lurqrun 0.1.6 → 0.1.8

package/dist/chunk-J3U2CPSK.js

@@ -0,0 +1,136 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  isPrivateAddress,
+  safeLookup
+} from "./chunk-3D2MPGOQ.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/core/safeFetch.ts
+init_esm_shims();
+import { isIP } from "net";
+import { Agent, fetch as undiciFetch } from "undici";
+var SAFE_FETCH_DEFAULTS = {
+  /** Time allowed for response headers. Streams are not cut off after that. */
+  headersTimeoutMs: 1e4,
+  /** Silence allowed between body chunks. */
+  bodyTimeoutMs: 3e4,
+  /** Discovery documents are kilobytes; a tool list rarely passes a megabyte. */
+  maxBytes: 5e6,
+  maxRedirects: 3,
+  userAgent: "lurq-probe/1 (+https://lurq.run/probe)"
+};
+var REDIRECTS = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var LOCAL_SUFFIXES = [".localhost", ".local", ".internal", ".home.arpa", ".lan"];
+var UnsafeUrlError = class extends Error {
+  code = "EUNSAFE";
+  constructor(message) {
+    super(message);
+    this.name = "UnsafeUrlError";
+  }
+};
+var ResponseTooLargeError = class extends Error {
+  code = "ETOOLARGE";
+  constructor(limit) {
+    super(`response body exceeded ${limit} bytes`);
+    this.name = "ResponseTooLargeError";
+  }
+};
+var publicHttpsOnly = (url) => {
+  if (url.protocol !== "https:")
+    throw new UnsafeUrlError(`only https URLs can be checked (got ${url.protocol})`);
+  if (url.username || url.password)
+    throw new UnsafeUrlError("URLs with embedded credentials are refused");
+  const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (!host || host === "localhost" || LOCAL_SUFFIXES.some((s) => host.endsWith(s))) {
+    throw new UnsafeUrlError(`${host || "that host"} is not reachable on the public internet`);
+  }
+  if (isIP(host) && isPrivateAddress(host)) {
+    throw new UnsafeUrlError(`${host} is a private or reserved address`);
+  }
+};
+function parse(input) {
+  try {
+    return new URL(input.toString());
+  } catch {
+    throw new UnsafeUrlError("not a valid URL");
+  }
+}
+function capped(body, limit) {
+  let seen = 0;
+  return body.pipeThrough(
+    new TransformStream({
+      transform(chunk, controller) {
+        seen += chunk.byteLength;
+        if (seen > limit) controller.error(new ResponseTooLargeError(limit));
+        else controller.enqueue(chunk);
+      }
+    })
+  );
+}
+function createSafeFetch(opts = {}) {
+  const policy = opts.policy ?? publicHttpsOnly;
+  const maxBytes = opts.maxBytes ?? SAFE_FETCH_DEFAULTS.maxBytes;
+  const maxRedirects = opts.maxRedirects ?? SAFE_FETCH_DEFAULTS.maxRedirects;
+  const userAgent = opts.userAgent ?? SAFE_FETCH_DEFAULTS.userAgent;
+  const dispatcher = new Agent({
+    connect: { lookup: opts.lookup ?? safeLookup() },
+    headersTimeout: opts.headersTimeoutMs ?? SAFE_FETCH_DEFAULTS.headersTimeoutMs,
+    bodyTimeout: opts.bodyTimeoutMs ?? SAFE_FETCH_DEFAULTS.bodyTimeoutMs
+  });
+  const safeFetch = async (input, init = {}) => {
+    let url = parse(input);
+    let method = (init.method ?? "GET").toUpperCase();
+    let body = init.body ?? null;
+    const headers = new Headers(init.headers);
+    if (!headers.has("user-agent")) headers.set("user-agent", userAgent);
+    for (let hop = 0; ; hop++) {
+      policy(url);
+      const res = await undiciFetch(url, {
+        method,
+        headers,
+        body,
+        redirect: "manual",
+        signal: init.signal ?? void 0,
+        dispatcher
+      });
+      const location = res.headers.get("location");
+      if (REDIRECTS.has(res.status) && location) {
+        await res.body?.cancel().catch(() => {
+        });
+        if (hop >= maxRedirects) throw new UnsafeUrlError(`more than ${maxRedirects} redirects`);
+        url = parse(new URL(location, url));
+        if (res.status === 303 || (res.status === 301 || res.status === 302) && method === "POST") {
+          method = "GET";
+          body = null;
+          headers.delete("content-type");
+        }
+        continue;
+      }
+      const final = res.body ? new Response(capped(res.body, maxBytes), {
+        status: res.status,
+        statusText: res.statusText,
+        headers: res.headers
+      }) : res;
