lurqrun 0.1.6 → 0.1.7

package/dist/browserAuth-B6G27USY.js

@@ -0,0 +1,95 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  openInBrowser
+} from "./chunk-TNTXWSYA.js";
+import {
+  API_KEY_PREFIX
+} from "./chunk-GPTKSNR6.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/cli/browserAuth.ts
+init_esm_shims();
+import { randomBytes, timingSafeEqual } from "crypto";
+import { createServer } from "http";
+var WEB_ORIGIN = process.env.LURQ_WEB_URL ?? "https://lurq.run";
+var DEADLINE_MS = 3 * 6e4;
+var MAX_BODY = 4096;
+function equal(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+async function readBody(req) {
+  let out = "";
+  for await (const chunk of req) {
+    out += chunk;
+    if (out.length > MAX_BODY) return "";
+  }
+  return out;
+}
+function keyViaBrowser(opts) {
+  return new Promise((resolve) => {
+    const nonce = randomBytes(18).toString("base64url");
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      server.close();
+      resolve(value);
+    };
+    const server = createServer((req, res) => {
+      res.setHeader("Access-Control-Allow-Origin", WEB_ORIGIN);
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+      res.setHeader("Access-Control-Allow-Private-Network", "true");
+      if (req.method === "OPTIONS") {
+        res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
+        res.writeHead(204).end();
+        return;
+      }
+      if (req.method !== "POST") {
+        res.writeHead(405).end();
+        return;
+      }
+      void readBody(req).then((raw) => {
+        let key = "";
+        let label = null;
+        try {
+          const body = JSON.parse(raw);
+          if (typeof body.nonce === "string" && equal(body.nonce, nonce)) {
+            if (typeof body.key === "string" && body.key.startsWith("lurq_")) key = body.key;
+            if (typeof body.label === "string") label = body.label;
+          }
+        } catch {
+        }
+        if (!key) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false }));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: true }));
+        finish({ key, label });
+      });
+    });
+    const timer = setTimeout(() => finish(null), DEADLINE_MS);
+    timer.unref?.();
+    server.on("error", () => finish(null));
+    opts.signal?.addEventListener("abort", () => finish(null), { once: true });
+    server.listen(0, "127.0.0.1", () => {
+      const { port } = server.address();
+      const url = `${WEB_ORIGIN}/dashboard/cli?port=${port}&nonce=${encodeURIComponent(nonce)}`;
+      opts.onUrl(url);
+      if (!opts.noOpen) openInBrowser(url);
+    });
+  });
+}
+function looksLikeKey(value) {
+  return value.startsWith("lurq_") || value.startsWith(API_KEY_PREFIX);
+}
+export {
+  keyViaBrowser,
+  looksLikeKey
+};

package/dist/cache-DKI34SVS.js

@@ -0,0 +1,12 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  cached,
+  invalidateCache
+} from "./chunk-HWBBVLOT.js";
+import "./chunk-MYGSLK44.js";
+import "./chunk-GPTKSNR6.js";
+import "./chunk-I3M2KJXB.js";
+export {
+  cached,
+  invalidateCache
+};

package/dist/check-2FDGUOV7.js

@@ -0,0 +1,192 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  checkApi
+} from "./chunk-CIDWNUAP.js";
+import {
+  require_dist
+} from "./chunk-QKGYDMWB.js";
+import "./chunk-3GHJR7XR.js";
+import {
+  __toESM,
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/api/check.ts
+init_esm_shims();
+import { execFile } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { relative, resolve } from "path";
+import { promisify } from "util";
+
+// src/api/openapi.ts
+init_esm_shims();
+var import_yaml = __toESM(require_dist(), 1);
+var METHODS = ["get", "put", "post", "delete", "options", "head", "patch", "trace"];
+var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function deref(root, node, seen = /* @__PURE__ */ new Set()) {
+  if (!isRecord(node)) return null;
+  const ref = node.$ref;
+  if (typeof ref !== "string") return node;
+  if (!ref.startsWith("#/") || seen.has(ref)) return null;
+  seen.add(ref);
+  let cursor = root;
+  for (const segment of ref.slice(2).split("/")) {
+    if (!isRecord(cursor)) return null;
