lurqrun 0.1.8 → 0.1.9

package/dist/{auditHandler-VWCXSDVO.js → auditHandler-G7PHKMZR.js}

@@ -1,23 +1,23 @@
 import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
 import {
   handleAudit
-} from "./chunk-B2UUYRBX.js";
-import "./chunk-FDFPMBCA.js";
-import "./chunk-BJT2LHAR.js";
-import "./chunk-P6MIKSPY.js";
+} from "./chunk-N2NYPTRU.js";
+import "./chunk-FHRT32JH.js";
+import "./chunk-JJCQVOC6.js";
+import "./chunk-2XMD4H2I.js";
 import "./chunk-6EQ3ARXA.js";
 import "./chunk-SHCEBP3J.js";
 import "./chunk-LEGPB7DO.js";
 import "./chunk-Q5VPF4WI.js";
 import "./chunk-QSL6QN5X.js";
 import "./chunk-QUIMQ7YL.js";
-import "./chunk-ONDVTXUO.js";
-import "./chunk-4JHDSVIN.js";
+import "./chunk-ZJ5XHA77.js";
+import "./chunk-6353IJJ5.js";
 import "./chunk-KYKSZ3XZ.js";
-import "./chunk-6L67QMCP.js";
+import "./chunk-J3NUERU7.js";
 import "./chunk-3GHJR7XR.js";
 import "./chunk-MYGSLK44.js";
-import "./chunk-72Y2FDVS.js";
+import "./chunk-L3V7AVM6.js";
 import "./chunk-I3M2KJXB.js";
 export {
   handleAudit

package/dist/autopilotInit-JO2SH5K3.js

@@ -0,0 +1,266 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  WORKFLOW_PATH,
+  detectInstallCommand,
+  renderWorkflow
+} from "./chunk-SWMWVK2R.js";
+import {
+  bold,
+  dim,
+  green,
+  red,
+  yellow
+} from "./chunk-4KCPOMG6.js";
+import {
+  logger
+} from "./chunk-MYGSLK44.js";
+import {
+  resolveApiKey
+} from "./chunk-J6XQ7OPZ.js";
+import "./chunk-L3V7AVM6.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/cli/autopilotInit.ts
+init_esm_shims();
+import { spawnSync } from "child_process";
+var LOCKFILES = ["package-lock.json", "yarn.lock", "pnpm-lock.yaml", "bun.lockb", "bun.lock"];
+var SETUP_BRANCH = "lurq/autopilot-setup";
+var COMMIT_MESSAGE = "ci: lurq upgrade autopilot";
+function parseRepoFromRemote(url) {
+  const trimmed = url.trim().replace(/\.git$/, "");
+  if (!trimmed) return null;
+  const match = (
+    // git@github.com:owner/name  |  ssh://git@github.com/owner/name
+    trimmed.match(/^(?:ssh:\/\/)?git@[^:/]+[:/]([^/]+)\/([^/]+)$/) ?? // https://github.com/owner/name
+    trimmed.match(/^https?:\/\/[^/]+\/([^/]+)\/([^/]+)$/)
+  );
+  if (!match) return null;
+  const [, owner, name] = match;
+  return owner && name ? `${owner}/${name}` : null;
+}
+function needsAgentCredential(mode) {
+  return mode === "pr";
+}
+function missingWorkflowScope(authStatus) {
+  const line = authStatus.split("\n").find((l) => /token scopes:/i.test(l));
+  return line !== void 0 && !/['"]workflow['"]/.test(line);
+}
+function parseMode(raw) {
+  if (!raw) return "fix";
+  if (raw === "comment" || raw === "fix" || raw === "pr") return raw;
+  throw new Error(`Unknown mode "${raw}". Use comment, fix, or pr.`);
+}
+function run(cmd, args, input, cwd) {
+  return spawnSync(cmd, args, { cwd, input, encoding: "utf8" });
+}
+function have(cmd) {
+  return run(cmd, ["--version"]).status === 0;
+}
+function errorText(res) {
+  return (res.stderr || res.stdout || "").trim().split("\n")[0] ?? "unknown error";
+}
+function ghApi(path, method = "GET", body) {
+  const args = ["api", "-X", method, path];
+  if (body !== void 0) args.push("--input", "-");
+  const res = run("gh", args, body === void 0 ? void 0 : JSON.stringify(body));
+  if (res.status !== 0) throw new Error(errorText(res));
+  return res.stdout.trim() ? JSON.parse(res.stdout) : null;
+}
+function setSecret(repo, name, value) {
+  const res = run("gh", ["secret", "set", name, "--repo", repo], value);
+  return res.status === 0 ? null : `could not set ${name}: ${errorText(res)}`;
+}
+function mintClaudeToken() {
+  const res = spawnSync("claude", ["setup-token"], {
+    stdio: ["inherit", "pipe", "inherit"],
+    encoding: "utf8"
