lurqrun 0.0.3 → 0.0.5

package/dist/bin/lurq.js

@@ -26,7 +26,7 @@ var init_constants = __esm({
     init_esm_shims();
     SERVER_NAME = "lurq";
     PACKAGE_NAME = "lurqrun";
-    VERSION = "0.0.2";
+    VERSION = "0.0.5";
     DEFAULT_ENDPOINT = "https://api.lurq.run/mcp";
     API_KEY_PREFIX = "lurq_live_";
     EMBEDDING_DIM = 1536;
@@ -146,12 +146,18 @@ var init_config = __esm({
     EnvSchema = z.object({
       DATABASE_URL: z.string().min(1).optional(),
       GITHUB_TOKEN: z.string().min(1).optional(),
+      // 'openai' here means "OpenAI-compatible" — any provider exposing /v1/embeddings
+      // + Bearer auth (OpenAI, Together, Fireworks, HF TEI, …). Point *_BASE_URL at it.
       EMBEDDING_PROVIDER: z.enum(["openai", "local"]).default("openai"),
       EMBEDDING_API_KEY: z.string().min(1).optional(),
       EMBEDDING_MODEL: z.string().min(1).default("text-embedding-3-small"),
+      EMBEDDING_BASE_URL: z.string().url().default("https://api.openai.com/v1"),
+      // 'openai' means "OpenAI-compatible /v1/chat/completions": OpenAI, Groq, Together,
+      // Fireworks, xAI (Grok), etc. Swap provider by setting SUMMARY_BASE_URL + key + model.
       SUMMARY_PROVIDER: z.enum(["openai", "none"]).default("openai"),
       SUMMARY_API_KEY: z.string().min(1).optional(),
       SUMMARY_MODEL: z.string().min(1).default("gpt-4o-mini"),
+      SUMMARY_BASE_URL: z.string().url().default("https://api.openai.com/v1"),
       LURQ_SYNC_CONCURRENCY: z.coerce.number().int().positive().max(50).default(5),
       LOG_LEVEL: z.enum(["error", "warn", "info", "debug"]).default("info"),
       // Hosted HTTP service (`serve-http`). Server-side only.
@@ -162,9 +168,22 @@ var init_config = __esm({
       LURQ_IP_RATE_LIMIT_MAX: z.coerce.number().int().positive().default(240),
       /** Rate-limit window, milliseconds (applies to both limiters). */
       LURQ_RATE_LIMIT_WINDOW_MS: z.coerce.number().int().positive().default(6e4),
+      /** Bearer token guarding `/metrics`. Unset → the endpoint is disabled (404). */
+      LURQ_METRICS_TOKEN: z.string().min(1).optional(),
+      /** Shared secret for self-serve key issuance (`POST /keys`). The Clerk-
+       *  authenticated web app presents it to mint a key for a signed-in user. Unset
+       *  → the endpoint is disabled (404). Keep it server-side, never in the client. */
+      LURQ_ISSUER_SECRET: z.string().min(1).optional(),
       // Client-side (install wizard / CLI talking to a remote endpoint).
       LURQ_ENDPOINT: z.string().url().optional(),
-      LURQ_API_KEY: z.string().min(1).optional()
+      LURQ_API_KEY: z.string().min(1).optional(),
+      // Sandbox verification. With E2B_API_KEY set, package install + smoke-load
+      // runs in an isolated E2B cloud sandbox (safe for UNTRUSTED packages);
+      // without it, the local child-process driver is used (trusted packages only).
+      E2B_API_KEY: z.string().min(1).optional(),
+      // E2B template to launch. Must provide node + npm on PATH; omit for E2B's
+      // default. Provision a Node-versioned template here for reproducible runs.
+      E2B_TEMPLATE: z.string().min(1).optional()
     });
     ConfigError = class extends Error {
       constructor(message) {
@@ -183,6 +202,7 @@ __export(schema_exports, {
   discoveryQueue: () => discoveryQueue,
   packageVersions: () => packageVersions,
   packages: () => packages,
+  recommendationOutcomes: () => recommendationOutcomes,
   seedPackages: () => seedPackages,
   syncRuns: () => syncRuns,
   verificationRuns: () => verificationRuns,
@@ -205,7 +225,7 @@ import {
   uniqueIndex,
   vector
 } from "drizzle-orm/pg-core";
-var tsvector, ts, packages, syncRuns, seedPackages, discoveryQueue, apiKeys, packageVersions, watchState, verificationRuns, compatEdges;
+var tsvector, ts, packages, syncRuns, seedPackages, discoveryQueue, apiKeys, packageVersions, watchState, verificationRuns, compatEdges, recommendationOutcomes;
 var init_schema = __esm({
   "src/db/schema.ts"() {
     "use strict";
@@ -388,6 +408,28 @@ var init_schema = __esm({
         )
       ]
     );
+    recommendationOutcomes = pgTable(
+      "recommendation_outcomes",
+      {
+        id: serial("id").primaryKey(),
+        /** The org this outcome belongs to (api_keys.owner_id). Null for anonymous /
+         *  operator-issued keys. This is what turns the flywheel from a global blob
+         *  into a per-org asset — "what did *this* org succeed with." Server-injected
+         *  from the authenticated key, never caller-supplied. */
+        ownerId: text("owner_id"),
+        packageName: text("package_name").notNull(),
+        accepted: boolean("accepted").notNull(),
+        buildSignal: text("build_signal").$type(),
+        /** The original need text the recommendation was for — ties outcome back to
+         *  the ask. Optional, length-capped at the trust boundary; never source code. */
+        need: text("need"),
+        createdAt: ts("created_at").notNull().defaultNow()
+      },
+      (table2) => [
+        index("recommendation_outcomes_pkg_idx").on(table2.packageName),
+        index("recommendation_outcomes_owner_idx").on(table2.ownerId)
+      ]
+    );
   }
 });
 
@@ -964,7 +1006,7 @@ function parseDownloadGrowth(json2) {
   const priorAvg = sum(prior) / prior.length;
   const recentAvg = sum(recent) / recent.length;
   if (priorAvg <= 0) return recentAvg > 0 ? 1 : 0;
-  return (recentAvg - priorAvg) / priorAvg;
+  return Math.round((recentAvg - priorAvg) / priorAvg * 1e3) / 1e3;
 }
 function ymd(date) {
   return date.toISOString().slice(0, 10);
@@ -1498,6 +1540,94 @@ var init_verification = __esm({
   }
 });
 
+// src/db/outcomes.ts
+async function recordOutcome(db, outcome) {
+  await db.insert(recommendationOutcomes).values(outcome);
+}
+var init_outcomes = __esm({
+  "src/db/outcomes.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_schema();
+  }
+});
+
+// src/data/successors.json
+var successors_default;
+var init_successors = __esm({
+  "src/data/successors.json"() {
+    successors_default = {
+      moment: {
+        replacedBy: "dayjs",
+        reason: "In maintenance mode since 2020 (the maintainers recommend alternatives). dayjs is a ~2KB immutable library with a near-identical API."
+      },
+      request: {
+        replacedBy: "got",
+        reason: "Deprecated in 2020 and no longer maintained. Use the built-in fetch, or got for a full-featured HTTP client."
