lurqrun 0.0.1 → 0.0.3

package/dist/index.js

@@ -70,14 +70,16 @@ var init_types = __esm({
 });
 
 // src/core/constants.ts
-var SERVER_NAME, PACKAGE_NAME, VERSION, EMBEDDING_DIM, STALENESS_DAYS, HOUR, DAY, CACHE_TTL;
+var SERVER_NAME, PACKAGE_NAME, VERSION, DEFAULT_ENDPOINT, API_KEY_PREFIX, EMBEDDING_DIM, STALENESS_DAYS, HOUR, DAY, CACHE_TTL;
 var init_constants = __esm({
   "src/core/constants.ts"() {
     "use strict";
     init_esm_shims();
     SERVER_NAME = "lurq";
     PACKAGE_NAME = "lurqrun";
-    VERSION = "0.0.1";
+    VERSION = "0.0.2";
+    DEFAULT_ENDPOINT = "https://api.lurq.run/mcp";
+    API_KEY_PREFIX = "lurq_live_";
     EMBEDDING_DIM = 1536;
     STALENESS_DAYS = 7;
     HOUR = 60 * 60 * 1e3;
@@ -93,6 +95,14 @@ var init_constants = __esm({
 });
 
 // src/core/config.ts
+var config_exports = {};
+__export(config_exports, {
+  ConfigError: () => ConfigError,
+  getConfig: () => getConfig,
+  loadEnv: () => loadEnv,
+  requireConfig: () => requireConfig,
+  resetConfigCache: () => resetConfigCache
+});
 import { config as dotenvConfig } from "dotenv";
 import { z } from "zod";
 function loadEnv() {
@@ -112,6 +122,9 @@ ${issues}`);
   cached = parsed.data;
   return cached;
 }
+function resetConfigCache() {
+  cached = void 0;
+}
 function requireConfig(keys) {
   const config = getConfig();
   const missing = keys.filter((k) => config[k] === void 0 || config[k] === "");
@@ -139,7 +152,18 @@ var init_config = __esm({
       SUMMARY_API_KEY: z.string().min(1).optional(),
       SUMMARY_MODEL: z.string().min(1).default("gpt-4o-mini"),
       LURQ_SYNC_CONCURRENCY: z.coerce.number().int().positive().max(50).default(5),
-      LOG_LEVEL: z.enum(["error", "warn", "info", "debug"]).default("info")
+      LOG_LEVEL: z.enum(["error", "warn", "info", "debug"]).default("info"),
+      // Hosted HTTP service (`serve-http`). Server-side only.
+      PORT: z.coerce.number().int().positive().default(8080),
+      /** Per-API-key rate limit: max requests per window. */
+      LURQ_RATE_LIMIT_MAX: z.coerce.number().int().positive().default(120),
+      /** Coarser per-IP rate limit (blunts unauthenticated floods before auth). */
+      LURQ_IP_RATE_LIMIT_MAX: z.coerce.number().int().positive().default(240),
+      /** Rate-limit window, milliseconds (applies to both limiters). */
+      LURQ_RATE_LIMIT_WINDOW_MS: z.coerce.number().int().positive().default(6e4),
+      // Client-side (install wizard / CLI talking to a remote endpoint).
+      LURQ_ENDPOINT: z.string().url().optional(),
+      LURQ_API_KEY: z.string().min(1).optional()
     });
     ConfigError = class extends Error {
       constructor(message) {
@@ -188,29 +212,44 @@ var init_logger = __esm({
 // src/db/schema.ts
 var schema_exports = {};
 __export(schema_exports, {
+  apiKeys: () => apiKeys,
+  compatEdges: () => compatEdges,
+  discoveryQueue: () => discoveryQueue,
+  packageVersions: () => packageVersions,
   packages: () => packages,
   seedPackages: () => seedPackages,
-  syncRuns: () => syncRuns
+  syncRuns: () => syncRuns,
+  verificationRuns: () => verificationRuns,
+  watchState: () => watchState
 });
+import { sql } from "drizzle-orm";
 import {
   bigint,
   boolean,
+  customType,
   index,
   integer,
   jsonb,
   pgTable,
+  primaryKey,
   real,
   serial,
   text,
   timestamp,
+  uniqueIndex,
   vector
 } from "drizzle-orm/pg-core";
-var ts, packages, syncRuns, seedPackages;
+var tsvector, ts, packages, syncRuns, seedPackages, discoveryQueue, apiKeys, packageVersions, watchState, verificationRuns, compatEdges;
 var init_schema = __esm({
   "src/db/schema.ts"() {
     "use strict";
     init_esm_shims();
     init_constants();
+    tsvector = customType({
+      dataType() {
+        return "tsvector";
+      }
+    });
     ts = (name) => timestamp(name, { withTimezone: true, mode: "date" });
     packages = pgTable(
       "packages",
@@ -220,6 +259,8 @@ var init_schema = __esm({
         ecosystem: text("ecosystem").notNull().default("npm"),
         // Classification + descriptive text
         category: text("category").$type(),
+        /** Whether `category` was hand-curated or inferred at ingest (§2A). */
+        categorySource: text("category_source").$type(),
         description: text("description"),
         summary: text("summary"),
         repoUrl: text("repo_url"),
@@ -235,7 +276,6 @@ var init_schema = __esm({
         // Adoption signals
         weeklyDownloads: bigint("weekly_downloads", { mode: "number" }),
         downloadGrowth90d: real("download_growth_90d"),
-        dependentsCount: integer("dependents_count"),
         stars: integer("stars"),
         openIssues: integer("open_issues"),
         closedIssues: integer("closed_issues"),
@@ -243,12 +283,30 @@ var init_schema = __esm({
         scorecard: real("scorecard"),
         bundleMinGzipKb: real("bundle_min_gzip_kb"),
         advisories: jsonb("advisories").$type(),
+        // Compatibility metadata (Tier-1): declared peer-deps + engines of the
+        // latest version, so a whole-stack peer-range check is one indexed query.
+        peerDependencies: jsonb("peer_dependencies").$type(),
+        peerDependenciesMeta: jsonb("peer_dependencies_meta").$type(),
+        engines: jsonb("engines").$type(),
         // Computed outputs
         healthScore: integer("health_score"),
+        /** Intrinsic-quality axis (§1), adoption-independent. Blends with health at
+         *  ranking time (composite); never folded into health_score itself. */
+        qualityScore: integer("quality_score"),
         confidence: text("confidence").$type(),
         scoreBreakdown: jsonb("score_breakdown").$type(),
         usageGuide: jsonb("usage_guide").$type(),
         embedding: vector("embedding", { dimensions: EMBEDDING_DIM }),
+        // Identity of the vector space `embedding` was produced in (e.g.
+        // `openai:text-embedding-3-small`, `local`). Vector search filters on the
+        // active provider so switching models can't compare incompatible spaces.
+        embeddingProvider: text("embedding_provider"),
+        // Lexical search vector (§3): name weighted highest (A), then category (B),
+        // then summary/description (C). Generated + STORED so it stays in sync with
+        // the row automatically; indexed with GIN for fast `@@` matching.
+        searchVector: tsvector("search_vector").generatedAlwaysAs(
+          sql`setweight(to_tsvector('english', coalesce(name, '')), 'A') || setweight(to_tsvector('english', coalesce(category, '')), 'B') || setweight(to_tsvector('english', coalesce(summary, description, '')), 'C')`
+        ),
         // Freshness + bookkeeping
         dataAsOf: timestamp("data_as_of", { withTimezone: true, mode: "date" }),
         createdAt: ts("created_at").notNull().defaultNow(),
@@ -258,7 +316,9 @@ var init_schema = __esm({
         index("packages_category_idx").on(table2.category),
         index("packages_health_score_idx").on(table2.healthScore),
         // pgvector HNSW index for cosine similarity search (§11).
-        index("packages_embedding_idx").using("hnsw", table2.embedding.op("vector_cosine_ops"))
+        index("packages_embedding_idx").using("hnsw", table2.embedding.op("vector_cosine_ops")),
+        // GIN index for lexical full-text search (§3).
+        index("packages_search_vector_idx").using("gin", table2.searchVector)
       ]
     );
     syncRuns = pgTable("sync_runs", {
@@ -275,6 +335,93 @@ var init_schema = __esm({
       category: text("category").$type(),
       addedAt: ts("added_at").notNull().defaultNow()
     });
+    discoveryQueue = pgTable(
+      "discovery_queue",
+      {
+        id: serial("id").primaryKey(),
+        name: text("name").notNull().unique(),
+        discoveredVia: text("discovered_via").$type().notNull(),
+        /** Lightweight quality-only pre-score (§2B). Null until the gate runs. */
+        preScore: integer("pre_score"),
+        status: text("status").$type().notNull().default("pending"),
+        discoveredAt: ts("discovered_at").notNull().defaultNow()
+      },
+      (table2) => [index("discovery_queue_status_idx").on(table2.status)]
+    );
+    apiKeys = pgTable(
+      "api_keys",
+      {
+        id: serial("id").primaryKey(),
+        /** sha256 hex of the full key — the only form persisted. */
+        keyHash: text("key_hash").notNull().unique(),
+        /** Identifiable display prefix, e.g. `lurq_live_ab12cd` (safe to show/log). */
+        prefix: text("prefix").notNull(),
+        /** Free-text label (owner / org / purpose). */
+        label: text("label"),
+        /** Reserved for self-serve issuance: maps to a Clerk user id. */
+        ownerId: text("owner_id"),
+        tier: text("tier").notNull().default("free"),
+        createdAt: ts("created_at").notNull().defaultNow(),
+        lastUsedAt: ts("last_used_at"),
+        revokedAt: ts("revoked_at")
+      },
+      (table2) => [index("api_keys_owner_idx").on(table2.ownerId)]
+    );
+    packageVersions = pgTable(
+      "package_versions",
+      {
+        packageName: text("package_name").notNull(),
+        version: text("version").notNull(),
+        publishedAt: ts("published_at")
+      },
+      (table2) => [
+        primaryKey({ columns: [table2.packageName, table2.version] }),
+        index("package_versions_name_published_idx").on(table2.packageName, table2.publishedAt)
+      ]
+    );
+    watchState = pgTable("watch_state", {
+      id: text("id").primaryKey(),
+      seq: text("seq").notNull(),
+      updatedAt: ts("updated_at")
+    });
+    verificationRuns = pgTable(
+      "verification_runs",
+      {
+        id: serial("id").primaryKey(),
+        packageName: text("package_name").notNull(),
+        version: text("version").notNull(),
+        driver: text("driver").notNull(),
+        moduleSystem: text("module_system").notNull(),
+        installed: boolean("installed").notNull(),
+        imported: boolean("imported"),
+        ranScripts: boolean("ran_scripts").notNull().default(false),
+        durationMs: integer("duration_ms"),
+        error: text("error"),
+        ranAt: ts("ran_at")
+      },
+      (table2) => [index("verification_runs_pkg_idx").on(table2.packageName, table2.version)]
+    );
+    compatEdges = pgTable(
+      "compat_edges",
+      {
+        id: serial("id").primaryKey(),
+        packageA: text("package_a").notNull(),
+        versionA: text("version_a").notNull(),
+        packageB: text("package_b").notNull(),
+        versionB: text("version_b").notNull(),
+        status: text("status").$type().notNull(),
+        driver: text("driver").notNull(),
+        ranAt: ts("ran_at")
+      },
+      (table2) => [
+        uniqueIndex("compat_edges_pair_idx").on(
+          table2.packageA,
+          table2.versionA,
+          table2.packageB,
+          table2.versionB
+        )
+      ]
+    );
   }
 });
 
@@ -297,6 +444,131 @@ var init_client = __esm({
   }
 });
 
+// src/core/cache.ts
+var cache_exports = {};
+__export(cache_exports, {
+  cached: () => cached2,
+  invalidateCache: () => invalidateCache
+});
+function ttlSeconds() {
+  const n = Number(process.env.LURQ_CACHE_TTL_SEC);
+  return Number.isFinite(n) && n > 0 ? n : DEFAULT_TTL_SEC;
+}
+async function getClient() {
+  if (!process.env.REDIS_URL) return null;
+  if (!clientPromise) {
+    clientPromise = (async () => {
+      try {
+        const { default: Redis } = await import("ioredis");
+        const client = new Redis(process.env.REDIS_URL, {
+          maxRetriesPerRequest: 1,
+          enableOfflineQueue: false,
+          lazyConnect: false,
+          // Railway's private network (redis.railway.internal) is IPv6-only and
+          // ioredis defaults to IPv4 — family:0 lets it resolve either stack, so
+          // both the private URL and a public/Upstash URL work unchanged.
+          family: 0
+        });
+        client.on("error", (err) => logger.warn(`redis: ${err.message}`));
+        logger.info("Response cache enabled (REDIS_URL set).");
+        return client;
+      } catch (err) {
+        logger.warn(`redis disabled (init failed): ${err.message}`);
+        return null;
+      }
+    })();
+  }
+  return clientPromise;
+}
+async function namespaceVersion(client) {
+  if (versionMemo && Date.now() - versionMemo.at < VERSION_MEMO_MS) return versionMemo.value;
+  const value = await client.get(VERSION_KEY).catch(() => null) ?? "0";
+  versionMemo = { value, at: Date.now() };
+  return value;
+}
+async function cached2(namespace, key, compute, opts = {}) {
+  const client = await getClient();
+  if (!client) return compute();
+  let fullKey;
+  try {
+    const version = await namespaceVersion(client);
+    fullKey = `lurq:${namespace}:${version}:${key}`;
+    const hit = await client.get(fullKey);
+    if (hit != null) return JSON.parse(hit);
+  } catch (err) {
+    logger.warn(`redis read failed, bypassing cache: ${err.message}`);
+    return compute();
+  }
+  const value = await compute();
+  if (!opts.skipCache?.(value)) {
+    client.set(fullKey, JSON.stringify(value), "EX", ttlSeconds()).catch(() => {
+    });
+  }
+  return value;
+}
+async function invalidateCache() {
+  const client = await getClient();
+  if (!client) return;
+  try {
+    await client.incr(VERSION_KEY);
+    versionMemo = null;
+  } catch (err) {
+    logger.warn(`redis invalidate failed: ${err.message}`);
+  }
+}
+var VERSION_KEY, DEFAULT_TTL_SEC, VERSION_MEMO_MS, clientPromise, versionMemo;
+var init_cache = __esm({
+  "src/core/cache.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_logger();
+    VERSION_KEY = "lurq:cachever";
+    DEFAULT_TTL_SEC = 3600;
+    VERSION_MEMO_MS = 1e4;
+    clientPromise = null;
+    versionMemo = null;
+  }
+});
+
+// src/db/compat.ts
+import { and, inArray } from "drizzle-orm";
+async function getCompatMetadata(db, names) {
+  if (names.length === 0) return [];
+  return db.select({
+    name: packages.name,
+    latestVersion: packages.latestVersion,
+    peerDependencies: packages.peerDependencies,
+    peerDependenciesMeta: packages.peerDependenciesMeta,
+    engines: packages.engines
+  }).from(packages).where(inArray(packages.name, names));
+}
+function canonicalPair(a, b) {
+  const [low, high] = a.name <= b.name ? [a, b] : [b, a];
+  return { packageA: low.name, versionA: low.version, packageB: high.name, versionB: high.version };
+}
+async function upsertCompatEdge(db, edge) {
+  await db.insert(compatEdges).values(edge).onConflictDoUpdate({
+    target: [
+      compatEdges.packageA,
+      compatEdges.versionA,
+      compatEdges.packageB,
+      compatEdges.versionB
+    ],
+    set: { status: edge.status, driver: edge.driver, ranAt: edge.ranAt }
+  });
+}
+async function getCompatEdges(db, names) {
+  if (names.length === 0) return [];
+  return db.select().from(compatEdges).where(and(inArray(compatEdges.packageA, names), inArray(compatEdges.packageB, names)));
+}
+var init_compat = __esm({
+  "src/db/compat.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_schema();
+  }
+});
+
 // src/core/http.ts
 import { createHash } from "crypto";
 import { mkdir, readFile, writeFile } from "fs/promises";
@@ -361,9 +633,9 @@ async function httpRequest(url, opts) {
   } = opts;
   const key = opts.cacheKey ?? `${method} ${url} ${body ?? ""}`;
   if (ttlMs > 0 && !bypassCacheRead) {
-    const cached2 = await readCache(key, ttlMs);
-    if (cached2) {
-      return { status: cached2.status, data: decode(cached2.body, accept), fromCache: true };
+    const cached3 = await readCache(key, ttlMs);
+    if (cached3) {
+      return { status: cached3.status, data: decode(cached3.body, accept), fromCache: true };
     }
   }
   const limiter = limiterFor(host);
@@ -530,8 +802,9 @@ function parseNpmRegistry(json2) {
   const { repoUrl, repo } = normalizeRepoUrl(repository, homepage);
   const deprecated = Boolean(latestManifest?.deprecated ?? json2?.deprecated);
   const maintainers = Array.isArray(json2?.maintainers) ? json2.maintainers.length : null;
+  const name = json2?.name ?? "";
   return {
-    name: json2?.name ?? "",
+    name,
     description: json2?.description ?? latestManifest?.description ?? null,
     latestVersion: latest,
     license: pickLicense(json2?.license ?? latestManifest?.license),
@@ -542,9 +815,76 @@ function parseNpmRegistry(json2) {
     lastReleaseAt: toDate(latest ? time?.[latest] : null) ?? toDate(time?.modified),
     deprecated,
     maintainersCount: maintainers,
-    readme: typeof json2?.readme === "string" ? json2.readme : null
+    readme: typeof json2?.readme === "string" ? json2.readme : null,
+    keywords: parseKeywords(json2?.keywords ?? latestManifest?.keywords),
+    hasTypes: detectTypes(name, latestManifest),
+    hasTestScript: detectTestScript(latestManifest),
+    directDependenciesCount: countDeps(latestManifest?.dependencies),
+    hasProvenance: detectProvenance(latestManifest),
+    hasInstallScripts: detectInstallScripts(latestManifest),
+    peerDependencies: parseDepMap(latestManifest?.peerDependencies),
+    peerDependenciesMeta: parsePeerMeta(latestManifest?.peerDependenciesMeta),
+    engines: parseDepMap(latestManifest?.engines),
+    versionTimeline: parseVersionTimeline(json2)
   };
 }
+function parseDepMap(value) {
+  if (!value || typeof value !== "object") return null;
+  const out = {};
+  for (const [name, range] of Object.entries(value)) {
+    if (typeof range === "string" && range.trim() !== "") out[name] = range;
+  }
+  return Object.keys(out).length ? out : null;
+}
+function parsePeerMeta(value) {
+  if (!value || typeof value !== "object") return null;
+  const out = {};
+  for (const [name, meta] of Object.entries(value)) {
+    if (meta && typeof meta === "object" && "optional" in meta) {
+      out[name] = { optional: Boolean(meta.optional) };
+    }
+  }
+  return Object.keys(out).length ? out : null;
+}
+function detectInstallScripts(manifest) {
+  const scripts = manifest?.scripts;
+  if (!scripts || typeof scripts !== "object") return false;
+  return ["preinstall", "install", "postinstall"].some(
+    (hook) => typeof scripts[hook] === "string" && scripts[hook].trim() !== ""
+  );
+}
+function parseVersionTimeline(json2) {
+  const versions = json2?.versions;
+  if (!versions || typeof versions !== "object") return [];
+  const time = json2?.time ?? {};
+  return Object.keys(versions).map((version) => ({ version, publishedAt: toDate(time?.[version]) })).sort((a, b) => (b.publishedAt?.getTime() ?? 0) - (a.publishedAt?.getTime() ?? 0));
+}
+function parseKeywords(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((k) => typeof k === "string");
+}
+function detectTypes(name, manifest) {
+  if (typeof manifest?.types === "string" || typeof manifest?.typings === "string") return true;
+  if (name.startsWith("@types/")) return true;
+  const exportsField = manifest?.exports;
+  if (exportsField && typeof exportsField === "object") {
+    const serialized = JSON.stringify(exportsField);
+    if (serialized.includes('"types"')) return true;
+  }
+  return false;
+}
+function detectTestScript(manifest) {
+  const test = manifest?.scripts?.test;
+  if (typeof test !== "string" || test.trim() === "") return false;
+  return !/no test specified/i.test(test);
+}
+function countDeps(deps) {
+  if (!deps || typeof deps !== "object") return 0;
+  return Object.keys(deps).length;
+}
+function detectProvenance(manifest) {
+  return Boolean(manifest?.dist?.attestations);
+}
 async function fetchNpmRegistry(name, fetchImpl) {
   const url = `https://${HOST}/${encodeNpmName(name)}`;
   const { data } = await httpGetJson(url, {
@@ -582,6 +922,32 @@ var init_npmRegistry = __esm({
   }
 });
 
+// src/ingestion/sources/npmSearch.ts
+async function searchNpm(query, size = 20, fetchImpl) {
+  const url = `https://${HOST2}/-/v1/search?text=${encodeURIComponent(query)}&size=${size}`;
+  try {
+    const { data } = await httpGetJson(url, {
+      host: HOST2,
+      ttlMs: CACHE_TTL.npmRegistry,
+      fetchImpl
+    });
+    const objects = Array.isArray(data?.objects) ? data.objects : [];
+    return objects.map((o) => ({ name: o?.package?.name, date: o?.package?.date ?? null })).filter((h) => typeof h.name === "string");
+  } catch {
+    return [];
+  }
+}
+var HOST2;
+var init_npmSearch = __esm({
+  "src/ingestion/sources/npmSearch.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_constants();
+    init_http();
+    HOST2 = "registry.npmjs.org";
+  }
+});
+
 // src/ingestion/sources/npmDownloads.ts
 function parseWeeklyDownloads(json2) {
   const value = json2?.downloads;
@@ -627,8 +993,8 @@ function chunk(items, size) {
 async function fetchWeeklyDownloads(name, fetchImpl) {
   try {
     const { data } = await httpGetJson(
-      `https://${HOST2}/downloads/point/last-week/${name}`,
-      { host: HOST2, ttlMs: CACHE_TTL.npmDownloads, retries: 5, fetchImpl }
+      `https://${HOST3}/downloads/point/last-week/${name}`,
+      { host: HOST3, ttlMs: CACHE_TTL.npmDownloads, retries: 5, fetchImpl }
     );
     return parseWeeklyDownloads(data);
   } catch (err) {
@@ -639,8 +1005,8 @@ async function fetchWeeklyDownloads(name, fetchImpl) {
 async function fetchDownloadGrowth(name, fetchImpl) {
   try {
     const { data } = await httpGetJson(
-      `https://${HOST2}/downloads/range/${last90DayRange()}/${name}`,
-      { host: HOST2, ttlMs: CACHE_TTL.npmDownloads, retries: 3, fetchImpl }
+      `https://${HOST3}/downloads/range/${last90DayRange()}/${name}`,
+      { host: HOST3, ttlMs: CACHE_TTL.npmDownloads, retries: 3, fetchImpl }
     );
     return parseDownloadGrowth(data);
   } catch {
@@ -654,8 +1020,8 @@ async function fetchBulkWeeklyDownloads(names, fetchImpl) {
   for (const batch of chunk(unscoped, BULK_CHUNK)) {
     try {
       const { data } = await httpGetJson(
-        `https://${HOST2}/downloads/point/last-week/${batch.join(",")}`,
-        { host: HOST2, ttlMs: CACHE_TTL.npmDownloads, retries: 5, fetchImpl }
+        `https://${HOST3}/downloads/point/last-week/${batch.join(",")}`,
+        { host: HOST3, ttlMs: CACHE_TTL.npmDownloads, retries: 5, fetchImpl }
       );
       for (const [k, v] of parseBulkWeekly(data, batch)) result.set(k, v);
     } catch {
@@ -669,14 +1035,14 @@ async function fetchBulkWeeklyDownloads(names, fetchImpl) {
   }
   return result;
 }
-var HOST2, BULK_CHUNK;
+var HOST3, BULK_CHUNK;
 var init_npmDownloads = __esm({
   "src/ingestion/sources/npmDownloads.ts"() {
     "use strict";
     init_esm_shims();
     init_constants();
     init_http();
-    HOST2 = "api.npmjs.org";
+    HOST3 = "api.npmjs.org";
     BULK_CHUNK = 128;
   }
 });
@@ -700,7 +1066,7 @@ function parseGithub(json2, now = /* @__PURE__ */ new Date()) {
 async function fetchGithubRepo(owner, repo, token, fetchImpl) {
   const body = JSON.stringify({ query: QUERY, variables: { owner, name: repo } });
   const { data } = await httpRequest(ENDPOINT, {
-    host: HOST3,
+    host: HOST4,
     ttlMs: CACHE_TTL.github,
     method: "POST",
     headers: {
@@ -715,15 +1081,15 @@ async function fetchGithubRepo(owner, repo, token, fetchImpl) {
   });
   return parseGithub(data);
 }
-var HOST3, ENDPOINT, QUERY, ONE_YEAR_MS;
+var HOST4, ENDPOINT, QUERY, ONE_YEAR_MS;
 var init_github = __esm({
   "src/ingestion/sources/github.ts"() {
     "use strict";
     init_esm_shims();
     init_constants();
     init_http();
-    HOST3 = "api.github.com";
-    ENDPOINT = `https://${HOST3}/graphql`;
+    HOST4 = "api.github.com";
+    ENDPOINT = `https://${HOST4}/graphql`;
     QUERY = `query($owner:String!, $name:String!) {
   repository(owner:$owner, name:$name) {
     stargazerCount
@@ -769,10 +1135,10 @@ function parseAdvisoryDetail(json2) {
 }
 async function fetchScorecard(owner, repo, fetchImpl) {
   const projectKey = encodeURIComponent(`github.com/${owner}/${repo}`);
-  const url = `https://${HOST4}/v3/projects/${projectKey}`;
+  const url = `https://${HOST5}/v3/projects/${projectKey}`;
   try {
     const { data } = await httpGetJson(url, {
-      host: HOST4,
+      host: HOST5,
       ttlMs: CACHE_TTL.depsDev,
       fetchImpl
     });
@@ -782,11 +1148,11 @@ async function fetchScorecard(owner, repo, fetchImpl) {
   }
 }
 async function fetchAdvisories(name, version, fetchImpl) {
-  const versionUrl = `https://${HOST4}/v3/systems/npm/packages/${encodeName(name)}/versions/${encodeURIComponent(version)}`;
+  const versionUrl = `https://${HOST5}/v3/systems/npm/packages/${encodeName(name)}/versions/${encodeURIComponent(version)}`;
   let keys = [];
   try {
     const { data } = await httpGetJson(versionUrl, {
-      host: HOST4,
+      host: HOST5,
       ttlMs: CACHE_TTL.depsDev,
       fetchImpl
     });
@@ -796,8 +1162,8 @@ async function fetchAdvisories(name, version, fetchImpl) {
   }
   const details = await Promise.allSettled(
     keys.map(
-      (key) => httpGetJson(`https://${HOST4}/v3/advisories/${encodeURIComponent(key)}`, {
-        host: HOST4,
+      (key) => httpGetJson(`https://${HOST5}/v3/advisories/${encodeURIComponent(key)}`, {
+        host: HOST5,
         ttlMs: CACHE_TTL.depsDev,
         fetchImpl
       })
@@ -807,6 +1173,21 @@ async function fetchAdvisories(name, version, fetchImpl) {
     (d) => d.status === "fulfilled"
   ).map((d) => parseAdvisoryDetail(d.value.data));
 }
+async function fetchDependencyNames(name, version, fetchImpl) {
+  const url = `https://${HOST5}/v3/systems/npm/packages/${encodeName(name)}/versions/${encodeURIComponent(version)}:dependencies`;
+  try {
+    const { data } = await httpGetJson(url, {
+      host: HOST5,
+      ttlMs: CACHE_TTL.depsDev,
+      fetchImpl
+    });
+    const nodes = Array.isArray(data?.nodes) ? data.nodes : [];
+    const names = nodes.map((n) => n?.versionKey?.name).filter((n) => typeof n === "string" && n !== name);
+    return [...new Set(names)];
+  } catch {
+    return [];
+  }
+}
 async function fetchDepsDev(name, version, repo, fetchImpl) {
   const [scorecard, advisories] = await Promise.all([
     repo ? fetchScorecard(repo.owner, repo.repo, fetchImpl) : Promise.resolve(null),
@@ -814,14 +1195,14 @@ async function fetchDepsDev(name, version, repo, fetchImpl) {
   ]);
   return { scorecard, advisories };
 }
-var HOST4, MAX_ADVISORIES;
+var HOST5, MAX_ADVISORIES;
 var init_depsDev = __esm({
   "src/ingestion/sources/depsDev.ts"() {
     "use strict";
     init_esm_shims();
     init_constants();
     init_http();
-    HOST4 = "api.deps.dev";
+    HOST5 = "api.deps.dev";
     MAX_ADVISORIES = 10;
   }
 });
@@ -834,10 +1215,10 @@ function parseBundleSize(json2) {
 }
 async function fetchBundlephobia(name, category, fetchImpl) {
   if (!isFrontendCategory(category)) return { bundleMinGzipKb: null };
-  const url = `https://${HOST5}/api/size?package=${encodeURIComponent(name)}`;
+  const url = `https://${HOST6}/api/size?package=${encodeURIComponent(name)}`;
   try {
     const { data } = await httpGetJson(url, {
-      host: HOST5,
+      host: HOST6,
       ttlMs: CACHE_TTL.bundlephobia,
       timeoutMs: 12e3,
       retries: 1,
@@ -848,7 +1229,7 @@ async function fetchBundlephobia(name, category, fetchImpl) {
     return { bundleMinGzipKb: null };
   }
 }
-var HOST5;
+var HOST6;
 var init_bundlephobia = __esm({
   "src/ingestion/sources/bundlephobia.ts"() {
     "use strict";
@@ -856,7 +1237,7 @@ var init_bundlephobia = __esm({
     init_constants();
     init_http();
     init_types();
-    HOST5 = "bundlephobia.com";
+    HOST6 = "bundlephobia.com";
   }
 });
 
