@4da/mcp-server 5.0.4 → 6.0.1

package/dist/tools/briefing-task-scope.js

@@ -0,0 +1,197 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Which of this project's dependencies a task touches, and what is known
+ * about each — the core of the what_should_i_know briefing.
+ *
+ * Measured 2026-10-01: asked about "bump fastembed 5 -> 7", the briefing
+ * returned eleven advisories and none about fastembed. It never asked which
+ * packages the task names; it merged feed items by recency and keyword class,
+ * so a 7-day-old `fastembed v7.1.0` release row was outside its 72-hour window
+ * while an arXiv dataset paper and three OpenAI-company headlines were in.
+ * This module starts from the task instead: the dependencies it names (exact
+ * package names from the resolved dependency set), then facts about exactly
+ * those packages.
+ */
+import { isActionableVulnerability } from "../live/maintenance.js";
+import { presentedSeverity } from "../live/severity-scope.js";
+import { compareVersions } from "../live/version-compare.js";
+/**
+ * Package names that are also everyday words. One of these counts as named
+ * only with a qualifier beside it — "the next crate", "`next`", "upgrade
+ * next to 15" — so "the next step" does not drag the `next` package in.
+ */
+export const COMMON_WORDS = new Set([
+    "next", "open", "debug", "ms", "ai", "test", "core", "util", "utils", "path", "fs", "os", "url", "http",
+    "log", "time", "rand", "bytes", "once", "glob", "which", "yes", "color", "colors", "async", "events",
+    "image", "regex", "net", "io", "fetch", "form", "data", "config", "cache", "queue", "stream",
+    "buffer", "assert", "base", "env", "error", "errors", "string", "table", "tree",
+    "safe", "lock", "slash", "sort", "type", "types", "web",
+]);
+const QUALIFIERS = /^(?:crate|crates|package|packages|pkg|dependency|dependencies|dep|deps|library|lib|module|version|upgrade|upgrading|bump|bumping|update|updating|migrate|migrating|install|v?\d[\w.*-]*)$/i;
+const VERSION_TOKEN = /^v?\d+(?:\.(?:\d+|x|\*))*(?:\.\d+)?(?:-[\w.]+)?$/i;
+/** Lowercased word-ish tokens, keeping package punctuation (@scope/name, a-b_c.d). */
+function tokenize(text) {
+    return (text.match(/[@A-Za-z0-9][\w./@*-]*/g) ?? []).map((t) => t.replace(/[.,;:)]+$/, "").toLowerCase());
+}
+/** Spellings a token may name a dependency by. */
+function nameKeys(dep) {
+    const name = dep.name.toLowerCase();
+    const keys = new Set([name]);
+    if (dep.ecosystem === "crates.io") {
+        keys.add(name.replace(/-/g, "_"));
+        keys.add(name.replace(/_/g, "-"));
+    }
+    if (dep.ecosystem === "PyPI")
+        keys.add(name.replace(/[-_.]+/g, "-"));
+    if (dep.ecosystem === "Go") {
+        const last = name.split("/").pop() ?? name;
+        if (last.length >= 3 && !/^v\d+$/.test(last))
+            keys.add(last);
+    }
+    return [...keys];
+}
+/**
+ * The dependencies a task (and its file list) names. Exact names only; a
+ * common-word name needs a qualifier within two tokens or code quoting.
+ * Direct dependencies first; at most `limit` packages.
+ */
+export function detectTaskPackages(task, files, deps, limit = 5) {
+    const quoted = new Set((task.match(/`([^`]+)`/g) ?? []).map((q) => q.slice(1, -1).toLowerCase()));
+    const tokens = tokenize(`${task} ${files.join(" ")}`);
+    const byKey = new Map();
+    for (const dep of deps) {
+        if (!dep.name)
+            continue;
+        for (const key of nameKeys(dep))
+            byKey.set(key, [...(byKey.get(key) ?? []), dep]);
+    }
+    const found = new Map();
+    tokens.forEach((token, i) => {
+        const matches = byKey.get(token);
+        if (!matches)
+            return;
+        if (COMMON_WORDS.has(token) && !quoted.has(token)) {
+            const window = [...tokens.slice(Math.max(0, i - 2), i), ...tokens.slice(i + 1, i + 3)];
+            if (!window.some((w) => QUALIFIERS.test(w)))
+                return;
+        }
+        const key = `${matches[0].ecosystem}\0${matches[0].name}`;
+        if (!found.has(key))
+            found.set(key, { deps: matches, at: i });
+    });
+    const packages = [...found.values()].map(({ deps: copies, at }) => {
+        const versions = tokens.slice(at + 1, at + 8).filter((t) => VERSION_TOKEN.test(t));
+        const first = copies[0];
+        return {
+            name: first.name,
+            ecosystem: first.ecosystem,
+            installed: [...new Set(copies.map((d) => d.version).filter((v) => Boolean(v)))],
+            direct: copies.some((d) => d.isDirect),
+            dev: copies.every((d) => d.isDev),
