lurqrun 0.0.8 → 0.0.10

package/dist/index.js

@@ -75,15 +75,119 @@ var init_types = __esm({
   }
 });
 
+// package.json
+var package_default;
+var init_package = __esm({
+  "package.json"() {
+    package_default = {
+      name: "lurqrun",
+      version: "0.0.10",
+      description: "A continuously-updated, evidence-scored index of JS/TS frameworks and libraries, exposed as an MCP server, CLI, and agent skill \u2014 so AI coding assistants get fresh, objective dependency recommendations.",
+      type: "module",
+      license: "Apache-2.0",
+      author: "jadenryu",
+      repository: {
+        type: "git",
+        url: "git+https://github.com/jadenryu/lurq.git"
+      },
+      homepage: "https://github.com/jadenryu/lurq#readme",
+      bugs: {
+        url: "https://github.com/jadenryu/lurq/issues"
+      },
+      keywords: [
+        "mcp",
+        "model-context-protocol",
+        "npm",
+        "dependencies",
+        "recommendations",
+        "claude-code",
+        "ai-coding"
+      ],
+      bin: {
+        lurq: "dist/bin/lurq.js"
+      },
+      workspaces: [
+        "apps/*"
+      ],
+      files: [
+        "dist",
+        "src/data/seed.json",
+        "templates",
+        "drizzle",
+        "README.md"
+      ],
+      engines: {
+        node: ">=20"
+      },
+      scripts: {
+        build: "tsup",
+        dev: "tsx src/bin/lurq.ts",
+        lurq: "tsx src/bin/lurq.ts",
+        "dev:apps": "npm run dev --workspace @lurq/docs & npm run dev --workspace @lurq/web",
+        "benchmark:validate": "tsx src/bin/benchmark.ts validate",
+        "benchmark:run": "tsx src/bin/benchmark.ts run",
+        start: "node dist/bin/lurq.js",
+        test: "vitest run",
+        "test:watch": "vitest",
+        typecheck: "tsc --noEmit",
+        lint: "eslint .",
+        format: "prettier --write .",
+        "format:check": "prettier --check .",
+        "db:generate": "drizzle-kit generate",
+        "db:migrate": "tsx src/bin/operator.ts db migrate",
+        operator: "tsx src/bin/operator.ts",
+        "operator:prod": "LURQ_ENV_FILE=.env.production tsx src/bin/operator.ts",
+        prepublishOnly: "npm test && npm run build",
+        "content:drift": "tsx scripts/gen-drift.ts"
+      },
+      dependencies: {
+        "@inquirer/prompts": "^8.5.2",
+        "@modelcontextprotocol/sdk": "^1.29.0",
+        commander: "^12.1.0",
+        dotenv: "^16.4.5",
+        "drizzle-orm": "^0.45.2",
+        express: "^5.2.1",
+        "express-rate-limit": "^8.5.2",
+        helmet: "^8.2.0",
+        ioredis: "^5.11.1",
+        postgres: "^3.4.9",
+        "rate-limit-redis": "^4.3.1",
+        semver: "^7.8.5",
+        typescript: "^5.5.4",
+        "update-notifier": "^7.3.1",
+        zod: "^3.23.8"
+      },
+      devDependencies: {
+        "@eslint/js": "^9.9.0",
+        "@types/express": "^5.0.6",
+        "@types/node": "^22.5.0",
+        "@types/semver": "^7.7.1",
+        "drizzle-kit": "^0.31.10",
+        e2b: "^2.31.0",
+        eslint: "^9.9.0",
+        marked: "^18.0.9",
+        "pdfjs-dist": "^6.2.108",
+        playwright: "^1.62.1",
+        prettier: "^3.3.3",
+        tsup: "^8.2.4",
+        tsx: "^4.19.0",
+        "typescript-eslint": "^8.3.0",
+        vitest: "^2.0.5"
+      }
+    };
+  }
+});
+
 // src/core/constants.ts
 var SERVER_NAME, PACKAGE_NAME, VERSION, DEFAULT_ENDPOINT, API_KEY_PREFIX, EMBEDDING_DIM, STALENESS_DAYS, HOUR, DAY, CACHE_TTL;
 var init_constants = __esm({
   "src/core/constants.ts"() {
     "use strict";
     init_esm_shims();
+    init_package();
     SERVER_NAME = "lurq";
     PACKAGE_NAME = "lurqrun";
-    VERSION = "0.0.8";
+    VERSION = package_default.version;
     DEFAULT_ENDPOINT = "https://api.lurq.run/mcp";
     API_KEY_PREFIX = "lurq_live_";
     EMBEDDING_DIM = 1536;
@@ -1117,6 +1221,10 @@ var init_schema = __esm({
         peerDependencies: jsonb("peer_dependencies").$type(),
         peerDependenciesMeta: jsonb("peer_dependencies_meta").$type(),
         engines: jsonb("engines").$type(),
+        /** Where this package runs, classified from its own manifest at ingest.
+         *  Resolves the `framework` category's frontend/backend ambiguity for the
+         *  architecture diagram. Null = the manifest did not say clearly enough. */
+        runtimeTarget: text("runtime_target").$type(),
         // Computed outputs
         healthScore: integer("health_score"),
         /** Intrinsic-quality axis (§1), adoption-independent. Blends with health at
@@ -1234,7 +1342,13 @@ var init_schema = __esm({
       {
         packageName: text("package_name").notNull(),
         version: text("version").notNull(),
-        publishedAt: ts("published_at")
+        publishedAt: ts("published_at"),
+        /** Peers/engines declared by this exact version. Lifted from the registry
+         *  document at ingest (it already carries every version's manifest), so a
+         *  conflict check against the versions a repo actually RUNS is one indexed
+         *  query rather than a registry read per dependency. */
+        peerDependencies: jsonb("peer_dependencies").$type(),
+        engines: jsonb("engines").$type()
       },
       (table2) => [
         primaryKey({ columns: [table2.packageName, table2.version] }),
@@ -1615,10 +1729,10 @@ import { drizzle } from "drizzle-orm/postgres-js";
 import postgres from "postgres";
 function createDb(opts = {}) {
   const { DATABASE_URL } = requireConfig(["DATABASE_URL"]);
-  const sql12 = postgres(DATABASE_URL, { max: opts.max ?? 10, onnotice: () => {
+  const sql14 = postgres(DATABASE_URL, { max: opts.max ?? 10, onnotice: () => {
   } });
-  const db = drizzle(sql12, { schema: schema_exports });
-  return { db, sql: sql12, close: () => sql12.end() };
+  const db = drizzle(sql14, { schema: schema_exports });
+  return { db, sql: sql14, close: () => sql14.end() };
 }
 var init_client = __esm({
   "src/db/client.ts"() {
@@ -1648,7 +1762,9 @@ async function upsertPackageVersions(db, name, versions) {
     const rows = versions.slice(i, i + VERSION_CHUNK).map((v) => ({
       packageName: name,
       version: v.version,
-      publishedAt: v.publishedAt
+      publishedAt: v.publishedAt,
+      peerDependencies: v.peerDependencies ?? null,
+      engines: v.engines ?? null
     }));
     await db.insert(packageVersions).values(rows).onConflictDoNothing();
   }
@@ -2163,6 +2279,7 @@ function parseNpmRegistry(json2) {
     directDependenciesCount: countDeps(latestManifest?.dependencies),
     hasProvenance: detectProvenance(latestManifest),
     hasInstallScripts: detectInstallScripts(latestManifest),
+    hasBrowserField: latestManifest?.browser != null,
     peerDependencies: parseDepMap(latestManifest?.peerDependencies),
     peerDependenciesMeta: parsePeerMeta(latestManifest?.peerDependenciesMeta),
     engines: parseDepMap(latestManifest?.engines),
@@ -2198,7 +2315,13 @@ function parseVersionTimeline(json2) {
   const versions = json2?.versions;
   if (!versions || typeof versions !== "object") return [];
   const time = json2?.time ?? {};
-  return Object.keys(versions).map((version) => ({ version, publishedAt: toDate(time?.[version]) })).sort((a, b) => (b.publishedAt?.getTime() ?? 0) - (a.publishedAt?.getTime() ?? 0));
+  return Object.keys(versions).map((version) => ({
+    version,
+    publishedAt: toDate(time?.[version]),
+    // Already in this document — no second fetch, no per-version round trip.
+    peerDependencies: parseDepMap(versions[version]?.peerDependencies),
+    engines: parseDepMap(versions[version]?.engines)
+  })).sort((a, b) => (b.publishedAt?.getTime() ?? 0) - (a.publishedAt?.getTime() ?? 0));
 }
 function parseKeywords(value) {
   if (!Array.isArray(value)) return [];
@@ -2778,18 +2901,21 @@ async function checkCompat(db, packages2, opts = {}) {
     provenance: edge.provenance,
     witnessCount: edge.witnessCount
   }));
+  const versionOf = new Map(members.map((m) => [m.name, m.version]));
+  const matchesCheckedVersions = (edge) => edgeMatchesVersions(edge, versionOf);
   for (const edge of edges) {
     if (edge.status === "conflict") {
+      const at = matchesCheckedVersions(edge) ? "" : ` (recorded at those versions; you are checking ${edge.packageA}@${versionOf.get(edge.packageA) ?? "?"} and ${edge.packageB}@${versionOf.get(edge.packageB) ?? "?"})`;
       conflicts.push({
         source: "sandbox",
         packages: [edge.packageA, edge.packageB],
-        detail: `${edge.packageA}@${edge.versionA} and ${edge.packageB}@${edge.versionB} failed to co-install in the sandbox`
+        detail: `${edge.packageA}@${edge.versionA} and ${edge.packageB}@${edge.versionB} failed to co-install in the sandbox${at}`
       });
     }
   }
   const checkedNames = members.map((m) => m.name);
   const provenCompatible = new Set(
-    edges.filter((e) => e.status === "compatible").map((e) => pairKey(e.packageA, e.packageB))
+    edges.filter((e) => e.status === "compatible" && matchesCheckedVersions(e)).map((e) => pairKey(e.packageA, e.packageB))
   );
   if (checkedNames.length >= 2 && !conflicts.length && !fullyCovered(checkedNames, provenCompatible)) {
     await enqueueCompatVerify(db, checkedNames).catch(() => {
@@ -2811,6 +2937,11 @@ async function checkCompat(db, packages2, opts = {}) {
     pairs: enumeratePairs(checkedNames, conflicts)
   };
 }
+function edgeMatchesVersions(edge, versionOf) {
+  const a = versionOf.get(edge.packageA);
+  const b = versionOf.get(edge.packageB);
+  return a != null && b != null && a === edge.versionA && b === edge.versionB;
+}
 function enumeratePairs(names2, conflicts) {
   const byPair = /* @__PURE__ */ new Map();
   for (const c of conflicts) {
@@ -3244,22 +3375,6 @@ var init_verification = __esm({
   }
 });
 