+    cursor = cursor[segment.replace(/~1/g, "/").replace(/~0/g, "~")];
+  }
+  return deref(root, cursor, seen);
+}
+function readParams(root, shared, own) {
+  const required = /* @__PURE__ */ new Set();
+  const optional = /* @__PURE__ */ new Set();
+  for (const list of [shared, own]) {
+    if (!Array.isArray(list)) continue;
+    for (const raw of list) {
+      const param = deref(root, raw);
+      const name = param?.name;
+      if (typeof name !== "string") continue;
+      const key = `${name} (${typeof param?.in === "string" ? param.in : "unknown"})`;
+      if (param?.required === true) {
+        required.add(key);
+        optional.delete(key);
+      } else if (!required.has(key)) {
+        optional.add(key);
+      }
+    }
+  }
+  return { required: [...required].sort(), optional: [...optional].sort() };
+}
+function readBodyFields(root, requestBody) {
+  const body = deref(root, requestBody);
+  if (!body || body.required !== true) return [];
+  const content = body.content;
+  if (!isRecord(content)) return [];
+  const out = /* @__PURE__ */ new Set();
+  for (const media of Object.values(content)) {
+    const schema = deref(root, isRecord(media) ? media.schema : null);
+    const required = schema?.required;
+    if (!Array.isArray(required)) continue;
+    for (const field of required) if (typeof field === "string") out.add(field);
+  }
+  return [...out].sort();
+}
+function extractApiSurface(source, label = "document") {
+  const empty = { title: null, version: null, operations: /* @__PURE__ */ new Map() };
+  let doc;
+  try {
+    doc = (0, import_yaml.parse)(source);
+  } catch (err) {
+    return {
+      ...empty,
+      unreadableReason: `${label} is not valid YAML or JSON: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (!isRecord(doc)) return { ...empty, unreadableReason: `${label} is not an object` };
+  if (!doc.openapi && !doc.swagger) {
+    return { ...empty, unreadableReason: `${label} has no openapi/swagger version field` };
+  }
+  const info = isRecord(doc.info) ? doc.info : {};
+  const paths = isRecord(doc.paths) ? doc.paths : {};
+  const operations = /* @__PURE__ */ new Map();
+  for (const [path, rawItem] of Object.entries(paths)) {
+    const item = deref(doc, rawItem);
+    if (!item) continue;
+    for (const method of METHODS) {
+      const op = item[method];
+      if (!isRecord(op)) continue;
+      const { required, optional } = readParams(doc, item.parameters, op.parameters);
+      const responses = isRecord(op.responses) ? Object.keys(op.responses).sort() : [];
+      const id = `${method.toUpperCase()} ${path}`;
+      operations.set(id, {
+        id,
+        method: method.toUpperCase(),
+        path,
+        requiredParams: required,
+        optionalParams: optional,
+        requiredBodyFields: readBodyFields(doc, op.requestBody),
+        responseCodes: responses,
+        deprecated: op.deprecated === true
+      });
+    }
+  }
+  return {
+    title: typeof info.title === "string" ? info.title : null,
+    version: typeof info.version === "string" ? info.version : null,
+    operations,
+    ...operations.size === 0 ? { unreadableReason: `${label} declares no operations` } : {}
+  };
+}
+
+// src/api/check.ts
+var execFileP = promisify(execFile);
+var CANDIDATES = [
+  "openapi.yaml",
+  "openapi.yml",
+  "openapi.json",
+  "swagger.yaml",
+  "swagger.yml",
+  "swagger.json",
+  "api/openapi.yaml",
+  "api/openapi.yml",
+  "api/openapi.json",
+  "docs/openapi.yaml",
+  "docs/openapi.yml"
+];
+function findSpec(dir) {
+  for (const candidate of CANDIDATES) {
+    const full = resolve(dir, candidate);
+    if (existsSync(full)) return full;
+  }
+  return null;
+}
+async function showAtRevision(dir, rev, repoPath) {
+  try {
+    const { stdout } = await execFileP("git", ["show", `${rev}:${repoPath}`], {
+      cwd: dir,
+      maxBuffer: 32 * 1024 * 1024
+    });
+    return stdout;
+  } catch {
+    return null;
+  }
+}
+async function runApiCheck(dir, opts = {}) {
+  const against = opts.against ?? "HEAD";
+  const specPath = opts.spec ? resolve(dir, opts.spec) : findSpec(dir);