+            requested_from: versions.length >= 2 ? versions[0] : null,
+            requested_to: versions.length >= 1 ? versions[versions.length - 1] : null,
+        };
+    });
+    packages.sort((a, b) => Number(b.direct) - Number(a.direct));
+    return packages.slice(0, limit);
+}
+/** Major version of a version or a `7.x` / `v7` request; null when unreadable. */
+export function majorOf(version) {
+    const m = version ? /^v?(\d+)/.exec(version) : null;
+    return m ? Number(m[1]) : null;
+}
+/** Actionable advisories on the installed copies of one package, highest presented severity first. */
+export function advisoriesFor(pkg, vulns) {
+    const rank = { critical: 4, high: 3, medium: 2, low: 1, unknown: 0 };
+    return vulns
+        .filter((v) => v.package === pkg.name && v.ecosystem === pkg.ecosystem && isActionableVulnerability(v))
+        .map((v) => ({
+        id: v.vulnId,
+        installed: v.currentVersion,
+        severity: presentedSeverity(v),
+        fixed_version: v.fixedVersion,
+        summary: v.summary.length > 160 ? `${v.summary.slice(0, 157)}...` : v.summary,
+    }))
+        .sort((a, b) => rank[b.severity] - rank[a.severity]);
+}
+const RELEASE_SOURCES = {
+    "crates.io": { source: "crates_io", prefix: "crates.io: " },
+    npm: { source: "npm_registry", prefix: "npm: " },
+};
+/**
+ * Registry release rows the desktop app's feed holds for one package, newer
+ * than the installed version. Matched on the registry's own title format
+ * (`crates.io: fastembed v7.1.0`), never on a free-text mention. Empty in
+ * standalone mode (no feed) or for ecosystems the feed does not watch.
+ */
+export function releasesFor(db, pkg) {
+    const spec = RELEASE_SOURCES[pkg.ecosystem];
+    if (!spec)
+        return [];
+    let rows;
+    try {
+        rows = db
+            .getRawDb()
+            .prepare(`SELECT title, url, created_at FROM source_items
+         WHERE source_type = ? AND title LIKE ? ORDER BY created_at DESC LIMIT 50`)
+            .all(spec.source, `${spec.prefix}${pkg.name} v%`);
+    }
+    catch {
+        return [];
+    }
+    const newest = pkg.installed.reduce((max, v) => (max === null || compareVersions(v, max, pkg.ecosystem) > 0 ? v : max), null);
+    const seen = new Set();
+    const out = [];
+    for (const row of rows) {
+        const version = row.title.slice(`${spec.prefix}${pkg.name} v`.length).trim();
+        if (!version || seen.has(version) || (row.title !== `${spec.prefix}${pkg.name} v${version}`))
+            continue;
+        if (newest && compareVersions(version, newest, pkg.ecosystem) <= 0)
+            continue;
+        seen.add(version);
+        out.push({ version, seen: row.created_at, url: row.url });
+    }
+    return out.sort((a, b) => compareVersions(b.version, a.version, pkg.ecosystem)).slice(0, 5);
+}
+/**
+ * Feed items about the task's packages that the app's relevance judge
+ * accepted (latest `llm_judgments` verdict >= 0.5) and that the feed kept
+ * (`feed_relevant` = 1). Exact package-name match on a word boundary in the
+ * title. Third-party text: reported as data. Empty without the desktop feed.
+ */
+export function judgedReadingFor(db, packages, limit = 5) {
+    if (packages.length === 0)
+        return [];
+    const raw = db.getRawDb();
+    let rows;
+    try {
+        rows = raw
+            .prepare(`WITH latest AS (
+           SELECT source_item_id, relevance_score,
+                  ROW_NUMBER() OVER (PARTITION BY source_item_id ORDER BY id DESC) AS rn
+           FROM llm_judgments)
+         SELECT s.id, s.title, s.url, s.source_type, l.relevance_score AS verdict, s.created_at
+         FROM source_items s JOIN latest l ON l.source_item_id = s.id AND l.rn = 1
+         WHERE s.feed_relevant = 1 AND l.relevance_score >= 0.5
+           AND s.created_at > datetime('now', '-30 days')
+         ORDER BY l.relevance_score DESC, s.created_at DESC LIMIT 2000`)
+            .all();
+    }
+    catch {
+        return [];
+    }
+    const patterns = packages.map((p) => ({
+        name: p.name,
+        re: new RegExp(`(^|[^\\w@/-])${p.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\w-])`, "i"),
+    }));
+    const out = [];
+    for (const row of rows) {
+        const hit = patterns.find((p) => p.re.test(row.title));
+        if (!hit)
+            continue;
+        out.push({ id: row.id, title: row.title, url: row.url, source: row.source_type, judge_relevance: Math.round(row.verdict * 100) / 100, package: hit.name });
+        if (out.length >= limit)
+            break;
+    }
+    return out;
+}