+  });
+  if (res.status !== 0) return null;
+  const lines = (res.stdout ?? "").split("\n").map((l) => l.trim()).filter(Boolean);
+  const token = lines[lines.length - 1];
+  if (!token || token.includes(" ") || token.length < 20) return null;
+  return token;
+}
+function putWorkflow(repo, branch, content, sha) {
+  ghApi(`repos/${repo}/contents/${WORKFLOW_PATH}`, "PUT", {
+    message: COMMIT_MESSAGE,
+    content: Buffer.from(content).toString("base64"),
+    branch,
+    ...sha ? { sha } : {}
+  });
+}
+function openSetupPr(repo, base, content) {
+  const head = ghApi(`repos/${repo}/git/ref/heads/${base}`).object.sha;
+  try {
+    ghApi(`repos/${repo}/git/refs`, "POST", { ref: `refs/heads/${SETUP_BRANCH}`, sha: head });
+  } catch {
+    ghApi(`repos/${repo}/git/refs/heads/${SETUP_BRANCH}`, "PATCH", { sha: head, force: true });
+  }
+  putWorkflow(repo, SETUP_BRANCH, content, existingSha(repo, SETUP_BRANCH));
+  const res = run("gh", [
+    "pr",
+    "create",
+    "--repo",
+    repo,
+    "--base",
+    base,
+    "--head",
+    SETUP_BRANCH,
+    "--title",
+    COMMIT_MESSAGE,
+    "--body",
+    "Adds the lurq upgrade autopilot. Merge to turn it on; delete the file to turn it off. https://lurq.run/docs/autopilot"
+  ]);
+  if (res.status !== 0) throw new Error(errorText(res));
+  return res.stdout.trim();
+}
+function existingSha(repo, branch) {
+  try {
+    return ghApi(`repos/${repo}/contents/${WORKFLOW_PATH}?ref=${branch}`).sha;
+  } catch {
+    return void 0;
+  }
+}
+function initRepo(repo, mode, secrets, opts) {
+  try {
+    for (const [name, value] of Object.entries(secrets)) {
+      const err = setSecret(repo, name, value);
+      if (err) return { repo, outcome: "failed", detail: err };
+    }
+    const base = ghApi(`repos/${repo}`).default_branch;
+    const sha = existingSha(repo, base);
+    if (sha && !opts.force) {
+      return {
+        repo,
+        outcome: "exists",
+        detail: "workflow already committed (--force replaces it)"
+      };
+    }
+    const root = ghApi(`repos/${repo}/contents/?ref=${base}`).map(
+      (e) => e.name
+    );
+    const content = renderWorkflow({
+      mode,
+      installCommand: detectInstallCommand(LOCKFILES.filter((f) => root.includes(f)))
+    });
+    if (!opts.pr) {
+      try {
+        putWorkflow(repo, base, content, sha);
+        const started = run("gh", [
+          "workflow",
+          "run",
+          WORKFLOW_PATH.split("/").pop(),
+          "--repo",
+          repo
+        ]);
+        return {
+          repo,
+          outcome: "committed",
+          detail: started.status === 0 ? "first run started" : "first run starts on schedule"
+        };
+      } catch {
+      }
+    }
+    return { repo, outcome: "pull-request", detail: openSetupPr(repo, base, content) };
+  } catch (err) {
+    return { repo, outcome: "failed", detail: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function runAutopilotInit(opts) {
+  const mode = parseMode(opts.mode);
+  let repos = (opts.repo ?? []).map((r) => r.trim()).filter(Boolean);
+  if (repos.length === 0) {
+    const remote = run("git", ["remote", "get-url", "origin"], void 0, opts.cwd);
+    const here = remote.status === 0 ? parseRepoFromRemote(remote.stdout) : null;
+    if (here) repos = [here];
+  }
+  if (repos.length === 0) {
+    logger.error("Could not work out which repository this is.");
+    logger.error("Pass one or more: lurq autopilot init --repo owner/a owner/b");
+    process.exitCode = 1;
+    return;
+  }
+  const apiKey = resolveApiKey(opts.apiKey);
+  if (!apiKey) {
+    logger.error(
+      "No lurq API key on this machine. Run `npx lurqrun setup` first, then this again."
