      `${plan.untracked} dependencies are not indexed yet, so they are not covered here.`
+    );
   lines.push("");
   return lines;
 }
@@ -110,9 +163,12 @@ function readMarkers(body) {
 }
 function withMarkers(body, hash, alerted) {
   const keys = alerted.slice(-MAX_ALERTED_KEYS).join(",");
-  return body.replace(DASHBOARD_MARKER, `${DASHBOARD_MARKER}
+  return body.replace(
+    DASHBOARD_MARKER,
+    `${DASHBOARD_MARKER}
 <!-- lurq:hash:${hash} -->
-<!-- lurq:alerted:${keys} -->`);
+<!-- lurq:alerted:${keys} -->`
+  );
 }
 var GithubIssueError = class extends Error {
   constructor(message, status) {
@@ -126,7 +182,11 @@ function githubEnvFrom(env) {
   const token = env.GITHUB_TOKEN;
   const repo = env.GITHUB_REPOSITORY;
   if (!token || !repo || !/^[\w.-]+\/[\w.-]+$/.test(repo)) return null;
-  return { token, repo, apiUrl: (env.GITHUB_API_URL ?? "https://api.github.com").replace(/\/$/, "") };
+  return {
+    token,
+    repo,
+    apiUrl: (env.GITHUB_API_URL ?? "https://api.github.com").replace(/\/$/, "")
+  };
 }
 async function gh(env, method, path, body) {
   const res = await (env.fetchImpl ?? fetch)(`${env.apiUrl}${path}`, {
@@ -151,28 +211,50 @@ async function gh(env, method, path, body) {
   return { status: res.status, data };
 }
 async function upsertDashboardIssue(env, rendered) {
-  const { data: issues } = await gh(env, "GET", `/repos/${env.repo}/issues?labels=${DASHBOARD_LABEL}&state=all&per_page=100`);
-  const mine = (issues ?? []).filter((i) => !i.pull_request && (i.body ?? "").includes(DASHBOARD_MARKER));
+  const { data: issues } = await gh(
+    env,
+    "GET",
+    `/repos/${env.repo}/issues?labels=${DASHBOARD_LABEL}&state=all&per_page=100`
+  );
+  const mine = (issues ?? []).filter(
+    (i) => !i.pull_request && (i.body ?? "").includes(DASHBOARD_MARKER)
+  );
   const open = mine.find((i) => i.state === "open");
   if (!open) {
     if (mine.length) return { action: "closed", url: mine[0].html_url, commented: 0 };
-    await gh(env, "POST", `/repos/${env.repo}/labels`, { name: DASHBOARD_LABEL, color: "6e40c9", description: "lurq dependency and MCP dashboard" });
+    await gh(env, "POST", `/repos/${env.repo}/labels`, {
+      name: DASHBOARD_LABEL,
+      color: "6e40c9",
+      description: "lurq dependency and MCP dashboard"
+    });
     const { data } = await gh(env, "POST", `/repos/${env.repo}/issues`, {
       title: rendered.title,
-      body: withMarkers(rendered.body, rendered.hash, rendered.urgent.map((u) => u.key)),
+      body: withMarkers(
+        rendered.body,
+        rendered.hash,
+        rendered.urgent.map((u) => u.key)
+      ),
       labels: [DASHBOARD_LABEL]
     });
     return { action: "created", url: data.html_url, commented: 0 };
   }
   const markers = readMarkers(open.body ?? "");
   const fresh = rendered.urgent.filter((u) => !markers.alerted.includes(u.key));
-  if (markers.hash === rendered.hash && !fresh.length) return { action: "unchanged", url: open.html_url, commented: 0 };
+  if (markers.hash === rendered.hash && !fresh.length)
+    return { action: "unchanged", url: open.html_url, commented: 0 };
   await gh(env, "PATCH", `/repos/${env.repo}/issues/${open.number}`, {
-    body: withMarkers(rendered.body, rendered.hash, [...markers.alerted, ...fresh.map((u) => u.key)])
+    body: withMarkers(rendered.body, rendered.hash, [
+      ...markers.alerted,
+      ...fresh.map((u) => u.key)
+    ])
   });
   if (fresh.length) {
     await gh(env, "POST", `/repos/${env.repo}/issues/${open.number}/comments`, {
-      body: [`lurq found ${fresh.length === 1 ? "something" : `${fresh.length} things`} that need a look today:`, "", ...fresh.map((u) => u.line)].join("\n")
+      body: [
+        `lurq found ${fresh.length === 1 ? "something" : `${fresh.length} things`} that need a look today:`,
+        "",
+        ...fresh.map((u) => u.line)
+      ].join("\n")
     });
   }
   return { action: "updated", url: open.html_url, commented: fresh.length ? 1 : 0 };