+  const spec = specPath ? relative(dir, specPath) || specPath : "(none found)";
+  const base = { spec, against, title: null, fromVersion: null, toVersion: null };
+  if (!specPath) {
+    return {
+      ...base,
+      verdict: "inconclusive",
+      versionCovers: null,
+      diff: {
+        breaking: [],
+        other: [],
+        inconclusive: `no OpenAPI document found in ${dir}. Name one: lurq check-api <file>`
+      }
+    };
+  }
+  const current = extractApiSurface(readFileSync(specPath, "utf8"), spec);
+  const previousSource = await showAtRevision(dir, against, spec);
+  if (previousSource === null) {
+    return {
+      ...base,
+      title: current.title,
+      toVersion: current.version,
+      verdict: "inconclusive",
+      versionCovers: null,
+      diff: {
+        breaking: [],
+        other: [],
+        inconclusive: `${spec} does not exist at ${against}, so there is nothing to compare against`
+      }
+    };
+  }
+  const previous = extractApiSurface(previousSource, `${spec} at ${against}`);
+  return { ...base, ...checkApi(previous, current) };
+}
+export {
+  findSpec,
+  runApiCheck
+};

package/dist/checkUpgrade-F2WESBPM.js

@@ -0,0 +1,103 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/cli/checkUpgrade.ts
+init_esm_shims();
+import { readFileSync } from "fs";
+var SCAN_LIMIT = 2e4;
+function parseUpgradeSpec(spec) {
+  const at = spec.lastIndexOf("@");
+  const name = spec.slice(0, at);
+  const [fromVersion, toVersion] = spec.slice(at + 1).split("..");
+  if (!name || !fromVersion || !toVersion) {
+    throw new Error(`bad --upgrade '${spec}', expected pkg@from..to`);
+  }
+  return { package: name, fromVersion, toVersion };
+}
+function targetsFromPlanFile(path) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch (err) {
+    const why = err.code === "ENOENT" ? "does not exist" : String(err);
+    throw new Error(`plan file ${path} ${why}. Did \`lurq upgrade-plan --json\` run?`);
+  }
+  if (!text.trim()) {
+    throw new Error(`plan file ${path} is empty. Did \`lurq upgrade-plan --json\` run?`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    throw new Error(`plan file ${path} is not valid JSON: ${err.message}`);
+  }
+  if (!Array.isArray(parsed.upgrades)) {
+    throw new Error(`${path} is not an upgrade plan (no "upgrades" array)`);
+  }
+  return parsed.upgrades.filter((u) => u.package && u.fromVersion && u.toVersion).filter((u) => u.inScope !== false).map((u) => ({ package: u.package, fromVersion: u.fromVersion, toVersion: u.toVersion }));
+}
+async function reportOutcome(report, targets, opts) {
+  const { buildRunReports, runContextFromEnv } = await import("./reportRuns-CKQQYLY4.js");
+  const ctx = runContextFromEnv();
+  if (!ctx) {
+    console.error("--report: no $GITHUB_REPOSITORY, so there is no run to attribute this to. Skipped.");
+    return;
+  }
+  const runs = buildRunReports(report, targets, ctx);
+  if (runs.length === 0) return;
+  try {
+    const { reportUpgradeRuns } = await import("./remote-YGCXYI4V.js");
+    const { recorded, rejected } = await reportUpgradeRuns(runs, {
+      url: opts.url,
+      apiKey: opts.apiKey
+    });
+    console.error(
+      `reported ${recorded} upgrade result(s) to the lurq dashboard` + (rejected ? ` (${rejected} rejected)` : "")
+    );
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const noKey = /no api key/i.test(message);
+    console.error(
+      noKey ? "--report: no API key, so there was nothing to report with. Set LURQ_API_KEY in this repository's secrets to see these results on your dashboard. The check itself is unaffected." : `--report: could not reach the lurq dashboard (${message}). The check itself is unaffected.`
+    );
+  }
+}
+async function runCheckUpgrade(dir, opts) {
+  const { scanReferences } = await import("./references-6N7VEPHT.js");
+  const { checkUpgrade, formatUpgradeReport } = await import("./upgrade-NQ5IWFZB.js");
+  const targets = [
+    ...opts.plan ? targetsFromPlanFile(opts.plan) : [],
+    ...(opts.upgrade ?? []).map(parseUpgradeSpec)
+  ];
+  if (targets.length === 0) {
+    if (opts.plan) {
