lurqrun 0.1.0 → 0.1.1

package/dist/bin/lurq.js

@@ -24,10 +24,10 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "lurqrun",
-      version: "0.1.0",
+      version: "0.1.1",
       description: "A continuously-updated, evidence-scored index of JS/TS frameworks and libraries, exposed as an MCP server, CLI, and agent skill \u2014 so AI coding assistants get fresh, objective dependency recommendations.",
       type: "module",
-      license: "Apache-2.0",
+      license: "MIT",
       author: "jadenryu",
       repository: {
         type: "git",
@@ -81,7 +81,8 @@ var init_package = __esm({
         operator: "tsx src/bin/operator.ts",
         "operator:prod": "LURQ_ENV_FILE=.env.production tsx src/bin/operator.ts",
         prepublishOnly: "npm test && npm run build",
-        "content:drift": "tsx scripts/gen-drift.ts"
+        "content:drift": "tsx scripts/gen-drift.ts",
+        "content:landing": "tsx scripts/build-landing-content.mts"
       },
       dependencies: {
         "@inquirer/prompts": "^8.5.2",
@@ -96,8 +97,10 @@ var init_package = __esm({
         postgres: "^3.4.9",
         "rate-limit-redis": "^4.3.1",
         semver: "^7.8.5",
+        stripe: "^22.6.0",
         typescript: "^5.5.4",
         "update-notifier": "^7.3.1",
+        yaml: "^2.9.0",
         zod: "^3.23.8"
       },
       devDependencies: {
@@ -1013,10 +1016,10 @@ ${issues}`);
 }
 function requireConfig(keys) {
   const config = getConfig();
-  const missing = keys.filter((k) => config[k] === void 0 || config[k] === "");
-  if (missing.length > 0) {
+  const missing2 = keys.filter((k) => config[k] === void 0 || config[k] === "");
+  if (missing2.length > 0) {
     throw new ConfigError(
-      `Missing required environment variable(s): ${missing.join(", ")}.
+      `Missing required environment variable(s): ${missing2.join(", ")}.
 See .env.example for setup. Tip: copy it to .env and fill in the values.`
     );
   }
@@ -1048,8 +1051,14 @@ var init_config = __esm({
        *  This is the rotation rate for everything discovery ingested: index size /
        *  this = days to come all the way around. Raise it if the sync finishes well
        *  inside the cron window; lower it if npm starts rate-limiting. 0 disables
-       *  the rotation (seeds only, the pre-rotation behaviour). */
-      LURQ_SYNC_REFRESH_CAP: z.coerce.number().int().min(0).max(5e3).default(400),
+       *  the rotation (seeds only, the pre-rotation behaviour).
+       *
+       *  It is also the discovery frontier's clock, which is why it is not a small
+       *  number. `graphChannel` re-expands a package only when its `latest_version`
+       *  moves, and nothing observes a version move except this rotation — so at 400
+       *  against a 20.8k index the graph channel could only re-arm on a 52-day lag
+       *  and had gone effectively silent. */
+      LURQ_SYNC_REFRESH_CAP: z.coerce.number().int().min(0).max(25e3).default(2e3),
       LOG_LEVEL: z.enum(["error", "warn", "info", "debug"]).default("info"),
       // Hosted HTTP service (`serve-http`). Server-side only.
       PORT: z.coerce.number().int().positive().default(8080),
@@ -1065,6 +1074,22 @@ var init_config = __esm({
        *  authenticated web app presents it to mint a key for a signed-in user. Unset
        *  → the endpoint is disabled (404). Keep it server-side, never in the client. */
       LURQ_ISSUER_SECRET: z.string().min(1).optional(),
+      // Billing (Stripe). Every secret here lives on this service and nowhere else:
+      // the web app holds no Stripe credential and reaches checkout through the
+      // issuer-secret routes, the same way it reaches key issuance. Unset →
+      // /billing/* is disabled (404) and every account is served the free tier, so
+      // a deployment without Stripe configured degrades to "free for everyone"
+      // rather than to "nobody can call anything".
+      STRIPE_SECRET_KEY: z.string().min(1).optional(),
+      /** Signing secret for `POST /billing/webhook`. Unset → the endpoint is 404. */
+      STRIPE_WEBHOOK_SECRET: z.string().min(1).optional(),
+      /** Price id backing the Pro plan. Unset → Pro cannot be checked out. */
+      STRIPE_PRICE_PRO: z.string().min(1).optional(),
+      /** Price id backing Enterprise. Normally unset: Enterprise is sold by
+       *  conversation, and `contactOnly` in core/plans.ts is what the page reads. */
+      STRIPE_PRICE_ENTERPRISE: z.string().min(1).optional(),
+      /** Absolute base URL the checkout returns to, e.g. https://lurq.run. */
+      LURQ_WEB_URL: z.string().url().default("https://lurq.run"),
       // GitHub App (repo autopilot). Only the App itself holds repo access; lurq
       // never stores a user's personal token. Either unset → /repos is disabled (404).
       // The App *slug* is deliberately not here: only the web app needs it, to build
@@ -1073,6 +1098,10 @@ var init_config = __esm({
       LURQ_GITHUB_APP_ID: z.string().min(1).optional(),
       /** PEM private key. Accepts literal newlines or `\n` escapes (Railway/Vercel). */
       LURQ_GITHUB_APP_PRIVATE_KEY: z.string().min(1).optional(),
+      /** Webhook secret from the same App settings page, so repo changes made on
+       *  GitHub reach us. Unset → `POST /github/webhook` is disabled (404): an
+       *  unverified webhook is an open write endpoint, so no secret means no route. */
+      LURQ_GITHUB_WEBHOOK_SECRET: z.string().min(1).optional(),
       // Client-side (install wizard / CLI talking to a remote endpoint).
       LURQ_ENDPOINT: z.string().url().optional(),
       LURQ_API_KEY: z.string().min(1).optional(),
@@ -1102,11 +1131,12 @@ function isCategory(value) {
 function isFrontendCategory(category) {
   return category != null && FRONTEND_CATEGORIES.includes(category);
 }
-var CATEGORIES, FRONTEND_CATEGORIES;
+var DEFAULT_ECOSYSTEM, CATEGORIES, FRONTEND_CATEGORIES;
 var init_types = __esm({
   "src/core/types.ts"() {
     "use strict";
     init_esm_shims();
+    DEFAULT_ECOSYSTEM = "npm";
     CATEGORIES = [
       "framework",
       "meta-framework",
@@ -1147,11 +1177,255 @@ var init_types = __esm({
   }
 });
 
+// src/core/capabilities.ts
+function searchCapabilities(query, limit = 5) {
+  const terms = tokenize(query ?? "");
+  if (!terms.length) return CAPABILITIES.slice(0, limit).map((c) => ({ ...c, score: 0 }));
+  const scored = CAPABILITIES.map((c) => {
+    let score = 0;
+    for (const { of, weight } of FIELDS) {
+      const haystack = tokenize(of(c));
+      for (const term of terms) {
+        if (haystack.includes(term)) score += weight;
+        else if (haystack.some((h) => sameStem(h, term))) score += weight / 2;
+      }
+    }
+    return { ...c, score };
+  }).filter((c) => c.score > 0);
+  if (!scored.length) return CAPABILITIES.slice(0, limit).map((c) => ({ ...c, score: 0 }));
+  return scored.sort((a, b) => b.score - a.score).slice(0, limit);
+}
+var CAPABILITIES, STOP, tokenize, STEM_LEN, sameStem, FIELDS;
+var init_capabilities = __esm({
+  "src/core/capabilities.ts"() {
+    "use strict";
+    init_esm_shims();
+    CAPABILITIES = [
+      {
+        id: "verify",
+        title: "Check a package is real",
+        question: "Does this package actually exist, and is it safe to install?",
+        answer: "Checks the live registry for existence, deprecation, archival and advisories \u2014 the guard against a hallucinated or typosquatted name reaching package.json.",
+        mcp: "verify",
+        cli: "lurq verify <package>",
+        aliases: ["hallucinated", "typosquat", "slopsquat", "fake", "malicious", "safe", "exists"]
+      },
+      {
+        id: "recommend",
+        title: "Pick a package for a need",
+        question: "What should I use for this?",
+        answer: "Returns evidence-scored candidates for a described need, with a confidence label on each. Ranks from current signals, not from what was popular at a training cutoff.",
+        mcp: "recommend",
+        cli: 'lurq recommend "<what you need>"',
+        aliases: ["choose", "library", "best", "alternative", "which"]
+      },
+      {
+        id: "evaluate",
+        title: "Read the evidence on a package",
+        question: "Is this package healthy, maintained, and worth adopting?",
+        answer: "The full evidence read for one package: health and quality scores with the signals behind them, release cadence, advisories, and how to wire it up.",
+        mcp: "evaluate",
+        cli: "lurq evaluate <package>",
+        aliases: ["health", "maintained", "abandoned", "deprecated", "score", "quality"]
+      },
+      {
+        id: "compare",
+        title: "Compare packages side by side",
+        question: "Which of these two should I go with?",
+        answer: "Ranks 2\u20135 named packages against each other on the same scored evidence.",
+        mcp: "compare",
+        cli: "lurq compare <a> <b>",
+        aliases: ["versus", "vs", "shootout", "better"]
+      },
+      {
+        id: "compat",
+        title: "Check a stack fits together",
+        question: "Will these packages work together?",
+        answer: "Peer-dependency and engine checks across the whole set at once, plus any sandbox-verified conflicts on record. Returns the exact clashing constraints.",
+        mcp: "compat",
+        cli: "lurq compat <a> <b> <c>",
+        aliases: ["peer", "conflict", "incompatible", "engines", "node version", "together"]
+      },
+      {
+        id: "usage",
+        title: "See a version-exact API",
+        question: "What does this package actually export at this version?",
+        answer: "The exported symbols and signatures for one exact version, read from the shipped JS \u2014 plus the delta from a version you already know.",
+        mcp: "usage",
+        cli: "lurq usage <package> --target <version>",
+        aliases: ["exports", "symbols", "api", "signature", "surface"]
+      },
+      {
+        id: "diff-surface",
+        title: "See what an upgrade removes",
+        question: "What breaks between these two versions?",
+        answer: "The symbol-level diff between two published versions: what was removed, what changed arity, what is new. Runtime breakage is reported separately from type-only breakage.",
+        mcp: "diff_surface",
+        cli: "lurq usage <package> --known <old> --target <new>",
+        aliases: ["breaking", "removed", "changed", "migration", "major"]
+      },
+      {
+        id: "plan",
+        title: "Turn a spec into a stack",
+        question: "I have a project description \u2014 what should I build it with?",
+        answer: "Decomposes a written spec into component slots, recommends a scored package per slot, and optimises the set for compatibility. A starter stack, not an architecture.",
+        mcp: "plan",
+        cli: "lurq plan <file.md> --open",
+        aliases: ["spec", "readme", "greenfield", "scaffold", "roadmap", "stack"]
+      },
+      {
+        id: "diagram",
+        title: "Draw the stack",
+        question: "Can I see this as a diagram?",
+        answer: "Renders a planned or existing stack as a Mermaid graph other tools can parse.",
+        mcp: "diagram",
+        cli: "lurq plan <file.md> --html <out.html>",
+        aliases: ["mermaid", "visual", "chart", "architecture", "graph"]
+      },
+      {
+        id: "upgrade-plan",
+        title: "Find what is behind",
+        question: "How far out of date is this project?",
+        answer: "Reads the local manifests and reports the gap between what is resolved and what is current, with what each upgrade removes from its API. Sends dependency ranges only, never source.",
+        cli: "lurq upgrade-plan",
+        page: "/dashboard/repos",
+        aliases: ["drift", "outdated", "behind", "stale", "update", "upgrade", "bump", "dependencies"]
+      },
+      {
+        id: "check-upgrade",
+        title: "Check an upgrade against your code",
+        question: "Will this upgrade break my code specifically?",
+        answer: "Intersects what the upgrade removes with what your code actually references, and answers with file:line. Needs no test suite and no network to lurq.",
+        cli: "lurq check-upgrade --plan plan.json --exit-code",
+        aliases: ["breaking", "ci", "gate", "call sites", "references", "blocking"]
+      },
+      {
+        id: "check-release",
+        title: "Check your own version bump",
+        question: "Am I about to break my consumers?",
+        answer: "Compares the built working tree against your last published version and says whether the bump you are about to tag covers what actually changed. For package authors.",
+        cli: "lurq check-release --exit-code",
+        aliases: ["publish", "semver", "release", "major", "prepublish", "library author"]
+      },
+      {
+        id: "check-api",
+        title: "Check your own API for breaks",
+        question: "Will this change break the people calling my service?",
+        answer: "Diffs two git revisions of your OpenAPI document: removed operations, newly required parameters and body fields, removed response codes \u2014 and whether info.version was bumped enough. Reads git only, nothing leaves the machine.",
+        cli: "lurq check-api --against origin/main --exit-code",
+        aliases: ["openapi", "swagger", "endpoint", "consumers", "callers", "service", "contract", "rest"]
+      },
+      {
+        id: "autopilot",
+        title: "Keep a repo current automatically",
+        question: "Can lurq just do the upgrades for me?",
+        answer: "Connect a repo and lurq drafts the upgrade, names the call sites it breaks, and opens a PR from your own runner. lurq never gets write access to your code.",
+        page: "/dashboard/repos",
+        cli: "lurq upgrade-plan --json",
+        aliases: ["automate", "pr", "github", "renovate", "dependabot", "autopilot", "workflow"]
+      },
+      {
+        id: "policy",
+        title: "Set what agents may install",
+        question: "How do I stop agents adding packages we do not allow?",
+        answer: "An allow/deny list plus licence and confidence floors, enforced at the moment an agent reaches for a dependency \u2014 before it becomes a line in package.json.",
+        page: "/dashboard/policy",
+        aliases: ["allowlist", "whitelist", "deny", "blocklist", "licence", "license", "govern", "standard"]
+      },
+      {
+        id: "alerts",
+        title: "Watch repos for new risk",
+        question: "Tell me when something I depend on goes bad",
+        answer: "Per-repo advisories and deprecations across the resolved tree, with the direct dependency responsible for each transitive finding.",
+        page: "/dashboard/repos",
+        aliases: ["advisory", "cve", "vulnerability", "security", "transitive", "sbom", "alert"]
+      },
+      {
+        id: "usage-dashboard",
+        title: "See how lurq is being used",
+        question: "Who on my team is calling lurq, and how much?",
+        answer: "Call volume by tool and by day, plus the outcomes reported back after a recommendation.",
+        page: "/dashboard/usage",
+        aliases: ["activity", "analytics", "volume", "calls", "team", "adoption", "heatmap"]
+      },
+      {
+        id: "setup",
+        title: "Connect lurq to an assistant",
+        question: "How do I get this into Claude Code / Cursor?",
+        answer: "One command detects every assistant on the machine and writes the MCP entry. No database credentials touch your machine.",
+        cli: "npx lurqrun",
+        page: "/dashboard/keys",
+        aliases: ["install", "mcp", "cursor", "claude code", "windsurf", "copilot", "api key", "onboard"]
+      },
+      {
+        id: "weights",
+        title: "Change how scoring works",
+        question: "I disagree with the ranking \u2014 can I tune it?",
+        answer: "Show the weight model, or layer your own overrides on top of the defaults, per user or per project.",
+        cli: "lurq edit-weights --set composite.lambda=0.5",
+        aliases: ["scoring", "ranking", "tune", "bias", "lambda", "override"]
+      },
+      {
+        id: "report-outcome",
+        title: "Tell lurq how it went",
+        question: "How does lurq learn from what I picked?",
+        answer: "An opt-in report of whether you took the recommendation and whether it built. Coarse signal only \u2014 never source code.",
+        mcp: "report_outcome",
+        aliases: ["feedback", "outcome", "accepted", "flywheel", "learn"]
+      }
+    ];
+    STOP = /* @__PURE__ */ new Set([
+      "a",
+      "an",
+      "the",
+      "is",
+      "it",
+      "i",
+      "my",
+      "me",
+      "do",
+      "does",
+      "how",
+      "what",
+      "which",
+      "to",
+      "for",
+      "of",
+      "in",
+      "on",
+      "and",
+      "or",
+      "can",
+      "with",
+      "this",
+      "that",
+      "be",
+      "am",
+      "are",
+      "should",
+      "lurq",
+      "package",
+      "packages"
+    ]);
+    tokenize = (s) => s.toLowerCase().split(/[^a-z0-9.@/]+/).filter((t) => t.length > 1 && !STOP.has(t));
+    STEM_LEN = 5;
+    sameStem = (a, b) => a.length >= STEM_LEN && b.length >= STEM_LEN && a.slice(0, STEM_LEN) === b.slice(0, STEM_LEN);
+    FIELDS = [
+      { of: (c) => c.title, weight: 5 },
+      { of: (c) => c.question, weight: 4 },
+      { of: (c) => (c.aliases ?? []).join(" "), weight: 3 },
+      { of: (c) => c.answer, weight: 1 },
+      { of: (c) => [c.mcp, c.cli, c.page].filter(Boolean).join(" "), weight: 4 }
+    ];
+  }
+});
+
 // src/db/schema.ts
 var schema_exports = {};
 __export(schema_exports, {
   apiKeys: () => apiKeys,
   apiSurfaces: () => apiSurfaces,
+  askSpendDaily: () => askSpendDaily,
   claims: () => claims,
   compatEdges: () => compatEdges,
   compatVerifyQueue: () => compatVerifyQueue,
@@ -1168,6 +1442,7 @@ __export(schema_exports, {
   resolvedClosures: () => resolvedClosures,
   seedPackages: () => seedPackages,
   selectionPolicies: () => selectionPolicies,
+  subscriptions: () => subscriptions,
   surfaceQueue: () => surfaceQueue,
   symbols: () => symbols,
   syncRuns: () => syncRuns,
@@ -1193,7 +1468,7 @@ import {
   uniqueIndex,
   vector
 } from "drizzle-orm/pg-core";
-var tsvector, ts, packages, syncRuns, seedPackages, discoveryQueue, compatVerifyQueue, apiKeys, packageVersions, watchState, verificationRuns, compatEdges, resolvedClosures, apiSurfaces, recommendationOutcomes, ownerUsageDaily, repos, upgradeRuns, repoAlerts, surfaceQueue, entities, symbols, environments, claims, observations, selectionPolicies;
+var tsvector, ts, packages, syncRuns, seedPackages, discoveryQueue, compatVerifyQueue, apiKeys, packageVersions, watchState, verificationRuns, compatEdges, resolvedClosures, apiSurfaces, recommendationOutcomes, askSpendDaily, ownerUsageDaily, repos, upgradeRuns, repoAlerts, surfaceQueue, entities, symbols, environments, claims, observations, selectionPolicies, subscriptions;
 var init_schema = __esm({
   "src/db/schema.ts"() {
     "use strict";
@@ -1209,8 +1484,8 @@ var init_schema = __esm({
       "packages",
       {
         id: serial("id").primaryKey(),
-        name: text("name").notNull().unique(),
-        ecosystem: text("ecosystem").notNull().default("npm"),
+        name: text("name").notNull(),
+        ecosystem: text("ecosystem").$type().notNull().default("npm"),
         // Classification + descriptive text
         category: text("category").$type(),
         /** Whether `category` was hand-curated or inferred at ingest (§2A). */
@@ -1282,6 +1557,7 @@ var init_schema = __esm({
         firstRequestedByOwnerId: text("first_requested_by_owner_id")
       },
       (table2) => [
+        uniqueIndex("packages_ecosystem_name_idx").on(table2.ecosystem, table2.name),
         index("packages_category_idx").on(table2.category),
         index("packages_health_score_idx").on(table2.healthScore),
         // pgvector HNSW index for cosine similarity search (§11).
@@ -1435,9 +1711,7 @@ var init_schema = __esm({
         nodes: jsonb("nodes").$type().notNull(),
         fetchedAt: ts("fetched_at").notNull().defaultNow()
       },
-      (table2) => [
-        uniqueIndex("resolved_closures_pkg_idx").on(table2.packageName, table2.version)
-      ]
+      (table2) => [uniqueIndex("resolved_closures_pkg_idx").on(table2.packageName, table2.version)]
     );
     apiSurfaces = pgTable(
       "api_surfaces",
@@ -1473,6 +1747,16 @@ var init_schema = __esm({
         index("recommendation_outcomes_owner_idx").on(table2.ownerId)
       ]
     );
+    askSpendDaily = pgTable(
+      "ask_spend_daily",
+      {
+        ownerId: text("owner_id").notNull(),
+        /** UTC day, 'YYYY-MM-DD'. */
+        date: date("date").notNull(),
+        usdMicros: bigint("usd_micros", { mode: "number" }).notNull().default(0)
+      },
+      (table2) => [primaryKey({ columns: [table2.ownerId, table2.date] })]
+    );
     ownerUsageDaily = pgTable(
       "owner_usage_daily",
       {
@@ -1601,11 +1885,7 @@ var init_schema = __esm({
         // One alert per repo per release. A re-sync of the same version — and the
         // watcher re-syncs on every publish, including non-latest backports — must
         // not re-notify.
-        uniqueIndex("repo_alerts_dedup_idx").on(
-          table2.repoId,
-          table2.packageName,
-          table2.toVersion
-        )
+        uniqueIndex("repo_alerts_dedup_idx").on(table2.repoId, table2.packageName, table2.toVersion)
       ]
     );
     surfaceQueue = pgTable(
@@ -1681,7 +1961,9 @@ var init_schema = __esm({
       // they are not interchangeable (§6.4.3). Without the tier in the key, storing a
       // tier-C surface would silently overwrite the tier-A one that answers runtime
       // existence — replacing the authoritative answer with a type-level guess.
-      (table2) => [uniqueIndex("symbols_entity_path_tier_idx").on(table2.entityId, table2.path, table2.tier)]
+      (table2) => [
+        uniqueIndex("symbols_entity_path_tier_idx").on(table2.entityId, table2.path, table2.tier)
+      ]
     );
     environments = pgTable("environments", {
       id: serial("id").primaryKey(),
@@ -1742,6 +2024,33 @@ var init_schema = __esm({
       policy: jsonb("policy").$type().notNull(),
       updatedAt: ts("updated_at").notNull().defaultNow()
     });
+    subscriptions = pgTable(
+      "subscriptions",
+      {
+        /** Clerk user id. One subscription per account. */
+        ownerId: text("owner_id").primaryKey(),
+        /** Stable across subscriptions: a customer who cancels and returns reuses it. */
+        stripeCustomerId: text("stripe_customer_id").notNull().unique(),
+        /** Null between creating a customer and completing a first checkout. */
+        stripeSubscriptionId: text("stripe_subscription_id").unique(),
+        tier: text("tier").$type().notNull().default("free"),
+        /** Raw Stripe subscription status. `null` = never subscribed. */
+        status: text("status"),
+        /** When the paid period lapses. Display only; `status` is what gates access. */
+        currentPeriodEnd: ts("current_period_end"),
+        /** Set when the user cancels but has paid through the period. */
+        cancelAtPeriodEnd: boolean("cancel_at_period_end").notNull().default(false),
+        /**
+         * Stripe delivers out of order and retries, so a late duplicate of an older
+         * event must not overwrite newer state. The webhook drops any event whose
+         * timestamp is older than the one that produced the current row.
+         */
+        lastEventAt: ts("last_event_at"),
+        createdAt: ts("created_at").notNull().defaultNow(),
+        updatedAt: ts("updated_at").notNull().defaultNow()
+      },
+      (table2) => [index("subscriptions_customer_idx").on(table2.stripeCustomerId)]
+    );
   }
 });
 
@@ -1750,28 +2059,34 @@ import { drizzle } from "drizzle-orm/postgres-js";
 import postgres from "postgres";
 function createDb(opts = {}) {
   const { DATABASE_URL } = requireConfig(["DATABASE_URL"]);
-  const sql14 = postgres(DATABASE_URL, { max: opts.max ?? 10, onnotice: () => {
-  } });
-  const db = drizzle(sql14, { schema: schema_exports });
-  return { db, sql: sql14, close: () => sql14.end() };
+  const sql16 = postgres(DATABASE_URL, {
+    max: opts.max ?? 10,
+    onnotice: () => {
+    },
+    connection: { statement_timeout: STATEMENT_TIMEOUT_MS }
+  });
+  const db = drizzle(sql16, { schema: schema_exports });
+  return { db, sql: sql16, close: () => sql16.end() };
 }
+var STATEMENT_TIMEOUT_MS;
 var init_client = __esm({
   "src/db/client.ts"() {
     "use strict";
     init_esm_shims();
     init_config();
     init_schema();
+    STATEMENT_TIMEOUT_MS = 15e3;
   }
 });
 