package/dist/{diff-GZA2774U.js → diff-I4SNUHU3.js}

@@ -3,7 +3,7 @@ import {
   checkApi,
   diffApiSurfaces,
   formatApiCheck
-} from "./chunk-CIDWNUAP.js";
+} from "./chunk-SOXFMMXC.js";
 import "./chunk-3GHJR7XR.js";
 import "./chunk-I3M2KJXB.js";
 export {

package/dist/domains-VRT4BRVZ.js

@@ -0,0 +1,14 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  AVAILABLE,
+  DOMAIN_SCAN_LIMIT,
+  SOURCE_DOMAINS,
+  runDomains
+} from "./chunk-XBQA4I36.js";
+import "./chunk-I3M2KJXB.js";
+export {
+  AVAILABLE,
+  DOMAIN_SCAN_LIMIT,
+  SOURCE_DOMAINS,
+  runDomains
+};

package/dist/env-UN6KGZ7S.js

@@ -0,0 +1,15 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  HARNESS_FILE,
+  declaredNames,
+  envFindings,
+  envReadsIn
+} from "./chunk-DONTW3NE.js";
+import "./chunk-SHZFOSXC.js";
+import "./chunk-I3M2KJXB.js";
+export {
+  HARNESS_FILE,
+  declaredNames,
+  envFindings,
+  envReadsIn
+};

package/dist/envCheck-KUPTORFQ.js

@@ -0,0 +1,71 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  envFindings
+} from "./chunk-DONTW3NE.js";
+import {
+  bold,
+  dim,
+  yellow
+} from "./chunk-4KCPOMG6.js";
+import "./chunk-SHZFOSXC.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/cli/envCheck.ts
+init_esm_shims();
+import { writeFileSync } from "fs";
+import { resolve } from "path";
+async function runEnvCheck(dir, opts) {
+  const root = resolve(dir ?? process.cwd());
+  const limit = opts.limit ? Number(opts.limit) : void 0;
+  if (limit !== void 0 && (!Number.isFinite(limit) || limit <= 0)) {
+    throw new Error(`--limit must be a positive number; got "${opts.limit}"`);
+  }
+  const plan = envFindings(root, { limit });
+  const distinct = new Set(plan.reads.map((r) => r.name)).size;
+  if (opts.sarif) {
+    const { toSarif } = await import("./sarif-WLVJFJ7U.js");
+    const { VERSION } = await import("./constants-DJFOFZ44.js");
+    const doc = toSarif(plan.findings, { version: VERSION, read: () => null });
+    writeFileSync(opts.sarif, `${JSON.stringify(doc, null, 2)}
+`, "utf8");
+    console.error(`wrote ${opts.sarif}`);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify({ root, ...plan, distinct }, null, 2));
+  } else {
+    console.log(formatEnvCheck(root, plan, distinct));
+  }
+  if (opts.exitCode && (plan.findings.length > 0 || plan.truncated)) process.exitCode = 1;
+}
+function formatEnvCheck(root, plan, distinct) {
+  const out = [];
+  const scanned = `${plan.reads.length} read(s) of ${distinct} variable(s) in ${root}`;
+  if (plan.findings.length === 0) {
+    out.push(`Every variable this project reads is declared or supplied by the platform.`);
+    out.push(dim(scanned));
+  } else {
+    out.push(`${plan.findings.length} variable(s) read here and declared nowhere:`);
+    for (const f of plan.findings) {
+      out.push(`  ${yellow(f.code.replace("env-undeclared:", ""))}  ${dim(f.evidence ?? "")}`);
+    }
+    out.push("");
+    out.push(
+      dim(
+        "add each to .env.example so the next clone knows it exists; ask the user for any real value"
+      )
+    );
+    out.push(dim(scanned));
+  }
+  if (plan.truncated) {
+    out.push(
+      bold("the scan stopped at its file limit, so this is not a complete answer (--limit)")
+    );
+  }
+  return out.join("\n");
+}
+export {
+  formatEnvCheck,
+  runEnvCheck
+};