+      if (final !== res || !res.url) Object.defineProperty(final, "url", { value: url.toString() });
+      return final;
+    }
+  };
+  safeFetch.close = () => dispatcher.close();
+  return safeFetch;
+}
+var shared = null;
+function sharedSafeFetch() {
+  shared ??= createSafeFetch();
+  return shared;
+}
+
+export {
+  SAFE_FETCH_DEFAULTS,
+  UnsafeUrlError,
+  ResponseTooLargeError,
+  publicHttpsOnly,
+  createSafeFetch,
+  sharedSafeFetch
+};

package/dist/chunk-J6XQ7OPZ.js

@@ -0,0 +1,74 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/core/userConfig.ts
+init_esm_shims();
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function lurqHome() {
+  return process.env.LURQ_HOME || join(homedir(), ".lurq");
+}
+function userConfigPath() {
+  return join(lurqHome(), "config.json");
+}
+function readUserConfig() {
+  const path = userConfigPath();
+  if (!existsSync(path)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function writeUserConfig(patch) {
+  const path = userConfigPath();
+  const next = { ...readUserConfig(), ...patch };
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 384 });
+    chmodSync(tmp, 384);
+    renameSync(tmp, path);
+  } catch (err) {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {
+    }
+    throw err;
+  }
+  return path;
+}
+function clearUserConfig() {
+  const path = userConfigPath();
+  if (!existsSync(path)) return false;
+  rmSync(path, { force: true });
+  return true;
+}
+function resolveApiKey(override) {
+  return override?.trim() || process.env.LURQ_API_KEY?.trim() || readUserConfig().apiKey?.trim();
+}
+function resolveEndpoint(override) {
+  return override?.trim() || process.env.LURQ_ENDPOINT?.trim() || readUserConfig().endpoint?.trim();
+}
+
+export {
+  lurqHome,
+  userConfigPath,
+  readUserConfig,
+  writeUserConfig,
+  clearUserConfig,
+  resolveApiKey,
+  resolveEndpoint
+};

package/dist/chunk-KMV4Y6R3.js

@@ -0,0 +1,127 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/policy/parse.ts
+init_esm_shims();
+var CONFIDENCES = ["unproven", "promising", "emerging", "proven"];
+var SEVERITIES = ["info", "low", "moderate", "high", "critical"];
+var MODES = ["enforce", "warn"];
+var MAX_ENTRIES = 500;
+var MAX_LEN = 214;
+var LIMITS = {
+  minWeeklyDownloads: { min: 0, max: 1e8 },
+  maxStaleMonths: { min: 1, max: 240 },
+  maxBundleKb: { min: 1, max: 1e5 },
+  minPackageAgeDays: { min: 1, max: 365 }
+};
+var Invalid = class extends Error {
+};
+function fail(message) {
+  throw new Invalid(message);
+}
+function bounded(input, field) {
+  if (input === null || input === void 0) return null;
+  const { min, max } = LIMITS[field];
+  if (typeof input !== "number" || !Number.isFinite(input) || input < min || input > max) {
+    fail(`${field} must be a number from ${min} to ${max}, or null for no rule.`);
+  }
+  return input;
+}
+function oneOf(input, field, options) {
+  if (input === null || input === void 0) return null;
+  if (!options.includes(input)) {
+    fail(`${field} must be one of ${options.join(", ")}, or null for no rule.`);
+  }
+  return input;
+}
+function list(input, field) {
+  if (!Array.isArray(input)) fail(`${field} must be a list.`);
+  if (input.length > MAX_ENTRIES) fail(`${field} has more than ${MAX_ENTRIES} entries.`);
+  return input;
+}
+function name(input, where) {
+  if (typeof input !== "string") fail(`${where} must be a string.`);
+  const trimmed = input.trim();
+  if (!trimmed || trimmed.length > MAX_LEN) fail(`${where} must be 1 to ${MAX_LEN} characters.`);
+  return trimmed;
+}
+function reason(input, where) {
+  if (input === null || input === void 0) return void 0;
+  if (typeof input !== "string" || input.length > MAX_LEN) {
+    fail(`${where}.reason must be text of at most ${MAX_LEN} characters.`);
+  }
+  return input.trim() || void 0;
+}
+function entry(input, where) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    fail(`${where} must be an object with a name.`);
+  }
+  return input;
+}
+function denyRules(input) {
+  return list(input, "deny").map((item, i) => {
+    const raw = entry(item, `deny[${i}]`);
+    const rule = { name: name(raw.name, `deny[${i}].name`) };
