lurqrun 0.0.1 → 0.0.2

package/dist/index.js

@@ -70,14 +70,16 @@ var init_types = __esm({
 });
 
 // src/core/constants.ts
-var SERVER_NAME, PACKAGE_NAME, VERSION, EMBEDDING_DIM, STALENESS_DAYS, HOUR, DAY, CACHE_TTL;
+var SERVER_NAME, PACKAGE_NAME, VERSION, DEFAULT_ENDPOINT, API_KEY_PREFIX, EMBEDDING_DIM, STALENESS_DAYS, HOUR, DAY, CACHE_TTL;
 var init_constants = __esm({
   "src/core/constants.ts"() {
     "use strict";
     init_esm_shims();
     SERVER_NAME = "lurq";
     PACKAGE_NAME = "lurqrun";
-    VERSION = "0.0.1";
+    VERSION = "0.0.2";
+    DEFAULT_ENDPOINT = "https://api.lurq.run/mcp";
+    API_KEY_PREFIX = "lurq_live_";
     EMBEDDING_DIM = 1536;
     STALENESS_DAYS = 7;
     HOUR = 60 * 60 * 1e3;
@@ -93,6 +95,14 @@ var init_constants = __esm({
 });
 
 // src/core/config.ts
+var config_exports = {};
+__export(config_exports, {
+  ConfigError: () => ConfigError,
+  getConfig: () => getConfig,
+  loadEnv: () => loadEnv,
+  requireConfig: () => requireConfig,
+  resetConfigCache: () => resetConfigCache
+});
 import { config as dotenvConfig } from "dotenv";
 import { z } from "zod";
 function loadEnv() {
@@ -112,6 +122,9 @@ ${issues}`);
   cached = parsed.data;
   return cached;
 }
+function resetConfigCache() {
+  cached = void 0;
+}
 function requireConfig(keys) {
   const config = getConfig();
   const missing = keys.filter((k) => config[k] === void 0 || config[k] === "");
@@ -139,7 +152,18 @@ var init_config = __esm({
       SUMMARY_API_KEY: z.string().min(1).optional(),
       SUMMARY_MODEL: z.string().min(1).default("gpt-4o-mini"),
       LURQ_SYNC_CONCURRENCY: z.coerce.number().int().positive().max(50).default(5),
-      LOG_LEVEL: z.enum(["error", "warn", "info", "debug"]).default("info")
+      LOG_LEVEL: z.enum(["error", "warn", "info", "debug"]).default("info"),
+      // Hosted HTTP service (`serve-http`). Server-side only.
+      PORT: z.coerce.number().int().positive().default(8080),
+      /** Per-API-key rate limit: max requests per window. */
+      LURQ_RATE_LIMIT_MAX: z.coerce.number().int().positive().default(120),
+      /** Coarser per-IP rate limit (blunts unauthenticated floods before auth). */
+      LURQ_IP_RATE_LIMIT_MAX: z.coerce.number().int().positive().default(240),
+      /** Rate-limit window, milliseconds (applies to both limiters). */
+      LURQ_RATE_LIMIT_WINDOW_MS: z.coerce.number().int().positive().default(6e4),
+      // Client-side (install wizard / CLI talking to a remote endpoint).
+      LURQ_ENDPOINT: z.string().url().optional(),
+      LURQ_API_KEY: z.string().min(1).optional()
     });
     ConfigError = class extends Error {
       constructor(message) {
@@ -188,13 +212,17 @@ var init_logger = __esm({
 // src/db/schema.ts
 var schema_exports = {};
 __export(schema_exports, {
+  apiKeys: () => apiKeys,
+  discoveryQueue: () => discoveryQueue,
   packages: () => packages,
   seedPackages: () => seedPackages,
   syncRuns: () => syncRuns
 });
+import { sql } from "drizzle-orm";
 import {
   bigint,
   boolean,
+  customType,
   index,
   integer,
   jsonb,
@@ -205,12 +233,17 @@ import {
   timestamp,
   vector
 } from "drizzle-orm/pg-core";
-var ts, packages, syncRuns, seedPackages;
+var tsvector, ts, packages, syncRuns, seedPackages, discoveryQueue, apiKeys;
 var init_schema = __esm({
   "src/db/schema.ts"() {
     "use strict";
     init_esm_shims();
     init_constants();
+    tsvector = customType({
+      dataType() {
+        return "tsvector";
+      }
+    });
     ts = (name) => timestamp(name, { withTimezone: true, mode: "date" });
     packages = pgTable(
       "packages",
@@ -220,6 +253,8 @@ var init_schema = __esm({
         ecosystem: text("ecosystem").notNull().default("npm"),
         // Classification + descriptive text
         category: text("category").$type(),
+        /** Whether `category` was hand-curated or inferred at ingest (§2A). */
+        categorySource: text("category_source").$type(),
         description: text("description"),
         summary: text("summary"),
         repoUrl: text("repo_url"),
@@ -245,10 +280,19 @@ var init_schema = __esm({
         advisories: jsonb("advisories").$type(),
         // Computed outputs
         healthScore: integer("health_score"),
+        /** Intrinsic-quality axis (§1), adoption-independent. Blends with health at
+         *  ranking time (composite); never folded into health_score itself. */
+        qualityScore: integer("quality_score"),
         confidence: text("confidence").$type(),
         scoreBreakdown: jsonb("score_breakdown").$type(),
         usageGuide: jsonb("usage_guide").$type(),
         embedding: vector("embedding", { dimensions: EMBEDDING_DIM }),
+        // Lexical search vector (§3): name weighted highest (A), then category (B),
+        // then summary/description (C). Generated + STORED so it stays in sync with
+        // the row automatically; indexed with GIN for fast `@@` matching.
+        searchVector: tsvector("search_vector").generatedAlwaysAs(
+          sql`setweight(to_tsvector('english', coalesce(name, '')), 'A') || setweight(to_tsvector('english', coalesce(category, '')), 'B') || setweight(to_tsvector('english', coalesce(summary, description, '')), 'C')`
+        ),
         // Freshness + bookkeeping
         dataAsOf: timestamp("data_as_of", { withTimezone: true, mode: "date" }),
         createdAt: ts("created_at").notNull().defaultNow(),
@@ -258,7 +302,9 @@ var init_schema = __esm({
         index("packages_category_idx").on(table2.category),
         index("packages_health_score_idx").on(table2.healthScore),
         // pgvector HNSW index for cosine similarity search (§11).
-        index("packages_embedding_idx").using("hnsw", table2.embedding.op("vector_cosine_ops"))
+        index("packages_embedding_idx").using("hnsw", table2.embedding.op("vector_cosine_ops")),
+        // GIN index for lexical full-text search (§3).
+        index("packages_search_vector_idx").using("gin", table2.searchVector)
       ]
     );
     syncRuns = pgTable("sync_runs", {
@@ -275,6 +321,38 @@ var init_schema = __esm({
       category: text("category").$type(),
       addedAt: ts("added_at").notNull().defaultNow()
     });
+    discoveryQueue = pgTable(
+      "discovery_queue",
+      {
+        id: serial("id").primaryKey(),
+        name: text("name").notNull().unique(),
+        discoveredVia: text("discovered_via").$type().notNull(),
+        /** Lightweight quality-only pre-score (§2B). Null until the gate runs. */
+        preScore: integer("pre_score"),
+        status: text("status").$type().notNull().default("pending"),
+        discoveredAt: ts("discovered_at").notNull().defaultNow()
+      },
+      (table2) => [index("discovery_queue_status_idx").on(table2.status)]
+    );
+    apiKeys = pgTable(
+      "api_keys",
+      {
+        id: serial("id").primaryKey(),
+        /** sha256 hex of the full key — the only form persisted. */
+        keyHash: text("key_hash").notNull().unique(),
+        /** Identifiable display prefix, e.g. `lurq_live_ab12cd` (safe to show/log). */
+        prefix: text("prefix").notNull(),
+        /** Free-text label (owner / org / purpose). */
+        label: text("label"),
+        /** Reserved for self-serve issuance: maps to a Clerk user id. */
+        ownerId: text("owner_id"),
+        tier: text("tier").notNull().default("free"),
+        createdAt: ts("created_at").notNull().defaultNow(),
+        lastUsedAt: ts("last_used_at"),
+        revokedAt: ts("revoked_at")
+      },
+      (table2) => [index("api_keys_owner_idx").on(table2.ownerId)]
+    );
   }
 });
 
@@ -283,10 +361,10 @@ import { drizzle } from "drizzle-orm/postgres-js";
 import postgres from "postgres";
 function createDb(opts = {}) {
   const { DATABASE_URL } = requireConfig(["DATABASE_URL"]);
-  const sql6 = postgres(DATABASE_URL, { max: opts.max ?? 10, onnotice: () => {
+  const sql8 = postgres(DATABASE_URL, { max: opts.max ?? 10, onnotice: () => {
   } });
-  const db = drizzle(sql6, { schema: schema_exports });
-  return { db, sql: sql6, close: () => sql6.end() };
+  const db = drizzle(sql8, { schema: schema_exports });
+  return { db, sql: sql8, close: () => sql8.end() };
 }
 var init_client = __esm({
   "src/db/client.ts"() {
@@ -530,8 +608,9 @@ function parseNpmRegistry(json2) {
   const { repoUrl, repo } = normalizeRepoUrl(repository, homepage);
   const deprecated = Boolean(latestManifest?.deprecated ?? json2?.deprecated);
   const maintainers = Array.isArray(json2?.maintainers) ? json2.maintainers.length : null;
+  const name = json2?.name ?? "";
   return {
-    name: json2?.name ?? "",
+    name,
     description: json2?.description ?? latestManifest?.description ?? null,
     latestVersion: latest,
     license: pickLicense(json2?.license ?? latestManifest?.license),
@@ -542,9 +621,40 @@ function parseNpmRegistry(json2) {
     lastReleaseAt: toDate(latest ? time?.[latest] : null) ?? toDate(time?.modified),
     deprecated,
     maintainersCount: maintainers,
-    readme: typeof json2?.readme === "string" ? json2.readme : null
+    readme: typeof json2?.readme === "string" ? json2.readme : null,
+    keywords: parseKeywords(json2?.keywords ?? latestManifest?.keywords),
+    hasTypes: detectTypes(name, latestManifest),
+    hasTestScript: detectTestScript(latestManifest),
+    directDependenciesCount: countDeps(latestManifest?.dependencies),
+    hasProvenance: detectProvenance(latestManifest)
   };
 }
+function parseKeywords(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((k) => typeof k === "string");
+}
+function detectTypes(name, manifest) {
+  if (typeof manifest?.types === "string" || typeof manifest?.typings === "string") return true;
+  if (name.startsWith("@types/")) return true;
+  const exportsField = manifest?.exports;
+  if (exportsField && typeof exportsField === "object") {
+    const serialized = JSON.stringify(exportsField);
+    if (serialized.includes('"types"')) return true;
+  }
+  return false;
+}
+function detectTestScript(manifest) {
+  const test = manifest?.scripts?.test;
+  if (typeof test !== "string" || test.trim() === "") return false;
+  return !/no test specified/i.test(test);
+}
+function countDeps(deps) {
+  if (!deps || typeof deps !== "object") return 0;
+  return Object.keys(deps).length;
+}
+function detectProvenance(manifest) {
+  return Boolean(manifest?.dist?.attestations);
+}
 async function fetchNpmRegistry(name, fetchImpl) {
   const url = `https://${HOST}/${encodeNpmName(name)}`;
   const { data } = await httpGetJson(url, {
@@ -582,6 +692,32 @@ var init_npmRegistry = __esm({
   }
 });
 