package/dist/tools/briefing-wisdom.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Wisdom retrieval for the what_should_i_know briefing.
+ *
+ * Ranks the developer's recorded decisions and agent memories against the
+ * task — lexically by default, blended with embedding similarity when a
+ * provider is configured. Split out of what-should-i-know.ts, which is the
+ * briefing's assembly and delegation logic.
+ */
+import type { FourDADatabase } from "../db.js";
+import { type EmbeddingConfig } from "../embeddings.js";
+export interface WisdomEntry {
+    type: string;
+    subject: string;
+    detail: string;
+}
+export type WisdomRecallMode = "hybrid" | "ranked_lexical";
+/**
+ * Lexical wisdom retrieval (the default, provider-free path): rank decisions and
+ * memories independently, merge by score, take the top entries.
+ */
+export declare function getRelevantWisdom(db: FourDADatabase, task: string, files: string[]): WisdomEntry[];
+/**
+ * Hybrid wisdom retrieval: blends alias-aware lexical scoring with embedding
+ * cosine similarity (per table, since each is normalized independently), so a
+ * paraphrased prior decision or memory surfaces in the briefing even with no
+ * shared words. Falls back to pure lexical (and reports it) when nothing embeds.
+ */
+export declare function getRelevantWisdomHybrid(db: FourDADatabase, task: string, files: string[], config: EmbeddingConfig): Promise<{
+    wisdom: WisdomEntry[];
+    recall_mode: WisdomRecallMode;
+}>;

