lurqrun 0.1.7 → 0.1.8

package/dist/probe-3IK646WN.js

@@ -0,0 +1,610 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  Client,
+  LIMITS,
+  addTools,
+  emptySnapshot
+} from "./chunk-XIFQIFSZ.js";
+import "./chunk-XLXPVN3Y.js";
+import {
+  UnsafeUrlError
+} from "./chunk-J3U2CPSK.js";
+import "./chunk-3D2MPGOQ.js";
+import {
+  endpointIdentity
+} from "./chunk-5ABNDB3I.js";
+import {
+  SSEClientTransport,
+  StreamableHTTPClientTransport
+} from "./chunk-X4W64MHU.js";
+import {
+  external_exports
+} from "./chunk-D3K6IZVR.js";
+import "./chunk-6EQ3ARXA.js";
+import "./chunk-SHCEBP3J.js";
+import "./chunk-WHX2ZFCG.js";
+import {
+  VERSION
+} from "./chunk-72Y2FDVS.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/remoteProbe/probe.ts
+init_esm_shims();
+
+// node_modules/zod/v4/classic/index.js
+init_esm_shims();
+
+// src/remoteProbe/oauth.ts
+init_esm_shims();
+var MAX_DOC_BYTES = 256e3;
+function parseWwwAuthenticate(header) {
+  if (!header) return null;
+  const m = /^\s*([A-Za-z0-9!#$%&'*+.^_`|~-]+)\s*(.*)$/s.exec(header);
+  if (!m) return null;
+  const params = {};
+  const re = /([A-Za-z0-9!#$%&'*+.^_`|~-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]+))\s*,?/g;
+  let p;
+  while ((p = re.exec(m[2] ?? "")) !== null) {
+    const key = p[1].toLowerCase();
+    if (!(key in params)) params[key] = p[2] !== void 0 ? p[2].replace(/\\(.)/g, "$1") : p[3];
+  }
+  return { scheme: m[1].toLowerCase(), params };
+}
+async function readJson(fetch, url, signal) {
+  try {
+    const res = await fetch(url, { headers: { accept: "application/json" }, signal });
+    if (res.status !== 200) {
+      await res.body?.cancel().catch(() => {
+      });
+      return null;
+    }
+    const text = await res.text();
+    if (text.length > MAX_DOC_BYTES) return null;
+    const body = JSON.parse(text);
+    return body && typeof body === "object" && !Array.isArray(body) ? body : null;
+  } catch {
+    return null;
+  }
+}
+var strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : null;
+function resourceMetadataCandidates(endpoint, headerValue) {
+  const out = [];
+  if (headerValue) {
+    try {
+      out.push({ url: new URL(headerValue, endpoint).toString(), via: "www_authenticate" });
+    } catch {
+    }
+  }
+  const path = endpoint.pathname.replace(/\/+$/, "");
+  if (path)
+    out.push({
+      url: `${endpoint.origin}/.well-known/oauth-protected-resource${path}`,
+      via: "well_known_path"
+    });
+  out.push({
+    url: `${endpoint.origin}/.well-known/oauth-protected-resource`,
+    via: "well_known_root"
+  });
+  return out;
+}
+function authServerMetadataCandidates(issuer) {
+  let u;
+  try {
+    u = new URL(issuer);
+  } catch {
+    return [];
+  }
+  const path = u.pathname.replace(/\/+$/, "");
+  if (!path) {
+    return [
+      `${u.origin}/.well-known/oauth-authorization-server`,
+      `${u.origin}/.well-known/openid-configuration`
+    ];
+  }
+  return [
+    `${u.origin}/.well-known/oauth-authorization-server${path}`,
+    `${u.origin}/.well-known/openid-configuration${path}`,
+    `${u.origin}${path}/.well-known/openid-configuration`
+  ];
+}
+function resourceCovers(resource, endpoint) {
+  try {
+    const r = new URL(resource);
+    if (r.origin.toLowerCase() !== endpoint.origin.toLowerCase()) return false;
+    const rp = r.pathname.replace(/\/+$/, "");
+    const ep = endpoint.pathname.replace(/\/+$/, "");
+    return rp === "" || ep === rp || ep.startsWith(`${rp}/`);
+  } catch {
+    return false;
+  }
+}
+async function discoverOAuth(fetch, endpoint, challenge, signal) {
+  const violations = [];
+  const headerValue = challenge?.params.resource_metadata ?? null;
+  if (headerValue && !/^https?:\/\//i.test(headerValue)) {
+    violations.push({
+      code: "resource_metadata_not_absolute",
+      detail: `WWW-Authenticate resource_metadata is "${headerValue.slice(0, 200)}", not an absolute URL; clients that do not resolve it cannot find the authorization server`