+      },
+      "request-promise": {
+        replacedBy: "got",
+        reason: "Deprecated alongside request. got returns promises natively."
+      },
+      "node-sass": {
+        replacedBy: "sass",
+        reason: "Deprecated; bindings break on new Node versions. sass is the Dart implementation (sass-embedded for speed)."
+      },
+      tslint: {
+        replacedBy: "typescript-eslint",
+        reason: "Deprecated in 2019 in favor of ESLint. Use typescript-eslint to lint TypeScript."
+      },
+      enzyme: {
+        replacedBy: "@testing-library/react",
+        reason: "Unmaintained with no official React 17+/18 adapter. React Testing Library is the current standard."
+      },
+      protractor: {
+        replacedBy: "@playwright/test",
+        reason: "Reached end-of-life in 2023. Use Playwright (or Cypress) for browser E2E."
+      },
+      faker: {
+        replacedBy: "@faker-js/faker",
+        reason: "The original package was sabotaged and deprecated. @faker-js/faker is the community-maintained fork."
+      },
+      bower: {
+        replacedBy: "npm",
+        reason: "Deprecated; front-end packages ship on npm now. Use npm (or your package manager) directly."
+      },
+      "popper.js": {
+        replacedBy: "@popperjs/core",
+        reason: "v1 is deprecated. @popperjs/core is the maintained v2 line."
+      },
+      "create-react-app": {
+        replacedBy: "vite",
+        reason: "No longer recommended by the React team and effectively unmaintained. Vite is the current scaffolding standard."
+      },
+      "babel-eslint": {
+        replacedBy: "@babel/eslint-parser",
+        reason: "Deprecated and renamed. Use @babel/eslint-parser."
+      },
+      istanbul: {
+        replacedBy: "nyc",
+        reason: "The istanbul package is legacy; nyc is its maintained CLI (or c8 for native V8 coverage)."
+      }
+    };
+  }
+});
+
+// src/core/successors.ts
+function lookupSuccessor(name) {
+  const hit = MAP[name.toLowerCase()];
+  return hit ? { name: hit.replacedBy, reason: hit.reason } : null;
+}
+var MAP;
+var init_successors2 = __esm({
+  "src/core/successors.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_successors();
+    MAP = successors_default;
+  }
+});
+
 // src/ingestion/sources/githubReadme.ts
 async function fetchGithubReadme(owner, repo, fetchImpl) {
   for (const file of CANDIDATES) {
@@ -1564,7 +1694,12 @@ function str(value) {
 function createSummaryProvider(fetchImpl) {
   const config = getConfig();
   if (config.SUMMARY_PROVIDER === "openai" && config.SUMMARY_API_KEY) {
-    return new OpenAISummaryProvider(config.SUMMARY_API_KEY, config.SUMMARY_MODEL, fetchImpl);
+    return new OpenAISummaryProvider(
+      config.SUMMARY_API_KEY,
+      config.SUMMARY_MODEL,
+      config.SUMMARY_BASE_URL,
+      fetchImpl
+    );
   }
   return new FallbackSummaryProvider();
 }
@@ -1636,15 +1771,19 @@ var init_summarize = __esm({
     };
     SYSTEM_PROMPT = "You summarize npm packages factually for an AI coding agent choosing dependencies. Use ONLY the provided README/description. Never invent capabilities or APIs. Be concise and concrete. Respond with a JSON object.";
     OpenAISummaryProvider = class {
-      constructor(apiKey, model, fetchImpl) {
+      constructor(apiKey, model, baseUrl, fetchImpl) {
         this.apiKey = apiKey;
         this.model = model;
         this.fetchImpl = fetchImpl;
+        this.endpoint = `${baseUrl.replace(/\/$/, "")}/chat/completions`;
+        this.host = new URL(baseUrl).host;
       }
       apiKey;
       model;
       fetchImpl;
       kind = "openai";
+      endpoint;
+      host;
       async generate(input) {
         try {
           const body = JSON.stringify({
@@ -1656,8 +1795,8 @@ var init_summarize = __esm({
             response_format: { type: "json_object" },
             temperature: 0.2
           });
-          const { data } = await httpRequest("https://api.openai.com/v1/chat/completions", {
-            host: "api.openai.com",
+          const { data } = await httpRequest(this.endpoint, {
+            host: this.host,
             method: "POST",
             ttlMs: 30 * 24 * 60 * 60 * 1e3,
             // cache summaries 30d to control cost
@@ -1844,10 +1983,10 @@ function activeWeightsPath() {
 function loadWeights() {
   if (cachedWeights) return cachedWeights;
   let merged = structuredClone(DEFAULT_WEIGHTS);
-  const active = activeWeightsPath();
-  if (active) {
+  const active2 = activeWeightsPath();
+  if (active2) {
     try {
-      const fromFile = JSON.parse(readFileSync(active.path, "utf8"));
+      const fromFile = JSON.parse(readFileSync(active2.path, "utf8"));
       merged = mergeWeights(merged, fromFile);
     } catch {
     }
@@ -2312,7 +2451,12 @@ function localEmbed(text2, dim2 = EMBEDDING_DIM) {
 function createEmbeddingProvider(fetchImpl) {
   const config = getConfig();
   if (config.EMBEDDING_PROVIDER === "openai" && config.EMBEDDING_API_KEY) {
-    return new OpenAIEmbeddingProvider(config.EMBEDDING_API_KEY, config.EMBEDDING_MODEL, fetchImpl);
+    return new OpenAIEmbeddingProvider(
+      config.EMBEDDING_API_KEY,
+      config.EMBEDDING_MODEL,
+      config.EMBEDDING_BASE_URL,
+      fetchImpl
+    );
   }
   if (config.EMBEDDING_PROVIDER === "openai" && !config.EMBEDDING_API_KEY) {
     logger.warn("EMBEDDING_API_KEY not set \u2014 falling back to the local embedder.");
@@ -2338,11 +2482,13 @@ var init_embeddings = __esm({
     };
     OPENAI_BATCH = 96;
     OpenAIEmbeddingProvider = class {
-      constructor(apiKey, model, fetchImpl) {
+      constructor(apiKey, model, baseUrl, fetchImpl) {
         this.apiKey = apiKey;
         this.model = model;
         this.fetchImpl = fetchImpl;
         this.id = `openai:${model}`;
+        this.endpoint = `${baseUrl.replace(/\/$/, "")}/embeddings`;
+        this.host = new URL(baseUrl).host;
       }
       apiKey;
       model;
@@ -2350,13 +2496,15 @@ var init_embeddings = __esm({
       kind = "openai";
       dimensions = EMBEDDING_DIM;
       id;
+      endpoint;
+      host;
       async embed(texts) {
         const out = [];
         for (let i = 0; i < texts.length; i += OPENAI_BATCH) {
           const batch = texts.slice(i, i + OPENAI_BATCH);
           const body = JSON.stringify({ model: this.model, input: batch, dimensions: EMBEDDING_DIM });
-          const { data } = await httpRequest("https://api.openai.com/v1/embeddings", {
-            host: "api.openai.com",
+          const { data } = await httpRequest(this.endpoint, {
+            host: this.host,
             method: "POST",
             ttlMs: 30 * 24 * 60 * 60 * 1e3,
             // cache embeddings 30d to control cost
@@ -2411,6 +2559,11 @@ async function runSync(opts = {}) {
   const handle = createDb({ max: Math.max(4, config.LURQ_SYNC_CONCURRENCY) });
   const provider = createSummaryProvider();
   logger.info(`Summary provider: ${provider.kind}`);
+  if (!config.GITHUB_TOKEN) {
+    logger.warn(
+      "GITHUB_TOKEN not set \u2014 GitHub signals (stars, issues, release cadence) will be skipped, degrading maintenance/adoption scores. Set it for accurate scoring."
