@4da/mcp-server 4.6.1 → 4.6.3

package/dist/tools/decision-memory.d.ts

@@ -126,5 +126,5 @@ export declare const decisionMemoryTool: {
         required: string[];
     };
 };
-export declare function executeDecisionMemory(db: FourDADatabase, params: DecisionMemoryParams): object;
+export declare function executeDecisionMemory(db: FourDADatabase, params: DecisionMemoryParams): object | Promise<object>;
 //# sourceMappingURL=decision-memory.d.ts.map

package/dist/tools/decision-memory.js

@@ -5,6 +5,9 @@
  * Manage developer decisions - record, list, check alignment, update, and supersede.
  * Decisions persist and inform signal classification, tech radar, and agent context.
  */
+import { matchesRecallQuery } from "./recall.js";
+import { getEmbeddingConfig } from "../embeddings.js";
+import { rankDecisionsLexical, hybridDecisionRecall, POSSIBLE_CONFLICT_THRESHOLD, } from "./decision-recall.js";
 // ============================================================================
 // Tool Definition
 // ============================================================================
@@ -119,6 +122,47 @@ function parseDecisionRow(row) {
         context_tags: JSON.parse(row.context_tags || "[]"),
     };
 }
+/**
+ * Build the check_alignment response from retrieved decisions. Hard conflicts are
+ * lexical/alias-aware (grounded); semantically-close decisions that rejected
+ * alternatives are surfaced as advisory `possible_conflicts`.
+ */
+function buildAlignmentResponse(rows, semanticById, recallMode, technology) {
+    const conflicts = [];
+    const possibleConflicts = [];
+    const relevant = [];
+    for (const row of rows) {
+        const alts = JSON.parse(row.alternatives_rejected || "[]");
+        const isRejected = alts.some((alt) => matchesRecallQuery(alt, technology));
+        if (isRejected) {
+            conflicts.push({
+                decision_id: row.id,
+                subject: row.subject,
+                reason: `'${technology}' was rejected in favor of '${row.decision}' (rationale: ${row.rationale || "none"})`,
+            });
+        }
+        else {
+            const sim = semanticById.get(row.id) ?? 0;
+            if (sim >= POSSIBLE_CONFLICT_THRESHOLD && alts.length > 0) {
+                possibleConflicts.push({
+                    decision_id: row.id,
+                    subject: row.subject,
+                    similarity: Math.round(sim * 1000) / 1000,
+                    reason: `'${technology}' is semantically close (${Math.round(sim * 100)}%) to a decision that rejected: ${alts.join(", ")}. Review before proceeding.`,
+                });
+            }
+        }
+        relevant.push(parseDecisionRow(row));
+    }
+    return {
+        aligned: conflicts.length === 0,
+        relevant_decisions: relevant,
+        conflicts,
+        possible_conflicts: possibleConflicts,
+        confidence: relevant.length > 0 ? Math.max(...relevant.map((r) => r.confidence)) : 0.5,
+        recall_mode: recallMode,
+    };
+}
 // ============================================================================
 // Execute
 // ============================================================================
@@ -172,39 +216,25 @@ export function executeDecisionMemory(db, params) {
                     error: "technology is required for check_alignment action",
                 };
             }
-            const search = `%${params.technology.toLowerCase()}%`;
-            const rows = rawDb
+            const candidateRows = rawDb
                 .prepare(`SELECT id, decision_type, subject, decision, rationale,
                   alternatives_rejected, context_tags, confidence,
-                  status, created_at
+                  status, superseded_by, created_at, updated_at
            FROM developer_decisions
            WHERE status = 'active'
-             AND (LOWER(subject) LIKE ?
-               OR LOWER(context_tags) LIKE ?
-               OR LOWER(alternatives_rejected) LIKE ?)`)
-                .all(search, search, search);
-            const conflicts = [];
-            const relevant = [];
-            for (const row of rows) {
-                const alts = JSON.parse(row.alternatives_rejected || "[]");
-                const isRejected = alts.some((alt) => alt.toLowerCase().includes(params.technology.toLowerCase()));
-                if (isRejected) {
-                    conflicts.push({
-                        decision_id: row.id,
-                        subject: row.subject,
-                        reason: `'${params.technology}' was rejected in favor of '${row.decision}' (rationale: ${row.rationale || "none"})`,
-                    });
-                }
-                relevant.push(parseDecisionRow(row));
+           ORDER BY updated_at DESC
+           LIMIT 500`)
+                .all();
+            const technology = params.technology;
+            const limit = params.limit || 20;
+            const config = getEmbeddingConfig();
+            // No provider -> synchronous lexical retrieval (classic behaviour).
+            if (!config) {
+                const rows = rankDecisionsLexical(candidateRows, technology, limit);
+                return buildAlignmentResponse(rows, new Map(), "ranked_lexical", technology);
             }
-            return {
-                aligned: conflicts.length === 0,
-                relevant_decisions: relevant,
-                conflicts,
-                confidence: relevant.length > 0
-                    ? Math.max(...relevant.map((r) => r.confidence))
-                    : 0.5,
-            };
+            // Provider configured -> hybrid retrieval (returns a Promise; dispatch awaits).
+            return hybridDecisionRecall(db, technology, candidateRows, limit, config).then(({ ranked, semanticById, recall_mode }) => buildAlignmentResponse(ranked, semanticById, recall_mode, technology));
         }
         case "update": {
             if (!params.id) {

