lurqrun 0.1.7 → 0.1.9

package/dist/chunk-53SG6XWA.js

@@ -0,0 +1,141 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  SseError,
+  StreamableHTTPError,
+  UnauthorizedError
+} from "./chunk-X4W64MHU.js";
+import {
+  ErrorCode,
+  McpError
+} from "./chunk-D3K6IZVR.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/mcpScan/errors.ts
+init_esm_shims();
+var ENV_COMPLAINT = /\b([A-Z][A-Z0-9]{2,}(?:_[A-Z0-9]+)+)\b[^.\n]{0,60}?\b(required|must be set|not set|missing|is not defined)\b|\b(required|must be set|missing)\b[^.\n]{0,60}?\b([A-Z][A-Z0-9]{2,}(?:_[A-Z0-9]+)+)\b/;
+function sniffMissingEnv(text) {
+  const m = ENV_COMPLAINT.exec(text);
+  return m ? m[1] ?? m[4] ?? null : null;
+}
+var NETWORK_CODES = /* @__PURE__ */ new Set([
+  "ECONNREFUSED",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_SOCKET",
+  "CERT_HAS_EXPIRED",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "ERR_TLS_CERT_ALTNAME_INVALID"
+]);
+function causeCode(err) {
+  let cur = err;
+  for (let i = 0; i < 5 && cur; i++) {
+    const code = cur.code;
+    if (typeof code === "string") return code;
+    cur = cur.cause;
+  }
+  return null;
+}
+var msg = (err) => err instanceof Error ? err.message : String(err);
+function classifyError(err, ctx) {
+  const message = msg(err).slice(0, 500);
+  if (err instanceof UnauthorizedError) {
+    return {
+      status: "auth_required",
+      error: message || "the server requires authorization",
+      hint: "this server signs in with OAuth, and lurq cannot reuse the token your agent holds; ask your agent to pass its tool list to the mcp_stack tool instead"
+    };
+  }
+  const httpCode = err instanceof StreamableHTTPError || err instanceof SseError ? err.code : void 0;
+  if (httpCode === 401 || httpCode === 403) {
+    return {
+      status: "auth_required",
+      error: `HTTP ${httpCode}`,
+      hint: "the server rejected the credentials in this config; check the Authorization header or token it is given"
+    };
+  }
+  if (typeof httpCode === "number" && httpCode > 0) {
+    return {
+      status: "unreachable",
+      error: `HTTP ${httpCode}: ${message}`,
+      hint: httpCode === 404 ? "nothing answers MCP at this url; check the path" : null
+    };
+  }
+  if (err instanceof McpError && err.code === ErrorCode.RequestTimeout) {
+    return {
+      status: "timeout",
+      error: message,
+      hint: ctx.transport === "stdio" ? "the server did not answer in time; a first run of npx/uvx downloads the package, so try again with a longer --timeout" : null
+    };
+  }
+  const code = causeCode(err);
+  if (code === "ENOENT" && ctx.transport === "stdio") {
+    return {
+      status: "spawn_failed",
+      error: `command not found: ${ctx.command ?? "(none)"}`,
+      hint: "install it, or use an absolute path in the config"
+    };
+  }
+  if (code && NETWORK_CODES.has(code)) {
+    return { status: "unreachable", error: `${code}: ${message}`, hint: null };
+  }
+  if (err instanceof TypeError && /fetch failed/i.test(message)) {
+    const cause = err.cause;
+    return {
+      status: "unreachable",
+      error: cause ? `fetch failed: ${msg(cause).slice(0, 300)}` : message,
+      hint: null
+    };
+  }
+  const closed = err instanceof McpError && err.code === ErrorCode.ConnectionClosed || /connection closed/i.test(message);
+  if (closed && ctx.transport === "stdio") {
+    const missing = sniffMissingEnv(ctx.stderrTail);
+    if (missing) {
+      return {
+        status: "needs_config",
+        error: `the server exited, and its output names ${missing} as required`,
+        hint: `set ${missing} in this server's env block`
+      };
+    }
+    if (ctx.stdoutNoise > 0 && !ctx.stderrTail.trim()) {
+      return {
+        status: "protocol_error",
+        error: "the server wrote non-protocol output to stdout and then closed",
+        hint: "stdio servers must log to stderr; stdout is reserved for JSON-RPC"
+      };
+    }
+    return {
+      status: "spawn_failed",
+      error: ctx.stderrTail.trim() ? `exited before completing the handshake: ${ctx.stderrTail.trim().split("\n").slice(-3).join(" | ")}` : "exited before completing the handshake",