+    );
+  }
   const runId = await startSyncRun(handle.db);
   const allErrors = [];
   try {
@@ -2623,6 +2776,57 @@ var init_sync = __esm({
   }
 });
 
+// src/pipeline/ingestQueue.ts
+function enqueueIngest(db, name) {
+  if (queuedNames.has(name) || inFlight.has(name)) return;
+  if (pending.length >= MAX_PENDING) {
+    logger.warn(`ingest queue full (${MAX_PENDING}); dropping on-demand request for ${name}`);
+    return;
+  }
+  queuedNames.add(name);
+  pending.push(name);
+  pump(db);
+}
+function pump(db) {
+  while (active < MAX_CONCURRENT && pending.length > 0) {
+    const name = pending.shift();
+    queuedNames.delete(name);
+    inFlight.add(name);
+    active += 1;
+    void ingestOne(db, name).finally(() => {
+      inFlight.delete(name);
+      active -= 1;
+      pump(db);
+    });
+  }
+}
+async function ingestOne(db, name) {
+  try {
+    const row = await syncOnePackage(db, name);
+    if (row.confidence && row.confidence !== "unproven") {
+      await ensureSeedEntry(db, name, row.category);
+    }
+  } catch (err) {
+    logger.warn(`on-demand ingest failed for ${name}: ${String(err)}`);
+  }
+}
+var MAX_CONCURRENT, MAX_PENDING, pending, inFlight, queuedNames, active;
+var init_ingestQueue = __esm({
+  "src/pipeline/ingestQueue.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_logger();
+    init_packages();
+    init_single();
+    MAX_CONCURRENT = 3;
+    MAX_PENDING = 500;
+    pending = [];
+    inFlight = /* @__PURE__ */ new Set();
+    queuedNames = /* @__PURE__ */ new Set();
+    active = 0;
+  }
+});
+
 // src/pipeline/single.ts
 import { and as and3, eq as eq3, isNotNull as isNotNull2, sql as sql2 } from "drizzle-orm";
 async function getSeedCategory(db, name) {
@@ -2706,11 +2910,8 @@ async function getOrFetchPackage(db, name) {
   if (existing) return { row: existing, wasTracked: true, existsOnNpm: true };
   const exists = await npmPackageExists(name);
   if (!exists) return { row: null, wasTracked: false, existsOnNpm: false };
-  const row = await syncOnePackage(db, name);
-  if (row.confidence && row.confidence !== "unproven") {
-    await ensureSeedEntry(db, name, row.category);
-  }
-  return { row, wasTracked: false, existsOnNpm: true };
+  enqueueIngest(db, name);
+  return { row: null, wasTracked: false, existsOnNpm: true, queued: true };
 }
 var init_single = __esm({
   "src/pipeline/single.ts"() {
@@ -2726,6 +2927,7 @@ var init_single = __esm({
     init_packages();
     init_schema();
     init_sync();
+    init_ingestQueue();
   }
 });
 
@@ -2879,7 +3081,220 @@ var init_risk = __esm({
   }
 });
 
+// src/data/popular-packages.json
+var popular_packages_default;
+var init_popular_packages = __esm({
+  "src/data/popular-packages.json"() {
+    popular_packages_default = [
+      "react",
+      "react-dom",
+      "react-router",
+      "react-router-dom",
+      "next",
+      "vue",
+      "vue-router",
+      "pinia",
+      "vuex",
+      "svelte",
+      "solid-js",
+      "preact",
+      "angular",
+      "@angular/core",
+      "jquery",
+      "lodash",
+      "underscore",
+      "ramda",
+      "immer",
+      "rxjs",
+      "express",
+      "koa",
+      "fastify",
+      "@nestjs/core",
+      "hapi",
+      "connect",
+      "body-parser",
+      "cookie-parser",
+      "cors",
+      "helmet",
+      "morgan",
+      "compression",
+      "express-session",
+      "express-rate-limit",
+      "multer",
+      "passport",
+      "jsonwebtoken",
+      "bcrypt",
+      "bcryptjs",
+      "axios",
+      "node-fetch",
+      "got",
+      "undici",
+      "superagent",
+      "request",
+      "cheerio",
+      "puppeteer",
+      "playwright",
+      "cypress",
+      "jsdom",
+      "ws",
+      "socket.io",
+      "socket.io-client",
+      "graphql",
+      "@apollo/client",
+      "apollo-server",
+      "dataloader",
+      "mongoose",
+      "mongodb",
+      "pg",
+      "mysql2",
+      "sequelize",
+      "prisma",
+      "knex",
+      "drizzle-orm",
+      "typeorm",
+      "redis",
+      "ioredis",
+      "sqlite3",
+      "better-sqlite3",
+      "typescript",
+      "eslint",
+      "prettier",
+      "tslint",
+      "webpack",
+      "vite",
+      "rollup",
+      "esbuild",
+      "parcel",
+      "@babel/core",
+      "babel-core",
+      "babel-loader",
+      "ts-node",
+      "tsx",
+      "tsup",
+      "nodemon",
+      "concurrently",
+      "npm-run-all",
+      "jest",
+      "vitest",
+      "mocha",
+      "chai",
+      "sinon",
+      "ava",
+      "tape",
+      "supertest",
+      "@testing-library/react",
+      "enzyme",
+      "chalk",
+      "colors",
+      "kleur",
+      "picocolors",
+      "ansi-colors",
+      "commander",
+      "yargs",
+      "meow",
+      "minimist",
+      "inquirer",
+      "prompts",
+      "ora",
+      "boxen",
+      "figlet",
+      "cli-progress",
+      "debug",
+      "dotenv",
+      "cross-env",
+      "rimraf",
+      "glob",
+      "fast-glob",
+      "chokidar",
+      "fs-extra",
+      "execa",
+      "cross-spawn",
+      "shelljs",
+      "which",
+      "semver",
+      "uuid",
+      "nanoid",
+      "ulid",
+      "moment",
+      "dayjs",
+      "date-fns",
+      "luxon",
+      "zod",
+      "yup",
+      "joi",
+      "ajv",
+      "validator",
+      "class-validator",
+      "winston",
+      "pino",
+      "bunyan",
+      "nodemailer",
+      "node-cron",
+      "bull",
+      "bullmq",
+      "kafkajs",
+      "amqplib",
+      "sharp",
+      "jimp",
+      "archiver",
+      "tar",
+      "adm-zip",
+      "qs",
+      "query-string",
+      "form-data",
+      "mime-types",
+      "http-errors",
+      "classnames",
+      "clsx",
+      "styled-components",
+      "@emotion/react",
+      "tailwindcss",
+      "postcss",
+      "autoprefixer",
+      "sass",
+      "less",
+      "framer-motion",
+      "three",
+      "d3",
+      "chart.js",
+      "recharts",
+      "gsap",
+      "swiper",
+      "leaflet",
+      "mapbox-gl",
+      "formik",
+      "react-hook-form",
+      "redux",
+      "@reduxjs/toolkit",
+      "zustand",
+      "jotai",
+      "mobx",
+      "bootstrap",
+      "@popperjs/core",
+      "aws-sdk",
+      "@aws-sdk/client-s3",
+      "firebase",
+      "firebase-admin",
+      "stripe",
+      "twilio",
+      "openai",
+      "@anthropic-ai/sdk",
+      "googleapis",
+      "bignumber.js",
+      "decimal.js",
+      "mathjs",
+      "slugify",
+      "faker",
+      "@faker-js/faker",
+      "puppeteer-core"
+    ];
+  }
+});