-// src/db/outcomes.ts
-import { desc as desc3, eq as eq5 } from "drizzle-orm";
-async function recordOutcome(db, outcome) {
-  await db.insert(recommendationOutcomes).values(outcome);
-}
-async function getOutcomesByOwner(db, ownerId, opts = {}) {
-  return db.select().from(recommendationOutcomes).where(eq5(recommendationOutcomes.ownerId, ownerId)).orderBy(desc3(recommendationOutcomes.createdAt)).limit(opts.limit ?? 50);
-}
-var init_outcomes = __esm({
-  "src/db/outcomes.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_schema();
-  }
-});
-
 // src/data/successors.json
 var successors_default;
 var init_successors = __esm({
@@ -3322,9 +3437,30 @@ var init_successors = __esm({
 });
 
 // src/core/successors.ts
-function lookupSuccessor(name) {
-  const hit = MAP[name.toLowerCase()];
-  return hit ? { name: hit.replacedBy, reason: hit.reason } : null;
+function lookupSuccessor(name, learned) {
+  const key = name.toLowerCase();
+  const curated = MAP[key];
+  if (curated) return { name: curated.replacedBy, reason: curated.reason };
+  return learned?.get(key) ?? null;
+}
+function buildLearnedSuccessors(observed, isSuperseded) {
+  const best = /* @__PURE__ */ new Map();
+  for (const row of observed) {
+    if (!isSuperseded(row.from)) continue;
+    const key = row.from.toLowerCase();
+    const current = best.get(key);
+    const better = !current || row.owners > current.owners || row.owners === current.owners && row.observations > current.observations;
+    if (better) best.set(key, { to: row.to, owners: row.owners, observations: row.observations });
+  }
+  return new Map(
+    [...best].map(([from, hit]) => [
+      from,
+      {
+        name: hit.to,
+        reason: `${hit.owners} teams moved here after ${from} failed for the same need`
+      }
+    ])
+  );
 }
 var MAP;
 var init_successors2 = __esm({
@@ -3336,6 +3472,81 @@ var init_successors2 = __esm({
   }
 });
 
+// src/db/outcomes.ts
+import { count, desc as desc3, eq as eq5, inArray as inArray3, sql as sql5 } from "drizzle-orm";
+import { alias } from "drizzle-orm/pg-core";
+async function recordOutcome(db, outcome) {
+  await db.insert(recommendationOutcomes).values(outcome);
+}
+async function getFieldEvidence(db, names2) {
+  if (names2 && names2.length === 0) return /* @__PURE__ */ new Map();
+  const rows = await db.select({
+    packageName: recommendationOutcomes.packageName,
+    reports: count(),
+    successes: sql5`count(*) FILTER (WHERE ${SUCCESS_PREDICATE})`.mapWith(Number)
+  }).from(recommendationOutcomes).where(names2 ? inArray3(recommendationOutcomes.packageName, names2) : void 0).groupBy(recommendationOutcomes.packageName);
+  return new Map(
+    rows.map((r) => [r.packageName, { reports: Number(r.reports), successes: r.successes }])
+  );
+}
+async function learnSuccessions(db) {
+  const failed = alias(recommendationOutcomes, "failed");
+  const worked = alias(recommendationOutcomes, "worked");
+  const rows = await db.select({
+    from: failed.packageName,
+    to: worked.packageName,
+    owners: sql5`count(DISTINCT ${failed.ownerId})`.mapWith(Number),
+    observations: sql5`count(*)`.mapWith(Number)
+  }).from(failed).innerJoin(
+    worked,
+    sql5`${worked.ownerId} = ${failed.ownerId}
+        AND ${worked.need} = ${failed.need}
+        AND ${worked.packageName} <> ${failed.packageName}
+        AND ${worked.createdAt} > ${failed.createdAt}`
+  ).where(
+    sql5`${failed.need} IS NOT NULL
+        AND ${failed.ownerId} IS NOT NULL
+        AND NOT (${failed.accepted} AND (${failed.buildSignal} IS NULL OR ${failed.buildSignal} <> 'failed'))
+        AND (${worked.accepted} AND (${worked.buildSignal} IS NULL OR ${worked.buildSignal} <> 'failed'))`
+  ).groupBy(failed.packageName, worked.packageName).having(sql5`count(DISTINCT ${failed.ownerId}) >= ${MIN_SUCCESSION_OWNERS}`);
+  return rows.map((r) => ({
+    from: r.from,
+    to: r.to,
+    owners: Number(r.owners),
+    observations: Number(r.observations)
+  }));
+}
+async function loadLearnedSuccessors(db, now = Date.now()) {
+  if (learnedCache && now - learnedCache.at < LEARNED_TTL_MS) return learnedCache.value;
+  const observed = await learnSuccessions(db);
+  if (observed.length === 0) {
+    learnedCache = { at: now, value: /* @__PURE__ */ new Map() };
+    return learnedCache.value;
+  }
+  const names2 = [...new Set(observed.map((o) => o.from))];
+  const rows = await db.select({ name: packages.name, deprecated: packages.deprecated, archived: packages.archived }).from(packages).where(inArray3(packages.name, names2));
+  const dead = new Set(rows.filter((r) => r.deprecated || r.archived).map((r) => r.name));
+  const value = buildLearnedSuccessors(observed, (name) => dead.has(name));
+  learnedCache = { at: now, value };
+  return value;
+}
+async function getOutcomesByOwner(db, ownerId, opts = {}) {
+  return db.select().from(recommendationOutcomes).where(eq5(recommendationOutcomes.ownerId, ownerId)).orderBy(desc3(recommendationOutcomes.createdAt)).limit(opts.limit ?? 50);
+}
+var SUCCESS_PREDICATE, MIN_SUCCESSION_OWNERS, LEARNED_TTL_MS, learnedCache;
+var init_outcomes = __esm({
+  "src/db/outcomes.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_successors2();
+    init_schema();
+    SUCCESS_PREDICATE = sql5`${recommendationOutcomes.accepted} AND (${recommendationOutcomes.buildSignal} IS NULL OR ${recommendationOutcomes.buildSignal} <> 'failed')`;
+    MIN_SUCCESSION_OWNERS = 3;
+    LEARNED_TTL_MS = 10 * 60 * 1e3;
+    learnedCache = null;
+  }
+});
+
 // src/ingestion/sources/githubReadme.ts
 async function fetchGithubReadme(owner, repo, fetchImpl) {
   for (const file of CANDIDATES) {
@@ -3732,7 +3943,7 @@ function resetWeights() {
   resetWeightsCache();
   return removed;
 }
-var HEALTH_WEIGHTS, COMPOSITE, QUALITY_WEIGHTS, QUALITY, MAINTENANCE_WEIGHTS, MAINTENANCE, ADOPTION, RELIABILITY, EFFICIENCY, DEFAULT_WEIGHTS, cachedWeights, SETTABLE, WEIGHT_EXPLANATIONS, CONFIDENCE;
+var HEALTH_WEIGHTS, COMPOSITE, QUALITY_WEIGHTS, QUALITY, MAINTENANCE_WEIGHTS, MAINTENANCE, ADOPTION, RELIABILITY, EFFICIENCY, FIELD, DEFAULT_WEIGHTS, cachedWeights, SETTABLE, WEIGHT_EXPLANATIONS, CONFIDENCE;
 var init_weights = __esm({
   "src/scoring/weights.ts"() {
     "use strict";
@@ -3811,6 +4022,26 @@ var init_weights = __esm({
       /** Bundle size at the category median maps to this score; smaller → higher. */
       medianScore: 50
     };
+    FIELD = {
+      /** Weight when evidence exists — ~9% of the blend (0.10 / 1.10). */
+      weight: 0.1,
+      /**
+       * Bayesian shrinkage strength: how many prior observations the neutral rate is
+       * worth. One failed report out of one is not a 0-scoring package, and a raw
+       * success rate would say it is. At m=12, a single failure lands near 69 rather
+       * than 0, and it takes real volume to move the number far — which is the
+       * correct epistemics for a signal users can trivially poison.
+       */
+      priorWeight: 12,
+      /**
+       * The prior success rate a package is assumed to have before anyone reports.
+       * Set at the observed base rate of "installs and builds fine", not 0.5:
+       * most packages do work, so 0.5 would penalise the first honest reporter.
+       */
+      priorRate: 0.75,
+      /** Reports at or above this cap the confidence note as fully-evidenced. */
+      wellEvidencedReports: 25
+    };
     DEFAULT_WEIGHTS = {
       health: { ...HEALTH_WEIGHTS },
       composite: { ...COMPOSITE }
@@ -3978,17 +4209,24 @@ function computeQuality(input) {
   if (components.length === 0) return null;
   return weightedAverage(components);
 }
+function computeFieldScore(evidence) {
+  if (!evidence || evidence.reports <= 0) return null;
+  const { reports, successes } = evidence;
+  const m = FIELD.priorWeight;
+  return clamp(Math.round(100 * (successes + m * FIELD.priorRate) / (reports + m)));
+}
 function computeHealthScore(breakdown, weights = HEALTH_WEIGHTS) {
-  const { maintenance, adoption, reliability, efficiency } = breakdown;
   const w = weights;
-  if (efficiency === null) {
-    const denom = w.maintenance + w.adoption + w.reliability;
-    return Math.round(
-      (w.maintenance * maintenance + w.adoption * adoption + w.reliability * reliability) / denom
-    );
-  }
-  return Math.round(
-    w.maintenance * maintenance + w.adoption * adoption + w.reliability * reliability + w.efficiency * efficiency
+  return weightedAverage(
+    [
+      { value: breakdown.maintenance, weight: w.maintenance },
+      { value: breakdown.adoption, weight: w.adoption },
+      { value: breakdown.reliability, weight: w.reliability },
+      { value: breakdown.efficiency, weight: w.efficiency },
+      // `?? null` — a breakdown stored before field evidence shipped has the key
+      // absent, and undefined must redistribute, not score 0.
+      { value: breakdown.field ?? null, weight: FIELD.weight }
+    ].filter((c) => c.value !== null)
   );
 }
 function computeComposite(healthScore, qualityScore, lambda = COMPOSITE.lambda) {
@@ -4233,7 +4471,7 @@ var init_types2 = __esm({
 });
 