+      hint: null
+    };
+  }
+  if (/protocol version is not supported/i.test(message)) {
+    return {
+      status: "protocol_error",
+      error: message,
+      hint: "the server speaks a protocol revision this lurq version does not; upgrade lurq"
+    };
+  }
+  if (ctx.stdoutNoise > 0) {
+    return {
+      status: "protocol_error",
+      error: `${message} (the server also wrote ${ctx.stdoutNoise} non-protocol line(s) to stdout)`,
+      hint: "stdio servers must log to stderr; stdout is reserved for JSON-RPC"
+    };
+  }
+  return { status: "protocol_error", error: message || "unknown error", hint: null };
+}
+
+export {
+  sniffMissingEnv,
+  classifyError
+};

package/dist/chunk-5ABNDB3I.js

@@ -0,0 +1,37 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/remoteProbe/url.ts
+init_esm_shims();
+var PLACEHOLDER = /\{[^{}]+\}/;
+function endpointIdentity(raw) {
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim();
+  if (!trimmed || trimmed.length > 2048) return null;
+  const templated = PLACEHOLDER.test(trimmed);
+  let parsed;
+  try {
+    parsed = new URL(templated ? trimmed.replace(/\{[^{}]+\}/g, "placeholder") : trimmed);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+  const host = parsed.hostname.toLowerCase();
+  if (!host) return null;
+  if (templated) return { url: trimmed, host, templated: true };
+  parsed.hash = "";
+  const path = parsed.pathname === "/" ? "" : parsed.pathname;
+  const port = parsed.port ? `:${parsed.port}` : "";
+  const auth = parsed.username ? `${parsed.username}${parsed.password ? `:${parsed.password}` : ""}@` : "";
+  return {
+    url: `${parsed.protocol}//${auth}${host}${port}${path}${parsed.search}`,
+    host,
+    templated: false
+  };
+}
+
+export {
+  endpointIdentity
+};

package/dist/chunk-5ALIJFDA.js

@@ -0,0 +1,114 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  require_semver
+} from "./chunk-3GHJR7XR.js";
+import {
+  __toESM,
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/fix/manifest.ts
+init_esm_shims();
+var import_semver = __toESM(require_semver(), 1);
+import { readFileSync } from "fs";
+import { join } from "path";
+import ts from "typescript";
+var BLOCKS = ["dependencies", "devDependencies", "optionalDependencies"];
+var SIMPLE_RANGE = /^(\^|~)?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/;
+function declaredRange(text, pkg) {
+  const sf = ts.parseJsonText("package.json", text);
+  const root = sf.statements[0]?.expression;
+  if (!root || !ts.isObjectLiteralExpression(root)) return null;
+  const propNamed = (obj, name) => obj.properties.find(
+    (p) => ts.isPropertyAssignment(p) && ts.isStringLiteral(p.name) && p.name.text === name
+  );
+  for (const block of BLOCKS) {
+    const blockProp = propNamed(root, block);
+    if (!blockProp || !ts.isObjectLiteralExpression(blockProp.initializer)) continue;
+    const dep = propNamed(blockProp.initializer, pkg);
+    if (!dep || !ts.isStringLiteral(dep.initializer)) continue;
+    const node = dep.initializer;
+    return { block, range: node.text, start: node.getStart(sf) + 1, end: node.getEnd() - 1 };
+  }
+  return null;
+}
+function decideRange(file, found, toVersion) {
+  if (!import_semver.default.valid(toVersion)) {
+    return { refusedBecause: `${toVersion} is not an exact version` };
+  }
+  if (import_semver.default.validRange(found.range) && import_semver.default.satisfies(toVersion, found.range)) {
+    return { satisfied: true };
+  }
+  const simple = SIMPLE_RANGE.exec(found.range);
+  if (!simple) {
+    return {
+      refusedBecause: `"${found.range}" is not a plain ^, ~ or exact range, so what it should become is a judgement`
+    };
+  }
+  const prefix = simple[1] ?? "";
+  return {
+    edit: {
+      file,
+      start: found.start,
+      end: found.end,
+      text: `${prefix}${toVersion}`,
+      was: found.range
+    }
+  };
+}
+function manifestFindings(root, targets, opts = {}) {
+  const files = opts.files ?? ["package.json"];
+  const read = opts.read ?? ((file) => {
+    try {
+      return readFileSync(join(root, file), "utf8");
+    } catch {
+      return null;
+    }
+  });
