lurqrun 0.1.7 → 0.1.9

package/dist/{chunk-FW6BD2NO.js → chunk-ABH4BTK4.js}

@@ -5,16 +5,12 @@ import {
 import {
   installKey,
   queryVulnerableInstalls
-} from "./chunk-LRD4GBYE.js";
-import {
-  DEFAULT_REPO_POLICY,
-  REPO_DRIFT_DETAIL_CAP,
-  TRANSITIVE_DETAIL_CAP
-} from "./chunk-BCANRN5B.js";
+} from "./chunk-QUIMQ7YL.js";
 import {
   ADOPTION,
   COMPOSITE,
   CONFIDENCE,
+  DISCOVERY,
   EFFICIENCY,
   FIELD,
   HEALTH_WEIGHTS,
@@ -23,30 +19,24 @@ import {
   QUALITY,
   QUALITY_WEIGHTS,
   RELIABILITY
-} from "./chunk-2VMOWSRY.js";
-import {
-  withBudget
-} from "./chunk-4ESO33J6.js";
+} from "./chunk-6DM6UQFD.js";
 import {
   getCompatMetadata
-} from "./chunk-CW5HJ3LX.js";
+} from "./chunk-KT7PWDNV.js";
 import {
   fetchNpmCompatAtVersion,
   fetchNpmRegistry,
   npmPackageExists
-} from "./chunk-AHBP533R.js";
+} from "./chunk-XBTYJQEK.js";
 import {
-  HttpError,
-  httpGetJson,
-  httpRequest
-} from "./chunk-SJOVFF7B.js";
+  withBudget
+} from "./chunk-4ESO33J6.js";
 import {
-  ensureSeedEntry,
   getPackageByName,
   stampFirstRequester,
   upsertPackage,
   upsertPackageVersions
-} from "./chunk-NH5I4KHH.js";
+} from "./chunk-75LMEMJ3.js";
 import {
   CATEGORIES,
   DEFAULT_ECOSYSTEM,
@@ -54,13 +44,33 @@ import {
   isFrontendCategory
 } from "./chunk-VLRHFMGJ.js";
 import {
+  discoveryQueue,
   packageVersions,
   packages,
   recommendationOutcomes,
   repoAlerts,
+  repoPolicyDefaults,
   repos,
-  seedPackages
-} from "./chunk-LYMPYETA.js";
+  seedPackages,
+  upgradeRuns
+} from "./chunk-6353IJJ5.js";
+import {
+  GithubAppError,
+  installationPost
+} from "./chunk-GM5Y555O.js";
+import {
+  DEFAULT_REPO_POLICY,
+  REPO_DRIFT_DETAIL_CAP,
+  TRANSITIVE_DETAIL_CAP
+} from "./chunk-2GAYNIHG.js";
+import {
+  HttpError,
+  httpGetJson,
+  httpRequest
+} from "./chunk-KYKSZ3XZ.js";
+import {
+  WORKFLOW_PATH
+} from "./chunk-SWMWVK2R.js";
 import {
   require_semver
 } from "./chunk-3GHJR7XR.js";
@@ -73,7 +83,7 @@ import {
 import {
   CACHE_TTL,
   EMBEDDING_DIM
-} from "./chunk-GPTKSNR6.js";
+} from "./chunk-L3V7AVM6.js";
 import {
   __toESM,
   init_esm_shims
@@ -82,9 +92,46 @@ import {
 // src/pipeline/ingestQueue.ts
 init_esm_shims();
 
+// src/db/discovery.ts
+init_esm_shims();
+import { eq, sql } from "drizzle-orm";
+async function getQueuedNames(db) {
+  const rows = await db.select({ name: discoveryQueue.name }).from(discoveryQueue);
+  return new Set(rows.map((r) => r.name));
+}
+async function enqueueCandidates(db, candidates) {
+  if (candidates.length === 0) return 0;
+  const rows = candidates.map((c) => ({ name: c.name, discoveredVia: c.via }));
+  const inserted = await db.insert(discoveryQueue).values(rows).onConflictDoNothing({ target: discoveryQueue.name }).returning({ id: discoveryQueue.id });
+  return inserted.length;
+}
+async function enqueueDemand(db, name, requestedByOwnerId) {
+  await db.insert(discoveryQueue).values({ name, discoveredVia: "reactive", requestedByOwnerId }).onConflictDoUpdate({
+    target: discoveryQueue.name,
+    set: {
+      discoveredVia: "reactive",
+      status: sql`case when ${discoveryQueue.status} = 'failed' then 'failed' else 'pending' end`,
+      requestedByOwnerId: sql`coalesce(${discoveryQueue.requestedByOwnerId}, excluded.requested_by_owner_id)`
+    }
+  });
+}
+async function recordIngestFailure(db, name, maxAttempts) {
+  const [row] = await db.update(discoveryQueue).set({
+    attempts: sql`${discoveryQueue.attempts} + 1`,
+    status: sql`case when ${discoveryQueue.attempts} + 1 >= ${maxAttempts} then 'failed' else ${discoveryQueue.status} end`
+  }).where(eq(discoveryQueue.name, name)).returning({ attempts: discoveryQueue.attempts });
+  return row?.attempts ?? 0;
+}
+async function setDiscoveryStatus(db, name, data) {
+  await db.update(discoveryQueue).set({
+    status: data.status,
+    ...data.preScore !== void 0 ? { preScore: data.preScore } : {}
+  }).where(eq(discoveryQueue.name, name));
+}
+
 // src/pipeline/single.ts
 init_esm_shims();
-import { and as and5, eq as eq5, isNotNull, sql as sql4 } from "drizzle-orm";
+import { and as and5, eq as eq6, isNotNull, sql as sql6 } from "drizzle-orm";
 
 // src/ingestion/collect.ts
 init_esm_shims();
@@ -181,9 +228,7 @@ async function fetchAdvisories(name, version, fetchImpl) {
       })
     )
   );
-  return details.filter(
-    (d) => d.status === "fulfilled"
-  ).map((d) => parseAdvisoryDetail(d.value.data));
+  return details.filter((d) => d.status === "fulfilled").map((d) => parseAdvisoryDetail(d.value.data));
 }
 async function fetchDependents(name, version, fetchImpl) {
   const url = `https://${HOST2}/v3alpha/systems/npm/packages/${encodeName(name)}/versions/${encodeURIComponent(version)}:dependents`;
@@ -292,10 +337,12 @@ function last90DayRange(now = /* @__PURE__ */ new Date()) {
 }
 async function fetchWeeklyDownloads(name, fetchImpl) {
   try {
-    const { data } = await httpGetJson(
-      `https://${HOST4}/downloads/point/last-week/${name}`,
-      { host: HOST4, ttlMs: CACHE_TTL.npmDownloads, retries: 5, fetchImpl }
-    );
+    const { data } = await httpGetJson(`https://${HOST4}/downloads/point/last-week/${name}`, {
+      host: HOST4,
+      ttlMs: CACHE_TTL.npmDownloads,
+      retries: 5,
+      fetchImpl
+    });
     return parseWeeklyDownloads(data);
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) return null;