 // src/db/repos.ts
-import { and as and5, eq as eq7, sql as sql5 } from "drizzle-orm";
+import { and as and5, eq as eq7, sql as sql6 } from "drizzle-orm";
 async function upsertRepos(db, rows) {
   if (rows.length === 0) return 0;
   await db.insert(repos).values(
@@ -4248,9 +4486,9 @@ async function upsertRepos(db, rows) {
   ).onConflictDoUpdate({
     target: [repos.ownerId, repos.fullName],
     set: {
-      installationId: sql5`excluded.installation_id`,
-      defaultBranch: sql5`excluded.default_branch`,
-      isPrivate: sql5`excluded.is_private`
+      installationId: sql6`excluded.installation_id`,
+      defaultBranch: sql6`excluded.default_branch`,
+      isPrivate: sql6`excluded.is_private`
     }
   });
   return rows.length;
@@ -4260,7 +4498,7 @@ async function listRepos(db, ownerId) {
 }
 async function reposDeclaring(db, name) {
   return db.select().from(repos).where(
-    sql5`exists (
+    sql6`exists (
         select 1 from jsonb_array_elements(${repos.manifests}) as m
         where jsonb_exists(m -> 'deps', ${name})
       )`
@@ -4270,6 +4508,10 @@ async function getRepo(db, ownerId, id) {
   const rows = await db.select().from(repos).where(and5(eq7(repos.ownerId, ownerId), eq7(repos.id, id))).limit(1);
   return rows[0] ?? null;
 }
+async function findPolicyByFullName(db, ownerId, fullName) {
+  const rows = await db.select({ policy: repos.policy }).from(repos).where(and5(eq7(repos.ownerId, ownerId), eq7(repos.fullName, fullName))).limit(1);
+  return rows[0]?.policy ?? null;
+}
 async function saveScan(db, id, scan) {
   await db.update(repos).set({
     manifests: scan.manifests,
@@ -4355,8 +4597,76 @@ var init_attribute = __esm({
   }
 });
 
