lurqrun 0.1.7 → 0.1.9

package/dist/{check-2FDGUOV7.js → check-PQSQ2MMA.js}

@@ -1,7 +1,7 @@
 import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
 import {
   checkApi
-} from "./chunk-CIDWNUAP.js";
+} from "./chunk-SOXFMMXC.js";
 import {
   require_dist
 } from "./chunk-QKGYDMWB.js";

package/dist/checkUpgrade-Q4CV7GXG.js

@@ -0,0 +1,24 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  SCAN_LIMIT,
+  fixableTargets,
+  modeDisagreement,
+  parseUpgradeSpec,
+  planMode,
+  planUpgrades,
+  runCheckUpgrade,
+  targetsFromPlanFile,
+  targetsFromUpgrades
+} from "./chunk-ILKYIVYV.js";
+import "./chunk-I3M2KJXB.js";
+export {
+  SCAN_LIMIT,
+  fixableTargets,
+  modeDisagreement,
+  parseUpgradeSpec,
+  planMode,
+  planUpgrades,
+  runCheckUpgrade,
+  targetsFromPlanFile,
+  targetsFromUpgrades
+};

package/dist/{chunk-BCANRN5B.js → chunk-2GAYNIHG.js}

@@ -8,8 +8,14 @@ init_esm_shims();
 var DEFAULT_REPO_POLICY = {
   enabled: false,
   scope: "blocking",
-  autoMerge: false
+  autoMerge: false,
+  // Stated rather than relied upon. `permits()` already reads an absent
+  // `checks` as on, so a repo connected before this shipped behaves the same as
+  // a new one — which is the point of the inversion. Writing it here keeps the
+  // default visible in the policy the dashboard round-trips.
+  checks: { env: true }
 };
+var RUN_TRIGGERS = ["schedule", "dispatch", "push", "pull_request", "other"];
 var UPGRADE_SEVERITIES = ["blocking", "warning", "ok", "unverified"];
 var UPGRADE_RUN_STATUSES = [
   "checked",
@@ -25,6 +31,7 @@ var TRANSITIVE_DETAIL_CAP = 100;
 