package/dist/tools/briefing-wisdom.js

@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Wisdom retrieval for the what_should_i_know briefing.
+ *
+ * Ranks the developer's recorded decisions and agent memories against the
+ * task — lexically by default, blended with embedding similarity when a
+ * provider is configured. Split out of what-should-i-know.ts, which is the
+ * briefing's assembly and delegation logic.
+ */
+import { rankRowsByRecall } from "./recall.js";
+import { semanticScores } from "../embeddings.js";
+import { decisionEmbedText } from "./decision-recall.js";
+import { memoryEmbedText } from "./agent-memory.js";
+/** Weighted fields for ranking decisions (mirrors the decision tools' weights). */
+const WISDOM_DECISION_FIELDS = [
+    { name: "alternatives", weight: 5, value: (row) => row.alternatives_rejected },
+    { name: "subject", weight: 4, value: (row) => row.subject },
+    { name: "tags", weight: 3, value: (row) => row.context_tags },
+    { name: "decision", weight: 2, value: (row) => row.decision },
+    { name: "rationale", weight: 1, value: (row) => row.rationale },
+];
+/** Weighted fields for ranking memories. */
+const WISDOM_MEMORY_FIELDS = [
+    { name: "subject", weight: 4, value: (row) => row.subject },
+    { name: "tags", weight: 3, value: (row) => row.context_tags },
+    { name: "content", weight: 2, value: (row) => row.content },
+    { name: "type", weight: 1, value: (row) => row.memory_type },
+];
+const WISDOM_LIMIT = 6;
+/** Blend weight for semantic cosine vs normalized lexical score in hybrid wisdom. */
+const WISDOM_BLEND = 0.65;
+function loadWisdomDecisions(rawDb) {
+    try {
+        return rawDb
+            .prepare(`SELECT id, subject, decision, rationale, alternatives_rejected, context_tags, updated_at
+         FROM developer_decisions
+         WHERE status = 'active'
+         ORDER BY updated_at DESC
+         LIMIT 300`)
+            .all();
+    }
+    catch {
+        return []; // Older DBs may not have decision memory yet.
+    }
+}
+function loadWisdomMemories(rawDb) {
+    try {
+        return rawDb
+            .prepare(`SELECT id, memory_type, subject, content, context_tags, created_at
+         FROM agent_memory
+         WHERE (expires_at IS NULL OR expires_at > datetime('now'))
+         ORDER BY created_at DESC
+         LIMIT 300`)
+            .all();
+    }
+    catch {
+        return []; // Older DBs may not have agent memory yet.
+    }
+}
+/** Map a ranked decision/memory row to the public WisdomEntry shape. */
+function toWisdomEntry(item) {
+    if (item.type === "decision") {
+        const row = item.row;
+        return {
+            type: "decision",
+            subject: row.subject,
+            detail: row.rationale ? `${row.decision} Rationale: ${row.rationale}` : row.decision,
+        };
+    }
+    const row = item.row;
+    return {
+        type: `memory:${row.memory_type}`,
+        subject: row.subject,
+        detail: row.content,
+    };
+}
+/**
+ * Lexical wisdom retrieval (the default, provider-free path): rank decisions and
+ * memories independently, merge by score, take the top entries.
+ */
+export function getRelevantWisdom(db, task, files) {
+    const rawDb = db.getRawDb();
+    const query = [task, ...files].join(" ");
+    const entries = [