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (!have("gh")) {
+    logger.error("The GitHub CLI (`gh`) is not installed. https://cli.github.com");
+    process.exitCode = 1;
+    return;
+  }
+  const auth = run("gh", ["auth", "status"]);
+  if (auth.status !== 0) {
+    logger.error("`gh` is not signed in. Run `gh auth login`, then this again.");
+    process.exitCode = 1;
+    return;
+  }
+  if (missingWorkflowScope(`${auth.stdout}
+${auth.stderr}`)) {
+    logger.error(
+      "GitHub only lets a token write workflow files with the `workflow` scope. Add it:"
+    );
+    logger.error("    gh auth refresh -s workflow");
+    process.exitCode = 1;
+    return;
+  }
+  const secrets = { LURQ_API_KEY: apiKey };
+  const notes = [];
+  if (needsAgentCredential(mode) && opts.credential !== false) {
+    const token = have("claude") ? (logger.info(dim("Minting a Claude token \u2014 sign in when prompted.")), mintClaudeToken()) : null;
+    if (token) {
+      secrets.CLAUDE_CODE_OAUTH_TOKEN = token;
+      notes.push(
+        `${yellow("The Claude token expires one year from today, with no warning.")} An ANTHROPIC_API_KEY does not:
+    gh secret set ANTHROPIC_API_KEY --repo <owner/name>`
+      );
+    } else {
+      notes.push(
+        "pr mode needs an Anthropic credential and none was set. Per repo:\n    gh secret set ANTHROPIC_API_KEY --repo <owner/name>"
+      );
+    }
+  }
+  if (!opts.json)
+    logger.info(
+      `${bold("mode")} ${mode} \xB7 ${repos.length} ${repos.length === 1 ? "repository" : "repositories"}
+`
+    );
+  const results = [];
+  for (const repo of repos) {
+    const result = initRepo(repo, mode, secrets, opts);
+    results.push(result);
+    if (!opts.json)
+      logger.info(`${resultMark(result)} ${repo}${result.detail ? dim(`  ${result.detail}`) : ""}`);
+  }
+  if (results.some((r) => r.outcome === "failed")) process.exitCode = 1;
+  if (opts.json) {
+    logger.info(JSON.stringify({ mode, results }, null, 2));
+    return;
+  }
+  if (results.some((r) => r.outcome === "pull-request")) {
+    notes.push("Merge the pull requests above to turn those repositories on.");
+  }
+  if (results.some((r) => r.outcome === "committed") && !opts.repo?.length) {
+    notes.push("Committed on GitHub, not locally: `git pull` to see it in this checkout.");
+  }
+  for (const note of notes) logger.info(`
+  \xB7 ${note}`);
+}
+function resultMark(r) {
+  if (r.outcome === "failed") return red("\u2717");
+  if (r.outcome === "pull-request") return yellow("\u2197");
+  if (r.outcome === "exists") return dim("\xB7");
+  return green("\u2713");
+}
+export {
+  missingWorkflowScope,
+  needsAgentCredential,
+  parseRepoFromRemote,
+  runAutopilotInit
+};

package/dist/bin/lurq.js

@@ -9,18 +9,18 @@ import {
 import "../chunk-WHX2ZFCG.js";
 import {
   withSetupOnMissingKey
-} from "../chunk-2O6Z37IT.js";
+} from "../chunk-PZZU3FQY.js";
 import {
   yellow
 } from "../chunk-4KCPOMG6.js";
 import {
   SUPPORTED_AGENTS
-} from "../chunk-DM37MTOO.js";
+} from "../chunk-ETY4FSOW.js";
 import "../chunk-LUAKDHLZ.js";
 import {
   logger
 } from "../chunk-MYGSLK44.js";
-import "../chunk-OTJFHESY.js";
+import "../chunk-SFY5MPJE.js";
 import {
   readUserConfig,
   resolveApiKey
@@ -32,7 +32,7 @@ import {
   SERVER_NAME,
   VERSION,
   package_default
-} from "../chunk-72Y2FDVS.js";
+} from "../chunk-L3V7AVM6.js";
 import {
   __commonJS,
   __require,
@@ -3081,7 +3081,7 @@ async function maintainHooks(argv2, now = Date.now()) {
     if (config.autoHooks === false || !resolveApiKey()) return;
     mkdirSync(join(stamp, ".."), { recursive: true });
     writeFileSync(stamp, "");
-    const skill = await import("../installSkill-5TIMYIJZ.js");
+    const skill = await import("../installSkill-A7KKPDMS.js");
     const invocation = skill.lurqInvocation();
     if (!invocation.onPath) return;
     const states = skill.agentSpecs().flatMap((spec) => {
@@ -3161,18 +3161,21 @@ coding agent on this machine. Get a key at ${KEYS_URL}
       program2.outputHelp();
       return;
     }
-    const { runSetup } = await import("../install-G2HHXYJ2.js");
+    const { runSetup } = await import("../install-55EPX34C.js");
     await runSetup({});
   });