 // src/db/packages.ts
-import { and, desc, eq, inArray, isNotNull, isNull, lt, notExists, sql as sql2 } from "drizzle-orm";
-async function getPackageByName(db, name) {
-  const rows = await db.select().from(packages).where(eq(packages.name, name)).limit(1);
+import { and, desc, eq, gte, inArray, isNotNull, isNull, lt, notExists, sql as sql2 } from "drizzle-orm";
+async function getPackageByName(db, name, ecosystem = DEFAULT_ECOSYSTEM) {
+  const rows = await db.select().from(packages).where(and(eq(packages.name, name), eq(packages.ecosystem, ecosystem))).limit(1);
   return rows[0] ?? null;
 }
-async function getAllPackageNames(db) {
-  const rows = await db.select({ name: packages.name }).from(packages);
+async function getAllPackageNames(db, ecosystem = DEFAULT_ECOSYSTEM) {
+  const rows = await db.select({ name: packages.name }).from(packages).where(eq(packages.ecosystem, ecosystem));
   return rows.map((r) => r.name);
 }
 async function upsertPackageVersions(db, name, versions) {
@@ -1802,14 +2117,20 @@ async function ensureSeedEntry(db, name, category) {
   await db.insert(seedPackages).values({ name, category }).onConflictDoNothing({ target: seedPackages.name });
 }
 async function upsertPackage(db, row) {
-  const { name: _name, createdAt: _createdAt, ...mutable } = row;
+  const { name: _name, ecosystem: _ecosystem, createdAt: _createdAt, ...mutable } = row;
   await db.insert(packages).values(row).onConflictDoUpdate({
-    target: packages.name,
+    target: [packages.ecosystem, packages.name],
     set: { ...mutable, updatedAt: /* @__PURE__ */ new Date() }
   });
 }
-async function stampFirstRequester(db, name, ownerId) {
-  await db.update(packages).set({ firstRequestedByOwnerId: ownerId }).where(and(eq(packages.name, name), isNull(packages.firstRequestedByOwnerId)));
+async function stampFirstRequester(db, name, ownerId, ecosystem = DEFAULT_ECOSYSTEM) {
+  await db.update(packages).set({ firstRequestedByOwnerId: ownerId }).where(
+    and(
+      eq(packages.name, name),
+      eq(packages.ecosystem, ecosystem),
+      isNull(packages.firstRequestedByOwnerId)
+    )
+  );
 }
 async function getContributionsByOwner(db, ownerId, opts = {}) {
   const limit = opts.limit ?? 50;
@@ -1831,6 +2152,7 @@ var init_packages = __esm({
     "use strict";
     init_esm_shims();
     init_logger();
+    init_types();
     init_schema();
     VERSION_CHUNK = 500;
     SYNC_STALE_MS = 6 * 60 * 60 * 1e3;
@@ -1879,13 +2201,16 @@ async function namespaceVersion(client) {
   versionMemo = { value, at: Date.now() };
   return value;
 }
+function codeVersion() {
+  return VERSION;
+}
 async function cached2(namespace, key, compute, opts = {}) {
   const client = await getClient();
   if (!client) return compute();
   let fullKey;
   try {
     const version = await namespaceVersion(client);
-    fullKey = `lurq:${namespace}:${version}:${key}`;
+    fullKey = `lurq:${namespace}:${codeVersion()}:${version}:${key}`;
     const hit = await client.get(fullKey);
     if (hit != null) return JSON.parse(hit);
   } catch (err) {
@@ -1914,6 +2239,7 @@ var init_cache = __esm({
   "src/core/cache.ts"() {
     "use strict";
     init_esm_shims();
+    init_constants();
     init_logger();
     VERSION_KEY = "lurq:cachever";
     DEFAULT_TTL_SEC = 3600;
@@ -1925,7 +2251,7 @@ var init_cache = __esm({
 
 // src/db/compat.ts
 import { and as and2, eq as eq2, inArray as inArray2, sql as sql3 } from "drizzle-orm";
-async function getCompatMetadata(db, names2) {
+async function getCompatMetadata(db, names2, ecosystem = DEFAULT_ECOSYSTEM) {
   if (names2.length === 0) return [];
   return db.select({
     name: packages.name,
@@ -1933,7 +2259,7 @@ async function getCompatMetadata(db, names2) {
     peerDependencies: packages.peerDependencies,
     peerDependenciesMeta: packages.peerDependenciesMeta,
     engines: packages.engines
-  }).from(packages).where(inArray2(packages.name, names2));
+  }).from(packages).where(and2(inArray2(packages.name, names2), eq2(packages.ecosystem, ecosystem)));
 }
 function canonicalPair(a, b) {
   const [low, high] = a.name <= b.name ? [a, b] : [b, a];
@@ -2027,6 +2353,7 @@ var init_compat = __esm({
   "src/db/compat.ts"() {
     "use strict";
     init_esm_shims();
+    init_types();
     init_schema();
     CONFLICT_TARGET = [
       compatEdges.packageA,
@@ -2171,7 +2498,7 @@ function parseRetryAfter(value) {
   return Number.isNaN(date2) ? void 0 : Math.max(0, date2 - Date.now());
 }
 function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 var HttpError, DEFAULT_HOST_CONFIG, HOST_CONFIG, HostLimiter, limiters, MEMORY_CACHE_MAX, memoryCache, bypassCacheRead, RETRYABLE;
 var init_http = __esm({
@@ -2211,7 +2538,7 @@ var init_http = __esm({
       queue = [];
       async acquire() {
         if (this.active >= this.config.maxConcurrent) {
-          await new Promise((resolve) => this.queue.push(resolve));
+          await new Promise((resolve2) => this.queue.push(resolve2));
         }
         this.active++;
         const now = Date.now();
@@ -2401,6 +2728,20 @@ async function fetchNpmCompatAtVersion(name, version, fetchImpl) {
     return null;
   }
 }
+async function npmVersionExists(name, version, fetchImpl) {
+  const url = `https://${HOST}/${encodeNpmName(name)}`;
+  try {
+    const { data } = await httpGetJson(url, {
+      host: HOST,
+      ttlMs: CACHE_TTL.npmRegistry,
+      fetchImpl
+    });
+    if (!data?.versions || typeof data.versions !== "object") return null;
+    return Object.prototype.hasOwnProperty.call(data.versions, version);
+  } catch {
+    return null;
+  }
+}
 async function npmPackageExists(name, fetchImpl) {
   const url = `https://${HOST}/${encodeNpmName(name)}`;
   try {
@@ -3048,6 +3389,23 @@ var init_diff = __esm({
   }
 });
 
+// src/core/concurrency.ts
+function withBudget(task, ms) {
+  let timer;
+  return Promise.race([
+    task,
+    new Promise((resolve2) => {
+      timer = setTimeout(resolve2, ms, null);
+    })
+  ]).finally(() => clearTimeout(timer));
+}
+var init_concurrency = __esm({
+  "src/core/concurrency.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/db/apiSurfaces.ts
 import { and as and3, eq as eq3, isNotNull as isNotNull2, isNull as isNull2, sql as sql4 } from "drizzle-orm";
 async function getStoredSurface(db, packageName, version) {
@@ -3092,8 +3450,8 @@ async function fetchFile(url, opts, ttlMs = CACHE_TTL.depsDev) {
     });
     return { text: typeof data === "string" ? data : null, unknown: false };
   } catch (err) {
-    const missing = err instanceof HttpError && err.status === 404;
-    return { text: null, unknown: !missing };
+    const missing2 = err instanceof HttpError && err.status === 404;
+    return { text: null, unknown: !missing2 };
   }
 }
 async function fetchText(url, opts) {
@@ -3341,9 +3699,6 @@ var init_extract = __esm({
 });
 
 // src/usage/service.ts
-function raceBudget(task, budgetMs) {
-  return Promise.race([task, new Promise((resolve) => setTimeout(resolve, budgetMs, null))]);
-}
 function extractOnce(db, name, version, fetchOpts) {
   const key = `${name}@${version}`;
   const existing = inFlight.get(key);
@@ -3363,13 +3718,14 @@ async function getOrExtractSurface(db, name, version, opts = {}) {
   if (opts.budgetMs === 0) return null;
   const fetchOpts = opts.fetch ?? (opts.budgetMs === void 0 ? {} : READ_PATH_FETCH);
   const task = extractOnce(db, name, version, fetchOpts);
-  return opts.budgetMs === void 0 ? task : raceBudget(task, opts.budgetMs);
+  return opts.budgetMs === void 0 ? task : withBudget(task, opts.budgetMs);
 }
 var USAGE_EXTRACT_BUDGET_MS, READ_PATH_FETCH, MAX_INFLIGHT, inFlight;
 var init_service = __esm({
   "src/usage/service.ts"() {
     "use strict";
     init_esm_shims();
+    init_concurrency();
     init_apiSurfaces();
     init_extract();
     USAGE_EXTRACT_BUDGET_MS = 4e3;
@@ -3494,7 +3850,7 @@ var init_successors2 = __esm({
 });
 
 // src/db/outcomes.ts
-import { count, desc as desc3, eq as eq5, inArray as inArray3, sql as sql5 } from "drizzle-orm";
+import { and as and4, count, desc as desc3, eq as eq5, inArray as inArray3, sql as sql5 } from "drizzle-orm";
 import { alias } from "drizzle-orm/pg-core";
 async function recordOutcome(db, outcome) {
   await db.insert(recommendationOutcomes).values(outcome);
@@ -3545,7 +3901,7 @@ async function loadLearnedSuccessors(db, now = Date.now()) {
     return learnedCache.value;
   }
   const names2 = [...new Set(observed.map((o) => o.from))];
-  const rows = await db.select({ name: packages.name, deprecated: packages.deprecated, archived: packages.archived }).from(packages).where(inArray3(packages.name, names2));
+  const rows = await db.select({ name: packages.name, deprecated: packages.deprecated, archived: packages.archived }).from(packages).where(and4(inArray3(packages.name, names2), eq5(packages.ecosystem, DEFAULT_ECOSYSTEM)));
   const dead = new Set(rows.filter((r) => r.deprecated || r.archived).map((r) => r.name));
   const value = buildLearnedSuccessors(observed, (name) => dead.has(name));
   learnedCache = { at: now, value };
@@ -3559,6 +3915,7 @@ var init_outcomes = __esm({
   "src/db/outcomes.ts"() {
     "use strict";
     init_esm_shims();
+    init_types();
     init_successors2();
     init_schema();
     SUCCESS_PREDICATE = sql5`${recommendationOutcomes.accepted} AND (${recommendationOutcomes.buildSignal} IS NULL OR ${recommendationOutcomes.buildSignal} <> 'failed')`;
@@ -3933,10 +4290,10 @@ function settableKeys() {
 function applyOverrides(base, sets) {
   const next = structuredClone(base);
   for (const entry of sets) {
-    const eq18 = entry.indexOf("=");
-    if (eq18 < 0) throw new Error(`Invalid --set "${entry}" (expected key=value).`);
-    const key = entry.slice(0, eq18).trim();
-    const value = Number(entry.slice(eq18 + 1).trim());
+    const eq25 = entry.indexOf("=");
+    if (eq25 < 0) throw new Error(`Invalid --set "${entry}" (expected key=value).`);
+    const key = entry.slice(0, eq25).trim();
+    const value = Number(entry.slice(eq25 + 1).trim());
     const apply = SETTABLE[key];
     if (!apply) {
       throw new Error(`Unknown weight key "${key}". Settable: ${settableKeys().join(", ")}.`);
@@ -3964,7 +4321,7 @@ function resetWeights() {
   resetWeightsCache();
   return removed;
 }
-var HEALTH_WEIGHTS, COMPOSITE, QUALITY_WEIGHTS, QUALITY, MAINTENANCE_WEIGHTS, MAINTENANCE, ADOPTION, RELIABILITY, EFFICIENCY, FIELD, DEFAULT_WEIGHTS, cachedWeights, SETTABLE, WEIGHT_EXPLANATIONS, CONFIDENCE;
+var HEALTH_WEIGHTS, COMPOSITE, RANKING, CONFIDENCE_WEIGHT, QUALITY_WEIGHTS, QUALITY, MAINTENANCE_WEIGHTS, MAINTENANCE, ADOPTION, RELIABILITY, EFFICIENCY, FIELD, DEFAULT_WEIGHTS, cachedWeights, SETTABLE, WEIGHT_EXPLANATIONS, CONFIDENCE;
 var init_weights = __esm({
   "src/scoring/weights.ts"() {
     "use strict";
@@ -3979,6 +4336,17 @@ var init_weights = __esm({
     COMPOSITE = {
       lambda: 0.35
     };
+    RANKING = {
+      relevance: 0.45,
+      composite: 0.35,
+      confidence: 0.2
+    };
+    CONFIDENCE_WEIGHT = {
+      proven: 1,
+      emerging: 0.55,
+      promising: 0.45,
+      unproven: 0.1
+    };
     QUALITY_WEIGHTS = {
       types: 0.25,
       tests: 0.2,
@@ -4086,12 +4454,44 @@ var init_weights = __esm({
       proven: {
         minWeeklyDownloads: 1e5,
         minAgeMonths: 12,
-        maxLastReleaseMonths: 6
+        /**
+         * Recency ceiling for the top tier.
+         *
+         * Was 6 months, which quietly punished stability. Because the stored label
+         * is frozen at ingest, nothing surfaced it until confidence was re-derived
+         * — at which point `p-limit` (273M weekly downloads, ten years old, last
+         * release 6.2 months ago) dropped out of `proven`, along with
+         * `@testing-library/react` at 6.7 months and 44M/wk. A mature utility that
+         * has not needed a release is the most proven kind of package there is.
+         *
+         * Abandonment is already caught three other ways that do not confuse it
+         * with maturity: `deprecated` and `archived` are hard-checked right here,
+         * and the maintenance component of health decays to zero over 24 months
+         * while carrying 35% of the health weight. Recency was the fourth penalty
+         * on the same fact, and the strictest.
+         */
+        maxLastReleaseMonths: 18
       },
       emerging: {
         minWeeklyDownloads: 5e3,
         strongGrowth: 0.5,
-        maxLastReleaseMonths: 9
+        /**
+         * Absolute floor the growth path must also clear.
+         *
+         * Growth alone used to qualify a package for `emerging`, and a percentage
+         * computed on a tiny base is noise: 4 → 17 weekly downloads is +325% and
+         * cleared the bar outright. That is how `@podgres/pg` (17/wk) and
+         * `@bungres/orm` (275/wk) came to wear the same evidence label as a package
+         * with five thousand real installs, and — because `recommend` treats the
+         * label as meaningful — outrank Prisma for "an orm for postgres".
+         *
+         * 1,000/wk is where a 50% swing stops being one CI pipeline changing its
+         * schedule. Below it the growth signal is not measuring adoption.
+         */
+        minDownloadsForGrowth: 1e3,
+        /** Same reasoning as `proven` above: 9 months demoted `@emotion/react`
+         *  (14.7M/wk, last release 9.2 months ago) to `unproven`. */
+        maxLastReleaseMonths: 18
       },
       /** `promising` (§1): new but intrinsically high-quality, regardless of adoption. */
       promising: {
@@ -4268,7 +4668,7 @@ function computeConfidence(input, now, qualityScore = null) {
     return "proven";
   }
   const emergingReleaseOk = lastReleaseMonths !== null && lastReleaseMonths <= CONFIDENCE.emerging.maxLastReleaseMonths;
-  const emergingAdoptionOk = dl >= CONFIDENCE.emerging.minWeeklyDownloads || growth >= CONFIDENCE.emerging.strongGrowth;
+  const emergingAdoptionOk = dl >= CONFIDENCE.emerging.minWeeklyDownloads || growth >= CONFIDENCE.emerging.strongGrowth && dl >= CONFIDENCE.emerging.minDownloadsForGrowth;
   if (emergingAdoptionOk && emergingReleaseOk && !input.deprecated && !input.archived) {
     return "emerging";
   }
@@ -4330,7 +4730,7 @@ function buildEmbeddingText(input) {
   const body = input.summary || input.description || "";
   return `${input.name}. ${input.category ?? ""}. ${body}`.trim();
 }
-function tokenize(text2) {
+function tokenize2(text2) {
   return text2.toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length > 1);
 }
 function fnv1a(str3) {
@@ -4343,7 +4743,7 @@ function fnv1a(str3) {
 }
 function localEmbed(text2, dim2 = EMBEDDING_DIM) {
   const vec = new Float64Array(dim2);
-  const tokens = tokenize(text2);
+  const tokens = tokenize2(text2);
   const add = (token, weight) => {
     const idx = fnv1a(token) % dim2;
     const sign = fnv1a("s:" + token) & 1 ? 1 : -1;
@@ -4441,7 +4841,7 @@ var init_embeddings = __esm({
 });
 
 // src/db/alerts.ts
-import { and as and4, desc as desc4, eq as eq6 } from "drizzle-orm";
+import { and as and5, desc as desc4, eq as eq6 } from "drizzle-orm";
 async function insertAlerts(db, rows) {
   if (rows.length === 0) return 0;
   const inserted = await db.insert(repoAlerts).values(rows).onConflictDoNothing({
@@ -4453,7 +4853,7 @@ async function listAlerts(db, ownerId, limit = ALERT_FEED_LIMIT) {
   return db.select().from(repoAlerts).where(eq6(repoAlerts.ownerId, ownerId)).orderBy(desc4(repoAlerts.createdAt)).limit(Math.min(limit, ALERT_FEED_LIMIT));
 }
 async function deleteAlertsForRepo(db, ownerId, repoId) {
-  await db.delete(repoAlerts).where(and4(eq6(repoAlerts.ownerId, ownerId), eq6(repoAlerts.repoId, repoId)));
+  await db.delete(repoAlerts).where(and5(eq6(repoAlerts.ownerId, ownerId), eq6(repoAlerts.repoId, repoId)));
 }
 var ALERT_FEED_LIMIT;
 var init_alerts = __esm({
@@ -4492,7 +4892,7 @@ var init_types2 = __esm({
 });
 
 // src/db/repos.ts
-import { and as and5, eq as eq7, sql as sql6 } from "drizzle-orm";
+import { and as and6, eq as eq7, sql as sql6 } from "drizzle-orm";
 async function upsertRepos(db, rows) {
   if (rows.length === 0) return 0;
   await db.insert(repos).values(
@@ -4525,12 +4925,26 @@ async function reposDeclaring(db, name) {
       )`
   );
 }
+async function ownerForInstallation(db, installationId2) {
+  const rows = await db.select({ ownerId: repos.ownerId }).from(repos).where(eq7(repos.installationId, installationId2)).limit(1);
+  return rows[0]?.ownerId ?? null;
+}
+async function deleteReposByInstallation(db, installationId2, fullNames2) {
+  const only = fullNames2 ? new Set(fullNames2) : null;
+  const rows = await db.select({ id: repos.id, ownerId: repos.ownerId, fullName: repos.fullName }).from(repos).where(eq7(repos.installationId, installationId2));
+  let deleted = 0;
+  for (const row of rows) {
+    if (only && !only.has(row.fullName)) continue;
+    if (await deleteRepo(db, row.ownerId, row.id)) deleted++;
+  }
+  return deleted;
+}
 async function getRepo(db, ownerId, id) {
-  const rows = await db.select().from(repos).where(and5(eq7(repos.ownerId, ownerId), eq7(repos.id, id))).limit(1);
+  const rows = await db.select().from(repos).where(and6(eq7(repos.ownerId, ownerId), eq7(repos.id, id))).limit(1);
   return rows[0] ?? null;
 }
 async function findPolicyByFullName(db, ownerId, fullName) {
-  const rows = await db.select({ policy: repos.policy }).from(repos).where(and5(eq7(repos.ownerId, ownerId), eq7(repos.fullName, fullName))).limit(1);
+  const rows = await db.select({ policy: repos.policy }).from(repos).where(and6(eq7(repos.ownerId, ownerId), eq7(repos.fullName, fullName))).limit(1);
   return rows[0]?.policy ?? null;
 }
 async function saveScan(db, id, scan) {
@@ -4546,12 +4960,12 @@ async function saveScanError(db, id, message) {
   await db.update(repos).set({ lastScanAt: /* @__PURE__ */ new Date(), lastScanError: message.slice(0, 500) }).where(eq7(repos.id, id));
 }
 async function setRepoPolicy(db, ownerId, id, policy) {
-  const updated = await db.update(repos).set({ policy }).where(and5(eq7(repos.ownerId, ownerId), eq7(repos.id, id))).returning({ id: repos.id });
+  const updated = await db.update(repos).set({ policy }).where(and6(eq7(repos.ownerId, ownerId), eq7(repos.id, id))).returning({ id: repos.id });
   return updated.length > 0;
 }
 async function deleteRepo(db, ownerId, id) {
   await deleteAlertsForRepo(db, ownerId, id);
-  const deleted = await db.delete(repos).where(and5(eq7(repos.ownerId, ownerId), eq7(repos.id, id))).returning({ id: repos.id });
+  const deleted = await db.delete(repos).where(and6(eq7(repos.ownerId, ownerId), eq7(repos.id, id))).returning({ id: repos.id });
   return deleted.length > 0;
 }
 var init_repos = __esm({
@@ -4573,8 +4987,8 @@ function buildAttribution(deps, edges, directNames) {
   }
   const parentIds = /* @__PURE__ */ new Map();
   for (const edge of edges) {
-    const list = parentIds.get(edge.child);
-    if (list) list.push(edge.parent);
+    const list2 = parentIds.get(edge.child);
+    if (list2) list2.push(edge.parent);
     else parentIds.set(edge.child, [edge.parent]);
   }
   const informative = edges.some(
@@ -4686,8 +5100,91 @@ var init_osv = __esm({
   }
 });
 
+// src/pipeline/ingestQueue.ts
+var ingestQueue_exports = {};
+__export(ingestQueue_exports, {
+  drainIngestQueue: () => drainIngestQueue,
+  enqueueIngest: () => enqueueIngest,
+  ingestQueueDepth: () => ingestQueueDepth,
+  resetIngestQueue: () => resetIngestQueue,
+  runIngest: () => runIngest
+});
+function ingestQueueDepth() {
+  return pending.length + inFlight2.size;
+}
+async function drainIngestQueue(timeoutMs = 10 * 6e4) {
+  const deadline = Date.now() + timeoutMs;
+  while (ingestQueueDepth() > 0 && Date.now() < deadline) {
+    await new Promise((resolve2) => setTimeout(resolve2, 250));
+  }
+  return ingestQueueDepth();
+}
+function resetIngestQueue() {
+  pending.length = 0;
+  inFlight2.clear();
+  queuedNames.clear();
+  owners.clear();
+  active = 0;
+}
+function enqueueIngest(db, name, requestedByOwnerId = null) {
+  if (queuedNames.has(name) || inFlight2.has(name)) return;
+  if (pending.length >= MAX_PENDING) {
+    logger.warn(`ingest queue full (${MAX_PENDING}); dropping on-demand request for ${name}`);
+    return;
+  }
+  queuedNames.add(name);
+  owners.set(name, requestedByOwnerId);
+  pending.push(name);
+  pump(db);
+}
+function pump(db) {
+  while (active < MAX_CONCURRENT && pending.length > 0) {
+    const name = pending.shift();
+    queuedNames.delete(name);
+    const owner = owners.get(name) ?? null;
+    owners.delete(name);
+    inFlight2.add(name);
+    active += 1;
+    void runIngest(db, name, owner).finally(() => {
+      inFlight2.delete(name);
+      active -= 1;
+      pump(db);
+    });
+  }
+}
+async function runIngest(db, name, requestedByOwnerId = null) {
+  try {
+    const row = await syncOnePackage(db, name, { requestedByOwnerId });
+    if (row.confidence && row.confidence !== "unproven") {
+      await ensureSeedEntry(db, name, row.category).catch(() => {
+      });
+    }
+    return row;
+  } catch (err) {
+    logger.warn(`on-demand ingest failed for ${name}: ${String(err)}`);
+    return null;
+  }
+}
+var MAX_CONCURRENT, MAX_PENDING, pending, inFlight2, queuedNames, owners, active;
+var init_ingestQueue = __esm({
+  "src/pipeline/ingestQueue.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_logger();
+    init_packages();
+    init_single();
+    MAX_CONCURRENT = 3;
+    MAX_PENDING = 500;
+    pending = [];
+    inFlight2 = /* @__PURE__ */ new Set();
+    queuedNames = /* @__PURE__ */ new Set();
+    owners = /* @__PURE__ */ new Map();
+    active = 0;
+  }
+});
+
 // src/github/drift.ts
-import { inArray as inArray4, sql as sql7 } from "drizzle-orm";
+import { and as and7, eq as eq8, inArray as inArray4, sql as sql7 } from "drizzle-orm";
 import semver2 from "semver";
 function declaredDeps(manifests) {
   const out = /* @__PURE__ */ new Map();
@@ -4706,7 +5203,7 @@ function declaredDeps(manifests) {
   }
   return out;
 }
-async function loadIndexed(db, names2) {
+async function loadIndexed(db, names2, ecosystem = DEFAULT_ECOSYSTEM) {
   const out = /* @__PURE__ */ new Map();
   for (let i = 0; i < names2.length; i += NAME_CHUNK) {
     const rows = await db.select({
@@ -4714,7 +5211,12 @@ async function loadIndexed(db, names2) {
       latestVersion: packages.latestVersion,
       deprecated: packages.deprecated,
       advisories: packages.advisories
-    }).from(packages).where(inArray4(packages.name, names2.slice(i, i + NAME_CHUNK)));
+    }).from(packages).where(
+      and7(
+        inArray4(packages.name, names2.slice(i, i + NAME_CHUNK)),
+        eq8(packages.ecosystem, ecosystem)
+      )
+    );
     for (const row of rows) {
       out.set(row.name, {
         latestVersion: row.latestVersion,
@@ -4730,8 +5232,8 @@ async function loadVersions(db, names2) {
   for (let i = 0; i < names2.length; i += NAME_CHUNK) {
     const rows = await db.select({ name: packageVersions.packageName, version: packageVersions.version }).from(packageVersions).where(inArray4(packageVersions.packageName, names2.slice(i, i + NAME_CHUNK)));
     for (const row of rows) {
-      const list = out.get(row.name);
-      if (list) list.push(row.version);
+      const list2 = out.get(row.name);
+      if (list2) list2.push(row.version);
       else out.set(row.name, [row.version]);
     }
   }
@@ -4848,7 +5350,15 @@ async function conflictsAtCurrent(db, deps) {
   }));
   return resolveArchitectureCompat(members).slice(0, REPO_DRIFT_DETAIL_CAP);
 }
-async function computeDrift(db, manifests, resolvedTree = null) {
+function queueUntracked(db, names2, ownerId) {
+  if (names2.length === 0) return;
+  void Promise.resolve().then(() => (init_ingestQueue(), ingestQueue_exports)).then(({ enqueueIngest: enqueueIngest2 }) => {
+    for (const name of names2) enqueueIngest2(db, name, ownerId);
+  }).catch((err) => {
+    logger.debug(`untracked-dep enqueue failed: ${String(err)}`);
+  });
+}
+async function computeDrift(db, manifests, resolvedTree = null, requestedByOwnerId = null) {
   const declared = declaredDeps(manifests);
   const names2 = [...declared.keys()];
   const directNames = new Set(names2);
@@ -4877,6 +5387,11 @@ async function computeDrift(db, manifests, resolvedTree = null) {
     loadIndexed(db, names2),
     loadVersions(db, names2)
   ]);
+  queueUntracked(
+    db,
+    names2.filter((name) => !indexed.has(name)),
+    requestedByOwnerId
+  );
   const deps = [];
   for (const [name, entry] of declared) {
     const row = indexed.get(name);
@@ -4906,12 +5421,14 @@ var init_drift = __esm({
   "src/github/drift.ts"() {
     "use strict";
     init_esm_shims();
+    init_logger();
     init_schema();
     init_types2();
     init_attribute();
     init_osv();
     init_members();
     init_peerCompat();
+    init_types();
     NAME_CHUNK = 500;
   }
 });
@@ -4969,14 +5486,6 @@ var init_alerts2 = __esm({
   }
 });
 
-// src/core/concurrency.ts
-var init_concurrency = __esm({
-  "src/core/concurrency.ts"() {
-    "use strict";
-    init_esm_shims();
-  }
-});
-
 // src/core/errors.ts
 function truncate(text2, max) {
   if (text2.length <= max) return text2;
@@ -5086,20 +5595,39 @@ var init_runtimeTarget = __esm({
   }
 });
 