 export {
   DEFAULT_REPO_POLICY,
+  RUN_TRIGGERS,
   UPGRADE_SEVERITIES,
   UPGRADE_RUN_STATUSES,
   REPO_MANIFEST_CAP,

package/dist/chunk-2LXYRDUN.js

@@ -0,0 +1,92 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/fix/domains.ts
+init_esm_shims();
+var DOMAIN_SCAN_LIMIT = 2e4;
+var DOMAINS = {
+  /** Variables the code reads that no .env file declares. No key, no network. */
+  env: async (root, opts) => {
+    const { envFindings } = await import("./env-UN6KGZ7S.js");
+    const plan = envFindings(root, { limit: opts.limit ?? DOMAIN_SCAN_LIMIT });
+    return { findings: plan.findings, truncated: plan.truncated };
+  },
+  /**
+   * Model identifiers the provider has retired or put an end date on.
+   *
+   * Reads source only — no network, no key, no arguments. That is why it runs
+   * by default: the check costs nothing the scan is not already paying, and
+   * the failure it catches is one nothing else in the toolchain can see.
+   */
+  model: async (root, opts) => {
+    const { modelFindings } = await import("./model-ASMZWLM7.js");
+    const plan = modelFindings(root, { limit: opts.limit ?? DOMAIN_SCAN_LIMIT });
+    return { findings: plan.findings, truncated: plan.truncated };
+  },
+  /**
+   * Renames the package itself proves, the manifest ranges an upgrade leaves
+   * stale, and a brief for everything that needs judgement.
+   *
+   * Reads the two published versions from npm, so it needs the network but no
+   * API key — the same contract `check-upgrade` advertises.
+   */
+  package: async (root, opts) => {
+    const targets = opts.upgrade ?? [];
+    if (targets.length === 0) {
+      return {
+        findings: [],
+        skipped: "no upgrades given. Pass `upgrade` with the versions to assess, or run `lurq fix` in the project to have them worked out from the index."
+      };
+    }
+    const { scanReferences } = await import("./references-I6Y4BSRR.js");
+    const { checkUpgrade } = await import("./upgrade-S72W7JVC.js");
+    const { renamePlan } = await import("./rename-OS6JYBZQ.js");
+    const { manifestFindings } = await import("./manifest-ENMIC54B.js");
+    const stats = { files: 0, truncated: false };
+    const refs = scanReferences(root, { limit: opts.limit ?? DOMAIN_SCAN_LIMIT, stats });
+    const report = await checkUpgrade(targets, refs, { rootDir: root });
+    return {
+      findings: [...renamePlan(report).findings, ...manifestFindings(root, targets).findings],
+      truncated: stats.truncated
+    };
+  }
+};
+var AVAILABLE = ["env", "model", "package"];
+var SOURCE_DOMAINS = AVAILABLE.filter((d) => d !== "package");
+async function runDomains(opts = {}) {
+  const root = opts.dir?.trim() || process.cwd();
+  const wanted = opts.domains?.length ? opts.domains : AVAILABLE;
+  const findings = [];
+  const ran = [];
+  const skipped = [];
+  let truncated = false;
+  for (const domain of wanted) {
+    const run = DOMAINS[domain];
+    if (!run) {
+      skipped.push({ domain, reason: `lurq has no detector for the ${domain} domain yet` });
+      continue;
+    }
+    try {
+      const result = await run(root, opts);
+      if (result.skipped) {
+        skipped.push({ domain, reason: result.skipped });
+        continue;
+      }
+      findings.push(...result.findings);
+      if (result.truncated) truncated = true;
+      ran.push(domain);
+    } catch (err) {
+      skipped.push({ domain, reason: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  return { root, ran, skipped, findings, truncated };
+}
+
+export {
+  DOMAIN_SCAN_LIMIT,
+  AVAILABLE,
+  SOURCE_DOMAINS,
+  runDomains
+};