+    });
+  }
+  let prm = null;
+  let found = null;
+  let sawInvalid = false;
+  for (const c of resourceMetadataCandidates(endpoint, headerValue)) {
+    const doc = await readJson(fetch, c.url, signal);
+    if (!doc) continue;
+    if (!strings(doc.authorization_servers)?.length) {
+      sawInvalid = true;
+      continue;
+    }
+    prm = doc;
+    found = c;
+    break;
+  }
+  if (!prm || !found) {
+    if (sawInvalid) {
+      violations.push({
+        code: "resource_metadata_invalid",
+        detail: "protected resource metadata lists no authorization_servers"
+      });
+    } else if (headerValue) {
+      violations.push({
+        code: "resource_metadata_unreachable",
+        detail: "the resource_metadata URL in WWW-Authenticate did not return a metadata document"
+      });
+    } else {
+      violations.push({
+        code: "challenge_without_resource_metadata",
+        detail: "refused without credentials but publishes no OAuth protected resource metadata; a key or token must be configured by hand"
+      });
+    }
+    return { oauth: null, violations };
+  }
+  const authorizationServers = strings(prm.authorization_servers);
+  const resource = typeof prm.resource === "string" ? prm.resource : null;
+  if (prm.resource !== void 0 && resource === null) {
+    violations.push({
+      code: "resource_metadata_invalid",
+      detail: "`resource` in protected resource metadata is not a string"
+    });
+  } else if (resource && !resourceCovers(resource, endpoint)) {
+    violations.push({
+      code: "resource_mismatch",
+      detail: `protected resource metadata names resource ${resource.slice(0, 200)}, which does not cover ${endpoint.toString()}; clients that validate it refuse the token`
+    });
+  }
+  const profile = {
+    resourceMetadataUrl: found.url,
+    resourceMetadataVia: found.via,
+    resource,
+    authorizationServers,
+    scopesSupported: strings(prm.scopes_supported),
+    challengeScope: challenge?.params.scope ?? null,
+    issuer: null,
+    asMetadataUrl: null,
+    cimd: false,
+    dcr: false,
+    pkceS256: false,
+    issParameter: null
+  };
+  const issuer = authorizationServers[0];
+  for (const candidate of authServerMetadataCandidates(issuer)) {
+    const asm = await readJson(fetch, candidate, signal);
+    if (!asm || typeof asm.issuer !== "string") continue;
+    profile.issuer = asm.issuer;
+    profile.asMetadataUrl = candidate;
+    profile.cimd = asm.client_id_metadata_document_supported === true;
+    profile.dcr = typeof asm.registration_endpoint === "string" && asm.registration_endpoint.length > 0;
+    profile.pkceS256 = strings(asm.code_challenge_methods_supported)?.includes("S256") ?? false;
+    profile.issParameter = typeof asm.authorization_response_iss_parameter_supported === "boolean" ? asm.authorization_response_iss_parameter_supported : null;
+    if (asm.issuer !== issuer) {
+      violations.push({
+        code: "issuer_mismatch",
+        detail: asm.issuer.replace(/\/+$/, "") === issuer.replace(/\/+$/, "") ? `authorization server metadata issuer "${asm.issuer}" differs from "${issuer}" only by a trailing slash; the spec requires an identical string, so strict clients reject it` : `authorization server metadata issuer "${asm.issuer.slice(0, 200)}" does not match "${issuer.slice(0, 200)}"; clients must not use it`
+      });
+    }
+    if (!profile.pkceS256) {
+      violations.push({
+        code: "pkce_s256_not_advertised",
+        detail: "code_challenge_methods_supported does not include S256; compliant clients refuse to proceed"
+      });
+    }
+    if (!profile.cimd && !profile.dcr) {
+      violations.push({
+        code: "no_client_registration",
+        detail: "neither Client ID Metadata Documents nor Dynamic Client Registration is offered; only clients where the user can enter a pre-registered client id can sign in"