+// src/db/watch.ts
+import { eq as eq9 } from "drizzle-orm";
+async function getWatchCursor(db, id) {
+  const rows = await db.select({ seq: watchState.seq }).from(watchState).where(eq9(watchState.id, id)).limit(1);
+  return rows[0]?.seq ?? null;
+}
+async function setWatchCursor(db, id, seq) {
+  await db.insert(watchState).values({ id, seq, updatedAt: /* @__PURE__ */ new Date() }).onConflictDoUpdate({ target: watchState.id, set: { seq, updatedAt: /* @__PURE__ */ new Date() } });
+}
+var init_watch = __esm({
+  "src/db/watch.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_schema();
+  }
+});
+
 // src/pipeline/mineEdges.ts
-function trackedPairs(nodes, tracked) {
+function trackedPairs(nodes, tracked, mustTouch) {
   const t = nodes.filter((n) => tracked.has(n.name));
   const pairs = [];
   for (let i = 0; i < t.length; i++) {
     for (let j = i + 1; j < t.length; j++) {
       if (t[i].name === t[j].name) continue;
+      if (mustTouch && !mustTouch.has(t[i].name) && !mustTouch.has(t[j].name)) continue;
       pairs.push(canonicalPair(t[i], t[j]));
     }
   }
   return pairs;
 }
-async function mintObservedPairs(db, nodes, tracked, now, freshWitness) {
-  const pairs = trackedPairs(nodes, tracked);
+async function mintObservedPairs(db, nodes, tracked, now, freshWitness, mustTouch) {
+  const pairs = trackedPairs(nodes, tracked, mustTouch);
+  if (pairs.length === 0) return 0;
   const rows = pairs.map((pair) => ({
     ...pair,
     status: "compatible",
@@ -5132,6 +5660,7 @@ var init_mineEdges = __esm({
     init_errors();
     init_logger();
     init_packages();
+    init_watch();
     init_compat();
     init_depsDev();
   }
@@ -5208,84 +5737,17 @@ var init_sync = __esm({
   }
 });
 
-// src/pipeline/ingestQueue.ts
-function enqueueIngest(db, name, requestedByOwnerId = null) {
-  if (queuedNames.has(name) || inFlight2.has(name)) return;
-  if (pending.length >= MAX_PENDING) {
-    logger.warn(`ingest queue full (${MAX_PENDING}); dropping on-demand request for ${name}`);
-    return;
-  }
-  queuedNames.add(name);
-  owners.set(name, requestedByOwnerId);
-  pending.push(name);
-  pump(db);
-}
-function pump(db) {
-  while (active < MAX_CONCURRENT && pending.length > 0) {
-    const name = pending.shift();
-    queuedNames.delete(name);
-    const owner = owners.get(name) ?? null;
-    owners.delete(name);
-    inFlight2.add(name);
-    active += 1;
-    void runIngest(db, name, owner).finally(() => {
-      inFlight2.delete(name);
-      active -= 1;
-      pump(db);
-    });
-  }
+// src/pipeline/single.ts
+import { and as and8, eq as eq10, isNotNull as isNotNull3, sql as sql8 } from "drizzle-orm";
+async function getSeedCategory(db, name) {
+  const [row] = await db.select({ category: seedPackages.category }).from(seedPackages).where(eq10(seedPackages.name, name)).limit(1);
+  return row?.category ?? null;
 }
-async function runIngest(db, name, requestedByOwnerId = null) {
-  try {
-    const row = await syncOnePackage(db, name, { requestedByOwnerId });
-    if (row.confidence && row.confidence !== "unproven") {
-      await ensureSeedEntry(db, name, row.category).catch(() => {
-      });
-    }
-    return row;
-  } catch (err) {
-    logger.warn(`on-demand ingest failed for ${name}: ${String(err)}`);
-    return null;
-  }
-}
-var MAX_CONCURRENT, MAX_PENDING, pending, inFlight2, queuedNames, owners, active;
-var init_ingestQueue = __esm({
-  "src/pipeline/ingestQueue.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_logger();
-    init_packages();
-    init_single();
-    MAX_CONCURRENT = 3;
-    MAX_PENDING = 500;
-    pending = [];
-    inFlight2 = /* @__PURE__ */ new Set();
-    queuedNames = /* @__PURE__ */ new Set();
-    owners = /* @__PURE__ */ new Map();
-    active = 0;
-  }
-});
-
-// src/pipeline/single.ts
-import { and as and6, eq as eq8, isNotNull as isNotNull3, sql as sql8 } from "drizzle-orm";
-function raceTimeout(p, ms) {
-  let timer;
-  return Promise.race([
-    p,
-    new Promise((resolve) => {
-      timer = setTimeout(() => resolve(null), ms);
-    })
-  ]).finally(() => clearTimeout(timer));
-}
-async function getSeedCategory(db, name) {
-  const [row] = await db.select({ category: seedPackages.category }).from(seedPackages).where(eq8(seedPackages.name, name)).limit(1);
-  return row?.category ?? null;
-}
-async function getCategoryMedianBundle(db, category) {
-  const [row] = await db.select({
-    m: sql8`percentile_cont(0.5) within group (order by ${packages.bundleMinGzipKb})`
-  }).from(packages).where(and6(eq8(packages.category, category), isNotNull3(packages.bundleMinGzipKb)));
-  return row?.m ?? null;
+async function getCategoryMedianBundle(db, category) {
+  const [row] = await db.select({
+    m: sql8`percentile_cont(0.5) within group (order by ${packages.bundleMinGzipKb})`
+  }).from(packages).where(and8(eq10(packages.category, category), isNotNull3(packages.bundleMinGzipKb)));
+  return row?.m ?? null;
 }
 async function syncOnePackage(db, name, opts = {}) {
   const config = getConfig();
@@ -5372,7 +5834,7 @@ async function getOrFetchPackage(db, name, opts = {}) {
   const exists = await npmPackageExists(name);
   if (!exists) return { row: null, wasTracked: false, existsOnNpm: false };
   if (opts.blockMs && opts.blockMs > 0) {
-    const row = await raceTimeout(runIngest(db, name, opts.requestedByOwnerId ?? null), opts.blockMs);
+    const row = await withBudget(runIngest(db, name, opts.requestedByOwnerId ?? null), opts.blockMs);
     if (row) return { row, wasTracked: false, existsOnNpm: true };
     return { row: null, wasTracked: false, existsOnNpm: true, queued: true };
   }
@@ -5384,6 +5846,7 @@ var init_single = __esm({
   "src/pipeline/single.ts"() {
     "use strict";
     init_esm_shims();
+    init_concurrency();
     init_config();
     init_logger();
     init_collect();
@@ -5404,7 +5867,12 @@ var init_single = __esm({
 });
 
 // src/search/recommend.ts
-import { and as and7, cosineDistance, eq as eq9, inArray as inArray5, isNotNull as isNotNull4, lte, sql as sql9 } from "drizzle-orm";
+import { and as and9, cosineDistance, eq as eq11, inArray as inArray5, isNotNull as isNotNull4, lte, sql as sql9 } from "drizzle-orm";
+function rankScore(row, relevance, lambda) {
+  const composite = computeComposite(row.healthScore ?? 0, row.qualityScore, lambda) / 100;
+  const confidence = CONFIDENCE_WEIGHT[row.confidence ?? "unproven"] ?? 0;
+  return RANKING.relevance * relevance + RANKING.composite * composite + RANKING.confidence * confidence;
+}
 async function recommend(db, opts, provider = createEmbeddingProvider()) {
   const limit = Math.min(Math.max(opts.limit ?? 3, 1), 5);
   const [queryVec] = await provider.embed([opts.need]);
@@ -5420,11 +5888,10 @@ async function recommend(db, opts, provider = createEmbeddingProvider()) {
   if (fused.length === 0) return [];
   const lambda = loadWeights().composite.lambda;
   const maxRrf = Math.max(...fused.map((f) => f.rrf));
-  const ranked = fused.map((f) => {
-    const relevance = maxRrf > 0 ? f.rrf / maxRrf : 0;
-    const composite = computeComposite(f.row.healthScore ?? 0, f.row.qualityScore, lambda) / 100;
-    return { row: f.row, score: RELEVANCE_WEIGHT * relevance + COMPOSITE_WEIGHT * composite };
-  }).sort((a, b) => b.score - a.score).slice(0, limit);
+  const ranked = fused.map((f) => ({
+    row: f.row,
+    score: rankScore(f.row, maxRrf > 0 ? f.rrf / maxRrf : 0, lambda)
+  })).sort((a, b) => b.score - a.score).slice(0, limit);
   return ranked.map(({ row }) => toCandidate(row));
 }
 async function hybridSearch(db, queryVec, providerId, need, constraints, category, pool) {
@@ -5436,8 +5903,8 @@ async function hybridSearch(db, queryVec, providerId, need, constraints, categor
 }
 function rrfFuse(lists, k = RRF_K) {
   const fused = /* @__PURE__ */ new Map();
-  for (const list of lists) {
-    list.forEach((row, idx) => {
+  for (const list2 of lists) {
+    list2.forEach((row, idx) => {
       const contribution = 1 / (k + idx + 1);
       const prev = fused.get(row.name);
       if (prev) prev.rrf += contribution;
@@ -5448,14 +5915,14 @@ function rrfFuse(lists, k = RRF_K) {
 }
 function buildConditions(constraints, category) {
   const conditions = [];
-  if (category) conditions.push(eq9(packages.category, category));
-  if (constraints?.license) conditions.push(eq9(packages.license, constraints.license));
+  if (category) conditions.push(eq11(packages.category, category));
+  if (constraints?.license) conditions.push(eq11(packages.license, constraints.license));
   if (constraints?.maxBundleKb !== void 0) {
     conditions.push(lte(packages.bundleMinGzipKb, constraints.maxBundleKb));
   }
   if (constraints?.minConfidence) {
     const allowed = ["proven", "emerging", "promising", "unproven"].filter(
-      (c) => CONFIDENCE_RANK[c] >= CONFIDENCE_RANK[constraints.minConfidence]
+      (c) => CONFIDENCE_ORDER[c] >= CONFIDENCE_ORDER[constraints.minConfidence]
     );
     conditions.push(inArray5(packages.confidence, allowed));
   }
@@ -5465,16 +5932,16 @@ async function runVectorQuery(db, queryVec, providerId, constraints, category, p
   const distance = cosineDistance(packages.embedding, queryVec);
   const conditions = [
     isNotNull4(packages.embedding),
-    eq9(packages.embeddingProvider, providerId),
+    eq11(packages.embeddingProvider, providerId),
     ...buildConditions(constraints, category)
   ];
-  return db.select(ROW_COLUMNS).from(packages).where(and7(...conditions)).orderBy(distance).limit(pool);
+  return db.select(ROW_COLUMNS).from(packages).where(and9(...conditions)).orderBy(distance).limit(pool);
 }
 async function runLexicalQuery(db, need, constraints, category, pool) {
   const tsquery = sql9`websearch_to_tsquery('english', ${need})`;
   const rank2 = sql9`ts_rank(${packages.searchVector}, ${tsquery})`;
   const conditions = [sql9`${packages.searchVector} @@ ${tsquery}`, ...buildConditions(constraints, category)];
-  return db.select(ROW_COLUMNS).from(packages).where(and7(...conditions)).orderBy(sql9`${rank2} desc`).limit(pool);
+  return db.select(ROW_COLUMNS).from(packages).where(and9(...conditions)).orderBy(sql9`${rank2} desc`).limit(pool);
 }
 function toCandidate(row) {
   return {
@@ -5487,22 +5954,32 @@ function toCandidate(row) {
     latestVersion: row.latestVersion,
     weeklyDownloads: row.weeklyDownloads,
     lastReleaseAt: row.lastReleaseAt ? row.lastReleaseAt.toISOString() : null,
-    repoUrl: row.repoUrl
+    repoUrl: row.repoUrl,
+    deprecated: row.deprecated ?? false,
+    archived: row.archived ?? false,
+    advisories: Number(row.advisories ?? 0)
   };
 }
 function buildWhy(row) {
+  const warnings = [];
+  if (row.deprecated) warnings.push("DEPRECATED");
+  if (row.archived) warnings.push("repo archived");
+  if (row.advisories) {
+    warnings.push(`${row.advisories} advisor${row.advisories === 1 ? "y" : "ies"}`);
+  }
   const parts = [];
   if (row.confidence) parts.push(row.confidence);
   if (row.weeklyDownloads) parts.push(`${formatDownloads(row.weeklyDownloads)} weekly downloads`);
   if (row.healthScore !== null) parts.push(`health ${row.healthScore}`);
-  return parts.join(", ") || "tracked package";
+  const rationale = parts.join(", ") || "tracked package";
+  return warnings.length ? `${warnings.join(" + ")} \u2014 ${rationale}` : rationale;
 }
 function formatDownloads(n) {
   if (n >= 1e6) return `${Math.round(n / 1e5) / 10}M`;
   if (n >= 1e3) return `${Math.round(n / 1e3)}k`;
   return String(n);
 }
-var CONFIDENCE_RANK, RELEVANCE_WEIGHT, COMPOSITE_WEIGHT, RRF_K, ROW_COLUMNS;
+var CONFIDENCE_ORDER, RRF_K, ROW_COLUMNS;
 var init_recommend = __esm({
   "src/search/recommend.ts"() {
     "use strict";
@@ -5512,14 +5989,12 @@ var init_recommend = __esm({
     init_weights();
     init_categoryInference();
     init_embeddings();
-    CONFIDENCE_RANK = {
+    CONFIDENCE_ORDER = {
       unproven: 0,
       promising: 1,
       emerging: 2,
       proven: 3
     };
-    RELEVANCE_WEIGHT = 0.6;
-    COMPOSITE_WEIGHT = 0.4;
     RRF_K = 60;
     ROW_COLUMNS = {
       name: packages.name,
@@ -5530,7 +6005,14 @@ var init_recommend = __esm({
       latestVersion: packages.latestVersion,
       weeklyDownloads: packages.weeklyDownloads,
       lastReleaseAt: packages.lastReleaseAt,
-      repoUrl: packages.repoUrl
+      repoUrl: packages.repoUrl,
+      deprecated: packages.deprecated,
+      archived: packages.archived,
+      // The count, not the array: an agent shortlisting five packages needs to know
+      // that one carries advisories, and `evaluate` is where it reads which. Pulling
+      // the jsonb payload for every candidate would cost tokens on every call for
+      // detail the next call already serves.
+      advisories: sql9`coalesce(jsonb_array_length(${packages.advisories}), 0)`
     };
   }
 });
@@ -5571,7 +6053,7 @@ function check(policy, pkg, facts) {
     };
   }
   if (policy.minConfidence) {
-    if (CONFIDENCE_RANK2[pkg.confidence] < CONFIDENCE_RANK2[policy.minConfidence]) {
+    if (CONFIDENCE_RANK[pkg.confidence] < CONFIDENCE_RANK[policy.minConfidence]) {
       return {
         name,
         rule: "confidence",
@@ -5581,12 +6063,12 @@ function check(policy, pkg, facts) {
   }
   return null;
 }
-var CONFIDENCE_RANK2;
+var CONFIDENCE_RANK;
 var init_enforce = __esm({
   "src/policy/enforce.ts"() {
     "use strict";
     init_esm_shims();
-    CONFIDENCE_RANK2 = {
+    CONFIDENCE_RANK = {
       unproven: 0,
       promising: 1,
       emerging: 2,
@@ -5612,10 +6094,10 @@ var init_types3 = __esm({
 });
 
 // src/db/selectionPolicy.ts
-import { eq as eq10, inArray as inArray6 } from "drizzle-orm";
+import { and as and10, eq as eq12, inArray as inArray6 } from "drizzle-orm";
 async function getSelectionPolicy(db, ownerId) {
   if (!ownerId) return DEFAULT_SELECTION_POLICY;
-  const [row] = await db.select({ policy: selectionPolicies.policy }).from(selectionPolicies).where(eq10(selectionPolicies.ownerId, ownerId)).limit(1);
+  const [row] = await db.select({ policy: selectionPolicies.policy }).from(selectionPolicies).where(eq12(selectionPolicies.ownerId, ownerId)).limit(1);
   return row ? { ...DEFAULT_SELECTION_POLICY, ...row.policy } : DEFAULT_SELECTION_POLICY;
 }
 async function setSelectionPolicy(db, ownerId, policy) {
@@ -5624,14 +6106,14 @@ async function setSelectionPolicy(db, ownerId, policy) {
     set: { policy, updatedAt: /* @__PURE__ */ new Date() }
   });
 }
-async function loadPolicyFacts(db, names2) {
+async function loadPolicyFacts(db, names2, ecosystem = DEFAULT_ECOSYSTEM) {
   const out = /* @__PURE__ */ new Map();
   if (names2.length === 0) return out;
   const rows = await db.select({
     name: packages.name,
     license: packages.license,
     deprecated: packages.deprecated
-  }).from(packages).where(inArray6(packages.name, names2));
+  }).from(packages).where(and10(inArray6(packages.name, names2), eq12(packages.ecosystem, ecosystem)));
   for (const row of rows) {
     out.set(row.name, { license: row.license, deprecated: row.deprecated });
   }
@@ -5642,6 +6124,7 @@ var init_selectionPolicy = __esm({
     "use strict";
     init_esm_shims();
     init_schema();
+    init_types();
     init_types3();
   }
 });
@@ -6060,6 +6543,12 @@ async function handleEvaluate(db, input, ownerId = null) {
   );
   return { ...evaluated, policy: exclusion ? { allowed: false, ...exclusion } : { allowed: true } };
 }
+function comparisonNote(notFound, pending2) {
+  return [
+    notFound.length ? `Not found on the npm registry: ${notFound.join(", ")}. Check the name(s) before installing \u2014 these do not exist.` : null,
+    pending2.length ? `\u{1F389} You're the first to add ${pending2.join(", ")} to lurq's registry! They're being scored now; retry shortly for the full comparison.` : null
+  ].filter(Boolean).join(" ");
+}
 async function handleCompare(db, input, ownerId = null) {
   const out = await cached2(
     "cmp",
@@ -6069,17 +6558,28 @@ async function handleCompare(db, input, ownerId = null) {
         input.packages.map((name) => getOrFetchPackage(db, name, { requestedByOwnerId: ownerId }))
       );
       const rows = results.map((r) => r.row).filter((row) => row !== null).map((row) => rowToEvaluate(row)).sort((a, b) => b.healthScore - a.healthScore);
-      const missing = input.packages.filter((name) => !rows.some((r) => r.name === name));
+      const missing2 = [];
+      const notFound = [];
+      const pending2 = [];
+      input.packages.forEach((name, i) => {
+        const result = results[i];
+        if (result.row) return;
+        missing2.push(name);
+        (result.existsOnNpm ? pending2 : notFound).push(name);
+      });
       return {
         dataAsOf: await latestDataAsOf(db),
         rows,
-        ...missing.length ? {
-          missing,
-          note: "\u{1F389} You're the first to add these to lurq's registry! They're being scored now; retry shortly for the full comparison."
-        } : {}
+        // `missing` stays the union, in the caller's own order, so a client
+        // pinned to an older lurq keeps printing its "not found" line.
+        ...missing2.length ? { missing: missing2 } : {},
+        ...notFound.length ? { notFound } : {},
+        ...pending2.length ? { pending: pending2 } : {},
+        ...missing2.length ? { note: comparisonNote(notFound, pending2) } : {}
       };
     },
-    // Don't cache a transient miss (a package that momentarily failed to fetch).
+    // Don't cache a miss: a pending ingest lands within seconds, and a name that
+    // is not on npm today may be published tomorrow.
     { skipCache: (r) => Boolean(r.missing?.length) }
   );
   out.rows = out.rows.map(refreshStale);
@@ -6169,14 +6669,18 @@ async function handleVerify(db, input, ownerId = null) {
   };
 }
 async function resolveVersion(db, name, requested) {
-  if (requested) return requested;
+  if (requested) {
+    const exists = await npmVersionExists(name, requested);
+    return exists === false ? { version: null, unpublished: true } : { version: requested };
+  }
   const row = await getPackageByName(db, name);
-  if (row?.latestVersion) return row.latestVersion;
+  if (row?.latestVersion) return { version: row.latestVersion };
   const reg = await fetchNpmRegistry(name).catch(() => null);
-  return reg?.latestVersion ?? null;
+  return { version: reg?.latestVersion ?? null };
 }
 async function handleUsage(db, input) {
-  const version = await resolveVersion(db, input.package, input.version);
+  const resolved = await resolveVersion(db, input.package, input.version);
+  const version = resolved.version;
   if (!version) {
     return {
       package: input.package,
@@ -6184,7 +6688,8 @@ async function handleUsage(db, input) {
       surface: null,
       available: false,
       engines: null,
-      note: `Could not resolve a version for "${input.package}" on npm.`
+      note: resolved.unpublished ? `"${input.package}" has no published version ${input.version}. That release does not exist on the npm registry \u2014 check the version before writing code against it.` : `Could not resolve a version for "${input.package}" on npm.`,
+      ...resolved.unpublished ? { unpublishedVersion: input.version } : {}
     };
   }
   const deadline = Date.now() + USAGE_EXTRACT_BUDGET_MS;
@@ -6207,6 +6712,10 @@ async function handleUsage(db, input) {
       budgetMs: Math.max(0, deadline - Date.now())
     });
     if (known) out.delta = { ...diffSurface(known, surface), fromVersion: input.knownVersion };
+    else {
+      const knownExists = await npmVersionExists(input.package, input.knownVersion);
+      out.deltaNote = knownExists === false ? `No delta: "${input.package}" has no published version ${input.knownVersion}. That release does not exist on the npm registry.` : `No delta: no API surface extracted for ${input.package}@${input.knownVersion} yet. Retry shortly, or compare against a version that has been indexed.`;
+    }
   }
   return out;
 }
@@ -6262,7 +6771,8 @@ __export(remote_exports, {
   apiKey: () => apiKey,
   callTool: () => callTool,
   endpoint: () => endpoint,
-  fetchUpgradePlan: () => fetchUpgradePlan
+  fetchUpgradePlan: () => fetchUpgradePlan,
+  reportUpgradeRuns: () => reportUpgradeRuns
 });
 function endpoint(override) {
   const base = resolveEndpoint(override) ?? DEFAULT_ENDPOINT;
@@ -6356,6 +6866,9 @@ function fetchUpgradePlan(deps, opts = {}) {
   const body = opts.repo ? { deps, repo: opts.repo } : { deps };
   return post("/upgrade-plan", body, opts);
 }
+function reportUpgradeRuns(runs, opts = {}) {
+  return post("/upgrade-runs", { runs }, opts);
+}
 var RemoteError;
 var init_remote = __esm({
   "src/cli/remote.ts"() {
@@ -6449,7 +6962,7 @@ var init_optimize = __esm({
 });
 
 // src/mcp/diagram.ts
-import { inArray as inArray7 } from "drizzle-orm";
+import { and as and11, eq as eq13, inArray as inArray7 } from "drizzle-orm";
 function layerFor(item) {
   if (!item.category) return UNCLASSIFIED;
   if (item.category === "framework" && item.runtimeTarget === "node") return "Backend";
@@ -6462,19 +6975,19 @@ function buildMermaid(items) {
   const byLayer = /* @__PURE__ */ new Map();
   for (const item of items) {
     const layer = layerFor(item);
-    const list = byLayer.get(layer) ?? [];
-    list.push(item);
-    byLayer.set(layer, list);
+    const list2 = byLayer.get(layer) ?? [];
+    list2.push(item);
+    byLayer.set(layer, list2);
   }
   const lines = ["flowchart TD", "  user([User])"];
   const ids = /* @__PURE__ */ new Map();
   let counter = 0;
   const repNode = /* @__PURE__ */ new Map();
   const emitLayer = (layer) => {
-    const list = byLayer.get(layer);
-    if (!list?.length) return;
+    const list2 = byLayer.get(layer);
+    if (!list2?.length) return;
     lines.push(`  subgraph ${layer.replace(/\s+/g, "_")}["${layer}"]`);
-    for (const item of list) {
+    for (const item of list2) {
       const id = nodeId(item.label, counter++);
       ids.set(item.label, id);
       if (!repNode.has(layer)) repNode.set(layer, id);
@@ -6506,7 +7019,9 @@ async function handleDiagram(db, input) {
     name: packages.name,
     category: packages.category,
     runtimeTarget: packages.runtimeTarget
-  }).from(packages).where(inArray7(packages.name, input.stack));
+  }).from(packages).where(
+    and11(inArray7(packages.name, input.stack), eq13(packages.ecosystem, DEFAULT_ECOSYSTEM))
+  );
   const known = new Map(rows.map((r) => [r.name, r]));
   const items = input.stack.map((name) => {
     const row = known.get(name);
@@ -6535,6 +7050,7 @@ var init_diagram = __esm({
   "src/mcp/diagram.ts"() {
     "use strict";
     init_esm_shims();
+    init_types();
     init_categoryInference();
     init_runtimeTarget();
     init_schema();
@@ -6578,7 +7094,7 @@ __export(plan_exports, {
   resolvePins: () => resolvePins
 });
 import { createHash as createHash4 } from "crypto";
-import { inArray as inArray8 } from "drizzle-orm";
+import { and as and12, eq as eq14, inArray as inArray8 } from "drizzle-orm";
 function packageToCandidate(row) {
   return {
     name: row.name,
@@ -6590,17 +7106,24 @@ function packageToCandidate(row) {
     latestVersion: row.latestVersion,
     weeklyDownloads: row.weeklyDownloads,
     lastReleaseAt: row.lastReleaseAt ? row.lastReleaseAt.toISOString() : null,
-    repoUrl: row.repoUrl
+    repoUrl: row.repoUrl,
+    // A pin is the one slot lurq did not choose, which makes these MORE worth
+    // saying, not less: the user picked it, so nobody else is going to notice
+    // that it has been deprecated since they did.
+    deprecated: row.deprecated,
+    archived: row.archived,
+    advisories: row.advisories?.length ?? 0
   };
 }
 async function resolvePins(db, using, recommendedNames, requestedByOwnerId = null) {
   const slots = [];
-  const unresolved = [];
+  const notFound = [];
+  const pending2 = [];
   for (const name of new Set(using ?? [])) {
     if (recommendedNames.has(name)) continue;
-    const { row } = await getOrFetchPackage(db, name, { requestedByOwnerId });
+    const { row, existsOnNpm } = await getOrFetchPackage(db, name, { requestedByOwnerId });
     if (!row) {
-      unresolved.push(name);
+      (existsOnNpm ? pending2 : notFound).push(name);
       continue;
     }
     slots.push({
@@ -6613,7 +7136,7 @@ async function resolvePins(db, using, recommendedNames, requestedByOwnerId = nul
       note: "pinned by you"
     });
   }
-  return { slots, unresolved };
+  return { slots, notFound, pending: pending2 };
 }
 async function handlePlan(db, input, ownerId = null) {
   const optimize = input.optimize ?? "balanced";
@@ -6670,17 +7193,20 @@ async function handlePlan(db, input, ownerId = null) {
   const recommendedNames = new Set(
     recSlots.map((s) => s.recommended?.name).filter((n) => Boolean(n))
   );
-  const { slots: pinnedSlots, unresolved: unresolvedPins } = await resolvePins(
-    db,
-    input.using,
-    recommendedNames,
-    ownerId
-  );
+  const {
+    slots: pinnedSlots,
+    notFound: pinsNotFound,
+    pending: pinsPending
+  } = await resolvePins(db, input.using, recommendedNames, ownerId);
   const slots = [...pinnedSlots, ...recSlots];
   const compatibility = await resolveCompat(db, slots);
   const unmatched = [
     ...slots.filter((s) => !s.recommended).map((s) => s.need),
-    ...unresolvedPins.map((n) => `${n} (pinned, but not found on npm)`)
+    ...pinsNotFound.map((n) => `${n} (pinned, but not on the npm registry)`),
+    // A pin that exists and is merely being ingested is not an unmatched need —
+    // it just has no scores yet. Saying so keeps the user from "fixing" a name
+    // that was correct all along.
+    ...pinsPending.map((n) => `${n} (pinned; being scored now, retry shortly)`)
   ];
   const mermaid = buildMermaid(
     slots.filter((s) => s.recommended).map((s) => ({ label: s.recommended.name, category: s.category }))
@@ -6799,7 +7325,7 @@ function orderCandidates(cands, anchorFamily, optimize, bundleByName) {
 async function bundleSizes(db, candidates) {
   const names2 = [...new Set(candidates.map((c) => c.name))];
   if (names2.length === 0) return /* @__PURE__ */ new Map();
-  const rows = await db.select({ name: packages.name, bundle: packages.bundleMinGzipKb }).from(packages).where(inArray8(packages.name, names2));
+  const rows = await db.select({ name: packages.name, bundle: packages.bundleMinGzipKb }).from(packages).where(and12(inArray8(packages.name, names2), eq14(packages.ecosystem, DEFAULT_ECOSYSTEM)));
   return new Map(rows.filter((r) => r.bundle != null).map((r) => [r.name, r.bundle]));
 }
 async function decompose(document) {
@@ -6871,6 +7397,7 @@ var init_plan = __esm({
   "src/mcp/plan.ts"() {
     "use strict";
     init_esm_shims();
+    init_types();
     init_config();
     init_http();
     init_check();
@@ -6986,17 +7513,20 @@ var init_planView = __esm({
   }
 });
 