   program2.command("setup").aliases(["install", "login"]).description("one-time setup: store your API key, wire up your assistants and skills").option("--api-key <key>", "hosted API key (skips the prompt)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--agent <agent>", AGENT_CHOICES).option("--yes", "non-interactive: use flags/env and detected agents without prompting").option("--no-open", "don't launch a browser (headless boxes, SSH, CI)").addOption(new Option("--wait-for-signin").hideHelp()).action(
     async (opts) => {
-      const { runSetup } = await import("../install-G2HHXYJ2.js");
+      const { runSetup } = await import("../install-55EPX34C.js");
       await runSetup({ ...opts, noOpen: opts.open === false });
     }
   );
   const autopilot = program2.command("autopilot").description("set up and inspect the upgrade autopilot for a repository");
-  autopilot.command("init").description("set the repository secret and write the upgrade workflow (never commits)").option("--repo <owner/name>", "defaults to the origin remote of this checkout").option("--mode <mode>", "comment, fix, or pr (default: fix \u2014 opens PRs, needs no model)").option("--api-key <key>", "lurq API key (defaults to the stored one, then $LURQ_API_KEY)").option("--no-credential", "skip the Anthropic credential step in pr mode").option("--force", "overwrite an existing workflow file").option("--json", "machine-readable summary").action(async (opts) => {
-    const { runAutopilotInit } = await import("../autopilotInit-Q62MX5M6.js");
+  autopilot.command("init").description("turn the autopilot on for one or many repositories: secret, workflow, first run").option("--repo <owner/name...>", "one or more repositories (default: this checkout's origin)").option("--mode <mode>", "comment, fix, or pr (default: fix \u2014 opens PRs, needs no model)").option("--api-key <key>", "lurq API key (defaults to the stored one, then $LURQ_API_KEY)").option("--no-credential", "skip the Anthropic credential step in pr mode").option("--force", "replace a workflow that is already committed").option(
+    "--pr",
+    "open a pull request in each repository instead of committing to the default branch"
+  ).option("--json", "machine-readable summary").action(async (opts) => {
+    const { runAutopilotInit } = await import("../autopilotInit-JO2SH5K3.js");
     await runAutopilotInit(opts);
   });
   program2.command("logout").description("remove the stored API key from this machine").action(async () => {
@@ -3183,40 +3186,40 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     );
   });
   program2.command("uninstall").description("undo setup: remove lurq's MCP entries, agent instructions and the stored key").option("--agent <agent>", `only this agent: ${AGENT_CHOICES}`).option("--yes", "remove without asking").action(async (opts) => {
-    const { runUninstall } = await import("../uninstall-I2IJP5JZ.js");
+    const { runUninstall } = await import("../uninstall-4E5YUDQO.js");
     await runUninstall(opts);
   });
   const policy = program2.command("policy").description("keep your selection policy in a file: pull it, review it, push it");
   policy.command("pull").argument("[file]", "write the policy here (default: stdout)").description("download the policy your agents are held to").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").action(async (file, opts) => {
-    const { runPolicyPull } = await import("../policy-JAGNMQJI.js");
+    const { runPolicyPull } = await import("../policy-EQT43P7S.js");
     await runPolicyPull(file, opts);
   });
   policy.command("push").argument("<file>", "policy JSON, as written by `lurq policy pull`").description("replace the policy with this file (needs a policy:write key)").option("--check", "validate the file only; send nothing (for PR checks)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").action(async (file, opts) => {
-    const { runPolicyPush } = await import("../policy-JAGNMQJI.js");
+    const { runPolicyPush } = await import("../policy-EQT43P7S.js");
     await runPolicyPush(file, opts);
   });
   policy.command("history").description("who changed the policy, from where, and what changed").option("--json", "output the changes as JSON").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").action(async (opts) => {
-    const { runPolicyHistory } = await import("../policy-JAGNMQJI.js");
+    const { runPolicyHistory } = await import("../policy-EQT43P7S.js");
     await runPolicyHistory(opts);