@@ -866,6 +1247,7 @@ var init_sources = __esm({
     "use strict";
     init_esm_shims();
     init_npmRegistry();
+    init_npmSearch();
     init_npmDownloads();
     init_github();
     init_depsDev();
@@ -873,13 +1255,255 @@ var init_sources = __esm({
   }
 });
 
+// src/compat/members.ts
+async function assembleMembers(db, names) {
+  const tracked = new Map((await getCompatMetadata(db, names)).map((r) => [r.name, r]));
+  const members = [];
+  const unverified = [];
+  await Promise.all(
+    names.map(async (name) => {
+      const row = tracked.get(name);
+      if (row) {
+        members.push({
+          name,
+          version: row.latestVersion,
+          peerDependencies: row.peerDependencies,
+          peerDependenciesMeta: row.peerDependenciesMeta,
+          engines: row.engines
+        });
+        return;
+      }
+      const reg = await fetchNpmRegistry(name).catch(() => null);
+      if (reg) {
+        members.push({
+          name,
+          version: reg.latestVersion,
+          peerDependencies: reg.peerDependencies,
+          peerDependenciesMeta: reg.peerDependenciesMeta,
+          engines: reg.engines
+        });
+      } else {
+        unverified.push(name);
+      }
+    })
+  );
+  return { members, unverified };
+}
+var init_members = __esm({
+  "src/compat/members.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_compat();
+    init_sources();
+  }
+});
+
+// src/compat/peerCompat.ts
+import semver from "semver";
+function satisfiesRange(version, range) {
+  if (!semver.validRange(range)) return null;
+  const v = semver.valid(version) ? version : semver.coerce(version)?.version;
+  if (!v) return null;
+  return semver.satisfies(v, range, { includePrerelease: true });
+}
+function rangesIntersect(a, b) {
+  if (!semver.validRange(a) || !semver.validRange(b)) return null;
+  try {
+    return semver.intersects(a, b, { includePrerelease: true });
+  } catch {
+    return null;
+  }
+}
+function resolveArchitectureCompat(members) {
+  const conflicts = [];
+  const pinned = /* @__PURE__ */ new Map();
+  for (const m of members) if (m.version) pinned.set(m.name, m.version);
+  const constraints = [];
+  for (const m of members) {
+    if (!m.peerDependencies) continue;
+    for (const [peer, range] of Object.entries(m.peerDependencies)) {
+      constraints.push({
+        requirer: m.name,
+        peer,
+        range,
+        optional: Boolean(m.peerDependenciesMeta?.[peer]?.optional)
+      });
+    }
+  }
+  for (const c of constraints) {
+    const pv = pinned.get(c.peer);
+    if (pv && satisfiesRange(pv, c.range) === false) {
+      conflicts.push({
+        source: "peer-deps",
+        packages: [c.requirer, c.peer],
+        detail: `${c.requirer} needs peer ${c.peer}@${c.range}, but the stack uses ${c.peer}@${pv}`
+      });
+    }
+  }
+  const byPeer = /* @__PURE__ */ new Map();
+  for (const c of constraints) {
+    if (pinned.has(c.peer) || c.optional) continue;
+    const arr = byPeer.get(c.peer);
+    if (arr) arr.push(c);
+    else byPeer.set(c.peer, [c]);
+  }
+  for (const [peer, cs] of byPeer) {
+    for (let i = 0; i < cs.length; i++) {
+      for (let j = i + 1; j < cs.length; j++) {
+        if (cs[i].range !== cs[j].range && rangesIntersect(cs[i].range, cs[j].range) === false) {
+          conflicts.push({
+            source: "peer-deps",
+            packages: [cs[i].requirer, cs[j].requirer],
+            detail: `${cs[i].requirer} needs ${peer}@${cs[i].range} but ${cs[j].requirer} needs ${peer}@${cs[j].range} \u2014 no overlapping version`
+          });
+        }
+      }
+    }
+  }
+  const nodeReqs = members.map((m) => ({ name: m.name, range: m.engines?.node })).filter((r) => typeof r.range === "string");
+  for (let i = 0; i < nodeReqs.length; i++) {
+    for (let j = i + 1; j < nodeReqs.length; j++) {
+      if (rangesIntersect(nodeReqs[i].range, nodeReqs[j].range) === false) {
+        conflicts.push({
+          source: "engines",
+          packages: [nodeReqs[i].name, nodeReqs[j].name],
+          detail: `${nodeReqs[i].name} needs node ${nodeReqs[i].range} but ${nodeReqs[j].name} needs node ${nodeReqs[j].range} \u2014 no overlap`
+        });
+      }
+    }
+  }
+  return conflicts;
+}
+var init_peerCompat = __esm({
+  "src/compat/peerCompat.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/compat/check.ts
+async function checkCompat(db, packages2) {
+  const names = [...new Set(packages2)];
+  const { members, unverified } = await assembleMembers(db, names);
+  const conflicts = resolveArchitectureCompat(members);
+  for (const edge of await getCompatEdges(db, names)) {
+    if (edge.status === "conflict") {
+      conflicts.push({
+        source: "sandbox",
+        packages: [edge.packageA, edge.packageB],
+        detail: `${edge.packageA}@${edge.versionA} and ${edge.packageB}@${edge.versionB} failed to co-install in the sandbox`
+      });
+    }
+  }
+  const overall = conflicts.length ? "conflict" : unverified.length ? "unknown" : "compatible";
+  return {
+    packages: names,
+    overall,
+    conflicts,
+    unverified,
+    checked: members.map((m) => ({ name: m.name, version: m.version }))
+  };
+}
+var init_check = __esm({
+  "src/compat/check.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_compat();
+    init_members();
+    init_peerCompat();
+  }
+});
+
+// src/db/packages.ts
+import { desc, eq, isNotNull } from "drizzle-orm";
+async function getSeedTargets(db) {
+  const rows = await db.select({ name: seedPackages.name, category: seedPackages.category }).from(seedPackages);
+  return rows.map((r) => ({ name: r.name, category: r.category ?? null }));
+}
+async function getPackageByName(db, name) {
+  const rows = await db.select().from(packages).where(eq(packages.name, name)).limit(1);
+  return rows[0] ?? null;
+}
+async function getAllPackageNames(db) {
+  const rows = await db.select({ name: packages.name }).from(packages);
+  return rows.map((r) => r.name);
+}
+async function upsertPackageVersions(db, name, versions) {
+  if (versions.length === 0) return;
+  for (let i = 0; i < versions.length; i += VERSION_CHUNK) {
+    const rows = versions.slice(i, i + VERSION_CHUNK).map((v) => ({
+      packageName: name,
+      version: v.version,
+      publishedAt: v.publishedAt
+    }));
+    await db.insert(packageVersions).values(rows).onConflictDoNothing();
+  }
+}
+async function getPackageVersions(db, name, limit = 50) {
+  const rows = await db.select({ version: packageVersions.version, publishedAt: packageVersions.publishedAt }).from(packageVersions).where(eq(packageVersions.packageName, name)).orderBy(desc(packageVersions.publishedAt)).limit(limit);
+  return rows.map((r) => ({ version: r.version, publishedAt: r.publishedAt }));
+}
+async function getTopPackageNames(db, limit = 1e3) {
+  const rows = await db.select({ name: packages.name }).from(packages).where(isNotNull(packages.weeklyDownloads)).orderBy(desc(packages.weeklyDownloads)).limit(limit);
+  return rows.map((r) => r.name);
+}
+async function ensureSeedEntry(db, name, category) {
+  await db.insert(seedPackages).values({ name, category }).onConflictDoNothing({ target: seedPackages.name });
+}
+async function upsertPackage(db, row) {
+  const { name: _name, createdAt: _createdAt, ...mutable } = row;
+  await db.insert(packages).values(row).onConflictDoUpdate({
+    target: packages.name,
+    set: { ...mutable, updatedAt: /* @__PURE__ */ new Date() }
+  });
+}
+async function startSyncRun(db) {
+  const [row] = await db.insert(syncRuns).values({ status: "running" }).returning({ id: syncRuns.id });
+  return row.id;
+}
+async function finishSyncRun(db, id, data) {
+  await db.update(syncRuns).set({
+    finishedAt: /* @__PURE__ */ new Date(),
+    packagesSeen: data.packagesSeen,
+    packagesUpdated: data.packagesUpdated,
+    errors: data.errors,
+    status: data.status
+  }).where(eq(syncRuns.id, id));
+}
+var VERSION_CHUNK;
+var init_packages = __esm({
+  "src/db/packages.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_schema();
+    VERSION_CHUNK = 500;
+  }
+});
+
+// src/db/verification.ts
+import { and as and2, desc as desc2, eq as eq2 } from "drizzle-orm";
+async function storeVerificationRun(db, run) {
+  await db.insert(verificationRuns).values(run);
+}
+async function getLatestVerificationByName(db, packageName) {
+  const rows = await db.select().from(verificationRuns).where(eq2(verificationRuns.packageName, packageName)).orderBy(desc2(verificationRuns.ranAt)).limit(1);
+  return rows[0] ?? null;
+}
+var init_verification = __esm({
+  "src/db/verification.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_schema();
+  }
+});
+
 // src/ingestion/sources/githubReadme.ts
 async function fetchGithubReadme(owner, repo, fetchImpl) {
   for (const file of CANDIDATES) {
-    const url = `https://${HOST6}/${owner}/${repo}/HEAD/${file}`;
+    const url = `https://${HOST7}/${owner}/${repo}/HEAD/${file}`;
     try {
       const { data } = await httpRequest(url, {
-        host: HOST6,
+        host: HOST7,
         ttlMs: CACHE_TTL.github,
         accept: "text",
         retries: 0,
@@ -891,14 +1515,14 @@ async function fetchGithubReadme(owner, repo, fetchImpl) {
   }
   return null;
 }
-var HOST6, CANDIDATES;
+var HOST7, CANDIDATES;
 var init_githubReadme = __esm({
   "src/ingestion/sources/githubReadme.ts"() {
     "use strict";
     init_esm_shims();
     init_constants();
     init_http();
-    HOST6 = "raw.githubusercontent.com";
+    HOST7 = "raw.githubusercontent.com";
     CANDIDATES = ["README.md", "readme.md", "README.markdown", "README"];
   }
 });
@@ -915,6 +1539,7 @@ function truncateSentences(text2, max = 3) {
 }
 function buildUserPrompt(input) {
   const readme = (input.readme ?? "").slice(0, 4e3);
+  const needsCategory = input.category == null;
   return [
     `Package: ${input.name}`,
     `Category: ${input.category ?? "unknown"}`,
@@ -928,7 +1553,8 @@ ${readme || "(none)"}`,
     '- "whenToUse": one sentence on the ideal use case.',
     '- "whenNotToUse": one sentence on when to pick something else (or "").',
     '- "whereItFits": one sentence on its architectural role.',
-    '- "howToWireIn": one short sentence on the minimal setup (install + entry point), or "".'
+    '- "howToWireIn": one short sentence on the minimal setup (install + entry point), or "".',
+    ...needsCategory ? [`- "category": the single best fit from this list: ${CATEGORIES.join(", ")}.`] : []
   ].join("\n");
 }
 function str(value) {
@@ -962,6 +1588,7 @@ var init_summarize = __esm({
   "src/ingestion/summarize.ts"() {
     "use strict";
     init_esm_shims();
+    init_types();
     init_config();
     init_http();
     init_logger();
@@ -1003,7 +1630,7 @@ var init_summarize = __esm({
           whereItFits: `Sits at ${role}.`,
           context7Hint: context7Hint(input.name)
         };
-        return { summary, usageGuide: guide };
+        return { summary, usageGuide: guide, inferredCategory: null };
       }
     };
     SYSTEM_PROMPT = "You summarize npm packages factually for an AI coding agent choosing dependencies. Use ONLY the provided README/description. Never invent capabilities or APIs. Be concise and concrete. Respond with a JSON object.";
@@ -1051,7 +1678,13 @@ var init_summarize = __esm({
             howToWireIn: str(parsed.howToWireIn) || void 0,
             context7Hint: context7Hint(input.name)
           };
-          return { summary: str(parsed.summary) ? truncateSentences(parsed.summary, 3) : null, usageGuide: guide };
+          const rawCategory = str(parsed.category);
+          const inferredCategory = rawCategory && isCategory(rawCategory) ? rawCategory : null;
+          return {
+            summary: str(parsed.summary) ? truncateSentences(parsed.summary, 3) : null,
+            usageGuide: guide,
+            inferredCategory
+          };
         } catch (err) {
           logger.warn(`summary LLM failed for ${input.name}, using fallback: ${err.message}`);
           return new FallbackSummaryProvider().generate(input);
@@ -1103,47 +1736,256 @@ var init_collect = __esm({
   }
 });
 