@@ -328,7 +375,11 @@ async function attempt(source, errors, fn) {
 async function collectSignals(name, category, deps = {}) {
   const { githubToken, fetchImpl } = deps;
   const errors = [];
-  const registry = await attempt("npm-registry", errors, () => fetchNpmRegistry(name, fetchImpl));
+  const registry = await attempt(
+    "npm-registry",
+    errors,
+    () => fetchNpmRegistry(name, fetchImpl, { fresh: deps.freshRegistry })
+  );
   const repo = registry?.repo ?? null;
   const version = registry?.latestVersion ?? null;
   const [downloads, github, depsDev, bundle] = await Promise.all([
@@ -337,7 +388,11 @@ async function collectSignals(name, category, deps = {}) {
       const downloadGrowth90d = await fetchDownloadGrowth(name, fetchImpl);
       return { weeklyDownloads, downloadGrowth90d };
     }),
-    repo && githubToken ? attempt("github", errors, () => fetchGithubRepo(repo.owner, repo.repo, githubToken, fetchImpl)) : Promise.resolve(null),
+    repo && githubToken ? attempt(
+      "github",
+      errors,
+      () => fetchGithubRepo(repo.owner, repo.repo, githubToken, fetchImpl)
+    ) : Promise.resolve(null),
     attempt("deps-dev", errors, () => fetchDepsDev(name, version, repo, fetchImpl)),
     attempt("bundlephobia", errors, () => fetchBundlephobia(name, category, fetchImpl))
   ]);
@@ -502,7 +557,9 @@ var OpenAISummaryProvider = class {
         inferredCategory
       };
     } catch (err) {
-      logger.warn(`summary LLM failed for ${input.name}, using fallback: ${err.message}`);
+      logger.warn(
+        `summary LLM failed for ${input.name}, using fallback: ${err.message}`
+      );
       return new FallbackSummaryProvider().generate(input);
     }
   }
@@ -542,30 +599,84 @@ async function buildSummaryInput(signals, category, fetchImpl) {
 // src/search/categoryInference.ts
 init_esm_shims();
 var RULES = [
-  { category: "meta-framework", patterns: /\b(meta-?framework|next\.?js|nuxt|remix|astro|gatsby|sveltekit|full-?stack framework)\b/ },
-  { category: "state-management", patterns: /\b(state management|global state|store|redux|zustand|jotai|mobx|atoms?)\b/ },
+  {
+    category: "meta-framework",
+    patterns: /\b(meta-?framework|next\.?js|nuxt|remix|astro|gatsby|sveltekit|full-?stack framework)\b/
+  },
+  {
+    category: "state-management",
+    patterns: /\b(state management|global state|store|redux|zustand|jotai|mobx|atoms?)\b/
+  },
   { category: "routing", patterns: /\b(rout(e|er|ing)|navigation|url matching)\b/ },
-  { category: "orm", patterns: /\b(orm|object-?relational|query builder|prisma|drizzle|sequelize|typeorm)\b/ },
-  { category: "database-client", patterns: /\b(database (driver|client)|postgres|mysql|mongo(db)?|redis|sqlite|db driver)\b/ },
-  { category: "ui-component-library", patterns: /\b(component library|ui kit|ui components?|design system|buttons?|modal|dialog)\b/ },
+  {
+    category: "orm",
+    patterns: /\b(orm|object-?relational|query builder|prisma|drizzle|sequelize|typeorm)\b/
+  },
+  {
+    category: "database-client",
+    patterns: /\b(database (driver|client)|postgres|mysql|mongo(db)?|redis|sqlite|db driver)\b/
+  },
+  {
+    category: "ui-component-library",
+    patterns: /\b(component library|ui kit|ui components?|design system|buttons?|modal|dialog)\b/
+  },
   { category: "styling", patterns: /\b(styl(e|ing)|css|tailwind|sass|scss|class ?names?|theme)\b/ },
   { category: "forms", patterns: /\b(forms?|form (state|library|handling)|input handling)\b/ },
-  { category: "validation", patterns: /\b(validat(e|ion|or)|schema|parse input|type ?safe parsing)\b/ },
-  { category: "data-fetching", patterns: /\b(data fetching|server state|react query|swr|graphql client|caching queries)\b/ },
-  { category: "http-client", patterns: /\b(http client|fetch wrapper|rest client|make (a )?request|ajax|api calls?)\b/ },
-  { category: "auth", patterns: /\b(auth(entication|orization)?|login|session|jwt|oauth|password hashing)\b/ },
-  { category: "testing", patterns: /\b(test(ing|s)?|unit test|e2e|assertion|mocking|test runner)\b/ },
-  { category: "bundler", patterns: /\b(bundler|bundle (modules?|code)|webpack|rollup|esbuild|parcel)\b/ },
-  { category: "build-tool", patterns: /\b(build tool|dev server|monorepo|task runner|compile|transpile)\b/ },
+  {
+    category: "validation",
+    patterns: /\b(validat(e|ion|or)|schema|parse input|type ?safe parsing)\b/
+  },
+  {
+    category: "data-fetching",
+    patterns: /\b(data fetching|server state|react query|swr|graphql client|caching queries)\b/
+  },
+  {
+    category: "http-client",
+    patterns: /\b(http client|fetch wrapper|rest client|make (a )?request|ajax|api calls?)\b/
+  },
+  {
+    category: "auth",
+    patterns: /\b(auth(entication|orization)?|login|session|jwt|oauth|password hashing)\b/
+  },
+  {
+    category: "testing",
+    patterns: /\b(test(ing|s)?|unit test|e2e|assertion|mocking|test runner)\b/
+  },
+  {
+    category: "bundler",
+    patterns: /\b(bundler|bundle (modules?|code)|webpack|rollup|esbuild|parcel)\b/
+  },
+  {
+    category: "build-tool",
+    patterns: /\b(build tool|dev server|monorepo|task runner|compile|transpile)\b/
+  },
   // date-time precedes linting: "date formatting" must not be captured by linting's
   // bare "formatting" token before the date rule is reached (first-match-wins).
