lurqrun 0.1.7 → 0.1.8

package/dist/{chunk-B43LCXBM.js → chunk-A3TYI2TF.js}

@@ -2,7 +2,7 @@ import { createRequire as __lurqCreateRequire } from 'node:module'; const requir
 import {
   PACKAGE_NAME,
   VERSION
-} from "./chunk-GPTKSNR6.js";
+} from "./chunk-72Y2FDVS.js";
 import {
   init_esm_shims
 } from "./chunk-I3M2KJXB.js";
@@ -15,6 +15,10 @@ function cliSpec(version = VERSION) {
   return major === "0" ? `${PACKAGE_NAME}@${major}.${minor}` : `${PACKAGE_NAME}@${major}`;
 }
 var DEFAULT_CRON = "0 6 * * 1";
+var SECURITY_CRON = "0 6 * * *";
+function cronForScope(scope) {
+  return scope === "security" ? SECURITY_CRON : DEFAULT_CRON;
+}
 function detectInstallCommand(lockfiles) {
   if (lockfiles.includes("pnpm-lock.yaml")) return "pnpm install --frozen-lockfile";
   if (lockfiles.includes("yarn.lock")) return "yarn install --frozen-lockfile";
@@ -26,13 +30,20 @@ function renderWorkflow(opts = {}) {
   const cron = opts.cron ?? DEFAULT_CRON;
   const install = opts.installCommand ?? "npm ci";
   const max = opts.maxUpgrades ?? 3;
-  const mode = opts.armed ? "pr" : "comment";
+  const mode = opts.mode ?? (opts.armed ? "pr" : "comment");
   const autoMerge = opts.autoMerge ?? false;
   const cli = cliSpec();
+  const envCheck = opts.checkEnv === true ? `      - name: Check environment
+        run: |
+          npx -y ${cli} check-env . > lurq-env.txt
+          { echo '\`\`\`'; cat lurq-env.txt; echo '\`\`\`'; } >> "\${GITHUB_STEP_SUMMARY}"
+
+` : "";
   return `# Managed by lurq, https://lurq.run
 #
 # Keeps this repository's dependencies current and rewrites the call sites an
-# upgrade breaks. lurq itself has read-only access to your code; every write
+# upgrade breaks. lurq has read-only access to your code, and may start this
+# workflow when a dependency you declare ships a breaking release; every write
 # below is made by this workflow's own GITHUB_TOKEN, scoped by the permissions
 # block. Delete this file to turn the autopilot off.
 name: lurq upgrade
@@ -43,10 +54,15 @@ on:
   workflow_dispatch:
     inputs:
       mode:
-        description: "comment = analyse only \xB7 pr = open pull requests"
-        type: choice
-        options: [comment, pr]
-        default: ${mode}
+        # No default, and deliberately a string rather than a choice. GitHub
+        # applies an input default on EVERY dispatch, including the ones lurq
+        # sends when a new major lands \u2014 which would fill LURQ_MODE before the
+        # "Resolve mode" step could read this repo's dashboard setting, and
+        # silently pin every triggered run to whatever was baked in at
+        # generation time. Left empty, a dispatch behaves like a scheduled run.
+        description: "leave empty to use your dashboard setting; or comment / fix / pr"
+        type: string
+        required: false
 
 # The blast radius. \`contents: write\` permits pushing a BRANCH; branch
 # protection on your default branch is what stops anything landing unreviewed.
@@ -62,7 +78,11 @@ jobs:
   upgrade:
     runs-on: ubuntu-latest
     env:
-      LURQ_MODE: \${{ inputs.mode || vars.LURQ_MODE || '${mode}' }}
+      # Empty when nothing explicit set it, which the "Resolve mode" step below
+      # then fills from this repository's dashboard setting. Precedence is
+      # explicit first: a dispatch input, then a repository variable, then the
+      # dashboard, then the mode baked in when this file was generated.
+      LURQ_MODE: \${{ inputs.mode || vars.LURQ_MODE || '' }}
       MAX_UPGRADES: "${max}"
     steps:
       - uses: actions/checkout@v6
@@ -78,6 +98,29 @@ jobs:
           LURQ_API_KEY: \${{ secrets.LURQ_API_KEY }}
         run: npx -y ${cli} upgrade-plan . --json > lurq-plan.json
 