-// src/db/watch.ts
-import { eq as eq11 } from "drizzle-orm";
-async function getWatchCursor(db, id) {
-  const rows = await db.select({ seq: watchState.seq }).from(watchState).where(eq11(watchState.id, id)).limit(1);
-  return rows[0]?.seq ?? null;
+// src/db/discovery.ts
+import { eq as eq15 } from "drizzle-orm";
+async function getQueuedNames(db) {
+  const rows = await db.select({ name: discoveryQueue.name }).from(discoveryQueue);
+  return new Set(rows.map((r) => r.name));
 }
-async function setWatchCursor(db, id, seq) {
-  await db.insert(watchState).values({ id, seq, updatedAt: /* @__PURE__ */ new Date() }).onConflictDoUpdate({ target: watchState.id, set: { seq, updatedAt: /* @__PURE__ */ new Date() } });
+async function enqueueCandidates(db, candidates) {
+  if (candidates.length === 0) return 0;
+  const rows = candidates.map((c) => ({ name: c.name, discoveredVia: c.via }));
+  const inserted = await db.insert(discoveryQueue).values(rows).onConflictDoNothing({ target: discoveryQueue.name }).returning({ id: discoveryQueue.id });
+  return inserted.length;
 }
-var init_watch = __esm({
-  "src/db/watch.ts"() {
+var init_discovery = __esm({
+  "src/db/discovery.ts"() {
     "use strict";
     init_esm_shims();
     init_schema();
@@ -7006,56 +7536,104 @@ var init_watch = __esm({
 // src/pipeline/watch.ts
 var watch_exports = {};
 __export(watch_exports, {
-  parseChangeLine: () => parseChangeLine,
+  fetchHeadSeq: () => fetchHeadSeq,
+  parseChange: () => parseChange,
+  parseChangesPage: () => parseChangesPage,
+  routeChange: () => routeChange,
   watchNpmChanges: () => watchNpmChanges
 });
-function parseChangeLine(line) {
-  const trimmed = line.trim();
-  if (!trimmed) return null;
-  try {
-    const obj = JSON.parse(trimmed);
-    if (typeof obj?.id !== "string" || obj.seq == null) return null;
-    return { seq: obj.seq, id: obj.id, deleted: Boolean(obj.deleted) };
-  } catch {
-    return null;
-  }
+function parseChange(obj) {
+  if (typeof obj !== "object" || obj === null) return null;
+  const rec = obj;
+  if (typeof rec.id !== "string" || rec.seq == null) return null;
+  if (typeof rec.seq !== "number" && typeof rec.seq !== "string") return null;
+  return { seq: rec.seq, id: rec.id, deleted: Boolean(rec.deleted) };
+}
+function parseChangesPage(body) {
+  if (typeof body !== "object" || body === null) return { changes: [], lastSeq: null };
+  const { results, last_seq: lastSeq } = body;
+  const changes = Array.isArray(results) ? results.map(parseChange).filter((c) => c !== null) : [];
+  return {
+    changes,
+    lastSeq: typeof lastSeq === "number" || typeof lastSeq === "string" ? String(lastSeq) : null
+  };
+}
+function routeChange(change2, tracked, queued) {
+  if (change2.deleted) return "skip";
+  if (tracked.has(change2.id)) return "resync";
+  if (queued.has(change2.id)) return "skip";
+  return "enqueue";
+}
+async function getJson(url, fetchImpl, signal) {
+  const res = await fetchImpl(url, { signal });
+  if (!res.ok) throw new Error(`feed responded ${res.status}`);
+  return res.json();
+}
+async function fetchHeadSeq(fetchImpl = fetch, signal) {
+  const body = await getJson(`${FEED_URL}?descending=true&limit=1`, fetchImpl, signal);
+  return parseChangesPage(body).lastSeq;
+}
+async function loadSeenSets(db) {
+  const [tracked, queued] = await Promise.all([getAllPackageNames(db), getQueuedNames(db)]);
+  return [new Set(tracked), queued];
 }
 async function watchNpmChanges(db, opts = {}) {
-  const { signal } = opts;
+  const { signal, fetchImpl = fetch } = opts;
   let backoff2 = 1e3;
+  let [tracked, queued] = await loadSeenSets(db);
+  let seenAt = Date.now();
+  let cursor = await getWatchCursor(db, FEED_ID) ?? opts.since ?? await fetchHeadSeq(fetchImpl, signal).catch(() => null);
+  if (cursor == null) {
+    logger.warn("watch: could not establish a starting sequence; giving up.");
+    return;
+  }
+  logger.info(
+    `watch: following from seq=${cursor} (${tracked.size} tracked, ${queued.size} queued)`
+  );
   while (!signal?.aborted) {
-    let tracked = new Set(await getAllPackageNames(db));
-    let trackedAt = Date.now();
-    const since = await getWatchCursor(db, FEED_ID) ?? opts.since ?? "now";
-    const url = `${FEED_URL}?feed=continuous&since=${encodeURIComponent(since)}&heartbeat=${HEARTBEAT_MS}`;
-    logger.info(`watch: connecting from seq=${since} (${tracked.size} tracked packages)`);
     try {
-      const res = await fetch(url, { signal });
-      if (!res.ok || !res.body) throw new Error(`feed responded ${res.status}`);
+      const url = `${FEED_URL}?since=${encodeURIComponent(cursor)}&limit=${PAGE_SIZE}`;
+      const { changes, lastSeq } = parseChangesPage(await getJson(url, fetchImpl, signal));
       backoff2 = 1e3;
-      let sinceCheckpoint = 0;
-      for await (const line of ndjsonLines(res.body, signal)) {
-        const change = parseChangeLine(line);
-        if (!change) continue;
-        const seq = String(change.seq);
-        sinceCheckpoint++;
-        if (Date.now() - trackedAt > TRACKED_REFRESH_MS) {
-          tracked = new Set(await getAllPackageNames(db));
-          trackedAt = Date.now();
-        }
-        if (!change.deleted && tracked.has(change.id)) {
-          logger.info(`watch: re-syncing ${change.id} (seq=${seq})`);
-          await syncOnePackage(db, change.id).catch(
-            (err) => logger.warn(`watch: re-sync failed for ${change.id}: ${String(err)}`)
+      if (Date.now() - seenAt > TRACKED_REFRESH_MS) {
+        [tracked, queued] = await loadSeenSets(db);
+        seenAt = Date.now();
+      }
+      const buffered = [];
+      const flush = async () => {
+        if (buffered.length === 0) return;
+        const batch = buffered.map((name) => ({ name, via: "npm-changes" }));
+        const inserted = await enqueueCandidates(db, batch).catch((err) => {
+          logger.warn(`watch: enqueue of ${batch.length} candidate(s) failed: ${String(err)}`);
+          return 0;
+        });
+        if (inserted > 0) logger.info(`watch: queued ${inserted} new discovery candidate(s)`);
+        buffered.length = 0;
+      };
+      let resynced = 0;
+      for (const change2 of changes) {
+        if (signal?.aborted) break;
+        const route = routeChange(change2, tracked, queued);
+        if (route === "resync") {
+          await syncOnePackage(db, change2.id).catch(
+            (err) => logger.warn(`watch: re-sync failed for ${change2.id}: ${String(err)}`)
           );
-          await setWatchCursor(db, FEED_ID, seq);
-          sinceCheckpoint = 0;
-        } else if (sinceCheckpoint >= CHECKPOINT_EVERY) {
-          await setWatchCursor(db, FEED_ID, seq);
-          sinceCheckpoint = 0;
+          resynced++;
+        } else if (route === "enqueue") {
+          queued.add(change2.id);
+          buffered.push(change2.id);
+          if (buffered.length >= ENQUEUE_BATCH) await flush();
         }
       }
-      logger.info("watch: feed stream ended; reconnecting");
+      await flush();
+      if (lastSeq !== null && lastSeq !== cursor) {
+        cursor = lastSeq;
+        await setWatchCursor(db, FEED_ID, cursor);
+      }
+      if (changes.length > 0) {
+        logger.info(`watch: ${changes.length} change(s), ${resynced} re-synced, seq=${cursor}`);
+      }
+      if (changes.length < PAGE_SIZE) await sleep(IDLE_POLL_MS, signal);
     } catch (err) {
       if (signal?.aborted) break;
       logger.warn(`watch: ${String(err)}, retrying in ${backoff2}ms`);
@@ -7063,54 +7641,38 @@ async function watchNpmChanges(db, opts = {}) {
       backoff2 = Math.min(backoff2 * 2, MAX_BACKOFF_MS);
     }
   }
-}
-async function* ndjsonLines(body, signal) {
-  const reader = body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = "";
-  try {
-    while (!signal?.aborted) {
-      const { value, done } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      let nl;
-      while ((nl = buffer.indexOf("\n")) >= 0) {
-        yield buffer.slice(0, nl);
-        buffer = buffer.slice(nl + 1);
-      }
-    }
-  } finally {
-    reader.releaseLock();
-  }
+  logger.info("watch: stopped.");
 }
 function sleep(ms, signal) {
-  return new Promise((resolve) => {
-    const timer = setTimeout(resolve, ms);
+  return new Promise((resolve2) => {
+    const timer = setTimeout(resolve2, ms);
     signal?.addEventListener(
       "abort",
       () => {
         clearTimeout(timer);
-        resolve();
+        resolve2();
       },
       { once: true }
     );
   });
 }
-var FEED_ID, FEED_URL, HEARTBEAT_MS, TRACKED_REFRESH_MS, CHECKPOINT_EVERY, MAX_BACKOFF_MS;
+var FEED_ID, FEED_URL, PAGE_SIZE, IDLE_POLL_MS, TRACKED_REFRESH_MS, MAX_BACKOFF_MS, ENQUEUE_BATCH;
 var init_watch2 = __esm({
   "src/pipeline/watch.ts"() {
     "use strict";
     init_esm_shims();
     init_logger();
+    init_discovery();
     init_packages();
     init_watch();
     init_single();
     FEED_ID = "npm-changes";
     FEED_URL = "https://replicate.npmjs.com/_changes";
-    HEARTBEAT_MS = 3e4;
+    PAGE_SIZE = 1e3;
+    IDLE_POLL_MS = 3e4;
     TRACKED_REFRESH_MS = 5 * 6e4;
-    CHECKPOINT_EVERY = 200;
     MAX_BACKOFF_MS = 3e4;
+    ENQUEUE_BATCH = 200;
   }
 });
 
@@ -7711,6 +8273,7 @@ var init_compat2 = __esm({
 var commands_exports = {};
 __export(commands_exports, {
   indexSource: () => indexSource,
+  runCan: () => runCan,
   runCompare: () => runCompare,
   runCompat: () => runCompat,
   runCompatBackfill: () => runCompatBackfill,
@@ -7749,6 +8312,14 @@ async function fromIndex(tool, args, local) {
   const { callTool: callTool2 } = await Promise.resolve().then(() => (init_remote(), remote_exports));
   return callTool2(tool, args);
 }
+function candidateFlags(c) {
+  const flags = [
+    c.deprecated && red("deprecated"),
+    c.archived && yellow("archived"),
+    c.advisories ? yellow(`${c.advisories} advisory`) : null
+  ].filter(Boolean);
+  return flags.length ? flags.join(" ") : dim("\u2014");
+}
 async function runRecommend(need, opts) {
   if (opts.category && !isCategory(opts.category)) {
     throw new Error(`Unknown category "${opts.category}".`);
@@ -7767,7 +8338,7 @@ async function runRecommend(need, opts) {
   }
   console.log(
     table(
-      ["Package", "Health", "Quality", "Confidence", "Weekly", "Latest", "Category"],
+      ["Package", "Health", "Quality", "Confidence", "Weekly", "Latest", "Category", "Flags"],
       candidates.map((c) => [
         c.name,
         String(c.healthScore),
@@ -7775,7 +8346,11 @@ async function runRecommend(need, opts) {
         confidenceLabel(c.confidence),
         formatNumber(c.weeklyDownloads),
         c.latestVersion ?? "\u2014",
-        c.category ?? "\u2014"
+        c.category ?? "\u2014",
+        // Last, and the only coloured cell: it is the column that can reverse
+        // the decision the other seven are supporting, so it reads as a verdict
+        // at the end of the row rather than as one more attribute among them.
+        candidateFlags(c)
       ])
     )
   );
@@ -7873,10 +8448,31 @@ async function runCompare(pkgs, opts) {
       ])
     )
   );
-  if (res.missing?.length) console.log(dim(`
-not found: ${res.missing.join(", ")}`));
+  const notFound = res.notFound ?? (res.pending ? [] : res.missing ?? []);
+  if (notFound.length) console.log(red(`
+not on npm: ${notFound.join(", ")}`));
+  if (res.pending?.length) {
+    console.log(dim(`
+being scored now (retry shortly): ${res.pending.join(", ")}`));
+  }
   console.log(dim(`data as of ${formatDate(res.dataAsOf)}`));
 }
+function runCan(query, opts = {}) {
+  const matches = searchCapabilities(query, 5);
+  if (opts.json) {
+    console.log(JSON.stringify(matches, null, 2));
+    return;
+  }
+  if (!query.trim()) console.log(dim("Showing everything lurq does. Add words to narrow it.\n"));
+  for (const m of matches) {
+    console.log(bold(m.title));
+    console.log(`  ${m.answer}`);
+    if (m.cli) console.log(`  ${green("$")} ${m.cli}`);
+    if (m.mcp) console.log(dim(`  agents: call the \`${m.mcp}\` tool`));
+    if (m.page) console.log(dim(`  dashboard: https://lurq.run${m.page}`));
+    console.log("");
+  }
+}
 function runWeights(opts = {}) {
   const w = loadWeights();
   const active2 = activeWeightsPath();
@@ -7947,10 +8543,10 @@ async function runEditWeights(opts) {
   runWeights(opts);
 }
 async function runPlan(file, opts) {
-  const { readFileSync: readFileSync10 } = await import("fs");
+  const { readFileSync: readFileSync11 } = await import("fs");
   let document;
   try {
-    document = readFileSync10(file, "utf8");
+    document = readFileSync11(file, "utf8");
   } catch {
     throw new Error(`Could not read "${file}".`);
   }
@@ -8115,6 +8711,7 @@ async function runUsage(pkg, opts) {
     const reqs = Object.entries(res.engines).map(([k, v]) => `${k} ${v}`).join(", ");
     if (reqs) console.log(dim(`requires: ${reqs}`));
   }
+  if (res.unpublishedVersion) return console.log(red(res.note ?? "that version does not exist"));
   if (!res.available) return console.log(dim(res.note ?? "no API surface available"));
   console.log(
     table(
@@ -8137,6 +8734,9 @@ async function runUsage(pkg, opts) {
     if (!removed.length && !added.length && !renamed.length && !changed.length) {
       console.log(dim("  no API changes"));
     }
+  } else if (res.deltaNote) {
+    console.log(yellow(`
+${res.deltaNote}`));
   }
 }
 async function runCompatBackfill(opts) {
@@ -8243,6 +8843,7 @@ var init_commands = __esm({
     init_open();
     init_userConfig();
     init_types();
+    init_capabilities();
     init_client();
     init_packages();
     init_handlers();
@@ -8274,15 +8875,15 @@ function appJwt(creds, now = /* @__PURE__ */ new Date()) {
   const signature = createSign("RSA-SHA256").update(`${header}.${payload}`).sign(creds.privateKey);
   return `${header}.${payload}.${b64url(signature)}`;
 }
-async function installationToken(installationId) {
-  const cached3 = tokenCache.get(installationId);
+async function installationToken(installationId2) {
+  const cached3 = tokenCache.get(installationId2);
   if (cached3 && cached3.expiresAt - TOKEN_SKEW_MS > Date.now()) return cached3.token;
   const creds = githubAppCredentials();
   if (!creds) throw new GithubAppError("GitHub App is not configured.", 503);
   let res;
   try {
     res = await httpRequest(
-      `${API}/app/installations/${installationId}/access_tokens`,
+      `${API}/app/installations/${installationId2}/access_tokens`,
       {
         host: API_HOST,
         ttlMs: 0,
@@ -8307,7 +8908,7 @@ async function installationToken(installationId) {
   const token = res.data?.token;
   if (!token) throw new GithubAppError("GitHub returned no installation token.", 502);
   const expiresAt = res.data.expires_at ? Date.parse(res.data.expires_at) : NaN;
-  tokenCache.set(installationId, {
+  tokenCache.set(installationId2, {
     token,
     // A token with an unparseable expiry is still valid; treat it as short-lived
     // rather than caching it forever on a malformed timestamp.
@@ -8315,8 +8916,8 @@ async function installationToken(installationId) {
   });
   return token;
 }
-async function installationGet(installationId, path2) {
-  const token = await installationToken(installationId);
+async function installationGet(installationId2, path2) {
+  const token = await installationToken(installationId2);
   const res = await httpRequest(`${API}${path2}`, {
     host: API_HOST,
     ttlMs: 0,
@@ -8422,8 +9023,15 @@ jobs:
 
       # 2. Narrow that to symbols THIS repo references. Runs entirely locally
       #    against both versions' npm tarballs, no API key, no test suite.
+      #
+      #    \`--report\` is the only part that talks to us, and it is additive: it
+      #    posts what this check concluded so your dashboard can show it. A
+      #    missing key or an unreachable API prints a line and changes nothing
+      #    else, so the gate keeps working exactly as it does without it.
       - name: Check against this codebase
-        run: npx -y ${cli} check-upgrade . --plan lurq-plan.json --json > lurq-brief.json
+        env:
+          LURQ_API_KEY: \${{ secrets.LURQ_API_KEY }}
+        run: npx -y ${cli} check-upgrade . --plan lurq-plan.json --report --json > lurq-brief.json
 
       # The same report twice: once into the run summary, once as the body of
       # the pull request. Fenced, because the report is aligned plain text and
@@ -8547,22 +9155,23 @@ var init_workflow = __esm({
 });
 
 // src/github/manifests.ts
-async function listInstallationRepos(installationId) {
+async function listInstallationRepos(installationId2) {
   const out = [];
   for (let page = 1; page <= MAX_PAGES; page++) {
     const data = await installationGet(
-      installationId,
-      `/installation/repositories?per_page=${PAGE_SIZE}&page=${page}`
+      installationId2,
+      `/installation/repositories?per_page=${PAGE_SIZE2}&page=${page}`
     );
     const batch = data.repositories ?? [];
     for (const repo of batch) {
       out.push({
         fullName: repo.full_name,
         defaultBranch: repo.default_branch,
-        isPrivate: repo.private
+        isPrivate: repo.private,
+        pushedAt: repo.pushed_at ?? null
       });
     }
-    if (batch.length < PAGE_SIZE) break;
+    if (batch.length < PAGE_SIZE2) break;
   }
   return out;
 }
@@ -8589,9 +9198,9 @@ function parseManifest(path2, json2) {
   }
   return Object.keys(deps).length > 0 ? { path: path2, deps } : null;
 }
-async function fetchManifests(installationId, fullName, branch) {
+async function fetchManifests(installationId2, fullName, branch) {
   const tree = await installationGet(
-    installationId,
+    installationId2,
     `/repos/${fullName}/git/trees/${encodeURIComponent(branch)}?recursive=1`
   );
   const nodes = tree.tree ?? [];
@@ -8602,7 +9211,7 @@ async function fetchManifests(installationId, fullName, branch) {
   for (const path2 of paths) {
     try {
       const res = await installationGet(
-        installationId,
+        installationId2,
         `/repos/${fullName}/contents/${path2.split("/").map(encodeURIComponent).join("/")}?ref=${encodeURIComponent(branch)}`
       );
       if (!res.content || res.encoding !== "base64") continue;
@@ -8621,7 +9230,7 @@ async function fetchManifests(installationId, fullName, branch) {
     partial: Boolean(tree.truncated) || allPaths.length > paths.length
   };
 }
-var PAGE_SIZE, MAX_PAGES;
+var PAGE_SIZE2, MAX_PAGES;
 var init_manifests = __esm({
   "src/github/manifests.ts"() {
     "use strict";
@@ -8630,7 +9239,7 @@ var init_manifests = __esm({
     init_workflow();
     init_types2();
     init_logger();
-    PAGE_SIZE = 100;
+    PAGE_SIZE2 = 100;
     MAX_PAGES = 20;
   }
 });
@@ -8728,8 +9337,8 @@ function formatUpgradePlan(plan) {
     if (upgrade.removed.length) {
       out.push(`  removes ${upgrade.removed.length}: ${upgrade.removed.slice(0, 8).join(", ")}`);
     }
-    for (const change of upgrade.arityChanged.slice(0, 5)) {
-      out.push(`  arity ${change.path}: ${change.from ?? "?"} \u2192 ${change.to ?? "?"}`);
+    for (const change2 of upgrade.arityChanged.slice(0, 5)) {
+      out.push(`  arity ${change2.path}: ${change2.from ?? "?"} \u2192 ${change2.to ?? "?"}`);
     }
     if (upgrade.hops?.length) {
       out.push(`  via ${[upgrade.fromVersion, ...upgrade.hops.map((h) => h.toVersion)].join(" \u2192 ")}`);
@@ -8770,6 +9379,68 @@ var init_upgradePlan = __esm({
   }
 });
 