-  { category: "date-time", patterns: /\b(dates?|date ?time|time(zone)?s?|calendar|parse dates?|format dates?)\b/ },
-  { category: "linting", patterns: /\b(lint(er|ing)?|formatter|formatting|code (quality|style|format)|prettier|eslint)\b/ },
+  {
+    category: "date-time",
+    patterns: /\b(dates?|date ?time|time(zone)?s?|calendar|parse dates?|format dates?)\b/
+  },
+  {
+    category: "linting",
+    patterns: /\b(lint(er|ing)?|formatter|formatting|code (quality|style|format)|prettier|eslint)\b/
+  },
   { category: "animation", patterns: /\b(animat(e|ion)|motion|transition|spring|gsap|3d)\b/ },
-  { category: "charts", patterns: /\b(charts?|graphs?|data ?vis(ualization)?|plots?|dashboards?)\b/ },
-  { category: "i18n", patterns: /\b(i18n|internationali[sz]ation|localization|translat(e|ion)|locale)\b/ },
-  { category: "framework", patterns: /\b(framework|react|vue|svelte|angular|web server|backend framework)\b/ },
-  { category: "utility", patterns: /\b(debounce|throttle|deep ?clone|slugify|uuid|util(ity|ities)?|helper|lodash|retry)\b/ }
+  {
+    category: "charts",
+    patterns: /\b(charts?|graphs?|data ?vis(ualization)?|plots?|dashboards?)\b/
+  },
+  {
+    category: "i18n",
+    patterns: /\b(i18n|internationali[sz]ation|localization|translat(e|ion)|locale)\b/
+  },
+  {
+    category: "framework",
+    patterns: /\b(framework|react|vue|svelte|angular|web server|backend framework)\b/
+  },
+  {
+    category: "utility",
+    patterns: /\b(debounce|throttle|deep ?clone|slugify|uuid|util(ity|ities)?|helper|lodash|retry)\b/
+  }
 ];
 function inferCategory(need) {
   const text = need.toLowerCase();
@@ -636,17 +747,24 @@ function computeMaintenance(input, now) {
   const components = [];
   const days = daysSince(input.lastReleaseAt, now);
   if (days !== null) {
-    const recency = days <= MAINTENANCE.freshDays ? 100 : clamp(100 * (MAINTENANCE.staleDays - days) / (MAINTENANCE.staleDays - MAINTENANCE.freshDays));
+    const recency = days <= MAINTENANCE.freshDays ? 100 : clamp(
+      100 * (MAINTENANCE.staleDays - days) / (MAINTENANCE.staleDays - MAINTENANCE.freshDays)
+    );
     components.push({ value: recency, weight: MAINTENANCE_WEIGHTS.recency });
   }
   if (input.releasesLast12mo !== null) {
-    const cadence = clamp(Math.min(input.releasesLast12mo, MAINTENANCE.cadenceCap) / MAINTENANCE.cadenceCap * 100);
+    const cadence = clamp(
+      Math.min(input.releasesLast12mo, MAINTENANCE.cadenceCap) / MAINTENANCE.cadenceCap * 100
+    );
     components.push({ value: cadence, weight: MAINTENANCE_WEIGHTS.cadence });
   }
   if (input.openIssues !== null && input.closedIssues !== null) {
     const total = input.openIssues + input.closedIssues;
     if (total > 0) {
-      components.push({ value: input.closedIssues / total * 100, weight: MAINTENANCE_WEIGHTS.closeRatio });
+      components.push({
+        value: input.closedIssues / total * 100,
+        weight: MAINTENANCE_WEIGHTS.closeRatio
+      });
     }
   }
   return weightedAverage(components);
@@ -905,7 +1023,7 @@ function createEmbeddingProvider(fetchImpl) {
 
 // src/db/outcomes.ts
 init_esm_shims();
-import { and, count, desc, eq, inArray, sql } from "drizzle-orm";
+import { and, count, desc, eq as eq2, inArray, sql as sql2 } from "drizzle-orm";
 import { alias } from "drizzle-orm/pg-core";
 
 // src/core/successors.ts
@@ -999,13 +1117,13 @@ function buildLearnedSuccessors(observed, isSuperseded) {
 async function recordOutcome(db, outcome) {
   await db.insert(recommendationOutcomes).values(outcome);
 }
-var SUCCESS_PREDICATE = sql`${recommendationOutcomes.accepted} AND (${recommendationOutcomes.buildSignal} IS NULL OR ${recommendationOutcomes.buildSignal} <> 'failed')`;
+var SUCCESS_PREDICATE = sql2`${recommendationOutcomes.accepted} AND (${recommendationOutcomes.buildSignal} IS NULL OR ${recommendationOutcomes.buildSignal} <> 'failed')`;
 async function getFieldEvidence(db, names) {
   if (names && names.length === 0) return /* @__PURE__ */ new Map();
   const rows = await db.select({
     packageName: recommendationOutcomes.packageName,
     reports: count(),
-    successes: sql`count(*) FILTER (WHERE ${SUCCESS_PREDICATE})`.mapWith(Number)
+    successes: sql2`count(*) FILTER (WHERE ${SUCCESS_PREDICATE})`.mapWith(Number)
   }).from(recommendationOutcomes).where(names ? inArray(recommendationOutcomes.packageName, names) : void 0).groupBy(recommendationOutcomes.packageName);
   return new Map(
     rows.map((r) => [r.packageName, { reports: Number(r.reports), successes: r.successes }])
@@ -1018,20 +1136,20 @@ async function learnSuccessions(db) {
   const rows = await db.select({
     from: failed.packageName,
     to: worked.packageName,
-    owners: sql`count(DISTINCT ${failed.ownerId})`.mapWith(Number),
-    observations: sql`count(*)`.mapWith(Number)
+    owners: sql2`count(DISTINCT ${failed.ownerId})`.mapWith(Number),
+    observations: sql2`count(*)`.mapWith(Number)
   }).from(failed).innerJoin(
     worked,
-    sql`${worked.ownerId} = ${failed.ownerId}
+    sql2`${worked.ownerId} = ${failed.ownerId}
         AND ${worked.need} = ${failed.need}
         AND ${worked.packageName} <> ${failed.packageName}
         AND ${worked.createdAt} > ${failed.createdAt}`
   ).where(
-    sql`${failed.need} IS NOT NULL
+    sql2`${failed.need} IS NOT NULL
         AND ${failed.ownerId} IS NOT NULL