+// src/ingestion/sources/npmSearch.ts
+async function searchNpm(query, size = 20, fetchImpl) {
+  const url = `https://${HOST2}/-/v1/search?text=${encodeURIComponent(query)}&size=${size}`;
+  try {
+    const { data } = await httpGetJson(url, {
+      host: HOST2,
+      ttlMs: CACHE_TTL.npmRegistry,
+      fetchImpl
+    });
+    const objects = Array.isArray(data?.objects) ? data.objects : [];
+    return objects.map((o) => ({ name: o?.package?.name, date: o?.package?.date ?? null })).filter((h) => typeof h.name === "string");
+  } catch {
+    return [];
+  }
+}
+var HOST2;
+var init_npmSearch = __esm({
+  "src/ingestion/sources/npmSearch.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_constants();
+    init_http();
+    HOST2 = "registry.npmjs.org";
+  }
+});
+
 // src/ingestion/sources/npmDownloads.ts
 function parseWeeklyDownloads(json2) {
   const value = json2?.downloads;
@@ -627,8 +763,8 @@ function chunk(items, size) {
 async function fetchWeeklyDownloads(name, fetchImpl) {
   try {
     const { data } = await httpGetJson(
-      `https://${HOST2}/downloads/point/last-week/${name}`,
-      { host: HOST2, ttlMs: CACHE_TTL.npmDownloads, retries: 5, fetchImpl }
+      `https://${HOST3}/downloads/point/last-week/${name}`,
+      { host: HOST3, ttlMs: CACHE_TTL.npmDownloads, retries: 5, fetchImpl }
     );
     return parseWeeklyDownloads(data);
   } catch (err) {
@@ -639,8 +775,8 @@ async function fetchWeeklyDownloads(name, fetchImpl) {
 async function fetchDownloadGrowth(name, fetchImpl) {
   try {
     const { data } = await httpGetJson(
-      `https://${HOST2}/downloads/range/${last90DayRange()}/${name}`,
-      { host: HOST2, ttlMs: CACHE_TTL.npmDownloads, retries: 3, fetchImpl }
+      `https://${HOST3}/downloads/range/${last90DayRange()}/${name}`,
+      { host: HOST3, ttlMs: CACHE_TTL.npmDownloads, retries: 3, fetchImpl }
     );
     return parseDownloadGrowth(data);
   } catch {
@@ -654,8 +790,8 @@ async function fetchBulkWeeklyDownloads(names, fetchImpl) {
   for (const batch of chunk(unscoped, BULK_CHUNK)) {
     try {
       const { data } = await httpGetJson(
-        `https://${HOST2}/downloads/point/last-week/${batch.join(",")}`,
-        { host: HOST2, ttlMs: CACHE_TTL.npmDownloads, retries: 5, fetchImpl }
+        `https://${HOST3}/downloads/point/last-week/${batch.join(",")}`,
+        { host: HOST3, ttlMs: CACHE_TTL.npmDownloads, retries: 5, fetchImpl }
       );
       for (const [k, v] of parseBulkWeekly(data, batch)) result.set(k, v);
     } catch {
@@ -669,14 +805,14 @@ async function fetchBulkWeeklyDownloads(names, fetchImpl) {
   }
   return result;
 }
-var HOST2, BULK_CHUNK;
+var HOST3, BULK_CHUNK;
 var init_npmDownloads = __esm({
   "src/ingestion/sources/npmDownloads.ts"() {
     "use strict";
     init_esm_shims();
     init_constants();
     init_http();
-    HOST2 = "api.npmjs.org";
+    HOST3 = "api.npmjs.org";
     BULK_CHUNK = 128;
   }
 });
@@ -700,7 +836,7 @@ function parseGithub(json2, now = /* @__PURE__ */ new Date()) {
 async function fetchGithubRepo(owner, repo, token, fetchImpl) {
   const body = JSON.stringify({ query: QUERY, variables: { owner, name: repo } });
   const { data } = await httpRequest(ENDPOINT, {
-    host: HOST3,
+    host: HOST4,
     ttlMs: CACHE_TTL.github,
     method: "POST",
     headers: {
@@ -715,15 +851,15 @@ async function fetchGithubRepo(owner, repo, token, fetchImpl) {
   });
   return parseGithub(data);
 }
-var HOST3, ENDPOINT, QUERY, ONE_YEAR_MS;
+var HOST4, ENDPOINT, QUERY, ONE_YEAR_MS;
 var init_github = __esm({
   "src/ingestion/sources/github.ts"() {
     "use strict";
     init_esm_shims();
     init_constants();
     init_http();
-    HOST3 = "api.github.com";
-    ENDPOINT = `https://${HOST3}/graphql`;
+    HOST4 = "api.github.com";
+    ENDPOINT = `https://${HOST4}/graphql`;
     QUERY = `query($owner:String!, $name:String!) {
   repository(owner:$owner, name:$name) {
     stargazerCount
@@ -769,10 +905,10 @@ function parseAdvisoryDetail(json2) {
 }
 async function fetchScorecard(owner, repo, fetchImpl) {
   const projectKey = encodeURIComponent(`github.com/${owner}/${repo}`);
-  const url = `https://${HOST4}/v3/projects/${projectKey}`;
+  const url = `https://${HOST5}/v3/projects/${projectKey}`;
   try {
     const { data } = await httpGetJson(url, {
-      host: HOST4,
+      host: HOST5,
       ttlMs: CACHE_TTL.depsDev,
       fetchImpl
     });
@@ -782,11 +918,11 @@ async function fetchScorecard(owner, repo, fetchImpl) {
   }
 }
 async function fetchAdvisories(name, version, fetchImpl) {
-  const versionUrl = `https://${HOST4}/v3/systems/npm/packages/${encodeName(name)}/versions/${encodeURIComponent(version)}`;
+  const versionUrl = `https://${HOST5}/v3/systems/npm/packages/${encodeName(name)}/versions/${encodeURIComponent(version)}`;
   let keys = [];
   try {
     const { data } = await httpGetJson(versionUrl, {
-      host: HOST4,
+      host: HOST5,
       ttlMs: CACHE_TTL.depsDev,
       fetchImpl
     });
@@ -796,8 +932,8 @@ async function fetchAdvisories(name, version, fetchImpl) {
   }
   const details = await Promise.allSettled(
     keys.map(
-      (key) => httpGetJson(`https://${HOST4}/v3/advisories/${encodeURIComponent(key)}`, {
-        host: HOST4,
+      (key) => httpGetJson(`https://${HOST5}/v3/advisories/${encodeURIComponent(key)}`, {
+        host: HOST5,
         ttlMs: CACHE_TTL.depsDev,
         fetchImpl
       })
@@ -807,6 +943,21 @@ async function fetchAdvisories(name, version, fetchImpl) {
     (d) => d.status === "fulfilled"
   ).map((d) => parseAdvisoryDetail(d.value.data));
 }
+async function fetchDependencyNames(name, version, fetchImpl) {
+  const url = `https://${HOST5}/v3/systems/npm/packages/${encodeName(name)}/versions/${encodeURIComponent(version)}:dependencies`;
+  try {
+    const { data } = await httpGetJson(url, {
+      host: HOST5,
+      ttlMs: CACHE_TTL.depsDev,
+      fetchImpl
+    });
+    const nodes = Array.isArray(data?.nodes) ? data.nodes : [];
+    const names = nodes.map((n) => n?.versionKey?.name).filter((n) => typeof n === "string" && n !== name);
+    return [...new Set(names)];
+  } catch {
+    return [];
+  }
+}
 async function fetchDepsDev(name, version, repo, fetchImpl) {
   const [scorecard, advisories] = await Promise.all([
     repo ? fetchScorecard(repo.owner, repo.repo, fetchImpl) : Promise.resolve(null),
@@ -814,14 +965,14 @@ async function fetchDepsDev(name, version, repo, fetchImpl) {
   ]);
   return { scorecard, advisories };
 }
-var HOST4, MAX_ADVISORIES;
+var HOST5, MAX_ADVISORIES;
 var init_depsDev = __esm({
   "src/ingestion/sources/depsDev.ts"() {
     "use strict";
     init_esm_shims();
     init_constants();
     init_http();
-    HOST4 = "api.deps.dev";
+    HOST5 = "api.deps.dev";
     MAX_ADVISORIES = 10;
   }
 });
@@ -834,10 +985,10 @@ function parseBundleSize(json2) {
 }
 async function fetchBundlephobia(name, category, fetchImpl) {
   if (!isFrontendCategory(category)) return { bundleMinGzipKb: null };
-  const url = `https://${HOST5}/api/size?package=${encodeURIComponent(name)}`;
+  const url = `https://${HOST6}/api/size?package=${encodeURIComponent(name)}`;
   try {
     const { data } = await httpGetJson(url, {
-      host: HOST5,
+      host: HOST6,
       ttlMs: CACHE_TTL.bundlephobia,
       timeoutMs: 12e3,
       retries: 1,
@@ -848,7 +999,7 @@ async function fetchBundlephobia(name, category, fetchImpl) {
     return { bundleMinGzipKb: null };
   }
 }
-var HOST5;
+var HOST6;
 var init_bundlephobia = __esm({
   "src/ingestion/sources/bundlephobia.ts"() {
     "use strict";
@@ -856,7 +1007,7 @@ var init_bundlephobia = __esm({
     init_constants();
     init_http();
     init_types();
-    HOST5 = "bundlephobia.com";
+    HOST6 = "bundlephobia.com";
   }
 });
 
@@ -866,6 +1017,7 @@ var init_sources = __esm({
     "use strict";
     init_esm_shims();
     init_npmRegistry();
+    init_npmSearch();
     init_npmDownloads();
     init_github();
     init_depsDev();
@@ -876,10 +1028,10 @@ var init_sources = __esm({
 // src/ingestion/sources/githubReadme.ts
 async function fetchGithubReadme(owner, repo, fetchImpl) {
   for (const file of CANDIDATES) {
-    const url = `https://${HOST6}/${owner}/${repo}/HEAD/${file}`;
+    const url = `https://${HOST7}/${owner}/${repo}/HEAD/${file}`;
     try {
       const { data } = await httpRequest(url, {
-        host: HOST6,
+        host: HOST7,
         ttlMs: CACHE_TTL.github,
         accept: "text",
         retries: 0,
@@ -891,14 +1043,14 @@ async function fetchGithubReadme(owner, repo, fetchImpl) {
   }
   return null;
 }
-var HOST6, CANDIDATES;
+var HOST7, CANDIDATES;
 var init_githubReadme = __esm({
   "src/ingestion/sources/githubReadme.ts"() {
     "use strict";
     init_esm_shims();
     init_constants();
     init_http();
-    HOST6 = "raw.githubusercontent.com";
+    HOST7 = "raw.githubusercontent.com";
     CANDIDATES = ["README.md", "readme.md", "README.markdown", "README"];
   }
 });
@@ -915,6 +1067,7 @@ function truncateSentences(text2, max = 3) {
 }
 function buildUserPrompt(input) {
   const readme = (input.readme ?? "").slice(0, 4e3);
+  const needsCategory = input.category == null;
   return [
     `Package: ${input.name}`,
     `Category: ${input.category ?? "unknown"}`,
@@ -928,7 +1081,8 @@ ${readme || "(none)"}`,
     '- "whenToUse": one sentence on the ideal use case.',
     '- "whenNotToUse": one sentence on when to pick something else (or "").',
     '- "whereItFits": one sentence on its architectural role.',
-    '- "howToWireIn": one short sentence on the minimal setup (install + entry point), or "".'
+    '- "howToWireIn": one short sentence on the minimal setup (install + entry point), or "".',
+    ...needsCategory ? [`- "category": the single best fit from this list: ${CATEGORIES.join(", ")}.`] : []
   ].join("\n");
 }
 function str(value) {
@@ -962,6 +1116,7 @@ var init_summarize = __esm({
   "src/ingestion/summarize.ts"() {
     "use strict";
     init_esm_shims();
+    init_types();
     init_config();
     init_http();
     init_logger();
@@ -1003,7 +1158,7 @@ var init_summarize = __esm({
           whereItFits: `Sits at ${role}.`,
           context7Hint: context7Hint(input.name)
         };
-        return { summary, usageGuide: guide };
+        return { summary, usageGuide: guide, inferredCategory: null };
       }
     };
     SYSTEM_PROMPT = "You summarize npm packages factually for an AI coding agent choosing dependencies. Use ONLY the provided README/description. Never invent capabilities or APIs. Be concise and concrete. Respond with a JSON object.";
@@ -1051,7 +1206,13 @@ var init_summarize = __esm({
             howToWireIn: str(parsed.howToWireIn) || void 0,
             context7Hint: context7Hint(input.name)
           };
-          return { summary: str(parsed.summary) ? truncateSentences(parsed.summary, 3) : null, usageGuide: guide };
+          const rawCategory = str(parsed.category);
+          const inferredCategory = rawCategory && isCategory(rawCategory) ? rawCategory : null;
+          return {
+            summary: str(parsed.summary) ? truncateSentences(parsed.summary, 3) : null,
+            usageGuide: guide,
+            inferredCategory
+          };
         } catch (err) {
           logger.warn(`summary LLM failed for ${input.name}, using fallback: ${err.message}`);
           return new FallbackSummaryProvider().generate(input);
@@ -1103,18 +1264,227 @@ var init_collect = __esm({
   }
 });
 