   });
   policy.command("log").description("packages the policy refused, or warned about, grouped by rule").option("--days <n>", "look back this many days, 1 to 365 (default 30)").option("--json", "output the log as JSON").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").action(async (opts) => {
-    const { runPolicyLog } = await import("../policy-JAGNMQJI.js");
+    const { runPolicyLog } = await import("../policy-EQT43P7S.js");
     await runPolicyLog(opts);
   });
   program2.command("can").argument("[query...]", "what you are trying to do, in plain words").description("find the lurq capability for what you are trying to do").option("--json", "output matches as JSON").action(async (query, opts) => {
-    const { runCan } = await import("../commands-UOOTMBKA.js");
+    const { runCan } = await import("../commands-6BBLN5N5.js");
     runCan(query.join(" "), opts);
   });
   program2.command("evaluate").argument("<package>", "npm package name").description("full evidence read for one package (scores, signals, usage guide)").option("--json", "output JSON instead of a table").action(async (pkg, opts) => {
-    const { runEvaluate } = await import("../commands-UOOTMBKA.js");
+    const { runEvaluate } = await import("../commands-6BBLN5N5.js");
     await runEvaluate(pkg, opts);
   });
   program2.command("compare").argument("<packages...>", "2\u20135 npm package names").description("side-by-side comparison of packages, ranked by health").option("--json", "output JSON instead of a table").action(async (pkgs, opts) => {
-    const { runCompare } = await import("../commands-UOOTMBKA.js");
+    const { runCompare } = await import("../commands-6BBLN5N5.js");
     await runCompare(pkgs, opts);
   });
   program2.command("verify").argument("<package>", "npm package name").description("safety check: is this package real, healthy, and not risky?").option("--json", "output JSON instead of a table").action(async (pkg, opts) => {
-    const { runVerify } = await import("../commands-UOOTMBKA.js");
+    const { runVerify } = await import("../commands-6BBLN5N5.js");
     await runVerify(pkg, opts);
   });
   program2.command("usage").argument("<package>", "npm package name").description(
@@ -3227,7 +3230,7 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     (v) => Math.max(0, parseInt(v, 10) || 0)
   ).option("--json", "output JSON").action(
     async (pkg, opts) => {
-      const { runUsage } = await import("../commands-UOOTMBKA.js");
+      const { runUsage } = await import("../commands-6BBLN5N5.js");
       await runUsage(pkg, {
         version: opts.target ?? opts.version,
         known: opts.known,
@@ -3238,18 +3241,18 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     }
   );
   program2.command("versions").argument("<package>", "npm package name").description("show the stored version timeline for a package").option("--json", "output JSON instead of a table").option("-n, --limit <n>", "how many versions to show (default 30)").action(async (pkg, opts) => {
-    const { runVersions } = await import("../commands-UOOTMBKA.js");
+    const { runVersions } = await import("../commands-6BBLN5N5.js");
     await runVersions(pkg, opts);
   });
   program2.command("compat").argument("<packages...>", "npm package names to check together").description(
     "check whether a set of packages forms a coherent stack (peer/engine + recorded evidence)"
   ).option("--pin <name=version...>", "evaluate an exact version, e.g. --pin next=15").option("--json", "output JSON").action(async (pkgs, opts) => {
-    const { runCompat } = await import("../commands-UOOTMBKA.js");
+    const { runCompat } = await import("../commands-6BBLN5N5.js");
     await runCompat(pkgs, opts);
   });
   program2.command("upgrade-plan").argument("[dir]", "project directory (default: current)", ".").description("what is behind in this project, and what each upgrade removes from its API").option("--json", "output the plan as JSON (feed to `check-upgrade --plan`)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").option("--repo <owner/name>", "apply this repo's policy (defaults to $GITHUB_REPOSITORY)").action(
     async (dir, opts) => {
-      const { buildUpgradePlan, formatUpgradePlan } = await import("../upgradePlan-ZS5IOVMZ.js");
+      const { buildUpgradePlan, formatUpgradePlan } = await import("../upgradePlan-F3OUNL3E.js");