-// src/scoring/weights.ts
-var HEALTH_WEIGHTS, MAINTENANCE_WEIGHTS, MAINTENANCE, ADOPTION, RELIABILITY, EFFICIENCY, CONFIDENCE;
-var init_weights = __esm({
-  "src/scoring/weights.ts"() {
+// src/search/categoryInference.ts
+function inferCategory(need) {
+  const text2 = need.toLowerCase();
+  for (const rule of RULES) {
+    if (rule.patterns.test(text2)) return rule.category;
+  }
+  return null;
+}
+function inferCategoryFromSignals(signals) {
+  const r = signals.registry;
+  const keywords = (r?.keywords ?? []).join(" ");
+  const text2 = [
+    signals.name,
+    keywords,
+    keywords,
+    // weight keywords higher via repetition
+    r?.description ?? "",
+    (r?.readme ?? "").slice(0, 600)
+  ].filter(Boolean).join(" ");
+  return inferCategory(text2);
+}
+var RULES;
+var init_categoryInference = __esm({
+  "src/search/categoryInference.ts"() {
     "use strict";
     init_esm_shims();
-    HEALTH_WEIGHTS = {
-      maintenance: 0.35,
-      adoption: 0.3,
-      reliability: 0.25,
-      efficiency: 0.1
-    };
-    MAINTENANCE_WEIGHTS = {
-      recency: 0.5,
-      cadence: 0.25,
-      closeRatio: 0.25
-    };
-    MAINTENANCE = {
-      /** A release within this many days scores full recency. */
-      freshDays: 30,
-      /** Recency decays linearly to 0 by this many days (~24 months). */
-      staleDays: 730,
-      /** Releases/12mo at or above this cap full cadence. */
-      cadenceCap: 12,
-      /** deprecated/archived hard-cap maintenance at this value. */
-      deadCap: 15
-    };
-    ADOPTION = {
-      /** log10(weekly downloads): this maps to 0. */
-      downloadsLogMin: 1,
-      // 10/wk
-      /** log10(weekly downloads): this maps to 100. */
-      downloadsLogMax: 7,
-      // 10M/wk
-      /** log10(stars) that maps to 100. */
-      starsLogMax: 5,
-      // 100k stars
-      /** Weight of the stars component when available (downloads gets the rest). */
-      starsWeight: 0.2,
-      /** Growth bonus: growth fraction × this, clamped to ±cap. */
-      growthMultiplier: 30,
+    RULES = [
+      { category: "meta-framework", patterns: /\b(meta-?framework|next\.?js|nuxt|remix|astro|gatsby|sveltekit|full-?stack framework)\b/ },
+      { category: "state-management", patterns: /\b(state management|global state|store|redux|zustand|jotai|mobx|atoms?)\b/ },
+      { category: "routing", patterns: /\b(rout(e|er|ing)|navigation|url matching)\b/ },
+      { category: "orm", patterns: /\b(orm|object-?relational|query builder|prisma|drizzle|sequelize|typeorm)\b/ },
+      { category: "database-client", patterns: /\b(database (driver|client)|postgres|mysql|mongo(db)?|redis|sqlite|db driver)\b/ },
+      { category: "ui-component-library", patterns: /\b(component library|ui kit|ui components?|design system|buttons?|modal|dialog)\b/ },
+      { category: "styling", patterns: /\b(styl(e|ing)|css|tailwind|sass|scss|class ?names?|theme)\b/ },
+      { category: "forms", patterns: /\b(forms?|form (state|library|handling)|input handling)\b/ },
+      { category: "validation", patterns: /\b(validat(e|ion|or)|schema|parse input|type ?safe parsing)\b/ },
+      { category: "data-fetching", patterns: /\b(data fetching|server state|react query|swr|graphql client|caching queries)\b/ },
+      { category: "http-client", patterns: /\b(http client|fetch wrapper|rest client|make (a )?request|ajax|api calls?)\b/ },
+      { category: "auth", patterns: /\b(auth(entication|orization)?|login|session|jwt|oauth|password hashing)\b/ },
+      { category: "testing", patterns: /\b(test(ing|s)?|unit test|e2e|assertion|mocking|test runner)\b/ },
+      { category: "bundler", patterns: /\b(bundler|bundle (modules?|code)|webpack|rollup|esbuild|parcel)\b/ },
+      { category: "build-tool", patterns: /\b(build tool|dev server|monorepo|task runner|compile|transpile)\b/ },
+      // date-time precedes linting: "date formatting" must not be captured by linting's
+      // bare "formatting" token before the date rule is reached (first-match-wins).
+      { category: "date-time", patterns: /\b(dates?|date ?time|time(zone)?s?|calendar|parse dates?|format dates?)\b/ },
+      { category: "linting", patterns: /\b(lint(er|ing)?|formatter|formatting|code (quality|style|format)|prettier|eslint)\b/ },
+      { category: "animation", patterns: /\b(animat(e|ion)|motion|transition|spring|gsap|3d)\b/ },
+      { category: "charts", patterns: /\b(charts?|graphs?|data ?vis(ualization)?|plots?|dashboards?)\b/ },
+      { category: "i18n", patterns: /\b(i18n|internationali[sz]ation|localization|translat(e|ion)|locale)\b/ },
+      { category: "framework", patterns: /\b(framework|react|vue|svelte|angular|web server|backend framework)\b/ },
+      { category: "utility", patterns: /\b(debounce|throttle|deep ?clone|slugify|uuid|util(ity|ities)?|helper|lodash|retry)\b/ }
+    ];
+  }
+});
+
+// src/core/paths.ts
+import { existsSync as existsSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function packageRoot() {
+  if (cachedRoot) return cachedRoot;
+  let dir = dirname2(fileURLToPath2(import.meta.url));
+  for (; ; ) {
+    if (existsSync2(join2(dir, "package.json"))) {
+      cachedRoot = dir;
+      return dir;
+    }
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  cachedRoot = process.cwd();
+  return cachedRoot;
+}
+function migrationsDir() {
+  return join2(packageRoot(), "drizzle");
+}
+function seedJsonPath() {
+  return join2(packageRoot(), "src", "data", "seed.json");
+}
+function userWeightsPath() {
+  const base = process.env.XDG_CONFIG_HOME || join2(homedir2(), ".config");
+  return join2(base, "lurq", "weights.json");
+}
+function projectWeightsPath() {
+  return join2(process.cwd(), ".lurq", "weights.json");
+}
+var cachedRoot;
+var init_paths = __esm({
+  "src/core/paths.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/scoring/weights.ts
+import { existsSync as existsSync3, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { dirname as dirname3 } from "path";
+function activeWeightsPath() {
+  if (existsSync3(projectWeightsPath())) return { path: projectWeightsPath(), source: "project-config" };
+  if (existsSync3(userWeightsPath())) return { path: userWeightsPath(), source: "user-config" };
+  return null;
+}
+function loadWeights() {
+  if (cachedWeights) return cachedWeights;
+  let merged = structuredClone(DEFAULT_WEIGHTS);
+  const active = activeWeightsPath();
+  if (active) {
+    try {
+      const fromFile = JSON.parse(readFileSync(active.path, "utf8"));
+      merged = mergeWeights(merged, fromFile);
+    } catch {
+    }
+  }
+  const envLambda = process.env.LURQ_COMPOSITE_LAMBDA;
+  if (envLambda !== void 0 && envLambda !== "") {
+    const n = Number(envLambda);
+    if (Number.isFinite(n)) merged.composite.lambda = n;
+  }
+  cachedWeights = validateWeights(merged).weights;
+  return cachedWeights;
+}
+function resetWeightsCache() {
+  cachedWeights = void 0;
+}
+function mergeWeights(base, over) {
+  return {
+    health: { ...base.health, ...over.health ?? {} },
+    composite: { ...base.composite, ...over.composite ?? {} }
+  };
+}
+function validateWeights(w) {
+  const lambda = Math.max(0, Math.min(1, w.composite.lambda));
+  const h = w.health;
+  const sum = h.maintenance + h.adoption + h.reliability + h.efficiency;
+  let normalized = false;
+  let health = h;
+  if (sum <= 0) {
+    health = { ...DEFAULT_WEIGHTS.health };
+    normalized = true;
+  } else if (Math.abs(sum - 1) > 1e-6) {
+    health = {
+      maintenance: h.maintenance / sum,
+      adoption: h.adoption / sum,
+      reliability: h.reliability / sum,
+      efficiency: h.efficiency / sum
+    };
+    normalized = true;
+  }
+  return { weights: { health, composite: { lambda } }, normalized };
+}
+function settableKeys() {
+  return Object.keys(SETTABLE);
+}
+function applyOverrides(base, sets) {
+  const next = structuredClone(base);
+  for (const entry of sets) {
+    const eq9 = entry.indexOf("=");
+    if (eq9 < 0) throw new Error(`Invalid --set "${entry}" (expected key=value).`);
+    const key = entry.slice(0, eq9).trim();
+    const value = Number(entry.slice(eq9 + 1).trim());
+    const apply = SETTABLE[key];
+    if (!apply) {
+      throw new Error(`Unknown weight key "${key}". Settable: ${settableKeys().join(", ")}.`);
+    }
+    if (!Number.isFinite(value)) throw new Error(`Value for "${key}" must be a number.`);
+    apply(next, value);
+  }
+  return next;
+}
+function saveWeights(w, scope = "user") {
+  const path2 = scope === "project" ? projectWeightsPath() : userWeightsPath();
+  mkdirSync(dirname3(path2), { recursive: true });
+  writeFileSync(path2, JSON.stringify(w, null, 2) + "\n", "utf8");
+  resetWeightsCache();
+  return path2;
+}
+function resetWeights() {
+  const removed = [];
+  for (const path2 of [projectWeightsPath(), userWeightsPath()]) {
+    if (existsSync3(path2)) {
+      rmSync(path2);
+      removed.push(path2);
+    }
+  }
+  resetWeightsCache();
+  return removed;
+}
+var HEALTH_WEIGHTS, COMPOSITE, QUALITY_WEIGHTS, QUALITY, MAINTENANCE_WEIGHTS, MAINTENANCE, ADOPTION, RELIABILITY, EFFICIENCY, DISCOVERY, DEFAULT_WEIGHTS, cachedWeights, SETTABLE, WEIGHT_EXPLANATIONS, CONFIDENCE;
+var init_weights = __esm({
+  "src/scoring/weights.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_paths();
+    HEALTH_WEIGHTS = {
+      maintenance: 0.35,
+      adoption: 0.3,
+      reliability: 0.25,
+      efficiency: 0.1
+    };
+    COMPOSITE = {
+      lambda: 0.35
+    };
+    QUALITY_WEIGHTS = {
+      types: 0.25,
+      tests: 0.2,
+      docs: 0.2,
+      changelog: 0.1,
+      deps: 0.1,
+      license: 0.1,
+      provenance: 0.05
+    };
+    QUALITY = {
+      /** README at/above this many characters scores full marks on doc length. */
+      docsFullLengthChars: 1200,
+      /** Direct-dependency count at/above this scores 0 on the deps component (log-scaled). */
+      depsLogMax: 30,
+      /** A license string present but not OSI-recognized scores this (vs 100 / 0). */
+      licenseUnrecognizedScore: 60
+    };
+    MAINTENANCE_WEIGHTS = {
+      recency: 0.5,
+      cadence: 0.25,
+      closeRatio: 0.25
+    };
+    MAINTENANCE = {
+      /** A release within this many days scores full recency. */
+      freshDays: 30,
+      /** Recency decays linearly to 0 by this many days (~24 months). */
+      staleDays: 730,
+      /** Releases/12mo at or above this cap full cadence. */
+      cadenceCap: 12,
+      /** deprecated/archived hard-cap maintenance at this value. */
+      deadCap: 15
+    };
+    ADOPTION = {
+      /** log10(weekly downloads): this maps to 0. */
+      downloadsLogMin: 1,
+      // 10/wk
+      /** log10(weekly downloads): this maps to 100. */
+      downloadsLogMax: 7,
+      // 10M/wk
+      /** log10(stars) that maps to 100. */
+      starsLogMax: 5,
+      // 100k stars
+      /** Weight of the stars component when available (downloads gets the rest). */
+      starsWeight: 0.2,
+      /** Growth bonus: growth fraction × this, clamped to ±cap. */
+      growthMultiplier: 30,
       growthBonusCap: 20
     };
     RELIABILITY = {
@@ -1162,6 +2004,35 @@ var init_weights = __esm({
       /** Bundle size at the category median maps to this score; smaller → higher. */
       medianScore: 50
     };
+    DISCOVERY = {
+      /** A queued candidate must clear this quality pre-score to graduate to ingest. */
+      minPreScore: 45,
+      /** Max candidates fully ingested per crawler run (cost bound). */
+      perRunCap: 25,
+      /** npm-search hits to pull per category keyword. */
+      searchSizePerCategory: 10,
+      /** Max dependency-graph neighbors to enqueue per tracked seed. */
+      graphNeighborsPerSeed: 20
+    };
+    DEFAULT_WEIGHTS = {
+      health: { ...HEALTH_WEIGHTS },
+      composite: { ...COMPOSITE }
+    };
+    SETTABLE = {
+      "health.maintenance": (w, v) => w.health.maintenance = v,
+      "health.adoption": (w, v) => w.health.adoption = v,
+      "health.reliability": (w, v) => w.health.reliability = v,
+      "health.efficiency": (w, v) => w.health.efficiency = v,
+      "composite.lambda": (w, v) => w.composite.lambda = v
+    };
+    WEIGHT_EXPLANATIONS = {
+      maintenance: "release recency, cadence, and issue close-ratio (weights.ts MAINTENANCE_WEIGHTS).",
+      adoption: "weekly downloads (log-scaled), stars, and 90-day growth (weights.ts ADOPTION).",
+      reliability: "OpenSSF Scorecard scaled 0\u2013100, minus advisory penalties (weights.ts RELIABILITY).",
+      efficiency: "bundle size vs the category median; frontend categories only (weights.ts EFFICIENCY).",
+      quality: "intrinsic, adoption-independent: types, tests, docs, changelog, deps, license, provenance (weights.ts QUALITY_WEIGHTS). A standalone axis \u2014 it does NOT feed health.",
+      lambda: "how much the default sort composite favors quality over health: (1\u2212\u03BB)\xB7health + \u03BB\xB7quality."
+    };
     CONFIDENCE = {
       proven: {
         minWeeklyDownloads: 1e5,
@@ -1172,6 +2043,11 @@ var init_weights = __esm({
         minWeeklyDownloads: 5e3,
         strongGrowth: 0.5,
         maxLastReleaseMonths: 9
+      },
+      /** `promising` (§1): new but intrinsically high-quality, regardless of adoption. */
+      promising: {
+        minQuality: 70,
+        maxLastReleaseMonths: 12
       }
     };
   }
@@ -1180,12 +2056,11 @@ var init_weights = __esm({
 // src/scoring/score.ts
 function toScoringInput(signals, category) {
   const { registry, downloads, github, depsDev, bundle } = signals;
+  const readme = registry?.readme ?? null;
   return {
     weeklyDownloads: downloads?.weeklyDownloads ?? null,
     downloadGrowth90d: downloads?.downloadGrowth90d ?? null,
     stars: github?.stars ?? null,
-    dependentsCount: null,
-    // not collected in v1 (see spec R1 note)
     firstPublishedAt: registry?.firstPublishedAt ?? null,
     lastReleaseAt: github?.lastReleaseAt ?? registry?.lastReleaseAt ?? null,
     releasesLast12mo: github?.releasesLast12mo ?? null,
@@ -1196,7 +2071,18 @@ function toScoringInput(signals, category) {
     deprecated: registry?.deprecated ?? false,
     archived: github?.archived ?? false,
     bundleMinGzipKb: bundle?.bundleMinGzipKb ?? null,
-    category
+    category,
+    // Quality signals — null (not false) when the manifest itself is missing, so
+    // weightedAverage drops the component rather than scoring it 0.
+    hasTypes: registry ? registry.hasTypes : null,
+    hasTestScript: registry ? registry.hasTestScript : null,
+    readmeLength: readme !== null ? readme.length : null,
+    hasExamples: readme !== null ? /```/.test(readme) : null,
+    hasHomepage: registry ? registry.homepage !== null : null,
+    hasReleaseNotes: github?.releasesLast12mo != null ? github.releasesLast12mo > 0 : null,
+    directDependenciesCount: registry?.directDependenciesCount ?? null,
+    license: registry?.license ?? null,
+    hasProvenance: registry ? registry.hasProvenance : null
   };
 }
 function computeMaintenance(input, now) {
@@ -1254,23 +2140,68 @@ function computeEfficiency(bundleMinGzipKb, category, categoryMedian) {
   const ratio = bundleMinGzipKb / categoryMedian;
   return clamp(100 - ratio * EFFICIENCY.medianScore);
 }
-function computeHealthScore(breakdown) {
+function isRecognizedLicense(license) {
+  if (!license) return false;
+  const id = license.trim().toLowerCase();
+  return RECOGNIZED_LICENSES.some((l) => id === l || id.startsWith(l));
+}
+function computeQuality(input) {
+  const components = [];
+  if (input.hasTypes !== null) {
+    components.push({ value: input.hasTypes ? 100 : 0, weight: QUALITY_WEIGHTS.types });
+  }
+  if (input.hasTestScript !== null) {
+    components.push({ value: input.hasTestScript ? 100 : 0, weight: QUALITY_WEIGHTS.tests });
+  }
+  if (input.readmeLength !== null || input.hasHomepage !== null) {
+    const lenScore = Math.min((input.readmeLength ?? 0) / QUALITY.docsFullLengthChars, 1) * 60;
+    const examples = input.hasExamples ? 25 : 0;
+    const homepage = input.hasHomepage ? 15 : 0;
+    components.push({ value: clamp(lenScore + examples + homepage), weight: QUALITY_WEIGHTS.docs });
+  }
+  if (input.hasReleaseNotes !== null) {
+    components.push({ value: input.hasReleaseNotes ? 100 : 0, weight: QUALITY_WEIGHTS.changelog });
+  }
+  if (input.directDependenciesCount !== null) {
+    const deps = input.directDependenciesCount;
+    const depsScore = clamp(
+      100 - Math.log10(deps + 1) / Math.log10(QUALITY.depsLogMax + 1) * 100
+    );
+    components.push({ value: depsScore, weight: QUALITY_WEIGHTS.deps });
+  }
+  if (input.license !== null) {
+    components.push({
+      value: isRecognizedLicense(input.license) ? 100 : QUALITY.licenseUnrecognizedScore,
+      weight: QUALITY_WEIGHTS.license
+    });
+  }
+  if (input.hasProvenance) {
+    components.push({ value: 100, weight: QUALITY_WEIGHTS.provenance });
+  }
+  if (components.length === 0) return null;
+  return weightedAverage(components);
+}
+function computeHealthScore(breakdown, weights = HEALTH_WEIGHTS) {
   const { maintenance, adoption, reliability, efficiency } = breakdown;
+  const w = weights;
   if (efficiency === null) {
-    const w = HEALTH_WEIGHTS;
     const denom = w.maintenance + w.adoption + w.reliability;
     return Math.round(
       (w.maintenance * maintenance + w.adoption * adoption + w.reliability * reliability) / denom
     );
   }
   return Math.round(
-    HEALTH_WEIGHTS.maintenance * maintenance + HEALTH_WEIGHTS.adoption * adoption + HEALTH_WEIGHTS.reliability * reliability + HEALTH_WEIGHTS.efficiency * efficiency
+    w.maintenance * maintenance + w.adoption * adoption + w.reliability * reliability + w.efficiency * efficiency
   );
 }
+function computeComposite(healthScore, qualityScore, lambda = COMPOSITE.lambda) {
+  if (qualityScore === null) return healthScore;
+  return Math.round((1 - lambda) * healthScore + lambda * qualityScore);
+}
 function hasCriticalOrHighAdvisory(advisories) {
   return advisories.some((a) => a.severity === "critical" || a.severity === "high");
 }
-function computeConfidence(input, now) {
+function computeConfidence(input, now, qualityScore = null) {
   const dl = input.weeklyDownloads ?? 0;
   const ageMonths = monthsSince(input.firstPublishedAt, now);
   const lastReleaseMonths = monthsSince(input.lastReleaseAt, now);
@@ -1285,6 +2216,11 @@ function computeConfidence(input, now) {
   if (emergingAdoptionOk && emergingReleaseOk && !input.deprecated && !input.archived) {
     return "emerging";
   }
+  const promisingRecencyMonths = lastReleaseMonths ?? ageMonths;
+  const promisingReleaseOk = promisingRecencyMonths !== null && promisingRecencyMonths <= CONFIDENCE.promising.maxLastReleaseMonths;
+  if (qualityScore !== null && qualityScore >= CONFIDENCE.promising.minQuality && promisingReleaseOk && !hasCriticalOrHighAdvisory(input.advisories) && !input.deprecated && !input.archived) {
+    return "promising";
+  }
   return "unproven";
 }
 function weightedAverage(components) {
@@ -1299,7 +2235,7 @@ function median(values) {
   const mid = Math.floor(sorted.length / 2);
   return sorted.length % 2 === 0 ? (sorted[mid - 1] + sorted[mid]) / 2 : sorted[mid];
 }
-var DAY_MS, MONTH_MS, clamp, daysSince, monthsSince;
+var DAY_MS, MONTH_MS, clamp, daysSince, monthsSince, RECOGNIZED_LICENSES;
 var init_score = __esm({
   "src/scoring/score.ts"() {
     "use strict";
@@ -1311,6 +2247,20 @@ var init_score = __esm({
     clamp = (n, lo = 0, hi = 100) => Math.max(lo, Math.min(hi, n));
     daysSince = (date, now) => date ? (now.getTime() - date.getTime()) / DAY_MS : null;
     monthsSince = (date, now) => date ? (now.getTime() - date.getTime()) / MONTH_MS : null;
+    RECOGNIZED_LICENSES = [
+      "mit",
+      "isc",
+      "apache-2.0",
+      "bsd-2-clause",
+      "bsd-3-clause",
+      "mpl-2.0",
+      "lgpl",
+      "gpl",
+      "agpl",
+      "unlicense",
+      "0bsd",
+      "cc0-1.0"
+    ];
   }
 });
 
@@ -1380,6 +2330,7 @@ var init_embeddings = __esm({
     LocalEmbeddingProvider = class {
       kind = "local";
       dimensions = EMBEDDING_DIM;
+      id = "local";
       async embed(texts) {
         return texts.map((t) => localEmbed(t));
       }
@@ -1390,17 +2341,19 @@ var init_embeddings = __esm({
         this.apiKey = apiKey;
         this.model = model;
         this.fetchImpl = fetchImpl;
+        this.id = `openai:${model}`;
       }
       apiKey;
       model;
       fetchImpl;
       kind = "openai";
       dimensions = EMBEDDING_DIM;
+      id;
       async embed(texts) {
         const out = [];
         for (let i = 0; i < texts.length; i += OPENAI_BATCH) {
           const batch = texts.slice(i, i + OPENAI_BATCH);
-          const body = JSON.stringify({ model: this.model, input: batch });
+          const body = JSON.stringify({ model: this.model, input: batch, dimensions: EMBEDDING_DIM });
           const { data } = await httpRequest("https://api.openai.com/v1/embeddings", {
             host: "api.openai.com",
             method: "POST",
@@ -1413,7 +2366,14 @@ var init_embeddings = __esm({
           });
           const vectors = data?.data ?? [];
           vectors.sort((a, b) => a.index - b.index);
-          for (const v of vectors) out.push(v.embedding);
+          for (const v of vectors) {
+            if (v.embedding.length !== EMBEDDING_DIM) {
+              throw new Error(
+                `OpenAI model ${this.model} returned ${v.embedding.length}-dim vectors; expected ${EMBEDDING_DIM}. Set EMBEDDING_MODEL to a text-embedding-3 model or update EMBEDDING_DIM.`
+              );
+            }
+            out.push(v.embedding);
+          }
         }
         return out;
       }
@@ -1421,47 +2381,6 @@ var init_embeddings = __esm({
   }
 });
 
-// src/db/packages.ts
-import { eq, sql } from "drizzle-orm";
-async function getSeedTargets(db) {
-  const rows = await db.select({ name: seedPackages.name, category: seedPackages.category }).from(seedPackages);
-  return rows.map((r) => ({ name: r.name, category: r.category ?? null }));
-}
-async function getPackageByName(db, name) {
-  const rows = await db.select().from(packages).where(eq(packages.name, name)).limit(1);
-  return rows[0] ?? null;
-}
-async function ensureSeedEntry(db, name, category) {
-  await db.insert(seedPackages).values({ name, category }).onConflictDoNothing({ target: seedPackages.name });
-}
-async function upsertPackage(db, row) {
-  const { name: _name, createdAt: _createdAt, ...mutable } = row;
-  await db.insert(packages).values(row).onConflictDoUpdate({
-    target: packages.name,
-    set: { ...mutable, updatedAt: /* @__PURE__ */ new Date() }
-  });
-}
-async function startSyncRun(db) {
-  const [row] = await db.insert(syncRuns).values({ status: "running" }).returning({ id: syncRuns.id });
-  return row.id;
-}
-async function finishSyncRun(db, id, data) {
-  await db.update(syncRuns).set({
-    finishedAt: /* @__PURE__ */ new Date(),
-    packagesSeen: data.packagesSeen,
-    packagesUpdated: data.packagesUpdated,
-    errors: data.errors,
-    status: data.status
-  }).where(eq(syncRuns.id, id));
-}
-var init_packages = __esm({
-  "src/db/packages.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_schema();
-  }
-});
-
 // src/core/concurrency.ts
 async function pMap(items, mapper, concurrency) {
   const results = new Array(items.length);
@@ -1508,18 +2427,28 @@ async function runSync(opts = {}) {
             prefetchedWeekly: weeklyMap.has(target.name) ? weeklyMap.get(target.name) : void 0
           });
           for (const e of signals.errors) allErrors.push({ package: target.name, ...e });
-          const input = toScoringInput(signals, target.category);
           const summaryInput = await buildSummaryInput(signals, target.category);
-          const { summary, usageGuide } = await provider.generate(summaryInput);
+          const { summary, usageGuide, inferredCategory } = await provider.generate(summaryInput);
+          let category = target.category;
+          let categorySource = target.category ? "curated" : null;
+          if (!category) {
+            category = inferCategoryFromSignals(signals) ?? inferredCategory ?? null;
+            categorySource = category ? "inferred" : null;
+          }
+          const input = toScoringInput(signals, category);
+          const quality = computeQuality(input);
           if (++done % 25 === 0) logger.info(`  \u2026${done}/${targets.length}`);
           return {
             target,
+            category,
+            categorySource,
             signals,
             input,
             maintenance: computeMaintenance(input, now),
             adoption: computeAdoption(input),
             reliability: computeReliability(input),
-            confidence: computeConfidence(input, now),
+            quality,
+            confidence: computeConfidence(input, now, quality),
             summary,
             usageGuide
           };
@@ -1542,7 +2471,7 @@ async function runSync(opts = {}) {
       ok.map(
         (c) => buildEmbeddingText({
           name: c.target.name,
-          category: c.target.category,
+          category: c.category,
           summary: c.summary,
           description: c.signals.registry?.description ?? null
         })
@@ -1553,21 +2482,23 @@ async function runSync(opts = {}) {
       const c = ok[i];
       const efficiency = computeEfficiency(
         c.input.bundleMinGzipKb,
-        c.target.category,
-        c.target.category ? medians.get(c.target.category) ?? null : null
+        c.category,
+        c.category ? medians.get(c.category) ?? null : null
       );
       const breakdown = {
         maintenance: c.maintenance,
         adoption: c.adoption,
         reliability: c.reliability,
-        efficiency
+        efficiency,
+        quality: c.quality
       };
       const healthScore = computeHealthScore(breakdown);
       await upsertPackage(
         handle.db,
         assemblePackageRow({
           name: c.target.name,
-          category: c.target.category,
+          category: c.category,
+          categorySource: c.categorySource,
           signals: c.signals,
           input: c.input,
           summary: c.summary,
@@ -1575,7 +2506,9 @@ async function runSync(opts = {}) {
           confidence: c.confidence,
           breakdown,
           healthScore,
+          qualityScore: c.quality,
           embedding: embeddings[i] ?? null,
+          embeddingProvider: embProvider.id,
           now
         })
       );
@@ -1589,6 +2522,7 @@ async function runSync(opts = {}) {
       status
     });
     logger.info(`Sync ${status}: ${updated}/${targets.length} updated, ${allErrors.length} source errors.`);
+    if (updated > 0) await invalidateCache();
     return { seen: targets.length, updated, errors: allErrors.length, status };
   } catch (err) {
     await finishSyncRun(handle.db, runId, {
@@ -1614,7 +2548,7 @@ async function resolveTargets(db, opts) {
 function computeCategoryMedians(computed) {
   const byCategory = /* @__PURE__ */ new Map();
   for (const c of computed) {
-    const cat = c.target.category;
+    const cat = c.category;
     const kb = c.input.bundleMinGzipKb;
     if (cat && isFrontendCategory(cat) && kb !== null) {
       const list = byCategory.get(cat) ?? [];
@@ -1635,6 +2569,7 @@ function assemblePackageRow(p) {
     name: p.name,
     ecosystem: "npm",
     category: p.category,
+    categorySource: p.categorySource,
     description: r?.description ?? null,
     summary: p.summary,
     repoUrl: r?.repoUrl ?? null,
@@ -1647,18 +2582,22 @@ function assemblePackageRow(p) {
     lastReleaseAt: p.input.lastReleaseAt,
     weeklyDownloads: p.input.weeklyDownloads,
     downloadGrowth90d: p.input.downloadGrowth90d,
-    dependentsCount: p.input.dependentsCount,
     stars: p.input.stars,
     openIssues: p.input.openIssues,
     closedIssues: p.input.closedIssues,
     scorecard: p.input.scorecard,
     bundleMinGzipKb: p.input.bundleMinGzipKb,
     advisories: p.input.advisories,
+    peerDependencies: r?.peerDependencies ?? null,
+    peerDependenciesMeta: r?.peerDependenciesMeta ?? null,
+    engines: r?.engines ?? null,
     healthScore: p.healthScore,
+    qualityScore: p.qualityScore,
     confidence: p.confidence,
     scoreBreakdown: p.breakdown,
     usageGuide: p.usageGuide,
     embedding: p.embedding,
+    embeddingProvider: p.embedding ? p.embeddingProvider : null,
     dataAsOf: p.now
   };
 }
@@ -1666,6 +2605,7 @@ var init_sync = __esm({
   "src/pipeline/sync.ts"() {
     "use strict";
     init_esm_shims();
+    init_cache();
     init_config();
     init_concurrency();
     init_http();
@@ -1673,6 +2613,7 @@ var init_sync = __esm({
     init_collect();
     init_npmDownloads();
     init_summarize();
+    init_categoryInference();
     init_embeddings();
     init_scoring();
     init_client();
@@ -1682,40 +2623,56 @@ var init_sync = __esm({
 });
 
 // src/pipeline/single.ts
-import { and, eq as eq2, isNotNull, sql as sql2 } from "drizzle-orm";
+import { and as and3, eq as eq3, isNotNull as isNotNull2, sql as sql2 } from "drizzle-orm";
 async function getSeedCategory(db, name) {
-  const [row] = await db.select({ category: seedPackages.category }).from(seedPackages).where(eq2(seedPackages.name, name)).limit(1);
+  const [row] = await db.select({ category: seedPackages.category }).from(seedPackages).where(eq3(seedPackages.name, name)).limit(1);
   return row?.category ?? null;
 }
 async function getCategoryMedianBundle(db, category) {
   const [row] = await db.select({
     m: sql2`percentile_cont(0.5) within group (order by ${packages.bundleMinGzipKb})`
-  }).from(packages).where(and(eq2(packages.category, category), isNotNull(packages.bundleMinGzipKb)));
+  }).from(packages).where(and3(eq3(packages.category, category), isNotNull2(packages.bundleMinGzipKb)));
   return row?.m ?? null;
 }
 async function syncOnePackage(db, name, opts = {}) {
   const config = getConfig();
   const now = /* @__PURE__ */ new Date();
   const existing = await getPackageByName(db, name);
-  const category = opts.category ?? existing?.category ?? await getSeedCategory(db, name) ?? null;
+  const curatedCategory = opts.category ?? await getSeedCategory(db, name) ?? null;
+  const initialCategory = curatedCategory ?? existing?.category ?? null;
   const prefetchedWeekly = await fetchWeeklyDownloads(name).catch(() => null);
-  const signals = await collectSignals(name, category, {
+  const signals = await collectSignals(name, initialCategory, {
     githubToken: config.GITHUB_TOKEN,
     prefetchedWeekly
   });
+  const summaryInput = await buildSummaryInput(signals, initialCategory);
+  const { summary, usageGuide, inferredCategory } = await createSummaryProvider().generate(summaryInput);
+  let category;
+  let categorySource;
+  if (curatedCategory) {
+    category = curatedCategory;
+    categorySource = "curated";
+  } else if (existing?.category) {
+    category = existing.category;
+    categorySource = existing.categorySource ?? "inferred";
+  } else {
+    category = inferCategoryFromSignals(signals) ?? inferredCategory ?? null;
+    categorySource = category ? "inferred" : null;
+  }
   const input = toScoringInput(signals, category);
-  const summaryInput = await buildSummaryInput(signals, category);
-  const { summary, usageGuide } = await createSummaryProvider().generate(summaryInput);
   const median2 = category ? await getCategoryMedianBundle(db, category) : null;
+  const quality = computeQuality(input);
   const breakdown = {
     maintenance: computeMaintenance(input, now),
     adoption: computeAdoption(input),
     reliability: computeReliability(input),
-    efficiency: computeEfficiency(input.bundleMinGzipKb, category, median2)
+    efficiency: computeEfficiency(input.bundleMinGzipKb, category, median2),
+    quality
   };
   const healthScore = computeHealthScore(breakdown);
-  const confidence = computeConfidence(input, now);
-  const [embedding] = await createEmbeddingProvider().embed([
+  const confidence = computeConfidence(input, now, quality);
+  const embProvider = createEmbeddingProvider();
+  const [embedding] = await embProvider.embed([
     buildEmbeddingText({ name, category, summary, description: signals.registry?.description ?? null })
   ]);
   await upsertPackage(
@@ -1723,6 +2680,7 @@ async function syncOnePackage(db, name, opts = {}) {
     assemblePackageRow({
       name,
       category,
+      categorySource,
       signals,
       input,
       summary,
@@ -1730,10 +2688,16 @@ async function syncOnePackage(db, name, opts = {}) {
       confidence,
       breakdown,
       healthScore,
+      qualityScore: quality,
       embedding: embedding ?? null,
+      embeddingProvider: embProvider.id,
       now
     })
   );
+  await upsertPackageVersions(db, name, signals.registry?.versionTimeline ?? []).catch(
+    () => {
+    }
+  );
   return await getPackageByName(db, name);
 }
 async function getOrFetchPackage(db, name) {
@@ -1742,7 +2706,9 @@ async function getOrFetchPackage(db, name) {
   const exists = await npmPackageExists(name);
   if (!exists) return { row: null, wasTracked: false, existsOnNpm: false };
   const row = await syncOnePackage(db, name);
-  await ensureSeedEntry(db, name, row.category);
+  if (row.confidence && row.confidence !== "unproven") {
+    await ensureSeedEntry(db, name, row.category);
+  }
   return { row, wasTracked: false, existsOnNpm: true };
 }
 var init_single = __esm({
@@ -1753,6 +2719,7 @@ var init_single = __esm({
     init_collect();
     init_sources();
     init_summarize();
+    init_categoryInference();
     init_scoring();
     init_embeddings();
     init_packages();
@@ -1761,103 +2728,87 @@ var init_single = __esm({
   }
 });
 