+
 // src/security/typosquat.ts
+function typosquatCorpus(trackedTopNames) {
+  return [.../* @__PURE__ */ new Set([...POPULAR_BASELINE, ...trackedTopNames])];
+}
 function bareName(name) {
   const slash = name.indexOf("/");
   return (slash >= 0 ? name.slice(slash + 1) : name).toLowerCase();
@@ -2928,10 +3343,13 @@ function detectTyposquat(name, popular, maxDistance = 2) {
   }
   return best;
 }
+var POPULAR_BASELINE;
 var init_typosquat = __esm({
   "src/security/typosquat.ts"() {
     "use strict";
     init_esm_shims();
+    init_popular_packages();
+    POPULAR_BASELINE = popular_packages_default;
   }
 });
 
@@ -2942,6 +3360,7 @@ __export(handlers_exports, {
   handleCompat: () => handleCompat,
   handleEvaluate: () => handleEvaluate,
   handleRecommend: () => handleRecommend,
+  handleReportOutcome: () => handleReportOutcome,
   handleVerify: () => handleVerify,
   latestDataAsOf: () => latestDataAsOf,
   rowToEvaluate: () => rowToEvaluate
@@ -2991,7 +3410,8 @@ function rowToEvaluate(row) {
     advisories: topAdvisories(row.advisories),
     summary: row.summary ? truncateSentences(row.summary, 3) : null,
     usageGuide: row.usageGuide ?? null,
-    repoUrl: row.repoUrl
+    repoUrl: row.repoUrl,
+    replacedBy: lookupSuccessor(row.name)
   };
 }
 async function latestDataAsOf(db) {
@@ -3027,7 +3447,7 @@ async function handleEvaluate(db, input) {
       if (!row) {
         return {
           tracked: false,
-          suggestion: existsOnNpm ? `"${input.package}" exists on npm but could not be scored right now; try again.` : `"${input.package}" was not found on the npm registry. Check the package name.`
+          suggestion: existsOnNpm ? `\u{1F389} Congrats \u2014 you're the first to add "${input.package}" to lurq's registry! It's being fetched and scored now; retry in a few seconds for the full evidence read.` : `"${input.package}" was not found on the npm registry. Check the package name.`
         };
       }
       const evaluated = rowToEvaluate(row);
@@ -3047,7 +3467,14 @@ async function handleCompare(db, input) {
       const results = await Promise.all(input.packages.map((name) => getOrFetchPackage(db, name)));
       const rows = results.map((r) => r.row).filter((row) => row !== null).map(rowToEvaluate).sort((a, b) => b.healthScore - a.healthScore);
       const missing = input.packages.filter((name) => !rows.some((r) => r.name === name));
-      return { dataAsOf: await latestDataAsOf(db), rows, ...missing.length ? { missing } : {} };
+      return {
+        dataAsOf: await latestDataAsOf(db),
+        rows,
+        ...missing.length ? {
+          missing,
+          note: "\u{1F389} You're the first to add these to lurq's registry! They're being scored now; retry shortly for the full comparison."
+        } : {}
+      };
     },
     // Don't cache a transient miss (a package that momentarily failed to fetch).
     { skipCache: (r) => Boolean(r.missing?.length) }
@@ -3071,7 +3498,7 @@ async function handleVerify(db, input) {
   const name = input.package;
   const exists = await npmPackageExists(name);
   if (!exists) {
-    const typo2 = detectTyposquat(name, await getTopPackageNames(db).catch(() => []));
+    const typo2 = detectTyposquat(name, typosquatCorpus(await getTopPackageNames(db).catch(() => [])));
     return {
       exists: false,
       tracked: false,
@@ -3091,7 +3518,7 @@ async function handleVerify(db, input) {
     getOrFetchPackage(db, name),
     getTopPackageNames(db).catch(() => [])
   ]);
-  const weeklyDownloads = row?.weeklyDownloads ?? null;
+  const weeklyDownloads = row?.weeklyDownloads ?? await fetchWeeklyDownloads(name).catch(() => null);
   const advisories = row?.advisories ?? [];
   const advisoryCount = advisories.length;
   const deprecated = Boolean(row?.deprecated || registry?.deprecated);
@@ -3099,7 +3526,7 @@ async function handleVerify(db, input) {
   const brandNew = withinDays(registry?.firstPublishedAt ?? null, 7);
   const lowTrust = weeklyDownloads === null || weeklyDownloads < 1e3;
   const installScripts = registry?.hasInstallScripts ?? false;
-  const typo = detectTyposquat(name, popular);
+  const typo = detectTyposquat(name, typosquatCorpus(popular));
   const riskFlags = [];
   if (typo) riskFlags.push(`possible-typosquat-of:${typo.target}`);
   if (weeklyDownloads === null || weeklyDownloads === 0) riskFlags.push("zero-downloads");
@@ -3133,6 +3560,16 @@ async function handleVerify(db, input) {
     advisoryCount
   };
 }
+async function handleReportOutcome(db, input, ownerId = null) {
+  await recordOutcome(db, {
+    ownerId,
+    packageName: input.package,
+    accepted: input.accepted,
+    buildSignal: input.buildSignal ?? null,
+    need: input.need ?? null
+  });
+  return { recorded: true };
+}
 var SEVERITY_RANK, DAY_MS2;
 var init_handlers = __esm({
   "src/mcp/handlers.ts"() {
@@ -3143,6 +3580,8 @@ var init_handlers = __esm({
     init_check();
     init_packages();
     init_verification();
+    init_outcomes();
+    init_successors2();
     init_schema();
     init_sources();
     init_summarize();
@@ -3296,6 +3735,7 @@ function optimizeStack(slots, sandboxConflicts = /* @__PURE__ */ new Set()) {
   const n = slots.length;
   const budget = 5e4;
   let nodes = 0;
+  let exhausted = false;
   let bestSelection = new Array(n).fill(0);
   let bestRegret = conflictsFor(
     slots.map((c) => c[0]).filter((m) => Boolean(m)),
@@ -3303,7 +3743,11 @@ function optimizeStack(slots, sandboxConflicts = /* @__PURE__ */ new Set()) {
   ).length === 0 ? 0 : Infinity;
   const chosen = new Array(n).fill(0);
   const dfs = (slot, regret) => {
-    if (nodes++ > budget || regret >= bestRegret) return;
+    if (nodes++ > budget) {
+      exhausted = true;
+      return;
+    }
+    if (regret >= bestRegret) return;
     if (slot === n) {
       bestSelection = chosen.slice();
       bestRegret = regret;
@@ -3316,7 +3760,10 @@ function optimizeStack(slots, sandboxConflicts = /* @__PURE__ */ new Set()) {
       if (conflictsFor(assigned, sandboxConflicts).length === 0) {
         dfs(slot + 1, regret + i);
       }
-      if (nodes > budget) return;
+      if (nodes > budget) {
+        exhausted = true;
+        return;
+      }
     }
   };
   dfs(0, 0);
@@ -3324,7 +3771,8 @@ function optimizeStack(slots, sandboxConflicts = /* @__PURE__ */ new Set()) {
   return {
     selection: bestSelection,
     conflicts: conflictsFor(members, sandboxConflicts),
-    regret: bestRegret === Infinity ? bestSelection.reduce((a, b) => a + b, 0) : bestRegret