+// src/cli/reportRuns.ts
+var reportRuns_exports = {};
+__export(reportRuns_exports, {
+  buildRunReports: () => buildRunReports,
+  runContextFromEnv: () => runContextFromEnv
+});
+function findingRefs(finding) {
+  return [
+    ...finding.symbolsRemoved.flatMap((s) => s.refs),
+    ...finding.arityChanged.flatMap((a) => a.refs)
+  ];
+}
+function buildRunReports(report, targets, ctx) {
+  const versions = new Map(targets.map((t) => [t.package, t]));
+  const base = (pkg) => {
+    const target = versions.get(pkg);
+    return {
+      repoFullName: ctx.repoFullName,
+      packageName: pkg,
+      fromVersion: target?.fromVersion ?? "",
+      toVersion: target?.toVersion ?? "",
+      status: "checked",
+      runUrl: ctx.runUrl
+    };
+  };
+  const rows = [];
+  for (const finding of report.breaking) {
+    const refs = findingRefs(finding);
+    rows.push({
+      ...base(finding.package),
+      // The finding carries its own versions; prefer them over the target map.
+      fromVersion: finding.fromVersion,
+      toVersion: finding.toVersion,
+      severity: finding.severity,
+      symbolsAffected: [
+        ...finding.symbolsRemoved.map((s) => s.symbol),
+        ...finding.arityChanged.map((a) => a.symbol)
+      ],
+      callSites: refs.length,
+      callSiteFiles: [...new Set(refs.map((r) => r.file))]
+    });
+  }
+  for (const pkg of report.ok) rows.push({ ...base(pkg), severity: "ok" });
+  for (const u of report.unverified) rows.push({ ...base(u.package), severity: "unverified" });
+  return rows.filter((r) => r.fromVersion && r.toVersion).slice(0, MAX_RUNS);
+}
+function runContextFromEnv(env = process.env) {
+  const repoFullName = env.GITHUB_REPOSITORY?.trim();
+  if (!repoFullName) return null;
+  const server = env.GITHUB_SERVER_URL?.trim() || "https://github.com";
+  const runId = env.GITHUB_RUN_ID?.trim();
+  return { repoFullName, runUrl: runId ? `${server}/${repoFullName}/actions/runs/${runId}` : "" };
+}
+var MAX_RUNS;
+var init_reportRuns = __esm({
+  "src/cli/reportRuns.ts"() {
+    "use strict";
+    init_esm_shims();
+    MAX_RUNS = 100;
+  }
+});
+
 // src/surface/references.ts
 var references_exports = {};
 __export(references_exports, {
@@ -8861,10 +9532,10 @@ function scanReferences(rootDir, opts = {}) {
   const record = (pkg, symbol, via, specifier, file, line, parent) => {
     let syms = byPackage.get(pkg);
     if (!syms) byPackage.set(pkg, syms = /* @__PURE__ */ new Map());
-    const list = syms.get(symbol);
+    const list2 = syms.get(symbol);
     const ref = { symbol, via, specifier, file, line, ...parent ? { parent } : {} };
-    if (list) {
-      if (!list.some((r) => r.file === file && r.line === line && r.via === via)) list.push(ref);
+    if (list2) {
+      if (!list2.some((r) => r.file === file && r.line === line && r.via === via)) list2.push(ref);
     } else {
       syms.set(symbol, [ref]);
     }
@@ -9650,8 +10321,8 @@ function groupByEntry(refs, pkg) {
       const sub = use.specifier === pkg ? "" : use.specifier.slice(pkg.length + 1);
       let symbols2 = byEntry.get(sub);
       if (!symbols2) byEntry.set(sub, symbols2 = /* @__PURE__ */ new Map());
-      const list = symbols2.get(sym);
-      if (list) list.push(use);
+      const list2 = symbols2.get(sym);
+      if (list2) list2.push(use);
       else symbols2.set(sym, [use]);
     }
   }
@@ -9872,6 +10543,32 @@ function targetsFromPlanFile(path2) {
   }
   return parsed.upgrades.filter((u) => u.package && u.fromVersion && u.toVersion).filter((u) => u.inScope !== false).map((u) => ({ package: u.package, fromVersion: u.fromVersion, toVersion: u.toVersion }));
 }
+async function reportOutcome(report, targets, opts) {
+  const { buildRunReports: buildRunReports2, runContextFromEnv: runContextFromEnv2 } = await Promise.resolve().then(() => (init_reportRuns(), reportRuns_exports));
+  const ctx = runContextFromEnv2();
+  if (!ctx) {
+    console.error("--report: no $GITHUB_REPOSITORY, so there is no run to attribute this to. Skipped.");
+    return;
+  }
+  const runs = buildRunReports2(report, targets, ctx);
+  if (runs.length === 0) return;
+  try {
+    const { reportUpgradeRuns: reportUpgradeRuns2 } = await Promise.resolve().then(() => (init_remote(), remote_exports));
+    const { recorded, rejected } = await reportUpgradeRuns2(runs, {
+      url: opts.url,
+      apiKey: opts.apiKey
+    });
+    console.error(
+      `reported ${recorded} upgrade result(s) to the lurq dashboard` + (rejected ? ` (${rejected} rejected)` : "")
+    );
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const noKey = /no api key/i.test(message);
+    console.error(
+      noKey ? "--report: no API key, so there was nothing to report with. Set LURQ_API_KEY in this repository's secrets to see these results on your dashboard. The check itself is unaffected." : `--report: could not reach the lurq dashboard (${message}). The check itself is unaffected.`
+    );
+  }
+}
 async function runCheckUpgrade(dir, opts) {
   const { scanReferences: scanReferences2 } = await Promise.resolve().then(() => (init_references(), references_exports));
   const { checkUpgrade: checkUpgrade2, formatUpgradeReport: formatUpgradeReport2 } = await Promise.resolve().then(() => (init_upgrade(), upgrade_exports));
@@ -9892,6 +10589,7 @@ async function runCheckUpgrade(dir, opts) {
   console.log(
     opts.json ? JSON.stringify(report, null, 2) : formatUpgradeReport2(report, `upgrade check on ${dir}`)
   );
+  if (opts.report) await reportOutcome(report, targets, opts);
   if (opts.exitCode && !report.safe) process.exitCode = 1;
 }
 var init_checkUpgrade = __esm({
@@ -9901,6 +10599,459 @@ var init_checkUpgrade = __esm({
   }
 });
 
+// src/surface/release.ts
+var release_exports = {};
+__export(release_exports, {
+  checkRelease: () => checkRelease,
+  formatReleaseCheck: () => formatReleaseCheck,
+  releaseVerdict: () => releaseVerdict
+});
+import semver5 from "semver";
+function declaredBump(from, to) {
+  if (!semver5.gt(to, from)) return null;
+  if (semver5.major(to) !== semver5.major(from)) return "major";
+  if (semver5.minor(to) !== semver5.minor(from)) return "minor";
+  return "patch";
+}
+function covers(declared, required, baselineMajor) {
+  if (baselineMajor === 0 && required === "major") return RANK[declared] >= RANK.minor;
+  return RANK[declared] >= RANK[required];
+}
+function releaseVerdict(publishedVersion, localVersion, diff) {
+  const required = diff.removed.length || diff.arityChanged.length || diff.typeOnlyRemoved.length ? "major" : diff.added.length ? "minor" : "patch";
+  const declared = declaredBump(publishedVersion, localVersion);
+  const verdict = declared !== null && covers(declared, required, semver5.major(publishedVersion)) ? "ok" : "understated";
+  return { declared, required, verdict };
+}
+async function checkRelease(dir, opts = {}) {
+  const manifest = readManifest(dir);
+  const name = manifest?.name;
+  const base = {
+    package: name ?? dir,
+    publishedVersion: null,
+    localVersion: manifest?.version ?? null
+  };
+  if (!name) return inconclusive(base, `no readable package.json in ${dir}`);
+  if (!manifest.version) return inconclusive(base, "package.json has no version field");
+  const { extractSurface: extractSurface3 } = await Promise.resolve().then(() => (init_extract2(), extract_exports));
+  const local = extractSurface3(dir, { manifest });
+  if (local.undeclaredReason) {
+    return inconclusive(base, `${local.undeclaredReason} \u2014 build the package first`);
+  }
+  const published = await fetchAndExtract(name, opts.against ?? "latest", {
+    fetchImpl: opts.fetchImpl
+  });
+  if (!published) {
+    return inconclusive(base, `${name} has no published version to compare against`);
+  }
+  const withVersion = { ...base, publishedVersion: published.resolvedVersion };
+  const diff = diffSurfaces(published.surface, local);
+  if (diff.inconclusive) return inconclusive(withVersion, diff.inconclusive);
+  return {
+    ...withVersion,
+    ...releaseVerdict(published.resolvedVersion, manifest.version, diff),
+    removed: diff.removed.map((s) => s.path),
+    arityChanged: diff.arityChanged,
+    typeOnlyRemoved: diff.typeOnlyRemoved.map((s) => s.path),
+    added: diff.added.map((s) => s.path)
+  };
+}
+function formatReleaseCheck(c) {
+  const out = [`lurq, release check \u2014 ${c.package}`, ""];
+  if (c.verdict === "inconclusive") {
+    out.push(`INCONCLUSIVE  ${c.inconclusive}`, "", "No verdict. This is not a pass.");
+    return out.join("\n");
+  }
+  const from = c.publishedVersion ?? "?";
+  const to = c.localVersion ?? "?";
+  out.push(
+    c.verdict === "ok" ? c.declared === c.required ? `OK          ${from} \u2192 ${to} is a ${c.declared}, which is what this API change needs.` : `OK          ${from} \u2192 ${to} is a ${c.declared}; this API change only needed a ${c.required}.` : c.declared === null ? `UNDERSTATED  ${to} is not ahead of the published ${from}.` : `UNDERSTATED  ${from} \u2192 ${to} is tagged ${c.declared}, but this API change is a ${c.required}.`,
+    ""
+  );
+  out.push(...list("Removed exports", c.removed));
+  if (c.arityChanged.length) {
+    out.push(`  Parameter count changed (${c.arityChanged.length}):`);
+    for (const a of c.arityChanged.slice(0, LIST_CAP)) {
+      out.push(`    \xB7 ${a.path}  ${a.from} \u2192 ${a.to}`);
+    }
+  }
+  out.push(...list("Removed types (breaks tsc, not node)", c.typeOnlyRemoved));
+  out.push(...list("Added exports", c.added));
+  if (!c.removed.length && !c.arityChanged.length && !c.typeOnlyRemoved.length && !c.added.length) {
+    out.push("  No change to the exported surface.");
+  }
+  return out.join("\n");
+}
+var RANK, inconclusive, LIST_CAP, list;
+var init_release = __esm({
+  "src/surface/release.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_diff2();
+    init_fetch();
+    init_resolve();
+    RANK = { patch: 0, minor: 1, major: 2 };
+    inconclusive = (base, reason) => ({
+      ...base,
+      declared: null,
+      required: "patch",
+      verdict: "inconclusive",
+      removed: [],
+      arityChanged: [],
+      typeOnlyRemoved: [],
+      added: [],
+      inconclusive: reason
+    });
+    LIST_CAP = 12;
+    list = (label, items) => {
+      if (!items.length) return [];
+      const shown = items.slice(0, LIST_CAP);
+      const more = items.length - shown.length;
+      return [
+        `  ${label} (${items.length}):`,
+        ...shown.map((s) => `    \xB7 ${s}`),
+        ...more > 0 ? [`    \u2026 ${more} more`] : []
+      ];
+    };
+  }
+});
+
+// src/api/diff.ts
+var diff_exports = {};
+__export(diff_exports, {
+  checkApi: () => checkApi,
+  diffApiSurfaces: () => diffApiSurfaces,
+  formatApiCheck: () => formatApiCheck
+});
+import semver6 from "semver";
+function compareOperation(before, after) {
+  const out = [];
+  for (const param of missing(after.requiredParams, before.requiredParams)) {
+    out.push(
+      change(
+        before.optionalParams.includes(param) ? "param-now-required" : "required-param-added",
+        after.id,
+        param
+      )
+    );
+  }
+  for (const param of missing(after.optionalParams, before.optionalParams)) {
+    out.push(change("optional-param-added", after.id, param));
+  }
+  for (const field of missing(after.requiredBodyFields, before.requiredBodyFields)) {
+    out.push(change("required-body-field-added", after.id, field));
+  }
+  for (const code of missing(before.responseCodes, after.responseCodes)) {
+    out.push(change("response-removed", after.id, code));
+  }
+  for (const code of missing(after.responseCodes, before.responseCodes)) {
+    out.push(change("response-added", after.id, code));
+  }
+  if (after.deprecated && !before.deprecated) out.push(change("operation-deprecated", after.id));
+  return out;
+}
+function diffApiSurfaces(before, after) {
+  if (before.unreadableReason) return { breaking: [], other: [], inconclusive: `previous revision: ${before.unreadableReason}` };
+  if (after.unreadableReason) return { breaking: [], other: [], inconclusive: `current revision: ${after.unreadableReason}` };
+  const changes = [];
+  for (const [id, op] of before.operations) {
+    const next = after.operations.get(id);
+    if (!next) {
+      changes.push(change("operation-removed", id));
+      continue;
+    }
+    changes.push(...compareOperation(op, next));
+  }
+  for (const id of after.operations.keys()) {
+    if (!before.operations.has(id)) changes.push(change("operation-added", id));
+  }
+  return {
+    breaking: changes.filter((c) => c.breaking),
+    other: changes.filter((c) => !c.breaking)
+  };
+}
+function checkApi(before, after) {
+  const diff = diffApiSurfaces(before, after);
+  const base = {
+    title: after.title ?? before.title,
+    fromVersion: before.version,
+    toVersion: after.version,
+    diff
+  };
+  if (diff.inconclusive) {
+    return { ...base, verdict: "inconclusive", versionCovers: null };
+  }
+  const from = before.version && semver6.valid(before.version);
+  const to = after.version && semver6.valid(after.version);
+  const versionCovers = from && to ? diff.breaking.length > 0 ? semver6.major(to) > semver6.major(from) : semver6.gte(to, from) : null;
+  return { ...base, verdict: diff.breaking.length > 0 ? "breaking" : "ok", versionCovers };
+}
+function renderChanges(changes) {
+  const shown = changes.slice(0, LIST_CAP2);
+  const lines = shown.map(
+    (c) => `    \xB7 ${c.operation}${c.detail ? `  \u2192  ${c.detail}` : ""}   ${LABEL[c.kind]}`
+  );
+  if (changes.length > shown.length) lines.push(`    \u2026 ${changes.length - shown.length} more`);
+  return lines;
+}
+function formatApiCheck(check2, label = "api check") {
+  const out = [`lurq, ${label}${check2.title ? ` \u2014 ${check2.title}` : ""}`, ""];
+  if (check2.verdict === "inconclusive") {
+    out.push(`INCONCLUSIVE  ${check2.diff.inconclusive}`, "", "No verdict. This is not a pass.");
+    return out.join("\n");
+  }
+  const versions = check2.fromVersion && check2.toVersion ? `  ${check2.fromVersion} \u2192 ${check2.toVersion}` : "";
+  if (check2.diff.breaking.length) {
+    out.push(`BREAKING${versions}`, "");
+    out.push(`  ${check2.diff.breaking.length} change(s) that break existing callers:`);
+    out.push(...renderChanges(check2.diff.breaking));
+  } else {
+    out.push(`OK${versions}`, "", "  Nothing here breaks an existing caller.");
+  }
+  if (check2.diff.other.length) {
+    out.push("", `  ${check2.diff.other.length} other change(s):`);
+    out.push(...renderChanges(check2.diff.other));
+  }
+  if (check2.versionCovers === false) {
+    out.push(
+      "",
+      check2.diff.breaking.length ? `  info.version went ${check2.fromVersion} \u2192 ${check2.toVersion}. A breaking change needs a major.` : `  info.version went ${check2.fromVersion} \u2192 ${check2.toVersion}, which is not ahead.`
+    );
+  } else if (check2.versionCovers === null && (check2.fromVersion || check2.toVersion)) {
+    out.push("", "  info.version is not semver on both sides, so the bump was not judged.");
+  }
+  return out.join("\n");
+}
+var BREAKING, change, missing, LIST_CAP2, LABEL;
+var init_diff3 = __esm({
+  "src/api/diff.ts"() {
+    "use strict";
+    init_esm_shims();
+    BREAKING = /* @__PURE__ */ new Set([
+      "operation-removed",
+      "required-param-added",
+      "param-now-required",
+      "required-body-field-added",
+      "response-removed"
+    ]);
+    change = (kind, operation, detail2) => ({
+      kind,
+      operation,
+      ...detail2 ? { detail: detail2 } : {},
+      breaking: BREAKING.has(kind)
+    });
+    missing = (a, b) => {
+      const has = new Set(b);
+      return a.filter((x) => !has.has(x));
+    };
+    LIST_CAP2 = 15;
+    LABEL = {
+      "operation-removed": "removed",
+      "required-param-added": "new required param",
+      "param-now-required": "now required",
+      "required-body-field-added": "new required body field",
+      "response-removed": "response removed",
+      "operation-added": "added",
+      "optional-param-added": "new optional param",
+      "response-added": "response added",
+      "operation-deprecated": "deprecated"
+    };
+  }
+});
+
+// src/api/openapi.ts
+import { parse as parseYaml } from "yaml";
+function deref(root, node, seen = /* @__PURE__ */ new Set()) {
+  if (!isRecord(node)) return null;
+  const ref = node.$ref;
+  if (typeof ref !== "string") return node;
+  if (!ref.startsWith("#/") || seen.has(ref)) return null;
+  seen.add(ref);
+  let cursor = root;
+  for (const segment of ref.slice(2).split("/")) {
+    if (!isRecord(cursor)) return null;
+    cursor = cursor[segment.replace(/~1/g, "/").replace(/~0/g, "~")];
+  }
+  return deref(root, cursor, seen);
+}
+function readParams(root, shared, own) {
+  const required = /* @__PURE__ */ new Set();
+  const optional = /* @__PURE__ */ new Set();
+  for (const list2 of [shared, own]) {
+    if (!Array.isArray(list2)) continue;
+    for (const raw of list2) {
+      const param = deref(root, raw);
+      const name = param?.name;
+      if (typeof name !== "string") continue;
+      const key = `${name} (${typeof param?.in === "string" ? param.in : "unknown"})`;
+      if (param?.required === true) {
+        required.add(key);
+        optional.delete(key);
+      } else if (!required.has(key)) {
+        optional.add(key);
+      }
+    }
+  }
+  return { required: [...required].sort(), optional: [...optional].sort() };
+}
+function readBodyFields(root, requestBody) {
+  const body = deref(root, requestBody);
+  if (!body || body.required !== true) return [];
+  const content = body.content;
+  if (!isRecord(content)) return [];
+  const out = /* @__PURE__ */ new Set();
+  for (const media of Object.values(content)) {
+    const schema = deref(root, isRecord(media) ? media.schema : null);
+    const required = schema?.required;
+    if (!Array.isArray(required)) continue;
+    for (const field of required) if (typeof field === "string") out.add(field);
+  }
+  return [...out].sort();
+}
+function extractApiSurface(source, label = "document") {
+  const empty2 = { title: null, version: null, operations: /* @__PURE__ */ new Map() };
+  let doc;
+  try {
+    doc = parseYaml(source);
+  } catch (err) {
+    return {
+      ...empty2,
+      unreadableReason: `${label} is not valid YAML or JSON: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (!isRecord(doc)) return { ...empty2, unreadableReason: `${label} is not an object` };
+  if (!doc.openapi && !doc.swagger) {
+    return { ...empty2, unreadableReason: `${label} has no openapi/swagger version field` };
+  }
+  const info = isRecord(doc.info) ? doc.info : {};
+  const paths = isRecord(doc.paths) ? doc.paths : {};
+  const operations = /* @__PURE__ */ new Map();
+  for (const [path2, rawItem] of Object.entries(paths)) {
+    const item = deref(doc, rawItem);
+    if (!item) continue;
+    for (const method of METHODS) {
+      const op = item[method];
+      if (!isRecord(op)) continue;
+      const { required, optional } = readParams(doc, item.parameters, op.parameters);
+      const responses = isRecord(op.responses) ? Object.keys(op.responses).sort() : [];
+      const id = `${method.toUpperCase()} ${path2}`;
+      operations.set(id, {
+        id,
+        method: method.toUpperCase(),
+        path: path2,
+        requiredParams: required,
+        optionalParams: optional,
+        requiredBodyFields: readBodyFields(doc, op.requestBody),
+        responseCodes: responses,
+        deprecated: op.deprecated === true
+      });
+    }
+  }
+  return {
+    title: typeof info.title === "string" ? info.title : null,
+    version: typeof info.version === "string" ? info.version : null,
+    operations,
+    ...operations.size === 0 ? { unreadableReason: `${label} declares no operations` } : {}
+  };
+}
+var METHODS, isRecord;
+var init_openapi = __esm({
+  "src/api/openapi.ts"() {
+    "use strict";
+    init_esm_shims();
+    METHODS = ["get", "put", "post", "delete", "options", "head", "patch", "trace"];
+    isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+  }
+});
+
+// src/api/check.ts
+var check_exports = {};
+__export(check_exports, {
+  findSpec: () => findSpec,
+  runApiCheck: () => runApiCheck
+});
+import { execFile as execFile4 } from "child_process";
+import { existsSync as existsSync7, readFileSync as readFileSync9 } from "fs";
+import { relative as relative4, resolve } from "path";
+import { promisify as promisify4 } from "util";
+function findSpec(dir) {
+  for (const candidate of CANDIDATES2) {
+    const full = resolve(dir, candidate);
+    if (existsSync7(full)) return full;
+  }
+  return null;
+}
+async function showAtRevision(dir, rev, repoPath) {
+  try {
+    const { stdout } = await execFileP3("git", ["show", `${rev}:${repoPath}`], {
+      cwd: dir,
+      maxBuffer: 32 * 1024 * 1024
+    });
+    return stdout;
+  } catch {
+    return null;
+  }
+}
+async function runApiCheck(dir, opts = {}) {
+  const against = opts.against ?? "HEAD";
+  const specPath = opts.spec ? resolve(dir, opts.spec) : findSpec(dir);
+  const spec = specPath ? relative4(dir, specPath) || specPath : "(none found)";
+  const base = { spec, against, title: null, fromVersion: null, toVersion: null };
+  if (!specPath) {
+    return {
+      ...base,
+      verdict: "inconclusive",
+      versionCovers: null,
+      diff: {
+        breaking: [],
+        other: [],
+        inconclusive: `no OpenAPI document found in ${dir}. Name one: lurq check-api <file>`
+      }
+    };
+  }
+  const current = extractApiSurface(readFileSync9(specPath, "utf8"), spec);
+  const previousSource = await showAtRevision(dir, against, spec);
+  if (previousSource === null) {
+    return {
+      ...base,
+      title: current.title,
+      toVersion: current.version,
+      verdict: "inconclusive",
+      versionCovers: null,
+      diff: {
+        breaking: [],
+        other: [],
+        inconclusive: `${spec} does not exist at ${against}, so there is nothing to compare against`
+      }
+    };
+  }
+  const previous = extractApiSurface(previousSource, `${spec} at ${against}`);
+  return { ...base, ...checkApi(previous, current) };
+}
+var execFileP3, CANDIDATES2;
+var init_check2 = __esm({
+  "src/api/check.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_diff3();
+    init_openapi();
+    execFileP3 = promisify4(execFile4);
+    CANDIDATES2 = [
+      "openapi.yaml",
+      "openapi.yml",
+      "openapi.json",
+      "swagger.yaml",
+      "swagger.yml",
+      "swagger.json",
+      "api/openapi.yaml",
+      "api/openapi.yml",
+      "api/openapi.json",
+      "docs/openapi.yaml",
+      "docs/openapi.yml"
+    ];
+  }
+});
+
 // src/graph/types.ts
 function canonicalKey(ref) {
   return `${ref.kind}:${ref.namespace}:${ref.name}:${ref.version ?? ""}`;
@@ -9913,7 +11064,7 @@ var init_types6 = __esm({
 });
 
 // src/db/graph.ts
-import { and as and8, eq as eq12, isNull as isNull3 } from "drizzle-orm";
+import { and as and13, eq as eq16, isNull as isNull3 } from "drizzle-orm";
 import { createHash as createHash6 } from "crypto";
 var init_graph = __esm({
   "src/db/graph.ts"() {
@@ -9925,7 +11076,7 @@ var init_graph = __esm({
 });
 
 // src/db/surface.ts
-import { and as and9, desc as desc5, eq as eq13, sql as sql11 } from "drizzle-orm";
+import { and as and14, desc as desc5, eq as eq17, sql as sql11 } from "drizzle-orm";
 function surfaceRef(pkg, version) {
   return { kind: "package_surface", namespace: "npm", name: pkg, version };
 }
@@ -9946,7 +11097,7 @@ var init_surface = __esm({
 
 // src/mcp/surfaceHandlers.ts
 import { createHash as createHash7 } from "crypto";
-import { and as and10, desc as desc6, eq as eq14 } from "drizzle-orm";
+import { and as and15, desc as desc6, eq as eq18 } from "drizzle-orm";
 function rowsToSurface(pkg, version, rows, tier) {
   const symbolsOut = rows.map((r) => ({
     path: r.path,
@@ -9970,17 +11121,17 @@ function rowsToSurface(pkg, version, rows, tier) {
 async function loadStored(db, pkg, version, tenantId = 0) {
   let entity;
   if (version === null) {
-    const rows2 = await db.select({ e: entities, at: observations.observedAt }).from(entities).innerJoin(claims, eq14(claims.subjectId, entities.id)).innerJoin(observations, eq14(observations.claimId, claims.id)).where(and10(eq14(entities.kind, "package_surface"), eq14(entities.name, pkg))).orderBy(desc6(observations.observedAt)).limit(1);
+    const rows2 = await db.select({ e: entities, at: observations.observedAt }).from(entities).innerJoin(claims, eq18(claims.subjectId, entities.id)).innerJoin(observations, eq18(observations.claimId, claims.id)).where(and15(eq18(entities.kind, "package_surface"), eq18(entities.name, pkg))).orderBy(desc6(observations.observedAt)).limit(1);
     entity = rows2.find((r) => r.e.tenantId === tenantId)?.e;
   } else {
     const key = canonicalKey(surfaceRef(pkg, version));
-    const ents = await db.select().from(entities).where(eq14(entities.canonicalKey, key)).limit(2);
+    const ents = await db.select().from(entities).where(eq18(entities.canonicalKey, key)).limit(2);
     entity = ents.find((e) => e.tenantId === tenantId);
   }
   if (!entity) return null;
-  const obs = await db.select({ o: observations }).from(observations).innerJoin(claims, eq14(observations.claimId, claims.id)).where(eq14(claims.subjectId, entity.id)).orderBy(desc6(observations.observedAt)).limit(1);
+  const obs = await db.select({ o: observations }).from(observations).innerJoin(claims, eq18(observations.claimId, claims.id)).where(eq18(claims.subjectId, entity.id)).orderBy(desc6(observations.observedAt)).limit(1);
   const latest = obs[0]?.o ?? null;
-  const rows = await db.select().from(symbols).where(eq14(symbols.entityId, entity.id));
+  const rows = await db.select().from(symbols).where(eq18(symbols.entityId, entity.id));
   return {
     entityId: entity.id,
     rows,
@@ -10052,18 +11203,18 @@ async function diffSurfaceUncached(db, input) {
     loadStored(db, input.package, input.fromVersion),
     loadStored(db, input.package, input.toVersion)
   ]);
-  const missing = [];
-  if (!a || a.rows.length === 0) missing.push(input.fromVersion);
-  if (!b || b.rows.length === 0) missing.push(input.toVersion);
-  if (missing.length) {
-    for (const v of missing) await enqueueSurface(db, input.package, v).catch(() => {
+  const missing2 = [];
+  if (!a || a.rows.length === 0) missing2.push(input.fromVersion);
+  if (!b || b.rows.length === 0) missing2.push(input.toVersion);
+  if (missing2.length) {
+    for (const v of missing2) await enqueueSurface(db, input.package, v).catch(() => {
     });
     return {
       package: input.package,
       fromVersion: input.fromVersion,
       toVersion: input.toVersion,
       verdict: "unknown",
-      inconclusive: `no extracted surface for ${missing.join(", ")}, queued; retry shortly. NOT evidence that symbols were removed.`,
+      inconclusive: `no extracted surface for ${missing2.join(", ")}, queued; retry shortly. NOT evidence that symbols were removed.`,
       removed: [],
       added: [],
       arityChanged: [],
@@ -10208,7 +11359,7 @@ var init_toolDescriptions = __esm({
 });
 