package/dist/tools/decision-recall.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Shared relevance retrieval for developer_decisions.
+ *
+ * Both decision tools (check_decision_alignment and decision_memory's
+ * check_alignment) retrieve "decisions relevant to X" the same way, so the
+ * ranking lives here once. Retrieval is lexical by default and OPTIONALLY hybrid
+ * (alias-aware lexical blended with provider-backed embedding similarity) when an
+ * embedding provider is configured — letting an agent surface a decision that is
+ * a paraphrase of what it is about to propose, even with zero shared words.
+ *
+ * Note: this affects RETRIEVAL only. Hard "X was rejected" conflict detection
+ * stays lexical/alias-aware in the tools, so semantic similarity can never
+ * fabricate a grounded conflict claim.
+ */
+import type { FourDADatabase } from "../db.js";
+import { type RecallField } from "./recall.js";
+import { type EmbeddingConfig } from "../embeddings.js";
+/** Minimum text fields a decision row must expose for ranking + embedding. */
+export interface DecisionLike {
+    id: number;
+    subject: string;
+    decision: string;
+    rationale: string | null;
+    /** JSON-encoded string[] */
+    alternatives_rejected: string;
+    /** JSON-encoded string[] */
+    context_tags: string;
+}
+/** Weighted fields for lexical ranking — rejected alternatives matter most. */
+export declare const DECISION_RECALL_FIELDS: RecallField<DecisionLike>[];
+/**
+ * A decision retrieved with at least this cosine similarity to the query, that
+ * also has rejected alternatives, is surfaced as a POSSIBLE (paraphrase) conflict
+ * for human review — distinct from a hard, lexically-grounded conflict.
+ */
+export declare const POSSIBLE_CONFLICT_THRESHOLD = 0.6;
+export interface DecisionRecallResult<T extends DecisionLike> {
+    /** Decisions ranked by relevance, capped to `limit`. */
+    ranked: T[];
+    /** id -> cosine similarity to the query (empty in pure-lexical mode). */
+    semanticById: Map<number, number>;
+    recall_mode: "hybrid" | "ranked_lexical";
+}
+/** Pure lexical ranking (the default, provider-free path). */
+export declare function rankDecisionsLexical<T extends DecisionLike>(rows: T[], query: string, limit: number): T[];
+/**
+ * The text embedded for a decision: everything that carries its meaning.
+ * Exported so every surface that embeds a decision row (decision tools AND the
+ * what_should_i_know briefing) uses IDENTICAL text — otherwise they would write
+ * conflicting vectors into the shared developer_decisions.embedding column.
+ */
+export declare function decisionEmbedText(row: DecisionLike): string;
+/**
+ * Hybrid retrieval: blends alias-aware lexical scoring with embedding cosine
+ * similarity. Falls back to pure lexical (and reports it) when the query cannot
+ * be embedded.
+ */
+export declare function hybridDecisionRecall<T extends DecisionLike>(db: FourDADatabase, query: string, rows: T[], limit: number, config: EmbeddingConfig): Promise<DecisionRecallResult<T>>;
+//# sourceMappingURL=decision-recall.d.ts.map