+// src/ingestion/sources/osv.ts
+function installKey(name, version) {
+  return `${name}@${version}`;
+}
+async function queryVulnerableInstalls(installs, fetchImpl) {
+  const affected = /* @__PURE__ */ new Map();
+  if (installs.length === 0) return { affected, complete: true };
+  const unique = [...new Map(installs.map((i) => [installKey(i.name, i.version), i])).values()];
+  const batches = [];
+  for (let i = 0; i < unique.length; i += BATCH) batches.push(unique.slice(i, i + BATCH));
+  let complete = true;
+  let cursor = 0;
+  const worker = async () => {
+    for (let i = cursor++; i < batches.length; i = cursor++) {
+      const batch = batches[i];
+      try {
+        const { data } = await httpRequest(URL2, {
+          host: HOST7,
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            queries: batch.map((q) => ({
+              version: q.version,
+              package: { name: q.name, ecosystem: "npm" }
+            }))
+          }),
+          // Uncached on purpose. The shared cache keys on the URL, and every
+          // batch here posts to the same one with a different body — a cache hit
+          // would answer one tree's question with another tree's vulnerabilities.
+          ttlMs: 0,
+          // Best-effort by contract: the caller keeps its coarser answer when
+          // this fails, so exhausting the default retry ladder would only stall
+          // a scheduled scan behind an outage nobody is waiting on.
+          retries: 1,
+          fetchImpl
+        });
+        const results = data?.results ?? [];
+        if (results.length !== batch.length) {
+          complete = false;
+          continue;
+        }
+        results.forEach((result, j) => {
+          const ids = (result?.vulns ?? []).map((v) => v?.id).filter((id) => typeof id === "string");
+          if (ids.length === 0) return;
+          const q = batch[j];
+          affected.set(installKey(q.name, q.version), ids);
+        });
+      } catch {
+        complete = false;
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(CONCURRENCY, batches.length) }, worker));
+  return { affected, complete };
+}
+var HOST7, URL2, BATCH, CONCURRENCY;
+var init_osv = __esm({
+  "src/ingestion/sources/osv.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_http();
+    HOST7 = "api.osv.dev";
+    URL2 = `https://${HOST7}/v1/querybatch`;
+    BATCH = 250;
+    CONCURRENCY = 4;
+  }
+});
+
 // src/github/drift.ts
-import { inArray as inArray3 } from "drizzle-orm";
+import { inArray as inArray4, sql as sql7 } from "drizzle-orm";
 import semver2 from "semver";
 function declaredDeps(manifests) {
   const out = /* @__PURE__ */ new Map();
@@ -4383,7 +4693,7 @@ async function loadIndexed(db, names2) {
       latestVersion: packages.latestVersion,
       deprecated: packages.deprecated,
       advisories: packages.advisories
-    }).from(packages).where(inArray3(packages.name, names2.slice(i, i + NAME_CHUNK)));
+    }).from(packages).where(inArray4(packages.name, names2.slice(i, i + NAME_CHUNK)));
     for (const row of rows) {
       out.set(row.name, {
         latestVersion: row.latestVersion,
@@ -4397,7 +4707,7 @@ async function loadIndexed(db, names2) {
 async function loadVersions(db, names2) {
   const out = /* @__PURE__ */ new Map();
   for (let i = 0; i < names2.length; i += NAME_CHUNK) {
-    const rows = await db.select({ name: packageVersions.packageName, version: packageVersions.version }).from(packageVersions).where(inArray3(packageVersions.packageName, names2.slice(i, i + NAME_CHUNK)));
+    const rows = await db.select({ name: packageVersions.packageName, version: packageVersions.version }).from(packageVersions).where(inArray4(packageVersions.packageName, names2.slice(i, i + NAME_CHUNK)));
     for (const row of rows) {
       const list = out.get(row.name);
       if (list) list.push(row.version);
@@ -4447,19 +4757,28 @@ async function computeTransitiveDrift(db, resolved, directNames, truncated, edge
   };
   if (transitives.length === 0) return empty2;
   const indexed = await loadIndexed(db, [...new Set(transitives.map((d) => d.name))]);
+  const { affected, complete } = await queryVulnerableInstalls(
+    transitives.map((d) => ({ name: d.name, version: d.version }))
+  );
   const risks = [];
   let tracked = 0;
   for (const dep of transitives) {
     const row = indexed.get(dep.name);
     if (!row) continue;
     tracked++;
-    if (row.advisories === 0 && !row.deprecated) continue;
+    const vulnIds = affected.get(installKey(dep.name, dep.version)) ?? [];
+    if (row.advisories === 0 && !row.deprecated && vulnIds.length === 0) continue;
     risks.push({
       name: dep.name,
       version: dep.version,
       latest: row.latestVersion,
       advisories: row.advisories,
       deprecated: row.deprecated,
+      // Empty when OSV cleared this version, which is the actionable difference
+      // from `advisories`: the package has a history, this install does not.
+      // Undefined when the lookup could not complete — never an empty array,
+      // which would read as a clean bill of health nobody established.
+      vulnerabilities: complete ? vulnIds : void 0,
       pulledInBy: attribution.parentsOf.get(dep.name) ?? []
     });
   }
@@ -4470,6 +4789,10 @@ async function computeTransitiveDrift(db, resolved, directNames, truncated, edge
     resolved: transitives.length,
     tracked,
     advisoryPackages: risks.filter((r) => r.advisories > 0).length,
+    // The number that can actually be acted on: installs OSV matched to a
+    // vulnerability at their exact version. Undefined when the lookup did not
+    // complete, so "not checked" never renders as zero.
+    vulnerableInstalls: complete ? risks.filter((r) => r.vulnerabilities?.length).length : void 0,
     deprecated: risks.filter((r) => r.deprecated).length,
     risks: risks.slice(0, TRANSITIVE_DETAIL_CAP),
     truncated,
@@ -4481,6 +4804,29 @@ async function conflictsAtLatest(db, names2) {
   const { members } = await assembleMembers(db, names2);
   return resolveArchitectureCompat(members).slice(0, REPO_DRIFT_DETAIL_CAP);
 }
+async function conflictsAtCurrent(db, deps) {
+  const pinned = deps.filter((d) => Boolean(d.resolved));
+  if (pinned.length === 0) return [];
+  const rows = await db.select({
+    packageName: packageVersions.packageName,
+    version: packageVersions.version,
+    peerDependencies: packageVersions.peerDependencies,
+    engines: packageVersions.engines
+  }).from(packageVersions).where(
+    inArray4(
+      sql7`(${packageVersions.packageName}, ${packageVersions.version})`,
+      pinned.map((d) => sql7`(${d.name}, ${d.resolved})`)
+    )
+  );
+  const members = rows.map((r) => ({
+    name: r.packageName,
+    version: r.version,
+    peerDependencies: r.peerDependencies,
+    peerDependenciesMeta: null,
+    engines: r.engines
+  }));
+  return resolveArchitectureCompat(members).slice(0, REPO_DRIFT_DETAIL_CAP);
+}
 async function computeDrift(db, manifests, resolvedTree = null) {
   const declared = declaredDeps(manifests);
   const names2 = [...declared.keys()];
@@ -4502,7 +4848,8 @@ async function computeDrift(db, manifests, resolvedTree = null) {
       advisories: 0,
       deps: [],
       transitive,
-      conflictsAtLatest: []
+      conflictsAtLatest: [],
+      conflictsAtCurrent: []
     };
   }
   const [indexed, versions] = await Promise.all([
@@ -4516,7 +4863,10 @@ async function computeDrift(db, manifests, resolvedTree = null) {
     deps.push(depDrift(name, entry, row, versions.get(name) ?? []));
   }
   deps.sort((a, b) => severity(b) - severity(a) || a.name.localeCompare(b.name));
-  const conflicts = await conflictsAtLatest(db, deps.map((d) => d.name));
+  const [conflicts, currentConflicts] = await Promise.all([
+    conflictsAtLatest(db, deps.map((d) => d.name)),
+    conflictsAtCurrent(db, deps)
+  ]);
   return {
     depsDeclared: declared.size,
     depsTracked: deps.length,
@@ -4526,7 +4876,8 @@ async function computeDrift(db, manifests, resolvedTree = null) {
     advisories: deps.reduce((sum, d) => sum + d.advisories, 0),
     deps: deps.slice(0, REPO_DRIFT_DETAIL_CAP),
     transitive,
-    conflictsAtLatest: conflicts
+    conflictsAtLatest: conflicts,
+    conflictsAtCurrent: currentConflicts
   };
 }
 var NAME_CHUNK;
@@ -4537,6 +4888,7 @@ var init_drift = __esm({
     init_schema();
     init_types2();
     init_attribute();
+    init_osv();
     init_members();
     init_peerCompat();
     NAME_CHUNK = 500;
@@ -4637,6 +4989,82 @@ var init_errors = __esm({
   }
 });
 
+// src/core/runtimeTarget.ts
+function classifyRuntimeTarget(input) {
+  const override = OVERRIDES[input.name.toLowerCase()];
+  if (override) return override;
+  const peers = Object.keys(input.peerDependencies ?? {});
+  if (peers.some((p) => RENDERER_PEERS.has(p))) return "browser";
+  const keywords = input.keywords.map((k) => k.toLowerCase());
+  const server = keywords.filter((k) => SERVER_KEYWORDS.has(k)).length;
+  const browser = keywords.filter((k) => BROWSER_KEYWORDS.has(k)).length;
+  if (browser > server) return "browser";
+  if (server > browser) return "node";
+  if (input.hasBrowserField) return "browser";
+  if (input.engines?.node && !input.hasBrowserField && browser === 0) return "node";
+  return null;
+}
+var SERVER_KEYWORDS, BROWSER_KEYWORDS, RENDERER_PEERS, OVERRIDES;
+var init_runtimeTarget = __esm({
+  "src/core/runtimeTarget.ts"() {
+    "use strict";
+    init_esm_shims();
+    SERVER_KEYWORDS = /* @__PURE__ */ new Set([
+      "server",
+      "http-server",
+      "backend",
+      "middleware",
+      "rest",
+      "restful",
+      "api",
+      "router",
+      "routing",
+      "orm",
+      "database",
+      "sql",
+      "graphql-server",
+      "microservice",
+      "websocket",
+      "rpc"
+    ]);
+    BROWSER_KEYWORDS = /* @__PURE__ */ new Set([
+      "react",
+      "vue",
+      "svelte",
+      "angular",
+      "preact",
+      "solid",
+      "dom",
+      "browser",
+      "component",
+      "components",
+      "ui",
+      "css",
+      "styling",
+      "animation",
+      "frontend",
+      "client-side",
+      "jsx",
+      "hooks"
+    ]);
+    RENDERER_PEERS = /* @__PURE__ */ new Set(["react", "react-dom", "vue", "svelte", "@angular/core", "preact"]);
+    OVERRIDES = {
+      express: "node",
+      fastify: "node",
+      koa: "node",
+      hono: "node",
+      "@nestjs/core": "node",
+      "@hapi/hapi": "node",
+      // Meta-frameworks run in both places; they are the server in an architecture
+      // diagram, which is the question this answers.
+      next: "node",
+      nuxt: "node",
+      "@remix-run/node": "node",
+      astro: "node"
+    };
+  }
+});
+
 // src/pipeline/mineEdges.ts
 function trackedPairs(nodes, tracked) {
   const t = nodes.filter((n) => tracked.has(n.name));
@@ -4717,6 +5145,13 @@ function assemblePackageRow(p) {
     peerDependencies: r?.peerDependencies ?? null,
     peerDependenciesMeta: r?.peerDependenciesMeta ?? null,
     engines: r?.engines ?? null,
+    runtimeTarget: r ? classifyRuntimeTarget({
+      name: p.name,
+      hasBrowserField: r.hasBrowserField,
+      keywords: r.keywords,
+      engines: r.engines,
+      peerDependencies: r.peerDependencies
+    }) : null,
     healthScore: p.healthScore,
     qualityScore: p.qualityScore,
     confidence: p.confidence,
@@ -4737,6 +5172,7 @@ var init_sync = __esm({
     init_errors();
     init_http();
     init_logger();
+    init_runtimeTarget();
     init_collect();
     init_npmDownloads();
     init_summarize();
@@ -4810,7 +5246,7 @@ var init_ingestQueue = __esm({
 });
 
