lurqrun 0.1.7 → 0.1.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (122) hide show
  1. package/README.md +312 -148
  2. package/dist/{auditHandler-JCOJSUYW.js → auditHandler-VWCXSDVO.js} +12 -11
  3. package/dist/autopilotInit-Q62MX5M6.js +178 -0
  4. package/dist/bin/lurq.js +235 -83
  5. package/dist/{browserAuth-B6G27USY.js → browserAuth-J7APSD4P.js} +4 -3
  6. package/dist/{cache-DKI34SVS.js → cache-AEAKCV4I.js} +2 -2
  7. package/dist/check-2JTQDQA6.js +2613 -0
  8. package/dist/{check-2FDGUOV7.js → check-PQSQ2MMA.js} +1 -1
  9. package/dist/checkUpgrade-5YW77OBL.js +24 -0
  10. package/dist/{chunk-BCANRN5B.js → chunk-2GAYNIHG.js} +8 -1
  11. package/dist/{chunk-EA3DP5HG.js → chunk-2O6Z37IT.js} +155 -25
  12. package/dist/{chunk-J5FZYN4A.js → chunk-2WD4QAH4.js} +1 -1
  13. package/dist/{chunk-CUP36ND3.js → chunk-3676XOBU.js} +145 -36
  14. package/dist/chunk-3D2MPGOQ.js +181 -0
  15. package/dist/{chunk-LYMPYETA.js → chunk-4JHDSVIN.js} +270 -6
  16. package/dist/chunk-53SG6XWA.js +141 -0
  17. package/dist/chunk-5ABNDB3I.js +37 -0
  18. package/dist/chunk-5ALIJFDA.js +114 -0
  19. package/dist/{chunk-BULZAX2U.js → chunk-64ZF7KO4.js} +55 -38
  20. package/dist/{chunk-2VMOWSRY.js → chunk-6DM6UQFD.js} +19 -1
  21. package/dist/{chunk-HWBBVLOT.js → chunk-6L67QMCP.js} +1 -1
  22. package/dist/{chunk-GPTKSNR6.js → chunk-72Y2FDVS.js} +2 -1
  23. package/dist/{chunk-B43LCXBM.js → chunk-A3TYI2TF.js} +81 -16
  24. package/dist/{chunk-IQ4SDKKY.js → chunk-B2UUYRBX.js} +31 -228
  25. package/dist/{chunk-DB2VF5UD.js → chunk-BJT2LHAR.js} +16 -11
  26. package/dist/chunk-BM3LF5T6.js +132 -0
  27. package/dist/{chunk-3N3Q3DSW.js → chunk-BN3NM47Q.js} +8 -8
  28. package/dist/chunk-D3K6IZVR.js +12845 -0
  29. package/dist/{chunk-AHBP533R.js → chunk-D3VTZS7V.js} +7 -5
  30. package/dist/{chunk-UDVNA7EA.js → chunk-DM37MTOO.js} +161 -8
  31. package/dist/chunk-DONTW3NE.js +171 -0
  32. package/dist/{chunk-M6NYEXCW.js → chunk-DSROTZ3Z.js} +1 -1
  33. package/dist/{chunk-4F7ZESPO.js → chunk-EQCXENKZ.js} +3 -5
  34. package/dist/{chunk-CW5HJ3LX.js → chunk-EYAKM6YN.js} +1 -1
  35. package/dist/{chunk-VL2E5T2A.js → chunk-FDFPMBCA.js} +6 -3
  36. package/dist/{chunk-BV32UNLL.js → chunk-FVYFV5HA.js} +2 -2
  37. package/dist/{chunk-DWAGCNEL.js → chunk-GM5Y555O.js} +36 -103
  38. package/dist/{chunk-PSX3GIAN.js → chunk-HWFX4BC4.js} +2 -1
  39. package/dist/chunk-IFNONGRQ.js +603 -0
  40. package/dist/chunk-J3U2CPSK.js +136 -0
  41. package/dist/{chunk-Y5GI7RL3.js → chunk-J6XQ7OPZ.js} +9 -1
  42. package/dist/{chunk-LBFGSSF2.js → chunk-KMV4Y6R3.js} +2 -1
  43. package/dist/{chunk-L6N4JFW2.js → chunk-KP5ZDDPE.js} +81 -4
  44. package/dist/{chunk-SJOVFF7B.js → chunk-KYKSZ3XZ.js} +3 -2
  45. package/dist/chunk-NEZNAPPN.js +41 -0
  46. package/dist/{chunk-NH5I4KHH.js → chunk-NPVN2THM.js} +1 -5
  47. package/dist/{chunk-6L3U7DZ5.js → chunk-NYZU5NCW.js} +1 -1
  48. package/dist/chunk-O4KHCV6I.js +320 -0
  49. package/dist/{chunk-LO35HLQZ.js → chunk-ONDVTXUO.js} +25 -4
  50. package/dist/{chunk-4ZYCIMY4.js → chunk-OTJFHESY.js} +25 -4
  51. package/dist/chunk-P6MIKSPY.js +243 -0
  52. package/dist/{checkUpgrade-F2WESBPM.js → chunk-QCRBX3LV.js} +72 -10
  53. package/dist/{chunk-LRD4GBYE.js → chunk-QUIMQ7YL.js} +1 -1
  54. package/dist/chunk-RG3YLU6E.js +49 -0
  55. package/dist/{chunk-ST2X2GYN.js → chunk-SHZFOSXC.js} +109 -20
  56. package/dist/{chunk-CIDWNUAP.js → chunk-SOXFMMXC.js} +8 -2
  57. package/dist/chunk-TDTYV6QI.js +119 -0
  58. package/dist/{chunk-FW6BD2NO.js → chunk-TUXQ32WE.js} +457 -121
  59. package/dist/{chunk-WQ23REYT.js → chunk-VGCDRK3S.js} +1 -1
  60. package/dist/{chunk-U5AT3TD4.js → chunk-X4W64MHU.js} +1735 -1858
  61. package/dist/chunk-XBQA4I36.js +92 -0
  62. package/dist/chunk-XGOV6KV4.js +413 -0
  63. package/dist/{chunk-OQS4GUSI.js → chunk-XIFQIFSZ.js} +210 -661
  64. package/dist/{chunk-XBIDMHSK.js → chunk-XLXPVN3Y.js} +2 -34