package/dist/{extract-NKGKLIVT.js → extract-6WG265BL.js}

@@ -20,7 +20,8 @@ function classify(node) {
   if (ts.isFunctionExpression(node) || ts.isArrowFunction(node) || ts.isFunctionDeclaration(node)) {
     return { kind: "function", arity: arityOf(node), maxArity: maxArityOf(node) };
   }
-  if (ts.isClassExpression(node) || ts.isClassDeclaration(node)) return { kind: "class", arity: null };
+  if (ts.isClassExpression(node) || ts.isClassDeclaration(node))
+    return { kind: "class", arity: null };
   if (ts.isObjectLiteralExpression(node)) return { kind: "object", arity: null };
   if (ts.isStringLiteral(node) || ts.isNumericLiteral(node) || node.kind === ts.SyntaxKind.TrueKeyword || node.kind === ts.SyntaxKind.FalseKeyword || node.kind === ts.SyntaxKind.NullKeyword) {
     return { kind: "primitive", arity: null };
@@ -147,7 +148,16 @@ function walk(file, ctx, out) {
       for (const pick of picks) {
         const found = sub.get(pick.from);
         if (found) put(out, { ...found, path: pick.as });
-        else put(out, { path: pick.as, kind: "object", arity: null, origin: "local", deprecated: false, tier: TIER, sourceRef: { file: rel, line: 1 } });
+        else
+          put(out, {
+            path: pick.as,
+            kind: "object",
+            arity: null,
+            origin: "local",
+            deprecated: false,
+            tier: TIER,
+            sourceRef: { file: rel, line: 1 }
+          });
       }
       return;
     }
@@ -340,7 +350,8 @@ function walk(file, ctx, out) {
   }
 }
 function throughGetter(sf, value) {
-  if (!(ts.isArrowFunction(value) || ts.isFunctionExpression(value)) || value.parameters.length) return value;
+  if (!(ts.isArrowFunction(value) || ts.isFunctionExpression(value)) || value.parameters.length)
+    return value;
   let returned;
   if (!ts.isBlock(value.body)) returned = value.body;
   else if (value.body.statements.length === 1 && ts.isReturnStatement(value.body.statements[0])) {

package/dist/{fetch-QYTUJVG2.js → fetch-PJ3SC32M.js}

@@ -6,11 +6,11 @@ import {
   resolveTarball,
   unpackPackage,
   verifyIntegrity
-} from "./chunk-BV32UNLL.js";
-import "./chunk-AHBP533R.js";
-import "./chunk-SJOVFF7B.js";
+} from "./chunk-FVYFV5HA.js";
+import "./chunk-D3VTZS7V.js";
+import "./chunk-KYKSZ3XZ.js";
 import "./chunk-MYGSLK44.js";
-import "./chunk-GPTKSNR6.js";
+import "./chunk-72Y2FDVS.js";
 import "./chunk-I3M2KJXB.js";
 export {
   extractUnpacked,