+  const texts = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const text = read(file);
+    if (text !== null) texts.set(file, text);
+  }
+  const findings = [];
+  const refused = [];
+  for (const target of targets) {
+    const edits = [];
+    const bumped = [];
+    for (const [file, text] of texts) {
+      const found = declaredRange(text, target.package);
+      if (!found) continue;
+      const decision = decideRange(file, found, target.toVersion);
+      if (decision.edit) {
+        edits.push(decision.edit);
+        bumped.push(file);
+      } else if (decision.refusedBecause) {
+        refused.push({ package: target.package, file, reason: decision.refusedBecause });
+      }
+    }
+    if (edits.length === 0) continue;
+    findings.push({
+      domain: "package",
+      code: `outdated-range:${target.package}`,
+      // Blocking: with the source rewritten and the range still pinning the old
+      // major, the next install puts the old version back under new code.
+      severity: "blocking",
+      detail: `${target.package} is declared at a range that excludes ${target.toVersion} in ${bumped.length} manifest(s): ${bumped.join(", ")}`,
+      file: bumped[0],
+      evidence: `upgrading ${target.package} ${target.fromVersion} \u2192 ${target.toVersion}`,
+      fix: {
+        summary: `bump ${target.package} to ${target.toVersion} in ${bumped.length} manifest(s)`,
+        edits,
+        // Installing is the user's call; the type check is what proves the tree agrees.
+        verify: ["typecheck"]
+      }
+    });
+  }
+  return { findings, refused };
+}
+
+export {
+  declaredRange,
+  decideRange,
+  manifestFindings
+};

package/dist/{chunk-LYMPYETA.js → chunk-6353IJJ5.js}

@@ -1,7 +1,7 @@
 import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
 import {
   EMBEDDING_DIM
-} from "./chunk-GPTKSNR6.js";
+} from "./chunk-L3V7AVM6.js";
 import {
   __export,
   init_esm_shims
@@ -14,6 +14,7 @@ __export(schema_exports, {
   apiKeys: () => apiKeys,
   apiSurfaces: () => apiSurfaces,
   askSpendDaily: () => askSpendDaily,
+  builderScans: () => builderScans,
   claims: () => claims,
   compatEdges: () => compatEdges,
   compatVerifyQueue: () => compatVerifyQueue,
@@ -23,8 +24,15 @@ __export(schema_exports, {
   mcpChangeEvents: () => mcpChangeEvents,
   mcpContracts: () => mcpContracts,
   mcpDeployments: () => mcpDeployments,
+  mcpEndpointChangeAcks: () => mcpEndpointChangeAcks,
+  mcpEndpointChanges: () => mcpEndpointChanges,
+  mcpEndpointObservations: () => mcpEndpointObservations,
+  mcpEndpointServers: () => mcpEndpointServers,
   mcpObservations: () => mcpObservations,
+  mcpPins: () => mcpPins,
   mcpPublicReports: () => mcpPublicReports,
+  mcpRegistryServers: () => mcpRegistryServers,
+  mcpRemoteEndpoints: () => mcpRemoteEndpoints,
   notificationChannels: () => notificationChannels,
   notificationDeliveries: () => notificationDeliveries,
   notificationItems: () => notificationItems,
@@ -36,6 +44,7 @@ __export(schema_exports, {
   policyDecisions: () => policyDecisions,
   recommendationOutcomes: () => recommendationOutcomes,
   repoAlerts: () => repoAlerts,
+  repoPolicyDefaults: () => repoPolicyDefaults,
   repos: () => repos,
   resolvedClosures: () => resolvedClosures,
   seedPackages: () => seedPackages,
@@ -161,7 +170,17 @@ var packages = pgTable(
      *  Null for crawler/_changes-created packages, or ones ingested before
      *  dashboard accounts existed. Stamped once via a standalone WHERE ... IS NULL
      *  update kept out of upsertPackage, so re-syncs can never clobber it. */
-    firstRequestedByOwnerId: text("first_requested_by_owner_id")
+    firstRequestedByOwnerId: text("first_requested_by_owner_id"),
+    /**
+     * Failed API-surface extractions for `surface_attempted_version`. The worker
+     * stops asking once a version has failed SURFACE_MAX_ATTEMPTS times; a new
+     * latest version starts the count again, since it may ship types the last
+     * one did not. Without this, a package with no extractable surface was
+     * re-attempted at random every hour, forever. Not in upsertPackage's row,
+     * so re-syncs never reset it.