-// src/search/categoryInference.ts
-function inferCategory(need) {
-  const text2 = need.toLowerCase();
-  for (const rule of RULES) {
-    if (rule.patterns.test(text2)) return rule.category;
-  }
-  return null;
-}
-var RULES;
-var init_categoryInference = __esm({
-  "src/search/categoryInference.ts"() {
-    "use strict";
-    init_esm_shims();
-    RULES = [
-      { category: "meta-framework", patterns: /\b(meta-?framework|next\.?js|nuxt|remix|astro|gatsby|sveltekit|full-?stack framework)\b/ },
-      { category: "state-management", patterns: /\b(state management|global state|store|redux|zustand|jotai|mobx|atoms?)\b/ },
-      { category: "routing", patterns: /\b(rout(e|er|ing)|navigation|url matching)\b/ },
-      { category: "orm", patterns: /\b(orm|object-?relational|query builder|prisma|drizzle|sequelize|typeorm)\b/ },
-      { category: "database-client", patterns: /\b(database (driver|client)|postgres|mysql|mongo(db)?|redis|sqlite|db driver)\b/ },
-      { category: "ui-component-library", patterns: /\b(component library|ui kit|ui components?|design system|buttons?|modal|dialog)\b/ },
-      { category: "styling", patterns: /\b(styl(e|ing)|css|tailwind|sass|scss|class ?names?|theme)\b/ },
-      { category: "forms", patterns: /\b(forms?|form (state|library|handling)|input handling)\b/ },
-      { category: "validation", patterns: /\b(validat(e|ion|or)|schema|parse input|type ?safe parsing)\b/ },
-      { category: "data-fetching", patterns: /\b(data fetching|server state|react query|swr|graphql client|caching queries)\b/ },
-      { category: "http-client", patterns: /\b(http client|fetch wrapper|rest client|make (a )?request|ajax|api calls?)\b/ },
-      { category: "auth", patterns: /\b(auth(entication|orization)?|login|session|jwt|oauth|password hashing)\b/ },
-      { category: "testing", patterns: /\b(test(ing|s)?|unit test|e2e|assertion|mocking|test runner)\b/ },
-      { category: "bundler", patterns: /\b(bundler|bundle (modules?|code)|webpack|rollup|esbuild|parcel)\b/ },
-      { category: "build-tool", patterns: /\b(build tool|dev server|monorepo|task runner|compile|transpile)\b/ },
-      // date-time precedes linting: "date formatting" must not be captured by linting's
-      // bare "formatting" token before the date rule is reached (first-match-wins).
-      { category: "date-time", patterns: /\b(dates?|date ?time|time(zone)?s?|calendar|parse dates?|format dates?)\b/ },
-      { category: "linting", patterns: /\b(lint(er|ing)?|formatter|formatting|code (quality|style|format)|prettier|eslint)\b/ },
-      { category: "animation", patterns: /\b(animat(e|ion)|motion|transition|spring|gsap|3d)\b/ },
-      { category: "charts", patterns: /\b(charts?|graphs?|data ?vis(ualization)?|plots?|dashboards?)\b/ },
-      { category: "i18n", patterns: /\b(i18n|internationali[sz]ation|localization|translat(e|ion)|locale)\b/ },
-      { category: "framework", patterns: /\b(framework|react|vue|svelte|angular|web server|backend framework)\b/ },
-      { category: "utility", patterns: /\b(debounce|throttle|deep ?clone|slugify|uuid|util(ity|ities)?|helper|lodash|retry)\b/ }
-    ];
-  }
-});
-
 // src/search/recommend.ts
-import { and as and2, cosineDistance, desc, eq as eq3, isNotNull as isNotNull2, lte, sql as sql3 } from "drizzle-orm";
+import { and as and4, cosineDistance, eq as eq4, isNotNull as isNotNull3, lte, sql as sql3 } from "drizzle-orm";
 async function recommend(db, opts, provider = createEmbeddingProvider()) {
   const limit = Math.min(Math.max(opts.limit ?? 3, 1), 5);
   const [queryVec] = await provider.embed([opts.need]);
   if (!queryVec) return [];
   const category = opts.category ?? inferCategory(opts.need);
   const pool = Math.max(limit * 5, 25);
-  let rows = await runQuery(db, queryVec, opts.constraints, category, pool);
-  if (category && rows.length < limit) {
-    const broad = await runQuery(db, queryVec, opts.constraints, null, pool);
-    const seen = new Set(rows.map((r) => r.name));
-    rows = rows.concat(broad.filter((r) => !seen.has(r.name)));
-  }
-  if (rows.length === 0) return [];
-  const ranked = rows.map((r) => {
-    const simNorm = Math.max(0, Math.min(1, (r.similarity + 1) / 2));
-    const health = (r.healthScore ?? 0) / 100;
-    return { row: r, score: SIM_WEIGHT * simNorm + HEALTH_WEIGHT * health };
+  let fused = await hybridSearch(db, queryVec, provider.id, opts.need, opts.constraints, category, pool);
+  if (category && fused.length < limit) {
+    const broad = await hybridSearch(db, queryVec, provider.id, opts.need, opts.constraints, null, pool);
+    const seen = new Set(fused.map((f) => f.row.name));
+    fused = fused.concat(broad.filter((f) => !seen.has(f.row.name)));
+  }
+  if (fused.length === 0) return [];
+  const lambda = loadWeights().composite.lambda;
+  const maxRrf = Math.max(...fused.map((f) => f.rrf));
+  const ranked = fused.map((f) => {
+    const relevance = maxRrf > 0 ? f.rrf / maxRrf : 0;
+    const composite = computeComposite(f.row.healthScore ?? 0, f.row.qualityScore, lambda) / 100;
+    return { row: f.row, score: RELEVANCE_WEIGHT * relevance + COMPOSITE_WEIGHT * composite };
   }).sort((a, b) => b.score - a.score).slice(0, limit);
   return ranked.map(({ row }) => toCandidate(row));
 }
-async function runQuery(db, queryVec, constraints, category, pool) {
-  const similarity = sql3`1 - (${cosineDistance(packages.embedding, queryVec)})`;
-  const conditions = [isNotNull2(packages.embedding)];
-  if (category) conditions.push(eq3(packages.category, category));
-  if (constraints?.license) conditions.push(eq3(packages.license, constraints.license));
+async function hybridSearch(db, queryVec, providerId, need, constraints, category, pool) {
+  const [vectorRows, lexicalRows] = await Promise.all([
+    runVectorQuery(db, queryVec, providerId, constraints, category, pool),
+    runLexicalQuery(db, need, constraints, category, pool)
+  ]);
+  return rrfFuse([vectorRows, lexicalRows]);
+}
+function rrfFuse(lists, k = RRF_K) {
+  const fused = /* @__PURE__ */ new Map();
+  for (const list of lists) {
+    list.forEach((row, idx) => {
+      const contribution = 1 / (k + idx + 1);
+      const prev = fused.get(row.name);
+      if (prev) prev.rrf += contribution;
+      else fused.set(row.name, { row, rrf: contribution });
+    });
+  }
+  return [...fused.values()].sort((a, b) => b.rrf - a.rrf);
+}
+function buildConditions(constraints, category) {
+  const conditions = [];
+  if (category) conditions.push(eq4(packages.category, category));
+  if (constraints?.license) conditions.push(eq4(packages.license, constraints.license));
   if (constraints?.maxBundleKb !== void 0) {
     conditions.push(lte(packages.bundleMinGzipKb, constraints.maxBundleKb));
   }
   if (constraints?.minConfidence) {
-    const allowed = ["proven", "emerging", "unproven"].filter(
+    const allowed = ["proven", "emerging", "promising", "unproven"].filter(
       (c) => CONFIDENCE_RANK[c] >= CONFIDENCE_RANK[constraints.minConfidence]
     );
     conditions.push(
       sql3`${packages.confidence} in ${sql3.raw(`(${allowed.map((c) => `'${c}'`).join(",")})`)}`
     );
   }
-  return db.select({
-    name: packages.name,
-    category: packages.category,
-    healthScore: packages.healthScore,
-    confidence: packages.confidence,
-    latestVersion: packages.latestVersion,
-    weeklyDownloads: packages.weeklyDownloads,
-    lastReleaseAt: packages.lastReleaseAt,
-    repoUrl: packages.repoUrl,
-    similarity
-  }).from(packages).where(and2(...conditions)).orderBy(desc(similarity)).limit(pool);
+  return conditions;
+}
+async function runVectorQuery(db, queryVec, providerId, constraints, category, pool) {
+  const distance = cosineDistance(packages.embedding, queryVec);
+  const conditions = [
+    isNotNull3(packages.embedding),
+    eq4(packages.embeddingProvider, providerId),
+    ...buildConditions(constraints, category)
+  ];
+  return db.select(ROW_COLUMNS).from(packages).where(and4(...conditions)).orderBy(distance).limit(pool);
+}
+async function runLexicalQuery(db, need, constraints, category, pool) {
+  const tsquery = sql3`websearch_to_tsquery('english', ${need})`;
+  const rank = sql3`ts_rank(${packages.searchVector}, ${tsquery})`;
+  const conditions = [sql3`${packages.searchVector} @@ ${tsquery}`, ...buildConditions(constraints, category)];
+  return db.select(ROW_COLUMNS).from(packages).where(and4(...conditions)).orderBy(sql3`${rank} desc`).limit(pool);
 }
 function toCandidate(row) {
   return {
     name: row.name,
     category: row.category,
     healthScore: row.healthScore ?? 0,
+    qualityScore: row.qualityScore,
     confidence: row.confidence ?? "unproven",
     why: buildWhy(row),
     latestVersion: row.latestVersion,
@@ -1878,26 +2829,132 @@ function formatDownloads(n) {
   if (n >= 1e3) return `${Math.round(n / 1e3)}k`;
   return String(n);
 }
-var CONFIDENCE_RANK, SIM_WEIGHT, HEALTH_WEIGHT;
+var CONFIDENCE_RANK, RELEVANCE_WEIGHT, COMPOSITE_WEIGHT, RRF_K, ROW_COLUMNS;
 var init_recommend = __esm({
   "src/search/recommend.ts"() {
     "use strict";
     init_esm_shims();
     init_schema();
+    init_scoring();
+    init_weights();
     init_categoryInference();
     init_embeddings();
-    CONFIDENCE_RANK = { unproven: 0, emerging: 1, proven: 2 };
-    SIM_WEIGHT = 0.6;
-    HEALTH_WEIGHT = 0.4;
+    CONFIDENCE_RANK = {
+      unproven: 0,
+      promising: 1,
+      emerging: 2,
+      proven: 3
+    };
+    RELEVANCE_WEIGHT = 0.6;
+    COMPOSITE_WEIGHT = 0.4;
+    RRF_K = 60;
+    ROW_COLUMNS = {
+      name: packages.name,
+      category: packages.category,
+      healthScore: packages.healthScore,
+      qualityScore: packages.qualityScore,
+      confidence: packages.confidence,
+      latestVersion: packages.latestVersion,
+      weeklyDownloads: packages.weeklyDownloads,
+      lastReleaseAt: packages.lastReleaseAt,
+      repoUrl: packages.repoUrl
+    };
   }
 });
 
-// src/mcp/handlers.ts
+// src/security/risk.ts
+function assessRisk(i) {
+  const malwarePattern = i.installScripts && i.brandNew && i.lowTrust;
+  if (i.typosquat || i.hasCriticalOrHighAdvisory || malwarePattern) return "high";
+  if (i.deprecatedOrArchived || i.installScripts && (i.lowTrust || i.brandNew) || i.lowTrust && i.flags.includes("single-maintainer")) {
+    return "medium";
+  }
+  return "low";
+}
+var init_risk = __esm({
+  "src/security/risk.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/security/typosquat.ts
+function bareName(name) {
+  const slash = name.indexOf("/");
+  return (slash >= 0 ? name.slice(slash + 1) : name).toLowerCase();
+}
+function editDistance(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  let prevPrev = new Array(n + 1).fill(0);
+  let prev = Array.from({ length: n + 1 }, (_, j) => j);
+  for (let i = 1; i <= m; i++) {
+    const cur = new Array(n + 1).fill(0);
+    cur[0] = i;
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      let val = Math.min(
+        (prev[j] ?? 0) + 1,
+        (cur[j - 1] ?? 0) + 1,
+        (prev[j - 1] ?? 0) + cost
+      );
+      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+        val = Math.min(val, (prevPrev[j - 2] ?? 0) + 1);
+      }
+      cur[j] = val;
+    }
+    prevPrev = prev;
+    prev = cur;
+  }
+  return prev[n] ?? 0;
+}
+function detectTyposquat(name, popular, maxDistance = 2) {
+  const target = bareName(name);
+  if (target.length < 4) return null;
+  if (popular.some((p) => p.toLowerCase() === name.toLowerCase())) return null;
+  let best = null;
+  for (const p of popular) {
+    const cand = bareName(p);
+    if (cand === target) continue;
+    if (Math.abs(cand.length - target.length) > maxDistance) continue;
+    const dist = editDistance(target, cand);
+    if (dist >= 1 && dist <= maxDistance && (!best || dist < best.distance)) {
+      best = { target: p, distance: dist };
+      if (dist === 1) break;
+    }
+  }
+  return best;
+}
+var init_typosquat = __esm({
+  "src/security/typosquat.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/mcp/handlers.ts
+var handlers_exports = {};
+__export(handlers_exports, {
+  handleCompare: () => handleCompare,
+  handleCompat: () => handleCompat,
+  handleEvaluate: () => handleEvaluate,
+  handleRecommend: () => handleRecommend,
+  handleVerify: () => handleVerify,
+  latestDataAsOf: () => latestDataAsOf,
+  rowToEvaluate: () => rowToEvaluate
+});
+import { createHash as createHash3 } from "crypto";
 import { sql as sql4 } from "drizzle-orm";
 function isStale(dataAsOf) {
   if (!dataAsOf) return true;
   return Date.now() - dataAsOf.getTime() > STALENESS_DAYS * DAY_MS2;
 }
+function refreshStale(out) {
+  out.stale = isStale(out.dataAsOf ? new Date(out.dataAsOf) : null) || void 0;
+  return out;
+}
 function withinDays(date, days) {
   return date ? Date.now() - date.getTime() <= days * DAY_MS2 : false;
 }
@@ -1910,7 +2967,8 @@ function rowToEvaluate(row) {
     maintenance: 0,
     adoption: 0,
     reliability: 0,
-    efficiency: null
+    efficiency: null,
+    quality: null
   };
   return {
     dataAsOf: (row.dataAsOf ?? /* @__PURE__ */ new Date()).toISOString(),
@@ -1918,13 +2976,13 @@ function rowToEvaluate(row) {
     name: row.name,
     category: row.category,
     healthScore: row.healthScore ?? 0,
+    qualityScore: row.qualityScore ?? null,
     confidence: row.confidence ?? "unproven",
     scoreBreakdown: breakdown,
     latestVersion: row.latestVersion,
     lastReleaseAt: row.lastReleaseAt ? row.lastReleaseAt.toISOString() : null,
     weeklyDownloads: row.weeklyDownloads,
     downloadGrowth90d: row.downloadGrowth90d,
-    dependentsCount: row.dependentsCount,
     scorecard: row.scorecard,
     bundleMinGzipKb: row.bundleMinGzipKb,
     deprecated: row.deprecated,
@@ -1939,37 +2997,80 @@ async function latestDataAsOf(db) {
   const [row] = await db.select({ m: sql4`max(${packages.dataAsOf})` }).from(packages);
   return new Date(row?.m ?? Date.now()).toISOString();
 }
+function cacheKey(parts) {
+  return createHash3("sha1").update(JSON.stringify(parts)).digest("hex").slice(0, 24);
+}
 async function handleRecommend(db, input) {
-  const candidates = await recommend(db, {
-    need: input.need,
-    category: input.category,
-    constraints: input.constraints,
-    limit: 5
-  });
-  return { dataAsOf: await latestDataAsOf(db), candidates };
+  return cached2(
+    "rec",
+    cacheKey([input.need, input.category ?? null, input.constraints ?? null]),
+    async () => {
+      const candidates = await recommend(db, {
+        need: input.need,
+        category: input.category,
+        constraints: input.constraints,
+        limit: 5
+      });
+      return { dataAsOf: await latestDataAsOf(db), candidates };
+    },
+    // Don't cache empty results — the index may still be populating.
+    { skipCache: (r) => r.candidates.length === 0 }
+  );
 }
 async function handleEvaluate(db, input) {
-  const { row, existsOnNpm } = await getOrFetchPackage(db, input.package);
-  if (!row) {
-    return {
-      tracked: false,
-      suggestion: existsOnNpm ? `"${input.package}" exists on npm but could not be scored right now; try again.` : `"${input.package}" was not found on the npm registry. Check the package name.`
-    };
-  }
-  return rowToEvaluate(row);
+  const out = await cached2(
+    "eval",
+    cacheKey([input.package]),
+    async () => {
+      const { row, existsOnNpm } = await getOrFetchPackage(db, input.package);
+      if (!row) {
+        return {
+          tracked: false,
+          suggestion: existsOnNpm ? `"${input.package}" exists on npm but could not be scored right now; try again.` : `"${input.package}" was not found on the npm registry. Check the package name.`
+        };
+      }
+      const evaluated = rowToEvaluate(row);
+      const verification = await getLatestVerificationByName(db, row.name);
+      return verification ? { ...evaluated, buildVerified: toBuildVerified(verification) } : evaluated;
+    },
+    // Don't cache "not found / not scored yet" — it may resolve on a later fetch.
+    { skipCache: (r) => "tracked" in r }
+  );
+  return "tracked" in out ? out : refreshStale(out);
 }
 async function handleCompare(db, input) {
-  const results = await Promise.all(input.packages.map((name) => getOrFetchPackage(db, name)));
-  const rows = results.map((r) => r.row).filter((row) => row !== null).map(rowToEvaluate).sort((a, b) => b.healthScore - a.healthScore);
-  const missing = input.packages.filter(
-    (name) => !rows.some((r) => r.name === name)
+  const out = await cached2(
+    "cmp",
+    cacheKey(input.packages),
+    async () => {
+      const results = await Promise.all(input.packages.map((name) => getOrFetchPackage(db, name)));
+      const rows = results.map((r) => r.row).filter((row) => row !== null).map(rowToEvaluate).sort((a, b) => b.healthScore - a.healthScore);
+      const missing = input.packages.filter((name) => !rows.some((r) => r.name === name));
+      return { dataAsOf: await latestDataAsOf(db), rows, ...missing.length ? { missing } : {} };
+    },
+    // Don't cache a transient miss (a package that momentarily failed to fetch).
+    { skipCache: (r) => Boolean(r.missing?.length) }
   );
-  return { dataAsOf: await latestDataAsOf(db), rows, ...missing.length ? { missing } : {} };
+  out.rows = out.rows.map(refreshStale);
+  return out;
+}
+function toBuildVerified(v) {
+  return {
+    version: v.version,
+    installed: v.installed,
+    loaded: v.imported,
+    driver: v.driver,
+    ranAt: v.ranAt ? v.ranAt.toISOString() : ""
+  };
+}
+async function handleCompat(db, input) {
+  return checkCompat(db, input.packages);
 }
 async function handleVerify(db, input) {
   const name = input.package;
   const exists = await npmPackageExists(name);
   if (!exists) {
+    const typo2 = detectTyposquat(name, await getTopPackageNames(db).catch(() => []));
     return {
       exists: false,
       tracked: false,
@@ -1977,25 +3078,46 @@ async function handleVerify(db, input) {
       archived: false,
       latestVersion: null,
       weeklyDownloads: null,
-      riskFlags: ["not-found-on-registry"],
+      riskFlags: typo2 ? ["not-found-on-registry", `possible-typosquat-of:${typo2.target}`] : ["not-found-on-registry"],
+      risk: "high",
+      typosquatOf: typo2?.target ?? null,
       confidence: null,
       advisoryCount: 0
     };
   }
-  const registry = await fetchNpmRegistry(name).catch(() => null);
-  const { row, wasTracked } = await getOrFetchPackage(db, name);
+  const [registry, { row, wasTracked }, popular] = await Promise.all([
+    fetchNpmRegistry(name).catch(() => null),
+    getOrFetchPackage(db, name),
+    getTopPackageNames(db).catch(() => [])
+  ]);
   const weeklyDownloads = row?.weeklyDownloads ?? null;
-  const advisoryCount = row?.advisories?.length ?? 0;
+  const advisories = row?.advisories ?? [];
+  const advisoryCount = advisories.length;
   const deprecated = Boolean(row?.deprecated || registry?.deprecated);
   const archived = Boolean(row?.archived);
+  const brandNew = withinDays(registry?.firstPublishedAt ?? null, 7);
+  const lowTrust = weeklyDownloads === null || weeklyDownloads < 1e3;
+  const installScripts = registry?.hasInstallScripts ?? false;
+  const typo = detectTyposquat(name, popular);
   const riskFlags = [];
+  if (typo) riskFlags.push(`possible-typosquat-of:${typo.target}`);
   if (weeklyDownloads === null || weeklyDownloads === 0) riskFlags.push("zero-downloads");
   else if (weeklyDownloads < 1e3) riskFlags.push("low-downloads");
-  if (withinDays(registry?.firstPublishedAt ?? null, 7)) riskFlags.push("published-within-7-days");
+  if (brandNew) riskFlags.push("published-within-7-days");
   if (registry?.maintainersCount === 1) riskFlags.push("single-maintainer");
+  if (installScripts) riskFlags.push("runs-install-scripts");
   if (advisoryCount > 0) riskFlags.push("has-known-advisory");
   if (deprecated) riskFlags.push("deprecated");
   if (archived) riskFlags.push("archived");
+  const risk = assessRisk({
+    flags: riskFlags,
+    hasCriticalOrHighAdvisory: hasCriticalOrHighAdvisory(advisories),
+    typosquat: Boolean(typo),
+    installScripts,
+    brandNew,
+    lowTrust,
+    deprecatedOrArchived: deprecated || archived
+  });
   return {
     exists: true,
     tracked: wasTracked,
@@ -2004,6 +3126,8 @@ async function handleVerify(db, input) {
     latestVersion: registry?.latestVersion ?? row?.latestVersion ?? null,
     weeklyDownloads,
     riskFlags,
+    risk,
+    typosquatOf: typo?.target ?? null,
     confidence: row?.confidence ?? null,
     advisoryCount
   };
@@ -2013,12 +3137,19 @@ var init_handlers = __esm({
   "src/mcp/handlers.ts"() {
     "use strict";
     init_esm_shims();
+    init_cache();
     init_constants();
+    init_check();
+    init_packages();
+    init_verification();
     init_schema();
     init_sources();
     init_summarize();
     init_single();
+    init_score();
     init_recommend();
+    init_risk();
+    init_typosquat();
     SEVERITY_RANK = {
       critical: 4,
       high: 3,
@@ -2031,7 +3162,7 @@ var init_handlers = __esm({
 });
 
 // src/mcp/diagram.ts
-import { inArray } from "drizzle-orm";
+import { inArray as inArray2 } from "drizzle-orm";
 function layerFor(item) {
   if (!item.category) return UNCLASSIFIED;
   if (item.category === "framework" && BACKEND_FRAMEWORKS.has(item.label)) return "Backend";
@@ -2084,7 +3215,7 @@ async function handleDiagram(db, input) {
       note: "Provide a `stack` of package names to diagram. lurq labels a stack you choose; it does not infer an architecture from a description."
     };
   }
-  const rows = await db.select({ name: packages.name, category: packages.category }).from(packages).where(inArray(packages.name, input.stack));
+  const rows = await db.select({ name: packages.name, category: packages.category }).from(packages).where(inArray2(packages.name, input.stack));
   const known = new Map(rows.map((r) => [r.name, r.category]));
   const items = input.stack.map((name) => ({
     label: name,
@@ -2138,10 +3269,407 @@ var init_diagram = __esm({
   }
 });
 