 // src/db/usage.ts
-import { and as and11, desc as desc7, eq as eq15, gte, sql as sql12 } from "drizzle-orm";
+import { and as and16, desc as desc7, eq as eq19, gte as gte2, sql as sql12 } from "drizzle-orm";
 function windowStart(days) {
   return sql12`CURRENT_DATE - (${days}::int - 1)`;
 }
@@ -10242,9 +11393,9 @@ async function getUsageByTool(db, ownerId, days) {
     tool: ownerUsageDaily.tool,
     count: sql12`sum(${ownerUsageDaily.count})::int`
   }).from(ownerUsageDaily).where(
-    and11(
-      eq15(ownerUsageDaily.ownerId, ownerId),
-      gte(ownerUsageDaily.date, windowStart(days))
+    and16(
+      eq19(ownerUsageDaily.ownerId, ownerId),
+      gte2(ownerUsageDaily.date, windowStart(days))
     )
   ).groupBy(ownerUsageDaily.tool).orderBy(desc7(sql12`sum(${ownerUsageDaily.count})`));
   return rows.map((r) => ({ tool: r.tool, count: Number(r.count) }));
@@ -10409,9 +11560,20 @@ function buildMcpServer(db, ctx = {}) {
     async (args) => json(await run("diff_surface", () => handleDiffSurface(db, args)))
   );
   server.registerTool(
-    "report_outcome",
+    "capabilities",
     {
-      title: "Report a recommendation outcome",
+      title: "What lurq can do",
+      description: "Look up which lurq tool answers a situation, and what to run next. Call when you're unsure whether lurq covers something (an upgrade, a licence rule, a version's exact exports, publishing a package) instead of guessing or skipping it. Returns matching capabilities with the tool or command to use.",
+      inputSchema: {
+        query: z2.string().max(300).optional().describe("What you are trying to do, in plain words. Omit for the full menu.")
+      }
+    },
+    async (args) => json({ capabilities: searchCapabilities(args.query ?? "", 6) })
+  );
+  server.registerTool(
+    "report_outcome",
+    {
+      title: "Report a recommendation outcome",
       description: "Opt-in feedback after acting on a lurq recommendation: report whether you went with the package and whether it built. No source code, only the coarse decision + a build signal. Helps lurq learn which packages agents actually succeed with; safe to skip.",
       inputSchema: {
         package: npmName.describe("The package that was recommended"),
@@ -10449,6 +11611,7 @@ var init_server = __esm({
     init_esm_shims();
     init_constants();
     init_types();
+    init_capabilities();
     init_client();
     init_logger();
     init_surfaceHandlers();
@@ -10472,7 +11635,7 @@ var init_server = __esm({
 
 // src/auth/apiKeys.ts
 import { createHash as createHash8, randomBytes } from "crypto";
-import { and as and12, desc as desc8, eq as eq16, isNull as isNull4 } from "drizzle-orm";
+import { and as and17, desc as desc8, eq as eq20, isNull as isNull4 } from "drizzle-orm";
 function hashKey(key) {
   return createHash8("sha256").update(key).digest("hex");
 }
@@ -10495,7 +11658,7 @@ async function createKey(db, input = {}) {
 function stampLastUsed(db, entry, now) {
   if (now - entry.lastStampAt < STAMP_INTERVAL_MS) return;
   entry.lastStampAt = now;
-  db.update(apiKeys).set({ lastUsedAt: new Date(now) }).where(eq16(apiKeys.id, entry.row.id)).then(void 0, (err) => logger.debug(`lastUsedAt stamp failed: ${String(err)}`));
+  db.update(apiKeys).set({ lastUsedAt: new Date(now) }).where(eq20(apiKeys.id, entry.row.id)).then(void 0, (err) => logger.debug(`lastUsedAt stamp failed: ${String(err)}`));
 }
 async function lookupActiveKey(db, key) {
   const hash = hashKey(key);
@@ -10505,7 +11668,7 @@ async function lookupActiveKey(db, key) {
     stampLastUsed(db, cached3, now);
     return cached3.row;
   }
-  const [row] = await db.select().from(apiKeys).where(and12(eq16(apiKeys.keyHash, hash), isNull4(apiKeys.revokedAt))).limit(1);
+  const [row] = await db.select().from(apiKeys).where(and17(eq20(apiKeys.keyHash, hash), isNull4(apiKeys.revokedAt))).limit(1);
   if (!row) {
     authCache.delete(hash);
     return null;
@@ -10516,30 +11679,35 @@ async function lookupActiveKey(db, key) {
   return row;
 }
 async function listKeysForOwner(db, ownerId) {
-  return db.select().from(apiKeys).where(eq16(apiKeys.ownerId, ownerId)).orderBy(desc8(apiKeys.createdAt));
+  return db.select().from(apiKeys).where(eq20(apiKeys.ownerId, ownerId)).orderBy(desc8(apiKeys.createdAt));
 }
 function matchByPrefixOrId(prefixOrId) {
   const asId = Number(prefixOrId);
-  return Number.isInteger(asId) && String(asId) === prefixOrId.trim() ? eq16(apiKeys.id, asId) : eq16(apiKeys.prefix, prefixOrId);
+  return Number.isInteger(asId) && String(asId) === prefixOrId.trim() ? eq20(apiKeys.id, asId) : eq20(apiKeys.prefix, prefixOrId);
 }
 async function findKeyForOwner(db, args) {
-  const [row] = await db.select().from(apiKeys).where(and12(matchByPrefixOrId(args.prefixOrId), isNull4(apiKeys.revokedAt))).limit(1);
-  if (!row || row.ownerId !== args.ownerId) return null;
-  return row;
+  const [row] = await db.select().from(apiKeys).where(
+    and17(
+      matchByPrefixOrId(args.prefixOrId),
+      eq20(apiKeys.ownerId, args.ownerId),
+      isNull4(apiKeys.revokedAt)
+    )
+  ).orderBy(apiKeys.id).limit(1);
+  return row ?? null;
 }
 async function revokeKey(db, prefixOrId) {
-  const rows = await db.update(apiKeys).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and12(matchByPrefixOrId(prefixOrId), isNull4(apiKeys.revokedAt))).returning({ id: apiKeys.id });
+  const rows = await db.update(apiKeys).set({ revokedAt: /* @__PURE__ */ new Date() }).where(and17(matchByPrefixOrId(prefixOrId), isNull4(apiKeys.revokedAt))).returning({ id: apiKeys.id });
   return rows.length;
 }
 async function rotateKey(db, prefixOrId) {
-  const [previous] = await db.select().from(apiKeys).where(and12(matchByPrefixOrId(prefixOrId), isNull4(apiKeys.revokedAt))).limit(1);
+  const [previous] = await db.select().from(apiKeys).where(and17(matchByPrefixOrId(prefixOrId), isNull4(apiKeys.revokedAt))).limit(1);
   if (!previous) return null;
   const { key, row } = await createKey(db, {
     label: previous.label ?? void 0,
     tier: previous.tier,
     ownerId: previous.ownerId ?? void 0
   });
-  await db.update(apiKeys).set({ revokedAt: /* @__PURE__ */ new Date() }).where(eq16(apiKeys.id, previous.id));
+  await db.update(apiKeys).set({ revokedAt: /* @__PURE__ */ new Date() }).where(eq20(apiKeys.id, previous.id));
   return { key, row, previous };
 }
 var DISPLAY_BODY, authCache, AUTH_TTL_MS, STAMP_INTERVAL_MS;
@@ -10620,17 +11788,411 @@ var init_parse = __esm({
   }
 });
 
+// src/policy/conformance.ts
+import { and as and18, eq as eq21, inArray as inArray9 } from "drizzle-orm";
+async function loadRuleFacts(db, names2, ecosystem = DEFAULT_ECOSYSTEM) {
+  const out = /* @__PURE__ */ new Map();
+  for (let i = 0; i < names2.length; i += NAME_CHUNK2) {
+    const rows = await db.select({
+      name: packages.name,
+      license: packages.license,
+      deprecated: packages.deprecated,
+      confidence: packages.confidence
+    }).from(packages).where(
+      and18(
+        inArray9(packages.name, names2.slice(i, i + NAME_CHUNK2)),
+        eq21(packages.ecosystem, ecosystem)
+      )
+    );
+    for (const row of rows) {
+      out.set(row.name, {
+        license: row.license,
+        deprecated: row.deprecated,
+        confidence: row.confidence
+      });
+    }
+  }
+  return out;
+}
+function ruleRepo(policy, names2, facts) {
+  const violations = [];
+  let checked = 0;
+  let unchecked = 0;
+  let unscored = 0;
+  for (const name of names2) {
+    const fact = facts.get(name);
+    if (!fact) {
+      unchecked += 1;
+      continue;
+    }
+    checked += 1;
+    if (policy.minConfidence !== null && fact.confidence === null) unscored += 1;
+    const exclusion = check(
+      policy,
+      // `check` needs a grade and an unscored package has none. The top grade
+      // makes the confidence floor abstain rather than convict on a fact never
+      // established — "absent facts never convict", in enforce.ts — while the
+      // licence and deprecation rules still apply normally. The abstention is
+      // counted above rather than hidden.
+      { name, confidence: fact.confidence ?? "proven" },
+      { license: fact.license, deprecated: fact.deprecated }
+    );
+    if (exclusion) violations.push(exclusion);
+  }
+  return {
+    checked,
+    unchecked,
+    unscored,
+    total: violations.length,
+    violations: violations.slice(0, VIOLATION_CAP)
+  };
+}
+function bySeverity(a, z3) {
+  return z3.total - a.total || z3.unchecked - a.unchecked || a.fullName.localeCompare(z3.fullName);
+}
+async function repoConformance(db, ownerId) {
+  const policy = await getSelectionPolicy(db, ownerId);
+  if (!hasRules(policy)) return { enforcing: false, repos: [] };
+  const rows = await db.select({ id: repos.id, fullName: repos.fullName, manifests: repos.manifests }).from(repos).where(eq21(repos.ownerId, ownerId));
+  if (!rows.length) return { enforcing: true, repos: [] };
+  const declaredPerRepo = rows.map((r) => ({
+    repoId: r.id,
+    fullName: r.fullName,
+    names: [...declaredDeps(r.manifests ?? []).keys()]
+  }));
+  const union = [...new Set(declaredPerRepo.flatMap((r) => r.names))];
+  const facts = await loadRuleFacts(db, union);
+  const report = declaredPerRepo.map(({ repoId, fullName, names: names2 }) => ({
+    repoId,
+    fullName,
+    ...ruleRepo(policy, names2, facts)
+  }));
+  return { enforcing: true, repos: report.sort(bySeverity) };
+}
+var NAME_CHUNK2, VIOLATION_CAP;
+var init_conformance = __esm({
+  "src/policy/conformance.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_types();
+    init_schema();
+    init_selectionPolicy();
+    init_drift();
+    init_enforce();
+    NAME_CHUNK2 = 500;
+    VIOLATION_CAP = 50;
+  }
+});
+
+// src/core/plans.ts
+function planFor(tier) {
+  return PLANS[tier ?? "free"] ?? PLANS.free;
+}
+function isServed(status) {
+  return status != null && SERVED_STATUSES.has(status);
+}
+var TIERS, PLANS, PLAN_LIST, SERVED_STATUSES;
+var init_plans = __esm({
+  "src/core/plans.ts"() {
+    "use strict";
+    init_esm_shims();
+    TIERS = ["free", "pro", "enterprise"];
+    PLANS = {
+      free: {
+        tier: "free",
+        name: "Free",
+        priceCents: 0,
+        monthlyCalls: 200,
+        ratePerMinute: 60,
+        tagline: "Enough to find out whether the index is telling the truth.",
+        features: [
+          "CLI and installable skill",
+          "200 hosted calls a month",
+          "recommend, evaluate, verify",
+          "Daily refreshed index",
+          "Community support"
+        ],
+        paid: false
+      },
+      pro: {
+        tier: "pro",
+        name: "Pro",
+        priceCents: 500,
+        monthlyCalls: 1e4,
+        ratePerMinute: 120,
+        tagline: "For one developer who runs it on every install.",
+        features: [
+          "10,000 hosted calls a month",
+          "compare, diagram and plan",
+          "Repo autopilot and drift alerts",
+          "Priority index freshness",
+          "Email support"
+        ],
+        paid: true
+      },
+      enterprise: {
+        tier: "enterprise",
+        name: "Enterprise",
+        priceCents: 1e4,
+        monthlyCalls: null,
+        ratePerMinute: 600,
+        tagline: "For a team that needs the graph under its own controls.",
+        features: [
+          "Uncapped hosted calls",
+          "SSO and audit logs",
+          "Private compatibility runs",
+          "Custom SLA",
+          "Dedicated support channel"
+        ],
+        paid: true,
+        contactOnly: true
+      }
+    };
+    PLAN_LIST = TIERS.map((t) => PLANS[t]);
+    SERVED_STATUSES = /* @__PURE__ */ new Set(["active", "trialing", "past_due"]);
+  }
+});
+
+// src/db/subscriptions.ts
+import { and as and19, eq as eq22, gte as gte3, sql as sql13 } from "drizzle-orm";
+async function getSubscription(db, ownerId) {
+  const rows = await db.select().from(subscriptions).where(eq22(subscriptions.ownerId, ownerId)).limit(1);
+  return rows[0] ?? null;
+}
+async function getSubscriptionByCustomer(db, stripeCustomerId) {
+  const rows = await db.select().from(subscriptions).where(eq22(subscriptions.stripeCustomerId, stripeCustomerId)).limit(1);
+  return rows[0] ?? null;
+}
+async function linkCustomer(db, ownerId, stripeCustomerId) {
+  await db.insert(subscriptions).values({ ownerId, stripeCustomerId }).onConflictDoUpdate({
+    target: subscriptions.ownerId,
+    set: { stripeCustomerId, updatedAt: /* @__PURE__ */ new Date() }
+  });
+}
+async function applySubscriptionEvent(db, stripeCustomerId, update) {
+  const result = await db.insert(subscriptions).values({
+    // A webhook can legitimately arrive for a customer we have no row for
+    // (created in the Stripe dashboard, or our insert lost a race with
+    // checkout). ownerId comes from customer metadata in that case; the
+    // caller resolves it and passes a row that already exists, so this
+    // conflict target is the customer, not the owner.
+    ownerId: sql13`coalesce(
+        (select s.owner_id from subscriptions s where s.stripe_customer_id = ${stripeCustomerId}),
+        ${"stripe:" + stripeCustomerId}
+      )`,
+    stripeCustomerId,
+    stripeSubscriptionId: update.stripeSubscriptionId,
+    tier: update.tier,
+    status: update.status,
+    currentPeriodEnd: update.currentPeriodEnd,
+    cancelAtPeriodEnd: update.cancelAtPeriodEnd,
+    lastEventAt: update.eventAt,
+    updatedAt: /* @__PURE__ */ new Date()
+  }).onConflictDoUpdate({
+    target: subscriptions.stripeCustomerId,
+    set: {
+      stripeSubscriptionId: update.stripeSubscriptionId,
+      tier: update.tier,
+      status: update.status,
+      currentPeriodEnd: update.currentPeriodEnd,
+      cancelAtPeriodEnd: update.cancelAtPeriodEnd,
+      lastEventAt: update.eventAt,
+      updatedAt: /* @__PURE__ */ new Date()
+    },
+    setWhere: sql13`${subscriptions.lastEventAt} is null or ${subscriptions.lastEventAt} <= ${update.eventAt}`
+  }).returning({ ownerId: subscriptions.ownerId });
+  return result.length > 0;
+}
+async function monthlyCallCount(db, ownerId) {
+  const rows = await db.select({ total: sql13`coalesce(sum(${ownerUsageDaily.count}), 0)` }).from(ownerUsageDaily).where(
+    and19(
+      eq22(ownerUsageDaily.ownerId, ownerId),
+      gte3(ownerUsageDaily.date, sql13`date_trunc('month', CURRENT_DATE)::date`)
+    )
+  );
+  return Number(rows[0]?.total ?? 0);
+}
+async function entitlementFor(db, ownerId) {
+  if (!ownerId) {
+    return { plan: planFor("enterprise"), used: 0, withinQuota: true };
+  }
+  const [sub, used] = await Promise.all([
+    getSubscription(db, ownerId),
+    monthlyCallCount(db, ownerId)
+  ]);
+  const plan = planFor(sub && isServed(sub.status) ? sub.tier : "free");
+  const withinQuota = plan.monthlyCalls === null || used < plan.monthlyCalls;
+  return { plan, used, withinQuota };
+}
+var init_subscriptions = __esm({
+  "src/db/subscriptions.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_plans();
+    init_schema();
+  }
+});
+
+// src/billing/stripe.ts
+async function stripeClient() {
+  const { STRIPE_SECRET_KEY } = getConfig();
+  if (!STRIPE_SECRET_KEY) return null;
+  if (!clientPromise2) {
+    clientPromise2 = (async () => {
+      const { default: StripeCtor } = await import("stripe");
+      return new StripeCtor(STRIPE_SECRET_KEY, {
+        apiVersion: API_VERSION,
+        // Retries on Stripe's side of a network blip. The default is 0, which
+        // turns one dropped connection into a failed checkout for a real person.
+        maxNetworkRetries: 2,
+        timeout: 15e3
+      });
+    })();
+  }
+  return clientPromise2;
+}
+function billingEnabled() {
+  return Boolean(getConfig().STRIPE_SECRET_KEY);
+}
+function priceIdFor(tier) {
+  const config = getConfig();
+  if (tier === "pro") return config.STRIPE_PRICE_PRO ?? null;
+  if (tier === "enterprise") return config.STRIPE_PRICE_ENTERPRISE ?? null;
+  return null;
+}
+function tierForPrice(priceId, metadataTier) {
+  const config = getConfig();
+  if (priceId && priceId === config.STRIPE_PRICE_PRO) return "pro";
+  if (priceId && priceId === config.STRIPE_PRICE_ENTERPRISE) return "enterprise";
+  if (metadataTier && metadataTier in PLANS) return metadataTier;
+  if (priceId) {
+    logger.warn(`billing: price ${priceId} maps to no configured tier; treating as free`);
+  }
+  return "free";
+}
+async function customerFor(db, ownerId, email) {
+  const stripe = await stripeClient();
+  if (!stripe) return null;
+  const existing = await getSubscription(db, ownerId);
+  if (existing?.stripeCustomerId) return existing.stripeCustomerId;
+  const customer = await stripe.customers.create({
+    ...email ? { email } : {},
+    metadata: { ownerId }
+  });
+  await linkCustomer(db, ownerId, customer.id);
+  return customer.id;
+}
+async function createCheckoutSession(db, req) {
+  const stripe = await stripeClient();
+  if (!stripe) return null;
+  const price = priceIdFor(req.tier);
+  if (!price) return null;
+  const customer = await customerFor(db, req.ownerId, req.email);
+  if (!customer) return null;
+  const base = getConfig().LURQ_WEB_URL.replace(/\/$/, "");
+  const session = await stripe.checkout.sessions.create({
+    mode: "subscription",
+    customer,
+    line_items: [{ price, quantity: 1 }],
+    // Stripe substitutes the real id. The dashboard reads it to poll for the
+    // webhook having landed, so the page after payment can say "active" rather
+    // than "we think so".
+    success_url: `${base}/dashboard/billing?checkout={CHECKOUT_SESSION_ID}`,
+    cancel_url: `${base}/#pricing`,
+    // Carried onto the Subscription so tierForPrice has a fallback if the Price
+    // is later swapped out from under us.
+    subscription_data: { metadata: { ownerId: req.ownerId, tier: req.tier } },
+    metadata: { ownerId: req.ownerId, tier: req.tier },
+    allow_promotion_codes: true,
+    // Stripe Tax works out VAT/sales tax per the customer's address. This is the
+    // half of merchant-of-record we can buy; registration and remittance are
+    // still ours, which is the tradeoff taken when Stripe was chosen over a MoR.
+    automatic_tax: { enabled: true },
+    billing_address_collection: "auto"
+  });
+  return session.url;
+}
+async function createPortalSession(db, ownerId) {
+  const stripe = await stripeClient();
+  if (!stripe) return null;
+  const sub = await getSubscription(db, ownerId);
+  if (!sub?.stripeCustomerId) return null;
+  const base = getConfig().LURQ_WEB_URL.replace(/\/$/, "");
+  const session = await stripe.billingPortal.sessions.create({
+    customer: sub.stripeCustomerId,
+    return_url: `${base}/dashboard/billing`
+  });
+  return session.url;
+}
+async function constructEvent(raw, signature) {
+  const stripe = await stripeClient();
+  const secret = getConfig().STRIPE_WEBHOOK_SECRET;
+  if (!stripe || !secret || !signature) return null;
+  return stripe.webhooks.constructEvent(raw, signature, secret);
+}
+function periodEnd(sub) {
+  const item = sub.items?.data?.[0];
+  const raw = item?.current_period_end ?? sub.current_period_end;
+  return typeof raw === "number" ? new Date(raw * 1e3) : null;
+}
+async function handleEvent(db, event) {
+  if (!HANDLED.has(event.type)) return `ignored ${event.type}`;
+  const stripe = await stripeClient();
+  if (!stripe) return "billing disabled";
+  let subscription = null;
+  if (event.type === "checkout.session.completed") {
+    const session = event.data.object;
+    const id = typeof session.subscription === "string" ? session.subscription : session.subscription?.id;
+    if (!id) return "checkout completed with no subscription";
+    subscription = await stripe.subscriptions.retrieve(id);
+  } else {
+    subscription = event.data.object;
+  }
+  const customerId = typeof subscription.customer === "string" ? subscription.customer : subscription.customer?.id;
+  if (!customerId) return "event carried no customer";
+  const priceId = subscription.items?.data?.[0]?.price?.id ?? null;
+  const tier = event.type === "customer.subscription.deleted" ? "free" : tierForPrice(priceId, subscription.metadata?.tier);
+  const applied = await applySubscriptionEvent(db, customerId, {
+    tier,
+    status: event.type === "customer.subscription.deleted" ? "canceled" : subscription.status,
+    stripeSubscriptionId: subscription.id,
+    currentPeriodEnd: periodEnd(subscription),
+    cancelAtPeriodEnd: Boolean(subscription.cancel_at_period_end),
+    eventAt: new Date(event.created * 1e3)
+  });
+  return applied ? `${event.type}: customer ${customerId} \u2192 ${tier} (${subscription.status})` : `${event.type}: superseded by a newer event, dropped`;
+}
+var API_VERSION, clientPromise2, HANDLED;
+var init_stripe = __esm({
+  "src/billing/stripe.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_logger();
+    init_plans();
+    init_subscriptions();
+    API_VERSION = "2025-03-31.basil";
+    clientPromise2 = null;
+    HANDLED = /* @__PURE__ */ new Set([
+      "checkout.session.completed",
+      "customer.subscription.created",
+      "customer.subscription.updated",
+      "customer.subscription.deleted"
+    ]);
+  }
+});
+
 // src/github/hops.ts
-import semver5 from "semver";
+import semver7 from "semver";
 function planHops(versions, from, to) {
-  if (!semver5.valid(from) || !semver5.valid(to)) return [];
-  if (!semver5.gt(to, from)) return [];
-  const fromMajor = semver5.major(from);
-  const toMajor = semver5.major(to);
+  if (!semver7.valid(from) || !semver7.valid(to)) return [];
+  if (!semver7.gt(to, from)) return [];
+  const fromMajor = semver7.major(from);
+  const toMajor = semver7.major(to);
   if (toMajor - fromMajor < 2) return [];
   const stops = [];
   for (let major = fromMajor + 1; major < toMajor; major++) {
-    const best = semver5.maxSatisfying(versions, `${major}.x`, { includePrerelease: false });
+    const best = semver7.maxSatisfying(versions, `${major}.x`, { includePrerelease: false });
     if (best) stops.push(best);
   }
   const path2 = [from, ...stops, to];
@@ -10644,8 +12206,8 @@ function hopPairs(path2) {
   return pairs;
 }
 function tooFarToSequence(from, to) {
-  if (!semver5.valid(from) || !semver5.valid(to)) return false;
-  return semver5.major(to) - semver5.major(from) > MAX_HOPS2;
+  if (!semver7.valid(from) || !semver7.valid(to)) return false;
+  return semver7.major(to) - semver7.major(from) > MAX_HOPS2;
 }
 var MAX_HOPS2;
 var init_hops = __esm({
@@ -10663,8 +12225,8 @@ function briefable(dep) {
 function rank(dep) {
   return dep.advisories * 1e3 + dep.majorsBehind * 100 + (dep.deprecated ? 50 : 0);
 }
-function verdictOf(removed, arityChanged, inconclusive) {
-  if (inconclusive) return "unknown";
+function verdictOf(removed, arityChanged, inconclusive2) {
+  if (inconclusive2) return "unknown";
   if (removed.length > 0) return "removes-exports";
   if (arityChanged.length > 0) return "arity-changed";
   return "clean";
@@ -10685,17 +12247,17 @@ async function briefUpgrade(db, dep, knownVersions = []) {
     toVersion: base.toVersion
   });
   const removed = diff.removed.map((s) => s.path);
-  const inconclusive = "inconclusive" in diff ? diff.inconclusive : void 0;
+  const inconclusive2 = "inconclusive" in diff ? diff.inconclusive : void 0;
   const { hops, sequenceNote } = await planSequence(db, dep, base, knownVersions);
   return {
     ...base,
-    verdict: verdictOf(removed, diff.arityChanged, inconclusive),
+    verdict: verdictOf(removed, diff.arityChanged, inconclusive2),
     removed,
     arityChanged: diff.arityChanged,
     typeOnlyRemoved: diff.typeOnlyRemoved,
     newlyDeprecated: diff.deprecated ?? [],
     hops,
-    ...inconclusive ? { inconclusive } : {},
+    ...inconclusive2 ? { inconclusive: inconclusive2 } : {},
     ...sequenceNote ? { sequenceNote } : {}
   };
 }
@@ -10767,6 +12329,28 @@ var init_brief = __esm({
   }
 });
 