+     */
+    surfaceAttempts: integer("surface_attempts").notNull().default(0),
+    surfaceAttemptedVersion: text("surface_attempted_version")
   },
   (table) => [
     uniqueIndex("packages_ecosystem_name_idx").on(table.ecosystem, table.name),
@@ -211,6 +230,13 @@ var discoveryQueue = pgTable(
      *  and never reaching the write that would take it off the queue. Same
      *  treatment `compat_verify_queue.attempts` already gives a failing set. */
     attempts: integer("attempts").notNull().default(0),
+    /**
+     * The account whose query asked for this package (`reactive` rows only),
+     * credited as first requester when it is ingested. Stored here because the
+     * on-demand ingest used to live only in the API process's memory, and a
+     * deploy mid-backlog dropped both the work and the attribution.
+     */
+    requestedByOwnerId: text("requested_by_owner_id"),
     discoveredAt: ts("discovered_at").notNull().defaultNow()
   },
   (table) => [index("discovery_queue_status_idx").on(table.status)]
@@ -392,6 +418,11 @@ var ownerUsageDaily = pgTable(
     index("owner_usage_daily_owner_date_idx").on(table.ownerId, table.date)
   ]
 );
+var repoPolicyDefaults = pgTable("repo_policy_defaults", {
+  ownerId: text("owner_id").primaryKey(),
+  policy: jsonb("policy").$type().notNull(),
+  updatedAt: ts("updated_at").notNull().defaultNow()
+});
 var repos = pgTable(
   "repos",
   {
@@ -458,6 +489,21 @@ var upgradeRuns = pgTable(
      * row per package+target and updates in place.
      */
     runUrl: text("run_url").notNull().default(""),
+    /**
+     * What started the run, from GITHUB_EVENT_NAME. See `RunTrigger`.
+     *
+     * NULLABLE, and deliberately NOT in the dedup index below. Every row
+     * written before this column existed has no trigger, and back-filling them
+     * with 'schedule' would invent evidence the log then presents as fact — the
+     * same rule `unverified` and `analysedOnly` follow. The dashboard renders
+     * null as "not recorded".
+     *
+     * Keeping it out of the dedup key is not a style choice: `runUrl` is in
+     * that key and is NOT NULL precisely because Postgres treats NULLs as
+     * distinct, so a nullable column there would let every re-post insert a
+     * duplicate instead of updating in place.
+     */
+    trigger: text("trigger").$type(),
     createdAt: ts("created_at").notNull().defaultNow()
   },
   (table) => [
@@ -480,7 +526,10 @@ var repoAlerts = pgTable(
     id: serial("id").primaryKey(),
     /** Clerk user id, copied from the repo — alerts are read owner-scoped. */
     ownerId: text("owner_id").notNull(),
-    repoId: integer("repo_id").notNull(),
+    /** Null for an account that runs `check-upgrade` on a repo lurq has no
+     *  GitHub App installation for: the alert is keyed by `repo_full_name` from
+     *  its upgrade runs instead, and there is no repo page to link to. */
+    repoId: integer("repo_id"),
     /** Denormalized so the feed renders without a join, as in `upgrade_runs`. */
     repoFullName: text("repo_full_name").notNull(),
     packageName: text("package_name").notNull(),
@@ -507,7 +556,11 @@ var repoAlerts = pgTable(
     // One alert per repo per release. A re-sync of the same version — and the
     // watcher re-syncs on every publish, including non-latest backports — must
     // not re-notify.