+      # Without this the autopilot switch on the dashboard would only ever
+      # affect NEW installs: lurq is Contents:read-only and cannot rewrite this
+      # file or set a repository variable, so the mode is read at runtime from
+      # the plan above, which already carries this repository's policy.
+      #
+      # Skipped entirely when something explicit already set the mode, so a
+      # repository variable or a dispatch choice still wins. An older server or
+      # an unconnected repo sends no mode and the baked-in '${mode}' stands.
+      #
+      # The value is checked against the three it may be before it reaches the
+      # environment \u2014 it arrives over the network, and GITHUB_ENV is not the
+      # place to trust a response.
+      - name: Resolve mode
+        if: env.LURQ_MODE == ''
+        run: |
+          MODE=$(jq -r '.mode // empty' lurq-plan.json)
+          case "$MODE" in
+            pr|fix|comment) ;;
+            *) MODE='${mode}' ;;
+          esac
+          echo "LURQ_MODE=$MODE" >> "\${GITHUB_ENV}"
+          echo "Mode for this run: $MODE" >> "\${GITHUB_STEP_SUMMARY}"
+
       # 2. Narrow that to symbols THIS repo references. Runs entirely locally
       #    against both versions' npm tarballs, no API key, no test suite.
       #
@@ -99,9 +142,10 @@ jobs:
           { echo '\`\`\`'; cat lurq-report.txt; echo '\`\`\`'; } > lurq-report.md
           cat lurq-report.md >> "\${GITHUB_STEP_SUMMARY}"
 
-      # 3. Editing is opt-in. Until LURQ_MODE is 'pr', the job stops here having
-      #    changed nothing, the brief is in the run summary above, and no
-      #    Anthropic credential is needed to get this far.
+${envCheck}      # 3. Editing is opt-in. In 'comment' the job stops here having changed
+      #    nothing, with the brief in the run summary above. 'fix' and 'pr' both
+      #    continue; only 'pr' needs an Anthropic credential, which is why the
+      #    check below is gated on it alone and not on editing in general.
       - name: Check agent credentials
         if: env.LURQ_MODE == 'pr'
         env:
@@ -109,14 +153,27 @@ jobs:
           OAUTH_TOKEN: \${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
         run: |
           if [ -z "$API_KEY" ] && [ -z "$OAUTH_TOKEN" ]; then
-            echo "::error::pr mode needs one of ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN in this repository's secrets. A Claude Pro/Max subscription token works for the latter. Set LURQ_MODE=comment to run analysis only."
+            echo "::error::pr mode needs one of ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN in this repository's secrets. A Claude Pro/Max subscription token works for the latter. Set LURQ_MODE=fix to still open pull requests using only the changes lurq can prove (no key needed), or LURQ_MODE=comment to run analysis only."
             exit 1
           fi
 
       - name: Install dependencies
-        if: env.LURQ_MODE == 'pr'
+        if: env.LURQ_MODE == 'pr' || env.LURQ_MODE == 'fix'
         run: ${install}
 
+      # Everything the package itself proves, made WITHOUT a model: renamed call
+      # sites, and the range bump in every manifest declaring the dependency.
+      #
+      # After the install, not before: bumping package.json first fails \`npm ci\`
+      # outright with a lock-out-of-sync error, and the agent's own install below
+      # reconciles the lockfile afterwards. It takes the same cap the agent is
+      # given, so the two cannot disagree about blast radius, and it refuses
+      # multi-major upgrades and unplannable sequences \u2014 the same rules the
+      # prompt states below, applied by a rule instead of a model.
+      - name: Apply what needs no judgement
+        if: env.LURQ_MODE == 'pr' || env.LURQ_MODE == 'fix'
+        run: npx -y ${cli} fix . --plan lurq-plan.json --apply --max \${{ env.MAX_UPGRADES }}
+
       - name: Apply upgrades
         if: env.LURQ_MODE == 'pr'
         uses: anthropics/claude-code-action@v1
@@ -144,10 +201,17 @@ jobs:
                 "sequenceNote" is present, the sequence could not be planned,
                 treat that dependency as a migration and skip it.
 