  65. package/dist/chunk-ZJMLQ37G.js +90 -0
  66. package/dist/{client-IRKAMDYZ.js → client-MU4EUDZV.js} +3 -3
  67. package/dist/{commands-FIL5ET6P.js → commands-UOOTMBKA.js} +145 -33
  68. package/dist/{compat-R3UTFQ5Q.js → compat-Q5DVPITN.js} +6 -6
  69. package/dist/constants-DJFOFZ44.js +24 -0
  70. package/dist/{dashboardIssue-WYYMBFIB.js → dashboardIssue-KBKLQMGC.js} +105 -23
  71. package/dist/{diff-GZA2774U.js → diff-I4SNUHU3.js} +1 -1
  72. package/dist/domains-VRT4BRVZ.js +14 -0
  73. package/dist/env-UN6KGZ7S.js +15 -0
  74. package/dist/envCheck-KUPTORFQ.js +71 -0
  75. package/dist/{extract-NKGKLIVT.js → extract-6WG265BL.js} +14 -3
  76. package/dist/{fetch-QYTUJVG2.js → fetch-PJ3SC32M.js} +4 -4
  77. package/dist/{firstTouch-QQTJH4QX.js → firstTouch-COJCMOB3.js} +1 -1
  78. package/dist/fix-3EDWNKW3.js +220 -0
  79. package/dist/{handlers-GEJAVZDK.js → handlers-4Q37WIFT.js} +19 -17
  80. package/dist/hook-NA66XJLC.js +412 -0
  81. package/dist/{http-ETPYMBGD.js → http-25GJ6SKK.js} +2078 -510
  82. package/dist/{ingestQueue-VKN4KBIF.js → ingestQueue-FSVJC3AA.js} +14 -12
  83. package/dist/{install-EK3W2COX.js → install-G2HHXYJ2.js} +6 -6
  84. package/dist/{installSkill-VQJWJVCL.js → installSkill-5TIMYIJZ.js} +21 -3
  85. package/dist/manifest-ENMIC54B.js +13 -0
  86. package/dist/{mcp-3JHD5SUZ.js → mcp-PENLL2PK.js} +60 -32
  87. package/dist/mcpConfig-3LYPRY5Q.js +80 -0
  88. package/dist/{mcpHandlers-QFN4MCFL.js → mcpHandlers-PO7GENA7.js} +7 -7
  89. package/dist/{mcpScan-QZHWENIP.js → mcpScan-ULP626TQ.js} +306 -442
  90. package/dist/{mcpScanWorkflow-JPYCBGC4.js → mcpScanWorkflow-27O44FOE.js} +29 -12
  91. package/dist/{mcpStack-BYJCZNIV.js → mcpStack-ZNYIFXZ5.js} +1 -1
  92. package/dist/model-ASMZWLM7.js +214 -0
  93. package/dist/{packages-THVFMWFP.js → packages-RWF2LXST.js} +3 -5
  94. package/dist/{plan-V4OEI3J4.js → plan-SDILIDZT.js} +23 -21
  95. package/dist/{planView-JRXGCG2N.js → planView-ZAKRTGVS.js} +4 -1
  96. package/dist/{policy-3P6BGRDN.js → policy-JAGNMQJI.js} +5 -5
  97. package/dist/probe-3IK646WN.js +610 -0
  98. package/dist/publicUpgrades-WTBGLDIK.js +42 -0
  99. package/dist/{references-6N7VEPHT.js → references-I6Y4BSRR.js} +3 -1
  100. package/dist/{release-4U4ABNSJ.js → release-7IU2R4YG.js} +5 -5
  101. package/dist/{remote-YGCXYI4V.js → remote-FN6225AH.js} +13 -3
  102. package/dist/rename-OS6JYBZQ.js +204 -0
  103. package/dist/{reportRuns-CKQQYLY4.js → reportRuns-O4X7ZFTX.js} +15 -2
  104. package/dist/safeFetch-COERXGFN.js +19 -0
  105. package/dist/{sandbox-MEZLAODF.js → sandbox-SAPSRKEI.js} +4 -4
  106. package/dist/sarif-WLVJFJ7U.js +125 -0
  107. package/dist/server-OLTY3NYT.js +59 -0
  108. package/dist/{surface-V62GE554.js → surface-7MHE3RL7.js} +18 -16
  109. package/dist/{surface-YL6O67W3.js → surface-JS2XU3U3.js} +5 -3
  110. package/dist/{surfaceHandlers-X2IZKA3E.js → surfaceHandlers-4B6TMZ34.js} +5 -5
  111. package/dist/{typecheck-X7U5ELMR.js → typecheck-NGOKNAJY.js} +23 -9
  112. package/dist/{uninstall-P7RGBX6G.js → uninstall-I2IJP5JZ.js} +30 -4
  113. package/dist/{upgrade-NQ5IWFZB.js → upgrade-FS26DJGG.js} +86 -32
  114. package/dist/{upgradePlan-A4LRKLEG.js → upgradePlan-ZS5IOVMZ.js} +46 -11
  115. package/dist/upkeepHandler-VFGYXJKB.js +13 -0
  116. package/dist/{userConfig-Z3GQE776.js → userConfig-ICASHI47.js} +1 -1
  117. package/dist/{watch-DGFMWUDL.js → watch-OCNEUXG6.js} +24 -34
  118. package/package.json +3 -2
  119. package/templates/skill-instructions.md +22 -3
  120. package/dist/chunk-6AAEVQ7I.js +0 -6336
  121. package/dist/chunk-I2JUKN6Z.js +0 -24
  122. package/dist/server-KFUD5X57.js +0 -55
@@ -2,31 +2,41 @@ import { createRequire as __lurqCreateRequire } from 'node:module'; const requir
2
2
  import {
3
3
  MissingKeyError,
4
4
  RemoteError,
5
+ acknowledgePublicMcpChange,
5
6
  apiKey,
6
7
  callTool,
7
8
  endpoint,