-    uniqueIndex("repo_alerts_dedup_idx").on(table.repoId, table.packageName, table.toVersion)
+    uniqueIndex("repo_alerts_dedup_idx").on(table.repoId, table.packageName, table.toVersion),
+    // The same rule for alerts with no connected repo. Postgres treats NULLs as
+    // distinct, so the index above can never dedupe those rows; this one covers
+    // exactly them. Partial, so adding it cannot fail on existing rows.
+    uniqueIndex("repo_alerts_cli_dedup_idx").on(table.ownerId, table.repoFullName, table.packageName, table.toVersion).where(sql`repo_id is null`)
   ]
 );
 var surfaceQueue = pgTable(
@@ -532,6 +585,12 @@ var surfaceQueue = pgTable(
     specKey: text("spec_key").notNull().unique(),
     /** Failed drains bump this; the worker drops a spec that keeps failing. */
     attempts: integer("attempts").notNull().default(0),
+    /**
+     * Not eligible before this. Set on every retry with an exponential delay, so
+     * a spec that just failed waits instead of being retried the next cycle and
+     * — oldest-first — blocking every newer spec behind it. Null = ready now.
+     */
+    nextAttemptAt: ts("next_attempt_at"),
     requestedAt: ts("requested_at").notNull().defaultNow()
   },
   (table) => [index("surface_queue_requested_idx").on(table.kind, table.requestedAt)]
@@ -801,7 +860,11 @@ var mcpDeployments = pgTable(
     lastChangedAt: ts("last_changed_at")
   },
   (table) => [
-    uniqueIndex("mcp_deployments_identity_idx").on(table.ownerId, table.serverKey, table.configFingerprint),
+    uniqueIndex("mcp_deployments_identity_idx").on(
+      table.ownerId,
+      table.serverKey,
+      table.configFingerprint
+    ),
     index("mcp_deployments_owner_idx").on(table.ownerId, table.lastScannedAt)
   ]
 );
@@ -854,7 +917,9 @@ var mcpPublicReports = pgTable(
     reportedAt: ts("reported_at").notNull().defaultNow()
   },
   (table) => [
-    primaryKey({ columns: [table.registry, table.packageName, table.version, table.contentHash, table.ownerId] }),
+    primaryKey({
+      columns: [table.registry, table.packageName, table.version, table.contentHash, table.ownerId]
+    }),
     index("mcp_public_reports_version_idx").on(table.registry, table.packageName, table.version)
   ]
 );
@@ -924,6 +989,196 @@ var notificationChannels = pgTable(
   },
   (table) => [index("notification_channels_owner_idx").on(table.ownerId)]
 );
+var builderScans = pgTable(
+  "builder_scans",
+  {
+    ownerId: text("owner_id").notNull(),
+    target: text("target").notNull(),
+    login: text("login").notNull(),
+    archetype: text("archetype").$type().notNull(),
+    avatarUrl: text("avatar_url").notNull(),
+    // What builderStanding.ts ranks on, copied out of `profile` at save, so
+    // ranking reads seven integers per builder instead of every whole report.