package/dist/{firstTouch-QQTJH4QX.js → firstTouch-COJCMOB3.js}

@@ -20,7 +20,7 @@ function extractOnce(db, pkg, version) {
   if (existing) return existing;
   if (inFlight.size >= MAX_INFLIGHT) return Promise.resolve(null);
   const task = (async () => {
-    const { extractAndStore } = await import("./surface-V62GE554.js");
+    const { extractAndStore } = await import("./surface-7MHE3RL7.js");
     const { outcome, version: resolved } = await extractAndStore(db, pkg, version);
     return outcome === "stored" || outcome === "cached" ? resolved : null;
   })().catch((err) => {

package/dist/fix-3EDWNKW3.js

@@ -0,0 +1,220 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  SCAN_LIMIT,
+  fixableTargets,
+  parseUpgradeSpec,
+  planUpgrades
+} from "./chunk-QCRBX3LV.js";
+import {
+  manifestFindings
+} from "./chunk-5ALIJFDA.js";
+import {
+  applyEdits,
+  deterministic,
+  editsByFile,
+  unifiedDiff
+} from "./chunk-BM3LF5T6.js";
+import "./chunk-3GHJR7XR.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/cli/fix.ts
+init_esm_shims();
+import { readFileSync, writeFileSync } from "fs";
+import { join, relative } from "path";
+async function derivePlanTargets(dir, opts) {
+  const { buildUpgradePlan } = await import("./upgradePlan-ZS5IOVMZ.js");
+  try {
+    const plan = await buildUpgradePlan(dir, {
+      url: opts.url,
+      apiKey: opts.apiKey,
+      repo: opts.repo
+    });
+    return fixableTargets(plan.upgrades, opts.max);
+  } catch (err) {
+    if (err instanceof Error && err.name === "MissingKeyError") {
+      throw new Error(
+        `${err.message}
+
+Or skip the lookup: \`lurq fix --upgrade pkg@from..to\` reads both versions straight from npm and needs no key.`
+      );
+    }
+    throw err;
+  }
+}
+function stage(root, findings) {
+  const writes = /* @__PURE__ */ new Map();
+  let diff = "";
+  for (const [file, edits] of editsByFile(findings.filter(deterministic))) {
+    const before = readFileSync(join(root, file), "utf8");
+    diff += unifiedDiff(file, before, edits);
+    writes.set(file, applyEdits(before, edits));
+  }
+  return { writes, diff };
+}
+async function runFix(dir, opts) {
+  const { scanReferences } = await import("./references-I6Y4BSRR.js");
+  const { checkUpgrade } = await import("./upgrade-FS26DJGG.js");
+  const { renamePlan } = await import("./rename-OS6JYBZQ.js");
+  const asked = Boolean(opts.plan) || (opts.upgrade?.length ?? 0) > 0;
+  const split = asked ? {
+    ...fixableTargets(opts.plan ? planUpgrades(opts.plan) : [], opts.max),
+    named: (opts.upgrade ?? []).map(parseUpgradeSpec)
+  } : { ...await derivePlanTargets(dir, opts), named: [] };
+  const targets = [...split.targets, ...split.named];
+  const skipped = split.skipped;
+  const { runDomains, SOURCE_DOMAINS } = await import("./domains-VRT4BRVZ.js");
+  const source = await runDomains({ dir, domains: SOURCE_DOMAINS });
+  const unchecked = source.skipped.map((d) => ({ domain: d.domain, reason: d.reason }));
+  if (targets.length === 0 && source.findings.length === 0) {
+    const empty = {
+      root: dir,
+      files: [],
+      applied: [],
+      remaining: [],
+      refused: [],
+      skipped,
+      unchecked
+    };
+    const lines = skipped.length ? [
+      `Nothing attempted in ${dir}. ${skipped.length} upgrade(s) deliberately not tried:`,
+      ...skippedLines(skipped)
+    ] : [
+      `Nothing to fix in ${dir}: ${asked ? "no upgrade named here needs a change" : "every dependency is current or held by the repo policy"}, ${// Never "the source is clean" when no detector survived to look.
+      // `ran` is empty only when every source domain threw, and that is
+      // the one case where the reassuring sentence would be false.
+      source.ran.length ? "and nothing in the source needs changing" : "and the source could not be scanned"}.`
+    ];
+    lines.push(...uncheckedLines(unchecked));
+    console.log(opts.json ? JSON.stringify(empty, null, 2) : lines.join("\n"));
+    return;
+  }
+  let findings = [];
+  const refused = [];
+  if (targets.length > 0) {
+    const refs = scanReferences(dir, { limit: SCAN_LIMIT });
+    const report = await checkUpgrade(targets, refs, { rootDir: dir });
+    const renames = renamePlan(report);
+    const { findManifests } = await import("./upgradePlan-ZS5IOVMZ.js");