+// src/search/categoryInference.ts
+function inferCategory(need) {
+  const text2 = need.toLowerCase();
+  for (const rule of RULES) {
+    if (rule.patterns.test(text2)) return rule.category;
+  }
+  return null;
+}
+function inferCategoryFromSignals(signals) {
+  const r = signals.registry;
+  const keywords = (r?.keywords ?? []).join(" ");
+  const text2 = [
+    signals.name,
+    keywords,
+    keywords,
+    // weight keywords higher via repetition
+    r?.description ?? "",
+    (r?.readme ?? "").slice(0, 600)
+  ].filter(Boolean).join(" ");
+  return inferCategory(text2);
+}
+var RULES;
+var init_categoryInference = __esm({
+  "src/search/categoryInference.ts"() {
+    "use strict";
+    init_esm_shims();
+    RULES = [
+      { category: "meta-framework", patterns: /\b(meta-?framework|next\.?js|nuxt|remix|astro|gatsby|sveltekit|full-?stack framework)\b/ },
+      { category: "state-management", patterns: /\b(state management|global state|store|redux|zustand|jotai|mobx|atoms?)\b/ },
+      { category: "routing", patterns: /\b(rout(e|er|ing)|navigation|url matching)\b/ },
+      { category: "orm", patterns: /\b(orm|object-?relational|query builder|prisma|drizzle|sequelize|typeorm)\b/ },
+      { category: "database-client", patterns: /\b(database (driver|client)|postgres|mysql|mongo(db)?|redis|sqlite|db driver)\b/ },
+      { category: "ui-component-library", patterns: /\b(component library|ui kit|ui components?|design system|buttons?|modal|dialog)\b/ },
+      { category: "styling", patterns: /\b(styl(e|ing)|css|tailwind|sass|scss|class ?names?|theme)\b/ },
+      { category: "forms", patterns: /\b(forms?|form (state|library|handling)|input handling)\b/ },
+      { category: "validation", patterns: /\b(validat(e|ion|or)|schema|parse input|type ?safe parsing)\b/ },
+      { category: "data-fetching", patterns: /\b(data fetching|server state|react query|swr|graphql client|caching queries)\b/ },
+      { category: "http-client", patterns: /\b(http client|fetch wrapper|rest client|make (a )?request|ajax|api calls?)\b/ },
+      { category: "auth", patterns: /\b(auth(entication|orization)?|login|session|jwt|oauth|password hashing)\b/ },
+      { category: "testing", patterns: /\b(test(ing|s)?|unit test|e2e|assertion|mocking|test runner)\b/ },
+      { category: "bundler", patterns: /\b(bundler|bundle (modules?|code)|webpack|rollup|esbuild|parcel)\b/ },
+      { category: "build-tool", patterns: /\b(build tool|dev server|monorepo|task runner|compile|transpile)\b/ },
+      // date-time precedes linting: "date formatting" must not be captured by linting's
+      // bare "formatting" token before the date rule is reached (first-match-wins).
+      { category: "date-time", patterns: /\b(dates?|date ?time|time(zone)?s?|calendar|parse dates?|format dates?)\b/ },
+      { category: "linting", patterns: /\b(lint(er|ing)?|formatter|formatting|code (quality|style|format)|prettier|eslint)\b/ },
+      { category: "animation", patterns: /\b(animat(e|ion)|motion|transition|spring|gsap|3d)\b/ },
+      { category: "charts", patterns: /\b(charts?|graphs?|data ?vis(ualization)?|plots?|dashboards?)\b/ },
+      { category: "i18n", patterns: /\b(i18n|internationali[sz]ation|localization|translat(e|ion)|locale)\b/ },
+      { category: "framework", patterns: /\b(framework|react|vue|svelte|angular|web server|backend framework)\b/ },
+      { category: "utility", patterns: /\b(debounce|throttle|deep ?clone|slugify|uuid|util(ity|ities)?|helper|lodash|retry)\b/ }
+    ];
+  }
+});
+
+// src/core/paths.ts
+import { existsSync as existsSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function packageRoot() {
+  if (cachedRoot) return cachedRoot;
+  let dir = dirname2(fileURLToPath2(import.meta.url));
+  for (; ; ) {
+    if (existsSync2(join2(dir, "package.json"))) {
+      cachedRoot = dir;
+      return dir;
+    }
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  cachedRoot = process.cwd();
+  return cachedRoot;
+}
+function migrationsDir() {
+  return join2(packageRoot(), "drizzle");
+}
+function seedJsonPath() {
+  return join2(packageRoot(), "src", "data", "seed.json");
+}
+function userWeightsPath() {
+  const base = process.env.XDG_CONFIG_HOME || join2(homedir2(), ".config");
+  return join2(base, "lurq", "weights.json");
+}
+function projectWeightsPath() {
+  return join2(process.cwd(), ".lurq", "weights.json");
+}
+var cachedRoot;
+var init_paths = __esm({
+  "src/core/paths.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/scoring/weights.ts
-var HEALTH_WEIGHTS, MAINTENANCE_WEIGHTS, MAINTENANCE, ADOPTION, RELIABILITY, EFFICIENCY, CONFIDENCE;
+import { existsSync as existsSync3, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { dirname as dirname3 } from "path";
+function activeWeightsPath() {
+  if (existsSync3(projectWeightsPath())) return { path: projectWeightsPath(), source: "project-config" };
+  if (existsSync3(userWeightsPath())) return { path: userWeightsPath(), source: "user-config" };
+  return null;
+}
+function loadWeights() {
+  if (cachedWeights) return cachedWeights;
+  let merged = structuredClone(DEFAULT_WEIGHTS);
+  const active = activeWeightsPath();
+  if (active) {
+    try {
+      const fromFile = JSON.parse(readFileSync(active.path, "utf8"));
+      merged = mergeWeights(merged, fromFile);
+    } catch {
+    }
+  }
+  const envLambda = process.env.LURQ_COMPOSITE_LAMBDA;
+  if (envLambda !== void 0 && envLambda !== "") {
+    const n = Number(envLambda);
+    if (Number.isFinite(n)) merged.composite.lambda = n;
+  }
+  cachedWeights = validateWeights(merged).weights;
+  return cachedWeights;
+}
+function resetWeightsCache() {
+  cachedWeights = void 0;
+}
+function mergeWeights(base, over) {
+  return {
+    health: { ...base.health, ...over.health ?? {} },
+    composite: { ...base.composite, ...over.composite ?? {} }
+  };
+}
+function validateWeights(w) {
+  const lambda = Math.max(0, Math.min(1, w.composite.lambda));
+  const h = w.health;
+  const sum = h.maintenance + h.adoption + h.reliability + h.efficiency;
+  let normalized = false;
+  let health = h;
+  if (sum <= 0) {
+    health = { ...DEFAULT_WEIGHTS.health };
+    normalized = true;
+  } else if (Math.abs(sum - 1) > 1e-6) {
+    health = {
+      maintenance: h.maintenance / sum,
+      adoption: h.adoption / sum,
+      reliability: h.reliability / sum,
+      efficiency: h.efficiency / sum
+    };
+    normalized = true;
+  }
+  return { weights: { health, composite: { lambda } }, normalized };
+}
+function settableKeys() {
+  return Object.keys(SETTABLE);
+}
+function applyOverrides(base, sets) {
+  const next = structuredClone(base);
+  for (const entry of sets) {
+    const eq7 = entry.indexOf("=");
+    if (eq7 < 0) throw new Error(`Invalid --set "${entry}" (expected key=value).`);
+    const key = entry.slice(0, eq7).trim();
+    const value = Number(entry.slice(eq7 + 1).trim());
+    const apply = SETTABLE[key];
+    if (!apply) {
+      throw new Error(`Unknown weight key "${key}". Settable: ${settableKeys().join(", ")}.`);
+    }
+    if (!Number.isFinite(value)) throw new Error(`Value for "${key}" must be a number.`);
+    apply(next, value);
+  }
+  return next;
+}
+function saveWeights(w, scope = "user") {
+  const path2 = scope === "project" ? projectWeightsPath() : userWeightsPath();
+  mkdirSync(dirname3(path2), { recursive: true });
+  writeFileSync(path2, JSON.stringify(w, null, 2) + "\n", "utf8");
+  resetWeightsCache();
+  return path2;
+}
+function resetWeights() {
+  const removed = [];
+  for (const path2 of [projectWeightsPath(), userWeightsPath()]) {
+    if (existsSync3(path2)) {
+      rmSync(path2);
+      removed.push(path2);
+    }
+  }
+  resetWeightsCache();
+  return removed;
+}
+var HEALTH_WEIGHTS, COMPOSITE, QUALITY_WEIGHTS, QUALITY, MAINTENANCE_WEIGHTS, MAINTENANCE, ADOPTION, RELIABILITY, EFFICIENCY, DISCOVERY, DEFAULT_WEIGHTS, cachedWeights, SETTABLE, WEIGHT_EXPLANATIONS, CONFIDENCE;
 var init_weights = __esm({
   "src/scoring/weights.ts"() {
     "use strict";
     init_esm_shims();
+    init_paths();
     HEALTH_WEIGHTS = {
       maintenance: 0.35,
       adoption: 0.3,
       reliability: 0.25,
       efficiency: 0.1
     };
+    COMPOSITE = {
+      lambda: 0.35
+    };
+    QUALITY_WEIGHTS = {
+      types: 0.25,
+      tests: 0.2,
+      docs: 0.2,
+      changelog: 0.1,
+      deps: 0.1,
+      license: 0.1,
+      provenance: 0.05
+    };
+    QUALITY = {
+      /** README at/above this many characters scores full marks on doc length. */
+      docsFullLengthChars: 1200,
+      /** Direct-dependency count at/above this scores 0 on the deps component (log-scaled). */
+      depsLogMax: 30,
+      /** A license string present but not OSI-recognized scores this (vs 100 / 0). */
+      licenseUnrecognizedScore: 60
+    };
     MAINTENANCE_WEIGHTS = {
       recency: 0.5,
       cadence: 0.25,
@@ -1162,6 +1532,35 @@ var init_weights = __esm({
       /** Bundle size at the category median maps to this score; smaller → higher. */
       medianScore: 50
     };
+    DISCOVERY = {
+      /** A queued candidate must clear this quality pre-score to graduate to ingest. */
+      minPreScore: 45,
+      /** Max candidates fully ingested per crawler run (cost bound). */
+      perRunCap: 25,
+      /** npm-search hits to pull per category keyword. */
+      searchSizePerCategory: 10,
+      /** Max dependency-graph neighbors to enqueue per tracked seed. */
+      graphNeighborsPerSeed: 20
+    };
+    DEFAULT_WEIGHTS = {
+      health: { ...HEALTH_WEIGHTS },
+      composite: { ...COMPOSITE }
+    };
+    SETTABLE = {
+      "health.maintenance": (w, v) => w.health.maintenance = v,
+      "health.adoption": (w, v) => w.health.adoption = v,
+      "health.reliability": (w, v) => w.health.reliability = v,
+      "health.efficiency": (w, v) => w.health.efficiency = v,
+      "composite.lambda": (w, v) => w.composite.lambda = v
+    };
+    WEIGHT_EXPLANATIONS = {
+      maintenance: "release recency, cadence, and issue close-ratio (weights.ts MAINTENANCE_WEIGHTS).",
+      adoption: "weekly downloads (log-scaled), stars, and 90-day growth (weights.ts ADOPTION).",
+      reliability: "OpenSSF Scorecard scaled 0\u2013100, minus advisory penalties (weights.ts RELIABILITY).",
+      efficiency: "bundle size vs the category median; frontend categories only (weights.ts EFFICIENCY).",
+      quality: "intrinsic, adoption-independent: types, tests, docs, changelog, deps, license, provenance (weights.ts QUALITY_WEIGHTS). A standalone axis \u2014 it does NOT feed health.",
+      lambda: "how much the default sort composite favors quality over health: (1\u2212\u03BB)\xB7health + \u03BB\xB7quality."
+    };
     CONFIDENCE = {
       proven: {
         minWeeklyDownloads: 1e5,
@@ -1172,6 +1571,11 @@ var init_weights = __esm({
         minWeeklyDownloads: 5e3,
         strongGrowth: 0.5,
         maxLastReleaseMonths: 9
+      },
+      /** `promising` (§1): new but intrinsically high-quality, regardless of adoption. */
+      promising: {
+        minQuality: 70,
+        maxLastReleaseMonths: 12
       }
     };
   }
@@ -1180,6 +1584,7 @@ var init_weights = __esm({
 // src/scoring/score.ts
 function toScoringInput(signals, category) {
   const { registry, downloads, github, depsDev, bundle } = signals;
+  const readme = registry?.readme ?? null;
   return {
     weeklyDownloads: downloads?.weeklyDownloads ?? null,
     downloadGrowth90d: downloads?.downloadGrowth90d ?? null,
@@ -1196,7 +1601,18 @@ function toScoringInput(signals, category) {
     deprecated: registry?.deprecated ?? false,
     archived: github?.archived ?? false,
     bundleMinGzipKb: bundle?.bundleMinGzipKb ?? null,
-    category
+    category,
+    // Quality signals — null (not false) when the manifest itself is missing, so
+    // weightedAverage drops the component rather than scoring it 0.
+    hasTypes: registry ? registry.hasTypes : null,
+    hasTestScript: registry ? registry.hasTestScript : null,
+    readmeLength: readme !== null ? readme.length : null,
+    hasExamples: readme !== null ? /```/.test(readme) : null,
+    hasHomepage: registry ? registry.homepage !== null : null,
+    hasReleaseNotes: github?.releasesLast12mo != null ? github.releasesLast12mo > 0 : null,
+    directDependenciesCount: registry?.directDependenciesCount ?? null,
+    license: registry?.license ?? null,
+    hasProvenance: registry ? registry.hasProvenance : null
   };
 }
 function computeMaintenance(input, now) {
@@ -1254,23 +1670,68 @@ function computeEfficiency(bundleMinGzipKb, category, categoryMedian) {
   const ratio = bundleMinGzipKb / categoryMedian;
   return clamp(100 - ratio * EFFICIENCY.medianScore);
 }
-function computeHealthScore(breakdown) {
+function isRecognizedLicense(license) {
+  if (!license) return false;
+  const id = license.trim().toLowerCase();
+  return RECOGNIZED_LICENSES.some((l) => id === l || id.startsWith(l));
+}
+function computeQuality(input) {
+  const components = [];
+  if (input.hasTypes !== null) {
+    components.push({ value: input.hasTypes ? 100 : 0, weight: QUALITY_WEIGHTS.types });
+  }
+  if (input.hasTestScript !== null) {
+    components.push({ value: input.hasTestScript ? 100 : 0, weight: QUALITY_WEIGHTS.tests });
+  }
+  if (input.readmeLength !== null || input.hasHomepage !== null) {
+    const lenScore = Math.min((input.readmeLength ?? 0) / QUALITY.docsFullLengthChars, 1) * 60;
+    const examples = input.hasExamples ? 25 : 0;
+    const homepage = input.hasHomepage ? 15 : 0;
+    components.push({ value: clamp(lenScore + examples + homepage), weight: QUALITY_WEIGHTS.docs });
+  }
+  if (input.hasReleaseNotes !== null) {
+    components.push({ value: input.hasReleaseNotes ? 100 : 0, weight: QUALITY_WEIGHTS.changelog });
+  }
+  if (input.directDependenciesCount !== null) {
+    const deps = input.directDependenciesCount;
+    const depsScore = clamp(
+      100 - Math.log10(deps + 1) / Math.log10(QUALITY.depsLogMax + 1) * 100
+    );
+    components.push({ value: depsScore, weight: QUALITY_WEIGHTS.deps });
+  }
+  if (input.license !== null) {
+    components.push({
+      value: isRecognizedLicense(input.license) ? 100 : QUALITY.licenseUnrecognizedScore,
+      weight: QUALITY_WEIGHTS.license
+    });
+  }
+  if (input.hasProvenance) {
+    components.push({ value: 100, weight: QUALITY_WEIGHTS.provenance });
+  }
+  if (components.length === 0) return null;
+  return weightedAverage(components);
+}
+function computeHealthScore(breakdown, weights = HEALTH_WEIGHTS) {
   const { maintenance, adoption, reliability, efficiency } = breakdown;
+  const w = weights;
   if (efficiency === null) {
-    const w = HEALTH_WEIGHTS;
     const denom = w.maintenance + w.adoption + w.reliability;
     return Math.round(
       (w.maintenance * maintenance + w.adoption * adoption + w.reliability * reliability) / denom
     );
   }
   return Math.round(
-    HEALTH_WEIGHTS.maintenance * maintenance + HEALTH_WEIGHTS.adoption * adoption + HEALTH_WEIGHTS.reliability * reliability + HEALTH_WEIGHTS.efficiency * efficiency
+    w.maintenance * maintenance + w.adoption * adoption + w.reliability * reliability + w.efficiency * efficiency
   );
 }
+function computeComposite(healthScore, qualityScore, lambda = COMPOSITE.lambda) {
+  if (qualityScore === null) return healthScore;
+  return Math.round((1 - lambda) * healthScore + lambda * qualityScore);
+}
 function hasCriticalOrHighAdvisory(advisories) {
   return advisories.some((a) => a.severity === "critical" || a.severity === "high");
 }
-function computeConfidence(input, now) {
+function computeConfidence(input, now, qualityScore = null) {
   const dl = input.weeklyDownloads ?? 0;
   const ageMonths = monthsSince(input.firstPublishedAt, now);
   const lastReleaseMonths = monthsSince(input.lastReleaseAt, now);
@@ -1285,6 +1746,10 @@ function computeConfidence(input, now) {
   if (emergingAdoptionOk && emergingReleaseOk && !input.deprecated && !input.archived) {
     return "emerging";
   }
+  const promisingReleaseOk = lastReleaseMonths !== null && lastReleaseMonths <= CONFIDENCE.promising.maxLastReleaseMonths;
+  if (qualityScore !== null && qualityScore >= CONFIDENCE.promising.minQuality && promisingReleaseOk && !hasCriticalOrHighAdvisory(input.advisories) && !input.deprecated && !input.archived) {
+    return "promising";
+  }
   return "unproven";
 }
 function weightedAverage(components) {
@@ -1299,7 +1764,7 @@ function median(values) {
   const mid = Math.floor(sorted.length / 2);
   return sorted.length % 2 === 0 ? (sorted[mid - 1] + sorted[mid]) / 2 : sorted[mid];
 }
-var DAY_MS, MONTH_MS, clamp, daysSince, monthsSince;
+var DAY_MS, MONTH_MS, clamp, daysSince, monthsSince, RECOGNIZED_LICENSES;
 var init_score = __esm({
   "src/scoring/score.ts"() {
     "use strict";
@@ -1311,6 +1776,20 @@ var init_score = __esm({
     clamp = (n, lo = 0, hi = 100) => Math.max(lo, Math.min(hi, n));
     daysSince = (date, now) => date ? (now.getTime() - date.getTime()) / DAY_MS : null;
     monthsSince = (date, now) => date ? (now.getTime() - date.getTime()) / MONTH_MS : null;
+    RECOGNIZED_LICENSES = [
+      "mit",
+      "isc",
+      "apache-2.0",
+      "bsd-2-clause",
+      "bsd-3-clause",
+      "mpl-2.0",
+      "lgpl",
+      "gpl",
+      "agpl",
+      "unlicense",
+      "0bsd",
+      "cc0-1.0"
+    ];
   }
 });
 