+            A step before you has ALREADY APPLIED every change lurq could
+            prove: renamed call sites where the package itself proves the
+            replacement, and the range bump in every manifest for those
+            upgrades. Read the files before assuming any of it is undone \u2014 you
+            cannot run git, so the working tree is the only record. Your job is
+            what remains, and re-doing applied work risks reverting it.
+
             Take at most \${{ env.MAX_UPGRADES }} entries, hardest first:
 
             1. Bump the dependency's range in every manifest listed in
-               "declaredIn".
+               "declaredIn", where that has not been done already.
             2. Run \`${install.split(" ")[0]} install\` so node_modules holds the
                TARGET version. Until you do, the package on disk is the old one
                and anything you read from it describes the API you are leaving.
@@ -185,7 +249,7 @@ jobs:
       # 4. The workflow does version control, never the model.
       - name: Open pull request
         id: pr
-        if: env.LURQ_MODE == 'pr'
+        if: env.LURQ_MODE == 'pr' || env.LURQ_MODE == 'fix'
         uses: peter-evans/create-pull-request@v7
         with:
           branch: lurq/upgrades
@@ -204,7 +268,7 @@ var MERGE_STEP = `
       #    once the repo's OWN required checks pass; lurq never makes that call.
       #    Requires "Allow auto-merge" in repository settings.
       - name: Enable auto-merge
-        if: env.LURQ_MODE == 'pr' && steps.pr.outputs.pull-request-number
+        if: (env.LURQ_MODE == 'pr' || env.LURQ_MODE == 'fix') && steps.pr.outputs.pull-request-number
         env:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
         run: gh pr merge --auto --squash "\${{ steps.pr.outputs.pull-request-number }}"
@@ -217,6 +281,7 @@ function newFileUrl(fullName, branch, content) {
 export {
   WORKFLOW_PATH,
   cliSpec,
+  cronForScope,
   detectInstallCommand,
   renderWorkflow,
   newFileUrl

package/dist/{chunk-IQ4SDKKY.js → chunk-B2UUYRBX.js}

@@ -1,8 +1,19 @@
 import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  checkMcpStack,
+  isCrowded
+} from "./chunk-FDFPMBCA.js";
 import {
   loadStored,
   rowsToSurface
-} from "./chunk-DB2VF5UD.js";
+} from "./chunk-BJT2LHAR.js";
+import {
+  listAccountDeployments
+} from "./chunk-P6MIKSPY.js";
+import {
+  MCP_TIER,
+  contractOf
+} from "./chunk-6EQ3ARXA.js";
 import {
   fetchServerManifest,
   missingConfig
@@ -10,31 +21,18 @@ import {
 import {
   SEVERITY_RANK
 } from "./chunk-Q5VPF4WI.js";
-import {
-  checkMcpStack,
-  isCrowded
-} from "./chunk-VL2E5T2A.js";
-import {
-  MCP_TIER,
-  contractOf
-} from "./chunk-6EQ3ARXA.js";
-import {
-  enqueueSurface
-} from "./chunk-LO35HLQZ.js";
 import {
   assessVerdict
 } from "./chunk-QSL6QN5X.js";
 import {
   queryVulnerableInstalls
-} from "./chunk-LRD4GBYE.js";
+} from "./chunk-QUIMQ7YL.js";
+import {
+  enqueueSurface
+} from "./chunk-ONDVTXUO.js";
 import {
-  mcpChangeEvents,
-  mcpContracts,
-  mcpDeployments,
-  mcpObservations,
-  mcpPublicReports,
   packages
-} from "./chunk-LYMPYETA.js";
+} from "./chunk-4JHDSVIN.js";
 import {
   require_semver
 } from "./chunk-3GHJR7XR.js";
@@ -51,200 +49,6 @@ init_esm_shims();
 