+    const why = reason(raw.reason, `deny[${i}]`);
+    return why ? { ...rule, reason: why } : rule;
+  });
+}
+function allowRules(input) {
+  return list(input, "allow").map((item, i) => {
+    const where = `allow[${i}]`;
+    if (typeof item === "string") return { name: name(item, where) };
+    const raw = entry(item, where);
+    const rule = { name: name(raw.name, `${where}.name`) };
+    const why = reason(raw.reason, where);
+    if (why) rule.reason = why;
+    if (raw.expires !== null && raw.expires !== void 0) {
+      const valid = typeof raw.expires === "string" && /^\d{4}-\d{2}-\d{2}$/.test(raw.expires) && !Number.isNaN(Date.parse(raw.expires)) && new Date(raw.expires).toISOString().slice(0, 10) === raw.expires;
+      if (!valid) fail(`${where}.expires must be a date like 2026-12-31.`);
+      rule.expires = raw.expires;
+    }
+    return rule;
+  });
+}
+function build(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    fail("policy must be an object.");
+  const raw = input;
+  const allow = allowRules(raw.allow);
+  const deny = denyRules(raw.deny);
+  if (typeof raw.blockDeprecated !== "boolean") fail("blockDeprecated must be true or false.");
+  const licenses = raw.licenses === null || raw.licenses === void 0 ? null : list(raw.licenses, "licenses").map((item, i) => name(item, `licenses[${i}]`));
+  if (raw.blockArchived !== void 0 && typeof raw.blockArchived !== "boolean") {
+    fail("blockArchived must be true or false.");
+  }
+  if (raw.mode !== void 0 && !MODES.includes(raw.mode)) {
+    fail(`mode must be ${MODES.join(" or ")}.`);
+  }
+  return {
+    mode: raw.mode ?? "enforce",
+    allow,
+    deny,
+    minConfidence: oneOf(raw.minConfidence, "minConfidence", CONFIDENCES),
+    licenses,
+    blockDeprecated: raw.blockDeprecated,
+    blockArchived: raw.blockArchived === true,
+    maxAdvisorySeverity: oneOf(raw.maxAdvisorySeverity, "maxAdvisorySeverity", SEVERITIES),
+    minWeeklyDownloads: bounded(raw.minWeeklyDownloads, "minWeeklyDownloads"),
+    maxStaleMonths: bounded(raw.maxStaleMonths, "maxStaleMonths"),
+    maxBundleKb: bounded(raw.maxBundleKb, "maxBundleKb"),
+    minPackageAgeDays: bounded(raw.minPackageAgeDays, "minPackageAgeDays")
+  };
+}
+function validateSelectionPolicy(input) {
+  try {
+    return { policy: build(input) };
+  } catch (err) {
+    if (err instanceof Invalid) return { error: err.message };
+    throw err;
+  }
+}
+
+export {
+  validateSelectionPolicy
+};

package/dist/chunk-KP5ZDDPE.js

@@ -0,0 +1,340 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/core/capabilities.ts
+init_esm_shims();
+var CAPABILITIES = [
+  {
+    id: "verify",
+    title: "Check a package is real",
+    question: "Does this package actually exist, and is it safe to install?",
+    answer: "Checks the live registry for existence, deprecation, archival and advisories \u2014 the guard against a hallucinated or typosquatted name reaching package.json.",
+    mcp: "verify",
+    cli: "lurq verify <package>",
+    aliases: ["hallucinated", "typosquat", "slopsquat", "fake", "malicious", "safe", "exists"]
+  },
+  {
+    id: "evaluate",
+    title: "Read the evidence on a package",
+    question: "Is this package healthy, maintained, and worth adopting?",
+    answer: "The full evidence read for one package: health and quality scores with the signals behind them, release cadence, advisories, and how to wire it up.",
+    mcp: "evaluate",
+    cli: "lurq evaluate <package>",
+    aliases: ["health", "maintained", "abandoned", "deprecated", "score", "quality"]
+  },
+  {
+    id: "compare",
+    title: "Compare packages side by side",
+    question: "Which of these two should I go with?",
+    answer: "Ranks 2\u20135 named packages against each other on the same scored evidence.",
+    mcp: "compare",
+    cli: "lurq compare <a> <b>",
+    aliases: ["versus", "vs", "shootout", "better"]
+  },
+  {
+    id: "compat",
+    title: "Check a stack fits together",
+    question: "Will these packages work together?",
+    answer: "Peer-dependency and engine checks across the whole set at once, plus any sandbox-verified conflicts on record. Returns the exact clashing constraints.",
+    mcp: "compat",