+        ...rankRowsByRecall(loadWisdomDecisions(rawDb), query, WISDOM_DECISION_FIELDS, WISDOM_LIMIT).map((item) => ({ ...item, type: "decision" })),
+        ...rankRowsByRecall(loadWisdomMemories(rawDb), query, WISDOM_MEMORY_FIELDS, WISDOM_LIMIT).map((item) => ({ ...item, type: "memory" })),
+    ];
+    return entries
+        .sort((a, b) => b.score - a.score)
+        .slice(0, WISDOM_LIMIT)
+        .map(toWisdomEntry);
+}
+/**
+ * Hybrid wisdom retrieval: blends alias-aware lexical scoring with embedding
+ * cosine similarity (per table, since each is normalized independently), so a
+ * paraphrased prior decision or memory surfaces in the briefing even with no
+ * shared words. Falls back to pure lexical (and reports it) when nothing embeds.
+ */
+export async function getRelevantWisdomHybrid(db, task, files, config) {
+    const rawDb = db.getRawDb();
+    const query = [task, ...files].join(" ");
+    const decisions = loadWisdomDecisions(rawDb);
+    const memories = loadWisdomMemories(rawDb);
+    // Lexical baselines over ALL rows, per table, for normalization + fallback.
+    const decLex = rankRowsByRecall(decisions, query, WISDOM_DECISION_FIELDS, decisions.length);
+    const memLex = rankRowsByRecall(memories, query, WISDOM_MEMORY_FIELDS, memories.length);
+    const decLexById = new Map(decLex.map((i) => [i.row.id, i.score]));
+    const memLexById = new Map(memLex.map((i) => [i.row.id, i.score]));
+    const decMax = decLex.length ? decLex[0].score : 0;
+    const memMax = memLex.length ? memLex[0].score : 0;
+    const decSem = decisions.length
+        ? await semanticScores(db, "developer_decisions", query, decisions.map((d) => ({ id: d.id, text: decisionEmbedText(d) })), config)
+        : null;
+    const memSem = memories.length
+        ? await semanticScores(db, "agent_memory", query, memories.map((m) => ({ id: m.id, text: memoryEmbedText(m) })), config)
+        : null;
+    const anySemantic = (decSem?.embeddedCount ?? 0) > 0 || (memSem?.embeddedCount ?? 0) > 0;
+    if (!anySemantic) {
+        // Provider unreachable / nothing embedded -> behave exactly like lexical.
+        const entries = [
+            ...decLex.slice(0, WISDOM_LIMIT).map((i) => ({ ...i, type: "decision" })),
+            ...memLex.slice(0, WISDOM_LIMIT).map((i) => ({ ...i, type: "memory" })),
+        ];
+        return {
+            wisdom: entries.sort((a, b) => b.score - a.score).slice(0, WISDOM_LIMIT).map(toWisdomEntry),
+            recall_mode: "ranked_lexical",
+        };
+    }
+    const scored = [];
+    for (const d of decisions) {
+        const semantic = Math.max(0, decSem?.semanticById.get(d.id) ?? 0);
+        const lexNorm = decMax > 0 ? (decLexById.get(d.id) ?? 0) / decMax : 0;
+        const score = WISDOM_BLEND * semantic + (1 - WISDOM_BLEND) * lexNorm;
+        if (score > 0)
+            scored.push({ type: "decision", row: d, score });
+    }
+    for (const m of memories) {
+        const semantic = Math.max(0, memSem?.semanticById.get(m.id) ?? 0);
+        const lexNorm = memMax > 0 ? (memLexById.get(m.id) ?? 0) / memMax : 0;
+        const score = WISDOM_BLEND * semantic + (1 - WISDOM_BLEND) * lexNorm;
+        if (score > 0)
+            scored.push({ type: "memory", row: m, score });
+    }
+    return {
+        wisdom: scored.sort((a, b) => b.score - a.score).slice(0, WISDOM_LIMIT).map(toWisdomEntry),
+        recall_mode: "hybrid",
+    };
+}