         AND NOT (${failed.accepted} AND (${failed.buildSignal} IS NULL OR ${failed.buildSignal} <> 'failed'))
         AND (${worked.accepted} AND (${worked.buildSignal} IS NULL OR ${worked.buildSignal} <> 'failed'))`
-  ).groupBy(failed.packageName, worked.packageName).having(sql`count(DISTINCT ${failed.ownerId}) >= ${MIN_SUCCESSION_OWNERS}`);
+  ).groupBy(failed.packageName, worked.packageName).having(sql2`count(DISTINCT ${failed.ownerId}) >= ${MIN_SUCCESSION_OWNERS}`);
   return rows.map((r) => ({
     from: r.from,
     to: r.to,
@@ -1049,14 +1167,14 @@ async function loadLearnedSuccessors(db, now = Date.now()) {
     return learnedCache.value;
   }
   const names = [...new Set(observed.map((o) => o.from))];
-  const rows = await db.select({ name: packages.name, deprecated: packages.deprecated, archived: packages.archived }).from(packages).where(and(inArray(packages.name, names), eq(packages.ecosystem, DEFAULT_ECOSYSTEM)));
+  const rows = await db.select({ name: packages.name, deprecated: packages.deprecated, archived: packages.archived }).from(packages).where(and(inArray(packages.name, names), eq2(packages.ecosystem, DEFAULT_ECOSYSTEM)));
   const dead = new Set(rows.filter((r) => r.deprecated || r.archived).map((r) => r.name));
   const value = buildLearnedSuccessors(observed, (name) => dead.has(name));
   learnedCache = { at: now, value };
   return value;
 }
 async function getOutcomesByOwner(db, ownerId, opts = {}) {
-  return db.select().from(recommendationOutcomes).where(eq(recommendationOutcomes.ownerId, ownerId)).orderBy(desc(recommendationOutcomes.createdAt)).limit(opts.limit ?? 50);
+  return db.select().from(recommendationOutcomes).where(eq2(recommendationOutcomes.ownerId, ownerId)).orderBy(desc(recommendationOutcomes.createdAt)).limit(opts.limit ?? 50);
 }
 
 // src/github/alerts.ts
@@ -1065,26 +1183,49 @@ var import_semver2 = __toESM(require_semver(), 1);
 
 // src/db/alerts.ts
 init_esm_shims();
-import { and as and2, desc as desc2, eq as eq2 } from "drizzle-orm";
+import { and as and2, desc as desc2, eq as eq3, gte, isNull, sql as sql3 } from "drizzle-orm";
 var ALERT_FEED_LIMIT = 50;
+var CLI_WATCH_DAYS = 90;
 async function insertAlerts(db, rows) {
-  if (rows.length === 0) return 0;
-  const inserted = await db.insert(repoAlerts).values(rows).onConflictDoNothing({
-    target: [repoAlerts.repoId, repoAlerts.packageName, repoAlerts.toVersion]
-  }).returning({ id: repoAlerts.id });
-  return inserted.length;
+  if (rows.length === 0) return [];
+  return db.insert(repoAlerts).values(rows).onConflictDoNothing().returning({ id: repoAlerts.id, repoId: repoAlerts.repoId });
+}
+async function cliUpgradeWatchers(db, packageName, sinceDays = CLI_WATCH_DAYS) {
+  const rows = await db.select({
+    ownerId: upgradeRuns.ownerId,
+    repoFullName: upgradeRuns.repoFullName,
+    toVersion: upgradeRuns.toVersion
+  }).from(upgradeRuns).where(
+    and2(
+      eq3(upgradeRuns.packageName, packageName),
+      isNull(upgradeRuns.repoId),
+      gte(upgradeRuns.createdAt, sql3`now() - make_interval(days => ${sinceDays})`)
+    )
+  ).orderBy(desc2(upgradeRuns.createdAt)).limit(5e3);
+  const newest = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const key = `${r.ownerId}\0${r.repoFullName}`;
+    if (!newest.has(key)) {
+      newest.set(key, {
+        ownerId: r.ownerId,
+        repoFullName: r.repoFullName,
+        lastToVersion: r.toVersion
+      });
+    }
+  }
+  return [...newest.values()];
 }
 async function listAlerts(db, ownerId, limit = ALERT_FEED_LIMIT) {
-  return db.select().from(repoAlerts).where(eq2(repoAlerts.ownerId, ownerId)).orderBy(desc2(repoAlerts.createdAt)).limit(Math.min(limit, ALERT_FEED_LIMIT));
+  return db.select().from(repoAlerts).where(eq3(repoAlerts.ownerId, ownerId)).orderBy(desc2(repoAlerts.createdAt)).limit(Math.min(limit, ALERT_FEED_LIMIT));
 }
 async function deleteAlertsForRepo(db, ownerId, repoId) {
-  await db.delete(repoAlerts).where(and2(eq2(repoAlerts.ownerId, ownerId), eq2(repoAlerts.repoId, repoId)));
+  await db.delete(repoAlerts).where(and2(eq3(repoAlerts.ownerId, ownerId), eq3(repoAlerts.repoId, repoId)));
 }
 
 // src/db/repos.ts
 init_esm_shims();
-import { and as and3, eq as eq3, sql as sql2 } from "drizzle-orm";
-async function upsertRepos(db, rows) {
+import { and as and3, eq as eq4, inArray as inArray2, sql as sql4 } from "drizzle-orm";
+async function upsertRepos(db, rows, policy = DEFAULT_REPO_POLICY) {
   if (rows.length === 0) return 0;
   await db.insert(repos).values(
     rows.map((row) => ({
@@ -1093,36 +1234,36 @@ async function upsertRepos(db, rows) {
       fullName: row.fullName,
       defaultBranch: row.defaultBranch,
       isPrivate: row.isPrivate,
-      policy: DEFAULT_REPO_POLICY
+      policy
     }))
   ).onConflictDoUpdate({
     target: [repos.ownerId, repos.fullName],
     set: {
-      installationId: sql2`excluded.installation_id`,
-      defaultBranch: sql2`excluded.default_branch`,
-      isPrivate: sql2`excluded.is_private`
+      installationId: sql4`excluded.installation_id`,
+      defaultBranch: sql4`excluded.default_branch`,
+      isPrivate: sql4`excluded.is_private`
     }
   });
   return rows.length;
 }
 async function listRepos(db, ownerId) {
-  return db.select().from(repos).where(eq3(repos.ownerId, ownerId)).orderBy(repos.fullName);