+      });
+    }
+    return { oauth: profile, violations };
+  }
+  violations.push({
+    code: "as_metadata_unreachable",
+    detail: `no authorization server metadata found for ${issuer.slice(0, 200)}`
+  });
+  return { oauth: profile, violations };
+}
+
+// src/remoteProbe/probe.ts
+var PROBE_PROTOCOL_VERSION = "2026-07-28";
+var CLIENT_INFO = { name: "lurq-probe", version: VERSION };
+var PROBE_DEFAULTS = {
+  /** Whole probe, discovery included. */
+  budgetMs: 25e3,
+  requestTimeoutMs: 1e4,
+  /** Tool pages read at most; the snapshot's own caps still apply. */
+  maxPages: 20
+};
+var HttpStatusError = class extends Error {
+  constructor(status, wwwAuthenticate) {
+    super(`HTTP ${status}`);
+    this.status = status;
+    this.wwwAuthenticate = wwwAuthenticate;
+  }
+  status;
+  wwwAuthenticate;
+};
+function blankAuth(declared) {
+  return { mode: "unknown", challengeStatus: null, oauth: null, declaredHeaders: declared };
+}
+function base(url, declared) {
+  return {
+    url,
+    status: "unreachable",
+    httpStatus: null,
+    transport: null,
+    protocolMode: null,
+    protocolVersion: null,
+    serverName: null,
+    serverVersion: null,
+    auth: blankAuth(declared),
+    violations: [],
+    snapshot: null,
+    error: null,
+    latencyMs: null,
+    finalUrl: null
+  };
+}
+function classifyNetworkError(err) {
+  if (err instanceof UnsafeUrlError) return { status: "blocked", error: err.message };
+  const e = err;
+  const code = e?.code ?? e?.cause?.code ?? "";
+  const name = e?.name ?? e?.cause?.name ?? "";
+  if (code === "EPRIVATE")
+    return { status: "blocked", error: "the hostname resolves to a private network address" };
+  if (code === "ENOTFOUND" || code === "EAI_AGAIN")
+    return { status: "dns_failed", error: "the hostname does not resolve" };
+  if (name === "AbortError" || name === "TimeoutError" || code === "UND_ERR_HEADERS_TIMEOUT" || code === "UND_ERR_BODY_TIMEOUT" || code === "ETIMEDOUT") {
+    return { status: "timeout", error: "no response within the time limit" };
+  }
+  if (code === "ETOOLARGE")
+    return { status: "protocol_error", error: "the response was larger than lurq reads" };
+  if (/CERT|SSL|TLS|ERR_TLS/i.test(code))
+    return { status: "unreachable", error: `TLS failure (${code})` };
+  return {
+    status: "unreachable",
+    error: code ? `connection failed (${code})` : "connection failed"
+  };
+}
+function statusForHttp(status) {
+  if (status === 401 || status === 403) return "auth_required";
+  if (status === 404 || status === 410) return "not_found";
+  if (status >= 500) return "server_error";
+  return "protocol_error";
+}
+async function readRpc(res, id) {
+  const type = res.headers.get("content-type") ?? "";
+  const text = await res.text();
+  if (type.includes("text/event-stream")) {
+    for (const block of text.split(/\r?\n\r?\n/)) {
+      const data = block.split(/\r?\n/).filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trimStart()).join("\n");
+      if (!data) continue;
+      try {
+        const msg = JSON.parse(data);
+        if (msg.id === id) return msg;
+      } catch {
+      }
+    }
+    return null;
+  }
+  try {
+    const msg = JSON.parse(text);
+    return msg && typeof msg === "object" && !Array.isArray(msg) ? msg : null;
+  } catch {
+    return null;
+  }
+}
+var meta = () => ({
+  "io.modelcontextprotocol/protocolVersion": PROBE_PROTOCOL_VERSION,
+  "io.modelcontextprotocol/clientInfo": CLIENT_INFO,
+  "io.modelcontextprotocol/clientCapabilities": {}
+});
+async function statelessToolsList(fetch, url, opts, onFirst) {
+  const pages = [];
+  let cursor;
+  let info = {
+    serverName: null,
+    serverVersion: null
+  };
+  for (let page = 0; page < opts.maxPages; page++) {
+    const id = page + 1;
+    const res = await fetch(url, {
+      method: "POST",
+      signal: opts.signal,