 // src/pipeline/single.ts
-import { and as and6, eq as eq8, isNotNull as isNotNull3, sql as sql6 } from "drizzle-orm";
+import { and as and6, eq as eq8, isNotNull as isNotNull3, sql as sql8 } from "drizzle-orm";
 function raceTimeout(p, ms) {
   let timer;
   return Promise.race([
@@ -4826,7 +5262,7 @@ async function getSeedCategory(db, name) {
 }
 async function getCategoryMedianBundle(db, category) {
   const [row] = await db.select({
-    m: sql6`percentile_cont(0.5) within group (order by ${packages.bundleMinGzipKb})`
+    m: sql8`percentile_cont(0.5) within group (order by ${packages.bundleMinGzipKb})`
   }).from(packages).where(and6(eq8(packages.category, category), isNotNull3(packages.bundleMinGzipKb)));
   return row?.m ?? null;
 }
@@ -4858,12 +5294,14 @@ async function syncOnePackage(db, name, opts = {}) {
   const input = toScoringInput(signals, category);
   const median2 = category ? await getCategoryMedianBundle(db, category) : null;
   const quality = computeQuality(input);
+  const evidence = await getFieldEvidence(db, [name]);
   const breakdown = {
     maintenance: computeMaintenance(input, now),
     adoption: computeAdoption(input),
     reliability: computeReliability(input),
     efficiency: computeEfficiency(input.bundleMinGzipKb, category, median2),
-    quality
+    quality,
+    field: computeFieldScore(evidence.get(name) ?? null)
   };
   const healthScore = computeHealthScore(breakdown);
   const confidence = computeConfidence(input, now, quality);
@@ -4933,6 +5371,7 @@ var init_single = __esm({
     init_categoryInference();
     init_scoring();
     init_embeddings();
+    init_outcomes();
     init_packages();
     init_schema();
     init_alerts2();
@@ -4944,7 +5383,7 @@ var init_single = __esm({
 });
 
 // src/search/recommend.ts
-import { and as and7, cosineDistance, eq as eq9, inArray as inArray4, isNotNull as isNotNull4, lte, sql as sql7 } from "drizzle-orm";
+import { and as and7, cosineDistance, eq as eq9, inArray as inArray5, isNotNull as isNotNull4, lte, sql as sql9 } from "drizzle-orm";
 async function recommend(db, opts, provider = createEmbeddingProvider()) {
   const limit = Math.min(Math.max(opts.limit ?? 3, 1), 5);
   const [queryVec] = await provider.embed([opts.need]);
@@ -4997,7 +5436,7 @@ function buildConditions(constraints, category) {
     const allowed = ["proven", "emerging", "promising", "unproven"].filter(
       (c) => CONFIDENCE_RANK[c] >= CONFIDENCE_RANK[constraints.minConfidence]
     );
-    conditions.push(inArray4(packages.confidence, allowed));
+    conditions.push(inArray5(packages.confidence, allowed));
   }
   return conditions;
 }
@@ -5011,10 +5450,10 @@ async function runVectorQuery(db, queryVec, providerId, constraints, category, p
   return db.select(ROW_COLUMNS).from(packages).where(and7(...conditions)).orderBy(distance).limit(pool);
 }
 async function runLexicalQuery(db, need, constraints, category, pool) {
-  const tsquery = sql7`websearch_to_tsquery('english', ${need})`;
-  const rank2 = sql7`ts_rank(${packages.searchVector}, ${tsquery})`;
-  const conditions = [sql7`${packages.searchVector} @@ ${tsquery}`, ...buildConditions(constraints, category)];
-  return db.select(ROW_COLUMNS).from(packages).where(and7(...conditions)).orderBy(sql7`${rank2} desc`).limit(pool);
+  const tsquery = sql9`websearch_to_tsquery('english', ${need})`;
+  const rank2 = sql9`ts_rank(${packages.searchVector}, ${tsquery})`;
+  const conditions = [sql9`${packages.searchVector} @@ ${tsquery}`, ...buildConditions(constraints, category)];
+  return db.select(ROW_COLUMNS).from(packages).where(and7(...conditions)).orderBy(sql9`${rank2} desc`).limit(pool);
 }
 function toCandidate(row) {
   return {
@@ -5152,7 +5591,7 @@ var init_types3 = __esm({
 });
 
 // src/db/selectionPolicy.ts
-import { eq as eq10, inArray as inArray5 } from "drizzle-orm";
+import { eq as eq10, inArray as inArray6 } from "drizzle-orm";
 async function getSelectionPolicy(db, ownerId) {
   if (!ownerId) return DEFAULT_SELECTION_POLICY;
   const [row] = await db.select({ policy: selectionPolicies.policy }).from(selectionPolicies).where(eq10(selectionPolicies.ownerId, ownerId)).limit(1);
@@ -5171,7 +5610,7 @@ async function loadPolicyFacts(db, names2) {
     name: packages.name,
     license: packages.license,
     deprecated: packages.deprecated
-  }).from(packages).where(inArray5(packages.name, names2));
+  }).from(packages).where(inArray6(packages.name, names2));
   for (const row of rows) {
     out.set(row.name, { license: row.license, deprecated: row.deprecated });
   }
@@ -5488,7 +5927,7 @@ __export(handlers_exports, {
   rowToEvaluate: () => rowToEvaluate
 });
 import { createHash as createHash3 } from "crypto";
-import { sql as sql8 } from "drizzle-orm";
+import { sql as sql10 } from "drizzle-orm";
 function isStale(dataAsOf) {
   if (!dataAsOf) return true;
   return Date.now() - dataAsOf.getTime() > STALENESS_DAYS * DAY_MS2;
@@ -5504,7 +5943,7 @@ function topAdvisories(advisories, max = 5) {
   if (!advisories?.length) return [];
   return [...advisories].sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity]).slice(0, max);
 }
-function rowToEvaluate(row) {
+function rowToEvaluate(row, learned) {
   const breakdown = row.scoreBreakdown ?? {
     maintenance: 0,
     adoption: 0,
@@ -5533,11 +5972,11 @@ function rowToEvaluate(row) {
     summary: row.summary ? truncateSentences(row.summary, 3) : null,
     usageGuide: row.usageGuide ?? null,
     repoUrl: row.repoUrl,
-    replacedBy: lookupSuccessor(row.name)
+    replacedBy: lookupSuccessor(row.name, learned)
   };
 }
 async function latestDataAsOf(db) {
-  const [row] = await db.select({ m: sql8`max(${packages.dataAsOf})` }).from(packages);
+  const [row] = await db.select({ m: sql10`max(${packages.dataAsOf})` }).from(packages);
   return new Date(row?.m ?? Date.now()).toISOString();
 }
 function cacheKey(parts) {
@@ -5580,7 +6019,8 @@ async function handleEvaluate(db, input, ownerId = null) {
           suggestion: existsOnNpm ? `\u{1F389} Congrats, you're the first to add "${input.package}" to lurq's registry! It's being fetched and scored now; retry in a few seconds for the full evidence read.` : `"${input.package}" was not found on the npm registry. Check the package name.`
         };
       }
-      const evaluated2 = rowToEvaluate(row);
+      const learned = row.deprecated || row.archived ? await loadLearnedSuccessors(db) : void 0;
+      const evaluated2 = rowToEvaluate(row, learned);
       const verification = await getLatestVerificationByName(db, row.name);
       return verification ? { ...evaluated2, buildVerified: toBuildVerified(verification) } : evaluated2;
     },
@@ -5607,7 +6047,7 @@ async function handleCompare(db, input, ownerId = null) {
       const results = await Promise.all(
         input.packages.map((name) => getOrFetchPackage(db, name, { requestedByOwnerId: ownerId }))
       );
-      const rows = results.map((r) => r.row).filter((row) => row !== null).map(rowToEvaluate).sort((a, b) => b.healthScore - a.healthScore);
+      const rows = results.map((r) => r.row).filter((row) => row !== null).map((row) => rowToEvaluate(row)).sort((a, b) => b.healthScore - a.healthScore);
       const missing = input.packages.filter((name) => !rows.some((r) => r.name === name));
       return {
         dataAsOf: await latestDataAsOf(db),
@@ -5892,7 +6332,8 @@ function parseRpcBody(raw) {
   }
 }
 function fetchUpgradePlan(deps, opts = {}) {
-  return post("/upgrade-plan", { deps }, opts);
+  const body = opts.repo ? { deps, repo: opts.repo } : { deps };
+  return post("/upgrade-plan", body, opts);
 }
 var RemoteError;
 var init_remote = __esm({
@@ -5987,10 +6428,10 @@ var init_optimize = __esm({
 });
 