+    cli: "lurq compat <a> <b> <c>",
+    aliases: ["peer", "conflict", "incompatible", "engines", "node version", "together"]
+  },
+  {
+    id: "usage",
+    title: "See a version-exact API",
+    question: "What does this package actually export at this version?",
+    answer: "The exported symbols and signatures for one exact version, read from the shipped JS \u2014 plus the delta from a version you already know.",
+    mcp: "usage",
+    cli: "lurq usage <package> --target <version>",
+    aliases: ["exports", "symbols", "api", "signature", "surface"]
+  },
+  {
+    id: "diff-surface",
+    title: "See what an upgrade removes",
+    question: "What breaks between these two versions?",
+    answer: "The symbol-level diff between two published versions: what was removed, what changed arity, what is new. Runtime breakage is reported separately from type-only breakage.",
+    mcp: "diff_surface",
+    cli: "lurq usage <package> --known <old> --target <new>",
+    aliases: ["breaking", "removed", "changed", "migration", "major"]
+  },
+  {
+    id: "audit",
+    title: "Audit this whole project",
+    question: "What in this project is outdated, vulnerable, or drifting?",
+    answer: "Reads your manifests and agent configs locally, then assesses every dependency and MCP server in one call: outdated versions, deprecations, advisories against the exact installed version, and servers that need credentials or cannot be observed. Always prints how many items it actually answered for \u2014 anything it could not assess is reported as unassessed, never as clean.",
+    mcp: "audit",
+    cli: "lurq audit",
+    aliases: [
+      "scan",
+      "outdated",
+      "vulnerable",
+      "audit",
+      "health",
+      "project",
+      "dependencies",
+      "cve"
+    ]
+  },
+  {
+    id: "mcp-stack",
+    title: "Check your MCP servers coexist",
+    question: "Do the MCP servers I have wired up conflict with each other?",
+    answer: "Tool-name collisions across the servers configured into one agent. They are separate processes, so nothing resolves between them \u2014 they clash in the flat tool namespace the agent assembles, where two servers exposing the same name leave it unable to say which it means. Also reports the standing context cost of the whole set.",
+    mcp: "mcp_stack",
+    cli: "lurq mcp-stack",
+    aliases: ["collision", "conflict", "namespace", "mcp", "tools", "shadow", "coexist"]
+  },
+  {
+    id: "mcp-surface",
+    title: "Read an MCP server's tools",
+    question: "What tools does this MCP server actually expose, and what do they take?",
+    answer: "Every tool from a live `tools/list` handshake in a sandbox: required and optional parameters, and the behaviour annotations that say whether a tool writes, destroys, or reaches outside. Also returns the API keys and settings the server declares it needs, with a request you can put in front of the user. Declared contract only \u2014 that a tool is listed is not evidence that calling it succeeds.",
+    mcp: "mcp_surface",
+    cli: "lurq mcp-surface <server>",
+    aliases: ["mcp", "tools", "tool schema", "inputSchema", "agent tools", "server"]
+  },
+  {
+    id: "mcp-drift",
+    title: "See what an MCP upgrade changes",
+    question: "Did this MCP server change its tool contract?",
+    answer: "The contract diff between two versions of an MCP server: tools removed, parameters that became required, types narrowed, and annotation flips. Reports silent drift (schema moved, description unchanged) and privilege widening (a tool that stopped being read-only) separately, because neither shows up in a changelog.",
+    mcp: "mcp_drift",
+    cli: "lurq mcp-drift <server> --from <old> --to <new>",
+    aliases: ["mcp", "schema drift", "tool drift", "readOnlyHint", "breaking", "agent"]
+  },
+  {
+    id: "connect-check",
+    title: "Check a server works in your client",
+    question: "Will this MCP server work in Claude, ChatGPT, Cursor or VS Code, and what does it need?",