package/dist/chunk-2XMD4H2I.js

@@ -0,0 +1,243 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  mcpChangeEvents,
+  mcpContracts,
+  mcpDeployments,
+  mcpObservations,
+  mcpPublicReports
+} from "./chunk-6353IJJ5.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/db/mcpScans.ts
+init_esm_shims();
+import { and, desc, eq, inArray, isNull, sql } from "drizzle-orm";
+async function putContract(db, row) {
+  await db.insert(mcpContracts).values(row).onConflictDoNothing();
+}
+async function getContract(db, contentHash) {
+  const [row] = await db.select().from(mcpContracts).where(eq(mcpContracts.contentHash, contentHash)).limit(1);
+  return row ?? null;
+}
+async function countDeployments(db, ownerId) {
+  const [row] = await db.select({ n: sql`count(*)::int` }).from(mcpDeployments).where(eq(mcpDeployments.ownerId, ownerId));
+  return row?.n ?? 0;
+}
+async function deploymentExists(db, ownerId, serverKey, configFingerprint) {
+  const [row] = await db.select({ id: mcpDeployments.id }).from(mcpDeployments).where(
+    and(
+      eq(mcpDeployments.ownerId, ownerId),
+      eq(mcpDeployments.serverKey, serverKey),
+      eq(mcpDeployments.configFingerprint, configFingerprint)
+    )
+  ).limit(1);
+  return !!row;
+}
+async function recordScan(db, input, diff) {
+  return db.transaction(async (tx) => {
+    const now = /* @__PURE__ */ new Date();
+    const inserted = await tx.insert(mcpDeployments).values({
+      ownerId: input.ownerId,
+      serverKey: input.serverKey,
+      configFingerprint: input.configFingerprint,
+      alias: input.alias,
+      registry: input.registry,
+      packageName: input.packageName,
+      transport: input.transport,
+      lastStatus: input.status,
+      firstSeenAt: now,
+      lastScannedAt: now
+    }).onConflictDoNothing({
+      target: [
+        mcpDeployments.ownerId,
+        mcpDeployments.serverKey,
+        mcpDeployments.configFingerprint
+      ]
+    }).returning({ id: mcpDeployments.id });
+    const isFirst = inserted.length > 0;
+    const [dep] = await tx.select().from(mcpDeployments).where(
+      and(
+        eq(mcpDeployments.ownerId, input.ownerId),
+        eq(mcpDeployments.serverKey, input.serverKey),
+        eq(mcpDeployments.configFingerprint, input.configFingerprint)
+      )
+    ).for("update").limit(1);
+    if (!dep) throw new Error("deployment vanished inside its own transaction");
+    const [last] = await tx.select().from(mcpObservations).where(eq(mcpObservations.deploymentId, dep.id)).orderBy(desc(mcpObservations.id)).limit(1);
+    const same = last && last.status === input.status && last.contentHash === input.contentHash && last.serverVersion === input.serverVersion;
+    if (same) {
+      await tx.update(mcpObservations).set({ lastSeenAt: now, scanCount: sql`${mcpObservations.scanCount} + 1` }).where(eq(mcpObservations.id, last.id));
+    } else {
+      await tx.insert(mcpObservations).values({
+        deploymentId: dep.id,
+        ownerId: input.ownerId,
+        status: input.status,
+        contentHash: input.contentHash,
+        serverVersion: input.serverVersion,
+        error: input.error,
+        source: input.source,
+        firstSeenAt: now,
+        lastSeenAt: now
+      });
+    }
+    let change = isFirst ? "first" : "unchanged";
+    let event = null;
+    const moved = !isFirst && input.contentHash && dep.lastContentHash && input.contentHash !== dep.lastContentHash;