package/dist/tools/decision-enforcement.d.ts

@@ -16,7 +16,6 @@ import type { FourDADatabase } from "../db.js";
 export interface CheckDecisionAlignmentParams {
     technology: string;
     pattern?: string;
-    context?: string;
 }
 interface RelevantDecision {
     id: number;
@@ -62,10 +61,6 @@ export declare const checkDecisionAlignmentTool: {
                 type: string;
                 description: string;
             };
-            context: {
-                type: string;
-                description: string;
-            };
         };
         required: string[];
     };

package/dist/tools/decision-enforcement.js

@@ -33,10 +33,6 @@ export const checkDecisionAlignmentTool = {
                 type: "string",
                 description: "Architecture pattern to check (e.g., 'microservices', 'event-driven')",
             },
-            context: {
-                type: "string",
-                description: "Additional context about the proposed change",
-            },
         },
         required: ["technology"],
     },

package/dist/tools/decision-memory.js

@@ -5,9 +5,7 @@
  * Manage developer decisions - record, list, check alignment, update, and supersede.
  * Decisions persist and inform signal classification, tech radar, and agent context.
  */
-import { matchesRecallQuery } from "./recall.js";
-import { getEmbeddingConfig } from "../embeddings.js";
-import { rankDecisionsLexical, hybridDecisionRecall, POSSIBLE_CONFLICT_THRESHOLD, } from "./decision-recall.js";
+import { executeCheckDecisionAlignment } from "./decision-enforcement.js";
 // ============================================================================
 // Tool Definition
 // ============================================================================
@@ -73,11 +71,11 @@ export const decisionMemoryTool = {
             },
             technology: {
                 type: "string",
-                description: "Technology to check alignment for",
+                description: "Technology to check alignment for (check_alignment)",
             },
             pattern: {
                 type: "string",
-                description: "Pattern to check alignment for",
+                description: "Architecture pattern to check alongside the technology (check_alignment)",
             },
             id: {
                 type: "number",
@@ -122,47 +120,6 @@ function parseDecisionRow(row) {
         context_tags: JSON.parse(row.context_tags || "[]"),
     };
 }
-/**
- * Build the check_alignment response from retrieved decisions. Hard conflicts are
- * lexical/alias-aware (grounded); semantically-close decisions that rejected
- * alternatives are surfaced as advisory `possible_conflicts`.
- */
-function buildAlignmentResponse(rows, semanticById, recallMode, technology) {
-    const conflicts = [];
-    const possibleConflicts = [];
-    const relevant = [];
-    for (const row of rows) {
-        const alts = JSON.parse(row.alternatives_rejected || "[]");
-        const isRejected = alts.some((alt) => matchesRecallQuery(alt, technology));
-        if (isRejected) {
-            conflicts.push({
-                decision_id: row.id,
-                subject: row.subject,
-                reason: `'${technology}' was rejected in favor of '${row.decision}' (rationale: ${row.rationale || "none"})`,
-            });
-        }
-        else {
-            const sim = semanticById.get(row.id) ?? 0;
-            if (sim >= POSSIBLE_CONFLICT_THRESHOLD && alts.length > 0) {
-                possibleConflicts.push({
-                    decision_id: row.id,
-                    subject: row.subject,
-                    similarity: Math.round(sim * 1000) / 1000,
-                    reason: `'${technology}' is semantically close (${Math.round(sim * 100)}%) to a decision that rejected: ${alts.join(", ")}. Review before proceeding.`,
-                });
-            }
-        }
-        relevant.push(parseDecisionRow(row));
-    }
-    return {
-        aligned: conflicts.length === 0,
-        relevant_decisions: relevant,
-        conflicts,
-        possible_conflicts: possibleConflicts,
-        confidence: relevant.length > 0 ? Math.max(...relevant.map((r) => r.confidence)) : 0.5,
-        recall_mode: recallMode,
-    };
-}
 // ============================================================================
 // Execute
 // ============================================================================
@@ -216,25 +173,12 @@ export function executeDecisionMemory(db, params) {
                     error: "technology is required for check_alignment action",
                 };
             }
-            const candidateRows = rawDb
-                .prepare(`SELECT id, decision_type, subject, decision, rationale,
-                  alternatives_rejected, context_tags, confidence,
-                  status, superseded_by, created_at, updated_at
-           FROM developer_decisions
-           WHERE status = 'active'
-           ORDER BY updated_at DESC
-           LIMIT 500`)
-                .all();
-            const technology = params.technology;
-            const limit = params.limit || 20;
-            const config = getEmbeddingConfig();
-            // No provider -> synchronous lexical retrieval (classic behaviour).
-            if (!config) {
-                const rows = rankDecisionsLexical(candidateRows, technology, limit);
-                return buildAlignmentResponse(rows, new Map(), "ranked_lexical", technology);
-            }
-            // Provider configured -> hybrid retrieval (returns a Promise; dispatch awaits).
-            return hybridDecisionRecall(db, technology, candidateRows, limit, config).then(({ ranked, semanticById, recall_mode }) => buildAlignmentResponse(ranked, semanticById, recall_mode, technology));
+            // One implementation for both entry points. This action kept its own
+            // copy, which ignored `pattern` and drifted from check_decision_alignment.
+            return executeCheckDecisionAlignment(db, {
+                technology: params.technology,
+                pattern: params.pattern,
+            });
         }
         case "update": {
             if (!params.id) {
@@ -263,9 +207,12 @@ export function executeDecisionMemory(db, params) {
             }
             sets.push("updated_at = datetime('now')");
             values.push(params.id);
-            rawDb
+            const updated = rawDb
                 .prepare(`UPDATE developer_decisions SET ${sets.join(", ")} WHERE id = ?`)
                 .run(...values);
+            if (updated.changes === 0) {
+                return { error: `No decision with id ${params.id}. Use action "list" to find ids.` };
+            }
             return {
                 success: true,
                 message: `Decision ${params.id} updated`,
@@ -277,6 +224,11 @@ export function executeDecisionMemory(db, params) {
                     error: "old_id and new_id are required for supersede action",
                 };
             }
+            const exists = (id) => rawDb.prepare(`SELECT 1 FROM developer_decisions WHERE id = ?`).get(id) !== undefined;
+            const missing = [params.old_id, params.new_id].filter((id) => !exists(id));
+            if (missing.length > 0) {
+                return { error: `No decision with id ${missing.join(" or ")}. Use action "list" to find ids.` };
+            }
             rawDb
                 .prepare(`UPDATE developer_decisions
            SET status = 'superseded',