 // src/audit/accountScans.ts
 init_esm_shims();
-
-// src/db/mcpScans.ts
-init_esm_shims();
-import { and, desc, eq, inArray, isNull, sql } from "drizzle-orm";
-async function putContract(db, row) {
-  await db.insert(mcpContracts).values(row).onConflictDoNothing();
-}
-async function getContract(db, contentHash) {
-  const [row] = await db.select().from(mcpContracts).where(eq(mcpContracts.contentHash, contentHash)).limit(1);
-  return row ?? null;
-}
-async function countDeployments(db, ownerId) {
-  const [row] = await db.select({ n: sql`count(*)::int` }).from(mcpDeployments).where(eq(mcpDeployments.ownerId, ownerId));
-  return row?.n ?? 0;
-}
-async function deploymentExists(db, ownerId, serverKey, configFingerprint) {
-  const [row] = await db.select({ id: mcpDeployments.id }).from(mcpDeployments).where(
-    and(
-      eq(mcpDeployments.ownerId, ownerId),
-      eq(mcpDeployments.serverKey, serverKey),
-      eq(mcpDeployments.configFingerprint, configFingerprint)
-    )
-  ).limit(1);
-  return !!row;
-}
-async function recordScan(db, input, diff) {
-  return db.transaction(async (tx) => {
-    const now = /* @__PURE__ */ new Date();
-    const inserted = await tx.insert(mcpDeployments).values({
-      ownerId: input.ownerId,
-      serverKey: input.serverKey,
-      configFingerprint: input.configFingerprint,
-      alias: input.alias,
-      registry: input.registry,
-      packageName: input.packageName,
-      transport: input.transport,
-      lastStatus: input.status,
-      firstSeenAt: now,
-      lastScannedAt: now
-    }).onConflictDoNothing({
-      target: [mcpDeployments.ownerId, mcpDeployments.serverKey, mcpDeployments.configFingerprint]
-    }).returning({ id: mcpDeployments.id });
-    const isFirst = inserted.length > 0;
-    const [dep] = await tx.select().from(mcpDeployments).where(
-      and(
-        eq(mcpDeployments.ownerId, input.ownerId),
-        eq(mcpDeployments.serverKey, input.serverKey),
-        eq(mcpDeployments.configFingerprint, input.configFingerprint)
-      )
-    ).for("update").limit(1);
-    if (!dep) throw new Error("deployment vanished inside its own transaction");
-    const [last] = await tx.select().from(mcpObservations).where(eq(mcpObservations.deploymentId, dep.id)).orderBy(desc(mcpObservations.id)).limit(1);
-    const same = last && last.status === input.status && last.contentHash === input.contentHash && last.serverVersion === input.serverVersion;
-    if (same) {
-      await tx.update(mcpObservations).set({ lastSeenAt: now, scanCount: sql`${mcpObservations.scanCount} + 1` }).where(eq(mcpObservations.id, last.id));
-    } else {
-      await tx.insert(mcpObservations).values({
-        deploymentId: dep.id,
-        ownerId: input.ownerId,
-        status: input.status,
-        contentHash: input.contentHash,
-        serverVersion: input.serverVersion,
-        error: input.error,
-        source: input.source,
-        firstSeenAt: now,
-        lastSeenAt: now
-      });
-    }
-    let change = isFirst ? "first" : "unchanged";
-    let event = null;
-    const moved = !isFirst && input.contentHash && dep.lastContentHash && input.contentHash !== dep.lastContentHash;
-    if (moved) {
-      const [previous] = await tx.select().from(mcpContracts).where(eq(mcpContracts.contentHash, dep.lastContentHash)).limit(1);
-      if (previous) {
-        const d = diff(previous);
-        await tx.insert(mcpChangeEvents).values({
-          deploymentId: dep.id,
-          ownerId: input.ownerId,
-          fromHash: dep.lastContentHash,
-          toHash: input.contentHash,
-          severity: d.severity,
-          summary: d.summary.slice(0, 1e3),
-          diff: d,
-          createdAt: now
-        }).onConflictDoUpdate({
-          target: [mcpChangeEvents.deploymentId, mcpChangeEvents.fromHash, mcpChangeEvents.toHash],
-          set: { createdAt: now, acknowledgedAt: null, severity: d.severity, summary: d.summary.slice(0, 1e3), diff: d }
-        });
-        change = "changed";
-        event = { at: now, severity: d.severity, summary: d.summary, rugPull: d.rugPull };
-      }
-    } else if (!isFirst && dep.lastStatus !== input.status) {