@@ -1422,7 +1901,7 @@ var init_embeddings = __esm({
 });
 
 // src/db/packages.ts
-import { eq, sql } from "drizzle-orm";
+import { eq, sql as sql2 } from "drizzle-orm";
 async function getSeedTargets(db) {
   const rows = await db.select({ name: seedPackages.name, category: seedPackages.category }).from(seedPackages);
   return rows.map((r) => ({ name: r.name, category: r.category ?? null }));
@@ -1508,18 +1987,28 @@ async function runSync(opts = {}) {
             prefetchedWeekly: weeklyMap.has(target.name) ? weeklyMap.get(target.name) : void 0
           });
           for (const e of signals.errors) allErrors.push({ package: target.name, ...e });
-          const input = toScoringInput(signals, target.category);
           const summaryInput = await buildSummaryInput(signals, target.category);
-          const { summary, usageGuide } = await provider.generate(summaryInput);
+          const { summary, usageGuide, inferredCategory } = await provider.generate(summaryInput);
+          let category = target.category;
+          let categorySource = target.category ? "curated" : null;
+          if (!category) {
+            category = inferCategoryFromSignals(signals) ?? inferredCategory ?? null;
+            categorySource = category ? "inferred" : null;
+          }
+          const input = toScoringInput(signals, category);
+          const quality = computeQuality(input);
           if (++done % 25 === 0) logger.info(`  \u2026${done}/${targets.length}`);
           return {
             target,
+            category,
+            categorySource,
             signals,
             input,
             maintenance: computeMaintenance(input, now),
             adoption: computeAdoption(input),
             reliability: computeReliability(input),
-            confidence: computeConfidence(input, now),
+            quality,
+            confidence: computeConfidence(input, now, quality),
             summary,
             usageGuide
           };
@@ -1542,7 +2031,7 @@ async function runSync(opts = {}) {
       ok.map(
         (c) => buildEmbeddingText({
           name: c.target.name,
-          category: c.target.category,
+          category: c.category,
           summary: c.summary,
           description: c.signals.registry?.description ?? null
         })
@@ -1553,21 +2042,23 @@ async function runSync(opts = {}) {
       const c = ok[i];
       const efficiency = computeEfficiency(
         c.input.bundleMinGzipKb,
-        c.target.category,
-        c.target.category ? medians.get(c.target.category) ?? null : null
+        c.category,
+        c.category ? medians.get(c.category) ?? null : null
       );
       const breakdown = {
         maintenance: c.maintenance,
         adoption: c.adoption,
         reliability: c.reliability,
-        efficiency
+        efficiency,
+        quality: c.quality
       };
       const healthScore = computeHealthScore(breakdown);
       await upsertPackage(
         handle.db,
         assemblePackageRow({
           name: c.target.name,
-          category: c.target.category,
+          category: c.category,
+          categorySource: c.categorySource,
           signals: c.signals,
           input: c.input,
           summary: c.summary,
@@ -1575,6 +2066,7 @@ async function runSync(opts = {}) {
           confidence: c.confidence,
           breakdown,
           healthScore,
+          qualityScore: c.quality,
           embedding: embeddings[i] ?? null,
           now
         })
@@ -1614,7 +2106,7 @@ async function resolveTargets(db, opts) {
 function computeCategoryMedians(computed) {
   const byCategory = /* @__PURE__ */ new Map();
   for (const c of computed) {
-    const cat = c.target.category;
+    const cat = c.category;
     const kb = c.input.bundleMinGzipKb;
     if (cat && isFrontendCategory(cat) && kb !== null) {
       const list = byCategory.get(cat) ?? [];
@@ -1635,6 +2127,7 @@ function assemblePackageRow(p) {
     name: p.name,
     ecosystem: "npm",
     category: p.category,
+    categorySource: p.categorySource,
     description: r?.description ?? null,
     summary: p.summary,
     repoUrl: r?.repoUrl ?? null,
@@ -1655,6 +2148,7 @@ function assemblePackageRow(p) {
     bundleMinGzipKb: p.input.bundleMinGzipKb,
     advisories: p.input.advisories,
     healthScore: p.healthScore,
+    qualityScore: p.qualityScore,
     confidence: p.confidence,
     scoreBreakdown: p.breakdown,
     usageGuide: p.usageGuide,
@@ -1673,6 +2167,7 @@ var init_sync = __esm({
     init_collect();
     init_npmDownloads();
     init_summarize();
+    init_categoryInference();
     init_embeddings();
     init_scoring();
     init_client();
@@ -1682,14 +2177,14 @@ var init_sync = __esm({
 });
 
 // src/pipeline/single.ts
-import { and, eq as eq2, isNotNull, sql as sql2 } from "drizzle-orm";
+import { and, eq as eq2, isNotNull, sql as sql3 } from "drizzle-orm";
 async function getSeedCategory(db, name) {
   const [row] = await db.select({ category: seedPackages.category }).from(seedPackages).where(eq2(seedPackages.name, name)).limit(1);
   return row?.category ?? null;
 }
 async function getCategoryMedianBundle(db, category) {
   const [row] = await db.select({
-    m: sql2`percentile_cont(0.5) within group (order by ${packages.bundleMinGzipKb})`
+    m: sql3`percentile_cont(0.5) within group (order by ${packages.bundleMinGzipKb})`
   }).from(packages).where(and(eq2(packages.category, category), isNotNull(packages.bundleMinGzipKb)));
   return row?.m ?? null;
 }
@@ -1697,24 +2192,39 @@ async function syncOnePackage(db, name, opts = {}) {
   const config = getConfig();
   const now = /* @__PURE__ */ new Date();
   const existing = await getPackageByName(db, name);
-  const category = opts.category ?? existing?.category ?? await getSeedCategory(db, name) ?? null;
+  const curatedCategory = opts.category ?? await getSeedCategory(db, name) ?? null;
+  const initialCategory = curatedCategory ?? existing?.category ?? null;
   const prefetchedWeekly = await fetchWeeklyDownloads(name).catch(() => null);
-  const signals = await collectSignals(name, category, {
+  const signals = await collectSignals(name, initialCategory, {
     githubToken: config.GITHUB_TOKEN,
     prefetchedWeekly
   });
+  const summaryInput = await buildSummaryInput(signals, initialCategory);
+  const { summary, usageGuide, inferredCategory } = await createSummaryProvider().generate(summaryInput);
+  let category;
+  let categorySource;
+  if (curatedCategory) {
+    category = curatedCategory;
+    categorySource = "curated";
+  } else if (existing?.category) {
+    category = existing.category;
+    categorySource = existing.categorySource ?? "inferred";
+  } else {
+    category = inferCategoryFromSignals(signals) ?? inferredCategory ?? null;
+    categorySource = category ? "inferred" : null;
+  }
   const input = toScoringInput(signals, category);
-  const summaryInput = await buildSummaryInput(signals, category);
-  const { summary, usageGuide } = await createSummaryProvider().generate(summaryInput);
   const median2 = category ? await getCategoryMedianBundle(db, category) : null;
+  const quality = computeQuality(input);
   const breakdown = {
     maintenance: computeMaintenance(input, now),
     adoption: computeAdoption(input),
     reliability: computeReliability(input),
-    efficiency: computeEfficiency(input.bundleMinGzipKb, category, median2)
+    efficiency: computeEfficiency(input.bundleMinGzipKb, category, median2),
+    quality
   };
   const healthScore = computeHealthScore(breakdown);
-  const confidence = computeConfidence(input, now);
+  const confidence = computeConfidence(input, now, quality);
   const [embedding] = await createEmbeddingProvider().embed([
     buildEmbeddingText({ name, category, summary, description: signals.registry?.description ?? null })
   ]);
@@ -1723,6 +2233,7 @@ async function syncOnePackage(db, name, opts = {}) {
     assemblePackageRow({
       name,
       category,
+      categorySource,
       signals,
       input,
       summary,
@@ -1730,6 +2241,7 @@ async function syncOnePackage(db, name, opts = {}) {
       confidence,
       breakdown,
       healthScore,
+      qualityScore: quality,
       embedding: embedding ?? null,
       now
     })
@@ -1753,6 +2265,7 @@ var init_single = __esm({
     init_collect();
     init_sources();
     init_summarize();
+    init_categoryInference();
     init_scoring();
     init_embeddings();
     init_packages();
@@ -1761,103 +2274,83 @@ var init_single = __esm({
   }
 });
 