package/dist/tools/decision-recall.js

@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Shared relevance retrieval for developer_decisions.
+ *
+ * Both decision tools (check_decision_alignment and decision_memory's
+ * check_alignment) retrieve "decisions relevant to X" the same way, so the
+ * ranking lives here once. Retrieval is lexical by default and OPTIONALLY hybrid
+ * (alias-aware lexical blended with provider-backed embedding similarity) when an
+ * embedding provider is configured — letting an agent surface a decision that is
+ * a paraphrase of what it is about to propose, even with zero shared words.
+ *
+ * Note: this affects RETRIEVAL only. Hard "X was rejected" conflict detection
+ * stays lexical/alias-aware in the tools, so semantic similarity can never
+ * fabricate a grounded conflict claim.
+ */
+import { rankRowsByRecall } from "./recall.js";
+import { semanticScores } from "../embeddings.js";
+/** Weighted fields for lexical ranking — rejected alternatives matter most. */
+export const DECISION_RECALL_FIELDS = [
+    { name: "alternatives", weight: 5, value: (row) => row.alternatives_rejected },
+    { name: "subject", weight: 4, value: (row) => row.subject },
+    { name: "tags", weight: 3, value: (row) => row.context_tags },
+    { name: "decision", weight: 2, value: (row) => row.decision },
+    { name: "rationale", weight: 1, value: (row) => row.rationale },
+];
+/** Blend weight for semantic cosine vs normalized lexical score. */
+const SEMANTIC_BLEND = 0.65;
+/**
+ * A decision retrieved with at least this cosine similarity to the query, that
+ * also has rejected alternatives, is surfaced as a POSSIBLE (paraphrase) conflict
+ * for human review — distinct from a hard, lexically-grounded conflict.
+ */
+export const POSSIBLE_CONFLICT_THRESHOLD = 0.6;
+/** Pure lexical ranking (the default, provider-free path). */
+export function rankDecisionsLexical(rows, query, limit) {
+    return rankRowsByRecall(rows, query, DECISION_RECALL_FIELDS, limit).map((item) => item.row);
+}
+/**
+ * The text embedded for a decision: everything that carries its meaning.
+ * Exported so every surface that embeds a decision row (decision tools AND the
+ * what_should_i_know briefing) uses IDENTICAL text — otherwise they would write
+ * conflicting vectors into the shared developer_decisions.embedding column.
+ */
+export function decisionEmbedText(row) {
+    let alts = "";
+    try {
+        alts = JSON.parse(row.alternatives_rejected || "[]").join(", ");
+    }
+    catch {
+        // Malformed JSON — just skip the alternatives in the embed text.
+    }
+    return [row.subject, row.decision, row.rationale || "", alts].filter(Boolean).join("\n");
+}
+/**
+ * Hybrid retrieval: blends alias-aware lexical scoring with embedding cosine
+ * similarity. Falls back to pure lexical (and reports it) when the query cannot
+ * be embedded.
+ */
+export async function hybridDecisionRecall(db, query, rows, limit, config) {
+    // Lexical baseline over ALL candidates (for blending + fallback).
+    const lexical = rankRowsByRecall(rows, query, DECISION_RECALL_FIELDS, rows.length);
+    const lexById = new Map();
+    for (const item of lexical)
+        lexById.set(item.row.id, item.score);
+    const maxLex = lexical.length ? lexical[0].score : 0;
+    const sem = await semanticScores(db, "developer_decisions", query, rows.map((row) => ({ id: row.id, text: decisionEmbedText(row) })), config);
+    if (!sem.queryEmbedded || sem.embeddedCount === 0) {
+        return {
+            ranked: rankDecisionsLexical(rows, query, limit),
+            semanticById: new Map(),
+            recall_mode: "ranked_lexical",
+        };
+    }
+    const ranked = rows
+        .map((row) => {
+        const semantic = Math.max(0, sem.semanticById.get(row.id) ?? 0);
+        const lexNorm = maxLex > 0 ? (lexById.get(row.id) ?? 0) / maxLex : 0;
+        const score = SEMANTIC_BLEND * semantic + (1 - SEMANTIC_BLEND) * lexNorm;
+        return { row, score };
+    })
+        .filter((x) => x.score > 0)
+        .sort((a, b) => b.score - a.score)
+        .slice(0, limit)
+        .map((x) => x.row);
+    return { ranked, semanticById: sem.semanticById, recall_mode: "hybrid" };
+}
+//# sourceMappingURL=decision-recall.js.map