8
9
  fetchUpgradePlan,
10
+ getAlerts,
9
11
  getPolicy,
10
12
  getPolicyDecisions,
11
13
  getPolicyHistory,
14
+ listMcpPins,
15
+ pinMcpServer,
12
16
  putPolicy,
13
17
  reportUpgradeRuns,
18
+ unpinMcpServer,
14
19
  uploadMcpScan
15
- } from "./chunk-4ZYCIMY4.js";
16
- import "./chunk-Y5GI7RL3.js";
17
- import "./chunk-GPTKSNR6.js";
20
+ } from "./chunk-OTJFHESY.js";
21
+ import "./chunk-J6XQ7OPZ.js";
22
+ import "./chunk-72Y2FDVS.js";
18
23
  import "./chunk-I3M2KJXB.js";
19
24
  export {
20
25
  MissingKeyError,
21
26
  RemoteError,
27
+ acknowledgePublicMcpChange,
22
28
  apiKey,
23
29
  callTool,
24
30
  endpoint,
25
31
  fetchUpgradePlan,
32
+ getAlerts,
26
33
  getPolicy,
27
34
  getPolicyDecisions,
28
35
  getPolicyHistory,
36
+ listMcpPins,
37
+ pinMcpServer,
29
38
  putPolicy,
30
39
  reportUpgradeRuns,
40
+ unpinMcpServer,
31
41
  uploadMcpScan
32
42
  };
@@ -0,0 +1,204 @@
1
+ import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
2
+ import {
3
+ init_esm_shims
4
+ } from "./chunk-I3M2KJXB.js";
5
+
6
+ // src/fix/rename.ts
7
+ init_esm_shims();
8
+ var REWRITABLE = /* @__PURE__ */ new Set(["named", "destructured"]);
9
+ var CANDIDATE_LIMIT = 20;
10
+ function isRootSpecifier(ref, pkg) {
11
+ return ref.specifier === pkg;
12
+ }
13
+ function editsFor(refs, to, pkg) {
14
+ const byFile = /* @__PURE__ */ new Map();
15
+ for (const ref of refs) {
16
+ const list = byFile.get(ref.file);
17
+ if (list) list.push(ref);
18
+ else byFile.set(ref.file, [ref]);
19
+ }
20
+ const edits = [];
21
+ const files = [];
22
+ const refusedFiles = [];
23
+ for (const [file, fileRefs] of byFile) {
24
+ const fileEdits = [];
25
+ let refused = null;
26
+ for (const ref of fileRefs) {
27
+ if (!isRootSpecifier(ref, pkg)) continue;
28
+ if (ref.via === "type-only") continue;
29
+ if (!REWRITABLE.has(ref.via)) {
30
+ refused = `reached as ${ref.via}, where the export name is not what the code writes`;
31
+ break;
32
+ }
33
+ if (ref.shadowed) {
34
+ refused = `${ref.local ?? ref.symbol} is declared more than once`;
35
+ break;
36
+ }
37
+ if (ref.nameStart === void 0 || ref.nameEnd === void 0) {
38
+ refused = "no recorded position for the import";
39
+ break;
40
+ }
41
+ fileEdits.push({ file, start: ref.nameStart, end: ref.nameEnd, text: to, was: ref.symbol });
42
+ if (ref.aliased) continue;
43
+ const local = ref.local ?? ref.symbol;
44
+ for (const use of ref.calls ?? []) {
45
+ if (use.start === void 0 || use.end === void 0) {
46
+ refused = `a use of ${local} has no recorded position`;
47
+ break;
48
+ }
49
+ fileEdits.push({ file, start: use.start, end: use.end, text: to, was: local });
50
+ }
51
+ if (refused) break;
52
+ }
53
+ if (refused) refusedFiles.push({ file, reason: refused });
54
+ else if (fileEdits.length > 0) {
55
+ files.push(file);
56
+ edits.push(...fileEdits);
57
+ }
58
+ }
59
+ return { edits, files, refusedFiles };
60
+ }
61
+ function dedupe(edits) {
62
+ const seen = /* @__PURE__ */ new Set();
63
+ return edits.filter((e) => {
64
+ const key = `${e.file}:${e.start}-${e.end}`;
65
+ if (seen.has(key)) return false;
66
+ seen.add(key);
67
+ return true;
68
+ });
69
+ }
70
+ function renameFindings(breaking, opts) {
71
+ const findings = [];
72
+ const refused = [];
73
+ const version = `${breaking.package}@${breaking.fromVersion ?? "?"} \u2192 ${breaking.toVersion ?? "?"}`;
74
+ for (const removed of breaking.symbolsRemoved) {
75
+ const to = removed.renamedTo ?? [];
76
+ const code = `renamed-export:${breaking.package}:${removed.symbol}`;
77
+ const files = [...new Set(removed.refs.map((r) => r.file))];
78
+ if (to.length === 0) {
79
+ if (files.length === 0 || breaking.newExports.length === 0) continue;
80
+ const candidates = breaking.newExports.slice(0, CANDIDATE_LIMIT);
81
+ findings.push({
82
+ domain: "package",
83
+ code: `removed-export:${breaking.package}:${removed.symbol}`,