+    repos: integer("repos").notNull(),
+    active90: integer("active_90").notNull(),
+    stars: integer("stars").notNull(),
+    depsTracked: integer("deps_tracked").notNull(),
+    depsBehind: integer("deps_behind").notNull(),
+    depsMajor: integer("deps_major").notNull(),
+    advisories: integer("advisories").notNull(),
+    profile: jsonb("profile").$type().notNull(),
+    scannedAt: ts("scanned_at").notNull().defaultNow(),
+    createdAt: ts("created_at").notNull().defaultNow()
+  },
+  (table) => [
+    primaryKey({ columns: [table.ownerId, table.target] }),
+    index("builder_scans_owner_recent_idx").on(table.ownerId, table.scannedAt)
+  ]
+);
+var mcpRegistryServers = pgTable(
+  "mcp_registry_servers",
+  {
+    name: text("name").notNull(),
+    version: text("version").notNull(),
+    title: text("title"),
+    description: text("description"),
+    websiteUrl: text("website_url"),
+    repositoryUrl: text("repository_url"),
+    /** `active`, `deprecated`, `deleted`, … as the registry reports it. */
+    status: text("status").notNull(),
+    isLatest: boolean("is_latest").notNull(),
+    remotes: jsonb("remotes").$type().notNull(),
+    packages: jsonb("packages").$type().notNull(),
+    publishedAt: ts("published_at"),
+    registryUpdatedAt: ts("registry_updated_at"),
+    syncedAt: ts("synced_at").notNull().defaultNow()
+  },
+  (table) => [
+    primaryKey({ columns: [table.name, table.version] }),
+    index("mcp_registry_servers_latest_idx").on(table.name).where(sql`${table.isLatest}`),
+    index("mcp_registry_servers_updated_idx").on(table.registryUpdatedAt)
+  ]
+);
+var mcpRemoteEndpoints = pgTable(
+  "mcp_remote_endpoints",
+  {
+    id: serial("id").primaryKey(),
+    url: text("url").notNull().unique(),
+    host: text("host").notNull(),
+    /** Transport the registry declares: `streamable-http` or `sse`. */
+    transport: text("transport").notNull(),
+    /** URL carries `{placeholders}`: never probed, answered as setup-dependent. */
+    templated: boolean("templated").notNull().default(false),
+    /** A maintainer asked not to be probed. Never scheduled again. */
+    optedOut: boolean("opted_out").notNull().default(false),
+    lastStatus: text("last_status").$type(),
+    lastHttpStatus: integer("last_http_status"),
+    /** Content hash of the last contract read (a key into `mcp_contracts`). */
+    lastContentHash: text("last_content_hash"),
+    /** Hash of the auth profile, so an auth change is detectable without a diff. */
+    lastAuthHash: text("last_auth_hash"),
+    auth: jsonb("auth").$type(),
+    violations: jsonb("violations").$type().notNull().default([]),
+    protocolMode: text("protocol_mode").$type(),
+    protocolVersion: text("protocol_version"),
+    serverName: text("server_name"),
+    serverVersion: text("server_version"),
+    finalUrl: text("final_url"),
+    latencyMs: integer("latency_ms"),
+    lastError: text("last_error"),
+    consecutiveFailures: integer("consecutive_failures").notNull().default(0),
+    probeCount: integer("probe_count").notNull().default(0),
+    firstSeenAt: ts("first_seen_at").notNull().defaultNow(),
+    lastProbedAt: ts("last_probed_at"),
+    lastChangedAt: ts("last_changed_at"),
+    nextProbeAt: ts("next_probe_at").notNull().defaultNow(),
+    leaseUntil: ts("lease_until"),
+    /** No live registry entry names this URL any more. Kept for history. */
+    removedAt: ts("removed_at"),
+    /**
+     * The key an account's own `lurq mcp-scan` gives this server (`remote:<host><path>`,
+     * query dropped). Joining on it is how a change the public probe sees reaches
+     * every account already running the server, without anyone rescanning.
+     */
+    scanKey: text("scan_key")
+  },
+  (table) => [
+    index("mcp_remote_endpoints_scan_key_idx").on(table.scanKey),
+    index("mcp_remote_endpoints_due_idx").on(table.nextProbeAt).where(
+      sql`${table.optedOut} = false and ${table.templated} = false and ${table.removedAt} is null`
+    ),
+    index("mcp_remote_endpoints_host_idx").on(table.host)
+  ]
+);
+var mcpEndpointServers = pgTable(
+  "mcp_endpoint_servers",
+  {
+    endpointId: integer("endpoint_id").notNull().references(() => mcpRemoteEndpoints.id),
+    serverName: text("server_name").notNull(),
+    headers: jsonb("headers").$type().notNull().default([]),
+    lastSeenAt: ts("last_seen_at").notNull().defaultNow(),
+    /**
+     * The server's latest registry version stopped naming this URL, or the
+     * server was deleted. Marked, never deleted: rows in this schema are history.