-// src/search/categoryInference.ts
-function inferCategory(need) {
-  const text2 = need.toLowerCase();
-  for (const rule of RULES) {
-    if (rule.patterns.test(text2)) return rule.category;
-  }
-  return null;
-}
-var RULES;
-var init_categoryInference = __esm({
-  "src/search/categoryInference.ts"() {
-    "use strict";
-    init_esm_shims();
-    RULES = [
-      { category: "meta-framework", patterns: /\b(meta-?framework|next\.?js|nuxt|remix|astro|gatsby|sveltekit|full-?stack framework)\b/ },
-      { category: "state-management", patterns: /\b(state management|global state|store|redux|zustand|jotai|mobx|atoms?)\b/ },
-      { category: "routing", patterns: /\b(rout(e|er|ing)|navigation|url matching)\b/ },
-      { category: "orm", patterns: /\b(orm|object-?relational|query builder|prisma|drizzle|sequelize|typeorm)\b/ },
-      { category: "database-client", patterns: /\b(database (driver|client)|postgres|mysql|mongo(db)?|redis|sqlite|db driver)\b/ },
-      { category: "ui-component-library", patterns: /\b(component library|ui kit|ui components?|design system|buttons?|modal|dialog)\b/ },
-      { category: "styling", patterns: /\b(styl(e|ing)|css|tailwind|sass|scss|class ?names?|theme)\b/ },
-      { category: "forms", patterns: /\b(forms?|form (state|library|handling)|input handling)\b/ },
-      { category: "validation", patterns: /\b(validat(e|ion|or)|schema|parse input|type ?safe parsing)\b/ },
-      { category: "data-fetching", patterns: /\b(data fetching|server state|react query|swr|graphql client|caching queries)\b/ },
-      { category: "http-client", patterns: /\b(http client|fetch wrapper|rest client|make (a )?request|ajax|api calls?)\b/ },
-      { category: "auth", patterns: /\b(auth(entication|orization)?|login|session|jwt|oauth|password hashing)\b/ },
-      { category: "testing", patterns: /\b(test(ing|s)?|unit test|e2e|assertion|mocking|test runner)\b/ },
-      { category: "bundler", patterns: /\b(bundler|bundle (modules?|code)|webpack|rollup|esbuild|parcel)\b/ },
-      { category: "build-tool", patterns: /\b(build tool|dev server|monorepo|task runner|compile|transpile)\b/ },
-      // date-time precedes linting: "date formatting" must not be captured by linting's
-      // bare "formatting" token before the date rule is reached (first-match-wins).
-      { category: "date-time", patterns: /\b(dates?|date ?time|time(zone)?s?|calendar|parse dates?|format dates?)\b/ },
-      { category: "linting", patterns: /\b(lint(er|ing)?|formatter|formatting|code (quality|style|format)|prettier|eslint)\b/ },
-      { category: "animation", patterns: /\b(animat(e|ion)|motion|transition|spring|gsap|3d)\b/ },
-      { category: "charts", patterns: /\b(charts?|graphs?|data ?vis(ualization)?|plots?|dashboards?)\b/ },
-      { category: "i18n", patterns: /\b(i18n|internationali[sz]ation|localization|translat(e|ion)|locale)\b/ },
-      { category: "framework", patterns: /\b(framework|react|vue|svelte|angular|web server|backend framework)\b/ },
-      { category: "utility", patterns: /\b(debounce|throttle|deep ?clone|slugify|uuid|util(ity|ities)?|helper|lodash|retry)\b/ }
-    ];
-  }
-});
-
 // src/search/recommend.ts
-import { and as and2, cosineDistance, desc, eq as eq3, isNotNull as isNotNull2, lte, sql as sql3 } from "drizzle-orm";
+import { and as and2, cosineDistance, eq as eq3, isNotNull as isNotNull2, lte, sql as sql4 } from "drizzle-orm";
 async function recommend(db, opts, provider = createEmbeddingProvider()) {
   const limit = Math.min(Math.max(opts.limit ?? 3, 1), 5);
   const [queryVec] = await provider.embed([opts.need]);
   if (!queryVec) return [];
   const category = opts.category ?? inferCategory(opts.need);
   const pool = Math.max(limit * 5, 25);
-  let rows = await runQuery(db, queryVec, opts.constraints, category, pool);
-  if (category && rows.length < limit) {
-    const broad = await runQuery(db, queryVec, opts.constraints, null, pool);
-    const seen = new Set(rows.map((r) => r.name));
-    rows = rows.concat(broad.filter((r) => !seen.has(r.name)));
-  }
-  if (rows.length === 0) return [];
-  const ranked = rows.map((r) => {
-    const simNorm = Math.max(0, Math.min(1, (r.similarity + 1) / 2));
-    const health = (r.healthScore ?? 0) / 100;
-    return { row: r, score: SIM_WEIGHT * simNorm + HEALTH_WEIGHT * health };
+  let fused = await hybridSearch(db, queryVec, opts.need, opts.constraints, category, pool);
+  if (category && fused.length < limit) {
+    const broad = await hybridSearch(db, queryVec, opts.need, opts.constraints, null, pool);
+    const seen = new Set(fused.map((f) => f.row.name));
+    fused = fused.concat(broad.filter((f) => !seen.has(f.row.name)));
+  }
+  if (fused.length === 0) return [];
+  const lambda = loadWeights().composite.lambda;
+  const maxRrf = Math.max(...fused.map((f) => f.rrf));
+  const ranked = fused.map((f) => {
+    const relevance = maxRrf > 0 ? f.rrf / maxRrf : 0;
+    const composite = computeComposite(f.row.healthScore ?? 0, f.row.qualityScore, lambda) / 100;
+    return { row: f.row, score: RELEVANCE_WEIGHT * relevance + COMPOSITE_WEIGHT * composite };
   }).sort((a, b) => b.score - a.score).slice(0, limit);
   return ranked.map(({ row }) => toCandidate(row));
 }
-async function runQuery(db, queryVec, constraints, category, pool) {
-  const similarity = sql3`1 - (${cosineDistance(packages.embedding, queryVec)})`;
-  const conditions = [isNotNull2(packages.embedding)];
+async function hybridSearch(db, queryVec, need, constraints, category, pool) {
+  const [vectorRows, lexicalRows] = await Promise.all([
+    runVectorQuery(db, queryVec, constraints, category, pool),
+    runLexicalQuery(db, need, constraints, category, pool)
+  ]);
+  return rrfFuse([vectorRows, lexicalRows]);
+}
+function rrfFuse(lists, k = RRF_K) {
+  const fused = /* @__PURE__ */ new Map();
+  for (const list of lists) {
+    list.forEach((row, idx) => {
+      const contribution = 1 / (k + idx + 1);
+      const prev = fused.get(row.name);
+      if (prev) prev.rrf += contribution;
+      else fused.set(row.name, { row, rrf: contribution });
+    });
+  }
+  return [...fused.values()].sort((a, b) => b.rrf - a.rrf);
+}
+function buildConditions(constraints, category) {
+  const conditions = [];
   if (category) conditions.push(eq3(packages.category, category));
   if (constraints?.license) conditions.push(eq3(packages.license, constraints.license));
   if (constraints?.maxBundleKb !== void 0) {
     conditions.push(lte(packages.bundleMinGzipKb, constraints.maxBundleKb));
   }
   if (constraints?.minConfidence) {
-    const allowed = ["proven", "emerging", "unproven"].filter(
+    const allowed = ["proven", "emerging", "promising", "unproven"].filter(
       (c) => CONFIDENCE_RANK[c] >= CONFIDENCE_RANK[constraints.minConfidence]
     );
     conditions.push(
-      sql3`${packages.confidence} in ${sql3.raw(`(${allowed.map((c) => `'${c}'`).join(",")})`)}`
+      sql4`${packages.confidence} in ${sql4.raw(`(${allowed.map((c) => `'${c}'`).join(",")})`)}`
     );
   }
-  return db.select({
-    name: packages.name,
-    category: packages.category,
-    healthScore: packages.healthScore,
-    confidence: packages.confidence,
-    latestVersion: packages.latestVersion,
-    weeklyDownloads: packages.weeklyDownloads,
-    lastReleaseAt: packages.lastReleaseAt,
-    repoUrl: packages.repoUrl,
-    similarity
-  }).from(packages).where(and2(...conditions)).orderBy(desc(similarity)).limit(pool);
+  return conditions;
+}
+async function runVectorQuery(db, queryVec, constraints, category, pool) {
+  const distance = cosineDistance(packages.embedding, queryVec);
+  const conditions = [isNotNull2(packages.embedding), ...buildConditions(constraints, category)];
+  return db.select(ROW_COLUMNS).from(packages).where(and2(...conditions)).orderBy(distance).limit(pool);
+}
+async function runLexicalQuery(db, need, constraints, category, pool) {
+  const tsquery = sql4`websearch_to_tsquery('english', ${need})`;
+  const rank = sql4`ts_rank(${packages.searchVector}, ${tsquery})`;
+  const conditions = [sql4`${packages.searchVector} @@ ${tsquery}`, ...buildConditions(constraints, category)];
+  return db.select(ROW_COLUMNS).from(packages).where(and2(...conditions)).orderBy(sql4`${rank} desc`).limit(pool);
 }
 function toCandidate(row) {
   return {
     name: row.name,
     category: row.category,
     healthScore: row.healthScore ?? 0,
+    qualityScore: row.qualityScore,
     confidence: row.confidence ?? "unproven",
     why: buildWhy(row),
     latestVersion: row.latestVersion,
@@ -1878,22 +2371,41 @@ function formatDownloads(n) {
   if (n >= 1e3) return `${Math.round(n / 1e3)}k`;
   return String(n);
 }
-var CONFIDENCE_RANK, SIM_WEIGHT, HEALTH_WEIGHT;
+var CONFIDENCE_RANK, RELEVANCE_WEIGHT, COMPOSITE_WEIGHT, RRF_K, ROW_COLUMNS;
 var init_recommend = __esm({
   "src/search/recommend.ts"() {
     "use strict";
     init_esm_shims();
     init_schema();
+    init_scoring();
+    init_weights();
     init_categoryInference();
     init_embeddings();
-    CONFIDENCE_RANK = { unproven: 0, emerging: 1, proven: 2 };
-    SIM_WEIGHT = 0.6;
-    HEALTH_WEIGHT = 0.4;
+    CONFIDENCE_RANK = {
+      unproven: 0,
+      promising: 1,
+      emerging: 2,
+      proven: 3
+    };
+    RELEVANCE_WEIGHT = 0.6;
+    COMPOSITE_WEIGHT = 0.4;
+    RRF_K = 60;
+    ROW_COLUMNS = {
+      name: packages.name,
+      category: packages.category,
+      healthScore: packages.healthScore,
+      qualityScore: packages.qualityScore,
+      confidence: packages.confidence,
+      latestVersion: packages.latestVersion,
+      weeklyDownloads: packages.weeklyDownloads,
+      lastReleaseAt: packages.lastReleaseAt,
+      repoUrl: packages.repoUrl
+    };
   }
 });
 
 // src/mcp/handlers.ts
-import { sql as sql4 } from "drizzle-orm";
+import { sql as sql5 } from "drizzle-orm";
 function isStale(dataAsOf) {
   if (!dataAsOf) return true;
   return Date.now() - dataAsOf.getTime() > STALENESS_DAYS * DAY_MS2;
@@ -1910,7 +2422,8 @@ function rowToEvaluate(row) {
     maintenance: 0,
     adoption: 0,
     reliability: 0,
-    efficiency: null
+    efficiency: null,
+    quality: null
   };
   return {
     dataAsOf: (row.dataAsOf ?? /* @__PURE__ */ new Date()).toISOString(),
@@ -1918,6 +2431,7 @@ function rowToEvaluate(row) {
     name: row.name,
     category: row.category,
     healthScore: row.healthScore ?? 0,
+    qualityScore: row.qualityScore ?? null,
     confidence: row.confidence ?? "unproven",
     scoreBreakdown: breakdown,
     latestVersion: row.latestVersion,
@@ -1936,7 +2450,7 @@ function rowToEvaluate(row) {
   };
 }
 async function latestDataAsOf(db) {
-  const [row] = await db.select({ m: sql4`max(${packages.dataAsOf})` }).from(packages);
+  const [row] = await db.select({ m: sql5`max(${packages.dataAsOf})` }).from(packages);
   return new Date(row?.m ?? Date.now()).toISOString();
 }
 async function handleRecommend(db, input) {
@@ -2239,7 +2753,7 @@ var init_server = __esm({
     init_handlers();
     init_diagram();
     categoryEnum = z2.enum(CATEGORIES);
-    confidenceEnum = z2.enum(["proven", "emerging", "unproven"]);
+    confidenceEnum = z2.enum(["proven", "emerging", "promising", "unproven"]);
     constraintsSchema = z2.object({
       runtime: z2.enum(["browser", "node", "both"]).optional(),
       license: z2.string().optional(),
@@ -2249,27 +2763,378 @@ var init_server = __esm({
   }
 });
 
-// src/pipeline/index.ts
-var pipeline_exports = {};
-__export(pipeline_exports, {
-  runSync: () => runSync
-});
-var init_pipeline = __esm({
-  "src/pipeline/index.ts"() {
+// src/auth/apiKeys.ts
+import { createHash as createHash3, randomBytes } from "crypto";
+import { and as and3, desc, eq as eq4, isNull } from "drizzle-orm";
+function hashKey(key) {
+  return createHash3("sha256").update(key).digest("hex");
+}
+function generateApiKey() {
+  const body = randomBytes(24).toString("base64url");
+  const key = API_KEY_PREFIX + body;
+  return { key, hash: hashKey(key), prefix: API_KEY_PREFIX + body.slice(0, DISPLAY_BODY) };
+}
+async function createKey(db, input = {}) {
+  const { key, hash, prefix } = generateApiKey();
+  const [row] = await db.insert(apiKeys).values({
+    keyHash: hash,
+    prefix,
+    label: input.label,
+    tier: input.tier ?? "free",
+    ownerId: input.ownerId
+  }).returning();
+  return { key, row };
+}
+async function lookupActiveKey(db, key) {
+  const hash = hashKey(key);
+  const [row] = await db.select().from(apiKeys).where(and3(eq4(apiKeys.keyHash, hash), isNull(apiKeys.revokedAt))).limit(1);
+  if (!row) return null;
+  db.update(apiKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq4(apiKeys.id, row.id)).then(void 0, () => {
+  });
+  return row;
+}
+async function listKeys(db) {
+  return db.select().from(apiKeys).orderBy(desc(apiKeys.createdAt));
+}
+async function revokeKey(db, prefixOrId) {
+  const asId = Number(prefixOrId);
+  const match = Number.isInteger(asId) && String(asId) === prefixOrId.trim() ? eq4(apiKeys.id, asId) : eq4(apiKeys.prefix, prefixOrId);
+  const rows = await db.update(apiKeys).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and3(match, isNull(apiKeys.revokedAt))).returning({ id: apiKeys.id });
+  return rows.length;
+}
+var DISPLAY_BODY;
+var init_apiKeys = __esm({
+  "src/auth/apiKeys.ts"() {
     "use strict";
     init_esm_shims();
-    init_sync();
+    init_constants();
+    init_schema();
+    DISPLAY_BODY = 6;
   }
 });
 