84
+ severity: breaking.severity,
85
+ detail: `${removed.symbol} does not exist in ${version}, and the package does not say what replaced it`,
86
+ evidence: `${breaking.toVersion} exports that ${breaking.fromVersion} did not: ${candidates.map((e) => e.symbol).join(", ")}`,
87
+ fix: {
88
+ summary: `replace ${removed.symbol} using the exports ${breaking.toVersion} actually ships`,
89
+ task: {
90
+ instruction: `${removed.symbol} was removed from ${breaking.package} in ${breaking.toVersion}. Rewrite each use with the export that matches what the code does with it. Do not invent a name: use one from the list below, or report that none fits.`,
91
+ files,
92
+ evidence: candidates.map(
93
+ (e) => `${e.symbol}: ${e.kind}${e.arity === null ? "" : `, ${e.arity} parameter(s)`}`
94
+ )
95
+ },
96
+ verify: ["typecheck", "tests"]
97
+ }
98
+ });
99
+ continue;
100
+ }
101
+ if (to.length > 1) {
102
+ refused.push({
103
+ symbol: removed.symbol,
104
+ to,
105
+ reason: "more than one surviving name; a choice, not a rewrite"
106
+ });
107
+ findings.push({
108
+ domain: "package",
109
+ code,
110
+ severity: breaking.severity,
111
+ detail: `${removed.symbol} was removed in ${version}; the package exports ${to.join(" and ")} from the same declaration, so which one replaces it is a judgement`,
112
+ evidence: `${version}: same-declaration survivors ${to.join(", ")}`,
113
+ fix: {
114
+ summary: `replace ${removed.symbol} with whichever of ${to.join(" or ")} the code means`,
115
+ task: {
116
+ instruction: `${removed.symbol} no longer exists in ${breaking.package} ${breaking.toVersion ?? "the target version"}. Replace each use with ${to.join(" or ")}, whichever matches how the value is used.`,
117
+ files: [...new Set(removed.refs.map((r) => r.file))],
118
+ evidence: [`${breaking.toVersion ?? "target"} exports: ${to.join(", ")}`]
119
+ },
120
+ verify: ["typecheck", "tests"]
121
+ }
122
+ });
123
+ continue;
124
+ }
125
+ const target = to[0];
126
+ const proof = `${version}: ${removed.symbol} and ${target} were exported from one declaration at ${breaking.fromVersion ?? "the source version"}`;
127
+ const manualTask = (taskFiles, extra = []) => ({
128
+ instruction: `Rename ${removed.symbol} to ${target} where it is imported from ${breaking.package}.`,
129
+ files: taskFiles,
130
+ evidence: [`${target} exists at ${breaking.toVersion ?? "the target version"}`, ...extra]
131
+ });
132
+ const {
133
+ edits: collected,
134
+ files: editedFiles,
135
+ refusedFiles
136
+ } = editsFor(removed.refs, target, opts.packageName);
137
+ const edits = dedupe(collected);
138
+ if (edits.length > 0) {
139
+ findings.push({
140
+ domain: "package",
141
+ code,
142
+ severity: breaking.severity,
143
+ detail: `${removed.symbol} was renamed to ${target} in ${version}: ${edits.length} occurrence(s) in ${editedFiles.length} file(s)`,
144
+ file: editedFiles[0],
145
+ evidence: `${proof}, and ${target} still exists`,
146
+ fix: {
147
+ summary: `rename ${removed.symbol} to ${target}`,
148
+ edits,
149
+ verify: ["typecheck", "tests"]
150
+ }
151
+ });
152
+ }
153
+ if (refusedFiles.length > 0) {
154
+ for (const r of refusedFiles)
155
+ refused.push({ symbol: removed.symbol, to, file: r.file, reason: r.reason });
156
+ findings.push({
157
+ domain: "package",
158
+ code: `${code}:manual`,
159
+ severity: breaking.severity,
160
+ detail: `${removed.symbol} was renamed to ${target} in ${version}, but ${refusedFiles.length} file(s) need a person: ${refusedFiles.map((r) => `${r.file} (${r.reason})`).join("; ")}`,
161
+ file: refusedFiles[0].file,
162
+ evidence: proof,
163
+ fix: {
164
+ summary: `rename ${removed.symbol} to ${target} in ${refusedFiles.length} file(s) lurq will not touch`,
165
+ // The reasons are already in `detail`; repeating them as evidence put
166
+ // them under the "use one of these" label meant for real exports.