       const plan = await buildUpgradePlan(dir, {
         url: opts.url,
         apiKey: opts.apiKey,
@@ -3260,7 +3263,7 @@ coding agent on this machine. Get a key at ${KEYS_URL}
   );
   program2.command("check-upgrade").argument("[dir]", "project directory to scan (default: current)", ".").description("do these upgrades remove symbols your code actually references?").option("--plan <file>", "targets from `upgrade-plan --json`").option("--upgrade <spec...>", "pkg@from..to (repeatable), e.g. commander@11.1.0..12.1.0").option("--json", "output the report as JSON").option("--exit-code", "exit 1 when the report is not safe (for CI)").option("--report", "send the result to your lurq dashboard (CI; needs an API key)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").option("--no-types", "skip the type check (runtime surface only; faster)").action(
     async (dir, opts) => {
-      const { runCheckUpgrade } = await import("../checkUpgrade-5YW77OBL.js");
+      const { runCheckUpgrade } = await import("../checkUpgrade-Q4CV7GXG.js");
       await runCheckUpgrade(dir, opts);
     }
   );
@@ -3274,19 +3277,19 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     "write SARIF for GitHub code scanning (upload with codeql-action/upload-sarif)"
   ).option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").option("--repo <owner/name>", "apply this repo's policy (defaults to $GITHUB_REPOSITORY)").action(
     async (dir, opts) => {
-      const { runFix } = await import("../fix-3EDWNKW3.js");
+      const { runFix } = await import("../fix-Z7ZY55HB.js");
       await runFix(dir, opts);
     }
   );
   program2.command("check-release").argument("[dir]", "package directory (default: current)", ".").description("is the version you are about to publish honest about what changed?").option("--against <version>", "compare with this published version (default: latest)").option("--json", "output the check as JSON").option("--exit-code", "exit 1 when the bump is understated (for CI / prepublish)").action(async (dir, opts) => {
-    const { checkRelease, formatReleaseCheck } = await import("../release-7IU2R4YG.js");
+    const { checkRelease, formatReleaseCheck } = await import("../release-EUOM5I3R.js");
     const check = await checkRelease(dir, { against: opts.against });
     console.log(opts.json ? JSON.stringify(check, null, 2) : formatReleaseCheck(check));
     if (opts.exitCode && check.verdict !== "ok") process.exitCode = 1;
   });
   program2.command("check-env").argument("[dir]", "project directory to scan (default: current)", ".").description("which environment variables does this project read that nothing declares?").option("--json", "output the result as JSON").option("--exit-code", "exit 1 when anything is undeclared (for CI)").option("--sarif <file>", "write SARIF for GitHub code scanning").option("--limit <n>", "source files to read before stopping (default 5000)").action(
     async (dir, opts) => {
-      const { runEnvCheck } = await import("../envCheck-KUPTORFQ.js");
+      const { runEnvCheck } = await import("../envCheck-IL22OTSC.js");
       await runEnvCheck(dir, opts);
     }
   );
@@ -3306,7 +3309,7 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     "probe your MCP servers now instead of waiting for the worker (self-hosted index only)"
   ).option("--probe-budget <seconds>", "wall-clock ceiling for probing (default 90)").option("--json", "output JSON instead of a table").action(
     async (dir, opts) => {
-      const { runAudit } = await import("../commands-UOOTMBKA.js");
+      const { runAudit } = await import("../commands-6BBLN5N5.js");
       await runAudit(dir, opts);
     }
   );
@@ -3326,7 +3329,7 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     "--sarif <file>",
     "write SARIF for GitHub code scanning (upload with codeql-action/upload-sarif)"
   ).action(async (dir, opts) => {
-    const { runMcpScan } = await import("../mcpScan-ULP626TQ.js");
+    const { runMcpScan } = await import("../mcpScan-CKBQNK5H.js");
     await runMcpScan(dir, opts);
   });
   program2.command("mcp-ci").argument("[dir]", "repository directory (defaults to the current one)").description(
@@ -3339,23 +3342,23 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     "--sarif",