-      change = "status_changed";
-    }
-    await tx.update(mcpDeployments).set({
-      alias: input.alias,
-      transport: input.transport,
-      packageName: input.packageName,
-      lastStatus: input.status,
-      lastError: input.error,
-      lastScannedAt: now,
-      ...input.serverName !== null ? { serverName: input.serverName } : {},
-      ...input.serverVersion !== null ? { serverVersion: input.serverVersion } : {},
-      // A failed scan keeps the last contract that was read: "the server was
-      // unreachable today" must not erase what it exposed yesterday.
-      ...input.contentHash ? { lastContentHash: input.contentHash, worstSeverity: input.worstSeverity } : {},
-      ...moved || isFirst ? { lastChangedAt: now } : {}
-    }).where(eq(mcpDeployments.id, dep.id));
-    return { deploymentId: dep.id, change, event };
-  });
-}
-async function reportPublic(db, row) {
-  await db.insert(mcpPublicReports).values(row).onConflictDoNothing();
-  const [agree] = await db.select({ n: sql`count(distinct ${mcpPublicReports.ownerId})::int` }).from(mcpPublicReports).where(
-    and(
-      eq(mcpPublicReports.registry, row.registry),
-      eq(mcpPublicReports.packageName, row.packageName),
-      eq(mcpPublicReports.version, row.version),
-      eq(mcpPublicReports.contentHash, row.contentHash)
-    )
-  );
-  return agree?.n ?? 0;
-}
-var RANK = { critical: 0, high: 1, moderate: 2, low: 3, info: 4 };
-async function listDeployments(db, ownerId) {
-  const rows = await db.select({ d: mcpDeployments, c: { toolCount: mcpContracts.toolCount, analysis: mcpContracts.analysis } }).from(mcpDeployments).leftJoin(mcpContracts, eq(mcpContracts.contentHash, mcpDeployments.lastContentHash)).where(eq(mcpDeployments.ownerId, ownerId)).orderBy(desc(mcpDeployments.lastScannedAt)).limit(500);
-  if (rows.length === 0) return [];
-  const open = await db.select({ deploymentId: mcpChangeEvents.deploymentId, severity: mcpChangeEvents.severity }).from(mcpChangeEvents).where(
-    and(
-      eq(mcpChangeEvents.ownerId, ownerId),
-      isNull(mcpChangeEvents.acknowledgedAt),
-      inArray(
-        mcpChangeEvents.deploymentId,
-        rows.map((r) => r.d.id)
-      )
-    )
-  );
-  const byDep = /* @__PURE__ */ new Map();
-  for (const e of open) {
-    const cur = byDep.get(e.deploymentId) ?? { n: 0, worst: null };
-    cur.n++;
-    if (!cur.worst || RANK[e.severity] < RANK[cur.worst]) cur.worst = e.severity;
-    byDep.set(e.deploymentId, cur);
-  }
-  return rows.map(({ d, c }) => ({
-    ...d,
-    toolCount: c?.toolCount ?? null,
-    writes: c?.analysis?.stats.writes ?? null,
-    destroys: c?.analysis?.stats.destroys ?? null,
-    capabilities: c?.analysis?.stats.capabilities ?? {},
-    findings: c?.analysis?.findings.filter((f) => f.severity !== "info").length ?? 0,
-    openEvents: byDep.get(d.id)?.n ?? 0,
-    openWorst: byDep.get(d.id)?.worst ?? null
-  }));
-}
-async function getDeploymentDetail(db, ownerId, id) {
-  const [deployment] = await db.select().from(mcpDeployments).where(and(eq(mcpDeployments.id, id), eq(mcpDeployments.ownerId, ownerId))).limit(1);
-  if (!deployment) return null;
-  const [contract, observations, events] = await Promise.all([
-    deployment.lastContentHash ? getContract(db, deployment.lastContentHash) : Promise.resolve(null),
-    db.select().from(mcpObservations).where(and(eq(mcpObservations.deploymentId, id), eq(mcpObservations.ownerId, ownerId))).orderBy(desc(mcpObservations.id)).limit(60),
-    db.select().from(mcpChangeEvents).where(and(eq(mcpChangeEvents.deploymentId, id), eq(mcpChangeEvents.ownerId, ownerId))).orderBy(desc(mcpChangeEvents.createdAt)).limit(50)
-  ]);
-  return { deployment, contract, observations, events };
-}
-async function listChangeEvents(db, ownerId, opts = {}) {
-  const rows = await db.select({ e: mcpChangeEvents, alias: mcpDeployments.alias, serverKey: mcpDeployments.serverKey }).from(mcpChangeEvents).innerJoin(mcpDeployments, eq(mcpDeployments.id, mcpChangeEvents.deploymentId)).where(
-    and(eq(mcpChangeEvents.ownerId, ownerId), opts.openOnly ? isNull(mcpChangeEvents.acknowledgedAt) : void 0)