+    if (moved) {
+      const [previous] = await tx.select().from(mcpContracts).where(eq(mcpContracts.contentHash, dep.lastContentHash)).limit(1);
+      if (previous) {
+        const d = diff(previous);
+        await tx.insert(mcpChangeEvents).values({
+          deploymentId: dep.id,
+          ownerId: input.ownerId,
+          fromHash: dep.lastContentHash,
+          toHash: input.contentHash,
+          severity: d.severity,
+          summary: d.summary.slice(0, 1e3),
+          diff: d,
+          createdAt: now
+        }).onConflictDoUpdate({
+          target: [
+            mcpChangeEvents.deploymentId,
+            mcpChangeEvents.fromHash,
+            mcpChangeEvents.toHash
+          ],
+          set: {
+            createdAt: now,
+            acknowledgedAt: null,
+            severity: d.severity,
+            summary: d.summary.slice(0, 1e3),
+            diff: d
+          }
+        });
+        change = "changed";
+        event = { at: now, severity: d.severity, summary: d.summary, rugPull: d.rugPull };
+      }
+    } else if (!isFirst && dep.lastStatus !== input.status) {
+      change = "status_changed";
+    }
+    await tx.update(mcpDeployments).set({
+      alias: input.alias,
+      transport: input.transport,
+      packageName: input.packageName,
+      lastStatus: input.status,
+      lastError: input.error,
+      lastScannedAt: now,
+      ...input.serverName !== null ? { serverName: input.serverName } : {},
+      ...input.serverVersion !== null ? { serverVersion: input.serverVersion } : {},
+      // A failed scan keeps the last contract that was read: "the server was
+      // unreachable today" must not erase what it exposed yesterday.
+      ...input.contentHash ? { lastContentHash: input.contentHash, worstSeverity: input.worstSeverity } : {},
+      ...moved || isFirst ? { lastChangedAt: now } : {}
+    }).where(eq(mcpDeployments.id, dep.id));
+    return { deploymentId: dep.id, change, event };
+  });
+}
+async function reportPublic(db, row) {
+  await db.insert(mcpPublicReports).values(row).onConflictDoNothing();
+  const [agree] = await db.select({ n: sql`count(distinct ${mcpPublicReports.ownerId})::int` }).from(mcpPublicReports).where(
+    and(
+      eq(mcpPublicReports.registry, row.registry),
+      eq(mcpPublicReports.packageName, row.packageName),
+      eq(mcpPublicReports.version, row.version),
+      eq(mcpPublicReports.contentHash, row.contentHash)
+    )
+  );
+  return agree?.n ?? 0;
+}
+var RANK = { critical: 0, high: 1, moderate: 2, low: 3, info: 4 };
+async function listDeployments(db, ownerId) {
+  const rows = await db.select({
+    d: mcpDeployments,
+    c: { toolCount: mcpContracts.toolCount, analysis: mcpContracts.analysis }
+  }).from(mcpDeployments).leftJoin(mcpContracts, eq(mcpContracts.contentHash, mcpDeployments.lastContentHash)).where(eq(mcpDeployments.ownerId, ownerId)).orderBy(desc(mcpDeployments.lastScannedAt)).limit(500);
+  if (rows.length === 0) return [];
+  const open = await db.select({ deploymentId: mcpChangeEvents.deploymentId, severity: mcpChangeEvents.severity }).from(mcpChangeEvents).where(
+    and(
+      eq(mcpChangeEvents.ownerId, ownerId),
+      isNull(mcpChangeEvents.acknowledgedAt),
+      inArray(
+        mcpChangeEvents.deploymentId,
+        rows.map((r) => r.d.id)
+      )
+    )
+  );
+  const byDep = /* @__PURE__ */ new Map();
+  for (const e of open) {