-// src/cli/format.ts
-function table(headers, rows) {
-  const widths = headers.map((h, i) => Math.max(width(h), ...rows.map((r) => width(r[i] ?? ""))));
-  const pad = (s, w) => s + " ".repeat(Math.max(0, w - width(s)));
-  const line = (cells) => cells.map((c, i) => pad(c, widths[i])).join("  ");
-  const out = [bold(line(headers)), dim(widths.map((w) => "\u2500".repeat(w)).join("  "))];
-  for (const r of rows) out.push(line(r));
-  return out.join("\n");
+// src/mcp/http.ts
+var http_exports = {};
+__export(http_exports, {
+  startHttpServer: () => startHttpServer
+});
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+function rpcError(code, message) {
+  return { jsonrpc: "2.0", error: { code, message }, id: null };
+}
+async function startHttpServer(opts = {}) {
+  const config = getConfig();
+  const port = opts.port ?? config.PORT;
+  const [{ default: express }, { default: helmet }, { rateLimit, ipKeyGenerator }] = await Promise.all([import("express"), import("helmet"), import("express-rate-limit")]);
+  const { db } = createDb({ max: 20 });
+  const app = express();
+  app.set("trust proxy", 1);
+  app.use(helmet());
+  app.use(express.json({ limit: "1mb" }));
+  app.get("/healthz", (_req, res) => {
+    res.status(200).json({ status: "ok" });
+  });
+  const ipLimiter = rateLimit({
+    windowMs: config.LURQ_RATE_LIMIT_WINDOW_MS,
+    limit: config.LURQ_IP_RATE_LIMIT_MAX,
+    standardHeaders: "draft-7",
+    legacyHeaders: false,
+    message: rpcError(-32029, "Rate limit exceeded.")
+  });
+  const auth = async (req, res, next) => {
+    const header = req.headers.authorization;
+    const token = header?.startsWith("Bearer ") ? header.slice(7).trim() : "";
+    if (!token) {
+      res.status(401).json(rpcError(-32001, "Missing API key. Pass Authorization: Bearer <key>."));
+      return;
+    }
+    try {
+      const row = await lookupActiveKey(db, token);
+      if (!row) {
+        res.status(401).json(rpcError(-32001, "Invalid or revoked API key."));
+        return;
+      }
+      req.lurqKey = row;
+      next();
+    } catch (err) {
+      logger.error("auth lookup failed:", err instanceof Error ? err.message : String(err));
+      res.status(500).json(rpcError(-32603, "Internal error."));
+    }
+  };
+  const keyLimiter = rateLimit({
+    windowMs: config.LURQ_RATE_LIMIT_WINDOW_MS,
+    limit: config.LURQ_RATE_LIMIT_MAX,
+    standardHeaders: "draft-7",
+    legacyHeaders: false,
+    // Key on the resolved API key (always present — auth runs first). The IP
+    // fallback uses express-rate-limit's ipKeyGenerator so IPv6 addresses are
+    // normalized correctly (v8 throws ERR_ERL_KEY_GEN_IPV6 on a raw req.ip).
+    keyGenerator: (req) => req.lurqKey?.prefix ?? ipKeyGenerator(req.ip ?? "0.0.0.0"),
+    message: rpcError(-32029, "Rate limit exceeded.")
+  });
+  app.post("/mcp", ipLimiter, auth, keyLimiter, async (req, res) => {
+    const server = buildMcpServer(db);
+    const transport = new StreamableHTTPServerTransport({
+      sessionIdGenerator: void 0,
+      enableJsonResponse: true
+    });
+    res.on("close", () => {
+      void transport.close();
+      void server.close();
+    });
+    try {
+      await server.connect(transport);
+      await transport.handleRequest(req, res, req.body);
+    } catch (err) {
+      logger.error("mcp request failed:", err instanceof Error ? err.message : String(err));
+      if (!res.headersSent) res.status(500).json(rpcError(-32603, "Internal error"));
+    }
+  });
+  app.all("/mcp", (_req, res) => {
+    res.status(405).json(rpcError(-32e3, "Method not allowed."));
+  });
+  app.listen(port, () => {
+    logger.info(`lurq HTTP MCP server listening on :${port}/mcp`);
+  });
+}
+var init_http2 = __esm({
+  "src/mcp/http.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_logger();
+    init_apiKeys();
+    init_client();
+    init_server();
+  }
+});
+
+// src/pipeline/rescore.ts
+import { isNotNull as isNotNull3 } from "drizzle-orm";
+import { eq as eq5 } from "drizzle-orm";
+async function runRescore() {
+  const weights = loadWeights();
+  const handle = createDb({ max: 4 });
+  try {
+    const rows = await handle.db.select({ id: packages.id, breakdown: packages.scoreBreakdown, healthScore: packages.healthScore }).from(packages).where(isNotNull3(packages.scoreBreakdown));
+    let updated = 0;
+    for (const row of rows) {
+      if (!row.breakdown) continue;
+      const health = computeHealthScore(row.breakdown, weights.health);
+      if (health !== row.healthScore) {
+        await handle.db.update(packages).set({ healthScore: health, updatedAt: /* @__PURE__ */ new Date() }).where(eq5(packages.id, row.id));
+        updated++;
+      }
+    }
+    logger.info(`Rescored ${rows.length} package(s); ${updated} health score(s) changed.`);
+    return { seen: rows.length, updated };
+  } finally {
+    await handle.close();
+  }
+}
+var init_rescore = __esm({
+  "src/pipeline/rescore.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_logger();
+    init_client();
+    init_schema();
+    init_scoring();
+    init_weights();
+  }
+});
+
+// src/db/discovery.ts
+import { eq as eq6, inArray as inArray2, sql as sql6 } from "drizzle-orm";
+async function getKnownNames(db) {
+  const [tracked, queued] = await Promise.all([
+    db.select({ name: packages.name }).from(packages),
+    db.select({ name: discoveryQueue.name }).from(discoveryQueue)
+  ]);
+  return /* @__PURE__ */ new Set([...tracked.map((r) => r.name), ...queued.map((r) => r.name)]);
+}
+async function enqueueCandidates(db, candidates) {
+  if (candidates.length === 0) return 0;
+  const rows = candidates.map((c) => ({ name: c.name, discoveredVia: c.via }));
+  const inserted = await db.insert(discoveryQueue).values(rows).onConflictDoNothing({ target: discoveryQueue.name }).returning({ id: discoveryQueue.id });
+  return inserted.length;
+}
+async function getPendingCandidates(db, limit) {
+  return db.select().from(discoveryQueue).where(eq6(discoveryQueue.status, "pending")).limit(limit);
+}
+async function setDiscoveryStatus(db, name, data) {
+  await db.update(discoveryQueue).set({ status: data.status, ...data.preScore !== void 0 ? { preScore: data.preScore } : {} }).where(eq6(discoveryQueue.name, name));
+}
+var init_discovery = __esm({
+  "src/db/discovery.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_schema();
+  }
+});
+
+// src/pipeline/discovery.ts
+import { isNotNull as isNotNull4 } from "drizzle-orm";
+function selectCandidates(raw, known) {
+  const seen = new Set(known);
+  const out = [];
+  for (const c of raw) {
+    const name = c.name?.trim();
+    if (!name || seen.has(name)) continue;
+    seen.add(name);
+    out.push({ name, via: c.via });
+  }
+  return out;
+}
+function passesGate(preScore) {
+  return preScore !== null && preScore >= DISCOVERY.minPreScore;
+}
+async function preScorePackage(name, fetchImpl) {
+  try {
+    const registry = await fetchNpmRegistry(name, fetchImpl);
+    const signals = {
+      name,
+      registry,
+      downloads: null,
+      github: null,
+      depsDev: null,
+      bundle: null,
+      errors: []
+    };
+    return computeQuality(toScoringInput(signals, null));
+  } catch {
+    return null;
+  }
+}
+async function graphChannel(db) {
+  const tracked = await db.select({ name: packages.name, version: packages.latestVersion }).from(packages).where(isNotNull4(packages.latestVersion));
+  const out = [];
+  for (const t of tracked) {
+    if (!t.version) continue;
+    const deps = (await fetchDependencyNames(t.name, t.version)).slice(
+      0,
+      DISCOVERY.graphNeighborsPerSeed
+    );
+    for (const name of deps) out.push({ name, via: "dependency-graph" });
+  }
+  return out;
+}
+async function searchChannel() {
+  const out = [];
+  for (const category of CATEGORIES) {
+    if (category === "other") continue;
+    const hits = await searchNpm(`keywords:${category}`, DISCOVERY.searchSizePerCategory);
+    for (const hit of hits) {
+      const via = isRecent(hit.date) ? "recent" : "category-search";
+      out.push({ name: hit.name, via });
+    }
+  }
+  return out;
+}
+function isRecent(date) {
+  if (!date) return false;
+  const ms = Date.parse(date);
+  if (Number.isNaN(ms)) return false;
+  return Date.now() - ms <= 90 * 24 * 60 * 60 * 1e3;
+}
+async function runDiscovery(opts = {}) {
+  const cap = opts.perRunCap ?? DISCOVERY.perRunCap;
+  const handle = createDb({ max: 6 });
+  try {
+    logger.info("Discovery: gathering candidates from graph + search channels\u2026");
+    const [graph, search] = await Promise.all([graphChannel(handle.db), searchChannel()]);
+    const known = await getKnownNames(handle.db);
+    const fresh = selectCandidates([...graph, ...search], known);
+    const enqueued = await enqueueCandidates(handle.db, fresh);
+    logger.info(
+      `Discovery: ${graph.length} graph + ${search.length} search candidates \u2192 ${enqueued} new queued.`
+    );
+    const pending = await getPendingCandidates(handle.db, cap * 4);
+    const scored = [];
+    for (const cand of pending) {
+      const preScore = await preScorePackage(cand.name);
+      await setDiscoveryStatus(handle.db, cand.name, {
+        status: passesGate(preScore) ? "pending" : "rejected",
+        preScore: preScore ?? null
+      });
+      if (passesGate(preScore)) scored.push({ name: cand.name, preScore });
+    }
+    logger.info(`Discovery: gated ${pending.length}; ${scored.length} cleared the quality bar.`);
+    scored.sort((a, b) => b.preScore - a.preScore);
+    const toIngest = scored.slice(0, cap);
+    const deferred = scored.slice(cap);
+    if (deferred.length > 0) {
+      logger.info(
+        `Discovery: per-run cap ${cap} reached \u2014 ${deferred.length} eligible candidate(s) deferred to the next run: ${deferred.map((d) => d.name).join(", ")}`
+      );
+    }
+    let ingested = 0;
+    if (!opts.dryRun) {
+      for (const cand of toIngest) {
+        try {
+          await syncOnePackage(handle.db, cand.name);
+          await setDiscoveryStatus(handle.db, cand.name, { status: "ingested" });
+          ingested++;
+        } catch (err) {
+          logger.warn(`Discovery: failed to ingest ${cand.name}: ${err.message}`);
+        }
+      }
+    }
+    logger.info(`Discovery: ingested ${ingested}/${toIngest.length} candidate(s).`);
+    return {
+      enqueued,
+      gated: pending.length,
+      passed: scored.length,
+      ingested,
+      droppedToNextRun: deferred.length
+    };
+  } finally {
+    await handle.close();
+  }
+}
+var init_discovery2 = __esm({
+  "src/pipeline/discovery.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_logger();
+    init_types();
+    init_client();
+    init_discovery();
+    init_schema();
+    init_depsDev();
+    init_npmRegistry();
+    init_npmSearch();
+    init_scoring();
+    init_weights();
+    init_single();
+  }
+});
+
+// src/pipeline/index.ts
+var pipeline_exports = {};
+__export(pipeline_exports, {
+  runDiscovery: () => runDiscovery,
+  runRescore: () => runRescore,
+  runSync: () => runSync
+});
+var init_pipeline = __esm({
+  "src/pipeline/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_sync();
+    init_rescore();
+    init_discovery2();
+  }
+});
+
+// src/cli/format.ts
+function table(headers, rows) {
+  const widths = headers.map((h, i) => Math.max(width(h), ...rows.map((r) => width(r[i] ?? ""))));
+  const pad = (s, w) => s + " ".repeat(Math.max(0, w - width(s)));
+  const line = (cells) => cells.map((c, i) => pad(c, widths[i])).join("  ");
+  const out = [bold(line(headers)), dim(widths.map((w) => "\u2500".repeat(w)).join("  "))];
+  for (const r of rows) out.push(line(r));
+  return out.join("\n");
 }
 function detail(pairs) {
   const labelWidth = Math.max(...pairs.map(([k]) => k.length));
@@ -2292,6 +3157,7 @@ function formatPercent(fraction) {
 function confidenceLabel(c) {
   if (c === "proven") return green(c);
   if (c === "emerging") return yellow(c);
+  if (c === "promising") return green(c);
   return red(c);
 }
 var ESC, wrap, bold, dim, red, green, yellow, ANSI_RE, width;
@@ -2315,9 +3181,11 @@ var init_format = __esm({
 var commands_exports = {};
 __export(commands_exports, {
   runCompare: () => runCompare,
+  runEditWeights: () => runEditWeights,
   runEvaluate: () => runEvaluate,
   runRecommend: () => runRecommend,
-  runVerify: () => runVerify
+  runVerify: () => runVerify,
+  runWeights: () => runWeights
 });
 async function withDb(fn) {
   requireConfig(["DATABASE_URL"]);
@@ -2345,10 +3213,11 @@ async function runRecommend(need, opts) {
     }
     console.log(
       table(
-        ["Package", "Health", "Confidence", "Weekly", "Latest", "Category"],
+        ["Package", "Health", "Quality", "Confidence", "Weekly", "Latest", "Category"],
         res.candidates.map((c) => [
           c.name,
           String(c.healthScore),
+          c.qualityScore != null ? String(c.qualityScore) : "\u2014",
           confidenceLabel(c.confidence),
           formatNumber(c.weeklyDownloads),
           c.latestVersion ?? "\u2014",
@@ -2373,9 +3242,10 @@ async function runEvaluate(pkg, opts) {
     console.log(
       detail([
         ["health", `${res.healthScore}  ${confidenceLabel(res.confidence)}`],
+        ["quality", res.qualityScore != null ? String(res.qualityScore) : "\u2014"],
         [
           "breakdown",
-          `maint ${b.maintenance} \xB7 adopt ${b.adoption} \xB7 rel ${b.reliability} \xB7 eff ${b.efficiency ?? "\u2014"}`
+          `maint ${b.maintenance} \xB7 adopt ${b.adoption} \xB7 rel ${b.reliability} \xB7 eff ${b.efficiency ?? "\u2014"} \xB7 qual ${b.quality ?? "\u2014"}`
         ],
         ["version", res.latestVersion ?? "\u2014"],
         ["weekly dl", `${formatNumber(res.weeklyDownloads)}  (${formatPercent(res.downloadGrowth90d)} 90d)`],
@@ -2429,6 +3299,72 @@ not found: ${res.missing.join(", ")}`));
     console.log(dim(`data as of ${formatDate(res.dataAsOf)}`));
   });
 }
+function runWeights(opts = {}) {
+  const w = loadWeights();
+  const active = activeWeightsPath();
+  if (opts.json) {
+    console.log(JSON.stringify({ ...w, source: active?.source ?? "defaults" }, null, 2));
+    return;
+  }
+  const pct = (n) => n.toFixed(2);
+  console.log(bold("Two axes, blended for default sort:"));
+  console.log(`  composite = (1\u2212\u03BB)\xB7health + \u03BB\xB7quality      \u03BB = ${pct(w.composite.lambda)}
+`);
+  console.log(bold("Health (proven-ness) \u2014 weighted sum of 4 components:"));
+  console.log(
+    detail([
+      ["maintenance", `${pct(w.health.maintenance)}  ${dim("\u2014 " + WEIGHT_EXPLANATIONS.maintenance)}`],
+      ["adoption", `${pct(w.health.adoption)}  ${dim("\u2014 " + WEIGHT_EXPLANATIONS.adoption)}`],
+      ["reliability", `${pct(w.health.reliability)}  ${dim("\u2014 " + WEIGHT_EXPLANATIONS.reliability)}`],
+      ["efficiency", `${pct(w.health.efficiency)}  ${dim("\u2014 " + WEIGHT_EXPLANATIONS.efficiency)}`]
+    ])
+  );
+  console.log("\n" + bold("Quality (intrinsic, adoption-independent):"));
+  console.log("  " + dim(Object.keys(QUALITY_WEIGHTS).join(", ")));
+  console.log("\n" + bold("Confidence thresholds:"));
+  console.log(
+    detail([
+      ["proven", `\u2265 ${formatNumber(CONFIDENCE.proven.minWeeklyDownloads)} weekly dl, \u2265 ${CONFIDENCE.proven.minAgeMonths}mo old`],
+      ["emerging", `\u2265 ${formatNumber(CONFIDENCE.emerging.minWeeklyDownloads)} weekly dl OR \u2265 ${CONFIDENCE.emerging.strongGrowth * 100}% 90d growth`],
+      ["promising", `\u2265 ${CONFIDENCE.promising.minQuality} quality score (adoption-independent)`]
+    ])
+  );
+  console.log(dim(`
+Source: ${active ? `${active.source} (${active.path})` : "defaults (no user overrides)"}`));
+}
+function runEditWeights(opts) {
+  if (opts.reset) {
+    const removed = resetWeights();
+    console.log(removed.length ? `Removed overrides:
+  ${removed.join("\n  ")}` : "No overrides to remove; already on defaults.");
+    return;
+  }
+  if (opts.explain) {
+    const key = opts.explain;
+    const text2 = WEIGHT_EXPLANATIONS[key];
+    if (!text2) {
+      throw new Error(`No explanation for "${key}". Known: ${Object.keys(WEIGHT_EXPLANATIONS).join(", ")}.`);
+    }
+    console.log(`${bold(key)} \u2014 ${text2}`);
+    return;
+  }
+  if (opts.set && opts.set.length > 0) {
+    const next = applyOverrides(loadWeights(), opts.set);
+    const { weights, normalized } = validateWeights(next);
+    const path2 = saveWeights(weights, opts.project ? "project" : "user");
+    console.log(`Saved overrides to ${path2}`);
+    if (normalized) {
+      console.log(
+        yellow("Health weights did not sum to 1.0 \u2014 renormalized to: ") + `maint ${weights.health.maintenance.toFixed(3)}, adopt ${weights.health.adoption.toFixed(3)}, rel ${weights.health.reliability.toFixed(3)}, eff ${weights.health.efficiency.toFixed(3)}`
+      );
+    }
+    console.log(dim("\nRun `lurq rescore` to apply the new health weights to the stored index."));
+    return;
+  }
+  console.log(dim(`No changes. Settable keys: ${settableKeys().join(", ")}.
+`));
+  runWeights(opts);
+}
 async function runVerify(pkg, opts) {
   await withDb(async (db) => {
     const res = await handleVerify(db, { package: pkg });
@@ -2454,57 +3390,33 @@ var init_commands = __esm({
     init_types();
     init_client();
     init_handlers();
+    init_weights();
+    init_weights();
     init_format();
   }
 });
 