+// src/compat/optimize.ts
+function conflictsFor(members, sandboxConflicts) {
+  const out = resolveArchitectureCompat(members);
+  for (let i = 0; i < members.length; i++) {
+    for (let j = i + 1; j < members.length; j++) {
+      const a = members[i].name;
+      const b = members[j].name;
+      const key = a <= b ? `${a}|${b}` : `${b}|${a}`;
+      if (sandboxConflicts.has(key)) {
+        out.push({
+          source: "sandbox",
+          packages: [a, b],
+          detail: `${a} and ${b} are recorded as incompatible (sandbox)`
+        });
+      }
+    }
+  }
+  return out;
+}
+function optimizeStack(slots, sandboxConflicts = /* @__PURE__ */ new Set()) {
+  if (slots.some((s) => s.length === 0)) {
+    throw new Error("optimizeStack: every slot must have at least one candidate");
+  }
+  const n = slots.length;
+  const budget = 5e4;
+  let nodes = 0;
+  let bestSelection = new Array(n).fill(0);
+  let bestRegret = conflictsFor(
+    slots.map((c) => c[0]).filter((m) => Boolean(m)),
+    sandboxConflicts
+  ).length === 0 ? 0 : Infinity;
+  const chosen = new Array(n).fill(0);
+  const dfs = (slot, regret) => {
+    if (nodes++ > budget || regret >= bestRegret) return;
+    if (slot === n) {
+      bestSelection = chosen.slice();
+      bestRegret = regret;
+      return;
+    }
+    const candidates = slots[slot];
+    for (let i = 0; i < candidates.length; i++) {
+      chosen[slot] = i;
+      const assigned = chosen.slice(0, slot + 1).map((idx, s) => slots[s][idx]);
+      if (conflictsFor(assigned, sandboxConflicts).length === 0) {
+        dfs(slot + 1, regret + i);
+      }
+      if (nodes > budget) return;
+    }
+  };
+  dfs(0, 0);
+  const members = bestSelection.map((idx, s) => slots[s][idx]);
+  return {
+    selection: bestSelection,
+    conflicts: conflictsFor(members, sandboxConflicts),
+    regret: bestRegret === Infinity ? bestSelection.reduce((a, b) => a + b, 0) : bestRegret
+  };
+}
+var init_optimize = __esm({
+  "src/compat/optimize.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_peerCompat();
+  }
+});
+
+// src/mcp/plan.ts
+var plan_exports = {};
+__export(plan_exports, {
+  decomposeHeuristic: () => decomposeHeuristic,
+  familyOf: () => familyOf,
+  flagSlotConflicts: () => flagSlotConflicts,
+  handlePlan: () => handlePlan,
+  orderCandidates: () => orderCandidates,
+  resolvePins: () => resolvePins
+});
+import { createHash as createHash4 } from "crypto";
+import { inArray as inArray3 } from "drizzle-orm";
+function packageToCandidate(row) {
+  return {
+    name: row.name,
+    category: row.category,
+    healthScore: row.healthScore ?? 0,
+    qualityScore: row.qualityScore,
+    confidence: row.confidence ?? "unproven",
+    why: "pinned by you",
+    latestVersion: row.latestVersion,
+    weeklyDownloads: row.weeklyDownloads,
+    lastReleaseAt: row.lastReleaseAt ? row.lastReleaseAt.toISOString() : null,
+    repoUrl: row.repoUrl
+  };
+}
+async function resolvePins(db, using, recommendedNames) {
+  const slots = [];
+  const unresolved = [];
+  for (const name of new Set(using ?? [])) {
+    if (recommendedNames.has(name)) continue;
+    const { row } = await getOrFetchPackage(db, name);
+    if (!row) {
+      unresolved.push(name);
+      continue;
+    }
+    slots.push({
+      need: `using ${name}`,
+      category: row.category,
+      layer: layerFor({ label: name, category: row.category }),
+      recommended: packageToCandidate(row),
+      alternatives: [],
+      // fixed: the user chose this, so it never gets swapped
+      note: "pinned by you"
+    });
+  }
+  return { slots, unresolved };
+}
+async function handlePlan(db, input) {
+  const optimize = input.optimize ?? "balanced";
+  const decomposed = input.needs?.length ? { needs: dedupeNeeds(input.needs), source: "needs" } : input.document?.trim() ? await decompose(input.document) : null;
+  const hasPins = Boolean(input.using?.length);
+  if ((!decomposed || decomposed.needs.length === 0) && !hasPins) {
+    return {
+      note: "Provide a `document` (a detailed description of your program), a `needs` array, or a `using` list of packages you have already chosen. lurq recommends evidence-scored packages per component \u2014 it does not invent an architecture from a bare prompt."
+    };
+  }
+  const needs = (decomposed?.needs ?? []).slice(0, MAX_SLOTS);
+  const source = decomposed?.source ?? "needs";
+  const safeRecommend = (need, category) => recommend(db, { need, category, limit: PER_SLOT }).catch((err) => {
+    logger.warn(`plan: recommend failed for "${need}": ${err.message}`);
+    return [];
+  });
+  const effCat = (n) => n.category ?? inferCategory(n.need) ?? void 0;
+  const anchorFamily = familyOf(`${input.document ?? ""} ${needs.map((n) => n.need).join(" ")}`);
+  const metaIdx = needs.findIndex((n) => effCat(n) === "meta-framework");
+  const anchorIdx = metaIdx >= 0 ? metaIdx : needs.findIndex((n) => effCat(n) === "framework");
+  const recs = new Array(needs.length);
+  let framework = anchorFamily;
+  if (anchorIdx >= 0) {
+    recs[anchorIdx] = await safeRecommend(needs[anchorIdx].need, effCat(needs[anchorIdx]));
+    framework = recs[anchorIdx][0]?.name ?? anchorFamily;
+  }
+  const [, dataAsOf] = await Promise.all([
+    Promise.all(
+      needs.map(async (n, i) => {
+        if (i === anchorIdx) return;
+        const need = framework ? `${n.need} (for a ${framework} app)` : n.need;
+        recs[i] = await safeRecommend(need, effCat(n));
+      })
+    ),
+    latestDataAsOf(db)
+  ]);
+  const bundleByName = optimize === "speed" ? await bundleSizes(db, recs.flat()) : /* @__PURE__ */ new Map();
+  const recSlots = needs.map((n, i) => {
+    const candidates = orderCandidates(recs[i], anchorFamily, optimize, bundleByName);
+    const recommended = candidates[0] ?? null;
+    const category = n.category ?? recommended?.category ?? inferCategory(n.need);
+    return {
+      need: n.need,
+      category,
+      layer: layerFor({ label: recommended?.name ?? n.need, category }),
+      recommended,
+      alternatives: candidates.slice(1),
+      note: recommended ? void 0 : "no tracked package matched this need yet"
+    };
+  });
+  const recommendedNames = new Set(
+    recSlots.map((s) => s.recommended?.name).filter((n) => Boolean(n))
+  );
+  const { slots: pinnedSlots, unresolved: unresolvedPins } = await resolvePins(
+    db,
+    input.using,
+    recommendedNames
+  );
+  const slots = [...pinnedSlots, ...recSlots];
+  const compatibility = await resolveCompat(db, slots);
+  const unmatched = [
+    ...slots.filter((s) => !s.recommended).map((s) => s.need),
+    ...unresolvedPins.map((n) => `${n} (pinned, but not found on npm)`)
+  ];
+  const mermaid = buildMermaid(
+    slots.filter((s) => s.recommended).map((s) => ({ label: s.recommended.name, category: s.category }))
+  );
+  return {
+    dataAsOf,
+    optimize,
+    source,
+    framework,
+    slots,
+    unmatched,
+    mermaid,
+    note: planNote(source, unmatched.length, optimize, framework),
+    compatibility
+  };
+}
+function flagSlotConflicts(picks, conflicts) {
+  const out = /* @__PURE__ */ new Map();
+  for (const c of conflicts) {
+    for (const p of picks) {
+      if (p.name && c.packages.includes(p.name)) {
+        const others = c.packages.filter((n) => n !== p.name);
+        out.set(p.need, [.../* @__PURE__ */ new Set([...out.get(p.need) ?? [], ...others])]);
+      }
+    }
+  }
+  return out;
+}
+async function resolveCompat(db, slots) {
+  const eligible = slots.filter((s) => s.recommended);
+  if (eligible.length < 2) return null;
+  try {
+    const allNames = [
+      ...new Set(eligible.flatMap((s) => [s.recommended, ...s.alternatives].map((c) => c.name)))
+    ];
+    const [{ members }, edges] = await Promise.all([
+      assembleMembers(db, allNames),
+      getCompatEdges(db, allNames)
+    ]);
+    const metaByName = new Map(members.map((m) => [m.name, m]));
+    const sandboxConflicts = new Set(
+      edges.filter((e) => e.status === "conflict").map((e) => `${e.packageA}|${e.packageB}`)
+    );
+    const slotCandidates = eligible.map(
+      (s) => [s.recommended, ...s.alternatives].map((c) => metaByName.get(c.name) ?? NO_META(c))
+    );
+    const { selection } = optimizeStack(slotCandidates, sandboxConflicts);
+    eligible.forEach((s, i) => {
+      const idx = selection[i] ?? 0;
+      if (idx <= 0) return;
+      const all = [s.recommended, ...s.alternatives];
+      const chosen = all[idx];
+      if (!chosen) return;
+      s.recommended = chosen;
+      s.alternatives = all.filter((c) => c.name !== chosen.name);
+      s.swappedFrom = all[0].name;
+    });
+  } catch (err) {
+    logger.warn(`plan: compat optimization failed: ${String(err)}`);
+  }
+  const compat = await checkCompat(
+    db,
+    eligible.map((s) => s.recommended.name)
+  ).catch(() => null);
+  if (compat) {
+    const flags = flagSlotConflicts(
+      slots.map((s) => ({ need: s.need, name: s.recommended?.name ?? null })),
+      compat.conflicts
+    );
+    for (const s of slots) {
+      const cw = flags.get(s.need);
+      s.conflictsWith = cw?.length ? cw : void 0;
+    }
+  }
+  return compat;
+}
+function planNote(source, unmatched, optimize, framework) {
+  const base = source === "heuristic" ? "Components were extracted from your document with a keyword heuristic (no summary LLM configured) \u2014 coarse; pass a `needs` array or set SUMMARY_API_KEY for sharper decomposition." : source === "llm" ? "Components were extracted from your document by the summary model." : "Components taken from the supplied needs.";
+  const grounding = " Each package is recommended from lurq\u2019s scored index \u2014 a labeled, evidence-backed starting point, not a validated architecture.";
+  const ctx = framework ? ` Anchored to the ${framework} ecosystem so sibling libraries stay coherent across the stack.` : "";
+  const tail = unmatched ? ` ${unmatched} need(s) had no tracked match (listed in \`unmatched\`).` : "";
+  const opt = optimize === "speed" ? " Ranking favored the lightest-bundle option per slot." : "";
+  return base + grounding + ctx + opt + tail;
+}
+function dedupeNeeds(needs) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const n of needs) {
+    const key = n.need.trim().toLowerCase();
+    if (!key) continue;
+    if (!seen.has(key)) seen.set(key, { need: n.need.trim(), category: n.category });
+  }
+  return [...seen.values()];
+}
+function familyOf(name) {
+  const n = name.toLowerCase();
+  for (const f of FAMILY_TOKENS) if (f.re.test(n)) return f.family;
+  return null;
+}
+function orderCandidates(cands, anchorFamily, optimize, bundleByName) {
+  const coherence = (c) => {
+    const fam = familyOf(c.name);
+    if (!fam) return 0;
+    return fam === anchorFamily ? 1 : -1;
+  };
+  return [...cands].sort((a, b) => {
+    if (anchorFamily) {
+      const d = coherence(b) - coherence(a);
+      if (d) return d;
+    }
+    if (optimize === "speed") {
+      return (bundleByName.get(a.name) ?? Infinity) - (bundleByName.get(b.name) ?? Infinity);
+    }
+    return 0;
+  });
+}
+async function bundleSizes(db, candidates) {
+  const names = [...new Set(candidates.map((c) => c.name))];
+  if (names.length === 0) return /* @__PURE__ */ new Map();
+  const rows = await db.select({ name: packages.name, bundle: packages.bundleMinGzipKb }).from(packages).where(inArray3(packages.name, names));
+  return new Map(rows.filter((r) => r.bundle != null).map((r) => [r.name, r.bundle]));
+}
+async function decompose(document) {
+  const config = getConfig();
+  if (config.SUMMARY_PROVIDER === "openai" && config.SUMMARY_API_KEY) {
+    const llm = await decomposeWithLlm(document, config.SUMMARY_API_KEY, config.SUMMARY_MODEL).catch(
+      (err) => {
+        logger.warn(`plan: LLM decomposition failed, using heuristic: ${err.message}`);
+        return null;
+      }
+    );
+    if (llm?.length) return { needs: dedupeNeeds(llm), source: "llm" };
+  }
+  return { needs: decomposeHeuristic(document), source: "heuristic" };
+}
+async function decomposeWithLlm(document, apiKey, model) {
+  const prompt = [
+    "Project description:",
+    document.slice(0, 8e3),
+    "",
+    'Return JSON: { "needs": [ { "need": "<one phrase describing a component that needs a library>", "category": "<optional taxonomy hint or empty>" } ] }.',
+    "One entry per distinct component (e.g. routing, validation, ORM, HTTP client). Omit anything not implied by the description."
+  ].join("\n");
+  const { data } = await httpRequest("https://api.openai.com/v1/chat/completions", {
+    host: "api.openai.com",
+    method: "POST",
+    ttlMs: 24 * 60 * 60 * 1e3,
+    // Hash the FULL document — length + a 64-char prefix collide for same-length
+    // edits or shared templated headers, which would serve a stale decomposition.
+    cacheKey: `openai-plan ${model} ${createHash4("sha1").update(document).digest("hex")}`,
+    headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+    body: JSON.stringify({
+      model,
+      messages: [
+        { role: "system", content: DECOMPOSE_SYSTEM },
+        { role: "user", content: prompt }
+      ],
+      response_format: { type: "json_object" },
+      temperature: 0.2
+    })
+  });
+  const content = data?.choices?.[0]?.message?.content;
+  const parsed = content ? JSON.parse(content) : {};
+  const raw = Array.isArray(parsed?.needs) ? parsed.needs : [];
+  return raw.map((n) => {
+    const need = typeof n?.need === "string" ? n.need.trim() : "";
+    if (!need) return null;
+    const cat = typeof n?.category === "string" && isCategory(n.category) ? n.category : void 0;
+    return { need, category: cat };
+  }).filter(Boolean);
+}
+function decomposeHeuristic(document) {
+  const byCategory = /* @__PURE__ */ new Map();
+  for (const rawLine of document.split("\n")) {
+    const line = rawLine.replace(/^[#>*\-\s]+/, "").replace(/^\d+\.\s+/, "").trim();
+    if (line.length < 3) continue;
+    const category = inferCategory(line);
+    if (category && !byCategory.has(category)) {
+      byCategory.set(category, line.slice(0, 120));
+    }
+  }
+  return [...byCategory.entries()].map(([category, need]) => ({ need, category }));
+}
+var PER_SLOT, MAX_SLOTS, NO_META, FAMILY_TOKENS, DECOMPOSE_SYSTEM;
+var init_plan = __esm({
+  "src/mcp/plan.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_http();
+    init_check();
+    init_members();
+    init_optimize();
+    init_compat();
+    init_logger();
+    init_types();
+    init_schema();
+    init_categoryInference();
+    init_recommend();
+    init_single();
+    init_diagram();
+    init_handlers();
+    PER_SLOT = 3;
+    MAX_SLOTS = 24;
+    NO_META = (c) => ({
+      name: c.name,
+      version: c.latestVersion,
+      peerDependencies: null,
+      peerDependenciesMeta: null,
+      engines: null
+    });
+    FAMILY_TOKENS = [
+      { family: "react", re: /\breact\b|preact/ },
+      { family: "vue", re: /\bvue\b|nuxt/ },
+      { family: "angular", re: /angular/ },
+      { family: "svelte", re: /svelte/ },
+      { family: "solid", re: /\bsolid(-?js)?\b/ }
+    ];
+    DECOMPOSE_SYSTEM = "You break a software project description into the distinct technical components that each need a library. Return ONLY components the project actually requires, grounded in the description. Respond with a JSON object.";
+  }
+});
+
 // src/mcp/server.ts
 var server_exports = {};
 __export(server_exports, {
   buildMcpServer: () => buildMcpServer,
+  npmName: () => npmName,
   startMcpServer: () => startMcpServer
 });
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -2171,7 +3699,7 @@ function buildMcpServer(db) {
       title: "Evaluate a package",
       description: "Full evidence read for one npm package: scores, signals, advisories, summary, and a usage guide. Fetches & scores on demand if not yet tracked.",
       inputSchema: {
-        package: z2.string().min(1).describe("npm package name")
+        package: npmName.describe("npm package name")
       }
     },
     async (args) => json(await handleEvaluate(db, args))
@@ -2182,18 +3710,29 @@ function buildMcpServer(db) {
       title: "Compare packages",
       description: "Side-by-side comparison of 2\u20135 npm packages, ranked by health score.",
       inputSchema: {
-        packages: z2.array(z2.string().min(1)).min(2).max(5).describe("2\u20135 npm package names")
+        packages: z2.array(npmName).min(2).max(5).describe("2\u20135 npm package names")
       }
     },
     async (args) => json(await handleCompare(db, args))
   );
+  server.registerTool(
+    "compat",
+    {
+      title: "Check package compatibility",
+      description: "Check whether a set of packages forms a coherent stack: peer-dependency and engine-range compatibility across the whole set (instant, from declared metadata), plus any recorded sandbox-verified conflicts. Returns the exact clashing constraints. Read-only \u2014 does not run installs. Call before committing to a multi-package stack.",
+      inputSchema: {
+        packages: z2.array(npmName).min(2).max(8).describe("2\u20138 npm package names to check together")
+      }
+    },
+    async (args) => json(await handleCompat(db, args))
+  );
   server.registerTool(
     "verify",
     {
       title: "Verify a package",
       description: "Confirm an npm package is real, healthy, and not risky before installing \u2014 guards against hallucinated or typosquatted dependency names. Checks the live registry.",
       inputSchema: {
-        package: z2.string().min(1).describe("npm package name to verify")
+        package: npmName.describe("npm package name to verify")
       }
     },
     async (args) => json(await handleVerify(db, args))
@@ -2204,11 +3743,32 @@ function buildMcpServer(db) {
       title: "Reference architecture diagram",
       description: "Emit a reference-architecture Mermaid diagram for a stack you have already chosen (package names). A labeled starting point keyed by layer \u2014 not a validated architecture, and not an architecture designer.",
       inputSchema: {
-        stack: z2.array(z2.string()).optional().describe("Package names that make up the stack; omit or empty to get usage guidance")
+        stack: z2.array(npmName).optional().describe("Package names that make up the stack; omit or empty to get usage guidance")
       }
     },
     async (args) => json(await handleDiagram(db, args))
   );
+  server.registerTool(
+    "plan",
+    {
+      title: "Plan a stack from a program description",
+      description: "Turn a detailed program description (spec/README) or a list of component needs into an evidence-scored build plan: a real, lurq-scored package recommended per component, plus a Mermaid roadmap other agents can parse. Recommends building blocks slot-by-slot from the index \u2014 it does not invent an architecture from a bare prompt.",
+      inputSchema: {
+        document: z2.string().optional().describe("Detailed description of the program (spec/README); lurq decomposes it into components"),
+        needs: z2.array(
+          z2.object({
+            need: z2.string().min(1).describe("A component that needs a library"),
+            category: categoryEnum.optional()
+          })
+        ).optional().describe("Pre-decomposed components (skip if you pass a document)"),
+        using: z2.array(npmName).max(12).optional().describe(
+          "Packages you have already decided on. lurq pins these as fixed slots, recommends only the remaining needs, and checks/optimizes the whole stack around your picks."
+        ),
+        optimize: z2.enum(["speed", "balanced"]).optional().describe("'speed' prefers the lightest-bundle option per slot; default 'balanced'")
+      }
+    },
+    async (args) => json(await handlePlan(db, args))
+  );
   return server;
 }
 async function startMcpServer() {
@@ -2227,7 +3787,7 @@ async function startMcpServer() {
   await server.connect(transport);
   logger.info(`${SERVER_NAME} MCP server v${VERSION} running on stdio.`);
 }
-var categoryEnum, confidenceEnum, constraintsSchema;
+var categoryEnum, confidenceEnum, npmName, constraintsSchema;
 var init_server = __esm({
   "src/mcp/server.ts"() {
     "use strict";
@@ -2238,8 +3798,10 @@ var init_server = __esm({
     init_logger();
     init_handlers();
     init_diagram();
+    init_plan();
     categoryEnum = z2.enum(CATEGORIES);
-    confidenceEnum = z2.enum(["proven", "emerging", "unproven"]);
+    confidenceEnum = z2.enum(["proven", "emerging", "promising", "unproven"]);
+    npmName = z2.string().trim().min(1).max(214).regex(/^(?:@[a-z0-9-][a-z0-9-._]*\/)?[a-z0-9-][a-z0-9-._]*$/i, "Invalid npm package name");
     constraintsSchema = z2.object({
       runtime: z2.enum(["browser", "node", "both"]).optional(),
       license: z2.string().optional(),
@@ -2249,75 +3811,895 @@ var init_server = __esm({
   }
 });
 
-// src/pipeline/index.ts
-var pipeline_exports = {};
-__export(pipeline_exports, {
-  runSync: () => runSync
-});
-var init_pipeline = __esm({
-  "src/pipeline/index.ts"() {
+// src/auth/apiKeys.ts
+import { createHash as createHash5, randomBytes } from "crypto";
+import { and as and5, desc as desc3, eq as eq5, isNull } from "drizzle-orm";
+function hashKey(key) {
+  return createHash5("sha256").update(key).digest("hex");
+}
+function generateApiKey() {
+  const body = randomBytes(24).toString("base64url");
+  const key = API_KEY_PREFIX + body;
+  return { key, hash: hashKey(key), prefix: API_KEY_PREFIX + body.slice(0, DISPLAY_BODY) };
+}
+async function createKey(db, input = {}) {
+  const { key, hash, prefix } = generateApiKey();
+  const [row] = await db.insert(apiKeys).values({
+    keyHash: hash,
+    prefix,
+    label: input.label,
+    tier: input.tier ?? "free",
+    ownerId: input.ownerId
+  }).returning();
+  return { key, row };
+}
+async function lookupActiveKey(db, key) {
+  const hash = hashKey(key);
+  const [row] = await db.select().from(apiKeys).where(and5(eq5(apiKeys.keyHash, hash), isNull(apiKeys.revokedAt))).limit(1);
+  if (!row) return null;
+  db.update(apiKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq5(apiKeys.id, row.id)).then(void 0, () => {
+  });
+  return row;
+}
+async function listKeys(db) {
+  return db.select().from(apiKeys).orderBy(desc3(apiKeys.createdAt));
+}
+function matchByPrefixOrId(prefixOrId) {
+  const asId = Number(prefixOrId);
+  return Number.isInteger(asId) && String(asId) === prefixOrId.trim() ? eq5(apiKeys.id, asId) : eq5(apiKeys.prefix, prefixOrId);
+}
+async function revokeKey(db, prefixOrId) {
+  const rows = await db.update(apiKeys).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and5(matchByPrefixOrId(prefixOrId), isNull(apiKeys.revokedAt))).returning({ id: apiKeys.id });
+  return rows.length;
+}
+async function rotateKey(db, prefixOrId) {
+  const [previous] = await db.select().from(apiKeys).where(and5(matchByPrefixOrId(prefixOrId), isNull(apiKeys.revokedAt))).limit(1);
+  if (!previous) return null;
+  const { key, row } = await createKey(db, {
+    label: previous.label ?? void 0,
+    tier: previous.tier,
+    ownerId: previous.ownerId ?? void 0
+  });
+  await db.update(apiKeys).set({ revokedAt: /* @__PURE__ */ new Date() }).where(eq5(apiKeys.id, previous.id));
+  return { key, row, previous };
+}
+var DISPLAY_BODY;
+var init_apiKeys = __esm({
+  "src/auth/apiKeys.ts"() {
     "use strict";
     init_esm_shims();
-    init_sync();
+    init_constants();
+    init_schema();
+    DISPLAY_BODY = 6;
   }
 });
 