+    answer: "Per-client verdicts (works, needs setup, blocked, unknown) for one MCP server, from a credential-free probe of its endpoint and each client\u2019s documented constraints: how it authenticates and whether that client can sign in to it, spec deviations strict clients refuse, tool names and schemas the client rejects. Returns the setup steps and ready-to-paste config in each client\u2019s own format.",
+    mcp: "connect_check",
+    cli: "lurq connect-check <server> --client <client>",
+    aliases: [
+      "connect",
+      "oauth",
+      "auth",
+      "connector",
+      "setup",
+      "install",
+      "config",
+      "claude.ai",
+      "chatgpt",
+      "cursor",
+      "vscode",
+      "remote server",
+      "401"
+    ]
+  },
+  {
+    id: "mcp-pin",
+    title: "Get alerted when a server changes",
+    question: "How do I know if a remote MCP server I approved changes its tools or sign-in?",
+    answer: "Pin the server as it is now. lurq re-reads every remote endpoint in the official registry on a schedule and alerts the account (email, Slack, the agent itself) when a pinned server\u2019s tools, sign-in path or availability change \u2014 approved keeps meaning what was approved. Servers in your uploaded mcp-scan results are watched the same way without pinning.",
+    cli: "lurq mcp-pin <url-or-registry-name>",
+    aliases: [
+      "pin",
+      "approve",
+      "watch",
+      "alert",
+      "rug pull",
+      "drift",
+      "changed",
+      "monitor",
+      "remote"
+    ]
+  },
+  {
+    id: "diagram",
+    title: "Draw the stack",
+    question: "Can I see this as a diagram?",
+    answer: "Renders an existing stack as a Mermaid graph other tools can parse.",
+    mcp: "diagram",
+    aliases: ["mermaid", "visual", "chart", "architecture", "graph"]
+  },
+  {
+    id: "upgrade-plan",
+    title: "Find what is behind",
+    question: "How far out of date is this project?",
+    answer: "Reads the local manifests and reports the gap between what is resolved and what is current, with what each upgrade removes from its API. Sends dependency ranges only, never source.",
+    cli: "lurq upgrade-plan",
+    page: "/dashboard/repos",
+    aliases: ["drift", "outdated", "behind", "stale", "update", "upgrade", "bump", "dependencies"]
+  },
+  {
+    id: "check-upgrade",
+    title: "Check an upgrade against your code",
+    question: "Will this upgrade break my code specifically?",
+    answer: "Intersects what the upgrade removes with what your code actually references, and answers with file:line. Needs no test suite and no network to lurq.",
+    cli: "lurq check-upgrade --plan plan.json --exit-code",
+    aliases: ["breaking", "ci", "gate", "call sites", "references", "blocking"]
+  },
+  {
+    id: "check-release",
+    title: "Check your own version bump",
+    question: "Am I about to break my consumers?",
+    answer: "Compares the built working tree against your last published version and says whether the bump you are about to tag covers what actually changed. For package authors.",
+    cli: "lurq check-release --exit-code",
+    aliases: ["publish", "semver", "release", "major", "prepublish", "library author"]
+  },
+  {
+    id: "check-api",
+    title: "Check your own API for breaks",
+    question: "Will this change break the people calling my service?",
+    answer: "Diffs two git revisions of your OpenAPI document: removed operations, newly required parameters and body fields, removed response codes \u2014 and whether info.version was bumped enough. Reads git only, nothing leaves the machine.",
+    cli: "lurq check-api --against origin/main --exit-code",
+    aliases: [
+      "openapi",
+      "swagger",
+      "endpoint",
+      "consumers",
+      "callers",
+      "service",
+      "contract",
+      "rest"
+    ]
+  },
+  {
+    id: "autopilot",
+    title: "Keep a repo current automatically",
+    question: "Can lurq just do the upgrades for me?",
+    answer: "Connect a repo and lurq drafts the upgrade, names the call sites it breaks, and opens a PR from your own runner. lurq never gets write access to your code.",
+    page: "/dashboard/repos",
+    cli: "lurq upgrade-plan --json",
+    aliases: ["automate", "pr", "github", "renovate", "dependabot", "autopilot", "workflow"]
+  },
+  {
+    id: "policy",
+    title: "Set what agents may install",