+    regret: bestRegret === Infinity ? bestSelection.reduce((a, b) => a + b, 0) : bestRegret,
+    bounded: exhausted
   };
 }
 var init_optimize = __esm({
@@ -3569,17 +4017,20 @@ async function bundleSizes(db, candidates) {
 async function decompose(document) {
   const config = getConfig();
   if (config.SUMMARY_PROVIDER === "openai" && config.SUMMARY_API_KEY) {
-    const llm = await decomposeWithLlm(document, config.SUMMARY_API_KEY, config.SUMMARY_MODEL).catch(
-      (err) => {
-        logger.warn(`plan: LLM decomposition failed, using heuristic: ${err.message}`);
-        return null;
-      }
-    );
+    const llm = await decomposeWithLlm(
+      document,
+      config.SUMMARY_API_KEY,
+      config.SUMMARY_MODEL,
+      config.SUMMARY_BASE_URL
+    ).catch((err) => {
+      logger.warn(`plan: LLM decomposition failed, using heuristic: ${err.message}`);
+      return null;
+    });
     if (llm?.length) return { needs: dedupeNeeds(llm), source: "llm" };
   }
   return { needs: decomposeHeuristic(document), source: "heuristic" };
 }
-async function decomposeWithLlm(document, apiKey, model) {
+async function decomposeWithLlm(document, apiKey, model, baseUrl) {
   const prompt = [
     "Project description:",
     document.slice(0, 8e3),
@@ -3587,8 +4038,8 @@ async function decomposeWithLlm(document, apiKey, model) {
     'Return JSON: { "needs": [ { "need": "<one phrase describing a component that needs a library>", "category": "<optional taxonomy hint or empty>" } ] }.',
     "One entry per distinct component (e.g. routing, validation, ORM, HTTP client). Omit anything not implied by the description."
   ].join("\n");
-  const { data } = await httpRequest("https://api.openai.com/v1/chat/completions", {
-    host: "api.openai.com",
+  const { data } = await httpRequest(`${baseUrl.replace(/\/$/, "")}/chat/completions`, {
+    host: new URL(baseUrl).host,
     method: "POST",
     ttlMs: 24 * 60 * 60 * 1e3,
     // Hash the FULL document — length + a 64-char prefix collide for same-length
@@ -3666,6 +4117,80 @@ var init_plan = __esm({
   }
 });
 
+// src/mcp/metrics.ts
+function recordToolCall(tool, ok, ms) {
+  const s = stats.get(tool) ?? { calls: 0, errors: 0, totalMs: 0 };
+  s.calls += 1;
+  if (!ok) s.errors += 1;
+  s.totalMs += ms;
+  stats.set(tool, s);
+}
+async function timed(tool, fn) {
+  const start = Date.now();
+  let ok = false;
+  try {
+    const result = await fn();
+    ok = true;
+    return result;
+  } finally {
+    recordToolCall(tool, ok, Date.now() - start);
+  }
+}
+function renderPrometheus() {
+  const lines = [
+    "# HELP lurq_tool_calls_total Total MCP tool invocations.",
+    "# TYPE lurq_tool_calls_total counter",
+    "# HELP lurq_tool_errors_total MCP tool invocations that threw.",
+    "# TYPE lurq_tool_errors_total counter",
+    "# HELP lurq_tool_duration_ms_total Cumulative tool handler time in ms.",
+    "# TYPE lurq_tool_duration_ms_total counter"
+  ];
+  for (const [tool, s] of stats) {
+    const label = `{tool="${tool}"}`;
+    lines.push(`lurq_tool_calls_total${label} ${s.calls}`);
+    lines.push(`lurq_tool_errors_total${label} ${s.errors}`);
+    lines.push(`lurq_tool_duration_ms_total${label} ${s.totalMs}`);
+  }
+  return lines.join("\n") + "\n";
+}
+var stats;
+var init_metrics = __esm({
+  "src/mcp/metrics.ts"() {
+    "use strict";
+    init_esm_shims();
+    stats = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/mcp/compact.ts
+function isEmptyObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length === 0;
+}
+function compact(value) {
+  if (Array.isArray(value)) {
+    return value.map((v) => compact(v)).filter((v) => v !== null && v !== void 0);
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [key, raw] of Object.entries(value)) {
+      if (raw === null || raw === void 0) continue;
+      const cleaned = compact(raw);
+      if (cleaned === null || cleaned === void 0) continue;
+      if (Array.isArray(cleaned) && cleaned.length === 0) continue;
+      if (isEmptyObject(cleaned)) continue;
+      out[key] = cleaned;
+    }
+    return out;
+  }
+  return value;
+}
+var init_compact = __esm({
+  "src/mcp/compact.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/mcp/server.ts
 var server_exports = {};
 __export(server_exports, {
@@ -3677,9 +4202,9 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z2 } from "zod";
 function json(obj) {
-  return { content: [{ type: "text", text: JSON.stringify(obj) }] };
+  return { content: [{ type: "text", text: JSON.stringify(compact(obj)) }] };
 }
-function buildMcpServer(db) {
+function buildMcpServer(db, ctx = {}) {
   const server = new McpServer({ name: SERVER_NAME, version: VERSION });
   server.registerTool(
     "recommend",
@@ -3692,7 +4217,7 @@ function buildMcpServer(db) {
         constraints: constraintsSchema
       }
     },
-    async (args) => json(await handleRecommend(db, args))
+    async (args) => json(await timed("recommend", () => handleRecommend(db, args)))
   );
   server.registerTool(
     "evaluate",
@@ -3703,7 +4228,7 @@ function buildMcpServer(db) {
         package: npmName.describe("npm package name")
       }
     },
-    async (args) => json(await handleEvaluate(db, args))
+    async (args) => json(await timed("evaluate", () => handleEvaluate(db, args)))
   );
   server.registerTool(
     "compare",
@@ -3714,7 +4239,7 @@ function buildMcpServer(db) {
         packages: z2.array(npmName).min(2).max(5).describe("2\u20135 npm package names")
       }
     },
-    async (args) => json(await handleCompare(db, args))
+    async (args) => json(await timed("compare", () => handleCompare(db, args)))
   );
   server.registerTool(
     "compat",
@@ -3725,7 +4250,7 @@ function buildMcpServer(db) {
         packages: z2.array(npmName).min(2).max(8).describe("2\u20138 npm package names to check together")
       }
     },
-    async (args) => json(await handleCompat(db, args))
+    async (args) => json(await timed("compat", () => handleCompat(db, args)))
   );
   server.registerTool(
     "verify",
@@ -3736,7 +4261,7 @@ function buildMcpServer(db) {
         package: npmName.describe("npm package name to verify")
       }
     },
-    async (args) => json(await handleVerify(db, args))
+    async (args) => json(await timed("verify", () => handleVerify(db, args)))
   );
   server.registerTool(
     "diagram",
@@ -3747,7 +4272,7 @@ function buildMcpServer(db) {
         stack: z2.array(npmName).optional().describe("Package names that make up the stack; omit or empty to get usage guidance")