167
+ task: manualTask(refusedFiles.map((r) => r.file)),
168
+ verify: ["typecheck", "tests"]
169
+ }
170
+ });
171
+ }
172
+ if (edits.length === 0 && refusedFiles.length === 0) {
173
+ const reason = "nothing in this project references it at the package root";
174
+ refused.push({ symbol: removed.symbol, to, reason });
175
+ findings.push({
176
+ domain: "package",
177
+ code,
178
+ severity: breaking.severity,
179
+ detail: `${removed.symbol} was renamed to ${target} in ${version}, but lurq will not rewrite it here: ${reason}`,
180
+ evidence: proof,
181
+ fix: {
182
+ summary: `rename ${removed.symbol} to ${target} by hand`,
183
+ task: manualTask([...new Set(removed.refs.map((r) => r.file))]),
184
+ verify: ["typecheck", "tests"]
185
+ }
186
+ });
187
+ }
188
+ }
189
+ return { findings, refused };
190
+ }
191
+ function renamePlan(report) {
192
+ const findings = [];
193
+ const refused = [];
194
+ for (const breaking of report.breaking) {
195
+ const plan = renameFindings(breaking, { packageName: breaking.package });
196
+ findings.push(...plan.findings);
197
+ refused.push(...plan.refused);
198
+ }
199
+ return { findings, refused };
200
+ }
201
+ export {
202
+ renameFindings,
203
+ renamePlan
204
+ };
@@ -1,4 +1,7 @@
1
1
  import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
2
+ import {
3
+ RUN_TRIGGERS
4
+ } from "./chunk-2GAYNIHG.js";
2
5
  import {
3
6
  init_esm_shims
4
7
  } from "./chunk-I3M2KJXB.js";
@@ -6,6 +9,11 @@ import {
6
9
  // src/cli/reportRuns.ts
7
10
  init_esm_shims();
8
11
  var MAX_RUNS = 100;
12
+ function triggerFromEvent(event) {
13
+ if (!event) return null;
14
+ if (event === "workflow_dispatch" || event === "repository_dispatch") return "dispatch";
15
+ return RUN_TRIGGERS.find((t) => t === event) ?? "other";
16
+ }
9
17
  function findingRefs(finding) {
10
18
  return [
11
19
  ...finding.symbolsRemoved.flatMap((s) => s.refs),
@@ -26,7 +34,8 @@ function buildRunReports(report, targets, ctx) {
26
34
  fromVersion: target?.fromVersion ?? "",
27
35
  toVersion: target?.toVersion ?? "",
28
36
  status: "checked",
29
- runUrl: ctx.runUrl
37
+ runUrl: ctx.runUrl,
38
+ trigger: ctx.trigger
30
39
  };
31
40
  };
32
41
  const rows = [];
@@ -56,7 +65,11 @@ function runContextFromEnv(env = process.env) {
56
65
  if (!repoFullName) return null;
57
66
  const server = env.GITHUB_SERVER_URL?.trim() || "https://github.com";
58
67
  const runId = env.GITHUB_RUN_ID?.trim();
59
- return { repoFullName, runUrl: runId ? `${server}/${repoFullName}/actions/runs/${runId}` : "" };
68
+ return {
69
+ repoFullName,
70
+ runUrl: runId ? `${server}/${repoFullName}/actions/runs/${runId}` : "",
71
+ trigger: triggerFromEvent(env.GITHUB_EVENT_NAME?.trim())
72
+ };
60
73
  }
61
74
  export {
62
75
  buildRunReports,
@@ -0,0 +1,19 @@
1
+ import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
2
+ import {
3
+ ResponseTooLargeError,
4
+ SAFE_FETCH_DEFAULTS,
5
+ UnsafeUrlError,
6
+ createSafeFetch,
7
+ publicHttpsOnly,
8
+ sharedSafeFetch
9
+ } from "./chunk-J3U2CPSK.js";
10
+ import "./chunk-3D2MPGOQ.js";
11
+ import "./chunk-I3M2KJXB.js";
12
+ export {
13
+ ResponseTooLargeError,
14
+ SAFE_FETCH_DEFAULTS,
15
+ UnsafeUrlError,
16
+ createSafeFetch,
17
+ publicHttpsOnly,
18
+ sharedSafeFetch
19
+ };
@@ -1,16 +1,16 @@
1
1
  import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
2
2
  import {
3
3
  getSandbox
4
- } from "./chunk-I2JUKN6Z.js";
4
+ } from "./chunk-RG3YLU6E.js";
5
5
  import "./chunk-C6GLE626.js";
6
6
  import "./chunk-GE37NVLN.js";
7
7
  import {
8
8
  storeVerificationRun
9
- } from "./chunk-6L3U7DZ5.js";
10
- import "./chunk-LYMPYETA.js";
9
+ } from "./chunk-NYZU5NCW.js";
10
+ import "./chunk-4JHDSVIN.js";
11
11
  import "./chunk-GRJXQBQZ.js";
12
12
  import "./chunk-WHX2ZFCG.js";
13
- import "./chunk-GPTKSNR6.js";
13
+ import "./chunk-72Y2FDVS.js";
14
14
  import {
15
15
  init_esm_shims
16
16
  } from "./chunk-I3M2KJXB.js";
@@ -0,0 +1,125 @@
1
+ import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
2
+ import {
3
+ deterministic,
4
+ positionAt
5
+ } from "./chunk-BM3LF5T6.js";
6
+ import {
7
+ init_esm_shims
8
+ } from "./chunk-I3M2KJXB.js";
9
+
10
+ // src/fix/sarif.ts
11
+ init_esm_shims();
12
+ var LEVEL = {
13
+ blocking: "error",
14
+ warning: "warning",
15
+ info: "note"
16
+ };
17
+ var RULE_TEXT = {
18
+ "renamed-export": "An export this code imports was renamed by the package itself, which proves the replacement.",
19
+ "removed-export": "An export this code imports no longer exists, and the package does not say what replaced it."