     "also file findings as GitHub code scanning alerts (needs code scanning enabled; adds security-events: write)"
   ).option("--no-issue", "do not maintain the pinned lurq dashboard issue").action(async (dir, opts) => {
-    const { runMcpCi } = await import("../mcpScan-ULP626TQ.js");
+    const { runMcpCi } = await import("../mcpScan-CKBQNK5H.js");
     await runMcpCi(dir, opts);
   });
   program2.command("mcp-stack").argument("[dir]", "project directory (defaults to the current one)").description(
     "do your configured MCP servers coexist? checks tool-name collisions and shadowing, live"
   ).option("--project-only", "read only config files in the project").option("--trust-project", "launch servers committed to the repository without asking").option("--timeout <seconds>", "per-server connect deadline (default 60)").option("--json", "output JSON instead of a table").action(
     async (dir, opts) => {
-      const { runMcpStack } = await import("../commands-UOOTMBKA.js");
+      const { runMcpStack } = await import("../commands-6BBLN5N5.js");
       await runMcpStack(dir, opts);
     }
   );
   program2.command("mcp-surface").argument("<server>", "npm package name of the MCP server").description("an MCP server's real tool contract: params and behaviour annotations").option("--version <v>", "exact version (defaults to the latest probed)").option("--json", "output JSON instead of a table").action(async (server, opts) => {
-    const { runMcpSurface } = await import("../commands-UOOTMBKA.js");
+    const { runMcpSurface } = await import("../commands-6BBLN5N5.js");
     await runMcpSurface(server, opts);
   });
   program2.command("mcp-drift").argument("<server>", "npm package name of the MCP server").description("what an MCP server changed between two versions (incl. silent + privilege drift)").requiredOption("--from <v>", "version you are on").requiredOption("--to <v>", "version you are moving to").option("--json", "output JSON instead of a table").action(async (server, opts) => {
-    const { runMcpDrift } = await import("../commands-UOOTMBKA.js");
+    const { runMcpDrift } = await import("../commands-6BBLN5N5.js");
     await runMcpDrift(server, opts);
   });
   program2.command("connect-check").argument("<server>", "endpoint URL, official registry name, or npm package name").description(
@@ -3364,25 +3367,25 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     "--client <id>",
     "one client: claude-code, claude-ai, chatgpt, cursor, vscode, codex, gemini-cli, \u2026"
   ).option("--json", "output JSON instead of a table").action(async (server, opts) => {
-    const { runConnectCheck } = await import("../commands-UOOTMBKA.js");
+    const { runConnectCheck } = await import("../commands-6BBLN5N5.js");
     await runConnectCheck(server, opts);
   });
   program2.command("mcp-pin").argument("<server>", "endpoint URL or official registry name of a remote MCP server").description(
     "approve a remote MCP server as it is now; you are alerted when its tools or sign-in path change"
   ).option("--note <text>", "why it was approved, shown with the pin").option("--json", "output JSON").action(async (server, opts) => {
-    const { runMcpPin } = await import("../commands-UOOTMBKA.js");
+    const { runMcpPin } = await import("../commands-6BBLN5N5.js");
     await runMcpPin(server, opts);
   });
   program2.command("mcp-unpin").argument("<server>", "endpoint URL or official registry name").description("stop watching a pinned remote MCP server").action(async (server) => {
-    const { runMcpUnpin } = await import("../commands-UOOTMBKA.js");
+    const { runMcpUnpin } = await import("../commands-6BBLN5N5.js");
     await runMcpUnpin(server);
   });
   program2.command("mcp-pins").description("your pinned remote MCP servers, and which changed since you pinned them").option("--json", "output JSON").action(async (opts) => {
-    const { runMcpPins } = await import("../commands-UOOTMBKA.js");
+    const { runMcpPins } = await import("../commands-6BBLN5N5.js");
     await runMcpPins(opts);
   });
   program2.command("weights").description("show and explain the scoring weight model (health, quality, composite \u03BB)").option("--json", "output the weight model as JSON").action(async (opts) => {
-    const { runWeights } = await import("../commands-UOOTMBKA.js");
+    const { runWeights } = await import("../commands-6BBLN5N5.js");