+    question: "How do I stop agents adding packages we do not allow?",
+    answer: "An allow/deny list plus licence and confidence floors, enforced at the moment an agent reaches for a dependency \u2014 before it becomes a line in package.json.",
+    page: "/dashboard/policy",
+    aliases: [
+      "allowlist",
+      "whitelist",
+      "deny",
+      "blocklist",
+      "licence",
+      "license",
+      "govern",
+      "standard"
+    ]
+  },
+  {
+    id: "alerts",
+    title: "Watch repos for new risk",
+    question: "Tell me when something I depend on goes bad",
+    answer: "Per-repo advisories and deprecations across the resolved tree, with the direct dependency responsible for each transitive finding.",
+    page: "/dashboard/repos",
+    aliases: ["advisory", "cve", "vulnerability", "security", "transitive", "sbom", "alert"]
+  },
+  {
+    id: "usage-dashboard",
+    title: "See how lurq is being used",
+    question: "Who on my team is calling lurq, and how much?",
+    answer: "Call volume by tool and by day, plus the outcomes agents reported back about the packages they chose.",
+    page: "/dashboard/usage",
+    aliases: ["activity", "analytics", "volume", "calls", "team", "adoption", "heatmap"]
+  },
+  {
+    id: "setup",
+    title: "Connect lurq to an assistant",
+    question: "How do I get this into Claude Code / Cursor?",
+    answer: "One command detects every assistant on the machine and writes the MCP entry. No database credentials touch your machine.",
+    cli: "npx lurqrun",
+    page: "/dashboard/keys",
+    aliases: [
+      "install",
+      "mcp",
+      "cursor",
+      "claude code",
+      "windsurf",
+      "copilot",
+      "api key",
+      "onboard"
+    ]
+  },
+  {
+    id: "weights",
+    title: "Change how scoring works",
+    question: "I disagree with the ranking \u2014 can I tune it?",
+    answer: "Show the weight model, or layer your own overrides on top of the defaults, per user or per project.",
+    cli: "lurq edit-weights --set composite.lambda=0.5",
+    aliases: ["scoring", "ranking", "tune", "bias", "lambda", "override"]
+  },
+  {
+    id: "report-outcome",
+    title: "Tell lurq how it went",
+    question: "How does lurq learn from what I picked?",
+    answer: "An opt-in report of whether you went with a package lurq checked and whether it built. Coarse signal only \u2014 never source code.",
+    mcp: "report_outcome",
+    aliases: ["feedback", "outcome", "accepted", "flywheel", "learn"]
+  }
+];
+var STOP = /* @__PURE__ */ new Set([
+  "a",
+  "an",
+  "the",
+  "is",
+  "it",
+  "i",
+  "my",
+  "me",
+  "do",
+  "does",
+  "how",
+  "what",
+  "which",
+  "to",
+  "for",
+  "of",
+  "in",
+  "on",
+  "and",
+  "or",
+  "can",
+  "with",
+  "this",
+  "that",
+  "be",
+  "am",
+  "are",
+  "should",
+  "lurq",
+  "package",
+  "packages"
+]);
+var tokenize = (s) => s.toLowerCase().split(/[^a-z0-9.@/]+/).filter((t) => t.length > 1 && !STOP.has(t));
+var STEM_LEN = 5;
+var sameStem = (a, b) => a.length >= STEM_LEN && b.length >= STEM_LEN && a.slice(0, STEM_LEN) === b.slice(0, STEM_LEN);
+var FIELDS = [
+  { of: (c) => c.title, weight: 5 },
+  { of: (c) => c.question, weight: 4 },
+  { of: (c) => (c.aliases ?? []).join(" "), weight: 3 },
+  { of: (c) => c.answer, weight: 1 },
+  { of: (c) => [c.mcp, c.cli, c.page].filter(Boolean).join(" "), weight: 4 }
+];
+function searchCapabilities(query, limit = 5) {
+  const terms = tokenize(query ?? "");
+  if (!terms.length) return CAPABILITIES.slice(0, limit).map((c) => ({ ...c, score: 0 }));
+  const scored = CAPABILITIES.map((c) => {
+    let score = 0;
+    for (const { of, weight } of FIELDS) {
+      const haystack = tokenize(of(c));
+      for (const term of terms) {
+        if (haystack.includes(term)) score += weight;
+        else if (haystack.some((h) => sameStem(h, term))) score += weight / 2;
+      }
+    }
+    return { ...c, score };
+  }).filter((c) => c.score > 0);
+  if (!scored.length) return CAPABILITIES.slice(0, limit).map((c) => ({ ...c, score: 0 }));
+  return scored.sort((a, b) => b.score - a.score).slice(0, limit);
+}
+
+export {
+  CAPABILITIES,
+  searchCapabilities
+};