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json, text/event-stream",
+        "mcp-method": "tools/list",
+        "mcp-protocol-version": PROBE_PROTOCOL_VERSION
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id,
+        method: "tools/list",
+        params: { ...cursor ? { cursor } : {}, _meta: meta() }
+      })
+    });
+    if (page === 0) onFirst(res);
+    if (res.status === 401 || res.status === 403) {
+      await res.body?.cancel().catch(() => {
+      });
+      throw new HttpStatusError(res.status, res.headers.get("www-authenticate"));
+    }
+    if (res.status !== 200) {
+      await res.body?.cancel().catch(() => {
+      });
+      if (page === 0 && [400, 404, 405, 406, 415].includes(res.status)) return null;
+      throw new HttpStatusError(res.status, null);
+    }
+    const msg = await readRpc(res, id);
+    const result = msg?.result;
+    if (!result || !Array.isArray(result.tools)) {
+      if (page === 0) return null;
+      break;
+    }
+    pages.push(result.tools);
+    const serverInfo = result._meta?.["io.modelcontextprotocol/serverInfo"];
+    if (page === 0 && serverInfo) {
+      info = {
+        serverName: typeof serverInfo.name === "string" ? serverInfo.name : null,
+        serverVersion: typeof serverInfo.version === "string" ? serverInfo.version : null
+      };
+    }
+    cursor = typeof result.nextCursor === "string" && result.nextCursor ? result.nextCursor : void 0;
+    if (!cursor)
+      return { tools: pages, truncated: false, ...info, protocolVersion: PROBE_PROTOCOL_VERSION };
+  }
+  return {
+    tools: pages,
+    truncated: Boolean(cursor),
+    ...info,
+    protocolVersion: PROBE_PROTOCOL_VERSION
+  };
+}
+var ToolsPage = external_exports.looseObject({
+  tools: external_exports.array(external_exports.unknown()).optional(),
+  nextCursor: external_exports.string().optional()
+});
+async function handshakeToolsList(fetch, url, kind, opts) {
+  const client = new Client(CLIENT_INFO, { capabilities: {} });
+  const target = new URL(url);
+  const transport = kind === "streamable-http" ? new StreamableHTTPClientTransport(target, {
+    fetch,
+    reconnectionOptions: {
+      maxRetries: 0,
+      initialReconnectionDelay: 1e3,
+      maxReconnectionDelay: 1e3,
+      reconnectionDelayGrowFactor: 1
+    }
+  }) : new SSEClientTransport(target, {
+    fetch,
+    eventSourceInit: { fetch }
+  });
+  try {
+    await client.connect(transport, { timeout: opts.requestTimeoutMs, signal: opts.signal });
+    const pages = [];
+    let cursor;
+    for (let page = 0; page < opts.maxPages; page++) {
+      const res = await client.request(
+        { method: "tools/list", params: cursor ? { cursor } : {} },
+        ToolsPage,
+        {
+          timeout: opts.requestTimeoutMs,
+          signal: opts.signal
+        }
+      );
+      pages.push(res.tools ?? []);
+      cursor = res.nextCursor || void 0;
+      if (!cursor) break;
+    }
+    const v = client.getServerVersion();
+    return {
+      tools: pages,
+      truncated: Boolean(cursor),
+      serverName: v?.name ?? null,
+      serverVersion: v?.version ?? null,
+      protocolVersion: transport.protocolVersion ?? null
+    };
+  } finally {
+    await client.close().catch(() => {
+    });
+  }
+}
+function httpFromSdkError(err) {
+  if (err instanceof HttpStatusError)
+    return { status: err.status, wwwAuthenticate: err.wwwAuthenticate };
+  const e = err;
+  if (e?.name === "UnauthorizedError") return { status: 401, wwwAuthenticate: null };
+  if (typeof e?.code === "number" && e.code >= 400 && e.code < 600)
+    return { status: e.code, wwwAuthenticate: null };
+  const m = /\b(?:HTTP|status(?: code)?)[\s:]*([45]\d\d)\b/i.exec(e?.message ?? "");
+  return m ? { status: Number(m[1]), wwwAuthenticate: null } : null;
+}
+function buildSnapshot(read) {
+  const snapshot = emptySnapshot();