+    const manifests = manifestFindings(dir, targets, {
+      files: findManifests(dir).map((abs) => relative(dir, abs) || "package.json")
+    });
+    findings = [...renames.findings, ...manifests.findings];
+    refused.push(
+      ...renames.refused,
+      ...manifests.refused.map((r) => ({ symbol: r.package, file: r.file, reason: r.reason }))
+    );
+  }
+  findings = [...findings, ...source.findings];
+  const result = {
+    root: dir,
+    files: [],
+    applied: [],
+    remaining: [],
+    refused: refused.map((r) => ({ symbol: r.symbol, file: r.file, reason: r.reason })),
+    skipped,
+    unchecked
+  };
+  const { writes, diff } = stage(dir, findings);
+  result.files = [...writes.keys()];
+  for (const f of findings) {
+    if (deterministic(f)) {
+      result.applied.push({
+        code: f.code,
+        summary: f.fix.summary,
+        files: [...new Set(f.fix.edits.map((e) => e.file))]
+      });
+    } else {
+      result.remaining.push({
+        code: f.code,
+        detail: f.detail,
+        instruction: f.fix?.task?.instruction,
+        files: f.fix?.task?.files,
+        evidence: f.fix?.task?.evidence
+      });
+    }
+  }
+  if (opts.apply && writes.size > 0) {
+    const { writeFileAtomic } = await import("./installSkill-5TIMYIJZ.js");
+    for (const [file, contents] of writes) writeFileAtomic(join(dir, file), contents);
+  }
+  if (opts.sarif) {
+    const { toSarif } = await import("./sarif-WLVJFJ7U.js");
+    const { VERSION } = await import("./constants-DJFOFZ44.js");
+    const sarif = toSarif(findings, {
+      version: VERSION,
+      // Read from disk rather than reusing the staged text: regions must
+      // describe the file as it is, not as it would be after the fix.
+      read: (file) => {
+        try {
+          return readFileSync(join(dir, file), "utf8");
+        } catch {
+          return null;
+        }
+      }
+    });
+    writeFileSync(opts.sarif, `${JSON.stringify(sarif, null, 2)}
+`, "utf8");
+    console.error(`wrote ${opts.sarif}`);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify({ ...result, applied_to_disk: Boolean(opts.apply) }, null, 2));
+  } else {
+    console.log(formatFix(result, diff, Boolean(opts.apply)));
+  }
+  if (opts.exitCode && result.remaining.length > 0) process.exitCode = 1;
+}
+function uncheckedLines(unchecked) {
+  if (unchecked.length === 0) return [];
+  return [
+    "",
+    `${unchecked.length} domain(s) could not be checked:`,
+    ...unchecked.map((u) => `  ${u.domain}: ${u.reason}`)
+  ];
+}
+function skippedLines(skipped) {
+  return skipped.map((s) => `  ${s.package}: ${s.reason}`);
+}
+function formatFix(result, diff, applied) {
+  const out = [];
+  if (result.applied.length === 0 && result.remaining.length === 0) {
+    return [
+      `Nothing to fix in ${result.root}: no upgrade in this plan renames a symbol this code references,`,
+      "every declared range already admits its target, and nothing in the source names a retired model",
+      "or reads an undeclared variable."
+    ].join(" ");
+  }
+  if (result.applied.length > 0) {
+    out.push(
+      applied ? `Wrote ${result.files.length} file(s) in ${result.root}:` : `Would write ${result.files.length} file(s) in ${result.root} (pass --apply):`
+    );
+    for (const a of result.applied) out.push(`  ${a.summary} \u2014 ${a.files.join(", ")}`);
+    if (!applied && diff) out.push("", diff.trimEnd());
+  }
+  if (result.remaining.length > 0) {
+    out.push("", `${result.remaining.length} change(s) lurq will not make for you:`);
+    for (const r of result.remaining) {
+      out.push(`  ${r.detail}`);
+      if (r.instruction) out.push(`    do: ${r.instruction}`);
+      if (r.files?.length) out.push(`    in: ${r.files.join(", ")}`);
+      for (const e of r.evidence ?? []) out.push(`    use: ${e}`);
+    }
+  }
+  if (result.skipped.length > 0) {
+    out.push("", `${result.skipped.length} upgrade(s) deliberately not attempted:`);
+    out.push(...skippedLines(result.skipped));
+  }
+  out.push(...uncheckedLines(result.unchecked));
+  if (result.refused.length > 0) {
+    out.push("", "Proven renames left alone:");
+    for (const r of result.refused) out.push(`  ${r.file ?? r.symbol}: ${r.reason}`);
+  }
+  return out.join("\n");
+}
+export {
+  formatFix,
+  runFix,
+  stage,
+  uncheckedLines
+};