+  return db.select().from(repos).where(eq4(repos.ownerId, ownerId)).orderBy(repos.fullName);
 }
 async function reposDeclaring(db, name) {
   return db.select().from(repos).where(
-    sql2`exists (
+    sql4`exists (
         select 1 from jsonb_array_elements(${repos.manifests}) as m
         where jsonb_exists(m -> 'deps', ${name})
       )`
   );
 }
 async function ownerForInstallation(db, installationId) {
-  const rows = await db.select({ ownerId: repos.ownerId }).from(repos).where(eq3(repos.installationId, installationId)).limit(1);
+  const rows = await db.select({ ownerId: repos.ownerId }).from(repos).where(eq4(repos.installationId, installationId)).limit(1);
   return rows[0]?.ownerId ?? null;
 }
 async function deleteReposByInstallation(db, installationId, fullNames) {
   const only = fullNames ? new Set(fullNames) : null;
-  const rows = await db.select({ id: repos.id, ownerId: repos.ownerId, fullName: repos.fullName }).from(repos).where(eq3(repos.installationId, installationId));
+  const rows = await db.select({ id: repos.id, ownerId: repos.ownerId, fullName: repos.fullName }).from(repos).where(eq4(repos.installationId, installationId));
   let deleted = 0;
   for (const row of rows) {
     if (only && !only.has(row.fullName)) continue;
@@ -1131,11 +1272,11 @@ async function deleteReposByInstallation(db, installationId, fullNames) {
   return deleted;
 }
 async function getRepo(db, ownerId, id) {
-  const rows = await db.select().from(repos).where(and3(eq3(repos.ownerId, ownerId), eq3(repos.id, id))).limit(1);
+  const rows = await db.select().from(repos).where(and3(eq4(repos.ownerId, ownerId), eq4(repos.id, id))).limit(1);
   return rows[0] ?? null;
 }
 async function findPolicyByFullName(db, ownerId, fullName) {
-  const rows = await db.select({ policy: repos.policy }).from(repos).where(and3(eq3(repos.ownerId, ownerId), eq3(repos.fullName, fullName))).limit(1);
+  const rows = await db.select({ policy: repos.policy }).from(repos).where(and3(eq4(repos.ownerId, ownerId), eq4(repos.fullName, fullName))).limit(1);
   return rows[0]?.policy ?? null;
 }
 async function saveScan(db, id, scan) {
@@ -1145,25 +1286,40 @@ async function saveScan(db, id, scan) {
     installCommand: scan.installCommand,
     lastScanAt: /* @__PURE__ */ new Date(),
     lastScanError: null
-  }).where(eq3(repos.id, id));
+  }).where(eq4(repos.id, id));
 }
 async function saveScanError(db, id, message) {
-  await db.update(repos).set({ lastScanAt: /* @__PURE__ */ new Date(), lastScanError: message.slice(0, 500) }).where(eq3(repos.id, id));
+  await db.update(repos).set({ lastScanAt: /* @__PURE__ */ new Date(), lastScanError: message.slice(0, 500) }).where(eq4(repos.id, id));
 }
 async function setRepoPolicy(db, ownerId, id, policy) {
-  const updated = await db.update(repos).set({ policy }).where(and3(eq3(repos.ownerId, ownerId), eq3(repos.id, id))).returning({ id: repos.id });
+  const updated = await db.update(repos).set({ policy }).where(and3(eq4(repos.ownerId, ownerId), eq4(repos.id, id))).returning({ id: repos.id });
   return updated.length > 0;
 }
 async function deleteRepo(db, ownerId, id) {
   await deleteAlertsForRepo(db, ownerId, id);
-  const deleted = await db.delete(repos).where(and3(eq3(repos.ownerId, ownerId), eq3(repos.id, id))).returning({ id: repos.id });
+  const deleted = await db.delete(repos).where(and3(eq4(repos.ownerId, ownerId), eq4(repos.id, id))).returning({ id: repos.id });
   return deleted.length > 0;
 }
+async function getRepoPolicyDefault(db, ownerId) {
+  const [row] = await db.select({ policy: repoPolicyDefaults.policy }).from(repoPolicyDefaults).where(eq4(repoPolicyDefaults.ownerId, ownerId)).limit(1);
+  return row?.policy ?? null;
+}
+async function setRepoPolicyDefault(db, ownerId, policy) {
+  await db.insert(repoPolicyDefaults).values({ ownerId, policy }).onConflictDoUpdate({
+    target: repoPolicyDefaults.ownerId,
+    set: { policy, updatedAt: /* @__PURE__ */ new Date() }
+  });
+}
+async function applyPolicyToRepos(db, ownerId, ids, policy) {
+  if (ids.length === 0) return 0;
+  const updated = await db.update(repos).set({ policy }).where(and3(eq4(repos.ownerId, ownerId), inArray2(repos.id, ids))).returning({ id: repos.id });
+  return updated.length;
+}
 
 // src/github/drift.ts
 init_esm_shims();
 var import_semver = __toESM(require_semver(), 1);
-import { and as and4, eq as eq4, inArray as inArray2, sql as sql3 } from "drizzle-orm";
+import { and as and4, eq as eq5, inArray as inArray3, sql as sql5 } from "drizzle-orm";
 
 // src/github/attribute.ts
 init_esm_shims();
@@ -1180,9 +1336,7 @@ function buildAttribution(deps, edges, directNames) {
     if (list) list.push(edge.parent);
     else parentIds.set(edge.child, [edge.parent]);
   }
-  const informative = edges.some(
-    (edge) => nameOf.has(edge.parent) && nameOf.has(edge.child)
-  );
+  const informative = edges.some((edge) => nameOf.has(edge.parent) && nameOf.has(edge.child));
   if (!informative) return { available: false, parentsOf: /* @__PURE__ */ new Map() };
   const parentsOf = /* @__PURE__ */ new Map();
   for (const dep of deps) {
@@ -1313,8 +1467,8 @@ async function loadIndexed(db, names, ecosystem = DEFAULT_ECOSYSTEM) {
       advisories: packages.advisories
     }).from(packages).where(
       and4(
-        inArray2(packages.name, names.slice(i, i + NAME_CHUNK)),
-        eq4(packages.ecosystem, ecosystem)