+  snapshot.serverInfo = { name: read.serverName, version: read.serverVersion, title: null };
+  snapshot.protocolVersion = read.protocolVersion;
+  snapshot.capabilities.tools = true;
+  const seen = /* @__PURE__ */ new Map();
+  for (const page of read.tools) if (!addTools(page, seen, snapshot.issues)) break;
+  snapshot.tools = [...seen.values()];
+  if (read.truncated) {
+    snapshot.issues.push({
+      list: "tools",
+      kind: "truncated",
+      detail: `still paginating after ${LIMITS.pages} pages`
+    });
+  }
+  return snapshot;
+}
+async function probeEndpoint(rawUrl, opts) {
+  const declared = opts.declaredHeaders ?? [];
+  const identity = endpointIdentity(rawUrl);
+  const out = base(identity?.url ?? rawUrl, declared);
+  if (!identity) return { ...out, status: "blocked", error: "not an http(s) URL" };
+  if (identity.templated)
+    return {
+      ...out,
+      status: "templated",
+      error: "the URL has placeholders that must be filled in first"
+    };
+  const started = Date.now();
+  const budget = AbortSignal.timeout(opts.budgetMs ?? PROBE_DEFAULTS.budgetMs);
+  const maxPages = Math.min(opts.maxPages ?? PROBE_DEFAULTS.maxPages, LIMITS.pages);
+  const requestTimeoutMs = opts.requestTimeoutMs ?? PROBE_DEFAULTS.requestTimeoutMs;
+  let challenge = null;
+  let read = null;
+  let mode = null;
+  let transport = null;
+  try {
+    read = await statelessToolsList(
+      opts.fetch,
+      identity.url,
+      { signal: budget, maxPages },
+      (res) => {
+        out.latencyMs = Date.now() - started;
+        out.httpStatus = res.status;
+        if (res.url && res.url !== identity.url) out.finalUrl = res.url;
+      }
+    );
+    if (read) {
+      mode = "stateless";
+      transport = "streamable-http";
+    }
+  } catch (err) {
+    const http = httpFromSdkError(err);
+    if (http) {
+      out.httpStatus = http.status;
+      if (http.status === 401 || http.status === 403) challenge = http;
+      else
+        return {
+          ...out,
+          status: statusForHttp(http.status),
+          error: `HTTP ${http.status}`,
+          auth: { ...out.auth, mode: "unknown" }
+        };
+    } else {
+      const c = classifyNetworkError(err);
+      return { ...out, ...c, latencyMs: out.latencyMs ?? Date.now() - started };
+    }
+  }
+  if (!read && !challenge) {
+    for (const kind of ["streamable-http", "sse"]) {
+      if (budget.aborted) break;
+      try {
+        read = await handshakeToolsList(opts.fetch, identity.url, kind, {
+          requestTimeoutMs,
+          maxPages,
+          signal: budget
+        });
+        mode = "initialize";
+        transport = kind;
+        break;
+      } catch (err) {
+        const http = httpFromSdkError(err);
+        if (http && (http.status === 401 || http.status === 403)) {
+          challenge = http;
+          out.httpStatus = http.status;
+          break;
+        }
+        if (http) out.httpStatus = http.status;
+        if (kind === "sse" || http && ![400, 404, 405].includes(http.status)) {
+          const c = http ? { status: statusForHttp(http.status), error: `HTTP ${http.status}` } : classifyNetworkError(err);
+          return { ...out, ...c, latencyMs: out.latencyMs ?? Date.now() - started };
+        }
+      }
+    }
+  }
+  if (read) {
+    const snapshot = buildSnapshot(read);
+    return {
+      ...out,
+      status: "open",
+      transport,
+      protocolMode: mode,
+      protocolVersion: read.protocolVersion,
+      serverName: read.serverName,
+      serverVersion: read.serverVersion,
+      snapshot,
+      auth: { ...out.auth, mode: "none" },
+      latencyMs: out.latencyMs ?? Date.now() - started
+    };
+  }
+  if (challenge) {
+    let wwwAuthenticate = challenge.wwwAuthenticate;
+    if (wwwAuthenticate === null) {
+      try {
+        const res = await opts.fetch(identity.url, {
+          method: "POST",
+          signal: budget,