+// src/db/askSpend.ts
+import { and as and20, eq as eq23, sql as sql14 } from "drizzle-orm";
+async function getAskSpendToday(db, ownerId) {
+  const rows = await db.select({ usdMicros: askSpendDaily.usdMicros }).from(askSpendDaily).where(and20(eq23(askSpendDaily.ownerId, ownerId), eq23(askSpendDaily.date, sql14`CURRENT_DATE`))).limit(1);
+  return rows[0]?.usdMicros ?? 0;
+}
+async function addAskSpend(db, ownerId, micros) {
+  if (micros === 0) return getAskSpendToday(db, ownerId);
+  const rows = await db.insert(askSpendDaily).values({ ownerId, date: sql14`CURRENT_DATE`, usdMicros: Math.max(0, micros) }).onConflictDoUpdate({
+    target: [askSpendDaily.ownerId, askSpendDaily.date],
+    set: { usdMicros: sql14`greatest(0, ${askSpendDaily.usdMicros} + ${micros})` }
+  }).returning({ usdMicros: askSpendDaily.usdMicros });
+  return rows[0]?.usdMicros ?? Math.max(0, micros);
+}
+var init_askSpend = __esm({
+  "src/db/askSpend.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_schema();
+  }
+});
+
 // src/github/scope.ts
 function isUnassessed(u) {
   return u.verdict === "unknown";
@@ -10905,7 +12489,7 @@ var init_runs = __esm({
 });
 
 // src/db/upgradeRuns.ts
-import { and as and13, desc as desc9, eq as eq17, gte as gte2, sql as sql13 } from "drizzle-orm";
+import { and as and21, desc as desc9, eq as eq24, gte as gte4, sql as sql15 } from "drizzle-orm";
 async function recordUpgradeRuns(db, rows) {
   if (rows.length === 0) return 0;
   await db.insert(upgradeRuns).values(rows).onConflictDoUpdate({
@@ -10917,36 +12501,36 @@ async function recordUpgradeRuns(db, rows) {
       upgradeRuns.runUrl
     ],
     set: {
-      severity: sql13`excluded.severity`,
-      status: sql13`excluded.status`,
-      symbolsAffected: sql13`excluded.symbols_affected`,
-      callSites: sql13`excluded.call_sites`,
-      callSiteFiles: sql13`excluded.call_site_files`,
-      filesChanged: sql13`excluded.files_changed`,
-      testsPassed: sql13`excluded.tests_passed`,
-      prUrl: sql13`excluded.pr_url`,
-      repoId: sql13`excluded.repo_id`
+      severity: sql15`excluded.severity`,
+      status: sql15`excluded.status`,
+      symbolsAffected: sql15`excluded.symbols_affected`,
+      callSites: sql15`excluded.call_sites`,
+      callSiteFiles: sql15`excluded.call_site_files`,
+      filesChanged: sql15`excluded.files_changed`,
+      testsPassed: sql15`excluded.tests_passed`,
+      prUrl: sql15`excluded.pr_url`,
+      repoId: sql15`excluded.repo_id`
     }
   });
   return rows.length;
 }
 async function findRepoIdByFullName(db, ownerId, fullName) {
-  const rows = await db.select({ id: repos.id }).from(repos).where(and13(eq17(repos.ownerId, ownerId), eq17(repos.fullName, fullName))).limit(1);
+  const rows = await db.select({ id: repos.id }).from(repos).where(and21(eq24(repos.ownerId, ownerId), eq24(repos.fullName, fullName))).limit(1);
   return rows[0]?.id ?? null;
 }
 async function listRunsForRepo(db, ownerId, repoId, limit = 50) {
-  return db.select().from(upgradeRuns).where(and13(eq17(upgradeRuns.ownerId, ownerId), eq17(upgradeRuns.repoId, repoId))).orderBy(desc9(upgradeRuns.createdAt)).limit(limit);
+  return db.select().from(upgradeRuns).where(and21(eq24(upgradeRuns.ownerId, ownerId), eq24(upgradeRuns.repoId, repoId))).orderBy(desc9(upgradeRuns.createdAt)).limit(limit);
 }
 async function getUpgradeImpact(db, ownerId, days = 30) {
   const since = new Date(Date.now() - days * 864e5);
   const rows = await db.select({
-    analysed: sql13`count(*)::int`,
-    blocking: sql13`count(*) filter (where ${upgradeRuns.severity} = 'blocking')::int`,
-    callSites: sql13`coalesce(sum(${upgradeRuns.callSites}) filter (where ${upgradeRuns.severity} = 'blocking'), 0)::int`,
-    prsOpened: sql13`count(*) filter (where ${upgradeRuns.status} in ('pr_open','merged'))::int`,
-    merged: sql13`count(*) filter (where ${upgradeRuns.status} = 'merged')::int`,
-    unverified: sql13`count(*) filter (where ${upgradeRuns.severity} = 'unverified')::int`
-  }).from(upgradeRuns).where(and13(eq17(upgradeRuns.ownerId, ownerId), gte2(upgradeRuns.createdAt, since)));
+    analysed: sql15`count(*)::int`,
+    blocking: sql15`count(*) filter (where ${upgradeRuns.severity} = 'blocking')::int`,
+    callSites: sql15`coalesce(sum(${upgradeRuns.callSites}) filter (where ${upgradeRuns.severity} = 'blocking'), 0)::int`,
+    prsOpened: sql15`count(*) filter (where ${upgradeRuns.status} in ('pr_open','merged'))::int`,
+    merged: sql15`count(*) filter (where ${upgradeRuns.status} = 'merged')::int`,
+    unverified: sql15`count(*) filter (where ${upgradeRuns.severity} = 'unverified')::int`
+  }).from(upgradeRuns).where(and21(eq24(upgradeRuns.ownerId, ownerId), gte4(upgradeRuns.createdAt, since)));
   return rows[0] ?? {
     analysed: 0,
     blocking: 0,
@@ -10966,6 +12550,59 @@ var init_upgradeRuns = __esm({
   }
 });
 
+// src/github/webhook.ts
+import { createHmac, timingSafeEqual } from "crypto";
+function verifyWebhookSignature(secret, body, header) {
+  if (!header?.startsWith("sha256=")) return false;
+  const presented = Buffer.from(header.slice(7), "hex");
+  const expected = createHmac("sha256", secret).update(body).digest();
+  return presented.length === expected.length && timingSafeEqual(presented, expected);
+}
+function fullNames(value) {
+  if (!Array.isArray(value)) return [];
+  return value.map(
+    (entry) => entry && typeof entry === "object" && typeof entry.full_name === "string" ? entry.full_name : null
+  ).filter((name) => name !== null);
+}
+function installationId(payload) {
+  const install = payload.installation;
+  const id = install && typeof install === "object" ? install.id : null;
+  return typeof id === "number" && Number.isInteger(id) && id > 0 ? id : null;
+}
+function parseWebhook(event, payload) {
+  if (!payload || typeof payload !== "object") return { kind: "ignored", reason: "no payload" };
+  const body = payload;
+  const id = installationId(body);
+  if (id === null) return { kind: "ignored", reason: "no installation id" };
+  const action = typeof body.action === "string" ? body.action : "";
+  if (event === "installation_repositories") {
+    const added = fullNames(body.repositories_added);
+    const removed = fullNames(body.repositories_removed);
+    if (added.length === 0 && removed.length === 0) {
+      return { kind: "ignored", reason: "no repository changes" };
+    }
+    return { kind: "repos-changed", installationId: id, added, removed };
+  }
+  if (event === "installation") {
+    if (action === "deleted") return { kind: "uninstalled", installationId: id };
+    if (action === "added" || action === "removed") {
+      const added = fullNames(body.repositories_added);
+      const removed = fullNames(body.repositories_removed);
+      if (added.length || removed.length) {
+        return { kind: "repos-changed", installationId: id, added, removed };
+      }
+    }
+    return { kind: "ignored", reason: `installation.${action || "unknown"}` };
+  }
+  return { kind: "ignored", reason: `event ${event ?? "unknown"}` };
+}
+var init_webhook = __esm({
+  "src/github/webhook.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/github/sbom.ts
 function parseNpmPurl(purl) {
   if (!purl.startsWith("pkg:npm/")) return null;
@@ -11007,10 +12644,10 @@ function parseRelationships(json2) {
   }
   return out;
 }
-async function fetchResolvedTree(installationId, fullName) {
+async function fetchResolvedTree(installationId2, fullName) {
   try {
     const data = await installationGet(
-      installationId,
+      installationId2,
       `/repos/${fullName}/dependency-graph/sbom`
     );
     const deps = parseSbom(data);
@@ -11048,7 +12685,7 @@ async function scanRepo(db, repo) {
       branch
     );
     const resolvedTree = await fetchResolvedTree(repo.installationId, repo.fullName);
-    const drift = await computeDrift(db, manifests, resolvedTree);
+    const drift = await computeDrift(db, manifests, resolvedTree, repo.ownerId);
     await saveScan(db, repo.id, { manifests, drift, installCommand: installCommand2 });
     return {
       ...base,
@@ -11074,15 +12711,24 @@ async function scanRepo(db, repo) {
     };
   }
 }
-async function scanEach(db, rows) {
+async function scanRepos(db, rows) {
   const results = [];
   for (const repo of rows) {
     results.push(await scanRepo(db, repo));
   }
   return results;
 }
-async function scanOwnerRepos(db, ownerId) {
-  return scanEach(db, await listRepos(db, ownerId));
+function byRecentPush(rows, inventory) {
+  const pushedAt = (repo) => {
+    const parsed = Date.parse(repo.pushedAt ?? "");
+    return Number.isNaN(parsed) ? 0 : parsed;
+  };
+  const rank2 = new Map(
+    [...inventory].sort((a, b) => pushedAt(b) - pushedAt(a)).map((repo, index2) => [repo.fullName, index2])
+  );
+  return [...rows].sort(
+    (a, b) => (rank2.get(a.fullName) ?? Number.MAX_SAFE_INTEGER) - (rank2.get(b.fullName) ?? Number.MAX_SAFE_INTEGER)
+  );
 }
 var init_repoScan = __esm({
   "src/pipeline/repoScan.ts"() {
@@ -11100,16 +12746,27 @@ var init_repoScan = __esm({
 // src/mcp/http.ts
 var http_exports = {};
 __export(http_exports, {
+  errorEnvelope: () => errorEnvelope,
   secretEquals: () => secretEquals,
   startHttpServer: () => startHttpServer
 });
-import { createHash as createHash9, timingSafeEqual } from "crypto";
+import { createHash as createHash9, timingSafeEqual as timingSafeEqual2 } from "crypto";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 function rpcError(code, message) {
   return { jsonrpc: "2.0", error: { code, message }, id: null };
 }
+function errorEnvelope(err, path2) {
+  const clientFault = typeof err.type === "string" && err.type.startsWith("entity.");
+  const status = typeof err.status === "number" && err.status >= 400 && err.status < 600 ? err.status : 500;
+  const message = clientFault ? err.type === "entity.too.large" ? "Request body too large (limit 1mb)." : "Request body is not valid JSON." : "Internal error.";
+  const body = path2 === "/mcp" ? (
+    // -32700 is JSON-RPC's own "parse error"; -32603 is "internal error".
+    rpcError(clientFault ? -32700 : -32603, message)
+  ) : { error: message };
+  return { status, body, clientFault };
+}
 function secretEquals(a, b) {
-  return timingSafeEqual(
+  return timingSafeEqual2(
     createHash9("sha256").update(a).digest(),
     createHash9("sha256").update(b).digest()
   );
@@ -11118,7 +12775,7 @@ async function startHttpServer(opts = {}) {
   const config = getConfig();
   const port = opts.port ?? config.PORT;
   const [{ default: express }, { default: helmet }, { rateLimit, ipKeyGenerator }] = await Promise.all([import("express"), import("helmet"), import("express-rate-limit")]);
-  const { db } = createDb({ max: 20 });
+  const { db, close: closeDb } = createDb({ max: 20 });
   if (!process.env.REDIS_URL) {
     logger.warn(
       "REDIS_URL not set, response caching is OFF; every request recomputes on the database. Set REDIS_URL before serving real traffic (and it also backs the rate limiter across instances)."
@@ -11140,7 +12797,14 @@ async function startHttpServer(opts = {}) {
   const app = express();
   app.set("trust proxy", 1);
   app.use(helmet());
-  app.use(express.json({ limit: "1mb" }));
+  app.use(
+    express.json({
+      limit: "1mb",
+      verify: (req, _res, buf) => {
+        req.rawBody = buf;
+      }
+    })
+  );
   app.get("/healthz", (_req, res) => {
     res.status(200).json({ status: "ok" });
   });
@@ -11152,7 +12816,7 @@ async function startHttpServer(opts = {}) {
     }
     const header = req.headers.authorization;
     const presented = header?.startsWith("Bearer ") ? header.slice(7).trim() : "";
-    if (presented !== token) {
+    if (!secretEquals(presented, token)) {
       res.status(401).end();
       return;
     }
@@ -11166,6 +12830,11 @@ async function startHttpServer(opts = {}) {
     ...makeStore ? { store: makeStore("rl:ip:") } : {},
     message: rpcError(-32029, "Rate limit exceeded.")
   });
+  app.get("/capabilities", ipLimiter, (req, res) => {
+    const q = typeof req.query.q === "string" ? req.query.q : "";
+    const limit = Math.min(Number(req.query.limit) || 6, CAPABILITIES.length);
+    res.json({ capabilities: q ? searchCapabilities(q, limit) : CAPABILITIES });
+  });
   const auth = async (req, res, next) => {
     const header = req.headers.authorization;
     const token = header?.startsWith("Bearer ") ? header.slice(7).trim() : "";
@@ -11186,9 +12855,30 @@ async function startHttpServer(opts = {}) {
       res.status(500).json(rpcError(-32603, "Internal error."));
     }
   };
+  const entitlementCache = /* @__PURE__ */ new Map();
+  const ENTITLEMENT_TTL_MS = 6e4;
+  const invalidateEntitlement = (ownerId) => entitlementCache.delete(ownerId);
+  const resolveEntitlement = async (ownerId) => {
+    if (!ownerId) return entitlementFor(db, null);
+    const hit = entitlementCache.get(ownerId);
+    if (hit && Date.now() - hit.at < ENTITLEMENT_TTL_MS) return hit.value;
+    const value = await entitlementFor(db, ownerId);
+    entitlementCache.set(ownerId, { at: Date.now(), value });
+    return value;
+  };
   const keyLimiter = rateLimit({
     windowMs: config.LURQ_RATE_LIMIT_WINDOW_MS,
-    limit: config.LURQ_RATE_LIMIT_MAX,
+    // The burst ceiling is the plan's, not one number for everybody. Read from
+    // the cached entitlement when `quota` has already resolved it on a previous
+    // request for this key, and otherwise from LURQ_RATE_LIMIT_MAX — the limiter
+    // runs BEFORE `quota` in the chain, so the first request of a minute is
+    // metered at the configured default and the rest at the plan's rate. Paying
+    // for Enterprise should not leave you sharing the free tier's burst.
+    limit: (req) => {
+      const ownerId = req.lurqKey?.ownerId;
+      const cached3 = ownerId ? entitlementCache.get(ownerId) : void 0;
+      return cached3?.value.plan.ratePerMinute ?? config.LURQ_RATE_LIMIT_MAX;
+    },
     standardHeaders: "draft-7",
     legacyHeaders: false,
     // Key on the resolved API key's unique row id (always present — auth runs
@@ -11203,6 +12893,30 @@ async function startHttpServer(opts = {}) {
     ...makeStore ? { store: makeStore("rl:key:") } : {},
     message: rpcError(-32029, "Rate limit exceeded.")
   });
+  const quota = async (req, res, next) => {
+    const authed = req;
+    const ownerId = authed.lurqKey?.ownerId ?? null;
+    try {
+      const ent = await resolveEntitlement(ownerId);
+      authed.entitlement = ent;
+      if (!ent.withinQuota) {
+        res.status(402).json(
+          rpcError(
+            -32002,
+            `Monthly limit reached for the ${ent.plan.name} plan (${ent.used}/${ent.plan.monthlyCalls} calls). It resets when the month turns. Upgrade at ${config.LURQ_WEB_URL}/#pricing`
+          )
+        );
+        return;
+      }
+      next();
+    } catch (err) {
+      logger.error(
+        "quota lookup failed, serving anyway:",
+        err instanceof Error ? err.message : String(err)
+      );
+      next();
+    }
+  };
   const requireIssuerSecret = (req, res, next) => {
     const secret = config.LURQ_ISSUER_SECRET;
     if (!secret) {
@@ -11226,6 +12940,154 @@ async function startHttpServer(opts = {}) {
     lastUsedAt: row.lastUsedAt,
     revokedAt: row.revokedAt
   });
+  app.post("/billing/checkout", requireIssuerSecret, async (req, res) => {
+    if (!billingEnabled()) {
+      res.status(404).end();
+      return;
+    }
+    const ownerId = typeof req.body?.ownerId === "string" ? req.body.ownerId.trim() : "";
+    const tier = typeof req.body?.tier === "string" ? req.body.tier : "pro";
+    const email = typeof req.body?.email === "string" ? req.body.email : null;
+    if (!ownerId) {
+      res.status(400).json({ error: "ownerId is required." });
+      return;
+    }
+    if (!(tier in PLANS) || !PLANS[tier].paid) {
+      res.status(400).json({ error: `${tier} is not a purchasable plan.` });
+      return;
+    }
+    try {
+      const url = await createCheckoutSession(db, { ownerId, tier, email });
+      if (!url) {
+        res.status(503).json({ error: "That plan is not available for checkout yet." });
+        return;
+      }
+      res.status(200).json({ url });
+    } catch (err) {
+      logger.error("checkout failed:", err instanceof Error ? err.message : String(err));
+      res.status(502).json({ error: "Could not start checkout." });
+    }
+  });
+  app.post("/billing/portal", requireIssuerSecret, async (req, res) => {
+    if (!billingEnabled()) {
+      res.status(404).end();
+      return;
+    }
+    const ownerId = typeof req.body?.ownerId === "string" ? req.body.ownerId.trim() : "";
+    if (!ownerId) {
+      res.status(400).json({ error: "ownerId is required." });
+      return;
+    }
+    try {
+      const url = await createPortalSession(db, ownerId);
+      if (!url) {
+        res.status(404).json({ error: "No billing account for this user yet." });
+        return;
+      }
+      res.status(200).json({ url });
+    } catch (err) {
+      logger.error("portal failed:", err instanceof Error ? err.message : String(err));
+      res.status(502).json({ error: "Could not open the billing portal." });
+    }
+  });
+  const ASK_DAILY_LIMIT_MICROS = Math.max(
+    0,
+    Math.round(Number(process.env.LURQ_ASK_DAILY_USD ?? "3") * 1e6)
+  );
+  app.get("/ask-budget", requireIssuerSecret, async (req, res) => {
+    const ownerId = typeof req.query.ownerId === "string" ? req.query.ownerId.trim() : "";
+    if (!ownerId) {
+      res.status(400).json({ error: "ownerId is required." });
+      return;
+    }
+    try {
+      const spentMicros = await getAskSpendToday(db, ownerId);
+      res.status(200).json({ spentMicros, limitMicros: ASK_DAILY_LIMIT_MICROS });
+    } catch (err) {
+      logger.error("ask budget read failed:", err instanceof Error ? err.message : String(err));
+      res.status(500).json({ error: "Could not read the Ask budget." });
+    }
+  });
+  app.post("/ask-budget", requireIssuerSecret, async (req, res) => {
+    const body = req.body ?? {};
+    const ownerId = typeof body.ownerId === "string" ? body.ownerId.trim() : "";
+    const micros = Number(body.usdMicros);
+    if (!ownerId) {
+      res.status(400).json({ error: "ownerId is required." });
+      return;
+    }
+    if (!Number.isFinite(micros) || Math.abs(micros) > ASK_DAILY_LIMIT_MICROS) {
+      res.status(400).json({ error: "usdMicros must be a finite delta within one day's limit." });
+      return;
+    }
+    try {
+      const spentMicros = await addAskSpend(db, ownerId, Math.round(micros));
+      res.status(200).json({ spentMicros, limitMicros: ASK_DAILY_LIMIT_MICROS });
+    } catch (err) {
+      logger.error("ask budget write failed:", err instanceof Error ? err.message : String(err));
+      res.status(500).json({ error: "Could not record Ask spend." });
+    }
+  });
+  app.get("/billing/subscription", requireIssuerSecret, async (req, res) => {
+    const ownerId = typeof req.query.ownerId === "string" ? req.query.ownerId.trim() : "";
+    if (!ownerId) {
+      res.status(400).json({ error: "ownerId is required." });
+      return;
+    }
+    try {
+      const [sub, ent] = await Promise.all([
+        getSubscription(db, ownerId),
+        entitlementFor(db, ownerId)
+      ]);
+      res.status(200).json({
+        tier: ent.plan.tier,
+        planName: ent.plan.name,
+        status: sub?.status ?? null,
+        currentPeriodEnd: sub?.currentPeriodEnd?.toISOString() ?? null,
+        cancelAtPeriodEnd: sub?.cancelAtPeriodEnd ?? false,
+        used: ent.used,
+        limit: ent.plan.monthlyCalls,
+        billingEnabled: billingEnabled(),
+        manageable: Boolean(sub?.stripeCustomerId)
+      });
+    } catch (err) {
+      logger.error("subscription read failed:", err instanceof Error ? err.message : String(err));
+      res.status(500).json({ error: "Could not read the subscription." });
+    }
+  });
+  app.post("/billing/webhook", async (req, res) => {
+    const raw = req.rawBody;
+    const signature = req.headers["stripe-signature"];
+    let event;
+    try {
+      event = await constructEvent(
+        raw ?? "",
+        typeof signature === "string" ? signature : void 0
+      );
+    } catch (err) {
+      logger.warn(
+        `billing webhook: bad signature: ${err instanceof Error ? err.message : String(err)}`
+      );
+      res.status(400).json({ error: "Invalid signature." });
+      return;
+    }
+    if (!event) {
+      res.status(404).end();
+      return;
+    }
+    res.status(200).json({ received: true });
+    try {
+      const outcome = await handleEvent(db, event);
+      logger.info(`billing webhook: ${outcome}`);
+      const object = event.data.object;
+      if (typeof object.customer === "string") {
+        const row = await getSubscriptionByCustomer(db, object.customer);
+        if (row) invalidateEntitlement(row.ownerId);
+      }
+    } catch (err) {
+      logger.error("billing webhook failed:", err instanceof Error ? err.message : String(err));
+    }
+  });
   app.post("/keys", requireIssuerSecret, async (req, res) => {
     const body = req.body ?? {};
     const ownerId = typeof body.ownerId === "string" ? body.ownerId.trim() : "";
@@ -11371,7 +13233,10 @@ async function startHttpServer(opts = {}) {
     const offsetRaw = typeof req.query.offset === "string" ? Number(req.query.offset) : NaN;
     const offset = Number.isInteger(offsetRaw) && offsetRaw > 0 ? offsetRaw : 0;
     try {
-      const { total, packages: rows } = await getContributionsByOwner(db, ownerId, { limit, offset });
+      const { total, packages: rows } = await getContributionsByOwner(db, ownerId, {
+        limit,
+        offset
+      });
       res.status(200).json({ total, packages: rows });
     } catch (err) {
       logger.error("contributions read failed:", err instanceof Error ? err.message : String(err));
@@ -11427,34 +13292,85 @@ async function startHttpServer(opts = {}) {
     if (raw.scope !== "security" && raw.scope !== "blocking" && raw.scope !== "all") return null;
     return { enabled: raw.enabled, scope: raw.scope, autoMerge: raw.autoMerge };
   }
-  app.post("/repos/connect", requireIssuerSecret, requireGithubApp, async (req, res) => {
-    const ownerId = ownerFrom(req);
-    const installationRaw = (req.body ?? {}).installationId;
-    const installationId = Number(installationRaw);
-    if (!ownerId || !Number.isInteger(installationId) || installationId <= 0) {
-      res.status(400).json({ error: "ownerId and installationId are required." });
+  const syncInstallation = async (ownerId, installationId2, scanOnly) => {
+    const found = await listInstallationRepos(installationId2);
+    const connected = await upsertRepos(
+      db,
+      found.map((repo) => ({
+        ownerId,
+        installationId: installationId2,
+        fullName: repo.fullName,
+        defaultBranch: repo.defaultBranch,
+        isPrivate: repo.isPrivate
+      }))
+    );
+    void (async () => {
+      const rows = byRecentPush(await listRepos(db, ownerId), found);
+      const only = scanOnly ? new Set(scanOnly) : null;
+      await scanRepos(db, only ? rows.filter((row) => only.has(row.fullName)) : rows);
+    })().catch((err) => {
+      logger.warn(`repo scan failed: ${err instanceof Error ? err.message : String(err)}`);
+    });
+    return connected;
+  };
+  app.post(
+    "/repos/connect",
+    requireIssuerSecret,
+    requireGithubApp,
+    async (req, res) => {
+      const ownerId = ownerFrom(req);
+      const installationRaw = (req.body ?? {}).installationId;
+      const installationId2 = Number(installationRaw);
+      if (!ownerId || !Number.isInteger(installationId2) || installationId2 <= 0) {
+        res.status(400).json({ error: "ownerId and installationId are required." });
+        return;
+      }
+      try {
+        res.status(200).json({ connected: await syncInstallation(ownerId, installationId2) });
+      } catch (err) {
+        const status = err instanceof GithubAppError ? err.status : 502;
+        logger.error("repo connect failed:", err instanceof Error ? err.message : String(err));
+        res.status(status).json({ error: "Could not read the GitHub installation." });
+      }
+    }
+  );
+  app.post("/github/webhook", requireGithubApp, async (req, res) => {
+    const secret = config.LURQ_GITHUB_WEBHOOK_SECRET;
+    if (!secret) {
+      res.status(404).end();
       return;
     }
+    const raw = req.rawBody;
+    const signature = req.headers["x-hub-signature-256"];
+    if (!raw || !verifyWebhookSignature(secret, raw, typeof signature === "string" ? signature : void 0)) {
+      res.status(401).json({ error: "Invalid signature." });
+      return;
+    }
+    const event = req.headers["x-github-event"];
+    const action = parseWebhook(typeof event === "string" ? event : void 0, req.body);
+    res.status(202).end();
+    if (action.kind === "ignored") return;
     try {
-      const found = await listInstallationRepos(installationId);
-      const connected = await upsertRepos(
-        db,
-        found.map((repo) => ({
-          ownerId,
-          installationId,
-          fullName: repo.fullName,
-          defaultBranch: repo.defaultBranch,
-          isPrivate: repo.isPrivate
-        }))
-      );
-      void scanOwnerRepos(db, ownerId).catch((err) => {
-        logger.warn(`initial repo scan failed: ${err instanceof Error ? err.message : String(err)}`);
-      });
-      res.status(200).json({ connected });
+      if (action.kind === "uninstalled") {
+        const forgotten = await deleteReposByInstallation(db, action.installationId);
+        logger.info(`installation ${action.installationId} uninstalled, forgot ${forgotten} repos`);
+        return;
+      }
+      if (action.removed.length > 0) {
+        await deleteReposByInstallation(db, action.installationId, action.removed);
+      }
+      if (action.added.length === 0) return;
+      const ownerId = await ownerForInstallation(db, action.installationId);
+      if (!ownerId) {
+        logger.warn(`webhook for unlinked installation ${action.installationId}, ignored`);
+        return;
+      }
+      await syncInstallation(ownerId, action.installationId, action.added);
     } catch (err) {
-      const status = err instanceof GithubAppError ? err.status : 502;
-      logger.error("repo connect failed:", err instanceof Error ? err.message : String(err));
-      res.status(status).json({ error: "Could not read the GitHub installation." });
+      logger.error(
+        `webhook handling failed for installation ${action.installationId}:`,
+        err instanceof Error ? err.message : String(err)
+      );
     }
   });
   app.get("/repos", requireIssuerSecret, requireGithubApp, async (req, res) => {
@@ -11471,129 +13387,162 @@ async function startHttpServer(opts = {}) {
       res.status(500).json({ error: "Could not list repos." });
     }
   });
-  app.get("/repos/alerts", requireIssuerSecret, requireGithubApp, async (req, res) => {
-    const ownerId = ownerFrom(req);
-    if (!ownerId) {
-      res.status(400).json({ error: "ownerId is required." });
-      return;
-    }
-    try {
-      res.status(200).json({ alerts: await listAlerts(db, ownerId) });
-    } catch (err) {
-      logger.error("alert list failed:", err instanceof Error ? err.message : String(err));
-      res.status(500).json({ error: "Could not list alerts." });
-    }
-  });
-  app.get("/repos/:id", requireIssuerSecret, requireGithubApp, async (req, res) => {
-    const ownerId = ownerFrom(req);
-    const id = Number(req.params.id);
-    if (!ownerId || !Number.isInteger(id)) {
-      res.status(400).json({ error: "ownerId and a numeric id are required." });
-      return;
+  app.get(
+    "/repos/alerts",
+    requireIssuerSecret,
+    requireGithubApp,
+    async (req, res) => {
+      const ownerId = ownerFrom(req);
+      if (!ownerId) {
+        res.status(400).json({ error: "ownerId is required." });
+        return;
+      }
+      try {
+        res.status(200).json({ alerts: await listAlerts(db, ownerId) });
+      } catch (err) {
+        logger.error("alert list failed:", err instanceof Error ? err.message : String(err));
+        res.status(500).json({ error: "Could not list alerts." });
+      }
     }
-    try {
-      const row = await getRepo(db, ownerId, id);
-      if (!row) {
-        res.status(404).json({ error: "Repo not found." });
+  );
+  app.get(
+    "/repos/:id",
+    requireIssuerSecret,
+    requireGithubApp,
+    async (req, res) => {
+      const ownerId = ownerFrom(req);
+      const id = Number(req.params.id);
+      if (!ownerId || !Number.isInteger(id)) {
+        res.status(400).json({ error: "ownerId and a numeric id are required." });
         return;
       }
-      const runs = await listRunsForRepo(db, ownerId, row.id);
-      const workflow = renderWorkflow({
-        installCommand: row.installCommand ?? void 0,
-        armed: row.policy.enabled,
-        autoMerge: row.policy.autoMerge
-      });
-      res.status(200).json({
-        repo: {
-          ...toDashboardRepo(row),
-          deps: row.drift?.deps ?? [],
-          transitiveRisks: row.drift?.transitive?.risks ?? [],
-          conflicts: row.drift?.conflictsAtLatest ?? null,
-          runs,
-          workflow,
-          workflowPath: WORKFLOW_PATH,
-          setupUrl: newFileUrl(row.fullName, row.defaultBranch ?? "main", workflow)
+      try {
+        const row = await getRepo(db, ownerId, id);
+        if (!row) {
+          res.status(404).json({ error: "Repo not found." });
+          return;
         }
-      });
-    } catch (err) {
-      logger.error("repo read failed:", err instanceof Error ? err.message : String(err));
-      res.status(500).json({ error: "Could not read repo." });
-    }
-  });
-  app.get("/repos/:id/brief", requireIssuerSecret, requireGithubApp, async (req, res) => {
-    const ownerId = ownerFrom(req);
-    const id = Number(req.params.id);
-    if (!ownerId || !Number.isInteger(id)) {
-      res.status(400).json({ error: "ownerId and a numeric id are required." });
-      return;
+        const runs = await listRunsForRepo(db, ownerId, row.id);
+        const workflow = renderWorkflow({
+          installCommand: row.installCommand ?? void 0,
+          armed: row.policy.enabled,
+          autoMerge: row.policy.autoMerge
+        });
+        res.status(200).json({
+          repo: {
+            ...toDashboardRepo(row),
+            deps: row.drift?.deps ?? [],
+            transitiveRisks: row.drift?.transitive?.risks ?? [],
+            conflicts: row.drift?.conflictsAtLatest ?? null,
+            runs,
+            workflow,
+            workflowPath: WORKFLOW_PATH,
+            setupUrl: newFileUrl(row.fullName, row.defaultBranch ?? "main", workflow)
+          }
+        });
+      } catch (err) {
+        logger.error("repo read failed:", err instanceof Error ? err.message : String(err));
+        res.status(500).json({ error: "Could not read repo." });
+      }
     }
-    try {
-      const row = await getRepo(db, ownerId, id);
-      if (!row) {
-        res.status(404).json({ error: "Repo not found." });
+  );
+  app.get(
+    "/repos/:id/brief",
+    requireIssuerSecret,
+    requireGithubApp,
+    async (req, res) => {
+      const ownerId = ownerFrom(req);
+      const id = Number(req.params.id);
+      if (!ownerId || !Number.isInteger(id)) {
+        res.status(400).json({ error: "ownerId and a numeric id are required." });
         return;
       }
-      res.status(200).json(await briefRepo(db, row.drift ?? null));
-    } catch (err) {
-      logger.error("repo brief failed:", err instanceof Error ? err.message : String(err));
-      res.status(500).json({ error: "Could not build the migration brief." });
-    }
-  });
-  app.post("/repos/:id/scan", requireIssuerSecret, requireGithubApp, async (req, res) => {
-    const ownerId = ownerFrom(req);
-    const id = Number(req.params.id);
-    if (!ownerId || !Number.isInteger(id)) {
-      res.status(400).json({ error: "ownerId and a numeric id are required." });
-      return;
+      try {
+        const row = await getRepo(db, ownerId, id);
+        if (!row) {
+          res.status(404).json({ error: "Repo not found." });
+          return;
+        }
+        res.status(200).json(await briefRepo(db, row.drift ?? null));
+      } catch (err) {
+        logger.error("repo brief failed:", err instanceof Error ? err.message : String(err));
+        res.status(500).json({ error: "Could not build the migration brief." });
+      }
     }
-    try {
-      const row = await getRepo(db, ownerId, id);
-      if (!row) {
-        res.status(404).json({ error: "Repo not found." });
+  );
+  app.post(
+    "/repos/:id/scan",
+    requireIssuerSecret,
+    requireGithubApp,
+    async (req, res) => {
+      const ownerId = ownerFrom(req);
+      const id = Number(req.params.id);
+      if (!ownerId || !Number.isInteger(id)) {
+        res.status(400).json({ error: "ownerId and a numeric id are required." });
         return;
       }
-      const result = await scanRepo(db, row);
-      res.status(200).json({ result });
-    } catch (err) {
-      logger.error("repo scan failed:", err instanceof Error ? err.message : String(err));
-      res.status(500).json({ error: "Could not scan repo." });
-    }
-  });
-  app.patch("/repos/:id", requireIssuerSecret, requireGithubApp, async (req, res) => {
-    const ownerId = ownerFrom(req);
-    const id = Number(req.params.id);
-    const policy = parsePolicy((req.body ?? {}).policy);
-    if (!ownerId || !Number.isInteger(id) || !policy) {
-      res.status(400).json({ error: "ownerId, a numeric id, and a complete policy are required." });
-      return;
+      try {
+        const row = await getRepo(db, ownerId, id);
+        if (!row) {
+          res.status(404).json({ error: "Repo not found." });
+          return;
+        }
+        const result = await scanRepo(db, row);
+        res.status(200).json({ result });
+      } catch (err) {
+        logger.error("repo scan failed:", err instanceof Error ? err.message : String(err));
+        res.status(500).json({ error: "Could not scan repo." });
+      }
     }
-    try {
-      const updated = await setRepoPolicy(db, ownerId, id, policy);
-      if (!updated) {
-        res.status(404).json({ error: "Repo not found." });
+  );
+  app.patch(
+    "/repos/:id",
+    requireIssuerSecret,
+    requireGithubApp,
+    async (req, res) => {
+      const ownerId = ownerFrom(req);
+      const id = Number(req.params.id);
+      const policy = parsePolicy((req.body ?? {}).policy);
+      if (!ownerId || !Number.isInteger(id) || !policy) {
+        res.status(400).json({ error: "ownerId, a numeric id, and a complete policy are required." });
         return;
       }
-      res.status(200).json({ policy });
-    } catch (err) {
-      logger.error("repo policy update failed:", err instanceof Error ? err.message : String(err));
-      res.status(500).json({ error: "Could not update policy." });
-    }
-  });
-  app.delete("/repos/:id", requireIssuerSecret, requireGithubApp, async (req, res) => {
-    const ownerId = ownerFrom(req);
-    const id = Number(req.params.id);
-    if (!ownerId || !Number.isInteger(id)) {
-      res.status(400).json({ error: "ownerId and a numeric id are required." });
-      return;
+      try {
+        const updated = await setRepoPolicy(db, ownerId, id, policy);
+        if (!updated) {
+          res.status(404).json({ error: "Repo not found." });
+          return;
+        }
+        res.status(200).json({ policy });
+      } catch (err) {
+        logger.error(
+          "repo policy update failed:",
+          err instanceof Error ? err.message : String(err)
+        );
+        res.status(500).json({ error: "Could not update policy." });
+      }
     }
-    try {
-      const removed = await deleteRepo(db, ownerId, id);
-      res.status(removed ? 200 : 404).json(removed ? { removed: true } : { error: "Repo not found." });
-    } catch (err) {
-      logger.error("repo delete failed:", err instanceof Error ? err.message : String(err));
-      res.status(500).json({ error: "Could not disconnect repo." });
+  );
+  app.delete(
+    "/repos/:id",
+    requireIssuerSecret,
+    requireGithubApp,
+    async (req, res) => {
+      const ownerId = ownerFrom(req);
+      const id = Number(req.params.id);
+      if (!ownerId || !Number.isInteger(id)) {
+        res.status(400).json({ error: "ownerId and a numeric id are required." });
+        return;
+      }
+      try {
+        const removed = await deleteRepo(db, ownerId, id);
+        res.status(removed ? 200 : 404).json(removed ? { removed: true } : { error: "Repo not found." });
+      } catch (err) {
+        logger.error("repo delete failed:", err instanceof Error ? err.message : String(err));
+        res.status(500).json({ error: "Could not disconnect repo." });
+      }
     }
-  });
+  );
   app.get("/selection-policy", requireIssuerSecret, async (req, res) => {
     const ownerId = ownerFrom(req);
     if (!ownerId) {
@@ -11603,7 +13552,10 @@ async function startHttpServer(opts = {}) {
     try {
       res.status(200).json({ policy: await getSelectionPolicy(db, ownerId) });
     } catch (err) {
-      logger.error("selection policy read failed:", err instanceof Error ? err.message : String(err));
+      logger.error(
+        "selection policy read failed:",
+        err instanceof Error ? err.message : String(err)
+      );
       res.status(500).json({ error: "Could not read policy." });
     }
   });
@@ -11618,75 +13570,117 @@ async function startHttpServer(opts = {}) {
       await setSelectionPolicy(db, ownerId, policy);
       res.status(200).json({ policy });
     } catch (err) {
-      logger.error("selection policy write failed:", err instanceof Error ? err.message : String(err));
+      logger.error(
+        "selection policy write failed:",
+        err instanceof Error ? err.message : String(err)
+      );
       res.status(500).json({ error: "Could not save policy." });
     }
   });
-  app.post("/upgrade-plan", ipLimiter, auth, keyLimiter, async (req, res) => {
-    const deps = parseDepsInput((req.body ?? {}).deps);
-    if (Object.keys(deps).length === 0) {
-      res.status(400).json({ error: 'deps is required: { "package": "range", \u2026 }' });
-      return;
+  app.get(
+    "/selection-policy/conformance",
+    requireIssuerSecret,
+    async (req, res) => {
+      const ownerId = ownerFrom(req);
+      if (!ownerId) {
+        res.status(400).json({ error: "ownerId is required." });
+        return;
+      }
+      try {
+        res.status(200).json(await repoConformance(db, ownerId));
+      } catch (err) {
+        logger.error("conformance read failed:", err instanceof Error ? err.message : String(err));
+        res.status(500).json({ error: "Could not read conformance." });
+      }
     }
-    try {
-      const drift = await computeDrift(db, [{ path: "package.json", deps }]);
-      const brief = await briefRepo(db, drift);
+  );
+  app.post(
+    "/upgrade-plan",
+    ipLimiter,
+    auth,
+    keyLimiter,
+    quota,
+    async (req, res) => {
+      const deps = parseDepsInput((req.body ?? {}).deps);
+      if (Object.keys(deps).length === 0) {
+        res.status(400).json({ error: 'deps is required: { "package": "range", \u2026 }' });
+        return;
+      }
       const ownerId = req.lurqKey?.ownerId ?? null;
-      const repoFullName = parseRepoFullName((req.body ?? {}).repo);
-      const policy = ownerId && repoFullName ? await findPolicyByFullName(db, ownerId, repoFullName) : null;
-      const scoped = applyScope(brief.upgrades, policy);
-      res.status(200).json({
-        ...brief,
-        ...scoped,
-        // Surfaced so CI can log what lurq had no opinion on. An upgrade we do
-        // not know about must not look like an upgrade we cleared.
-        untracked: Object.keys(deps).length - drift.depsTracked
-      });
-    } catch (err) {
-      logger.error("upgrade plan failed:", err instanceof Error ? err.message : String(err));
-      res.status(500).json({ error: "Could not build the upgrade plan." });
-    }
-  });
-  app.post("/upgrade-runs", ipLimiter, auth, keyLimiter, async (req, res) => {
-    const ownerId = req.lurqKey?.ownerId ?? null;
-    if (!ownerId) {
-      res.status(403).json({ error: "This key has no account attached." });
-      return;
-    }
-    const { runs, rejected } = parseUpgradeRuns((req.body ?? {}).runs, MAX_RUNS_PER_POST);
-    if (runs.length === 0) {
-      res.status(400).json({ error: "runs must be a non-empty array of upgrade results." });
-      return;
+      try {
+        const drift = await computeDrift(db, [{ path: "package.json", deps }], null, ownerId);
+        const brief = await briefRepo(db, drift);
+        const repoFullName = parseRepoFullName((req.body ?? {}).repo);
+        const policy = ownerId && repoFullName ? await findPolicyByFullName(db, ownerId, repoFullName) : null;
+        const scoped = applyScope(brief.upgrades, policy);
+        res.status(200).json({
+          ...brief,
+          ...scoped,
+          // Surfaced so CI can log what lurq had no opinion on. An upgrade we do
+          // not know about must not look like an upgrade we cleared.
+          untracked: Object.keys(deps).length - drift.depsTracked
+        });
+        void recordUsage(db, ownerId, "upgrade-plan");
+      } catch (err) {
+        logger.error("upgrade plan failed:", err instanceof Error ? err.message : String(err));
+        res.status(500).json({ error: "Could not build the upgrade plan." });
+      }
     }
-    try {
-      const repoIds = /* @__PURE__ */ new Map();
-      for (const run of runs) {
-        if (!repoIds.has(run.repoFullName)) {
-          repoIds.set(run.repoFullName, await findRepoIdByFullName(db, ownerId, run.repoFullName));
+  );
+  app.post(
+    "/upgrade-runs",
+    ipLimiter,
+    auth,
+    keyLimiter,
+    quota,
+    async (req, res) => {
+      const ownerId = req.lurqKey?.ownerId ?? null;
+      if (!ownerId) {
+        res.status(403).json({ error: "This key has no account attached." });
+        return;
+      }
+      const { runs, rejected } = parseUpgradeRuns((req.body ?? {}).runs, MAX_RUNS_PER_POST);
+      if (runs.length === 0) {
+        res.status(400).json({ error: "runs must be a non-empty array of upgrade results." });
+        return;
+      }
+      try {
+        const repoIds = /* @__PURE__ */ new Map();
+        for (const run of runs) {
+          if (!repoIds.has(run.repoFullName)) {
+            repoIds.set(
+              run.repoFullName,
+              await findRepoIdByFullName(db, ownerId, run.repoFullName)
+            );
+          }
         }
+        const recorded = await recordUpgradeRuns(
+          db,
+          runs.map((run) => ({ ...run, ownerId, repoId: repoIds.get(run.repoFullName) ?? null }))
+        );
+        res.status(200).json({ recorded, rejected });
+        void recordUsage(db, ownerId, "upgrade-runs");
+      } catch (err) {
+        logger.error(
+          "upgrade run record failed:",
+          err instanceof Error ? err.message : String(err)
+        );
+        res.status(500).json({ error: "Could not record the upgrade runs." });
       }
-      const recorded = await recordUpgradeRuns(
-        db,
-        runs.map((run) => ({ ...run, ownerId, repoId: repoIds.get(run.repoFullName) ?? null }))
-      );
-      res.status(200).json({ recorded, rejected });
-    } catch (err) {
-      logger.error("upgrade run record failed:", err instanceof Error ? err.message : String(err));
-      res.status(500).json({ error: "Could not record the upgrade runs." });
     }
-  });
-  app.post("/mcp", ipLimiter, auth, keyLimiter, async (req, res) => {
-    const server = buildMcpServer(db, { ownerId: req.lurqKey?.ownerId ?? null });
+  );
+  app.post("/mcp", ipLimiter, auth, keyLimiter, quota, async (req, res) => {
+    const server2 = buildMcpServer(db, { ownerId: req.lurqKey?.ownerId ?? null });
     const transport = new StreamableHTTPServerTransport({
       sessionIdGenerator: void 0,
       enableJsonResponse: true
     });
     res.on("close", () => {
       void transport.close();
-      void server.close();
+      void server2.close();
     });
     try {
-      await server.connect(transport);
+      await server2.connect(transport);
       await transport.handleRequest(req, res, req.body);
     } catch (err) {
       logger.error("mcp request failed:", err instanceof Error ? err.message : String(err));
@@ -11696,9 +13690,41 @@ async function startHttpServer(opts = {}) {
   app.all("/mcp", (_req, res) => {
     res.status(405).json(rpcError(-32e3, "Method not allowed."));
   });
-  app.listen(port, () => {
+  app.use((err, req, res, _next) => {
+    const { status, body, clientFault } = errorEnvelope(err, req.path);
+    if (!clientFault) {
+      logger.error(`unhandled request error (${req.method} ${req.path}):`, err.message);
+    }
+    if (res.headersSent) return;
+    res.status(status).json(body);
+  });
+  const server = app.listen(port, () => {
     logger.info(`lurq HTTP MCP server listening on :${port}/mcp`);
   });
+  server.on("error", (err) => {
+    logger.error(`could not listen on :${port}: ${err.message}`);
+    process.exit(1);
+  });
+  const FORCE_EXIT_MS = 1e4;
+  let shuttingDown = false;
+  const shutdown = (signal) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    logger.info(`${signal} received, draining\u2026`);
+    const force = setTimeout(() => {
+      logger.warn("drain timed out, exiting anyway");
+      process.exit(0);
+    }, FORCE_EXIT_MS);
+    force.unref();
+    server.close(() => {
+      void closeDb().then(
+        () => process.exit(0),
+        () => process.exit(0)
+      );
+    });
+  };
+  process.on("SIGTERM", () => shutdown("SIGTERM"));
+  process.on("SIGINT", () => shutdown("SIGINT"));
 }
 var init_http2 = __esm({
   "src/mcp/http.ts"() {
@@ -11706,6 +13732,7 @@ var init_http2 = __esm({
     init_esm_shims();
     init_config();
     init_logger();
+    init_capabilities();
     init_apiKeys();
     init_outcomes();
     init_packages();
@@ -11713,15 +13740,21 @@ var init_http2 = __esm({
     init_repos();
     init_selectionPolicy();
     init_parse();
+    init_conformance();
     init_usage();
+    init_subscriptions();
+    init_stripe();
+    init_plans();
     init_client();
     init_app();
     init_brief();
     init_drift();
+    init_askSpend();
     init_scope();
     init_runs();
     init_upgradeRuns();
     init_manifests();
+    init_webhook();
     init_workflow();
     init_repoScan();
     init_server();
@@ -11731,7 +13764,7 @@ var init_http2 = __esm({
 