-// src/cli/format.ts
-function table(headers, rows) {
-  const widths = headers.map((h, i) => Math.max(width(h), ...rows.map((r) => width(r[i] ?? ""))));
-  const pad = (s, w) => s + " ".repeat(Math.max(0, w - width(s)));
-  const line = (cells) => cells.map((c, i) => pad(c, widths[i])).join("  ");
-  const out = [bold(line(headers)), dim(widths.map((w) => "\u2500".repeat(w)).join("  "))];
-  for (const r of rows) out.push(line(r));
-  return out.join("\n");
-}
-function detail(pairs) {
-  const labelWidth = Math.max(...pairs.map(([k]) => k.length));
-  return pairs.map(([k, v]) => `${dim((k + ":").padEnd(labelWidth + 1))} ${v}`).join("\n");
-}
-function formatNumber(n) {
-  if (n == null) return "\u2014";
-  if (n >= 1e6) return `${Math.round(n / 1e5) / 10}M`;
-  if (n >= 1e3) return `${Math.round(n / 100) / 10}k`;
-  return String(n);
-}
-function formatDate(iso) {
-  return iso ? iso.slice(0, 10) : "\u2014";
-}
-function formatPercent(fraction) {
-  if (fraction == null) return "\u2014";
-  const pct = Math.round(fraction * 1e3) / 10;
-  return `${pct > 0 ? "+" : ""}${pct}%`;
+// src/mcp/http.ts
+var http_exports = {};
+__export(http_exports, {
+  startHttpServer: () => startHttpServer
+});
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+function rpcError(code, message) {
+  return { jsonrpc: "2.0", error: { code, message }, id: null };
 }
-function confidenceLabel(c) {
-  if (c === "proven") return green(c);
-  if (c === "emerging") return yellow(c);
-  return red(c);
+async function startHttpServer(opts = {}) {
+  const config = getConfig();
+  const port = opts.port ?? config.PORT;
+  const [{ default: express }, { default: helmet }, { rateLimit, ipKeyGenerator }] = await Promise.all([import("express"), import("helmet"), import("express-rate-limit")]);
+  const { db } = createDb({ max: 20 });
+  const app = express();
+  app.set("trust proxy", 1);
+  app.use(helmet());
+  app.use(express.json({ limit: "1mb" }));
+  app.get("/healthz", (_req, res) => {
+    res.status(200).json({ status: "ok" });
+  });
+  const ipLimiter = rateLimit({
+    windowMs: config.LURQ_RATE_LIMIT_WINDOW_MS,
+    limit: config.LURQ_IP_RATE_LIMIT_MAX,
+    standardHeaders: "draft-7",
+    legacyHeaders: false,
+    message: rpcError(-32029, "Rate limit exceeded.")
+  });
+  const auth = async (req, res, next) => {
+    const header = req.headers.authorization;
+    const token = header?.startsWith("Bearer ") ? header.slice(7).trim() : "";
+    if (!token) {
+      res.status(401).json(rpcError(-32001, "Missing API key. Pass Authorization: Bearer <key>."));
+      return;
+    }
+    try {
+      const row = await lookupActiveKey(db, token);
+      if (!row) {
+        res.status(401).json(rpcError(-32001, "Invalid or revoked API key."));
+        return;
+      }
+      req.lurqKey = row;
+      next();
+    } catch (err) {
+      logger.error("auth lookup failed:", err instanceof Error ? err.message : String(err));
+      res.status(500).json(rpcError(-32603, "Internal error."));
+    }
+  };
+  const keyLimiter = rateLimit({
+    windowMs: config.LURQ_RATE_LIMIT_WINDOW_MS,
+    limit: config.LURQ_RATE_LIMIT_MAX,
+    standardHeaders: "draft-7",
+    legacyHeaders: false,
+    // Key on the resolved API key's unique row id (always present — auth runs
+    // first). The display `prefix` is only 6 chars of body, so distinct keys
+    // can collide on it and share a quota; the id cannot. The IP fallback uses
+    // express-rate-limit's ipKeyGenerator so IPv6 addresses are normalized
+    // correctly (v8 throws ERR_ERL_KEY_GEN_IPV6 on a raw req.ip).
+    keyGenerator: (req) => {
+      const id = req.lurqKey?.id;
+      return id != null ? `key:${id}` : ipKeyGenerator(req.ip ?? "0.0.0.0");
+    },
+    message: rpcError(-32029, "Rate limit exceeded.")
+  });
+  app.post("/mcp", ipLimiter, auth, keyLimiter, async (req, res) => {
+    const server = buildMcpServer(db);
+    const transport = new StreamableHTTPServerTransport({
+      sessionIdGenerator: void 0,
+      enableJsonResponse: true
+    });
+    res.on("close", () => {
+      void transport.close();
+      void server.close();
+    });
+    try {
+      await server.connect(transport);
+      await transport.handleRequest(req, res, req.body);
+    } catch (err) {
+      logger.error("mcp request failed:", err instanceof Error ? err.message : String(err));
+      if (!res.headersSent) res.status(500).json(rpcError(-32603, "Internal error"));
+    }
+  });
+  app.all("/mcp", (_req, res) => {
+    res.status(405).json(rpcError(-32e3, "Method not allowed."));
+  });
+  app.listen(port, () => {
+    logger.info(`lurq HTTP MCP server listening on :${port}/mcp`);
+  });
 }
-var ESC, wrap, bold, dim, red, green, yellow, ANSI_RE, width;
-var init_format = __esm({
-  "src/cli/format.ts"() {
+var init_http2 = __esm({
+  "src/mcp/http.ts"() {
     "use strict";
     init_esm_shims();
-    ESC = "\x1B[";
-    wrap = (code, s) => `${ESC}${code}m${s}${ESC}0m`;
-    bold = (s) => wrap("1", s);
-    dim = (s) => wrap("2", s);
-    red = (s) => wrap("31", s);
-    green = (s) => wrap("32", s);
-    yellow = (s) => wrap("33", s);
-    ANSI_RE = /\[[0-9;]*m/g;
-    width = (s) => s.replace(ANSI_RE, "").length;
+    init_config();
+    init_logger();
+    init_apiKeys();
+    init_client();
+    init_server();
   }
 });
 
-// src/cli/commands.ts
-var commands_exports = {};
-__export(commands_exports, {
-  runCompare: () => runCompare,
-  runEvaluate: () => runEvaluate,
+// src/pipeline/rescore.ts
+import { isNotNull as isNotNull4 } from "drizzle-orm";
+import { eq as eq6 } from "drizzle-orm";
+async function runRescore() {
+  const weights = loadWeights();
+  const handle = createDb({ max: 4 });
+  try {
+    const rows = await handle.db.select({ id: packages.id, breakdown: packages.scoreBreakdown, healthScore: packages.healthScore }).from(packages).where(isNotNull4(packages.scoreBreakdown));
+    let updated = 0;
+    for (const row of rows) {
+      if (!row.breakdown) continue;
+      const health = computeHealthScore(row.breakdown, weights.health);
+      if (health !== row.healthScore) {
+        await handle.db.update(packages).set({ healthScore: health, updatedAt: /* @__PURE__ */ new Date() }).where(eq6(packages.id, row.id));
+        updated++;
+      }
+    }
+    logger.info(`Rescored ${rows.length} package(s); ${updated} health score(s) changed.`);
+    if (updated > 0) await invalidateCache();
+    return { seen: rows.length, updated };
+  } finally {
+    await handle.close();
+  }
+}
+var init_rescore = __esm({
+  "src/pipeline/rescore.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_cache();
+    init_logger();
+    init_client();
+    init_schema();
+    init_scoring();
+    init_weights();
+  }
+});
+
+// src/db/discovery.ts
+import { eq as eq7 } from "drizzle-orm";
+async function getKnownNames(db) {
+  const [tracked, queued] = await Promise.all([
+    db.select({ name: packages.name }).from(packages),
+    db.select({ name: discoveryQueue.name }).from(discoveryQueue)
+  ]);
+  return /* @__PURE__ */ new Set([...tracked.map((r) => r.name), ...queued.map((r) => r.name)]);
+}
+async function enqueueCandidates(db, candidates) {
+  if (candidates.length === 0) return 0;
+  const rows = candidates.map((c) => ({ name: c.name, discoveredVia: c.via }));
+  const inserted = await db.insert(discoveryQueue).values(rows).onConflictDoNothing({ target: discoveryQueue.name }).returning({ id: discoveryQueue.id });
+  return inserted.length;
+}
+async function getPendingCandidates(db, limit) {
+  return db.select().from(discoveryQueue).where(eq7(discoveryQueue.status, "pending")).limit(limit);
+}
+async function setDiscoveryStatus(db, name, data) {
+  await db.update(discoveryQueue).set({ status: data.status, ...data.preScore !== void 0 ? { preScore: data.preScore } : {} }).where(eq7(discoveryQueue.name, name));
+}
+var init_discovery = __esm({
+  "src/db/discovery.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_schema();
+  }
+});
+
+// src/pipeline/discovery.ts
+import { isNotNull as isNotNull5 } from "drizzle-orm";
+function selectCandidates(raw, known) {
+  const seen = new Set(known);
+  const out = [];
+  for (const c of raw) {
+    const name = c.name?.trim();
+    if (!name || seen.has(name)) continue;
+    seen.add(name);
+    out.push({ name, via: c.via });
+  }
+  return out;
+}
+function passesGate(preScore) {
+  return preScore !== null && preScore >= DISCOVERY.minPreScore;
+}
+async function preScorePackage(name, fetchImpl) {
+  try {
+    const registry = await fetchNpmRegistry(name, fetchImpl);
+    const signals = {
+      name,
+      registry,
+      downloads: null,
+      github: null,
+      depsDev: null,
+      bundle: null,
+      errors: []
+    };
+    return computeQuality(toScoringInput(signals, null));
+  } catch {
+    return null;
+  }
+}
+async function graphChannel(db) {
+  const tracked = await db.select({ name: packages.name, version: packages.latestVersion }).from(packages).where(isNotNull5(packages.latestVersion));
+  const out = [];
+  for (const t of tracked) {
+    if (!t.version) continue;
+    const deps = (await fetchDependencyNames(t.name, t.version)).slice(
+      0,
+      DISCOVERY.graphNeighborsPerSeed
+    );
+    for (const name of deps) out.push({ name, via: "dependency-graph" });
+  }
+  return out;
+}
+async function searchChannel() {
+  const out = [];
+  for (const category of CATEGORIES) {
+    if (category === "other") continue;
+    const hits = await searchNpm(`keywords:${category}`, DISCOVERY.searchSizePerCategory);
+    for (const hit of hits) {
+      const via = isRecent(hit.date) ? "recent" : "category-search";
+      out.push({ name: hit.name, via });
+    }
+  }
+  return out;
+}
+function isRecent(date) {
+  if (!date) return false;
+  const ms = Date.parse(date);
+  if (Number.isNaN(ms)) return false;
+  return Date.now() - ms <= 90 * 24 * 60 * 60 * 1e3;
+}
+async function runDiscovery(opts = {}) {
+  const cap = opts.perRunCap ?? DISCOVERY.perRunCap;
+  const handle = createDb({ max: 6 });
+  try {
+    logger.info("Discovery: gathering candidates from graph + search channels\u2026");
+    const [graph, search] = await Promise.all([graphChannel(handle.db), searchChannel()]);
+    const known = await getKnownNames(handle.db);
+    const fresh = selectCandidates([...graph, ...search], known);
+    const enqueued = await enqueueCandidates(handle.db, fresh);
+    logger.info(
+      `Discovery: ${graph.length} graph + ${search.length} search candidates \u2192 ${enqueued} new queued.`
+    );
+    const pending = await getPendingCandidates(handle.db, cap * 4);
+    const scored = [];
+    for (const cand of pending) {
+      const preScore = await preScorePackage(cand.name);
+      await setDiscoveryStatus(handle.db, cand.name, {
+        status: passesGate(preScore) ? "pending" : "rejected",
+        preScore: preScore ?? null
+      });
+      if (passesGate(preScore)) scored.push({ name: cand.name, preScore });
+    }
+    logger.info(`Discovery: gated ${pending.length}; ${scored.length} cleared the quality bar.`);
+    scored.sort((a, b) => b.preScore - a.preScore);
+    const toIngest = scored.slice(0, cap);
+    const deferred = scored.slice(cap);
+    if (deferred.length > 0) {
+      logger.info(
+        `Discovery: per-run cap ${cap} reached \u2014 ${deferred.length} eligible candidate(s) deferred to the next run: ${deferred.map((d) => d.name).join(", ")}`
+      );
+    }
+    let ingested = 0;
+    if (!opts.dryRun) {
+      for (const cand of toIngest) {
+        try {
+          await syncOnePackage(handle.db, cand.name);
+          await setDiscoveryStatus(handle.db, cand.name, { status: "ingested" });
+          ingested++;
+        } catch (err) {
+          logger.warn(`Discovery: failed to ingest ${cand.name}: ${err.message}`);
+        }
+      }
+    }
+    logger.info(`Discovery: ingested ${ingested}/${toIngest.length} candidate(s).`);
+    return {
+      enqueued,
+      gated: pending.length,
+      passed: scored.length,
+      ingested,
+      droppedToNextRun: deferred.length
+    };
+  } finally {
+    await handle.close();
+  }
+}
+var init_discovery2 = __esm({
+  "src/pipeline/discovery.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_logger();
+    init_types();
+    init_client();
+    init_discovery();
+    init_schema();
+    init_depsDev();
+    init_npmRegistry();
+    init_npmSearch();
+    init_scoring();
+    init_weights();
+    init_single();
+  }
+});
+
+// src/pipeline/index.ts
+var pipeline_exports = {};
+__export(pipeline_exports, {
+  runDiscovery: () => runDiscovery,
+  runRescore: () => runRescore,
+  runSync: () => runSync
+});
+var init_pipeline = __esm({
+  "src/pipeline/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_sync();
+    init_rescore();
+    init_discovery2();
+  }
+});
+
+// src/cli/format.ts
+function table(headers, rows) {
+  const widths = headers.map((h, i) => Math.max(width(h), ...rows.map((r) => width(r[i] ?? ""))));
+  const pad = (s, w) => s + " ".repeat(Math.max(0, w - width(s)));
+  const line = (cells) => cells.map((c, i) => pad(c, widths[i])).join("  ");
+  const out = [bold(line(headers)), dim(widths.map((w) => "\u2500".repeat(w)).join("  "))];
+  for (const r of rows) out.push(line(r));
+  return out.join("\n");
+}
+function detail(pairs) {
+  const labelWidth = Math.max(...pairs.map(([k]) => k.length));
+  return pairs.map(([k, v]) => `${dim((k + ":").padEnd(labelWidth + 1))} ${v}`).join("\n");
+}
+function formatNumber(n) {
+  if (n == null) return "\u2014";
+  if (n >= 1e6) return `${Math.round(n / 1e5) / 10}M`;
+  if (n >= 1e3) return `${Math.round(n / 100) / 10}k`;
+  return String(n);
+}
+function formatDate(iso) {
+  return iso ? iso.slice(0, 10) : "\u2014";
+}
+function formatPercent(fraction) {
+  if (fraction == null) return "\u2014";
+  const pct = Math.round(fraction * 1e3) / 10;
+  return `${pct > 0 ? "+" : ""}${pct}%`;
+}
+function confidenceLabel(c) {
+  if (c === "proven") return green(c);
+  if (c === "emerging") return yellow(c);
+  if (c === "promising") return green(c);
+  return red(c);
+}
+var ESC, wrap, bold, dim, red, green, yellow, ANSI_RE, width;
+var init_format = __esm({
+  "src/cli/format.ts"() {
+    "use strict";
+    init_esm_shims();
+    ESC = "\x1B[";
+    wrap = (code, s) => `${ESC}${code}m${s}${ESC}0m`;
+    bold = (s) => wrap("1", s);
+    dim = (s) => wrap("2", s);
+    red = (s) => wrap("31", s);
+    green = (s) => wrap("32", s);
+    yellow = (s) => wrap("33", s);
+    ANSI_RE = /\[[0-9;]*m/g;
+    width = (s) => s.replace(ANSI_RE, "").length;
+  }
+});
+
+// src/cli/planView.ts
+var planView_exports = {};
+__export(planView_exports, {
+  renderPlanHtml: () => renderPlanHtml
+});
+function esc(s) {
+  return s.replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
+}
+function slotRows(plan) {
+  return plan.slots.map((s) => {
+    const rec = s.recommended;
+    const name = rec ? rec.repoUrl ? `<a href="${esc(rec.repoUrl)}" target="_blank" rel="noreferrer">${esc(rec.name)}</a>` : esc(rec.name) : '<span class="muted">\u2014 no match \u2014</span>';
+    const alts = s.alternatives.map((a) => esc(a.name)).join(", ") || '<span class="muted">\u2014</span>';
+    return `<tr>
+        <td>${esc(s.need)}</td>
+        <td><span class="layer">${esc(s.layer)}</span></td>
+        <td class="pkg">${name}</td>
+        <td class="num">${rec ? rec.healthScore : "\u2014"}</td>
+        <td>${rec ? esc(rec.confidence) : "\u2014"}</td>
+        <td class="alts">${alts}</td>
+      </tr>`;
+  }).join("\n");
+}
+function renderPlanHtml(plan) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>lurq plan \u2014 roadmap</title>
+<style>
+  :root { color-scheme: dark; }
+  * { box-sizing: border-box; }
+  body { margin: 0; font: 15px/1.5 ui-sans-serif, system-ui, -apple-system, sans-serif;
+         background: #0b0b0f; color: #e7e7ea; padding: 2.5rem clamp(1rem, 5vw, 4rem); }
+  h1 { font-size: 1.5rem; margin: 0 0 .25rem; }
+  h2 { font-size: 1rem; text-transform: uppercase; letter-spacing: .08em; color: #9a9aa6; margin: 2.5rem 0 .75rem; }
+  .sub { color: #9a9aa6; margin: 0 0 1rem; max-width: 70ch; }
+  .diagram { background: #141419; border: 1px solid #26262e; border-radius: 14px; padding: 1.5rem; overflow: auto; }
+  table { width: 100%; border-collapse: collapse; margin-top: .5rem; }
+  th, td { text-align: left; padding: .55rem .75rem; border-bottom: 1px solid #1e1e25; vertical-align: top; }
+  th { font-size: .78rem; text-transform: uppercase; letter-spacing: .05em; color: #9a9aa6; }
+  .pkg a { color: #d98cff; text-decoration: none; } .pkg a:hover { text-decoration: underline; }
+  .num { text-align: right; font-variant-numeric: tabular-nums; }
+  .muted { color: #6a6a76; } .alts { color: #b8b8c2; font-size: .92rem; }
+  .layer { font-size: .8rem; color: #8ad; background: #15202b; border-radius: 6px; padding: .1rem .45rem; }
+  footer { margin-top: 2.5rem; color: #6a6a76; font-size: .85rem; }
+</style>
+</head>
+<body>
+  <h1>lurq plan <span class="muted">\xB7 ${esc(plan.optimize)} \xB7 ${esc(plan.source)}${plan.framework ? ` \xB7 ${esc(plan.framework)} ecosystem` : ""}</span></h1>
+  <p class="sub">${esc(plan.note)}</p>
+
+  <h2>Roadmap</h2>
+  <div class="diagram"><pre class="mermaid">${esc(plan.mermaid)}</pre></div>
+
+  <h2>Components</h2>
+  <table>
+    <thead><tr><th>Component</th><th>Layer</th><th>Recommended</th><th>Health</th><th>Confidence</th><th>Alternatives</th></tr></thead>
+    <tbody>
+${slotRows(plan)}
+    </tbody>
+  </table>
+
+  <footer>data as of ${esc(plan.dataAsOf)} \xB7 generated by lurq</footer>
+
+  <script type="module">
+    import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs';
+    mermaid.initialize({ startOnLoad: true, theme: 'dark' });
+  </script>
+</body>
+</html>
+`;
+}
+var init_planView = __esm({
+  "src/cli/planView.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/db/watch.ts
+import { eq as eq8 } from "drizzle-orm";
+async function getWatchCursor(db, id) {
+  const rows = await db.select({ seq: watchState.seq }).from(watchState).where(eq8(watchState.id, id)).limit(1);
+  return rows[0]?.seq ?? null;
+}
+async function setWatchCursor(db, id, seq) {
+  await db.insert(watchState).values({ id, seq, updatedAt: /* @__PURE__ */ new Date() }).onConflictDoUpdate({ target: watchState.id, set: { seq, updatedAt: /* @__PURE__ */ new Date() } });
+}
+var init_watch = __esm({
+  "src/db/watch.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_schema();
+  }
+});
+
+// src/pipeline/watch.ts
+var watch_exports = {};
+__export(watch_exports, {
+  parseChangeLine: () => parseChangeLine,
+  watchNpmChanges: () => watchNpmChanges
+});
+function parseChangeLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed) return null;
+  try {
+    const obj = JSON.parse(trimmed);
+    if (typeof obj?.id !== "string" || obj.seq == null) return null;
+    return { seq: obj.seq, id: obj.id, deleted: Boolean(obj.deleted) };
+  } catch {
+    return null;
+  }
+}
+async function watchNpmChanges(db, opts = {}) {
+  const { signal } = opts;
+  let backoff2 = 1e3;
+  while (!signal?.aborted) {
+    let tracked = new Set(await getAllPackageNames(db));
+    let trackedAt = Date.now();
+    const since = await getWatchCursor(db, FEED_ID) ?? opts.since ?? "now";
+    const url = `${FEED_URL}?feed=continuous&since=${encodeURIComponent(since)}&heartbeat=${HEARTBEAT_MS}`;
+    logger.info(`watch: connecting from seq=${since} (${tracked.size} tracked packages)`);
+    try {
+      const res = await fetch(url, { signal });
+      if (!res.ok || !res.body) throw new Error(`feed responded ${res.status}`);
+      backoff2 = 1e3;
+      let sinceCheckpoint = 0;
+      for await (const line of ndjsonLines(res.body, signal)) {
+        const change = parseChangeLine(line);
+        if (!change) continue;
+        const seq = String(change.seq);
+        sinceCheckpoint++;
+        if (Date.now() - trackedAt > TRACKED_REFRESH_MS) {
+          tracked = new Set(await getAllPackageNames(db));
+          trackedAt = Date.now();
+        }
+        if (!change.deleted && tracked.has(change.id)) {
+          logger.info(`watch: re-syncing ${change.id} (seq=${seq})`);
+          await syncOnePackage(db, change.id).catch(
+            (err) => logger.warn(`watch: re-sync failed for ${change.id}: ${String(err)}`)
+          );
+          await setWatchCursor(db, FEED_ID, seq);
+          sinceCheckpoint = 0;
+        } else if (sinceCheckpoint >= CHECKPOINT_EVERY) {
+          await setWatchCursor(db, FEED_ID, seq);
+          sinceCheckpoint = 0;
+        }
+      }
+      logger.info("watch: feed stream ended; reconnecting");
+    } catch (err) {
+      if (signal?.aborted) break;
+      logger.warn(`watch: ${String(err)} \u2014 retrying in ${backoff2}ms`);
+      await sleep(backoff2, signal);
+      backoff2 = Math.min(backoff2 * 2, MAX_BACKOFF_MS);
+    }
+  }
+}
+async function* ndjsonLines(body, signal) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  try {
+    while (!signal?.aborted) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      let nl;
+      while ((nl = buffer.indexOf("\n")) >= 0) {
+        yield buffer.slice(0, nl);
+        buffer = buffer.slice(nl + 1);
+      }
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+function sleep(ms, signal) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(timer);
+        resolve();
+      },
+      { once: true }
+    );
+  });
+}
+var FEED_ID, FEED_URL, HEARTBEAT_MS, TRACKED_REFRESH_MS, CHECKPOINT_EVERY, MAX_BACKOFF_MS;
+var init_watch2 = __esm({
+  "src/pipeline/watch.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_logger();
+    init_packages();
+    init_watch();
+    init_single();
+    FEED_ID = "npm-changes";
+    FEED_URL = "https://replicate.npmjs.com/_changes";
+    HEARTBEAT_MS = 3e4;
+    TRACKED_REFRESH_MS = 5 * 6e4;
+    CHECKPOINT_EVERY = 200;
+    MAX_BACKOFF_MS = 3e4;
+  }
+});
+
+// src/sandbox/types.ts
+var DEFAULT_TARGET;
+var init_types2 = __esm({
+  "src/sandbox/types.ts"() {
+    "use strict";
+    init_esm_shims();
+    DEFAULT_TARGET = {
+      node: "20",
+      moduleSystem: "cjs"
+    };
+  }
+});
+
+// src/sandbox/local.ts
+import { execFile } from "child_process";
+import { mkdtemp, rm, writeFile as writeFile2 } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join3 } from "path";
+import { promisify } from "util";
+function npmInstallArgs(specs, opts) {
+  const bad = specs.find((s) => s.startsWith("-"));
+  if (bad) throw new Error(`Invalid package spec: ${bad}`);
+  const args = ["install", ...specs, "--no-audit", "--no-fund", "--no-package-lock", "--no-save"];
+  if (!opts.allowScripts) args.push("--ignore-scripts");
+  return args;
+}
+function smokeScript(pkg, moduleSystem) {
+  return moduleSystem === "esm" ? ["--input-type=module", "-e", `await import(${JSON.stringify(pkg)})`] : ["-e", `require(${JSON.stringify(pkg)})`];
+}
+function condense(s) {
+  return s.replace(/\s+/g, " ").trim().slice(0, ERROR_MAX);
+}
+function stderrOf(err) {
+  if (err && typeof err === "object") {
+    const e = err;
+    if (typeof e.stderr === "string" && e.stderr.trim()) return e.stderr;
+    if (typeof e.message === "string") return e.message;
+  }
+  return String(err);
+}
+var execFileAsync, INSTALL_TIMEOUT_MS, SMOKE_TIMEOUT_MS, ERROR_MAX, toSpec, LocalSandbox;
+var init_local = __esm({
+  "src/sandbox/local.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_types2();
+    execFileAsync = promisify(execFile);
+    INSTALL_TIMEOUT_MS = 12e4;
+    SMOKE_TIMEOUT_MS = 3e4;
+    ERROR_MAX = 500;
+    toSpec = (p) => p.version ? `${p.name}@${p.version}` : p.name;
+    LocalSandbox = class {
+      name = "local";
+      async verify(pkg, version, opts = {}) {
+        const set = await this.verifySet([{ name: pkg, version }], opts);
+        return {
+          driver: this.name,
+          moduleSystem: set.moduleSystem,
+          installed: set.installed,
+          imported: set.loaded[0]?.loaded ?? null,
+          ranScripts: opts.allowScripts ?? false,
+          durationMs: set.durationMs,
+          error: set.error
+        };
+      }
+      async verifySet(packages2, opts = {}) {
+        const target = opts.target ?? DEFAULT_TARGET;
+        const allowScripts = opts.allowScripts ?? false;
+        const specs = packages2.map(toSpec);
+        const dir = await mkdtemp(join3(tmpdir(), "lurq-sandbox-"));
+        const started = Date.now();
+        const loaded = packages2.map((p) => ({ name: p.name, loaded: null }));
+        let installed = false;
+        let error = null;
+        try {
+          await writeFile2(
+            join3(dir, "package.json"),
+            JSON.stringify({ name: "lurq-sandbox", version: "0.0.0", private: true })
+          );
+          await execFileAsync("npm", npmInstallArgs(specs, { allowScripts }), {
+            cwd: dir,
+            timeout: opts.timeoutMs ?? INSTALL_TIMEOUT_MS,
+            signal: opts.signal
+          });
+          installed = true;
+          for (let i = 0; i < packages2.length; i++) {
+            try {
+              await execFileAsync("node", smokeScript(packages2[i].name, target.moduleSystem), {
+                cwd: dir,
+                timeout: SMOKE_TIMEOUT_MS,
+                signal: opts.signal
+              });
+              loaded[i].loaded = true;
+            } catch (err) {
+              loaded[i].loaded = false;
+              if (!error) error = condense(stderrOf(err));
+            }
+          }
+        } catch (err) {
+          error = condense(stderrOf(err));
+        } finally {
+          await rm(dir, { recursive: true, force: true }).catch(() => {
+          });
+        }
+        return {
+          driver: this.name,
+          moduleSystem: target.moduleSystem,
+          installed,
+          loaded,
+          durationMs: Date.now() - started,
+          error
+        };
+      }
+    };
+  }
+});
+
+// src/sandbox/index.ts
+function getSandbox() {
+  return new LocalSandbox();
+}
+var init_sandbox = __esm({
+  "src/sandbox/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_local();
+    init_types2();
+    init_local();
+  }
+});
+
+// src/pipeline/sandbox.ts
+var sandbox_exports = {};
+__export(sandbox_exports, {
+  verifyPackageInSandbox: () => verifyPackageInSandbox
+});
+async function verifyPackageInSandbox(db, pkg, version, opts = {}) {
+  const result = await getSandbox().verify(pkg, version, opts);
+  await storeVerificationRun(db, {
+    packageName: pkg,
+    version: version ?? "latest",
+    driver: result.driver,
+    moduleSystem: result.moduleSystem,
+    installed: result.installed,
+    imported: result.imported,
+    ranScripts: result.ranScripts,
+    durationMs: result.durationMs,
+    error: result.error,
+    ranAt: /* @__PURE__ */ new Date()
+  }).catch(() => {
+  });
+  return result;
+}
+var init_sandbox2 = __esm({
+  "src/pipeline/sandbox.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_verification();
+    init_sandbox();
+  }
+});
+
+// src/pipeline/compat.ts
+var compat_exports = {};
+__export(compat_exports, {
+  deriveCompatEdges: () => deriveCompatEdges,
+  verifyCompatibility: () => verifyCompatibility
+});
+function deriveCompatEdges(resolved, result) {
+  const allLoaded = result.loaded.every((l) => l.loaded === true);
+  const edges = [];
+  if (result.installed && allLoaded) {
+    for (let i = 0; i < resolved.length; i++) {
+      for (let j = i + 1; j < resolved.length; j++) {
+        edges.push({
+          a: resolved[i].name,
+          aVersion: resolved[i].version,
+          b: resolved[j].name,
+          bVersion: resolved[j].version,
+          status: "compatible"
+        });
+      }
+    }
+  } else if (resolved.length === 2) {
+    edges.push({
+      a: resolved[0].name,
+      aVersion: resolved[0].version,
+      b: resolved[1].name,
+      bVersion: resolved[1].version,
+      status: "conflict"
+    });
+  }
+  return edges;
+}
+async function verifyCompatibility(db, packages2, opts = {}) {
+  const resolved = await Promise.all(
+    packages2.map(async (name) => ({
+      name,
+      version: (await getPackageByName(db, name))?.latestVersion ?? "latest"
+    }))
+  );
+  const result = await getSandbox().verifySet(
+    resolved.map((r) => ({ name: r.name, version: r.version === "latest" ? null : r.version })),
+    { allowScripts: opts.allowScripts }
+  );
+  const edges = deriveCompatEdges(resolved, result);
+  for (const e of edges) {
+    const pair = canonicalPair(
+      { name: e.a, version: e.aVersion },
+      { name: e.b, version: e.bVersion }
+    );
+    await upsertCompatEdge(db, {
+      ...pair,
+      status: e.status,
+      driver: result.driver,
+      ranAt: /* @__PURE__ */ new Date()
+    }).catch(() => {
+    });
+  }
+  const failed = !result.installed || !result.loaded.every((l) => l.loaded === true);
+  return { result, edges, unattributedConflict: failed && edges.length === 0 };
+}
+var init_compat2 = __esm({
+  "src/pipeline/compat.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_compat();
+    init_packages();
+    init_sandbox();
+  }
+});
+
+// src/cli/commands.ts
+var commands_exports = {};
+__export(commands_exports, {
+  runCompare: () => runCompare,
+  runCompat: () => runCompat,
+  runEditWeights: () => runEditWeights,
+  runEvaluate: () => runEvaluate,
+  runPlan: () => runPlan,
   runRecommend: () => runRecommend,
-  runVerify: () => runVerify
+  runSandbox: () => runSandbox,
+  runVerify: () => runVerify,
+  runVersions: () => runVersions,
+  runWatch: () => runWatch,
+  runWeights: () => runWeights
 });
 async function withDb(fn) {
   requireConfig(["DATABASE_URL"]);
@@ -2345,10 +4727,11 @@ async function runRecommend(need, opts) {
     }
     console.log(
       table(
-        ["Package", "Health", "Confidence", "Weekly", "Latest", "Category"],
+        ["Package", "Health", "Quality", "Confidence", "Weekly", "Latest", "Category"],
         res.candidates.map((c) => [
           c.name,
           String(c.healthScore),
+          c.qualityScore != null ? String(c.qualityScore) : "\u2014",
           confidenceLabel(c.confidence),
           formatNumber(c.weeklyDownloads),
           c.latestVersion ?? "\u2014",
@@ -2373,9 +4756,10 @@ async function runEvaluate(pkg, opts) {
     console.log(
       detail([
         ["health", `${res.healthScore}  ${confidenceLabel(res.confidence)}`],
+        ["quality", res.qualityScore != null ? String(res.qualityScore) : "\u2014"],
         [
           "breakdown",
-          `maint ${b.maintenance} \xB7 adopt ${b.adoption} \xB7 rel ${b.reliability} \xB7 eff ${b.efficiency ?? "\u2014"}`
+          `maint ${b.maintenance} \xB7 adopt ${b.adoption} \xB7 rel ${b.reliability} \xB7 eff ${b.efficiency ?? "\u2014"} \xB7 qual ${b.quality ?? "\u2014"}`
         ],
         ["version", res.latestVersion ?? "\u2014"],
         ["weekly dl", `${formatNumber(res.weeklyDownloads)}  (${formatPercent(res.downloadGrowth90d)} 90d)`],
@@ -2387,6 +4771,12 @@ async function runEvaluate(pkg, opts) {
         ["repo", res.repoUrl ?? "\u2014"]
       ])
     );
+    if (res.buildVerified) {
+      const bv = res.buildVerified;
+      const state = !bv.installed ? red("install failed") : bv.loaded === false ? yellow("installs, load failed") : green("installs and loads");
+      console.log(`
+sandbox: ${state}  ${dim(`${bv.version} \xB7 ${bv.driver}`)}`);
+    }
     if (res.summary) console.log("\n" + res.summary);
     if (res.usageGuide) {
       const g = res.usageGuide;
@@ -2424,8 +4814,148 @@ async function runCompare(pkgs, opts) {
         ])
       )
     );
-    if (res.missing?.length) console.log(dim(`
-not found: ${res.missing.join(", ")}`));
+    if (res.missing?.length) console.log(dim(`
+not found: ${res.missing.join(", ")}`));
+    console.log(dim(`data as of ${formatDate(res.dataAsOf)}`));
+  });
+}
+function runWeights(opts = {}) {
+  const w = loadWeights();
+  const active = activeWeightsPath();
+  if (opts.json) {
+    console.log(JSON.stringify({ ...w, source: active?.source ?? "defaults" }, null, 2));
+    return;
+  }
+  const pct = (n) => n.toFixed(2);
+  console.log(bold("Two axes, blended for default sort:"));
+  console.log(`  composite = (1\u2212\u03BB)\xB7health + \u03BB\xB7quality      \u03BB = ${pct(w.composite.lambda)}
+`);
+  console.log(bold("Health (proven-ness) \u2014 weighted sum of 4 components:"));
+  console.log(
+    detail([
+      ["maintenance", `${pct(w.health.maintenance)}  ${dim("\u2014 " + WEIGHT_EXPLANATIONS.maintenance)}`],
+      ["adoption", `${pct(w.health.adoption)}  ${dim("\u2014 " + WEIGHT_EXPLANATIONS.adoption)}`],
+      ["reliability", `${pct(w.health.reliability)}  ${dim("\u2014 " + WEIGHT_EXPLANATIONS.reliability)}`],
+      ["efficiency", `${pct(w.health.efficiency)}  ${dim("\u2014 " + WEIGHT_EXPLANATIONS.efficiency)}`]
+    ])
+  );
+  console.log("\n" + bold("Quality (intrinsic, adoption-independent):"));
+  console.log("  " + dim(Object.keys(QUALITY_WEIGHTS).join(", ")));
+  console.log("\n" + bold("Confidence thresholds:"));
+  console.log(
+    detail([
+      ["proven", `\u2265 ${formatNumber(CONFIDENCE.proven.minWeeklyDownloads)} weekly dl, \u2265 ${CONFIDENCE.proven.minAgeMonths}mo old`],
+      ["emerging", `\u2265 ${formatNumber(CONFIDENCE.emerging.minWeeklyDownloads)} weekly dl OR \u2265 ${CONFIDENCE.emerging.strongGrowth * 100}% 90d growth`],
+      ["promising", `\u2265 ${CONFIDENCE.promising.minQuality} quality score (adoption-independent)`]
+    ])
+  );
+  console.log(dim(`
+Source: ${active ? `${active.source} (${active.path})` : "defaults (no user overrides)"}`));
+}
+async function runEditWeights(opts) {
+  const { invalidateCache: invalidateCache2 } = await Promise.resolve().then(() => (init_cache(), cache_exports));
+  if (opts.reset) {
+    const removed = resetWeights();
+    console.log(removed.length ? `Removed overrides:
+  ${removed.join("\n  ")}` : "No overrides to remove; already on defaults.");
+    if (removed.length) await invalidateCache2();
+    return;
+  }
+  if (opts.explain) {
+    const key = opts.explain;
+    const text2 = WEIGHT_EXPLANATIONS[key];
+    if (!text2) {
+      throw new Error(`No explanation for "${key}". Known: ${Object.keys(WEIGHT_EXPLANATIONS).join(", ")}.`);
+    }
+    console.log(`${bold(key)} \u2014 ${text2}`);
+    return;
+  }
+  if (opts.set && opts.set.length > 0) {
+    const next = applyOverrides(loadWeights(), opts.set);
+    const { weights, normalized } = validateWeights(next);
+    const path2 = saveWeights(weights, opts.project ? "project" : "user");
+    await invalidateCache2();
+    console.log(`Saved overrides to ${path2}`);
+    if (normalized) {
+      console.log(
+        yellow("Health weights did not sum to 1.0 \u2014 renormalized to: ") + `maint ${weights.health.maintenance.toFixed(3)}, adopt ${weights.health.adoption.toFixed(3)}, rel ${weights.health.reliability.toFixed(3)}, eff ${weights.health.efficiency.toFixed(3)}`
+      );
+    }
+    console.log(dim("\nRun `lurq rescore` to apply the new health weights to the stored index."));
+    return;
+  }
+  console.log(dim(`No changes. Settable keys: ${settableKeys().join(", ")}.
+`));
+  runWeights(opts);
+}
+async function openInBrowser(target) {
+  const { spawn } = await import("child_process");
+  const [cmd, args] = process.platform === "darwin" ? ["open", [target]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", target]] : ["xdg-open", [target]];
+  spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+}
+async function runPlan(file, opts) {
+  const { readFileSync: readFileSync4 } = await import("fs");
+  let document;
+  try {
+    document = readFileSync4(file, "utf8");
+  } catch {
+    throw new Error(`Could not read "${file}".`);
+  }
+  if (opts.optimize && opts.optimize !== "speed" && opts.optimize !== "balanced") {
+    throw new Error("--optimize must be 'speed' or 'balanced'.");
+  }
+  await withDb(async (db) => {
+    const { handlePlan: handlePlan2 } = await Promise.resolve().then(() => (init_plan(), plan_exports));
+    const res = await handlePlan2(db, {
+      document,
+      optimize: opts.optimize
+    });
+    if (opts.json) return console.log(JSON.stringify(res, null, 2));
+    if (!("slots" in res)) {
+      console.log(res.note);
+      return;
+    }
+    if (opts.html || opts.open) {
+      const { writeFileSync: writeFileSync3 } = await import("fs");
+      const { tmpdir: tmpdir2 } = await import("os");
+      const { join: join5 } = await import("path");
+      const { renderPlanHtml: renderPlanHtml2 } = await Promise.resolve().then(() => (init_planView(), planView_exports));
+      const out = opts.html ?? join5(tmpdir2(), `lurq-plan-${Date.now()}.html`);
+      writeFileSync3(out, renderPlanHtml2(res), "utf8");
+      console.log(`Roadmap written to ${out}`);
+      if (opts.open) await openInBrowser(out);
+    }
+    console.log(
+      table(
+        ["Component", "Layer", "Recommended", "Health", "Confidence", "Alternatives"],
+        res.slots.map((s) => [
+          s.need.length > 32 ? s.need.slice(0, 31) + "\u2026" : s.need,
+          s.layer,
+          s.recommended ? `${s.recommended.name}@${s.recommended.latestVersion ?? "?"}` : dim("\u2014"),
+          s.recommended ? String(s.recommended.healthScore) : "\u2014",
+          s.recommended ? confidenceLabel(s.recommended.confidence) : "\u2014",
+          s.alternatives.map((a) => a.name).join(", ") || "\u2014"
+        ])
+      )
+    );
+    if (res.unmatched.length) console.log(yellow(`
+No match for: ${res.unmatched.join(", ")}`));
+    if (res.compatibility) {
+      const c = res.compatibility;
+      const col = c.overall === "compatible" ? green : c.overall === "conflict" ? red : dim;
+      console.log("\n" + bold("Compatibility: ") + col(c.overall));
+      for (const s of res.slots) {
+        if (s.swappedFrom && s.recommended) {
+          console.log(green(`  \u2713 swapped ${s.swappedFrom} \u2192 ${s.recommended.name} for compatibility`));
+        }
+      }
+      for (const cf of c.conflicts) console.log(red(`  \u2717 ${cf.detail} (no compatible alternative)`));
+      if (c.unverified.length) console.log(dim(`  unverified: ${c.unverified.join(", ")}`));
+    }
+    console.log("\n" + bold("Roadmap (Mermaid):"));
+    console.log(res.mermaid);
+    console.log(dim(`
+${res.note}`));
     console.log(dim(`data as of ${formatDate(res.dataAsOf)}`));
   });
 }
@@ -2433,7 +4963,8 @@ async function runVerify(pkg, opts) {
   await withDb(async (db) => {
     const res = await handleVerify(db, { package: pkg });
     if (opts.json) return console.log(JSON.stringify(res, null, 2));
-    const verdict = !res.exists ? red("\u2717 NOT FOUND on npm") : res.deprecated || res.archived || res.advisoryCount > 0 ? yellow("\u26A0 exists, but risky") : green("\u2713 looks safe");
+    const riskColor = res.risk === "high" ? red : res.risk === "medium" ? yellow : green;
+    const verdict = !res.exists ? red("\u2717 NOT FOUND on npm") : res.risk === "high" ? red("\u2717 high supply-chain risk") : res.risk === "medium" ? yellow("\u26A0 exists, but risky") : green("\u2713 looks safe");
     console.log(`${bold(pkg)}  ${verdict}`);
     console.log(
       detail([
@@ -2441,11 +4972,107 @@ async function runVerify(pkg, opts) {
         ["weekly dl", formatNumber(res.weeklyDownloads)],
         ["confidence", res.confidence ? confidenceLabel(res.confidence) : "\u2014"],
         ["advisories", String(res.advisoryCount)],
+        ["risk", riskColor(res.risk)],
         ["risk flags", res.riskFlags.length ? yellow(res.riskFlags.join(", ")) : "none"]
       ])
     );
   });
 }
+async function runVersions(pkg, opts) {
+  const limit = opts.limit ? Math.max(1, parseInt(opts.limit, 10) || 30) : 30;
+  await withDb(async (db) => {
+    const versions = await getPackageVersions(db, pkg, limit);
+    if (opts.json) return console.log(JSON.stringify(versions, null, 2));
+    if (versions.length === 0) {
+      console.log(`No stored versions for ${bold(pkg)}. Run \`lurq sync --package ${pkg}\` first.`);
+      return;
+    }
+    console.log(bold(pkg));
+    console.log(
+      table(
+        ["Version", "Published"],
+        versions.map((v) => [
+          v.version,
+          v.publishedAt ? v.publishedAt.toISOString().slice(0, 10) : "\u2014"
+        ])
+      )
+    );
+  });
+}
+async function runWatch() {
+  const { watchNpmChanges: watchNpmChanges2 } = await Promise.resolve().then(() => (init_watch2(), watch_exports));
+  await withDb(async (db) => {
+    const controller = new AbortController();
+    const stop = () => controller.abort();
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+    console.log(dim("watching npm for releases of tracked packages \u2014 Ctrl-C to stop"));
+    try {
+      await watchNpmChanges2(db, { signal: controller.signal });
+    } finally {
+      process.off("SIGINT", stop);
+      process.off("SIGTERM", stop);
+    }
+  });
+}
+async function runSandbox(pkg, version, opts) {
+  if (opts.allowScripts) {
+    console.error(
+      yellow("warning: running install scripts and loading the package locally without isolation")
+    );
+  }
+  const { verifyPackageInSandbox: verifyPackageInSandbox2 } = await Promise.resolve().then(() => (init_sandbox2(), sandbox_exports));
+  await withDb(async (db) => {
+    const result = await verifyPackageInSandbox2(db, pkg, version ?? null, {
+      target: { node: "20", moduleSystem: opts.esm ? "esm" : "cjs" },
+      allowScripts: opts.allowScripts
+    });
+    if (opts.json) return console.log(JSON.stringify(result, null, 2));
+    const ok = result.installed && result.imported !== false;
+    const label = version ? `${pkg}@${version}` : pkg;
+    const verdict = ok ? green("\u2713 installs and loads") : red("\u2717 failed");
+    console.log(`${bold(label)}  ${verdict}  ${dim(`(${result.durationMs}ms \xB7 ${result.driver})`)}`);
+    console.log(
+      detail([
+        ["installed", result.installed ? "yes" : "no"],
+        ["loaded", result.imported === null ? "\u2014" : result.imported ? "yes" : "no"],
+        ["module", result.moduleSystem],
+        ["scripts", result.ranScripts ? "ran" : "skipped"],
+        ["error", result.error ?? "none"]
+      ])
+    );
+  });
+}
+async function runCompat(pkgs, opts) {
+  await withDb(async (db) => {
+    if (opts.run) {
+      console.error(
+        yellow("co-installing in the sandbox (loads package code locally without isolation)")
+      );
+      const { verifyCompatibility: verifyCompatibility2 } = await Promise.resolve().then(() => (init_compat2(), compat_exports));
+      await verifyCompatibility2(db, pkgs);
+    }
+    const { handleCompat: handleCompat2 } = await Promise.resolve().then(() => (init_handlers(), handlers_exports));
+    const res = await handleCompat2(db, { packages: pkgs });
+    if (opts.json) return console.log(JSON.stringify(res, null, 2));
+    const color = res.overall === "compatible" ? green : res.overall === "conflict" ? red : dim;
+    console.log(`${bold(res.packages.join(" + "))}  ${color(res.overall)}`);
+    if (res.conflicts.length) {
+      console.log(
+        table(
+          ["Source", "Detail"],
+          res.conflicts.map((c) => [c.source, c.detail])
+        )
+      );
+    } else if (res.overall === "compatible") {
+      console.log(dim("no peer-dependency or engine conflicts across the set"));
+    }
+    if (res.unverified.length) {
+      console.log(dim(`
+unverified (no metadata): ${res.unverified.join(", ")}`));
+    }
+  });
+}
 var init_commands = __esm({
   "src/cli/commands.ts"() {
     "use strict";
@@ -2453,58 +5080,35 @@ var init_commands = __esm({
     init_config();
     init_types();
     init_client();
+    init_packages();
     init_handlers();
+    init_weights();
+    init_weights();
     init_format();
   }
 });
 