20
+ };
21
+ var ruleClassOf = (code) => code.split(":")[0] || code;
22
+ var regionOf = (text, edit) => {
23
+ const start = positionAt(text, edit.start);
24
+ const end = positionAt(text, edit.end);
25
+ return {
26
+ startLine: start.line,
27
+ startColumn: start.column,
28
+ endLine: end.line,
29
+ endColumn: end.column
30
+ };
31
+ };
32
+ function filesOf(f) {
33
+ const byFile = /* @__PURE__ */ new Map();
34
+ for (const e of f.fix?.edits ?? []) {
35
+ const list = byFile.get(e.file);
36
+ if (list) list.push(e);
37
+ else byFile.set(e.file, [e]);
38
+ }
39
+ if (byFile.size > 0) return [...byFile].map(([file, edits]) => ({ file, edits }));
40
+ const named = f.fix?.task?.files ?? (f.file ? [f.file] : []);
41
+ return [...new Set(named)].map((file) => ({ file, edits: [] }));
42
+ }
43
+ function toSarif(findings, opts) {
44
+ const results = [];
45
+ const seenRules = /* @__PURE__ */ new Set();
46
+ for (const f of findings) {
47
+ seenRules.add(ruleClassOf(f.code));
48
+ const places = filesOf(f);
49
+ if (places.length === 0) {
50
+ results.push({
51
+ ruleId: ruleClassOf(f.code),
52
+ level: LEVEL[f.severity],
53
+ message: { text: f.detail },
54
+ partialFingerprints: { lurqCode: f.code },
55
+ properties: { fixable: deterministic(f), ...f.evidence ? { evidence: f.evidence } : {} }
56
+ });
57
+ continue;
58
+ }
59
+ for (const { file, edits } of places) {
60
+ const text = edits.length > 0 ? opts.read(file) : null;
61
+ const region = text !== null && edits[0] ? regionOf(text, edits[0]) : null;
62
+ results.push({
63
+ ruleId: ruleClassOf(f.code),
64
+ level: LEVEL[f.severity],
65
+ message: { text: f.detail },
66
+ locations: [
67
+ {
68
+ physicalLocation: {
69
+ artifactLocation: { uri: file, uriBaseId: "%SRCROOT%" },
70
+ ...region ? { region } : {}
71
+ }
72
+ }
73
+ ],
74
+ // Same finding, same file, across runs — even if the line moved.
75
+ partialFingerprints: { lurqCode: `${f.code}@${file}` },
76
+ properties: {
77
+ fixable: deterministic(f),
78
+ ...f.evidence ? { evidence: f.evidence } : {},
79
+ ...f.fix?.task ? { agentInstruction: f.fix.task.instruction } : {}
80
+ },
81
+ ...text !== null && edits.length > 0 ? {
82
+ fixes: [
83
+ {
84
+ description: { text: f.fix.summary },
85
+ artifactChanges: [
86
+ {
87
+ artifactLocation: { uri: file, uriBaseId: "%SRCROOT%" },
88
+ replacements: edits.map((e) => ({
89
+ deletedRegion: regionOf(text, e),
90
+ insertedContent: { text: e.text }
91
+ }))
92
+ }
93
+ ]
94
+ }
95
+ ]
96
+ } : {}
97
+ });
98
+ }
99
+ }
100
+ return {
101
+ $schema: "https://json.schemastore.org/sarif-2.1.0.json",
102
+ version: "2.1.0",
103
+ runs: [
104
+ {
105
+ tool: {
106
+ driver: {
107
+ name: "lurq",
108
+ informationUri: "https://lurq.run",
109
+ version: opts.version,
110
+ rules: [...seenRules].sort().map((id) => ({
111
+ id,
112
+ name: id,
113
+ shortDescription: { text: RULE_TEXT[id] ?? `lurq finding: ${id}` }
114
+ }))
115
+ }
116
+ },
117
+ results
118
+ }
119
+ ]
120
+ };
121
+ }
122
+ export {
123
+ ruleClassOf,
124
+ toSarif
125
+ };
@@ -0,0 +1,59 @@
1
+ import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
2
+ import {
3
+ SERVE_NEEDS_DATABASE,
4
+ buildMcpServer,
5
+ exactVersion,
6
+ npmName,
7
+ startMcpServer
8
+ } from "./chunk-3676XOBU.js";
9
+ import "./chunk-B2UUYRBX.js";
10
+ import "./chunk-NEZNAPPN.js";
11
+ import "./chunk-FDFPMBCA.js";
12
+ import "./chunk-KP5ZDDPE.js";
13
+ import "./chunk-BN3NM47Q.js";
14
+ import "./chunk-BJT2LHAR.js";
15
+ import "./chunk-XLXPVN3Y.js";
16
+ import "./chunk-P6MIKSPY.js";
17
+ import "./chunk-D3K6IZVR.js";
18
+ import "./chunk-6EQ3ARXA.js";
19
+ import "./chunk-SHCEBP3J.js";
20
+ import "./chunk-LEGPB7DO.js";
21
+ import "./chunk-Q5VPF4WI.js";
22
+ import "./chunk-EQCXENKZ.js";
23
+ import "./chunk-64ZF7KO4.js";
24
+ import "./chunk-QSL6QN5X.js";
25
+ import "./chunk-NYZU5NCW.js";
26
+ import "./chunk-2WD4QAH4.js";