-// src/core/paths.ts
-import { existsSync as existsSync2 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function packageRoot() {
-  if (cachedRoot) return cachedRoot;
-  let dir = dirname2(fileURLToPath2(import.meta.url));
-  for (; ; ) {
-    if (existsSync2(join2(dir, "package.json"))) {
-      cachedRoot = dir;
-      return dir;
-    }
-    const parent = dirname2(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  cachedRoot = process.cwd();
-  return cachedRoot;
-}
-function migrationsDir() {
-  return join2(packageRoot(), "drizzle");
-}
-function seedJsonPath() {
-  return join2(packageRoot(), "src", "data", "seed.json");
-}
-var cachedRoot;
-var init_paths = __esm({
-  "src/core/paths.ts"() {
-    "use strict";
-    init_esm_shims();
-  }
-});
-
 // src/cli/installSkill.ts
 var installSkill_exports = {};
 __export(installSkill_exports, {
   SUPPORTED_AGENTS: () => SUPPORTED_AGENTS,
+  agentSpecs: () => agentSpecs,
+  buildRemoteServerEntry: () => buildRemoteServerEntry,
+  buildRemoteTomlBlock: () => buildRemoteTomlBlock,
   buildServerEntry: () => buildServerEntry,
   buildTomlBlock: () => buildTomlBlock,
+  installAgent: () => installAgent,
+  installInstructionsFile: () => installInstructionsFile,
+  printInstallReport: () => printInstallReport,
+  resolveAgents: () => resolveAgents,
   runInstallSkill: () => runInstallSkill
 });
-import { existsSync as existsSync3, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { copyFileSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join3 } from "path";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname4, join as join3 } from "path";
 function home(...p) {
-  return join3(homedir2(), ...p);
+  return join3(homedir3(), ...p);
 }
 function agentSpecs() {
   return [
@@ -2513,35 +3425,35 @@ function agentSpecs() {
       label: "Claude Code",
       format: "mcpServers",
       path: home(".claude.json"),
-      detected: existsSync3(home(".claude.json")) || existsSync3(home(".claude"))
+      detected: existsSync4(home(".claude.json")) || existsSync4(home(".claude"))
     },
     {
       id: "cursor",
       label: "Cursor",
       format: "mcpServers",
       path: home(".cursor", "mcp.json"),
-      detected: existsSync3(home(".cursor"))
+      detected: existsSync4(home(".cursor"))
     },
     {
       id: "windsurf",
       label: "Windsurf",
       format: "mcpServers",
       path: home(".codeium", "windsurf", "mcp_config.json"),
-      detected: existsSync3(home(".codeium"))
+      detected: existsSync4(home(".codeium"))
     },
     {
       id: "copilot",
       label: "VS Code / GitHub Copilot",
       format: "servers",
       path: home("Library", "Application Support", "Code", "User", "mcp.json"),
-      detected: existsSync3(home("Library", "Application Support", "Code", "User"))
+      detected: existsSync4(home("Library", "Application Support", "Code", "User"))
     },
     {
       id: "codex",
       label: "OpenAI Codex CLI",
       format: "toml",
       path: home(".codex", "config.toml"),
-      detected: existsSync3(home(".codex"))
+      detected: existsSync4(home(".codex"))
     }
   ];
 }
@@ -2554,14 +3466,14 @@ function collectEnv() {
   return env;
 }
 function readJsonObject(path2) {
-  if (!existsSync3(path2)) return {};
-  const text2 = readFileSync(path2, "utf8").trim();
+  if (!existsSync4(path2)) return {};
+  const text2 = readFileSync2(path2, "utf8").trim();
   if (!text2) return {};
   return JSON.parse(text2);
 }
 function writeJson(path2, obj) {
-  mkdirSync(dirname3(path2), { recursive: true });
-  writeFileSync(path2, JSON.stringify(obj, null, 2) + "\n", "utf8");
+  mkdirSync2(dirname4(path2), { recursive: true });
+  writeFileSync2(path2, JSON.stringify(obj, null, 2) + "\n", "utf8");
 }
 function buildServerEntry(env, withType) {
   const entry = { command: "npx", args: ["-y", PACKAGE_NAME, "serve"] };
@@ -2569,13 +3481,18 @@ function buildServerEntry(env, withType) {
   if (Object.keys(env).length) entry.env = env;
   return entry;
 }
-function installJson(spec, env) {
-  const key = spec.format === "servers" ? "servers" : "mcpServers";
-  const config = readJsonObject(spec.path);
-  if (typeof config[key] !== "object" || config[key] === null) config[key] = {};
-  config[key].lurq = buildServerEntry(env, spec.format === "servers");
-  writeJson(spec.path, config);
-  return { agent: spec.id, path: spec.path, status: "installed" };
+function buildRemoteServerEntry(agentId, opts) {
+  const headers = { Authorization: `Bearer ${opts.apiKey}` };
+  switch (agentId) {
+    case "cursor":
+      return { url: opts.url, headers };
+    case "windsurf":
+      return { serverUrl: opts.url, headers };
+    case "claude-code":
+    case "copilot":
+    default:
+      return { type: "http", url: opts.url, headers };
+  }
 }
 function buildTomlBlock(env) {
   const lines = ["[mcp_servers.lurq]", 'command = "npx"', `args = ["-y", "${PACKAGE_NAME}", "serve"]`];
@@ -2585,8 +3502,23 @@ function buildTomlBlock(env) {
   }
   return lines.join("\n") + "\n";
 }
-function installToml(spec, env) {
-  const existing = existsSync3(spec.path) ? readFileSync(spec.path, "utf8") : "";
+function buildRemoteTomlBlock(opts) {
+  return [
+    "[mcp_servers.lurq]",
+    `url = ${JSON.stringify(opts.url)}`,
+    `http_headers = { Authorization = ${JSON.stringify(`Bearer ${opts.apiKey}`)} }`
+  ].join("\n") + "\n";
+}
+function installJsonEntry(spec, entry) {
+  const key = spec.format === "servers" ? "servers" : "mcpServers";
+  const config = readJsonObject(spec.path);
+  if (typeof config[key] !== "object" || config[key] === null) config[key] = {};
+  config[key].lurq = entry;
+  writeJson(spec.path, config);
+  return { agent: spec.id, path: spec.path, status: "installed" };
+}
+function installTomlBlock(spec, block) {
+  const existing = existsSync4(spec.path) ? readFileSync2(spec.path, "utf8") : "";
   if (existing.includes("[mcp_servers.lurq]")) {
     return {
       agent: spec.id,
@@ -2595,59 +3527,48 @@ function installToml(spec, env) {
       message: "lurq already present; edit manually to change it."
     };
   }
-  mkdirSync(dirname3(spec.path), { recursive: true });
+  mkdirSync2(dirname4(spec.path), { recursive: true });
   const sep = existing && !existing.endsWith("\n") ? "\n\n" : existing ? "\n" : "";
-  writeFileSync(spec.path, existing + sep + buildTomlBlock(env), "utf8");
+  writeFileSync2(spec.path, existing + sep + block, "utf8");
   return { agent: spec.id, path: spec.path, status: "installed" };
 }
+function installAgent(spec, mode) {
+  try {
+    if (spec.format === "toml") {
+      const block = mode.kind === "remote" ? buildRemoteTomlBlock(mode) : buildTomlBlock(mode.env);
+      return installTomlBlock(spec, block);
+    }
+    const entry = mode.kind === "remote" ? buildRemoteServerEntry(spec.id, mode) : buildServerEntry(mode.env, spec.format === "servers");
+    return installJsonEntry(spec, entry);
+  } catch (err) {
+    return {
+      agent: spec.id,
+      path: spec.path,
+      status: "error",
+      message: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
 function installInstructionsFile() {
   const src = join3(packageRoot(), "templates", "skill-instructions.md");
-  if (!existsSync3(src)) return null;
+  if (!existsSync4(src)) return null;
   const destDir = home(".lurq");
   const dest = join3(destDir, "skill-instructions.md");
-  mkdirSync(destDir, { recursive: true });
+  mkdirSync2(destDir, { recursive: true });
   copyFileSync(src, dest);
   return dest;
 }
-async function runInstallSkill(opts) {
-  const target = opts.agent ?? "claude-code";
+function resolveAgents(target) {
   const specs = agentSpecs();
-  const env = collectEnv();
-  let selected;
-  if (target === "all") {
-    selected = specs.filter((s) => s.detected);
-    if (selected.length === 0) {
-      console.log("No supported agents detected on this machine.");
-      return;
-    }
-  } else {
-    const spec = specs.find((s) => s.id === target);
-    if (!spec) {
-      throw new Error(
-        `Unknown agent "${target}". Supported: ${SUPPORTED_AGENTS.join(", ")}, all.`
-      );
-    }
-    selected = [spec];
-  }
-  if (!env.DATABASE_URL) {
-    logger.warn(
-      "DATABASE_URL is not set in the current environment \u2014 the installed server entry will have no DATABASE_URL. Set it (in .env) and re-run, or edit the config."
-    );
-  }
-  const results = [];
-  for (const spec of selected) {
-    try {
-      results.push(spec.format === "toml" ? installToml(spec, env) : installJson(spec, env));
-    } catch (err) {
-      results.push({
-        agent: spec.id,
-        path: spec.path,
-        status: "error",
-        message: err instanceof Error ? err.message : String(err)
-      });
-    }
+  if (target === "all") return specs.filter((s) => s.detected);
+  const spec = specs.find((s) => s.id === target);
+  if (!spec) {
+    throw new Error(`Unknown agent "${target}". Supported: ${SUPPORTED_AGENTS.join(", ")}, all.`);
   }
-  const instructionsPath = installInstructionsFile();
+  return [spec];
+}
+function printInstallReport(results, instructionsPath, mode) {
+  const specs = agentSpecs();
   console.log("lurq MCP server registration:");
   for (const r of results) {
     const spec = specs.find((s) => s.id === r.agent);
@@ -2657,9 +3578,43 @@ async function runInstallSkill(opts) {
   if (instructionsPath) console.log(`
 Skill instructions written to ${instructionsPath}`);
   console.log("\nNext steps:");
-  console.log("  1. Ensure DATABASE_URL (and any API keys) are set in the config env above.");
-  console.log("  2. Restart the agent so it picks up the new MCP server.");
-  console.log("  3. Ask it to recommend a library \u2014 it should call lurq.");
+  if (mode.kind === "local") {
+    console.log("  1. Ensure DATABASE_URL (and any API keys) are set in the config env above.");
+    console.log("  2. Restart the agent so it picks up the new MCP server.");
+  } else {
+    console.log("  1. Restart the agent so it picks up the new MCP server.");
+  }
+  console.log("  \u2022 Ask it to recommend a library \u2014 it should call lurq.");
+}
+async function runInstallSkill(opts) {
+  const selected = resolveAgents(opts.agent ?? "claude-code");
+  if (selected.length === 0) {
+    console.log("No supported agents detected on this machine.");
+    return;
+  }
+  const remote = !opts.local;
+  let mode;
+  if (remote) {
+    const apiKey = opts.apiKey ?? process.env.LURQ_API_KEY;
+    if (!apiKey) {
+      throw new Error(
+        "An API key is required for a hosted install. Pass --api-key <key> (or set LURQ_API_KEY), or use `lurq install` for the guided setup, or --local to self-host."
+      );
+    }
+    const url = opts.url ?? process.env.LURQ_ENDPOINT ?? DEFAULT_ENDPOINT;
+    mode = { kind: "remote", url, apiKey };
+  } else {
+    const env = collectEnv();
+    if (!env.DATABASE_URL) {
+      logger.warn(
+        "DATABASE_URL is not set \u2014 the local server entry will have no DATABASE_URL. Set it (in .env) and re-run, or edit the config."
+      );
+    }
+    mode = { kind: "local", env };
+  }
+  const results = selected.map((spec) => installAgent(spec, mode));
+  const instructionsPath = installInstructionsFile();
+  printInstallReport(results, instructionsPath, mode);
 }
 var ENV_KEYS, SUPPORTED_AGENTS;
 var init_installSkill = __esm({
@@ -2683,12 +3638,228 @@ var init_installSkill = __esm({
   }
 });
 