package/dist/tools/dependency-health.js

@@ -75,15 +75,17 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
     // Compute stats
     let outdated = 0;
     let deprecated = 0;
-    let vulnerable = 0;
     for (const dep of registryData) {
         if (dep.versionsBehind && dep.versionsBehind.label !== "up-to-date")
             outdated++;
         if (dep.deprecated)
             deprecated++;
-        if (vulnMap.has(dep.name))
-            vulnerable++;
     }
+    // Count vulnerable packages from the full scanned set (the OSV scan covers
+    // transitives), so the "N vulnerable" summary agrees with the severity
+    // breakdown shown beside it. registryData is direct deps only — counting there
+    // undercounts CVEs that live in transitive dependencies.
+    const vulnerable = vulnMap.size;
     // Sort
     const sortBy = params.sort_by ?? "risk";
     const sorted = [...registryData].sort((a, b) => {
@@ -135,7 +137,7 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
         parts.push("all healthy");
     return {
         scannedAt: new Date().toISOString(),
-        projectPath: process.cwd(),
+        projectPath: liveIntel.getProjectRoot() ?? process.cwd(),
         ecosystemsScanned: ecosystems,
         totalDeps: total,
         outdatedCount: outdated,

package/dist/tools/developer-dna.js

@@ -195,15 +195,17 @@ export function executeDeveloperDna(db, params) {
                 }
                 // Check for any source_items mentioning this dep that have interactions
                 try {
+                    // Escape LIKE wildcards so a name containing % or _ matches literally.
+                    const likeDep = `%${depLower.replace(/[\\%_]/g, (c) => "\\" + c)}%`;
                     const mentionedInteraction = rawDb
                         .prepare(`SELECT i.timestamp
                FROM interactions i
                JOIN source_items si ON i.item_id = si.id AND i.item_source = si.source_type
-               WHERE (LOWER(si.title) LIKE ? OR LOWER(si.content) LIKE ?)
+               WHERE (LOWER(si.title) LIKE ? ESCAPE '\\' OR LOWER(si.content) LIKE ? ESCAPE '\\')
                AND i.action_type IN ('click', 'save')
                ORDER BY i.timestamp DESC
                LIMIT 1`)
-                        .get(`%${depLower}%`, `%${depLower}%`);
+                        .get(likeDep, likeDep);
                     if (mentionedInteraction) {
                         const interactionTime = new Date(mentionedInteraction.timestamp).getTime();
                         const daysSince = Math.floor((now - interactionTime) / (1000 * 60 * 60 * 24));

package/dist/tools/knowledge-gaps.js

@@ -9,6 +9,11 @@ function hasWordBoundary(text, term) {
     const regex = new RegExp(`\\b${term}\\b`, 'i');
     return regex.test(text);
 }
+// Escape SQL LIKE wildcards so a package name containing % or _ (npm names may
+// contain _) is matched literally rather than as a pattern. Paired with ESCAPE '\'.
+function escapeLike(s) {
+    return s.replace(/[\\%_]/g, (c) => "\\" + c);
+}
 export const knowledgeGapsTool = {
     name: "knowledge_gaps",
     description: `Detect knowledge gaps by cross-referencing your project dependencies with source items you haven't engaged with. Identifies things you should know about but might have missed.`,
@@ -43,13 +48,20 @@ export function executeKnowledgeGaps(db, params) {
     }
     const gaps = [];
     for (const dep of deps) {
-        // Find source items mentioning this dependency
-        const pattern = `%${dep.package_name}%`;
+        // Names shorter than 3 chars (e.g. "c", "go", "ws") match too many unrelated
+        // items via substring LIKE to be a trustworthy "mention" signal — skip them.
+        if (!dep.package_name || dep.package_name.length < 3)
+            continue;
+        // Find source items mentioning this dependency. Engagement is recorded by the
+        // app in interactions.item_id / .action_type (the canonical columns; the older
+        // source_item_id / action columns are unused), so the NOT-IN suppression must
+        // read those or it silently never fires.
+        const pattern = `%${escapeLike(dep.package_name)}%`;
         const mentionedItems = rawDb
             .prepare(`SELECT si.id, si.title, si.url, si.source_type, si.created_at
         FROM source_items si
-        WHERE (si.title LIKE ? OR si.content LIKE ?)
-        AND si.id NOT IN (SELECT source_item_id FROM interactions WHERE action IN ('click', 'save'))
+        WHERE (si.title LIKE ? ESCAPE '\\' OR si.content LIKE ? ESCAPE '\\')
+        AND si.id NOT IN (SELECT item_id FROM interactions WHERE action_type IN ('click', 'save'))
         ORDER BY si.created_at DESC LIMIT 5`)
             .all(pattern, pattern);
         if (mentionedItems.length > 0) {