27
+ import "./chunk-DSROTZ3Z.js";
28
+ import "./chunk-TUXQ32WE.js";
29
+ import "./chunk-BUALU27S.js";
30
+ import "./chunk-QUIMQ7YL.js";
31
+ import "./chunk-6DM6UQFD.js";
32
+ import "./chunk-EYAKM6YN.js";
33
+ import "./chunk-D3VTZS7V.js";
34
+ import "./chunk-4ESO33J6.js";
35
+ import "./chunk-NPVN2THM.js";
36
+ import "./chunk-VLRHFMGJ.js";
37
+ import "./chunk-VGCDRK3S.js";
38
+ import "./chunk-ONDVTXUO.js";
39
+ import "./chunk-4JHDSVIN.js";
40
+ import "./chunk-GM5Y555O.js";
41
+ import "./chunk-2GAYNIHG.js";
42
+ import "./chunk-KYKSZ3XZ.js";
43
+ import "./chunk-A3TYI2TF.js";
44
+ import "./chunk-HWFX4BC4.js";
45
+ import "./chunk-6L67QMCP.js";
46
+ import "./chunk-3GHJR7XR.js";
47
+ import "./chunk-GRJXQBQZ.js";
48
+ import "./chunk-WHX2ZFCG.js";
49
+ import "./chunk-LUAKDHLZ.js";
50
+ import "./chunk-MYGSLK44.js";
51
+ import "./chunk-72Y2FDVS.js";
52
+ import "./chunk-I3M2KJXB.js";
53
+ export {
54
+ SERVE_NEEDS_DATABASE,
55
+ buildMcpServer,
56
+ exactVersion,
57
+ npmName,
58
+ startMcpServer
59
+ };
@@ -2,6 +2,17 @@ import { createRequire as __lurqCreateRequire } from 'node:module'; const requir
2
2
  import {
3
3
  formatError
4
4
  } from "./chunk-MHUEVBVO.js";
5
+ import {
6
+ fetchAndExtract
7
+ } from "./chunk-FVYFV5HA.js";
8
+ import {
9
+ getPackagesWithSurface
10
+ } from "./chunk-DSROTZ3Z.js";
11
+ import "./chunk-D3VTZS7V.js";
12
+ import {
13
+ getPackageVersions
14
+ } from "./chunk-NPVN2THM.js";
15
+ import "./chunk-VLRHFMGJ.js";
5
16
  import {
6
17
  bumpSurfaceAttempt,
7
18
  dropSurfaceQueue,
@@ -12,24 +23,13 @@ import {
12
23
  isExtractionCached,
13
24
  storeSurface,
14
25
  surfaceRef
15
- } from "./chunk-LO35HLQZ.js";
16
- import {
17
- fetchAndExtract
18
- } from "./chunk-BV32UNLL.js";
19
- import {
20
- getPackagesWithSurface
21
- } from "./chunk-M6NYEXCW.js";
22
- import "./chunk-AHBP533R.js";
23
- import "./chunk-SJOVFF7B.js";
24
- import {
25
- getPackageVersions
26
- } from "./chunk-NH5I4KHH.js";
27
- import "./chunk-VLRHFMGJ.js";
28
- import "./chunk-LYMPYETA.js";
26
+ } from "./chunk-ONDVTXUO.js";
27
+ import "./chunk-4JHDSVIN.js";
28
+ import "./chunk-KYKSZ3XZ.js";
29
29
  import {
30
30
  logger
31
31
  } from "./chunk-MYGSLK44.js";
32
- import "./chunk-GPTKSNR6.js";
32
+ import "./chunk-72Y2FDVS.js";
33
33
  import {
34
34
  init_esm_shims
35
35
  } from "./chunk-I3M2KJXB.js";
@@ -104,7 +104,9 @@ async function drainSurfaceQueue(db, opts = {}) {
104
104
  async function backfillSurfaces(db, opts = {}) {
105
105
  const limit = opts.limit ?? 500;
106
106
  const s = { scanned: 0, queuedLatest: 0, queuedPrevious: 0 };
107
- const missing = await getPackagesMissingGraphSurface(db, limit, { byDownloads: opts.byDownloads });
107
+ const missing = await getPackagesMissingGraphSurface(db, limit, {
108
+ byDownloads: opts.byDownloads
109
+ });
108
110
  for (const row of missing) {
109
111
  s.scanned++;
110
112
  await enqueueSurface(db, row.name, row.version).then(
@@ -13,10 +13,11 @@ import {
13
13
  previousVersion,
14
14
  specKey,
15
15
  storeSurface,
16
+ surfaceQueueDepth,
16
17
  surfaceRef
17
- } from "./chunk-LO35HLQZ.js";
18
- import "./chunk-LYMPYETA.js";
19
- import "./chunk-GPTKSNR6.js";
18
+ } from "./chunk-ONDVTXUO.js";
19
+ import "./chunk-4JHDSVIN.js";
20
+ import "./chunk-72Y2FDVS.js";
20
21
  import "./chunk-I3M2KJXB.js";
21
22
  export {
22
23
  bumpSurfaceAttempt,
@@ -32,5 +33,6 @@ export {
32
33
  previousVersion,
33
34
  specKey,
34
35
  storeSurface,
36
+ surfaceQueueDepth,
35
37
  surfaceRef
36
38
  };
@@ -4,13 +4,13 @@ import {
4
4
  handleResolveSurface,
5
5
  loadStored,
6
6
  rowsToSurface
7
- } from "./chunk-DB2VF5UD.js";
7
+ } from "./chunk-BJT2LHAR.js";
8
8
  import "./chunk-SHCEBP3J.js";
9
- import "./chunk-LO35HLQZ.js";
10
- import "./chunk-HWBBVLOT.js";
11
- import "./chunk-LYMPYETA.js";
9
+ import "./chunk-ONDVTXUO.js";