-  ).orderBy(desc(mcpChangeEvents.createdAt)).limit(Math.min(opts.limit ?? 50, 200));
-  return rows.map((r) => ({ ...r.e, alias: r.alias, serverKey: r.serverKey }));
-}
-async function acknowledgeEvent(db, ownerId, eventId) {
-  const rows = await db.update(mcpChangeEvents).set({ acknowledgedAt: /* @__PURE__ */ new Date() }).where(and(eq(mcpChangeEvents.id, eventId), eq(mcpChangeEvents.ownerId, ownerId))).returning({ id: mcpChangeEvents.id });
-  return rows.length > 0;
-}
-async function listAccountDeployments(db, ownerId) {
-  const summaries = await listDeployments(db, ownerId);
-  const hashes = [...new Set(summaries.map((s) => s.lastContentHash).filter((h) => !!h))];
-  const analyses = hashes.length ? await db.select({ hash: mcpContracts.contentHash, analysis: mcpContracts.analysis }).from(mcpContracts).where(inArray(mcpContracts.contentHash, hashes)) : [];
-  const byHash = new Map(analyses.map((a) => [a.hash, a.analysis]));
-  return summaries.map((s) => ({
-    serverKey: s.serverKey,
-    alias: s.alias,
-    lastStatus: s.lastStatus,
-    lastError: s.lastError,
-    lastContentHash: s.lastContentHash,
-    lastScannedAt: s.lastScannedAt,
-    analysis: s.lastContentHash ? byHash.get(s.lastContentHash) ?? null : null,
-    openEvents: s.openEvents,
-    openWorst: s.openWorst
-  }));
-}
-
-// src/audit/accountScans.ts
 var STALE_AFTER_DAYS = 14;
 var MAX_TOOL_FINDINGS = 5;
 var DAY_MS = 864e5;
@@ -252,7 +56,8 @@ function matchDeployment(s, deployments) {
   const host = s.endpoint?.toLowerCase();
   const candidates = deployments.filter((d) => {
     if (s.packageName) return d.serverKey === `npm:${s.packageName}`;
-    if (s.kind === "remote" && host) return d.serverKey === `remote:${host}` || d.serverKey.startsWith(`remote:${host}/`);
+    if (s.kind === "remote" && host)
+      return d.serverKey === `remote:${host}` || d.serverKey.startsWith(`remote:${host}/`);
     return d.alias === s.alias;
   });
   return candidates.sort((a, b) => b.lastScannedAt.getTime() - a.lastScannedAt.getTime())[0] ?? null;
@@ -281,7 +86,9 @@ function enrich(item, d, now) {
   if (item.status !== "answered") {
     item.status = "answered";
     delete item.skipReason;
-    item.findings = item.findings.filter((f) => !(f.kind === "contract-drift" && f.severity === "info"));
+    item.findings = item.findings.filter(
+      (f) => !(f.kind === "contract-drift" && f.severity === "info")
+    );
   }
   if (age > STALE_AFTER_DAYS) {
     item.findings.push({
@@ -352,7 +159,7 @@ async function withAccountScans(db, ownerId, report, servers) {
 // src/audit/assess.ts
 init_esm_shims();
 var import_semver = __toESM(require_semver(), 1);
-import { inArray as inArray2 } from "drizzle-orm";
+import { inArray } from "drizzle-orm";
 var NAME_CHUNK = 500;
 async function loadIndexed(db, names) {
   const out = /* @__PURE__ */ new Map();
@@ -363,7 +170,7 @@ async function loadIndexed(db, names) {
       latestVersion: packages.latestVersion,
       deprecated: packages.deprecated,
       advisories: packages.advisories
-    }).from(packages).where(inArray2(packages.name, chunk));
+    }).from(packages).where(inArray(packages.name, chunk));
     for (const r of rows) out.set(r.name, r);
   }
   return out;
@@ -669,7 +476,7 @@ async function queueUnknown(db, report, ownerId = null) {
   const names = report.items.filter((i) => i.unit !== "transitive" && i.skipReason === "not-in-index").map((i) => i.name);
   if (names.length === 0) return 0;
   try {
-    const { enqueueIngest } = await import("./ingestQueue-VKN4KBIF.js");
+    const { enqueueIngest } = await import("./ingestQueue-FSVJC3AA.js");
     for (const name of names) enqueueIngest(db, name, ownerId);
   } catch (err) {
     logger.debug(`audit: untracked-dep enqueue failed: ${String(err)}`);
@@ -714,20 +521,16 @@ async function handleAudit(db, input, ownerId = null) {
     filesRead: [],
     notes
   };
-  const report = await withAccountScans(db, ownerId, await assessInventory(db, inv), inv.mcpServers);
+  const report = await withAccountScans(
+    db,
+    ownerId,
+    await assessInventory(db, inv),
+    inv.mcpServers
+  );
   await queueUnknown(db, report);
   return { ...report, root: null };
 }
 