+        inArray3(packages.name, names.slice(i, i + NAME_CHUNK)),
+        eq5(packages.ecosystem, ecosystem)
       )
     );
     for (const row of rows) {
@@ -1330,7 +1484,7 @@ async function loadIndexed(db, names, ecosystem = DEFAULT_ECOSYSTEM) {
 async function loadVersions(db, names) {
   const out = /* @__PURE__ */ new Map();
   for (let i = 0; i < names.length; i += NAME_CHUNK) {
-    const rows = await db.select({ name: packageVersions.packageName, version: packageVersions.version }).from(packageVersions).where(inArray2(packageVersions.packageName, names.slice(i, i + NAME_CHUNK)));
+    const rows = await db.select({ name: packageVersions.packageName, version: packageVersions.version }).from(packageVersions).where(inArray3(packageVersions.packageName, names.slice(i, i + NAME_CHUNK)));
     for (const row of rows) {
       const list = out.get(row.name);
       if (list) list.push(row.version);
@@ -1342,7 +1496,8 @@ async function loadVersions(db, names) {
 function depDrift(name, declared, indexed, knownVersions) {
   const { range } = declared;
   const latest = indexed.latestVersion;
-  const resolved = bestSatisfying(knownVersions, range) ?? rangeFloor(range);
+  const fromIndex = bestSatisfying(knownVersions, range);
+  const resolved = fromIndex ?? rangeFloor(range);
   let majorsBehind = 0;
   if (resolved && latest && import_semver.default.valid(resolved) && import_semver.default.valid(latest)) {
     majorsBehind = Math.max(0, import_semver.default.major(latest) - import_semver.default.major(resolved));
@@ -1355,9 +1510,20 @@ function depDrift(name, declared, indexed, knownVersions) {
     latest,
     majorsBehind,
     deprecated: indexed.deprecated,
-    advisories: indexed.advisories
+    advisories: indexed.advisories,
+    status: driftStatus(resolved, latest),
+    resolvedFrom: fromIndex ? "index" : "range-floor",
+    // Until computeDrift checks the resolved version against OSV, this is the
+    // package-level count, and says so.
+    advisoriesAt: "package"
   };
 }
+function driftStatus(resolved, latest) {
+  if (!resolved || !latest || !import_semver.default.valid(resolved) || !import_semver.default.valid(latest)) return "unknown";
+  if (!import_semver.default.lt(resolved, latest)) return "current";
+  const breaking = import_semver.default.major(latest) > import_semver.default.major(resolved) || import_semver.default.major(resolved) === 0 && import_semver.default.major(latest) === 0 && import_semver.default.minor(latest) > import_semver.default.minor(resolved);
+  return breaking ? "major" : "behind";
+}
 function isBehind(dep) {
   if (!dep.resolved || !dep.latest) return false;
   if (!import_semver.default.valid(dep.resolved) || !import_semver.default.valid(dep.latest)) return false;
@@ -1436,9 +1602,9 @@ async function conflictsAtCurrent(db, deps) {
     peerDependencies: packageVersions.peerDependencies,
     engines: packageVersions.engines
   }).from(packageVersions).where(
-    inArray2(
-      sql3`(${packageVersions.packageName}, ${packageVersions.version})`,
-      pinned.map((d) => sql3`(${d.name}, ${d.resolved})`)
+    inArray3(
+      sql5`(${packageVersions.packageName}, ${packageVersions.version})`,
+      pinned.map((d) => sql5`(${d.name}, ${d.resolved})`)
     )
   );
   const members = rows.map((r) => ({
@@ -1452,7 +1618,7 @@ async function conflictsAtCurrent(db, deps) {
 }
 function queueUntracked(db, names, ownerId) {
   if (names.length === 0) return;
-  void import("./ingestQueue-VKN4KBIF.js").then(({ enqueueIngest: enqueueIngest2 }) => {
+  void import("./ingestQueue-RSEPMORK.js").then(({ enqueueIngest: enqueueIngest2 }) => {
     for (const name of names) enqueueIngest2(db, name, ownerId);
   }).catch((err) => {
     logger.debug(`untracked-dep enqueue failed: ${String(err)}`);
@@ -1477,16 +1643,14 @@ async function computeDrift(db, manifests, resolvedTree = null, requestedByOwner
       anyDrift: 0,
       deprecated: 0,
       advisories: 0,
+      advisoriesExact: true,
       deps: [],
       transitive,
       conflictsAtLatest: [],
       conflictsAtCurrent: []
     };
   }
-  const [indexed, versions] = await Promise.all([
-    loadIndexed(db, names),
-    loadVersions(db, names)
-  ]);
+  const [indexed, versions] = await Promise.all([loadIndexed(db, names), loadVersions(db, names)]);
   queueUntracked(
     db,
     names.filter((name) => !indexed.has(name)),
@@ -1498,9 +1662,22 @@ async function computeDrift(db, manifests, resolvedTree = null, requestedByOwner
     if (!row) continue;
     deps.push(depDrift(name, entry, row, versions.get(name) ?? []));
   }
+  const checkable = deps.filter((d) => d.resolved && import_semver.default.valid(d.resolved));
+  const exact = await queryVulnerableInstalls(
+    checkable.map((d) => ({ name: d.name, version: d.resolved }))
+  );
+  if (exact.complete) {
+    for (const d of checkable) {
+      d.advisories = exact.affected.get(installKey(d.name, d.resolved))?.length ?? 0;
+      d.advisoriesAt = "resolved";
+    }
+  }
   deps.sort((a, b) => severity(b) - severity(a) || a.name.localeCompare(b.name));
   const [conflicts, currentConflicts] = await Promise.all([
-    conflictsAtLatest(db, deps.map((d) => d.name)),
+    conflictsAtLatest(
+      db,
+      deps.map((d) => d.name)
+    ),
     conflictsAtCurrent(db, deps)
   ]);
   return {