 // src/bin/lurq.ts
 init_esm_shims();
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import updateNotifier from "update-notifier";
 
 // src/cli/index.ts
@@ -11770,6 +13803,10 @@ function buildProgram() {
       clearUserConfig2() ? `Removed ${path2}. Agent MCP configs still hold the key; re-run \`lurq setup\` to change them.` : "No stored API key on this machine."
     );
   });
+  program.command("can").argument("[query...]", "what you are trying to do, in plain words").description("find the lurq capability for what you are trying to do").option("--json", "output matches as JSON").action(async (query, opts) => {
+    const { runCan: runCan2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
+    runCan2(query.join(" "), opts);
+  });
   program.command("recommend").argument("<need>", "natural-language description of what you need").description("recommend the best current packages for a described need").option("--category <category>", "restrict to a taxonomy category").option("--min-confidence <level>", "proven | emerging | promising | unproven").option("--json", "output JSON instead of a table").action(async (need, opts) => {
     const { runRecommend: runRecommend2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     await runRecommend2(need, opts);
@@ -11813,12 +13850,31 @@ function buildProgram() {
     const plan = await buildUpgradePlan2(dir, { url: opts.url, apiKey: opts.apiKey, repo: opts.repo });
     console.log(opts.json ? JSON.stringify(plan, null, 2) : formatUpgradePlan2(plan));
   });
-  program.command("check-upgrade").argument("[dir]", "project directory to scan (default: current)", ".").description("do these upgrades remove symbols your code actually references?").option("--plan <file>", "targets from `upgrade-plan --json`").option("--upgrade <spec...>", "pkg@from..to (repeatable), e.g. commander@11.1.0..12.1.0").option("--json", "output the report as JSON").option("--exit-code", "exit 1 when the report is not safe (for CI)").action(
+  program.command("check-upgrade").argument("[dir]", "project directory to scan (default: current)", ".").description("do these upgrades remove symbols your code actually references?").option("--plan <file>", "targets from `upgrade-plan --json`").option("--upgrade <spec...>", "pkg@from..to (repeatable), e.g. commander@11.1.0..12.1.0").option("--json", "output the report as JSON").option("--exit-code", "exit 1 when the report is not safe (for CI)").option("--report", "send the result to your lurq dashboard (CI; needs an API key)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").action(
     async (dir, opts) => {
       const { runCheckUpgrade: runCheckUpgrade2 } = await Promise.resolve().then(() => (init_checkUpgrade(), checkUpgrade_exports));
       await runCheckUpgrade2(dir, opts);
     }
   );
+  program.command("check-release").argument("[dir]", "package directory (default: current)", ".").description("is the version you are about to publish honest about what changed?").option("--against <version>", "compare with this published version (default: latest)").option("--json", "output the check as JSON").option("--exit-code", "exit 1 when the bump is understated (for CI / prepublish)").action(
+    async (dir, opts) => {
+      const { checkRelease: checkRelease2, formatReleaseCheck: formatReleaseCheck2 } = await Promise.resolve().then(() => (init_release(), release_exports));
+      const check2 = await checkRelease2(dir, { against: opts.against });
+      console.log(opts.json ? JSON.stringify(check2, null, 2) : formatReleaseCheck2(check2));
+      if (opts.exitCode && check2.verdict !== "ok") process.exitCode = 1;
+    }
+  );
+  program.command("check-api").argument("[spec]", "OpenAPI document (default: the first one found)").description("does this change break the callers of your own API?").option("--against <rev>", "git revision to compare with (default: HEAD)").option("-C, --dir <dir>", "repository directory (default: current)", ".").option("--json", "output the check as JSON").option("--exit-code", "exit 1 on a breaking change (for CI)").action(
+    async (spec, opts) => {
+      const { runApiCheck: runApiCheck2 } = await Promise.resolve().then(() => (init_check2(), check_exports));
+      const { formatApiCheck: formatApiCheck2 } = await Promise.resolve().then(() => (init_diff3(), diff_exports));
+      const check2 = await runApiCheck2(opts.dir ?? ".", { spec, against: opts.against });
+      console.log(
+        opts.json ? JSON.stringify(check2, null, 2) : formatApiCheck2(check2, `api check (vs ${check2.against})`)
+      );
+      if (opts.exitCode && check2.verdict !== "ok") process.exitCode = 1;
+    }
+  );
   program.command("weights").description("show and explain the scoring weight model (health, quality, composite \u03BB)").option("--json", "output the weight model as JSON").action(async (opts) => {
     const { runWeights: runWeights2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
     runWeights2(opts);
@@ -11848,7 +13904,7 @@ init_config();
 // src/core/gate.ts
 init_esm_shims();
 init_constants();
-import { createHash as createHash10, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash10, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var PRE_LAUNCH = false;
 var OWNER_HASH = "9675c37e56783e747e4a89ee3919d95d1364f2e5dd0f14501b0f878f8cc3682b";
 var ALLOWED = /* @__PURE__ */ new Set([
@@ -11870,7 +13926,7 @@ function isOwner() {
   if (!key) return false;
   const got = createHash10("sha256").update(key).digest();
   const want = Buffer.from(OWNER_HASH, "hex");
-  return got.length === want.length && timingSafeEqual2(got, want);
+  return got.length === want.length && timingSafeEqual3(got, want);
 }
 function enforceGate(argv) {
   if (!PRE_LAUNCH || isOwner()) return;
@@ -11918,7 +13974,7 @@ function notifyOnUpdate() {
   if (quiet) return;
   try {
     const pkg = JSON.parse(
-      readFileSync9(new URL("../../package.json", import.meta.url), "utf8")
+      readFileSync10(new URL("../../package.json", import.meta.url), "utf8")
     );
     updateNotifier({ pkg }).notify();
   } catch {