package/dist/{handlers-GEJAVZDK.js → handlers-4Q37WIFT.js}

@@ -11,32 +11,34 @@ import {
   handleVerify,
   latestDataAsOf,
   rowToEvaluate
-} from "./chunk-BULZAX2U.js";
+} from "./chunk-64ZF7KO4.js";
 import "./chunk-QSL6QN5X.js";
-import "./chunk-M6NYEXCW.js";
-import "./chunk-6L3U7DZ5.js";
-import "./chunk-J5FZYN4A.js";
-import "./chunk-PSX3GIAN.js";
-import "./chunk-FW6BD2NO.js";
+import "./chunk-NYZU5NCW.js";
+import "./chunk-2WD4QAH4.js";
+import "./chunk-DSROTZ3Z.js";
+import "./chunk-TUXQ32WE.js";
 import "./chunk-BUALU27S.js";
-import "./chunk-LRD4GBYE.js";
-import "./chunk-BCANRN5B.js";
-import "./chunk-2VMOWSRY.js";
+import "./chunk-QUIMQ7YL.js";
+import "./chunk-6DM6UQFD.js";
+import "./chunk-EYAKM6YN.js";
+import "./chunk-D3VTZS7V.js";
 import "./chunk-4ESO33J6.js";
-import "./chunk-CW5HJ3LX.js";
-import "./chunk-AHBP533R.js";
-import "./chunk-SJOVFF7B.js";
-import "./chunk-HWBBVLOT.js";
-import "./chunk-NH5I4KHH.js";
+import "./chunk-NPVN2THM.js";
 import "./chunk-VLRHFMGJ.js";
-import "./chunk-WQ23REYT.js";
-import "./chunk-LYMPYETA.js";
+import "./chunk-VGCDRK3S.js";
+import "./chunk-4JHDSVIN.js";
+import "./chunk-GM5Y555O.js";
+import "./chunk-2GAYNIHG.js";
+import "./chunk-KYKSZ3XZ.js";
+import "./chunk-A3TYI2TF.js";
+import "./chunk-HWFX4BC4.js";
+import "./chunk-6L67QMCP.js";
 import "./chunk-3GHJR7XR.js";
 import "./chunk-GRJXQBQZ.js";
 import "./chunk-WHX2ZFCG.js";
 import "./chunk-LUAKDHLZ.js";
 import "./chunk-MYGSLK44.js";
-import "./chunk-GPTKSNR6.js";
+import "./chunk-72Y2FDVS.js";
 import "./chunk-I3M2KJXB.js";
 export {
   USAGE_PAGE_SIZE,