@@ -1510,6 +1687,7 @@ async function computeDrift(db, manifests, resolvedTree = null, requestedByOwner
     anyDrift: deps.filter(isBehind).length,
     deprecated: deps.filter((d) => d.deprecated).length,
     advisories: deps.reduce((sum, d) => sum + d.advisories, 0),
+    advisoriesExact: deps.every((d) => d.advisoriesAt === "resolved"),
     deps: deps.slice(0, REPO_DRIFT_DETAIL_CAP),
     transitive,
     conflictsAtLatest: conflicts,
@@ -1517,6 +1695,116 @@ async function computeDrift(db, manifests, resolvedTree = null, requestedByOwner
   };
 }
 
+// src/github/dispatch.ts
+init_esm_shims();
+
+// src/github/scope.ts
+init_esm_shims();
+function permits(policy, check) {
+  return policy?.checks?.[check] !== false;
+}
+function isUnassessed(u) {
+  return u.verdict === "unknown";
+}
+function breaksSomething(u) {
+  return u.verdict === "removes-exports" || u.verdict === "arity-changed";
+}
+function scopeVerdict(u, scope) {
+  if (scope === "all") return { inScope: true };
+  if (u.advisories > 0) return { inScope: true };
+  if (scope === "security") {
+    return { inScope: false, reason: "no advisory \u2014 scope is security-only" };
+  }
+  if (isUnassessed(u)) {
+    return {
+      inScope: false,
+      reason: "surface not yet analysed \u2014 nothing for the agent to rewrite"
+    };
+  }
+  if (breaksSomething(u)) return { inScope: true };
+  return { inScope: false, reason: "nothing referenced breaks \u2014 scope is security + blocking" };
+}
+function repoMode(policy) {
+  if (!policy.enabled) return "comment";
+  return policy.mode ?? "pr";
+}
+function applyScope(upgrades, policy) {
+  if (!policy) {
+    return {
+      upgrades: upgrades.map((u) => ({ ...u, inScope: true })),
+      scope: "all",
+      scopeSource: "unconnected",
+      outOfScope: 0
+    };
+  }
+  const scoped = upgrades.map((u) => {
+    const verdict = scopeVerdict(u, policy.scope);
+    return verdict.inScope ? { ...u, inScope: true } : { ...u, inScope: false, scopeReason: verdict.reason };
+  });
+  return {
+    upgrades: scoped,
+    scope: policy.scope,
+    scopeSource: "repo-policy",
+    outOfScope: scoped.filter((u) => !u.inScope).length,
+    // Only on this branch. The unconnected branch above deliberately omits it:
+    // "no policy" is not "policy says comment", and conflating them would turn
+    // an unconnected checkout into a silent disarm.
+    mode: repoMode(policy)
+  };
+}
+
+// src/github/dispatch.ts
+var WORKFLOW_FILE = WORKFLOW_PATH.split("/").pop();
+function shouldDispatch(repo) {
+  return repoMode(repo.policy) !== "comment";
+}
+async function dispatchUpgradeWorkflow(repo) {
+  if (!shouldDispatch(repo)) return "not-armed";
+  try {
+    await installationPost(
+      repo.installationId,
+      `/repos/${repo.fullName}/actions/workflows/${WORKFLOW_FILE}/dispatches`,
+      { ref: repo.defaultBranch ?? "main" }
+    );
+    return "dispatched";
+  } catch (err) {
+    if (err instanceof GithubAppError && err.status === 403) return "permission-denied";
+    if (err instanceof GithubAppError && err.status === 404) return "no-workflow";
+    logger.warn(
+      `dispatch: could not start a run for ${repo.fullName}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return "failed";
+  }
+}
+async function dispatchForAlerts(repos2) {
+  const tally = {
+    dispatched: 0,
+    "not-armed": 0,
+    "permission-denied": 0,
+    "no-workflow": 0,
+    failed: 0
+  };
+  for (const repo of repos2) {
+    try {
+      tally[await dispatchUpgradeWorkflow(repo)] += 1;
+    } catch (err) {
+      tally.failed += 1;
+      logger.warn(
+        `dispatch: skipped ${repo.fullName}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  if (tally.dispatched > 0) {
+    logger.info(`dispatch: started ${tally.dispatched} upgrade run(s) on a new major`);
+  }
+  if (tally["permission-denied"] > 0) {
+    logger.warn(
+      `dispatch: ${tally["permission-denied"]} run(s) not started \u2014 the lurq GitHub App needs Actions: write. The weekly schedule is unaffected.`
+    );
+  }
+  return tally;
+}
+
 // src/github/alerts.ts
 function newMajorRelease(before, after) {
   const from = before?.latestVersion;
@@ -1548,18 +1836,44 @@ function draftAlert(repo, packageName, toVersion) {
     inRange: import_semver2.default.validRange(declared.range) ? import_semver2.default.satisfies(toVersion, declared.range, { includePrerelease: false }) : false
   };
 }
+function draftCliAlert(watcher, packageName, toVersion) {
+  const last = import_semver2.default.valid(watcher.lastToVersion) ?? import_semver2.default.coerce(watcher.lastToVersion)?.version ?? null;
+  if (last && import_semver2.default.major(last) >= import_semver2.default.major(toVersion)) return null;
+  return {
+    ownerId: watcher.ownerId,
+    repoId: null,
+    repoFullName: watcher.repoFullName,
+    packageName,
+    range: watcher.lastToVersion,
+    fromVersion: watcher.lastToVersion,
+    toVersion,
+    inRange: false
+  };
+}
 async function emitPublishAlerts(db, name, before, after) {
   const toVersion = newMajorRelease(before, after);
   if (!toVersion) return 0;
   try {
-    const affected = await reposDeclaring(db, name);
-    if (affected.length === 0) return 0;
-    const rows = affected.map((repo) => draftAlert(repo, name, toVersion)).filter((row) => row !== null);
-    const written = await insertAlerts(db, rows);