+          headers: {
+            "content-type": "application/json",
+            accept: "application/json, text/event-stream"
+          },
+          body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "initialize",
+            params: { protocolVersion: "2025-06-18", capabilities: {}, clientInfo: CLIENT_INFO }
+          })
+        });
+        wwwAuthenticate = res.headers.get("www-authenticate");
+        await res.body?.cancel().catch(() => {
+        });
+      } catch {
+      }
+    }
+    const discovery = await discoverOAuth(
+      opts.fetch,
+      new URL(identity.url),
+      parseWwwAuthenticate(wwwAuthenticate),
+      budget
+    );
+    return {
+      ...out,
+      status: "auth_required",
+      transport: "streamable-http",
+      auth: {
+        mode: discovery.oauth ? "oauth" : "static",
+        challengeStatus: challenge.status,
+        oauth: discovery.oauth,
+        declaredHeaders: declared
+      },
+      violations: discovery.violations,
+      latencyMs: out.latencyMs ?? Date.now() - started
+    };
+  }
+  return {
+    ...out,
+    status: "protocol_error",
+    error: "answered, but not as an MCP server",
+    latencyMs: out.latencyMs ?? Date.now() - started
+  };
+}
+export {
+  PROBE_DEFAULTS,
+  PROBE_PROTOCOL_VERSION,
+  classifyNetworkError,
+  probeEndpoint
+};

package/dist/publicUpgrades-WTBGLDIK.js

@@ -0,0 +1,42 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  LIST_CAP,
+  PAIRS_PER_PACKAGE,
+  QUEUE_HEADROOM,
+  enqueuePublicUpgrades,
+  latestOfMajors,
+  majorPairs,
+  pendingUpgrade,
+  registerPublicUpgradeRoutes,
+  toPublicUpgrade,
+  unextractedSides,
+  upgradeGuideFor,
+  upgradePairsFor,
+  upgradeVerdict
+} from "./chunk-O4KHCV6I.js";
+import "./chunk-BJT2LHAR.js";
+import "./chunk-SHCEBP3J.js";
+import "./chunk-NPVN2THM.js";
+import "./chunk-VLRHFMGJ.js";
+import "./chunk-ONDVTXUO.js";
+import "./chunk-4JHDSVIN.js";
+import "./chunk-6L67QMCP.js";
+import "./chunk-3GHJR7XR.js";
+import "./chunk-MYGSLK44.js";
+import "./chunk-72Y2FDVS.js";
+import "./chunk-I3M2KJXB.js";
+export {
+  LIST_CAP,
+  PAIRS_PER_PACKAGE,
+  QUEUE_HEADROOM,
+  enqueuePublicUpgrades,
+  latestOfMajors,
+  majorPairs,
+  pendingUpgrade,
+  registerPublicUpgradeRoutes,
+  toPublicUpgrade,
+  unextractedSides,
+  upgradeGuideFor,
+  upgradePairsFor,
+  upgradeVerdict
+};

package/dist/{references-6N7VEPHT.js → references-I6Y4BSRR.js}

@@ -2,13 +2,15 @@ import { createRequire as __lurqCreateRequire } from 'node:module'; const requir
 import {
   SURFACE_CLAIM_KINDS,
   isRootSpecifier,
+  listSourceFiles,
   packageOfSpecifier,
   scanReferences
-} from "./chunk-ST2X2GYN.js";
+} from "./chunk-SHZFOSXC.js";
 import "./chunk-I3M2KJXB.js";
 export {
   SURFACE_CLAIM_KINDS,
   isRootSpecifier,
+  listSourceFiles,
   packageOfSpecifier,
   scanReferences
 };

package/dist/{release-4U4ABNSJ.js → release-7IU2R4YG.js}

@@ -7,14 +7,14 @@ import {
 } from "./chunk-ELGCAM7P.js";
 import {
   fetchAndExtract
-} from "./chunk-BV32UNLL.js";
-import "./chunk-AHBP533R.js";
-import "./chunk-SJOVFF7B.js";
+} from "./chunk-FVYFV5HA.js";
+import "./chunk-D3VTZS7V.js";
+import "./chunk-KYKSZ3XZ.js";
 import {
   require_semver
 } from "./chunk-3GHJR7XR.js";
 import "./chunk-MYGSLK44.js";
-import "./chunk-GPTKSNR6.js";
+import "./chunk-72Y2FDVS.js";
 import {
   __toESM,
   init_esm_shims
@@ -61,7 +61,7 @@ async function checkRelease(dir, opts = {}) {
   };
   if (!name) return inconclusive(base, `no readable package.json in ${dir}`);
   if (!manifest.version) return inconclusive(base, "package.json has no version field");
-  const { extractSurface } = await import("./extract-NKGKLIVT.js");
+  const { extractSurface } = await import("./extract-6WG265BL.js");
   const local = extractSurface(dir, { manifest });
   if (local.undeclaredReason) {
     return inconclusive(base, `${local.undeclaredReason} \u2014 build the package first`);