+    const cur = byDep.get(e.deploymentId) ?? { n: 0, worst: null };
+    cur.n++;
+    if (!cur.worst || RANK[e.severity] < RANK[cur.worst]) cur.worst = e.severity;
+    byDep.set(e.deploymentId, cur);
+  }
+  return rows.map(({ d, c }) => ({
+    ...d,
+    toolCount: c?.toolCount ?? null,
+    writes: c?.analysis?.stats.writes ?? null,
+    destroys: c?.analysis?.stats.destroys ?? null,
+    capabilities: c?.analysis?.stats.capabilities ?? {},
+    findings: c?.analysis?.findings.filter((f) => f.severity !== "info").length ?? 0,
+    openEvents: byDep.get(d.id)?.n ?? 0,
+    openWorst: byDep.get(d.id)?.worst ?? null
+  }));
+}
+async function getDeploymentDetail(db, ownerId, id) {
+  const [deployment] = await db.select().from(mcpDeployments).where(and(eq(mcpDeployments.id, id), eq(mcpDeployments.ownerId, ownerId))).limit(1);
+  if (!deployment) return null;
+  const [contract, observations, events] = await Promise.all([
+    deployment.lastContentHash ? getContract(db, deployment.lastContentHash) : Promise.resolve(null),
+    db.select().from(mcpObservations).where(and(eq(mcpObservations.deploymentId, id), eq(mcpObservations.ownerId, ownerId))).orderBy(desc(mcpObservations.id)).limit(60),
+    db.select().from(mcpChangeEvents).where(and(eq(mcpChangeEvents.deploymentId, id), eq(mcpChangeEvents.ownerId, ownerId))).orderBy(desc(mcpChangeEvents.createdAt)).limit(50)
+  ]);
+  return { deployment, contract, observations, events };
+}
+async function listChangeEvents(db, ownerId, opts = {}) {
+  const rows = await db.select({
+    e: mcpChangeEvents,
+    alias: mcpDeployments.alias,
+    serverKey: mcpDeployments.serverKey
+  }).from(mcpChangeEvents).innerJoin(mcpDeployments, eq(mcpDeployments.id, mcpChangeEvents.deploymentId)).where(
+    and(
+      eq(mcpChangeEvents.ownerId, ownerId),
+      opts.openOnly ? isNull(mcpChangeEvents.acknowledgedAt) : void 0
+    )
+  ).orderBy(desc(mcpChangeEvents.createdAt)).limit(Math.min(opts.limit ?? 50, 200));
+  return rows.map((r) => ({ ...r.e, alias: r.alias, serverKey: r.serverKey }));
+}
+async function acknowledgeEvent(db, ownerId, eventId) {
+  const rows = await db.update(mcpChangeEvents).set({ acknowledgedAt: /* @__PURE__ */ new Date() }).where(and(eq(mcpChangeEvents.id, eventId), eq(mcpChangeEvents.ownerId, ownerId))).returning({ id: mcpChangeEvents.id });
+  return rows.length > 0;
+}
+async function listAccountDeployments(db, ownerId) {
+  const summaries = await listDeployments(db, ownerId);
+  const hashes = [
+    ...new Set(summaries.map((s) => s.lastContentHash).filter((h) => !!h))
+  ];
+  const analyses = hashes.length ? await db.select({ hash: mcpContracts.contentHash, analysis: mcpContracts.analysis }).from(mcpContracts).where(inArray(mcpContracts.contentHash, hashes)) : [];
+  const byHash = new Map(analyses.map((a) => [a.hash, a.analysis]));
+  return summaries.map((s) => ({
+    serverKey: s.serverKey,
+    alias: s.alias,
+    lastStatus: s.lastStatus,
+    lastError: s.lastError,
+    lastContentHash: s.lastContentHash,
+    lastScannedAt: s.lastScannedAt,
+    analysis: s.lastContentHash ? byHash.get(s.lastContentHash) ?? null : null,
+    openEvents: s.openEvents,
+    openWorst: s.openWorst
+  }));
+}
+
+export {
+  putContract,
+  getContract,
+  countDeployments,
+  deploymentExists,
+  recordScan,
+  reportPublic,
+  listDeployments,
+  getDeploymentDetail,
+  listChangeEvents,
+  acknowledgeEvent,
+  listAccountDeployments
+};