10
+ import "./chunk-4JHDSVIN.js";
11
+ import "./chunk-6L67QMCP.js";
12
12
  import "./chunk-MYGSLK44.js";
13
- import "./chunk-GPTKSNR6.js";
13
+ import "./chunk-72Y2FDVS.js";
14
14
  import "./chunk-I3M2KJXB.js";
15
15
  export {
16
16
  handleDiffSurface,
@@ -33,11 +33,15 @@ function typeChecker(ts, rootDir, opts = {}) {
33
33
  const caches = /* @__PURE__ */ new Map();
34
34
  const parse = (configPath) => {
35
35
  if (!configs.has(configPath)) {
36
- const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
37
- ...ts.sys,
38
- onUnRecoverableConfigFileDiagnostic: () => {
36
+ const parsed = ts.getParsedCommandLineOfConfigFile(
37
+ configPath,
38
+ {},
39
+ {
40
+ ...ts.sys,
41
+ onUnRecoverableConfigFileDiagnostic: () => {
42
+ }
39
43
  }
40
- });
44
+ );
41
45
  configs.set(configPath, parsed ?? null);
42
46
  }
43
47
  return configs.get(configPath);
@@ -65,7 +69,9 @@ function typeChecker(ts, rootDir, opts = {}) {
65
69
  const after = build(ts, group.parsed, pkg, toDir, installedVersion, shared, true);
66
70
  if ("reason" in after) return { checked: false, reason: after.reason };
67
71
  const missingBefore = unresolvedTypeImports(ts, before);
68
- const newlyMissing = [...unresolvedTypeImports(ts, after)].filter((s) => !missingBefore.has(s));
72
+ const newlyMissing = [...unresolvedTypeImports(ts, after)].filter(
73
+ (s) => !missingBefore.has(s)
74
+ );
69
75
  if (newlyMissing.length) {
70
76
  return {
71
77
  checked: false,
@@ -130,7 +136,8 @@ function unresolvedTypeImports(ts, built) {
130
136
  for (const sf of built.program.getSourceFiles()) {
131
137
  if (!sf.isDeclarationFile || !built.overlaid(sf.fileName)) continue;
132
138
  for (const { fileName: spec } of ts.preProcessFile(sf.text, true, true).importedFiles) {
133
- if (!ts.resolveModuleName(spec, sf.fileName, options, built.host).resolvedModule) out.add(spec);
139
+ if (!ts.resolveModuleName(spec, sf.fileName, options, built.host).resolvedModule)
140
+ out.add(spec);
134
141
  }
135
142
  }
136
143
  return out;
@@ -153,11 +160,16 @@ function importersOf(ts, program, targets) {
153
160
  const key = (p) => ts.sys.useCaseSensitiveFileNames ? resolve(p) : resolve(p).toLowerCase();
154
161
  const wanted = new Set(targets.map(key));
155
162
  const options = program.getCompilerOptions();
156
- const cache = ts.createModuleResolutionCache(program.getCurrentDirectory(), (f) => key(f), options);
163
+ const cache = ts.createModuleResolutionCache(
164
+ program.getCurrentDirectory(),
165
+ (f) => key(f),
166
+ options
167
+ );
157
168
  const out = [];
158
169
  for (const sf of program.getSourceFiles()) {
159
170
  if (out.length >= HOP_CAP) break;
160
- if (sf.isDeclarationFile || sf.fileName.includes("/node_modules/") || wanted.has(key(sf.fileName))) continue;
171
+ if (sf.isDeclarationFile || sf.fileName.includes("/node_modules/") || wanted.has(key(sf.fileName)))
172
+ continue;
161
173
  const { importedFiles } = ts.preProcessFile(sf.text, true, true);
162
174
  const imports = importedFiles.some(({ fileName: spec }) => {
163
175
  const hit = ts.resolveModuleName(spec, sf.fileName, options, ts.sys, cache).resolvedModule;
@@ -178,7 +190,9 @@ function overlayHost(ts, options, pkg, pkgDir, installedVersion, cache) {
178
190
  };
179
191
  const marker = `/node_modules/${pkg}`;
180
192
  const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
181
- const pnpmStore = installedVersion ? new RegExp(`^(.*)/node_modules/\\.pnpm/${escape(pkg.replace("/", "+"))}@${escape(installedVersion)}(?:[_(][^/]*)?$`) : null;
193
+ const pnpmStore = installedVersion ? new RegExp(
194
+ `^(.*)/node_modules/\\.pnpm/${escape(pkg.replace("/", "+"))}@${escape(installedVersion)}(?:[_(][^/]*)?$`
195
+ ) : null;
182
196
  const ownInstall = (prefix) => {
183
197
  if (!prefix.includes("/node_modules/")) return true;
184
198
  const store = pnpmStore?.exec(prefix);