package/dist/tools/recall.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Ranked lexical recall for small local knowledge tables.
+ *
+ * This is not embedding search. It is a deterministic bridge that searches
+ * all meaningful text fields and ranks matches until decision/memory
+ * embeddings get their own schema and vec index.
+ */
+export interface RecallField<T> {
+    name: string;
+    weight: number;
+    value: (row: T) => unknown;
+}
+export interface RankedRecall<T> {
+    row: T;
+    score: number;
+    matched_fields: string[];
+}
+export declare function normalizeRecallText(input: unknown): string;
+export declare function recallTerms(query: string): string[];
+export declare function matchesRecallQuery(text: unknown, query: string): boolean;
+export declare function rankRowsByRecall<T>(rows: T[], query: string, fields: RecallField<T>[], limit: number): RankedRecall<T>[];
+/**
+ * Build a reusable relevance scorer for a single query. The query's normalized
+ * phrase and alias-expanded terms are computed ONCE, so callers that score many
+ * texts against the same query (ranking 300+ rows x 5 fields, or filtering a
+ * briefing's advisories/windows/news) do not re-tokenize the query per text.
+ *
+ * Exported so every relevance check in the server shares one alias-aware scorer
+ * instead of re-implementing substring matching (which silently drops aliases
+ * like auth -> jwt).
+ */
+export declare function createRelevanceScorer(query: string): (text: unknown) => number;
+//# sourceMappingURL=recall.d.ts.map

package/dist/tools/recall.js

@@ -0,0 +1,134 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Ranked lexical recall for small local knowledge tables.
+ *
+ * This is not embedding search. It is a deterministic bridge that searches
+ * all meaningful text fields and ranks matches until decision/memory
+ * embeddings get their own schema and vec index.
+ */
+const STOP_WORDS = new Set([
+    "about",
+    "after",
+    "again",
+    "against",
+    "before",
+    "between",
+    "from",
+    "into",
+    "should",
+    "that",
+    "their",
+    "there",
+    "this",
+    "with",
+    "would",
+]);
+const TERM_ALIASES = {
+    auth: ["authentication", "authorization", "jwt", "oauth"],
+    authentication: ["auth"],
+    authorization: ["auth", "authz"],
+    authz: ["authorization"],
+    js: ["javascript"],
+    javascript: ["js"],
+    postgres: ["postgresql"],
+    postgresql: ["postgres"],
+    py: ["python"],
+    python: ["py"],
+    sqlite: ["sqlite3"],
+    sqlite3: ["sqlite"],
+    ts: ["typescript"],
+    typescript: ["ts"],
+};
+export function normalizeRecallText(input) {
+    if (input === null || input === undefined)
+        return "";
+    const text = Array.isArray(input) ? input.join(" ") : String(input);
+    return text
+        .toLowerCase()
+        .replace(/[^a-z0-9+#]+/g, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+export function recallTerms(query) {
+    const terms = new Set();
+    const normalized = normalizeRecallText(query);
+    for (const token of normalized.split(" ")) {
+        if (token.length < 3 || STOP_WORDS.has(token))
+            continue;
+        terms.add(token);
+        for (const alias of TERM_ALIASES[token] || []) {
+            terms.add(alias);
+        }
+    }
+    return [...terms];
+}
+export function matchesRecallQuery(text, query) {
+    return scoreRecallText(text, query) > 0;
+}
+export function rankRowsByRecall(rows, query, fields, limit) {
+    const scoreText = createRelevanceScorer(query);
+    const ranked = rows
+        .map((row) => {
+        let score = 0;
+        const matched = new Set();
+        for (const field of fields) {
+            const fieldScore = scoreText(safeValue(field, row));
+            if (fieldScore > 0) {
+                score += fieldScore * field.weight;
+                matched.add(field.name);
+            }
+        }
+        return { row, score, matched_fields: [...matched] };
+    })
+        .filter((item) => item.score > 0)
+        .sort((a, b) => b.score - a.score);
+    return ranked.slice(0, Math.max(1, limit));
+}
+function safeValue(field, row) {
+    try {
+        return field.value(row);
+    }
+    catch {
+        return "";
+    }
+}
+/**
+ * Build a reusable relevance scorer for a single query. The query's normalized
+ * phrase and alias-expanded terms are computed ONCE, so callers that score many
+ * texts against the same query (ranking 300+ rows x 5 fields, or filtering a
+ * briefing's advisories/windows/news) do not re-tokenize the query per text.
+ *
+ * Exported so every relevance check in the server shares one alias-aware scorer
+ * instead of re-implementing substring matching (which silently drops aliases
+ * like auth -> jwt).
+ */
+export function createRelevanceScorer(query) {
+    const phrase = normalizeRecallText(query);
+    const hasPhrase = phrase.length >= 3;
+    const terms = recallTerms(query);
+    return (text) => {
+        if (!hasPhrase && terms.length === 0)
+            return 0;
+        const haystack = normalizeRecallText(text);
+        if (!haystack)
+            return 0;
+        let score = 0;
+        if (hasPhrase && haystack.includes(phrase)) {
+            score += 4;
+        }
+        const haystackTerms = new Set(haystack.split(" "));
+        for (const term of terms) {
+            if (haystackTerms.has(term)) {
+                score += 2;
+            }
+            else if (haystack.includes(term)) {
+                score += 1;
+            }
+        }
+        return score;
+    };
+}
+function scoreRecallText(text, query) {
+    return createRelevanceScorer(query)(text);
+}
+//# sourceMappingURL=recall.js.map