       }
     },
-    async (args) => json(await handleDiagram(db, args))
+    async (args) => json(await timed("diagram", () => handleDiagram(db, args)))
   );
   server.registerTool(
     "plan",
@@ -3768,7 +4293,23 @@ function buildMcpServer(db) {
         optimize: z2.enum(["speed", "balanced"]).optional().describe("'speed' prefers the lightest-bundle option per slot; default 'balanced'")
       }
     },
-    async (args) => json(await handlePlan(db, args))
+    async (args) => json(await timed("plan", () => handlePlan(db, args)))
+  );
+  server.registerTool(
+    "report_outcome",
+    {
+      title: "Report a recommendation outcome",
+      description: "Opt-in feedback after acting on a lurq recommendation: report whether you went with the package and whether it built. No source code \u2014 only the coarse decision + a build signal. Helps lurq learn which packages agents actually succeed with; safe to skip.",
+      inputSchema: {
+        package: npmName.describe("The package that was recommended"),
+        accepted: z2.boolean().describe("Did you go with this package?"),
+        buildSignal: z2.enum(["installed", "compiled", "tests_passed", "failed"]).optional().describe("Coarse post-install result, if known"),
+        need: z2.string().max(500).optional().describe("The original need this was recommended for (no source code)")
+      }
+    },
+    // ownerId comes from the authenticated key (ctx), NOT the tool arguments —
+    // a caller must never be able to attribute an outcome to another org.
+    async (args) => json(await timed("report_outcome", () => handleReportOutcome(db, args, ctx.ownerId ?? null)))
   );
   return server;
 }
@@ -3800,6 +4341,8 @@ var init_server = __esm({
     init_handlers();
     init_diagram();
     init_plan();
+    init_metrics();
+    init_compact();
     categoryEnum = z2.enum(CATEGORIES);
     confidenceEnum = z2.enum(["proven", "emerging", "promising", "unproven"]);
     npmName = z2.string().trim().min(1).max(214).regex(/^(?:@[a-z0-9-][a-z0-9-._]*\/)?[a-z0-9-][a-z0-9-._]*$/i, "Invalid npm package name");
@@ -3834,12 +4377,27 @@ async function createKey(db, input = {}) {
   }).returning();
   return { key, row };
 }
+function stampLastUsed(db, entry, now) {
+  if (now - entry.lastStampAt < STAMP_INTERVAL_MS) return;
+  entry.lastStampAt = now;
+  db.update(apiKeys).set({ lastUsedAt: new Date(now) }).where(eq5(apiKeys.id, entry.row.id)).then(void 0, (err) => logger.debug(`lastUsedAt stamp failed: ${String(err)}`));
+}
 async function lookupActiveKey(db, key) {
   const hash = hashKey(key);
+  const now = Date.now();
+  const cached3 = authCache.get(hash);
+  if (cached3 && now - cached3.cachedAt < AUTH_TTL_MS) {
+    stampLastUsed(db, cached3, now);
+    return cached3.row;
+  }
   const [row] = await db.select().from(apiKeys).where(and5(eq5(apiKeys.keyHash, hash), isNull(apiKeys.revokedAt))).limit(1);
-  if (!row) return null;
-  db.update(apiKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq5(apiKeys.id, row.id)).then(void 0, () => {
-  });
+  if (!row) {
+    authCache.delete(hash);
+    return null;
+  }
+  const entry = { row, cachedAt: now, lastStampAt: 0 };
+  authCache.set(hash, entry);
+  stampLastUsed(db, entry, now);
   return row;
 }
 async function listKeys(db) {
@@ -3864,31 +4422,61 @@ async function rotateKey(db, prefixOrId) {
   await db.update(apiKeys).set({ revokedAt: /* @__PURE__ */ new Date() }).where(eq5(apiKeys.id, previous.id));
   return { key, row, previous };
 }
-var DISPLAY_BODY;
+var DISPLAY_BODY, authCache, AUTH_TTL_MS, STAMP_INTERVAL_MS;
 var init_apiKeys = __esm({
   "src/auth/apiKeys.ts"() {
     "use strict";
     init_esm_shims();
     init_constants();
     init_schema();
+    init_logger();
     DISPLAY_BODY = 6;
+    authCache = /* @__PURE__ */ new Map();
+    AUTH_TTL_MS = 6e4;
+    STAMP_INTERVAL_MS = 6e4;
   }
 });
 
 // src/mcp/http.ts
 var http_exports = {};
 __export(http_exports, {
+  secretEquals: () => secretEquals,
   startHttpServer: () => startHttpServer
 });
+import { createHash as createHash6, timingSafeEqual } from "crypto";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 function rpcError(code, message) {
   return { jsonrpc: "2.0", error: { code, message }, id: null };
 }
+function secretEquals(a, b) {
+  return timingSafeEqual(
+    createHash6("sha256").update(a).digest(),
+    createHash6("sha256").update(b).digest()
+  );
+}
 async function startHttpServer(opts = {}) {
   const config = getConfig();
   const port = opts.port ?? config.PORT;
   const [{ default: express }, { default: helmet }, { rateLimit, ipKeyGenerator }] = await Promise.all([import("express"), import("helmet"), import("express-rate-limit")]);
   const { db } = createDb({ max: 20 });
+  if (!process.env.REDIS_URL) {
+    logger.warn(
+      "REDIS_URL not set \u2014 response caching is OFF; every request recomputes on the database. Set REDIS_URL before serving real traffic (and it also backs the rate limiter across instances)."
+    );
+  }
+  let makeStore = null;
+  if (process.env.REDIS_URL) {
+    const [{ default: Redis }, { default: RedisStore }] = await Promise.all([
+      import("ioredis"),
+      import("rate-limit-redis")
+    ]);
+    const rlRedis = new Redis(process.env.REDIS_URL, { maxRetriesPerRequest: 1, family: 0 });
+    rlRedis.on("error", (err) => logger.warn(`rate-limit redis: ${err.message}`));
+    makeStore = (prefix) => new RedisStore({
+      prefix,
+      sendCommand: (...args) => rlRedis.call(args[0], ...args.slice(1))
+    });
+  }
   const app = express();
   app.set("trust proxy", 1);
   app.use(helmet());
@@ -3896,11 +4484,26 @@ async function startHttpServer(opts = {}) {
   app.get("/healthz", (_req, res) => {
     res.status(200).json({ status: "ok" });
   });
+  app.get("/metrics", (req, res) => {
+    const token = config.LURQ_METRICS_TOKEN;
+    if (!token) {
+      res.status(404).end();
+      return;
+    }
+    const header = req.headers.authorization;
+    const presented = header?.startsWith("Bearer ") ? header.slice(7).trim() : "";
+    if (presented !== token) {
+      res.status(401).end();
+      return;
+    }
+    res.type("text/plain").send(renderPrometheus());
+  });
   const ipLimiter = rateLimit({
     windowMs: config.LURQ_RATE_LIMIT_WINDOW_MS,
     limit: config.LURQ_IP_RATE_LIMIT_MAX,
     standardHeaders: "draft-7",
     legacyHeaders: false,
+    ...makeStore ? { store: makeStore("rl:ip:") } : {},
     message: rpcError(-32029, "Rate limit exceeded.")