-// src/core/paths.ts
-import { existsSync as existsSync2 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function packageRoot() {
-  if (cachedRoot) return cachedRoot;
-  let dir = dirname2(fileURLToPath2(import.meta.url));
-  for (; ; ) {
-    if (existsSync2(join2(dir, "package.json"))) {
-      cachedRoot = dir;
-      return dir;
-    }
-    const parent = dirname2(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  cachedRoot = process.cwd();
-  return cachedRoot;
-}
-function migrationsDir() {
-  return join2(packageRoot(), "drizzle");
-}
-function seedJsonPath() {
-  return join2(packageRoot(), "src", "data", "seed.json");
-}
-var cachedRoot;
-var init_paths = __esm({
-  "src/core/paths.ts"() {
-    "use strict";
-    init_esm_shims();
-  }
-});
-
 // src/cli/installSkill.ts
 var installSkill_exports = {};
 __export(installSkill_exports, {
   SUPPORTED_AGENTS: () => SUPPORTED_AGENTS,
+  agentSpecs: () => agentSpecs,
+  buildRemoteServerEntry: () => buildRemoteServerEntry,
+  buildRemoteTomlBlock: () => buildRemoteTomlBlock,
   buildServerEntry: () => buildServerEntry,
   buildTomlBlock: () => buildTomlBlock,
+  installAgent: () => installAgent,
+  installInstructionsFile: () => installInstructionsFile,
+  printInstallReport: () => printInstallReport,
+  resolveAgents: () => resolveAgents,
   runInstallSkill: () => runInstallSkill
 });
-import { existsSync as existsSync3, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { copyFileSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join3 } from "path";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname4, join as join4 } from "path";
 function home(...p) {
-  return join3(homedir2(), ...p);
+  return join4(homedir3(), ...p);
 }
 function agentSpecs() {
   return [
@@ -2513,35 +5117,35 @@ function agentSpecs() {
       label: "Claude Code",
       format: "mcpServers",
       path: home(".claude.json"),
-      detected: existsSync3(home(".claude.json")) || existsSync3(home(".claude"))
+      detected: existsSync4(home(".claude.json")) || existsSync4(home(".claude"))
     },
     {
       id: "cursor",
       label: "Cursor",
       format: "mcpServers",
       path: home(".cursor", "mcp.json"),
-      detected: existsSync3(home(".cursor"))
+      detected: existsSync4(home(".cursor"))
     },
     {
       id: "windsurf",
       label: "Windsurf",
       format: "mcpServers",
       path: home(".codeium", "windsurf", "mcp_config.json"),
-      detected: existsSync3(home(".codeium"))
+      detected: existsSync4(home(".codeium"))
     },
     {
       id: "copilot",
       label: "VS Code / GitHub Copilot",
       format: "servers",
       path: home("Library", "Application Support", "Code", "User", "mcp.json"),
-      detected: existsSync3(home("Library", "Application Support", "Code", "User"))
+      detected: existsSync4(home("Library", "Application Support", "Code", "User"))
     },
     {
       id: "codex",
       label: "OpenAI Codex CLI",
       format: "toml",
       path: home(".codex", "config.toml"),
-      detected: existsSync3(home(".codex"))
+      detected: existsSync4(home(".codex"))
     }
   ];
 }
@@ -2554,14 +5158,14 @@ function collectEnv() {
   return env;
 }
 function readJsonObject(path2) {
-  if (!existsSync3(path2)) return {};
-  const text2 = readFileSync(path2, "utf8").trim();
+  if (!existsSync4(path2)) return {};
+  const text2 = readFileSync2(path2, "utf8").trim();
   if (!text2) return {};
   return JSON.parse(text2);
 }
 function writeJson(path2, obj) {
-  mkdirSync(dirname3(path2), { recursive: true });
-  writeFileSync(path2, JSON.stringify(obj, null, 2) + "\n", "utf8");
+  mkdirSync2(dirname4(path2), { recursive: true });
+  writeFileSync2(path2, JSON.stringify(obj, null, 2) + "\n", "utf8");
 }
 function buildServerEntry(env, withType) {
   const entry = { command: "npx", args: ["-y", PACKAGE_NAME, "serve"] };
@@ -2569,13 +5173,18 @@ function buildServerEntry(env, withType) {
   if (Object.keys(env).length) entry.env = env;
   return entry;
 }
-function installJson(spec, env) {
-  const key = spec.format === "servers" ? "servers" : "mcpServers";
-  const config = readJsonObject(spec.path);
-  if (typeof config[key] !== "object" || config[key] === null) config[key] = {};
-  config[key].lurq = buildServerEntry(env, spec.format === "servers");
-  writeJson(spec.path, config);
-  return { agent: spec.id, path: spec.path, status: "installed" };
+function buildRemoteServerEntry(agentId, opts) {
+  const headers = { Authorization: `Bearer ${opts.apiKey}` };
+  switch (agentId) {
+    case "cursor":
+      return { url: opts.url, headers };
+    case "windsurf":
+      return { serverUrl: opts.url, headers };
+    case "claude-code":
+    case "copilot":
+    default:
+      return { type: "http", url: opts.url, headers };
+  }
 }
 function buildTomlBlock(env) {
   const lines = ["[mcp_servers.lurq]", 'command = "npx"', `args = ["-y", "${PACKAGE_NAME}", "serve"]`];
@@ -2585,8 +5194,23 @@ function buildTomlBlock(env) {
   }
   return lines.join("\n") + "\n";
 }
-function installToml(spec, env) {
-  const existing = existsSync3(spec.path) ? readFileSync(spec.path, "utf8") : "";
+function buildRemoteTomlBlock(opts) {
+  return [
+    "[mcp_servers.lurq]",
+    `url = ${JSON.stringify(opts.url)}`,
+    `http_headers = { Authorization = ${JSON.stringify(`Bearer ${opts.apiKey}`)} }`
+  ].join("\n") + "\n";
+}
+function installJsonEntry(spec, entry) {
+  const key = spec.format === "servers" ? "servers" : "mcpServers";
+  const config = readJsonObject(spec.path);
+  if (typeof config[key] !== "object" || config[key] === null) config[key] = {};
+  config[key].lurq = entry;
+  writeJson(spec.path, config);
+  return { agent: spec.id, path: spec.path, status: "installed" };
+}
+function installTomlBlock(spec, block) {
+  const existing = existsSync4(spec.path) ? readFileSync2(spec.path, "utf8") : "";
   if (existing.includes("[mcp_servers.lurq]")) {
     return {
       agent: spec.id,
@@ -2595,59 +5219,48 @@ function installToml(spec, env) {
       message: "lurq already present; edit manually to change it."
     };
   }
-  mkdirSync(dirname3(spec.path), { recursive: true });
+  mkdirSync2(dirname4(spec.path), { recursive: true });
   const sep = existing && !existing.endsWith("\n") ? "\n\n" : existing ? "\n" : "";
-  writeFileSync(spec.path, existing + sep + buildTomlBlock(env), "utf8");
+  writeFileSync2(spec.path, existing + sep + block, "utf8");
   return { agent: spec.id, path: spec.path, status: "installed" };
 }
+function installAgent(spec, mode) {
+  try {
+    if (spec.format === "toml") {
+      const block = mode.kind === "remote" ? buildRemoteTomlBlock(mode) : buildTomlBlock(mode.env);
+      return installTomlBlock(spec, block);
+    }
+    const entry = mode.kind === "remote" ? buildRemoteServerEntry(spec.id, mode) : buildServerEntry(mode.env, spec.format === "servers");
+    return installJsonEntry(spec, entry);
+  } catch (err) {
+    return {
+      agent: spec.id,
+      path: spec.path,
+      status: "error",
+      message: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
 function installInstructionsFile() {
-  const src = join3(packageRoot(), "templates", "skill-instructions.md");
-  if (!existsSync3(src)) return null;
+  const src = join4(packageRoot(), "templates", "skill-instructions.md");
+  if (!existsSync4(src)) return null;
   const destDir = home(".lurq");
-  const dest = join3(destDir, "skill-instructions.md");
-  mkdirSync(destDir, { recursive: true });
+  const dest = join4(destDir, "skill-instructions.md");
+  mkdirSync2(destDir, { recursive: true });
   copyFileSync(src, dest);
   return dest;
 }
-async function runInstallSkill(opts) {
-  const target = opts.agent ?? "claude-code";
+function resolveAgents(target) {
   const specs = agentSpecs();
-  const env = collectEnv();
-  let selected;
-  if (target === "all") {
-    selected = specs.filter((s) => s.detected);
-    if (selected.length === 0) {
-      console.log("No supported agents detected on this machine.");
-      return;
-    }
-  } else {
-    const spec = specs.find((s) => s.id === target);
-    if (!spec) {
-      throw new Error(
-        `Unknown agent "${target}". Supported: ${SUPPORTED_AGENTS.join(", ")}, all.`
-      );
-    }
-    selected = [spec];
-  }
-  if (!env.DATABASE_URL) {
-    logger.warn(
-      "DATABASE_URL is not set in the current environment \u2014 the installed server entry will have no DATABASE_URL. Set it (in .env) and re-run, or edit the config."
-    );
-  }
-  const results = [];
-  for (const spec of selected) {
-    try {
-      results.push(spec.format === "toml" ? installToml(spec, env) : installJson(spec, env));
-    } catch (err) {
-      results.push({
-        agent: spec.id,
-        path: spec.path,
-        status: "error",
-        message: err instanceof Error ? err.message : String(err)
-      });
-    }
+  if (target === "all") return specs.filter((s) => s.detected);
+  const spec = specs.find((s) => s.id === target);
+  if (!spec) {
+    throw new Error(`Unknown agent "${target}". Supported: ${SUPPORTED_AGENTS.join(", ")}, all.`);
   }
-  const instructionsPath = installInstructionsFile();
+  return [spec];
+}
+function printInstallReport(results, instructionsPath, mode) {
+  const specs = agentSpecs();
   console.log("lurq MCP server registration:");
   for (const r of results) {
     const spec = specs.find((s) => s.id === r.agent);
@@ -2657,9 +5270,43 @@ async function runInstallSkill(opts) {
   if (instructionsPath) console.log(`
 Skill instructions written to ${instructionsPath}`);
   console.log("\nNext steps:");
-  console.log("  1. Ensure DATABASE_URL (and any API keys) are set in the config env above.");
-  console.log("  2. Restart the agent so it picks up the new MCP server.");
-  console.log("  3. Ask it to recommend a library \u2014 it should call lurq.");
+  if (mode.kind === "local") {
+    console.log("  1. Ensure DATABASE_URL (and any API keys) are set in the config env above.");
+    console.log("  2. Restart the agent so it picks up the new MCP server.");
+  } else {
+    console.log("  1. Restart the agent so it picks up the new MCP server.");
+  }
+  console.log("  \u2022 Ask it to recommend a library \u2014 it should call lurq.");
+}
+async function runInstallSkill(opts) {
+  const selected = resolveAgents(opts.agent ?? "claude-code");
+  if (selected.length === 0) {
+    console.log("No supported agents detected on this machine.");
+    return;
+  }
+  const remote = !opts.local;
+  let mode;
+  if (remote) {
+    const apiKey = opts.apiKey ?? process.env.LURQ_API_KEY;
+    if (!apiKey) {
+      throw new Error(
+        "An API key is required for a hosted install. Pass --api-key <key> (or set LURQ_API_KEY), or use `lurq install` for the guided setup, or --local to self-host."
+      );
+    }
+    const url = opts.url ?? process.env.LURQ_ENDPOINT ?? DEFAULT_ENDPOINT;
+    mode = { kind: "remote", url, apiKey };
+  } else {
+    const env = collectEnv();
+    if (!env.DATABASE_URL) {
+      logger.warn(
+        "DATABASE_URL is not set \u2014 the local server entry will have no DATABASE_URL. Set it (in .env) and re-run, or edit the config."
+      );
+    }
+    mode = { kind: "local", env };
+  }
+  const results = selected.map((spec) => installAgent(spec, mode));
+  const instructionsPath = installInstructionsFile();
+  printInstallReport(results, instructionsPath, mode);
 }
 var ENV_KEYS, SUPPORTED_AGENTS;
 var init_installSkill = __esm({
@@ -2683,12 +5330,279 @@ var init_installSkill = __esm({
   }
 });
 