package/dist/tools/upgrade-planner.d.ts

@@ -1,9 +1,20 @@
 /**
  * upgrade_planner tool
  *
- * Ranked upgrade recommendations for project dependencies.
+ * Ranked standalone upgrade recommendations for project dependencies.
  * Combines version freshness, vulnerability data, and deprecation status
  * to produce a prioritized upgrade plan.
+ *
+ * Honesty contract (Phase 0 hardening):
+ * - Transitive CVEs are surfaced as `waiting_on_upstream` steps instead of
+ *   being counted-but-never-recommended. No dependency-graph parsing happens
+ *   here — parent mapping is the desktop core's job; the honest label is ours.
+ * - Output carries explicit heuristic provenance: this is a point-in-time
+ *   standalone plan, not the 4DA app's cross-project, version-confirmed plan.
+ * - `projectPath` reports the directory set the dependencies were actually
+ *   resolved from, not whatever `process.cwd()` happens to be.
+ * - When no vulnerability scan has run, the plan says so instead of silently
+ *   producing a CVE-blind ranking.
  */
 import type { FourDADatabase } from "../db.js";
 import type { LiveIntelligence } from "../live/index.js";
@@ -22,6 +33,12 @@ interface UpgradeRecommendation {
     reasons: string[];
     breaking: boolean;
     isDev: boolean;
+    /** Whether this package is declared in a manifest (direct) or only present via the lockfile (transitive). */
+    scope: "direct" | "transitive";
+    /** Direct deps you can bump yourself; transitive fixes arrive via a parent update or lockfile refresh. */
+    action: "upgrade_direct" | "waiting_on_upstream";
+    /** False when the dependency is gated behind a target spec not active on this host (label, never suppressed). */
+    platformActive: boolean;
 }
 interface UpgradePlanResult {
     generatedAt: string;
@@ -31,6 +48,13 @@ interface UpgradePlanResult {
     summary: string;
     quickWins: number;
     breakingChanges: number;
+    waitingOnUpstream: number;
+    /** False when no vulnerability scan has run this session — the ranking is then CVE-blind and says so. */
+    vulnerabilityDataAvailable: boolean;
+    provenance: {
+        mode: "standalone_heuristic";
+        note: string;
+    };
 }
 export declare const upgradePlannerTool: {
     name: string;