+// src/cli/install.ts
+var install_exports = {};
+__export(install_exports, {
+  runInstallWizard: () => runInstallWizard
+});
+async function validateKey(url, apiKey) {
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json, text/event-stream",
+        Authorization: `Bearer ${apiKey}`
+      },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" })
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+async function runInstallWizard(opts) {
+  const interactive = !opts.yes;
+  const url = opts.url ?? process.env.LURQ_ENDPOINT ?? DEFAULT_ENDPOINT;
+  let apiKey = (opts.apiKey ?? process.env.LURQ_API_KEY)?.trim();
+  if (interactive) {
+    const { input, checkbox, confirm } = await import("@inquirer/prompts");
+    console.log("\n  lurq \u2014 connect your coding agent to the hosted package index.\n");
+    if (!apiKey) {
+      console.log(`  Need a key? Get one at ${GET_KEY_URL}
+`);
+      apiKey = (await input({
+        message: "Paste your lurq API key",
+        validate: (v) => v.trim().startsWith("lurq_") ? true : "Keys look like lurq_live_\u2026 "
+      })).trim();
+    }
+    process.stdout.write("  Validating key\u2026 ");
+    const ok = await validateKey(url, apiKey);
+    console.log(ok ? "ok" : "could not reach endpoint");
+    if (!ok) {
+      const proceed = await confirm({
+        message: `Couldn't validate the key against ${url}. Continue anyway?`,
+        default: false
+      });
+      if (!proceed) {
+        console.log("Aborted. No config was changed.");
+        return;
+      }
+    }
+    let selected2;
+    if (opts.agent) {
+      selected2 = resolveAgents(opts.agent);
+    } else {
+      const specs = agentSpecs();
+      const ids = await checkbox({
+        message: "Which assistant(s) should I configure?",
+        choices: specs.map((s) => ({
+          name: `${s.label}${s.detected ? " (detected)" : ""}`,
+          value: s.id,
+          checked: s.detected
+        }))
+      });
+      selected2 = specs.filter((s) => ids.includes(s.id));
+    }
+    await finish(selected2, { url, apiKey });
+    return;
+  }
+  if (!apiKey) {
+    throw new Error(
+      "No API key. Pass --api-key <key> or set LURQ_API_KEY (or drop --yes to be prompted)."
+    );
+  }
+  const selected = opts.agent ? resolveAgents(opts.agent) : agentSpecs().filter((s) => s.detected);
+  await finish(selected, { url, apiKey });
+}
+async function finish(selected, remote) {
+  if (selected.length === 0) {
+    console.log(
+      "\nNo agents selected or detected. Re-run with --agent <id>, or install an assistant first."
+    );
+    return;
+  }
+  const mode = { kind: "remote", ...remote };
+  const results = selected.map((s) => installAgent(s, mode));
+  const instructionsPath = installInstructionsFile();
+  console.log("");
+  printInstallReport(results, instructionsPath, mode);
+}
+var GET_KEY_URL;
+var init_install = __esm({
+  "src/cli/install.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_constants();
+    init_installSkill();
+    GET_KEY_URL = "https://lurq.run";
+  }
+});
+
+// src/cli/keys.ts
+var keys_exports = {};
+__export(keys_exports, {
+  runKeysCreate: () => runKeysCreate,
+  runKeysList: () => runKeysList,
+  runKeysRevoke: () => runKeysRevoke
+});
+function waitForEnter(prompt) {
+  return new Promise((resolve) => {
+    process.stdout.write(prompt);
+    process.stdin.resume();
+    process.stdin.once("data", () => {
+      process.stdin.pause();
+      resolve();
+    });
+  });
+}
+async function runKeysCreate(opts) {
+  requireConfig(["DATABASE_URL"]);
+  const { db, close } = createDb({ max: 1 });
+  try {
+    const { key, row } = await createKey(db, { label: opts.label, tier: opts.tier });
+    if (opts.json) {
+      console.log(JSON.stringify({ key, prefix: row.prefix, tier: row.tier, label: row.label }));
+      return;
+    }
+    const meta = `prefix=${row.prefix}  tier=${row.tier}${row.label ? `  label=${row.label}` : ""}`;
+    const block = [bold("API key created."), "", `  ${green(key)}`, "", dim(meta)];
+    const interactive = Boolean(process.stdout.isTTY && process.stdin.isTTY);
+    console.log(block.join("\n"));
+    if (interactive) {
+      await waitForEnter(dim("Copy it now, then press Enter to erase it from the terminal\u2026 "));
+      process.stdout.write(`\x1B[${block.length + 1}F\x1B[0J\x1B[3J`);
+      console.log(
+        dim(`API key created (prefix ${row.prefix}) \u2014 value erased from the terminal. It is stored only as a hash and cannot be recovered, so make sure you saved it.`)
+      );
+    } else {
+      console.log(dim("Store it now \u2014 shown only once, stored hashed, cannot be recovered."));
+    }
+  } finally {
+    await close();
+  }
+}
+async function runKeysList(opts) {
+  requireConfig(["DATABASE_URL"]);
+  const { db, close } = createDb({ max: 1 });
+  try {
+    const rows = await listKeys(db);
+    if (opts.json) {
+      console.log(
+        JSON.stringify(
+          rows.map((r) => ({
+            id: r.id,
+            prefix: r.prefix,
+            label: r.label,
+            tier: r.tier,
+            ownerId: r.ownerId,
+            createdAt: r.createdAt,
+            lastUsedAt: r.lastUsedAt,
+            revokedAt: r.revokedAt
+          })),
+          null,
+          2
+        )
+      );
+      return;
+    }
+    if (rows.length === 0) {
+      console.log("No API keys yet. Create one with `lurq keys create --label <name>`.");
+      return;
+    }
+    console.log(
+      table(
+        ["prefix", "label", "tier", "created", "last used", "status"],
+        rows.map((r) => [
+          r.prefix,
+          r.label ?? "\u2014",
+          r.tier,
+          isoDay(r.createdAt),
+          isoDay(r.lastUsedAt),
+          r.revokedAt ? "revoked" : "active"
+        ])
+      )
+    );
+  } finally {
+    await close();
+  }
+}
+async function runKeysRevoke(prefixOrId) {
+  requireConfig(["DATABASE_URL"]);
+  const { db, close } = createDb({ max: 1 });
+  try {
+    const n = await revokeKey(db, prefixOrId);
+    if (n === 0) {
+      logger.warn(`No active key matched "${prefixOrId}".`);
+      process.exitCode = 1;
+      return;
+    }
+    console.log(`Revoked ${n} key(s) matching "${prefixOrId}".`);
+  } finally {
+    await close();
+  }
+}
+var isoDay;
+var init_keys = __esm({
+  "src/cli/keys.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_logger();
+    init_apiKeys();
+    init_client();
+    init_format();
+    isoDay = (d) => d ? d.toISOString().slice(0, 10) : "\u2014";
+  }
+});
+
 // src/db/seed.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { sql as sql5 } from "drizzle-orm";
+import { readFileSync as readFileSync3 } from "fs";
+import { sql as sql7 } from "drizzle-orm";
 import { z as z3 } from "zod";
 function loadSeedFile(path2 = seedJsonPath()) {
-  const raw = JSON.parse(readFileSync2(path2, "utf8"));
+  const raw = JSON.parse(readFileSync3(path2, "utf8"));
   const parsed = SeedFileSchema.parse(raw);
   const byName = /* @__PURE__ */ new Map();
   for (const entry of parsed) {
@@ -2702,7 +3873,7 @@ async function loadSeedPackages(db, path2) {
   await db.insert(seedPackages).values(entries.map((e) => ({ name: e.name, category: e.category ?? null }))).onConflictDoUpdate({
     target: seedPackages.name,
     // Refresh category to the incoming value on conflict (EXCLUDED.category).
-    set: { category: sql5`excluded.category` }
+    set: { category: sql7`excluded.category` }
   });
   logger.info(`Loaded ${entries.length} packages into seed_packages.`);
   return entries.length;
@@ -2732,7 +3903,13 @@ __export(migrate_exports, {
 });
 import { migrate } from "drizzle-orm/postgres-js/migrator";
 async function ensureVectorExtension(handle) {
-  await handle.sql`CREATE EXTENSION IF NOT EXISTS vector`;
+  try {
+    await handle.sql`CREATE EXTENSION IF NOT EXISTS vector`;
+  } catch (err) {
+    logger.warn(
+      `CREATE EXTENSION vector did not run cleanly (continuing to migrations): ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
 }
 async function runMigrate() {
   const handle = createDb({ max: 1 });
@@ -2791,13 +3968,17 @@ function buildProgram() {
     const { startMcpServer: startMcpServer2 } = await Promise.resolve().then(() => (init_server(), server_exports));
     await startMcpServer2();
   });
+  program.command("serve-http").description("start the hosted MCP server over HTTP with API-key auth").option("--port <n>", "port to listen on (default: $PORT or 8080)", (v) => parseInt(v, 10)).action(async (opts) => {
+    const { startHttpServer: startHttpServer2 } = await Promise.resolve().then(() => (init_http2(), http_exports));
+    await startHttpServer2({ port: opts.port });
+  });
   program.command("sync").description("run ingestion: refresh scores for the seed list (or one package)").option("--full", "force a full re-sync, ignoring cache TTLs").option("--package <name>", "sync a single package by name").option("--json", "output the run summary as JSON").action(async (opts) => {
     const { runSync: runSync2 } = await Promise.resolve().then(() => (init_pipeline(), pipeline_exports));
     const summary = await runSync2({ full: opts.full, packageName: opts.package });
     if (opts.json) console.log(JSON.stringify(summary, null, 2));
     if (summary.status === "failed") process.exitCode = 1;
   });
-  program.command("recommend").argument("<need>", "natural-language description of what you need").description("recommend the best current packages for a described need").option("--category <category>", "restrict to a taxonomy category").option("--min-confidence <level>", "proven | emerging | unproven").option("--json", "output JSON instead of a table").action(async (need, opts) => {
+  program.command("recommend").argument("<need>", "natural-language description of what you need").description("recommend the best current packages for a described need").option("--category <category>", "restrict to a taxonomy category").option("--min-confidence <level>", "proven | emerging | promising | unproven").option("--json", "output JSON instead of a table").action(async (need, opts) => {
     const { runRecommend: runRecommend2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     await runRecommend2(need, opts);
   });
@@ -2813,14 +3994,53 @@ function buildProgram() {
     const { runVerify: runVerify2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     await runVerify2(pkg, opts);
   });
-  program.command("install-skill").description("register lurq as an MCP server in supported AI assistants").option(
+  program.command("weights").description("show and explain the scoring weight model (health, quality, composite \u03BB)").option("--json", "output the weight model as JSON").action(async (opts) => {
+    const { runWeights: runWeights2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
+    runWeights2(opts);
+  });
+  program.command("edit-weights").description("override, reset, or explain the scoring weights (layered over defaults)").option("--set <pair>", "override key=value, e.g. composite.lambda=0.5 (repeatable)", (v, acc) => acc.concat(v), []).option("--reset", "remove all overrides and restore defaults").option("--explain <component>", "explain a component (e.g. adoption, quality, lambda)").option("--project", "write to project-local .lurq/weights.json instead of the user config").action(async (opts) => {
+    const { runEditWeights: runEditWeights2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
+    runEditWeights2(opts);
+  });
+  program.command("discover").description("operator-side: proactively crawl for new packages and queue/gate them (\xA72B)").option("--cap <n>", "max candidates to fully ingest this run", (v) => parseInt(v, 10)).option("--dry-run", "discover, queue, and gate, but do not ingest survivors").option("--json", "output the discovery summary as JSON").action(async (opts) => {
+    const { requireConfig: requireConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+    requireConfig2(["DATABASE_URL"]);
+    const { runDiscovery: runDiscovery2 } = await Promise.resolve().then(() => (init_pipeline(), pipeline_exports));
+    const summary = await runDiscovery2({ perRunCap: opts.cap, dryRun: opts.dryRun });
+    if (opts.json) console.log(JSON.stringify(summary, null, 2));
+  });
+  program.command("rescore").description("re-derive health scores from cached breakdowns using current weights (no re-ingest)").option("--json", "output the rescore summary as JSON").action(async (opts) => {
+    const { requireConfig: requireConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+    requireConfig2(["DATABASE_URL"]);
+    const { runRescore: runRescore2 } = await Promise.resolve().then(() => (init_pipeline(), pipeline_exports));
+    const summary = await runRescore2();
+    if (opts.json) console.log(JSON.stringify(summary, null, 2));
+  });
+  program.command("install").description("guided setup: connect lurq to your AI assistant(s)").option("--api-key <key>", "hosted API key (skips the prompt)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--agent <agent>", "claude-code | cursor | copilot | windsurf | codex | all").option("--yes", "non-interactive: use flags/env and detected agents without prompting").action(async (opts) => {
+    const { runInstallWizard: runInstallWizard2 } = await Promise.resolve().then(() => (init_install(), install_exports));
+    await runInstallWizard2(opts);
+  });
+  program.command("install-skill").description("register lurq as an MCP server in supported AI assistants (scriptable)").option(
     "--agent <agent>",
     "claude-code | cursor | copilot | windsurf | codex | all",
     "claude-code"
-  ).action(async (opts) => {
+  ).option("--api-key <key>", "hosted API key (remote install; default mode)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--local", "self-host: write a local stdio entry using your own DATABASE_URL").action(async (opts) => {
     const { runInstallSkill: runInstallSkill2 } = await Promise.resolve().then(() => (init_installSkill(), installSkill_exports));
     await runInstallSkill2(opts);
   });
+  const keys = program.command("keys").description("manage API keys for the hosted service (operator; needs DATABASE_URL)");
+  keys.command("create").description("create a new API key (shown once; erased from the terminal after you copy it)").option("--label <label>", "human label (owner / org / purpose)").option("--tier <tier>", "tier name", "free").option("--json", "print the key as JSON and skip the interactive erase (for scripts)").action(async (opts) => {
+    const { runKeysCreate: runKeysCreate2 } = await Promise.resolve().then(() => (init_keys(), keys_exports));
+    await runKeysCreate2(opts);
+  });
+  keys.command("list").description("list issued API keys (hashes are never shown)").option("--json", "output as JSON").action(async (opts) => {
+    const { runKeysList: runKeysList2 } = await Promise.resolve().then(() => (init_keys(), keys_exports));
+    await runKeysList2(opts);
+  });
+  keys.command("revoke").argument("<prefixOrId>", "key prefix (e.g. lurq_live_ab12cd) or numeric id").description("revoke an API key").action(async (prefixOrId) => {
+    const { runKeysRevoke: runKeysRevoke2 } = await Promise.resolve().then(() => (init_keys(), keys_exports));
+    await runKeysRevoke2(prefixOrId);
+  });
   const db = program.command("db").description("database management");
   db.command("migrate").description("apply database migrations and load the seed list").action(async () => {
     const { runMigrate: runMigrate2 } = await Promise.resolve().then(() => (init_migrate(), migrate_exports));
@@ -2840,9 +4060,11 @@ function buildProgram() {
   return program;
 }
 export {
+  API_KEY_PREFIX,
   CACHE_TTL,
   CATEGORIES,
   ConfigError,
+  DEFAULT_ENDPOINT,
   EMBEDDING_DIM,
   FRONTEND_CATEGORIES,
   PACKAGE_NAME,