+      const empty = { safe: true, breaking: [], ok: [], unverified: [] };
+      console.log(opts.json ? JSON.stringify(empty, null, 2) : "Nothing to check.");
+      return;
+    }
+    throw new Error("give --plan <file> or at least one --upgrade pkg@from..to");
+  }
+  const scan = { files: 0, truncated: false };
+  const refs = scanReferences(dir, { limit: SCAN_LIMIT, stats: scan });
+  const typeCheck = opts.types === false ? void 0 : await (await import("./typecheck-X7U5ELMR.js")).createTypeChecker(dir);
+  const report = await checkUpgrade(targets, refs, { typeCheck, rootDir: dir });
+  if (scan.truncated) {
+    report.unverified.push({
+      package: "(source scan)",
+      reason: `stopped after ${scan.files} source files; references in the rest were not checked`
+    });
+    report.safe = false;
+  }
+  console.log(
+    opts.json ? JSON.stringify(report, null, 2) : formatUpgradeReport(report, `upgrade check on ${dir}`)
+  );
+  if (opts.report) await reportOutcome(report, targets, opts);
+  if (opts.exitCode && !report.safe) process.exitCode = 1;
+}
+export {
+  parseUpgradeSpec,
+  runCheckUpgrade,
+  targetsFromPlanFile
+};

package/dist/chunk-2VMOWSRY.js

@@ -0,0 +1,300 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  projectWeightsPath,
+  userWeightsPath
+} from "./chunk-LUAKDHLZ.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/scoring/weights.ts
+init_esm_shims();
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { dirname } from "path";
+var HEALTH_WEIGHTS = {
+  maintenance: 0.35,
+  adoption: 0.3,
+  reliability: 0.25,
+  efficiency: 0.1
+};
+var COMPOSITE = {
+  lambda: 0.35
+};
+var RANKING = {
+  relevance: 0.45,
+  composite: 0.35,
+  confidence: 0.2
+};
+var CONFIDENCE_WEIGHT = {
+  proven: 1,
+  emerging: 0.55,
+  promising: 0.45,
+  unproven: 0.1
+};
+var QUALITY_WEIGHTS = {
+  types: 0.25,
+  tests: 0.2,
+  docs: 0.2,
+  changelog: 0.1,
+  deps: 0.1,
+  license: 0.1,
+  provenance: 0.05
+};
+var QUALITY = {
+  /** README at/above this many characters scores full marks on doc length. */
+  docsFullLengthChars: 1200,
+  /** Direct-dependency count at/above this scores 0 on the deps component (log-scaled). */
+  depsLogMax: 30,
+  /** A license string present but not OSI-recognized scores this (vs 100 / 0). */
+  licenseUnrecognizedScore: 60
+};
+var MAINTENANCE_WEIGHTS = {
+  recency: 0.5,
+  cadence: 0.25,
+  closeRatio: 0.25
+};
+var MAINTENANCE = {
+  /** A release within this many days scores full recency. */
+  freshDays: 30,
+  /** Recency decays linearly to 0 by this many days (~24 months). */
+  staleDays: 730,
+  /** Releases/12mo at or above this cap full cadence. */
+  cadenceCap: 12,
+  /** deprecated/archived hard-cap maintenance at this value. */
+  deadCap: 15
+};
+var ADOPTION = {
+  /** log10(weekly downloads): this maps to 0. */
+  downloadsLogMin: 1,
+  // 10/wk
+  /** log10(weekly downloads): this maps to 100. */
+  downloadsLogMax: 7,
+  // 10M/wk
+  /** log10(stars) that maps to 100. */
+  starsLogMax: 5,
+  // 100k stars
+  /** Weight of the stars component when available (downloads gets the rest). */
+  starsWeight: 0.2,
+  /** Growth bonus: growth fraction × this, clamped to ±cap. */
+  growthMultiplier: 30,
+  growthBonusCap: 20
+};
+var RELIABILITY = {
+  /** Used when no Scorecard is available (unknown security posture). */
+  neutralWhenUnknown: 50,
+  /** Advisory penalties by severity. */
+  penalty: {
+    critical: 40,
+    high: 20,
+    moderate: 8,
+    low: 3,
+    info: 0
+  }
+};
+var EFFICIENCY = {
+  /** Bundle size at the category median maps to this score; smaller → higher. */
+  medianScore: 50
+};
+var FIELD = {
+  /** Weight when evidence exists — ~9% of the blend (0.10 / 1.10). */
+  weight: 0.1,
+  /**
+   * Bayesian shrinkage strength: how many prior observations the neutral rate is
+   * worth. One failed report out of one is not a 0-scoring package, and a raw
+   * success rate would say it is. At m=12, a single failure lands near 69 rather
+   * than 0, and it takes real volume to move the number far — which is the
+   * correct epistemics for a signal users can trivially poison.