package/dist/chunk-3D2MPGOQ.js

@@ -0,0 +1,181 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/notify/safeHttp.ts
+init_esm_shims();
+import { lookup as dnsLookup } from "dns";
+import https from "https";
+import { isIP } from "net";
+var MAX_URL = 2e3;
+var TIMEOUT_MS = 1e4;
+var MAX_RESPONSE = 4e3;
+function v4Private(ip) {
+  const [a = 0, b = 0] = ip.split(".").map(Number);
+  return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || // carrier-grade NAT
+  a === 169 && b === 254 || // link-local, cloud metadata
+  a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 192 && b === 0 || a === 198 && (b === 18 || b === 19) || // benchmarking
+  a >= 224;
+}
+function isPrivateAddress(ip) {
+  const kind = isIP(ip);
+  if (kind === 4) return v4Private(ip);
+  if (kind !== 6) return true;
+  const v = ip.toLowerCase();
+  if (v === "::" || v === "::1") return true;
+  const mapped = /^::ffff:(.+)$/.exec(v);
+  if (mapped) {
+    const rest = mapped[1];
+    if (isIP(rest) === 4) return v4Private(rest);
+    const [hi = "0", lo = "0"] = rest.split(":");
+    const n = parseInt(hi, 16) << 16 | parseInt(lo, 16);
+    return v4Private([n >>> 24 & 255, n >>> 16 & 255, n >>> 8 & 255, n & 255].join("."));
+  }
+  return /^f[cd]/.test(v) || /^fe[89ab]/.test(v) || v.startsWith("ff");
+}
+var SLACK_HOSTS = /* @__PURE__ */ new Set(["hooks.slack.com"]);
+var DISCORD_HOSTS = /* @__PURE__ */ new Set([
+  "discord.com",
+  "discordapp.com",
+  "ptb.discord.com",
+  "canary.discord.com"
+]);
+var TEAMS_SUFFIXES = [".logic.azure.com", ".powerplatform.com", ".powerautomate.com"];
+function validateChannelUrl(kind, raw) {
+  if (typeof raw !== "string" || !raw.trim() || raw.length > MAX_URL)
+    return { ok: false, error: "Paste the full webhook URL." };
+  let url;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    return { ok: false, error: "That is not a valid URL." };
+  }
+  if (url.protocol !== "https:") return { ok: false, error: "The URL must start with https://." };
+  if (url.username || url.password)
+    return { ok: false, error: "The URL must not contain a username or password." };
+  const host = url.hostname.toLowerCase();
+  if (kind === "slack") {
+    if (!SLACK_HOSTS.has(host) || !/^\/(services|triggers)\//.test(url.pathname)) {
+      return {
+        ok: false,
+        error: "A Slack incoming webhook URL starts with https://hooks.slack.com/services/."
+      };
+    }
+  } else if (kind === "discord") {
+    if (!DISCORD_HOSTS.has(host) || !url.pathname.startsWith("/api/webhooks/")) {
+      return {
+        ok: false,
+        error: "A Discord webhook URL starts with https://discord.com/api/webhooks/."
+      };
+    }
+  } else if (kind === "teams") {
+    if (host.endsWith(".webhook.office.com") || host === "outlook.office.com") {
+      return {
+        ok: false,
+        error: "Teams retired Office 365 connector webhooks in May 2026. Create one with the Workflows app instead."
+      };
+    }
+    if (!TEAMS_SUFFIXES.some((s) => host.endsWith(s))) {
+      return {
+        ok: false,
+        error: "Use the webhook URL a Teams Workflows flow gives you (a logic.azure.com or powerplatform.com address)."
+      };
+    }
+  } else {
+    if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal")) {
+      return { ok: false, error: "The URL must be reachable on the public internet." };
+    }
+    if (isIP(host.replace(/^\[|\]$/g, "")) && isPrivateAddress(host.replace(/^\[|\]$/g, ""))) {
+      return { ok: false, error: "The URL must be reachable on the public internet." };
+    }
+  }
+  return { ok: true, url };
+}
+function safeLookup(resolve = dnsLookup) {
+  return (hostname, options, callback) => {
+    resolve(hostname, { all: true }, (err, addresses) => {
+      if (err) return callback(err, []);
+      const list = addresses;
+      if (!list.length || list.some((a) => isPrivateAddress(a.address))) {
+        const e = Object.assign(new Error(`${hostname} resolves to a private network address`), {
+          code: "EPRIVATE"
+        });
+        return callback(e, []);
+      }
+      if (options?.all) return callback(null, list);
+      callback(null, list[0].address, list[0].family);
+    });
+  };
+}
+function postJson(url, payload, headers, opts = {}) {
+  return new Promise((resolvePost) => {
+    let settled = false;
+    const done = (o) => {
+      if (!settled) {
+        settled = true;
+        resolvePost(o);
+      }
+    };
+    let req;
+    try {
+      req = https.request(
+        url,
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "User-Agent": "lurq-alerts",
+            "Content-Length": Buffer.byteLength(payload),
+            ...headers
+          },
+          lookup: opts.lookup ?? safeLookup(),
+          timeout: opts.timeoutMs ?? TIMEOUT_MS
+        },
+        (res) => {
+          let body = "";
+          res.setEncoding("utf8");
+          res.on("data", (chunk) => {
+            if (body.length < MAX_RESPONSE) body += chunk;
+          });
+          res.on("end", () => {
+            const status = res.statusCode ?? 0;
+            done({
+              status,
+              error: status >= 200 && status < 300 ? null : `HTTP ${status}${body ? `: ${body.slice(0, 120).replace(/\s+/g, " ")}` : ""}`
+            });
+          });
+          res.on(
+            "error",
+            () => done({ status: res.statusCode ?? 0, error: "response interrupted" })
+          );
+        }
+      );
+    } catch (err) {
+      done({
+        status: 0,
+        error: err instanceof Error ? err.message : "request failed",
+        code: "EINVAL"
+      });
+      return;
+    }
+    req.on("timeout", () => {
+      req.destroy(Object.assign(new Error("timed out"), { code: "ETIMEDOUT" }));
+    });
+    req.on("error", (err) => {
+      done({
+        status: 0,
+        error: err.code === "EPRIVATE" ? err.message : `could not connect (${err.code ?? err.message})`,
+        code: err.code ?? "ECONNECT"
+      });
+    });
+    req.end(payload);
+  });
+}
+
+export {
+  isPrivateAddress,
+  validateChannelUrl,
+  safeLookup,
+  postJson
+};