-    if (written > 0) {
-      logger.info(`alerts: ${name}@${toVersion} is a new major, notified ${written} repo(s)`);
+    const [affected, watchers] = await Promise.all([
+      reposDeclaring(db, name),
+      cliUpgradeWatchers(db, name)
+    ]);
+    const connected = new Set(affected.map((r) => `${r.ownerId}\0${r.fullName}`));
+    const rows = [
+      ...affected.map((repo) => draftAlert(repo, name, toVersion)),
+      ...watchers.filter((w) => !connected.has(`${w.ownerId}\0${w.repoFullName}`)).map((w) => draftCliAlert(w, name, toVersion))
+    ].filter((row) => row !== null);
+    if (rows.length === 0) return 0;
+    const inserted = await insertAlerts(db, rows);
+    if (inserted.length > 0) {
+      logger.info(
+        `alerts: ${name}@${toVersion} is a new major, notified ${inserted.length} repo(s)`
+      );
     }
-    return written;
+    const byId = new Map(affected.map((repo) => [repo.id, repo]));
+    const freshlyAlerted = inserted.map((row) => row.repoId === null ? void 0 : byId.get(row.repoId)).filter((repo) => repo !== void 0);
+    if (freshlyAlerted.length > 0) await dispatchForAlerts(freshlyAlerted);
+    return inserted.length;
   } catch (err) {
     logger.warn(`alerts: could not fan out ${name}@${toVersion}: ${err.message}`);
     return 0;
@@ -1698,13 +2012,13 @@ function assemblePackageRow(p) {
 // src/pipeline/single.ts
 var FIRST_TOUCH_BUDGET_MS = 4e3;
 async function getSeedCategory(db, name) {
-  const [row] = await db.select({ category: seedPackages.category }).from(seedPackages).where(eq5(seedPackages.name, name)).limit(1);
+  const [row] = await db.select({ category: seedPackages.category }).from(seedPackages).where(eq6(seedPackages.name, name)).limit(1);
   return row?.category ?? null;
 }
 async function getCategoryMedianBundle(db, category) {
   const [row] = await db.select({
-    m: sql4`percentile_cont(0.5) within group (order by ${packages.bundleMinGzipKb})`
-  }).from(packages).where(and5(eq5(packages.category, category), isNotNull(packages.bundleMinGzipKb)));
+    m: sql6`percentile_cont(0.5) within group (order by ${packages.bundleMinGzipKb})`
+  }).from(packages).where(and5(eq6(packages.category, category), isNotNull(packages.bundleMinGzipKb)));
   return row?.m ?? null;
 }
 async function syncOnePackage(db, name, opts = {}) {
@@ -1716,7 +2030,8 @@ async function syncOnePackage(db, name, opts = {}) {
   const prefetchedWeekly = await fetchWeeklyDownloads(name).catch(() => null);
   const signals = await collectSignals(name, initialCategory, {
     githubToken: config.GITHUB_TOKEN,
-    prefetchedWeekly
+    prefetchedWeekly,
+    freshRegistry: opts.fresh
   });
   const embProvider = createEmbeddingProvider();
   const reusable = canReuse(existing, signals.registry?.latestVersion ?? null, embProvider.id);
@@ -1805,7 +2120,10 @@ async function getOrFetchPackage(db, name, opts = {}) {
   const exists = await npmPackageExists(name);
   if (!exists) return { row: null, wasTracked: false, existsOnNpm: false };
   if (opts.blockMs && opts.blockMs > 0) {
-    const row = await withBudget(runIngest(db, name, opts.requestedByOwnerId ?? null), opts.blockMs);
+    const row = await withBudget(
+      runIngest(db, name, opts.requestedByOwnerId ?? null),
+      opts.blockMs
+    );
     if (row) return { row, wasTracked: false, existsOnNpm: true };
     return { row: null, wasTracked: false, existsOnNpm: true, queued: true };
   }
@@ -1814,6 +2132,11 @@ async function getOrFetchPackage(db, name, opts = {}) {
 }
 
 // src/pipeline/ingestQueue.ts
+async function persistDemand(db, name, owner) {
+  await enqueueDemand(db, name, owner).catch(
+    (err) => logger.warn(`ingest queue: could not persist request for ${name}: ${String(err)}`)
+  );
+}
 var MAX_CONCURRENT = 3;
 var MAX_PENDING = 500;
 var pending = [];
@@ -1847,6 +2170,7 @@ function enqueueIngest(db, name, requestedByOwnerId = null) {
   queuedNames.add(name);
   owners.set(name, requestedByOwnerId);
   pending.push(name);
+  void persistDemand(db, name, requestedByOwnerId);
   pump(db);
 }
 function pump(db) {
@@ -1865,15 +2189,18 @@ function pump(db) {
   }
 }
 async function runIngest(db, name, requestedByOwnerId = null) {
+  const persisted = persistDemand(db, name, requestedByOwnerId);
   try {
     const row = await syncOnePackage(db, name, { requestedByOwnerId });
-    if (row.confidence && row.confidence !== "unproven") {
-      await ensureSeedEntry(db, name, row.category).catch(() => {
-      });
-    }
+    await persisted;
+    await setDiscoveryStatus(db, name, { status: "ingested" }).catch(() => {
+    });
     return row;
   } catch (err) {
     logger.warn(`on-demand ingest failed for ${name}: ${String(err)}`);
+    await persisted;
+    await recordIngestFailure(db, name, DISCOVERY.maxIngestAttempts).catch(() => {
+    });
     return null;
   }
 }
@@ -1900,6 +2227,11 @@ export {
   saveScanError,
   setRepoPolicy,
   deleteRepo,
+  getRepoPolicyDefault,
+  setRepoPolicyDefault,
+  applyPolicyToRepos,
+  getQueuedNames,
+  enqueueCandidates,
   ingestQueueDepth,
   drainIngestQueue,
   resetIngestQueue,
@@ -1908,6 +2240,11 @@ export {
   declaredDeps,
   loadVersions,
   computeDrift,
+  permits,
+  breaksSomething,
+  repoMode,
+  applyScope,
+  dispatchUpgradeWorkflow,
   classifyRuntimeTarget,
   FIRST_TOUCH_BUDGET_MS,
   syncOnePackage,