+   */
+  priorWeight: 12,
+  /**
+   * The prior success rate a package is assumed to have before anyone reports.
+   * Set at the observed base rate of "installs and builds fine", not 0.5:
+   * most packages do work, so 0.5 would penalise the first honest reporter.
+   */
+  priorRate: 0.75,
+  /** Reports at or above this cap the confidence note as fully-evidenced. */
+  wellEvidencedReports: 25
+};
+var DEFAULT_WEIGHTS = {
+  health: { ...HEALTH_WEIGHTS },
+  composite: { ...COMPOSITE }
+};
+function activeWeightsPath() {
+  if (existsSync(projectWeightsPath())) return { path: projectWeightsPath(), source: "project-config" };
+  if (existsSync(userWeightsPath())) return { path: userWeightsPath(), source: "user-config" };
+  return null;
+}
+var cachedWeights;
+function loadWeights() {
+  if (cachedWeights) return cachedWeights;
+  let merged = structuredClone(DEFAULT_WEIGHTS);
+  const active = activeWeightsPath();
+  if (active) {
+    try {
+      const fromFile = JSON.parse(readFileSync(active.path, "utf8"));
+      merged = mergeWeights(merged, fromFile);
+    } catch {
+    }
+  }
+  const envLambda = process.env.LURQ_COMPOSITE_LAMBDA;
+  if (envLambda !== void 0 && envLambda !== "") {
+    const n = Number(envLambda);
+    if (Number.isFinite(n)) merged.composite.lambda = n;
+  }
+  cachedWeights = validateWeights(merged).weights;
+  return cachedWeights;
+}
+function resetWeightsCache() {
+  cachedWeights = void 0;
+}
+function mergeWeights(base, over) {
+  return {
+    health: { ...base.health, ...over.health ?? {} },
+    composite: { ...base.composite, ...over.composite ?? {} }
+  };
+}
+function validateWeights(w) {
+  const lambda = Math.max(0, Math.min(1, w.composite.lambda));
+  const h = w.health;
+  const sum = h.maintenance + h.adoption + h.reliability + h.efficiency;
+  let normalized = false;
+  let health = h;
+  if (sum <= 0) {
+    health = { ...DEFAULT_WEIGHTS.health };
+    normalized = true;
+  } else if (Math.abs(sum - 1) > 1e-6) {
+    health = {
+      maintenance: h.maintenance / sum,
+      adoption: h.adoption / sum,
+      reliability: h.reliability / sum,
+      efficiency: h.efficiency / sum
+    };
+    normalized = true;
+  }
+  return { weights: { health, composite: { lambda } }, normalized };
+}
+var SETTABLE = {
+  "health.maintenance": (w, v) => w.health.maintenance = v,
+  "health.adoption": (w, v) => w.health.adoption = v,
+  "health.reliability": (w, v) => w.health.reliability = v,
+  "health.efficiency": (w, v) => w.health.efficiency = v,
+  "composite.lambda": (w, v) => w.composite.lambda = v
+};
+function settableKeys() {
+  return Object.keys(SETTABLE);
+}
+function applyOverrides(base, sets) {
+  const next = structuredClone(base);
+  for (const entry of sets) {
+    const eq = entry.indexOf("=");
+    if (eq < 0) throw new Error(`Invalid --set "${entry}" (expected key=value).`);
+    const key = entry.slice(0, eq).trim();
+    const value = Number(entry.slice(eq + 1).trim());
+    const apply = SETTABLE[key];
+    if (!apply) {
+      throw new Error(`Unknown weight key "${key}". Settable: ${settableKeys().join(", ")}.`);
+    }
+    if (!Number.isFinite(value)) throw new Error(`Value for "${key}" must be a number.`);
+    apply(next, value);
+  }
+  return next;
+}
+function saveWeights(w, scope = "user") {
+  const path = scope === "project" ? projectWeightsPath() : userWeightsPath();
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, JSON.stringify(w, null, 2) + "\n", "utf8");
+  resetWeightsCache();
+  return path;
+}