+     */
+    removedAt: ts("removed_at")
+  },
+  (table) => [
+    primaryKey({ columns: [table.endpointId, table.serverName] }),
+    index("mcp_endpoint_servers_name_idx").on(table.serverName)
+  ]
+);
+var mcpEndpointObservations = pgTable(
+  "mcp_endpoint_observations",
+  {
+    id: serial("id").primaryKey(),
+    endpointId: integer("endpoint_id").notNull().references(() => mcpRemoteEndpoints.id),
+    status: text("status").$type().notNull(),
+    httpStatus: integer("http_status"),
+    contentHash: text("content_hash"),
+    authHash: text("auth_hash"),
+    violations: jsonb("violations").$type().notNull().default([]),
+    protocolVersion: text("protocol_version"),
+    error: text("error"),
+    probeCount: integer("probe_count").notNull().default(1),
+    firstSeenAt: ts("first_seen_at").notNull().defaultNow(),
+    lastSeenAt: ts("last_seen_at").notNull().defaultNow()
+  },
+  (table) => [
+    index("mcp_endpoint_observations_endpoint_idx").on(table.endpointId, table.firstSeenAt)
+  ]
+);
+var mcpEndpointChanges = pgTable(
+  "mcp_endpoint_changes",
+  {
+    id: serial("id").primaryKey(),
+    endpointId: integer("endpoint_id").notNull().references(() => mcpRemoteEndpoints.id),
+    kind: text("kind").$type().notNull(),
+    fromKey: text("from_key").notNull(),
+    toKey: text("to_key").notNull(),
+    severity: text("severity").$type().notNull(),
+    summary: text("summary").notNull(),
+    diff: jsonb("diff").$type(),
+    createdAt: ts("created_at").notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("mcp_endpoint_changes_pair_idx").on(
+      table.endpointId,
+      table.kind,
+      table.fromKey,
+      table.toKey
+    ),
+    index("mcp_endpoint_changes_endpoint_idx").on(table.endpointId, table.createdAt),
+    index("mcp_endpoint_changes_created_idx").on(table.createdAt)
+  ]
+);
+var mcpPins = pgTable(
+  "mcp_pins",
+  {
+    id: serial("id").primaryKey(),
+    ownerId: text("owner_id").notNull(),
+    endpointId: integer("endpoint_id").notNull().references(() => mcpRemoteEndpoints.id),
+    /** Null when the contract was not readable without credentials at pin time. */
+    contentHash: text("content_hash"),
+    authHash: text("auth_hash"),
+    note: text("note"),
+    pinnedAt: ts("pinned_at").notNull().defaultNow(),
+    removedAt: ts("removed_at")
+  },
+  (table) => [
+    uniqueIndex("mcp_pins_owner_endpoint_idx").on(table.ownerId, table.endpointId),
+    index("mcp_pins_endpoint_idx").on(table.endpointId)
+  ]
+);
+var mcpEndpointChangeAcks = pgTable(
+  "mcp_endpoint_change_acks",
+  {
+    ownerId: text("owner_id").notNull(),
+    changeId: integer("change_id").notNull().references(() => mcpEndpointChanges.id),
+    acknowledgedAt: ts("acknowledged_at").notNull().defaultNow()
+  },
+  (table) => [primaryKey({ columns: [table.ownerId, table.changeId] })]
+);
 
 export {
   packages,
@@ -940,6 +1195,7 @@ export {
   recommendationOutcomes,
   askSpendDaily,
   ownerUsageDaily,
+  repoPolicyDefaults,
   repos,
   upgradeRuns,
   repoAlerts,
@@ -961,5 +1217,13 @@ export {
   mcpPublicReports,
   notificationPreferences,
   notificationChannels,
+  builderScans,
+  mcpRegistryServers,
+  mcpRemoteEndpoints,
+  mcpEndpointServers,
+  mcpEndpointObservations,
+  mcpEndpointChanges,
+  mcpPins,
+  mcpEndpointChangeAcks,
   schema_exports
 };

package/dist/{chunk-M6NYEXCW.js → chunk-64DPQSXV.js}

@@ -2,7 +2,7 @@ import { createRequire as __lurqCreateRequire } from 'node:module'; const requir
 import {
   apiSurfaces,
   packages
-} from "./chunk-LYMPYETA.js";
+} from "./chunk-6353IJJ5.js";
 import {
   init_esm_shims
 } from "./chunk-I3M2KJXB.js";