 // src/mcp/diagram.ts
-import { inArray as inArray6 } from "drizzle-orm";
+import { inArray as inArray7 } from "drizzle-orm";
 function layerFor(item) {
   if (!item.category) return UNCLASSIFIED;
-  if (item.category === "framework" && BACKEND_FRAMEWORKS.has(item.label)) return "Backend";
+  if (item.category === "framework" && item.runtimeTarget === "node") return "Backend";
   return LAYER_OF[item.category] ?? UNCLASSIFIED;
 }
 function nodeId(label, i) {
@@ -6040,22 +6481,41 @@ async function handleDiagram(db, input) {
       note: "Provide a `stack` of package names to diagram. lurq labels a stack you choose; it does not infer an architecture from a description."
     };
   }
-  const rows = await db.select({ name: packages.name, category: packages.category }).from(packages).where(inArray6(packages.name, input.stack));
-  const known = new Map(rows.map((r) => [r.name, r.category]));
-  const items = input.stack.map((name) => ({
-    label: name,
-    category: known.get(name) ?? inferCategory(name)
-  }));
+  const rows = await db.select({
+    name: packages.name,
+    category: packages.category,
+    runtimeTarget: packages.runtimeTarget
+  }).from(packages).where(inArray7(packages.name, input.stack));
+  const known = new Map(rows.map((r) => [r.name, r]));
+  const items = input.stack.map((name) => {
+    const row = known.get(name);
+    return {
+      label: name,
+      category: row?.category ?? inferCategory(name),
+      // Fall back to the name-only classifier for a package that predates the
+      // column or is not indexed at all: the curated overrides still resolve the
+      // frameworks people actually diagram, and an unclassifiable one keeps the
+      // old Presentation default rather than moving on a null.
+      runtimeTarget: row?.runtimeTarget ?? classifyRuntimeTarget({
+        name,
+        hasBrowserField: false,
+        keywords: [],
+        engines: null,
+        peerDependencies: null
+      })
+    };
+  });
   const unclassified = items.filter((i) => layerFor(i) === UNCLASSIFIED).map((i) => i.label);
   const note = unclassified.length ? `Reference pattern derived from the provided stack: partial, not authoritative. Could not place ${unclassified.length} package(s): ${unclassified.join(", ")} (not in lurq's index and no category match), shown under Unclassified, outside the flow.` : "Reference pattern derived from the provided stack. A labeled starting point, not a validated architecture.";
   return { mermaid: buildMermaid(items), note };
 }
-var UNCLASSIFIED, LAYER_OF, FLOW_LAYERS, BACKEND_FRAMEWORKS;
+var UNCLASSIFIED, LAYER_OF, FLOW_LAYERS;
 var init_diagram = __esm({
   "src/mcp/diagram.ts"() {
     "use strict";
     init_esm_shims();
     init_categoryInference();
+    init_runtimeTarget();
     init_schema();
     UNCLASSIFIED = "Unclassified";
     LAYER_OF = {
@@ -6083,14 +6543,6 @@ var init_diagram = __esm({
       testing: "Tooling"
     };
     FLOW_LAYERS = ["Presentation", "Client Logic", "Backend", "Data"];
-    BACKEND_FRAMEWORKS = /* @__PURE__ */ new Set([
-      "express",
-      "fastify",
-      "koa",
-      "hono",
-      "@nestjs/core",
-      "@hapi/hapi"
-    ]);
   }
 });
 
@@ -6105,7 +6557,7 @@ __export(plan_exports, {
   resolvePins: () => resolvePins
 });
 import { createHash as createHash4 } from "crypto";
-import { inArray as inArray7 } from "drizzle-orm";
+import { inArray as inArray8 } from "drizzle-orm";
 function packageToCandidate(row) {
   return {
     name: row.name,
@@ -6326,7 +6778,7 @@ function orderCandidates(cands, anchorFamily, optimize, bundleByName) {
 async function bundleSizes(db, candidates) {
   const names2 = [...new Set(candidates.map((c) => c.name))];
   if (names2.length === 0) return /* @__PURE__ */ new Map();
-  const rows = await db.select({ name: packages.name, bundle: packages.bundleMinGzipKb }).from(packages).where(inArray7(packages.name, names2));
+  const rows = await db.select({ name: packages.name, bundle: packages.bundleMinGzipKb }).from(packages).where(inArray8(packages.name, names2));
   return new Map(rows.filter((r) => r.bundle != null).map((r) => [r.name, r.bundle]));
 }
 async function decompose(document) {
@@ -7880,6 +8332,10 @@ var init_app = __esm({
 });
 
 // src/github/workflow.ts
+function cliSpec(version = VERSION) {
+  const [major = "0", minor = "0"] = version.split(".");
+  return major === "0" ? `${PACKAGE_NAME}@${major}.${minor}` : `${PACKAGE_NAME}@${major}`;
+}
 function detectInstallCommand(lockfiles) {
   if (lockfiles.includes("pnpm-lock.yaml")) return "pnpm install --frozen-lockfile";
   if (lockfiles.includes("yarn.lock")) return "yarn install --frozen-lockfile";
@@ -7892,6 +8348,8 @@ function renderWorkflow(opts = {}) {
   const install = opts.installCommand ?? "npm ci";
   const max = opts.maxUpgrades ?? 3;
   const mode = opts.armed ? "pr" : "comment";
+  const autoMerge = opts.autoMerge ?? false;
+  const cli = cliSpec();
   return `# Managed by lurq, https://lurq.run
 #
 # Keeps this repository's dependencies current and rewrites the call sites an
@@ -7939,19 +8397,19 @@ jobs:
       - name: Plan
         env:
           LURQ_API_KEY: \${{ secrets.LURQ_API_KEY }}
-        run: npx -y lurqrun upgrade-plan . --json > lurq-plan.json
+        run: npx -y ${cli} upgrade-plan . --json > lurq-plan.json
 
       # 2. Narrow that to symbols THIS repo references. Runs entirely locally
       #    against both versions' npm tarballs, no API key, no test suite.
       - name: Check against this codebase
-        run: npx -y lurqrun check-upgrade . --plan lurq-plan.json --json > lurq-brief.json
+        run: npx -y ${cli} check-upgrade . --plan lurq-plan.json --json > lurq-brief.json
 
       # The same report twice: once into the run summary, once as the body of
       # the pull request. Fenced, because the report is aligned plain text and
       # markdown would otherwise collapse its indentation into one paragraph.
       - name: Summarise
         run: |
-          npx -y lurqrun check-upgrade . --plan lurq-plan.json > lurq-report.txt
+          npx -y ${cli} check-upgrade . --plan lurq-plan.json > lurq-report.txt
           { echo '\`\`\`'; cat lurq-report.txt; echo '\`\`\`'; } > lurq-report.md
           cat lurq-report.md >> "\${GITHUB_STEP_SUMMARY}"
 
@@ -8027,6 +8485,7 @@ jobs:
 