+// src/cli/install.ts
+var install_exports = {};
+__export(install_exports, {
+  runInstallWizard: () => runInstallWizard
+});
+async function validateKey(url, apiKey) {
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json, text/event-stream",
+        Authorization: `Bearer ${apiKey}`
+      },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" })
+    });
+    if (res.ok) return "valid";
+    if (res.status === 401 || res.status === 403) return "invalid";
+    return "unreachable";
+  } catch {
+    return "unreachable";
+  }
+}
+async function runInstallWizard(opts) {
+  const interactive = !opts.yes;
+  const url = opts.url ?? process.env.LURQ_ENDPOINT ?? DEFAULT_ENDPOINT;
+  let apiKey = (opts.apiKey ?? process.env.LURQ_API_KEY)?.trim();
+  if (interactive) {
+    const { input, checkbox, confirm, select } = await import("@inquirer/prompts");
+    console.log("\n  lurq \u2014 connect your coding agent to the hosted package index.\n");
+    if (!apiKey) {
+      console.log(`  Need a key? Get one at ${GET_KEY_URL}
+`);
+      apiKey = (await input({
+        message: "Paste your lurq API key",
+        validate: (v) => v.trim().startsWith("lurq_") ? true : "Keys look like lurq_live_\u2026 "
+      })).trim();
+    }
+    process.stdout.write("  Validating key\u2026 ");
+    const check = await validateKey(url, apiKey);
+    console.log(
+      check === "valid" ? "ok" : check === "invalid" ? "rejected" : "could not reach endpoint"
+    );
+    if (check !== "valid") {
+      const proceed = await confirm({
+        message: check === "invalid" ? `That key was rejected (401) by ${url}. Continue anyway?` : `Couldn't reach ${url} to validate the key. Continue anyway?`,
+        default: false
+      });
+      if (!proceed) {
+        console.log("Aborted. No config was changed.");
+        return;
+      }
+    }
+    if (opts.agent) {
+      await finish(resolveAgents(opts.agent), { url, apiKey });
+      return;
+    }
+    const specs = agentSpecs();
+    const detected = specs.filter((s) => s.detected);
+    const primary = detected.find((s) => s.id === "claude-code") ?? detected[0];
+    if (primary) {
+      const others = detected.length - 1;
+      const choice = await select({
+        message: others > 0 ? `Looks like you have ${detected.map((s) => s.label).join(", ")}. Connect lurq to them?` : `Looks like you have ${primary.label}. Connect lurq to it?`,
+        default: "yes",
+        choices: [
+          {
+            name: others > 0 ? `Yes \u2014 set up all ${detected.length} detected agents` : `Yes \u2014 set up ${primary.label} for me`,
+            value: "yes"
+          },
+          { name: "No \u2014 let me choose which agent(s)", value: "other" },
+          { name: "Cancel \u2014 change nothing", value: "cancel" }
+        ]
+      });
+      if (choice === "cancel") {
+        console.log("No problem \u2014 nothing was changed. Run `lurq install` again anytime.");
+        return;
+      }
+      if (choice === "yes") {
+        await finish(detected, { url, apiKey });
+        return;
+      }
+    }
+    const ids = await checkbox({
+      message: "Which assistant(s) should I configure?",
+      choices: specs.map((s) => ({
+        name: `${s.label}${s.detected ? " (detected)" : ""}`,
+        value: s.id,
+        checked: s.detected
+      }))
+    });
+    await finish(specs.filter((s) => ids.includes(s.id)), { url, apiKey });
+    return;
+  }
+  if (!apiKey) {
+    throw new Error(
+      "No API key. Pass --api-key <key> or set LURQ_API_KEY (or drop --yes to be prompted)."
+    );
+  }
+  const selected = opts.agent ? resolveAgents(opts.agent) : agentSpecs().filter((s) => s.detected);
+  await finish(selected, { url, apiKey });
+}
+async function finish(selected, remote) {
+  if (selected.length === 0) {
+    console.log(
+      "\nNo agents selected or detected. Re-run with --agent <id>, or install an assistant first."
+    );
+    return;
+  }
+  const mode = { kind: "remote", ...remote };
+  const results = selected.map((s) => installAgent(s, mode));
+  const instructionsPath = installInstructionsFile();
+  console.log("");
+  printInstallReport(results, instructionsPath, mode);
+}
+var GET_KEY_URL;
+var init_install = __esm({
+  "src/cli/install.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_constants();
+    init_installSkill();
+    GET_KEY_URL = "https://lurq.run";
+  }
+});
+
+// src/cli/keys.ts
+var keys_exports = {};
+__export(keys_exports, {
+  runKeysCreate: () => runKeysCreate,
+  runKeysList: () => runKeysList,
+  runKeysRevoke: () => runKeysRevoke,
+  runKeysRotate: () => runKeysRotate
+});
+function waitForEnter(prompt) {
+  return new Promise((resolve) => {
+    process.stdout.write(prompt);
+    process.stdin.resume();
+    process.stdin.once("data", () => {
+      process.stdin.pause();
+      resolve();
+    });
+  });
+}
+async function presentNewKey(key, row, opts) {
+  if (opts.json) {
+    console.log(
+      JSON.stringify({ key, prefix: row.prefix, tier: row.tier, label: row.label, ...opts.extraJson })
+    );
+    return;
+  }
+  const meta = `prefix=${row.prefix}  tier=${row.tier}${row.label ? `  label=${row.label}` : ""}`;
+  const block = [bold(opts.header ?? "API key created."), "", `  ${green(key)}`, "", dim(meta)];
+  console.log(block.join("\n"));
+  if (process.stdout.isTTY && process.stdin.isTTY) {
+    await waitForEnter(dim("Copy it now, then press Enter to erase it from the terminal\u2026 "));
+    process.stdout.write(`\x1B[${block.length + 1}F\x1B[0J\x1B[3J`);
+    console.log(
+      dim(`New key (prefix ${row.prefix}) erased from the terminal. It is stored only as a hash and cannot be recovered, so make sure you saved it.`)
+    );
+  } else {
+    console.log(dim("Store it now \u2014 shown only once, stored hashed, cannot be recovered."));
+  }
+}
+async function runKeysCreate(opts) {
+  requireConfig(["DATABASE_URL"]);
+  const { db, close } = createDb({ max: 1 });
+  try {
+    const { key, row } = await createKey(db, { label: opts.label, tier: opts.tier });
+    await presentNewKey(key, row, opts);
+  } finally {
+    await close();
+  }
+}
+async function runKeysRotate(prefixOrId, opts) {
+  requireConfig(["DATABASE_URL"]);
+  const { db, close } = createDb({ max: 1 });
+  try {
+    const result = await rotateKey(db, prefixOrId);
+    if (!result) {
+      logger.warn(`No active key matched "${prefixOrId}".`);
+      process.exitCode = 1;
+      return;
+    }
+    await presentNewKey(result.key, result.row, {
+      json: opts.json,
+      header: `API key rotated \u2014 replaces ${result.previous.prefix} (now revoked).`,
+      extraJson: { replaced: result.previous.prefix }
+    });
+  } finally {
+    await close();
+  }
+}
+async function runKeysList(opts) {
+  requireConfig(["DATABASE_URL"]);
+  const { db, close } = createDb({ max: 1 });
+  try {
+    const rows = await listKeys(db);
+    if (opts.json) {
+      console.log(
+        JSON.stringify(
+          rows.map((r) => ({
+            id: r.id,
+            prefix: r.prefix,
+            label: r.label,
+            tier: r.tier,
+            ownerId: r.ownerId,
+            createdAt: r.createdAt,
+            lastUsedAt: r.lastUsedAt,
+            revokedAt: r.revokedAt
+          })),
+          null,
+          2
+        )
+      );
+      return;
+    }
+    if (rows.length === 0) {
+      console.log("No API keys yet. Create one with `lurq keys create --label <name>`.");
+      return;
+    }
+    console.log(
+      table(
+        ["prefix", "label", "tier", "created", "last used", "status"],
+        rows.map((r) => [
+          r.prefix,
+          r.label ?? "\u2014",
+          r.tier,
+          isoDay(r.createdAt),
+          isoDay(r.lastUsedAt),
+          r.revokedAt ? "revoked" : "active"
+        ])
+      )
+    );
+  } finally {
+    await close();
+  }
+}
+async function runKeysRevoke(prefixOrId) {
+  requireConfig(["DATABASE_URL"]);
+  const { db, close } = createDb({ max: 1 });
+  try {
+    const n = await revokeKey(db, prefixOrId);
+    if (n === 0) {
+      logger.warn(`No active key matched "${prefixOrId}".`);
+      process.exitCode = 1;
+      return;
+    }
+    console.log(`Revoked ${n} key(s) matching "${prefixOrId}".`);
+  } finally {
+    await close();
+  }
+}
+var isoDay;
+var init_keys = __esm({
+  "src/cli/keys.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_logger();
+    init_apiKeys();
+    init_client();
+    init_format();
+    isoDay = (d) => d ? d.toISOString().slice(0, 10) : "\u2014";
+  }
+});
+
 // src/db/seed.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 import { sql as sql5 } from "drizzle-orm";
 import { z as z3 } from "zod";
 function loadSeedFile(path2 = seedJsonPath()) {
-  const raw = JSON.parse(readFileSync2(path2, "utf8"));
+  const raw = JSON.parse(readFileSync3(path2, "utf8"));
   const parsed = SeedFileSchema.parse(raw);
   const byName = /* @__PURE__ */ new Map();
   for (const entry of parsed) {
@@ -2732,7 +5646,13 @@ __export(migrate_exports, {
 });
 import { migrate } from "drizzle-orm/postgres-js/migrator";
 async function ensureVectorExtension(handle) {
-  await handle.sql`CREATE EXTENSION IF NOT EXISTS vector`;
+  try {
+    await handle.sql`CREATE EXTENSION IF NOT EXISTS vector`;
+  } catch (err) {
+    logger.warn(
+      `CREATE EXTENSION vector did not run cleanly (continuing to migrations): ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
 }
 async function runMigrate() {
   const handle = createDb({ max: 1 });
@@ -2791,13 +5711,17 @@ function buildProgram() {
     const { startMcpServer: startMcpServer2 } = await Promise.resolve().then(() => (init_server(), server_exports));
     await startMcpServer2();
   });
+  program.command("serve-http").description("start the hosted MCP server over HTTP with API-key auth").option("--port <n>", "port to listen on (default: $PORT or 8080)", (v) => parseInt(v, 10)).action(async (opts) => {
+    const { startHttpServer: startHttpServer2 } = await Promise.resolve().then(() => (init_http2(), http_exports));
+    await startHttpServer2({ port: opts.port });
+  });
   program.command("sync").description("run ingestion: refresh scores for the seed list (or one package)").option("--full", "force a full re-sync, ignoring cache TTLs").option("--package <name>", "sync a single package by name").option("--json", "output the run summary as JSON").action(async (opts) => {
     const { runSync: runSync2 } = await Promise.resolve().then(() => (init_pipeline(), pipeline_exports));
     const summary = await runSync2({ full: opts.full, packageName: opts.package });
     if (opts.json) console.log(JSON.stringify(summary, null, 2));
     if (summary.status === "failed") process.exitCode = 1;
   });
-  program.command("recommend").argument("<need>", "natural-language description of what you need").description("recommend the best current packages for a described need").option("--category <category>", "restrict to a taxonomy category").option("--min-confidence <level>", "proven | emerging | unproven").option("--json", "output JSON instead of a table").action(async (need, opts) => {
+  program.command("recommend").argument("<need>", "natural-language description of what you need").description("recommend the best current packages for a described need").option("--category <category>", "restrict to a taxonomy category").option("--min-confidence <level>", "proven | emerging | promising | unproven").option("--json", "output JSON instead of a table").action(async (need, opts) => {
     const { runRecommend: runRecommend2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     await runRecommend2(need, opts);
   });
@@ -2813,14 +5737,83 @@ function buildProgram() {
     const { runVerify: runVerify2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     await runVerify2(pkg, opts);
   });
-  program.command("install-skill").description("register lurq as an MCP server in supported AI assistants").option(
+  program.command("versions").argument("<package>", "npm package name").description("show the stored version timeline for a package").option("--json", "output JSON instead of a table").option("-n, --limit <n>", "how many versions to show (default 30)").action(async (pkg, opts) => {
+    const { runVersions: runVersions2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
+    await runVersions2(pkg, opts);
+  });
+  program.command("plan").argument("<file>", "path to a markdown file describing your program").description("turn a program description into an evidence-scored package plan + roadmap").option("--optimize <mode>", "ranking bias: 'speed' (lightest bundle) or 'balanced'").option("--html <path>", "write the roadmap as a self-contained HTML visualization").option("--open", "render the roadmap to HTML and open it in your browser").option("--json", "output the full plan as JSON").action(async (file, opts) => {
+    const { runPlan: runPlan2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
+    await runPlan2(file, opts);
+  });
+  program.command("weights").description("show and explain the scoring weight model (health, quality, composite \u03BB)").option("--json", "output the weight model as JSON").action(async (opts) => {
+    const { runWeights: runWeights2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
+    runWeights2(opts);
+  });
+  program.command("edit-weights").description("override, reset, or explain the scoring weights (layered over defaults)").option("--set <pair>", "override key=value, e.g. composite.lambda=0.5 (repeatable)", (v, acc) => acc.concat(v), []).option("--reset", "remove all overrides and restore defaults").option("--explain <component>", "explain a component (e.g. adoption, quality, lambda)").option("--project", "write to project-local .lurq/weights.json instead of the user config").action(async (opts) => {
+    const { runEditWeights: runEditWeights2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
+    await runEditWeights2(opts);
+  });
+  program.command("discover").description("operator-side: proactively crawl for new packages and queue/gate them (\xA72B)").option("--cap <n>", "max candidates to fully ingest this run", (v) => parseInt(v, 10)).option("--dry-run", "discover, queue, and gate, but do not ingest survivors").option("--json", "output the discovery summary as JSON").action(async (opts) => {
+    const { requireConfig: requireConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+    requireConfig2(["DATABASE_URL"]);
+    const { runDiscovery: runDiscovery2 } = await Promise.resolve().then(() => (init_pipeline(), pipeline_exports));
+    const summary = await runDiscovery2({ perRunCap: opts.cap, dryRun: opts.dryRun });
+    if (opts.json) console.log(JSON.stringify(summary, null, 2));
+  });
+  program.command("rescore").description("re-derive health scores from cached breakdowns using current weights (no re-ingest)").option("--json", "output the rescore summary as JSON").action(async (opts) => {
+    const { requireConfig: requireConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+    requireConfig2(["DATABASE_URL"]);
+    const { runRescore: runRescore2 } = await Promise.resolve().then(() => (init_pipeline(), pipeline_exports));
+    const summary = await runRescore2();
+    if (opts.json) console.log(JSON.stringify(summary, null, 2));
+  });
+  program.command("watch").description(
+    "operator-side: follow the npm changes feed, re-syncing tracked packages on new releases"
+  ).action(async () => {
+    const { runWatch: runWatch2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
+    await runWatch2();
+  });
+  program.command("sandbox").argument("<package>", "npm package name").argument("[version]", "specific version (default: latest)").description(
+    "operator-side: install + smoke-load a package in a sandbox to verify it actually works"
+  ).option("--esm", "load via ESM import instead of CJS require").option("--allow-scripts", "run install scripts (UNSAFE without VM isolation)").option("--json", "output JSON").action(
+    async (pkg, version, opts) => {
+      const { runSandbox: runSandbox2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
+      await runSandbox2(pkg, version, opts);
+    }
+  );
+  program.command("compat").argument("<packages...>", "npm package names to check together").description("check pairwise compatibility of packages from the sandbox matrix").option("--run", "operator-side: co-install them in the sandbox first (UNSAFE without VM isolation)").option("--json", "output JSON").action(async (pkgs, opts) => {
+    const { runCompat: runCompat2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
+    await runCompat2(pkgs, opts);
+  });
+  program.command("install").description("guided setup: connect lurq to your AI assistant(s)").option("--api-key <key>", "hosted API key (skips the prompt)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--agent <agent>", "claude-code | cursor | copilot | windsurf | codex | all").option("--yes", "non-interactive: use flags/env and detected agents without prompting").action(async (opts) => {
+    const { runInstallWizard: runInstallWizard2 } = await Promise.resolve().then(() => (init_install(), install_exports));
+    await runInstallWizard2(opts);
+  });
+  program.command("install-skill").description("register lurq as an MCP server in supported AI assistants (scriptable)").option(
     "--agent <agent>",
     "claude-code | cursor | copilot | windsurf | codex | all",
     "claude-code"
-  ).action(async (opts) => {
+  ).option("--api-key <key>", "hosted API key (remote install; default mode)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--local", "self-host: write a local stdio entry using your own DATABASE_URL").action(async (opts) => {
     const { runInstallSkill: runInstallSkill2 } = await Promise.resolve().then(() => (init_installSkill(), installSkill_exports));
     await runInstallSkill2(opts);
   });
+  const keys = program.command("keys").description("manage API keys for the hosted service (operator; needs DATABASE_URL)");
+  keys.command("create").description("create a new API key (shown once; erased from the terminal after you copy it)").option("--label <label>", "human label (owner / org / purpose)").option("--tier <tier>", "tier name", "free").option("--json", "print the key as JSON and skip the interactive erase (for scripts)").action(async (opts) => {
+    const { runKeysCreate: runKeysCreate2 } = await Promise.resolve().then(() => (init_keys(), keys_exports));
+    await runKeysCreate2(opts);
+  });
+  keys.command("list").description("list issued API keys (hashes are never shown)").option("--json", "output as JSON").action(async (opts) => {
+    const { runKeysList: runKeysList2 } = await Promise.resolve().then(() => (init_keys(), keys_exports));
+    await runKeysList2(opts);
+  });
+  keys.command("rotate").argument("<prefixOrId>", "key prefix (e.g. lurq_live_ab12cd) or numeric id to replace").description("issue a replacement key (same label/tier) and revoke the old one").option("--json", "print the new key as JSON and skip the interactive erase (for scripts)").action(async (prefixOrId, opts) => {
+    const { runKeysRotate: runKeysRotate2 } = await Promise.resolve().then(() => (init_keys(), keys_exports));
+    await runKeysRotate2(prefixOrId, opts);
+  });
+  keys.command("revoke").argument("<prefixOrId>", "key prefix (e.g. lurq_live_ab12cd) or numeric id").description("revoke an API key").action(async (prefixOrId) => {
+    const { runKeysRevoke: runKeysRevoke2 } = await Promise.resolve().then(() => (init_keys(), keys_exports));
+    await runKeysRevoke2(prefixOrId);
+  });
   const db = program.command("db").description("database management");
   db.command("migrate").description("apply database migrations and load the seed list").action(async () => {
     const { runMigrate: runMigrate2 } = await Promise.resolve().then(() => (init_migrate(), migrate_exports));
@@ -2840,9 +5833,11 @@ function buildProgram() {
   return program;
 }
 export {
+  API_KEY_PREFIX,
   CACHE_TTL,
   CATEGORIES,
   ConfigError,
+  DEFAULT_ENDPOINT,
   EMBEDDING_DIM,
   FRONTEND_CATEGORIES,
   PACKAGE_NAME,