+function resetWeights() {
+  const removed = [];
+  for (const path of [projectWeightsPath(), userWeightsPath()]) {
+    if (existsSync(path)) {
+      rmSync(path);
+      removed.push(path);
+    }
+  }
+  resetWeightsCache();
+  return removed;
+}
+var WEIGHT_EXPLANATIONS = {
+  maintenance: "release recency, cadence, and issue close-ratio (weights.ts MAINTENANCE_WEIGHTS).",
+  adoption: "weekly downloads (log-scaled), stars, and 90-day growth (weights.ts ADOPTION).",
+  reliability: "OpenSSF Scorecard scaled 0\u2013100, minus advisory penalties (weights.ts RELIABILITY).",
+  efficiency: "bundle size vs the category median; frontend categories only (weights.ts EFFICIENCY).",
+  quality: "intrinsic, adoption-independent: types, tests, docs, changelog, deps, license, provenance (weights.ts QUALITY_WEIGHTS). A standalone axis, it does NOT feed health.",
+  lambda: "how much the default sort composite favors quality over health: (1\u2212\u03BB)\xB7health + \u03BB\xB7quality."
+};
+var CONFIDENCE = {
+  proven: {
+    minWeeklyDownloads: 1e5,
+    minAgeMonths: 12,
+    /**
+     * Recency ceiling for the top tier.
+     *
+     * Was 6 months, which quietly punished stability. Because the stored label
+     * is frozen at ingest, nothing surfaced it until confidence was re-derived
+     * — at which point `p-limit` (273M weekly downloads, ten years old, last
+     * release 6.2 months ago) dropped out of `proven`, along with
+     * `@testing-library/react` at 6.7 months and 44M/wk. A mature utility that
+     * has not needed a release is the most proven kind of package there is.
+     *
+     * Abandonment is already caught three other ways that do not confuse it
+     * with maturity: `deprecated` and `archived` are hard-checked right here,
+     * and the maintenance component of health decays to zero over 24 months
+     * while carrying 35% of the health weight. Recency was the fourth penalty
+     * on the same fact, and the strictest.
+     */
+    maxLastReleaseMonths: 18
+  },
+  emerging: {
+    minWeeklyDownloads: 5e3,
+    strongGrowth: 0.5,
+    /**
+     * Absolute floor the growth path must also clear.
+     *
+     * Growth alone used to qualify a package for `emerging`, and a percentage
+     * computed on a tiny base is noise: 4 → 17 weekly downloads is +325% and
+     * cleared the bar outright. That is how `@podgres/pg` (17/wk) and
+     * `@bungres/orm` (275/wk) came to wear the same evidence label as a package
+     * with five thousand real installs, and — because `recommend` treats the
+     * label as meaningful — outrank Prisma for "an orm for postgres".
+     *
+     * 1,000/wk is where a 50% swing stops being one CI pipeline changing its
+     * schedule. Below it the growth signal is not measuring adoption.
+     */
+    minDownloadsForGrowth: 1e3,
+    /** Same reasoning as `proven` above: 9 months demoted `@emotion/react`
+     *  (14.7M/wk, last release 9.2 months ago) to `unproven`. */
+    maxLastReleaseMonths: 18
+  },
+  /** `promising` (§1): new but intrinsically high-quality, regardless of adoption. */
+  promising: {
+    minQuality: 70,
+    maxLastReleaseMonths: 12
+  }
+};
+
+export {
+  HEALTH_WEIGHTS,
+  COMPOSITE,
+  RANKING,
+  CONFIDENCE_WEIGHT,
+  QUALITY_WEIGHTS,
+  QUALITY,
+  MAINTENANCE_WEIGHTS,
+  MAINTENANCE,
+  ADOPTION,
+  RELIABILITY,
+  EFFICIENCY,
+  FIELD,
+  activeWeightsPath,
+  loadWeights,
+  validateWeights,
+  settableKeys,
+  applyOverrides,
+  saveWeights,
+  resetWeights,
+  WEIGHT_EXPLANATIONS,
+  CONFIDENCE
+};