       # 4. The workflow does version control, never the model.
       - name: Open pull request
+        id: pr
         if: env.LURQ_MODE == 'pr'
         uses: peter-evans/create-pull-request@v7
         with:
@@ -8039,19 +8498,30 @@ jobs:
           body-path: lurq-report.md
           labels: dependencies
           delete-branch: true
-`;
+${autoMerge ? MERGE_STEP : ""}`;
 }
 function newFileUrl(fullName, branch, content) {
   const params = new URLSearchParams({ filename: WORKFLOW_PATH, value: content });
   return `https://github.com/${fullName}/new/${encodeURIComponent(branch)}?${params.toString()}`;
 }
-var WORKFLOW_PATH, DEFAULT_CRON;
+var WORKFLOW_PATH, DEFAULT_CRON, MERGE_STEP;
 var init_workflow = __esm({
   "src/github/workflow.ts"() {
     "use strict";
     init_esm_shims();
+    init_constants();
     WORKFLOW_PATH = ".github/workflows/lurq-upgrade.yml";
     DEFAULT_CRON = "0 6 * * 1";
+    MERGE_STEP = `
+      # 5. Auto-merge, per this repository's lurq policy. GitHub merges only
+      #    once the repo's OWN required checks pass; lurq never makes that call.
+      #    Requires "Allow auto-merge" in repository settings.
+      - name: Enable auto-merge
+        if: env.LURQ_MODE == 'pr' && steps.pr.outputs.pull-request-number
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: gh pr merge --auto --squash "\${{ steps.pr.outputs.pull-request-number }}"
+`;
   }
 });
 
@@ -8148,6 +8618,7 @@ var init_manifests = __esm({
 var upgradePlan_exports = {};
 __export(upgradePlan_exports, {
   buildUpgradePlan: () => buildUpgradePlan,
+  detectRepoFullName: () => detectRepoFullName,
   findManifests: () => findManifests,
   formatUpgradePlan: () => formatUpgradePlan,
   mergedDeps: () => mergedDeps,
@@ -8201,27 +8672,38 @@ function mergedDeps(manifests) {
   }
   return out;
 }
+function detectRepoFullName(explicit) {
+  const value = explicit ?? process.env.GITHUB_REPOSITORY ?? null;
+  return value && /^[\w.-]+\/[\w.-]+$/.test(value) ? value : null;
+}
 async function buildUpgradePlan(dir, opts = {}) {
   const manifests = readManifests(dir);
   const deps = mergedDeps(manifests);
   if (Object.keys(deps).length === 0) {
     throw new Error(`No package.json with dependencies found under ${dir}`);
   }
-  const plan = await fetchUpgradePlan(deps, opts);
+  const plan = await fetchUpgradePlan(deps, { ...opts, repo: detectRepoFullName(opts.repo) });
   return { ...plan, manifests: manifests.length, deps: Object.keys(deps).length };
 }
 function formatUpgradePlan(plan) {
   const out = [
-    `lurq upgrade plan (${plan.deps} dependencies across ${plan.manifests} manifest(s))`,
-    ""
+    `lurq upgrade plan (${plan.deps} dependencies across ${plan.manifests} manifest(s))`
   ];
+  if (plan.scopeSource === "repo-policy") {
+    out.push(
+      `policy: scope=${plan.scope}` + (plan.outOfScope ? `, ${plan.outOfScope} upgrade(s) held back` : ", nothing held back")
+    );
+  }
+  out.push("");
   if (plan.upgrades.length === 0) {
     out.push("Everything lurq tracks is already on its latest release.");
   }
   for (const upgrade of plan.upgrades) {
+    const held = upgrade.inScope === false ? "  [HELD]" : "";
     out.push(
-      `${VERDICT_LABEL[upgrade.verdict]}  ${upgrade.package}  ${upgrade.fromVersion} \u2192 ${upgrade.toVersion}` + (upgrade.advisories ? `  (${upgrade.advisories} advisory)` : "")
+      `${VERDICT_LABEL[upgrade.verdict]}  ${upgrade.package}  ${upgrade.fromVersion} \u2192 ${upgrade.toVersion}` + (upgrade.advisories ? `  (${upgrade.advisories} advisory)` : "") + held
     );
+    if (upgrade.scopeReason) out.push(`  held: ${upgrade.scopeReason}`);
     if (upgrade.removed.length) {
       out.push(`  removes ${upgrade.removed.length}: ${upgrade.removed.slice(0, 8).join(", ")}`);
     }
@@ -9367,7 +9849,7 @@ function targetsFromPlanFile(path2) {
   if (!Array.isArray(parsed.upgrades)) {
     throw new Error(`${path2} is not an upgrade plan (no "upgrades" array)`);
   }
-  return parsed.upgrades.filter((u) => u.package && u.fromVersion && u.toVersion).map((u) => ({ package: u.package, fromVersion: u.fromVersion, toVersion: u.toVersion }));
+  return parsed.upgrades.filter((u) => u.package && u.fromVersion && u.toVersion).filter((u) => u.inScope !== false).map((u) => ({ package: u.package, fromVersion: u.fromVersion, toVersion: u.toVersion }));
 }
 async function runCheckUpgrade(dir, opts) {
   const { scanReferences: scanReferences2 } = await Promise.resolve().then(() => (init_references(), references_exports));
@@ -9422,7 +9904,7 @@ var init_graph = __esm({
 });
 
 // src/db/surface.ts
-import { and as and9, desc as desc5, eq as eq13, sql as sql9 } from "drizzle-orm";
+import { and as and9, desc as desc5, eq as eq13, sql as sql11 } from "drizzle-orm";
 function surfaceRef(pkg, version) {
   return { kind: "package_surface", namespace: "npm", name: pkg, version };
 }
@@ -9705,22 +10187,22 @@ var init_toolDescriptions = __esm({
 });
 
 // src/db/usage.ts
-import { and as and11, desc as desc7, eq as eq15, gte, sql as sql10 } from "drizzle-orm";
+import { and as and11, desc as desc7, eq as eq15, gte, sql as sql12 } from "drizzle-orm";
 function windowStart(days) {
-  return sql10`CURRENT_DATE - (${days}::int - 1)`;
+  return sql12`CURRENT_DATE - (${days}::int - 1)`;
 }
 async function recordUsage(db, ownerId, tool) {
   if (!ownerId) return;
   try {
-    await db.insert(ownerUsageDaily).values({ ownerId, date: sql10`CURRENT_DATE`, tool, count: 1 }).onConflictDoUpdate({
+    await db.insert(ownerUsageDaily).values({ ownerId, date: sql12`CURRENT_DATE`, tool, count: 1 }).onConflictDoUpdate({
       target: [ownerUsageDaily.ownerId, ownerUsageDaily.date, ownerUsageDaily.tool],
-      set: { count: sql10`${ownerUsageDaily.count} + 1` }
+      set: { count: sql12`${ownerUsageDaily.count} + 1` }
     });
   } catch {
   }
 }
 async function getUsageSummary(db, ownerId, days) {
-  const rows = await db.execute(sql10`
+  const rows = await db.execute(sql12`
     select
       to_char(d, 'YYYY-MM-DD') as date,
       coalesce(sum(u.count), 0)::int as count
@@ -9737,13 +10219,13 @@ async function getUsageSummary(db, ownerId, days) {
 async function getUsageByTool(db, ownerId, days) {
   const rows = await db.select({
     tool: ownerUsageDaily.tool,
-    count: sql10`sum(${ownerUsageDaily.count})::int`
+    count: sql12`sum(${ownerUsageDaily.count})::int`
   }).from(ownerUsageDaily).where(
     and11(
       eq15(ownerUsageDaily.ownerId, ownerId),
       gte(ownerUsageDaily.date, windowStart(days))
     )
-  ).groupBy(ownerUsageDaily.tool).orderBy(desc7(sql10`sum(${ownerUsageDaily.count})`));
+  ).groupBy(ownerUsageDaily.tool).orderBy(desc7(sql12`sum(${ownerUsageDaily.count})`));
   return rows.map((r) => ({ tool: r.tool, count: Number(r.count) }));
 }
 var init_usage = __esm({
@@ -10264,6 +10746,52 @@ var init_brief = __esm({
   }
 });
 