   });
   const auth = async (req, res, next) => {
@@ -3937,10 +4540,38 @@ async function startHttpServer(opts = {}) {
       const id = req.lurqKey?.id;
       return id != null ? `key:${id}` : ipKeyGenerator(req.ip ?? "0.0.0.0");
     },
+    ...makeStore ? { store: makeStore("rl:key:") } : {},
     message: rpcError(-32029, "Rate limit exceeded.")
   });
+  app.post("/keys", async (req, res) => {
+    const secret = config.LURQ_ISSUER_SECRET;
+    if (!secret) {
+      res.status(404).end();
+      return;
+    }
+    const header = req.headers.authorization;
+    const token = header?.startsWith("Bearer ") ? header.slice(7).trim() : "";
+    if (!token || !secretEquals(token, secret)) {
+      res.status(401).json({ error: "Invalid issuer secret." });
+      return;
+    }
+    const body = req.body ?? {};
+    const ownerId = typeof body.ownerId === "string" ? body.ownerId.trim() : "";
+    if (!ownerId) {
+      res.status(400).json({ error: "ownerId is required." });
+      return;
+    }
+    const label = typeof body.label === "string" ? body.label.slice(0, 200) : void 0;
+    try {
+      const { key, row } = await createKey(db, { ownerId, label, tier: "free" });
+      res.status(201).json({ key, prefix: row.prefix });
+    } catch (err) {
+      logger.error("key issuance failed:", err instanceof Error ? err.message : String(err));
+      res.status(500).json({ error: "Could not issue key." });
+    }
+  });
   app.post("/mcp", ipLimiter, auth, keyLimiter, async (req, res) => {
-    const server = buildMcpServer(db);
+    const server = buildMcpServer(db, { ownerId: req.lurqKey?.ownerId ?? null });
     const transport = new StreamableHTTPServerTransport({
       sessionIdGenerator: void 0,
       enableJsonResponse: true
@@ -3973,6 +4604,7 @@ var init_http2 = __esm({
     init_apiKeys();
     init_client();
     init_server();
+    init_metrics();
   }
 });
 
@@ -4118,9 +4750,13 @@ async function runDiscovery(opts = {}) {
     logger.info(
       `Discovery: ${graph.length} graph + ${search.length} search candidates \u2192 ${enqueued} new queued.`
     );
-    const pending = await getPendingCandidates(handle.db, cap * 4);
+    const pending2 = await getPendingCandidates(handle.db, cap * 4);
     const scored = [];
-    for (const cand of pending) {
+    for (const cand of pending2) {
+      if (cand.preScore !== null) {
+        scored.push({ name: cand.name, preScore: cand.preScore });
+        continue;
+      }
       const preScore = await preScorePackage(cand.name);
       await setDiscoveryStatus(handle.db, cand.name, {
         status: passesGate(preScore) ? "pending" : "rejected",
@@ -4128,7 +4764,7 @@ async function runDiscovery(opts = {}) {
       });
       if (passesGate(preScore)) scored.push({ name: cand.name, preScore });
     }
-    logger.info(`Discovery: gated ${pending.length}; ${scored.length} cleared the quality bar.`);
+    logger.info(`Discovery: gated ${pending2.length}; ${scored.length} cleared the quality bar.`);
     scored.sort((a, b) => b.preScore - a.preScore);
     const toIngest = scored.slice(0, cap);
     const deferred = scored.slice(cap);
@@ -4152,7 +4788,7 @@ async function runDiscovery(opts = {}) {
     logger.info(`Discovery: ingested ${ingested}/${toIngest.length} candidate(s).`);
     return {
       enqueued,
-      gated: pending.length,
+      gated: pending2.length,
       passed: scored.length,
       ingested,
       droppedToNextRun: deferred.length
@@ -4572,14 +5208,134 @@ var init_local = __esm({
   }
 });
 
+// src/sandbox/e2b.ts
+var e2b_exports = {};
+__export(e2b_exports, {
+  E2BSandbox: () => E2BSandbox,
+  installCommand: () => installCommand,
+  shQuote: () => shQuote,
+  smokeCommand: () => smokeCommand
+});
+function shQuote(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+function installCommand(specs, allowScripts) {
+  const bad = specs.find((s) => s.startsWith("-"));
+  if (bad) throw new Error(`Invalid package spec: ${bad}`);
+  const flags = ["--no-audit", "--no-fund", "--no-package-lock", "--no-save"];
+  if (!allowScripts) flags.push("--ignore-scripts");
+  return `npm install ${specs.map(shQuote).join(" ")} ${flags.join(" ")}`;
+}
+function smokeCommand(pkg, moduleSystem) {
+  const js = moduleSystem === "esm" ? `await import(${JSON.stringify(pkg)})` : `require(${JSON.stringify(pkg)})`;
+  const flags = moduleSystem === "esm" ? "--input-type=module " : "";
+  return `node ${flags}-e ${shQuote(js)}`;
+}
+function condense2(s) {
+  return s.replace(/\s+/g, " ").trim().slice(0, ERROR_MAX2);
+}
+function errText(err) {
+  if (err && typeof err === "object") {
+    const e = err;
+    if (typeof e.stderr === "string" && e.stderr.trim()) return e.stderr;
+    if (typeof e.message === "string") return e.message;
+  }
+  return String(err);
+}
+var INSTALL_TIMEOUT_MS2, SMOKE_TIMEOUT_MS2, ERROR_MAX2, WORKDIR, toSpec2, E2BSandbox;
+var init_e2b = __esm({
+  "src/sandbox/e2b.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_types2();
+    INSTALL_TIMEOUT_MS2 = 12e4;
+    SMOKE_TIMEOUT_MS2 = 3e4;
+    ERROR_MAX2 = 500;
+    WORKDIR = "/home/user";
+    toSpec2 = (p) => p.version ? `${p.name}@${p.version}` : p.name;
+    E2BSandbox = class {
+      name = "e2b";
+      async verify(pkg, version, opts = {}) {
+        const set = await this.verifySet([{ name: pkg, version }], opts);
+        return {
+          driver: this.name,
+          moduleSystem: set.moduleSystem,
+          installed: set.installed,
+          imported: set.loaded[0]?.loaded ?? null,
+          ranScripts: opts.allowScripts ?? false,
+          durationMs: set.durationMs,
+          error: set.error
+        };
+      }
+      async verifySet(packages2, opts = {}) {
+        const config = getConfig();
+        const target = opts.target ?? DEFAULT_TARGET;
+        const allowScripts = opts.allowScripts ?? false;
+        const specs = packages2.map(toSpec2);
+        const installTimeout = opts.timeoutMs ?? INSTALL_TIMEOUT_MS2;
+        const started = Date.now();
+        const loaded = packages2.map((p) => ({ name: p.name, loaded: null }));
+        let installed = false;
+        let error = null;
+        const install = installCommand(specs, allowScripts);
+        const { default: Sandbox } = await import("e2b");