     runWeights(opts);
   });
   program2.command("edit-weights").description("override, reset, or explain the scoring weights (layered over defaults)").option(
@@ -3392,12 +3395,12 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     []
   ).option("--reset", "remove all overrides and restore defaults").option("--explain <component>", "explain a component (e.g. adoption, quality, lambda)").option("--project", "write to project-local .lurq/weights.json instead of the user config").action(
     async (opts) => {
-      const { runEditWeights } = await import("../commands-UOOTMBKA.js");
+      const { runEditWeights } = await import("../commands-6BBLN5N5.js");
       await runEditWeights(opts);
     }
   );
   program2.command("install-skill").description("register lurq as an MCP server in supported AI assistants (scriptable)").option("--agent <agent>", AGENT_CHOICES, "claude-code").option("--api-key <key>", "hosted API key (remote install; default mode)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--local", "self-host: write a local stdio entry using your own DATABASE_URL").action(async (opts) => {
-    const { runInstallSkill } = await import("../installSkill-5TIMYIJZ.js");
+    const { runInstallSkill } = await import("../installSkill-A7KKPDMS.js");
     await runInstallSkill(opts);
   });
   program2.command("hook").argument(
@@ -3410,15 +3413,15 @@ coding agent on this machine. Get a key at ${KEYS_URL}
   ).description(
     "run as an agent hook: verify installs and suggest lurq where it helps (set up by `lurq setup`)"
   ).action(async (event, opts) => {
-    const { runHook } = await import("../hook-NA66XJLC.js");
+    const { runHook } = await import("../hook-TWFLIDK3.js");
     await runHook(event, opts.agent);
   });
   program2.command("serve").description("start the MCP server over stdio (for agent integration)").action(async () => {
-    const { startMcpServer } = await import("../server-OLTY3NYT.js");
+    const { startMcpServer } = await import("../server-LROMHS62.js");
     await startMcpServer();
   });
   program2.command("serve-http").description("start the hosted MCP server over HTTP with API-key auth").option("--port <n>", "port to listen on (default: $PORT or 8080)", (v) => parseInt(v, 10)).action(async (opts) => {
-    const { startHttpServer } = await import("../http-25GJ6SKK.js");
+    const { startHttpServer } = await import("../http-7VF2RE2D.js");
     await startHttpServer({ port: opts.port });
   });
   return program2;

package/dist/{browserAuth-J7APSD4P.js → browserAuth-PVYODBNR.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-TNTXWSYA.js";
 import {
   API_KEY_PREFIX
-} from "./chunk-72Y2FDVS.js";
+} from "./chunk-L3V7AVM6.js";
 import {
   init_esm_shims
 } from "./chunk-I3M2KJXB.js";

package/dist/{cache-AEAKCV4I.js → cache-ND4VOUVY.js}

@@ -2,9 +2,9 @@ import { createRequire as __lurqCreateRequire } from 'node:module'; const requir
 import {
   cached,
   invalidateCache
-} from "./chunk-6L67QMCP.js";
+} from "./chunk-J3NUERU7.js";
 import "./chunk-MYGSLK44.js";
-import "./chunk-72Y2FDVS.js";
+import "./chunk-L3V7AVM6.js";
 import "./chunk-I3M2KJXB.js";
 export {
   cached,

package/dist/{check-2JTQDQA6.js → check-A3FJE62G.js}

@@ -5,10 +5,10 @@ import {
   getEndpointByUrl,
   getEndpointsForServer,
   listEndpointChanges
-} from "./chunk-ZJMLQ37G.js";
+} from "./chunk-AHRDDKNO.js";
 import {
   getContract
-} from "./chunk-P6MIKSPY.js";
+} from "./chunk-2XMD4H2I.js";
 import "./chunk-XGOV6KV4.js";
 import "./chunk-63MUJNZL.js";
 import "./chunk-QKGYDMWB.js";
@@ -18,9 +18,9 @@ import {
 import {
   fetchServerManifest
 } from "./chunk-LEGPB7DO.js";
-import "./chunk-4JHDSVIN.js";
+import "./chunk-6353IJJ5.js";
 import "./chunk-MYGSLK44.js";
-import "./chunk-72Y2FDVS.js";
+import "./chunk-L3V7AVM6.js";
 import {
   init_esm_shims
 } from "./chunk-I3M2KJXB.js";
@@ -2481,7 +2481,7 @@ async function handleConnectCheck(db, input, deps = {}) {
       };
       if (row.lastStatus) source = "probe";
     } else if (deps.liveProbe) {
-      const { probeEndpoint } = await import("./probe-3IK646WN.js");
+      const { probeEndpoint } = await import("./probe-ZEZFNIQZ.js");
       const r2 = await probeEndpoint(query, {
         fetch: deps.liveProbe.fetch,
         budgetMs: deps.liveProbe.budgetMs ?? LIVE_BUDGET_MS