+// src/github/scope.ts
+function isUnassessed(u) {
+  return u.verdict === "unknown";
+}
+function breaksSomething(u) {
+  return u.verdict === "removes-exports" || u.verdict === "arity-changed";
+}
+function scopeVerdict(u, scope) {
+  if (scope === "all") return { inScope: true };
+  if (u.advisories > 0) return { inScope: true };
+  if (scope === "security") {
+    return { inScope: false, reason: "no advisory \u2014 scope is security-only" };
+  }
+  if (isUnassessed(u)) {
+    return { inScope: false, reason: "surface not yet analysed \u2014 nothing for the agent to rewrite" };
+  }
+  if (breaksSomething(u)) return { inScope: true };
+  return { inScope: false, reason: "nothing referenced breaks \u2014 scope is security + blocking" };
+}
+function applyScope(upgrades, policy) {
+  if (!policy) {
+    return {
+      upgrades: upgrades.map((u) => ({ ...u, inScope: true })),
+      scope: "all",
+      scopeSource: "unconnected",
+      outOfScope: 0
+    };
+  }
+  const scoped = upgrades.map((u) => {
+    const verdict = scopeVerdict(u, policy.scope);
+    return verdict.inScope ? { ...u, inScope: true } : { ...u, inScope: false, scopeReason: verdict.reason };
+  });
+  return {
+    upgrades: scoped,
+    scope: policy.scope,
+    scopeSource: "repo-policy",
+    outOfScope: scoped.filter((u) => !u.inScope).length
+  };
+}
+var init_scope = __esm({
+  "src/github/scope.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/github/runs.ts
 function str2(value, max) {
   if (typeof value !== "string") return null;
@@ -10280,7 +10808,7 @@ function strList(value, maxItems, maxLen) {
   }
   return out;
 }
-function count(value) {
+function count2(value) {
   const n = typeof value === "number" ? value : Number(value);
   return Number.isInteger(n) && n >= 0 && n < 1e6 ? n : null;
 }
@@ -10304,9 +10832,9 @@ function parseUpgradeRun(input) {
     severity: severity2,
     status,
     symbolsAffected: strList(raw.symbolsAffected, MAX_SYMBOLS, MAX_NAME),
-    callSites: count(raw.callSites) ?? 0,
+    callSites: count2(raw.callSites) ?? 0,
     callSiteFiles: files,
-    filesChanged: count(raw.filesChanged),
+    filesChanged: count2(raw.filesChanged),
     testsPassed: typeof raw.testsPassed === "boolean" ? raw.testsPassed : null,
     prUrl: str2(raw.prUrl, MAX_URL),
     // Empty string, not null: it is part of the dedup key (see schema).
@@ -10324,6 +10852,11 @@ function parseUpgradeRuns(input, max) {
   }
   return { runs, rejected };
 }
+function parseRepoFullName(input) {
+  const value = str2(input, MAX_NAME * 2);
+  if (!value) return null;
+  return /^[\w.-]+\/[\w.-]+$/.test(value) ? value : null;
+}
 function parseDepsInput(input) {
   if (!input || typeof input !== "object") return {};
   const out = {};
@@ -10351,7 +10884,7 @@ var init_runs = __esm({
 });
 
 // src/db/upgradeRuns.ts
-import { and as and13, desc as desc9, eq as eq17, gte as gte2, sql as sql11 } from "drizzle-orm";
+import { and as and13, desc as desc9, eq as eq17, gte as gte2, sql as sql13 } from "drizzle-orm";
 async function recordUpgradeRuns(db, rows) {
   if (rows.length === 0) return 0;
   await db.insert(upgradeRuns).values(rows).onConflictDoUpdate({
@@ -10363,15 +10896,15 @@ async function recordUpgradeRuns(db, rows) {
       upgradeRuns.runUrl
     ],
     set: {
-      severity: sql11`excluded.severity`,
-      status: sql11`excluded.status`,
-      symbolsAffected: sql11`excluded.symbols_affected`,
-      callSites: sql11`excluded.call_sites`,
-      callSiteFiles: sql11`excluded.call_site_files`,
-      filesChanged: sql11`excluded.files_changed`,
-      testsPassed: sql11`excluded.tests_passed`,
-      prUrl: sql11`excluded.pr_url`,
-      repoId: sql11`excluded.repo_id`
+      severity: sql13`excluded.severity`,
+      status: sql13`excluded.status`,
+      symbolsAffected: sql13`excluded.symbols_affected`,
+      callSites: sql13`excluded.call_sites`,
+      callSiteFiles: sql13`excluded.call_site_files`,
+      filesChanged: sql13`excluded.files_changed`,
+      testsPassed: sql13`excluded.tests_passed`,
+      prUrl: sql13`excluded.pr_url`,
+      repoId: sql13`excluded.repo_id`
     }
   });
   return rows.length;
@@ -10386,12 +10919,12 @@ async function listRunsForRepo(db, ownerId, repoId, limit = 50) {
 async function getUpgradeImpact(db, ownerId, days = 30) {
   const since = new Date(Date.now() - days * 864e5);
   const rows = await db.select({
-    analysed: sql11`count(*)::int`,
-    blocking: sql11`count(*) filter (where ${upgradeRuns.severity} = 'blocking')::int`,
-    callSites: sql11`coalesce(sum(${upgradeRuns.callSites}) filter (where ${upgradeRuns.severity} = 'blocking'), 0)::int`,
-    prsOpened: sql11`count(*) filter (where ${upgradeRuns.status} in ('pr_open','merged'))::int`,
-    merged: sql11`count(*) filter (where ${upgradeRuns.status} = 'merged')::int`,
-    unverified: sql11`count(*) filter (where ${upgradeRuns.severity} = 'unverified')::int`
+    analysed: sql13`count(*)::int`,
+    blocking: sql13`count(*) filter (where ${upgradeRuns.severity} = 'blocking')::int`,
+    callSites: sql13`coalesce(sum(${upgradeRuns.callSites}) filter (where ${upgradeRuns.severity} = 'blocking'), 0)::int`,
+    prsOpened: sql13`count(*) filter (where ${upgradeRuns.status} in ('pr_open','merged'))::int`,
+    merged: sql13`count(*) filter (where ${upgradeRuns.status} = 'merged')::int`,
+    unverified: sql13`count(*) filter (where ${upgradeRuns.severity} = 'unverified')::int`
   }).from(upgradeRuns).where(and13(eq17(upgradeRuns.ownerId, ownerId), gte2(upgradeRuns.createdAt, since)));
   return rows[0] ?? {
     analysed: 0,
@@ -10946,7 +11479,8 @@ async function startHttpServer(opts = {}) {
       const runs = await listRunsForRepo(db, ownerId, row.id);
       const workflow = renderWorkflow({
         installCommand: row.installCommand ?? void 0,
-        armed: row.policy.enabled
+        armed: row.policy.enabled,
+        autoMerge: row.policy.autoMerge
       });
       res.status(200).json({
         repo: {
@@ -11076,8 +11610,13 @@ async function startHttpServer(opts = {}) {
     try {
       const drift = await computeDrift(db, [{ path: "package.json", deps }]);
       const brief = await briefRepo(db, drift);
+      const ownerId = req.lurqKey?.ownerId ?? null;
+      const repoFullName = parseRepoFullName((req.body ?? {}).repo);
+      const policy = ownerId && repoFullName ? await findPolicyByFullName(db, ownerId, repoFullName) : null;
+      const scoped = applyScope(brief.upgrades, policy);
       res.status(200).json({
         ...brief,
+        ...scoped,
         // Surfaced so CI can log what lurq had no opinion on. An upgrade we do
         // not know about must not look like an upgrade we cleared.
         untracked: Object.keys(deps).length - drift.depsTracked
@@ -11158,6 +11697,7 @@ var init_http2 = __esm({
     init_app();
     init_brief();
     init_drift();
+    init_scope();
     init_runs();
     init_upgradeRuns();
     init_manifests();
@@ -11249,9 +11789,9 @@ function buildProgram() {
     const { runPlan: runPlan2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     await runPlan2(file, opts);
   });
-  program.command("upgrade-plan").argument("[dir]", "project directory (default: current)", ".").description("what is behind in this project, and what each upgrade removes from its API").option("--json", "output the plan as JSON (feed to `check-upgrade --plan`)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").action(async (dir, opts) => {
+  program.command("upgrade-plan").argument("[dir]", "project directory (default: current)", ".").description("what is behind in this project, and what each upgrade removes from its API").option("--json", "output the plan as JSON (feed to `check-upgrade --plan`)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").option("--repo <owner/name>", "apply this repo's policy (defaults to $GITHUB_REPOSITORY)").action(async (dir, opts) => {
     const { buildUpgradePlan: buildUpgradePlan2, formatUpgradePlan: formatUpgradePlan2 } = await Promise.resolve().then(() => (init_upgradePlan(), upgradePlan_exports));
-    const plan = await buildUpgradePlan2(dir, { url: opts.url, apiKey: opts.apiKey });
+    const plan = await buildUpgradePlan2(dir, { url: opts.url, apiKey: opts.apiKey, repo: opts.repo });
     console.log(opts.json ? JSON.stringify(plan, null, 2) : formatUpgradePlan2(plan));
   });
   program.command("check-upgrade").argument("[dir]", "project directory to scan (default: current)", ".").description("do these upgrades remove symbols your code actually references?").option("--plan <file>", "targets from `upgrade-plan --json`").option("--upgrade <spec...>", "pkg@from..to (repeatable), e.g. commander@11.1.0..12.1.0").option("--json", "output the report as JSON").option("--exit-code", "exit 1 when the report is not safe (for CI)").action(