+        const createOpts = {
+          apiKey: config.E2B_API_KEY,
+          timeoutMs: installTimeout + SMOKE_TIMEOUT_MS2 * packages2.length + 3e4
+        };
+        const sandbox = config.E2B_TEMPLATE ? await Sandbox.create(config.E2B_TEMPLATE, createOpts) : await Sandbox.create(createOpts);
+        try {
+          await sandbox.files.write(
+            `${WORKDIR}/package.json`,
+            JSON.stringify({ name: "lurq-sandbox", version: "0.0.0", private: true })
+          );
+          await sandbox.commands.run(install, { cwd: WORKDIR, timeoutMs: installTimeout });
+          installed = true;
+          for (let i = 0; i < packages2.length; i++) {
+            try {
+              await sandbox.commands.run(smokeCommand(packages2[i].name, target.moduleSystem), {
+                cwd: WORKDIR,
+                timeoutMs: SMOKE_TIMEOUT_MS2
+              });
+              loaded[i].loaded = true;
+            } catch (err) {
+              loaded[i].loaded = false;
+              if (!error) error = condense2(errText(err));
+            }
+          }
+        } catch (err) {
+          error = condense2(errText(err));
+        } finally {
+          await sandbox.kill().catch(() => {
+          });
+        }
+        return {
+          driver: this.name,
+          moduleSystem: target.moduleSystem,
+          installed,
+          loaded,
+          durationMs: Date.now() - started,
+          error
+        };
+      }
+    };
+  }
+});
+
 // src/sandbox/index.ts
-function getSandbox() {
+async function getSandbox() {
+  if (getConfig().E2B_API_KEY) {
+    const { E2BSandbox: E2BSandbox2 } = await Promise.resolve().then(() => (init_e2b(), e2b_exports));
+    return new E2BSandbox2();
+  }
   return new LocalSandbox();
 }
 var init_sandbox = __esm({
   "src/sandbox/index.ts"() {
     "use strict";
     init_esm_shims();
+    init_config();
     init_local();
     init_types2();
     init_local();
@@ -4592,7 +5348,7 @@ __export(sandbox_exports, {
   verifyPackageInSandbox: () => verifyPackageInSandbox
 });
 async function verifyPackageInSandbox(db, pkg, version, opts = {}) {
-  const result = await getSandbox().verify(pkg, version, opts);
+  const result = await (await getSandbox()).verify(pkg, version, opts);
   await storeVerificationRun(db, {
     packageName: pkg,
     version: version ?? "latest",
@@ -4656,7 +5412,7 @@ async function verifyCompatibility(db, packages2, opts = {}) {
       version: (await getPackageByName(db, name))?.latestVersion ?? "latest"
     }))
   );
-  const result = await getSandbox().verifySet(
+  const result = await (await getSandbox()).verifySet(
     resolved.map((r) => ({ name: r.name, version: r.version === "latest" ? null : r.version })),
     { allowScripts: opts.allowScripts }
   );
@@ -4822,9 +5578,9 @@ not found: ${res.missing.join(", ")}`));
 }
 function runWeights(opts = {}) {
   const w = loadWeights();
-  const active = activeWeightsPath();
+  const active2 = activeWeightsPath();
   if (opts.json) {
-    console.log(JSON.stringify({ ...w, source: active?.source ?? "defaults" }, null, 2));
+    console.log(JSON.stringify({ ...w, source: active2?.source ?? "defaults" }, null, 2));
     return;
   }
   const pct = (n) => n.toFixed(2);
@@ -4851,7 +5607,7 @@ function runWeights(opts = {}) {
     ])
   );
   console.log(dim(`
-Source: ${active ? `${active.source} (${active.path})` : "defaults (no user overrides)"}`));
+Source: ${active2 ? `${active2.source} (${active2.path})` : "defaults (no user overrides)"}`));
 }
 async function runEditWeights(opts) {
   const { invalidateCache: invalidateCache2 } = await Promise.resolve().then(() => (init_cache(), cache_exports));
@@ -5499,7 +6255,11 @@ async function runKeysCreate(opts) {
   requireConfig(["DATABASE_URL"]);
   const { db, close } = createDb({ max: 1 });
   try {
-    const { key, row } = await createKey(db, { label: opts.label, tier: opts.tier });
+    const { key, row } = await createKey(db, {
+      label: opts.label,
+      tier: opts.tier,
+      ownerId: opts.owner
+    });
     await presentNewKey(key, row, opts);
   } finally {
     await close();
@@ -5797,7 +6557,7 @@ function buildProgram() {
     await runInstallSkill2(opts);
   });
   const keys = program.command("keys").description("manage API keys for the hosted service (operator; needs DATABASE_URL)");
-  keys.command("create").description("create a new API key (shown once; erased from the terminal after you copy it)").option("--label <label>", "human label (owner / org / purpose)").option("--tier <tier>", "tier name", "free").option("--json", "print the key as JSON and skip the interactive erase (for scripts)").action(async (opts) => {
+  keys.command("create").description("create a new API key (shown once; erased from the terminal after you copy it)").option("--label <label>", "human label (owner / org / purpose)").option("--tier <tier>", "tier name", "free").option("--owner <id>", "org/owner id to attribute this key to (e.g. a Clerk org id)").option("--json", "print the key as JSON and skip the interactive erase (for scripts)").action(async (opts) => {
     const { runKeysCreate: runKeysCreate2 } = await Promise.resolve().then(() => (init_keys(), keys_exports));
     await runKeysCreate2(opts);
   });
@@ -5838,8 +6598,8 @@ init_config();
 // src/core/gate.ts
 init_esm_shims();
 init_constants();
-import { createHash as createHash6, timingSafeEqual } from "crypto";
-var PRE_LAUNCH = true;
+import { createHash as createHash7, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var PRE_LAUNCH = false;
 var OWNER_HASH = "9675c37e56783e747e4a89ee3919d95d1364f2e5dd0f14501b0f878f8cc3682b";
 var ALLOWED = /* @__PURE__ */ new Set([
   "-v",
@@ -5858,9 +6618,9 @@ var ALLOWED = /* @__PURE__ */ new Set([
 function isOwner() {
   const key = process.env.LURQ_OWNER_KEY;
   if (!key) return false;
-  const got = createHash6("sha256").update(key).digest();
+  const got = createHash7("sha256").update(key).digest();
   const want = Buffer.from(OWNER_HASH, "hex");
-  return got.length === want.length && timingSafeEqual(got, want);
+  return got.length === want.length && timingSafeEqual2(got, want);
 }
 function enforceGate(argv) {
   if (!PRE_LAUNCH || isOwner()) return;