 export {
-  putContract,
-  countDeployments,
-  deploymentExists,
-  recordScan,
-  reportPublic,
-  listDeployments,
-  getDeploymentDetail,
-  listChangeEvents,
-  acknowledgeEvent,
   handleAudit
 };

package/dist/{chunk-DB2VF5UD.js → chunk-BJT2LHAR.js}

@@ -7,17 +7,17 @@ import {
   enqueueSurface,
   mcpSurfaceRef,
   surfaceRef
-} from "./chunk-LO35HLQZ.js";
-import {
-  cached
-} from "./chunk-HWBBVLOT.js";
+} from "./chunk-ONDVTXUO.js";
 import {
   UNBOUNDED_ARITY,
   claims,
   entities,
   observations,
   symbols
-} from "./chunk-LYMPYETA.js";
+} from "./chunk-4JHDSVIN.js";
+import {
+  cached
+} from "./chunk-6L67QMCP.js";
 import {
   logger
 } from "./chunk-MYGSLK44.js";
@@ -65,7 +65,9 @@ async function drain() {
       const updated = await job.fill(job.db, job.pkg, job.version, job.entityId);
       logger.info(`surface fill ${key}: ${updated} symbol row(s) updated`);
     } catch (err) {
-      logger.warn(`surface fill failed for ${key}: ${err instanceof Error ? err.message : String(err)}`);
+      logger.warn(
+        `surface fill failed for ${key}: ${err instanceof Error ? err.message : String(err)}`
+      );
     } finally {
       pending.delete(key);
     }
@@ -73,10 +75,12 @@ async function drain() {
   }
 }
 async function fillOne(db, pkg, version, entityId) {
-  const { fetchAndExtract } = await import("./fetch-QYTUJVG2.js");
+  const { fetchAndExtract } = await import("./fetch-PJ3SC32M.js");
   const fetched = await fetchAndExtract(pkg, version);
   if (!fetched) return 0;
-  const values = fetched.surface.symbols.filter((s) => s.tier === TIER && (s.sourceRef?.offset !== void 0 || s.maxArity !== void 0)).map((s) => ({
+  const values = fetched.surface.symbols.filter(
+    (s) => s.tier === TIER && (s.sourceRef?.offset !== void 0 || s.maxArity !== void 0)
+  ).map((s) => ({
     path: s.path,
     offset: s.sourceRef?.offset ?? null,
     maxArity: s.maxArity === void 0 ? null : s.maxArity ?? UNBOUNDED_ARITY
@@ -189,7 +193,7 @@ async function resolveSurfaceUncached(db, input) {
   const version = input.version ?? null;
   let stored = await loadStored(db, input.package, version);
   if (!stored || stored.verdict === "unknown" && stored.rows.length === 0) {
-    const { firstTouchSurface } = await import("./firstTouch-QQTJH4QX.js");
+    const { firstTouchSurface } = await import("./firstTouch-COJCMOB3.js");
     if (await firstTouchSurface(db, input.package, version)) {
       stored = await loadStored(db, input.package, version);
     }
@@ -244,7 +248,7 @@ async function diffSurfaceUncached(db, input, onFill) {
     loadStored(db, input.package, input.toVersion)
   ]);
   if (!a || !b || a.rows.length === 0 || b.rows.length === 0) {
-    const { firstTouchPair } = await import("./firstTouch-QQTJH4QX.js");
+    const { firstTouchPair } = await import("./firstTouch-COJCMOB3.js");
     if (await firstTouchPair(db, input.package, input.fromVersion, input.toVersion)) {
       [a, b] = await Promise.all([
         loadStored(db, input.package, input.fromVersion),
@@ -279,7 +283,8 @@ async function diffSurfaceUncached(db, input, onFill) {
     [a, input.fromVersion],
     [b, input.toVersion]
   ]) {
-    if (needsFill(stored.rows) && scheduleFill(db, input.package, version, stored.entityId)) onFill();
+    if (needsFill(stored.rows) && scheduleFill(db, input.package, version, stored.entityId))
+      onFill();
   }
   const diff = diffSurfaces(
     rowsToSurface(input.package, input.fromVersion, a.rows, a.tier ?? "shipped_js_ast"),