package/dist/tools/dependency-check-signals.d.ts

@@ -0,0 +1,74 @@
+/**
+ * dependency_check signal evaluation — pure functions, no I/O.
+ *
+ * Each signal states a fact with its evidence and the verdict that fact
+ * implies on its own (`effect`). The item verdict is the strongest effect by
+ * a fixed precedence. `unknown` sits above `wait`/`proceed` and below
+ * `review`/`avoid`: a concrete negative finding stays actionable even when
+ * another source was unreachable, but a missing source never lets the
+ * verdict fall through to `proceed`.
+ */
+import type { PackageReleaseIndex, ReleaseRecord } from "../live/release-metadata.js";
+export type Verdict = "proceed" | "wait" | "review" | "avoid" | "unknown";
+export type SignalEffect = Verdict | "info";
+export interface CheckItem {
+    ecosystem: "npm" | "crates.io";
+    package: string;
+    to: string;
+    from?: string;
+}
+export interface Signal {
+    id: "advisories" | "release_age" | "publish_trust" | "install_script_added" | "new_dependencies" | "yanked_or_deprecated" | "upgrade_type";
+    value: unknown;
+    evidence: string;
+    effect: SignalEffect;
+}
+export interface AdvisoryRef {
+    id: string;
+    severity: "critical" | "high" | "medium" | "low" | "unknown";
+    summary: string;
+    /** Unmaintained-crate notice rather than an exploitable vulnerability. */
+    maintenance: boolean;
+}
+export type AdvisoryFacts = {
+    available: true;
+    to: AdvisoryRef[];
+    from: AdvisoryRef[];
+} | {
+    available: false;
+    detail: string;
+};
+/** A newly introduced dependency's first-publish lookup. */
+export type CreatedAtFact = {
+    status: "ok";
+    createdAt: string | null;
+} | {
+    status: "not_found";
+    detail: string;
+} | {
+    status: "unreachable";
+    detail: string;
+};
+export declare const WAIT_DAYS = 3;
+export declare const NEW_DEP_MIN_AGE_DAYS = 30;
+/** The release `to` is judged against: the installed `from`, else the previous release on `to`'s line. */
+export declare function selectBaseline(index: PackageReleaseIndex, item: CheckItem): {
+    record: ReleaseRecord | null;
+    kind: "from" | "previous_on_line";
+    note: string;
+};
+/** Runtime dependency names in `to` that the baseline did not have; null when either list is unknown. */
+export declare function introducedDependencies(to: ReleaseRecord, base: ReleaseRecord | null): string[] | null;
+export declare function advisoriesSignal(item: CheckItem, facts: AdvisoryFacts): Signal;
+export declare function releaseAgeSignal(item: CheckItem, to: ReleaseRecord, advisories: Signal, now: Date): Signal;
+export declare function publishTrustSignal(item: CheckItem, to: ReleaseRecord, base: ReturnType<typeof selectBaseline>): Signal;
+export declare function installScriptSignal(item: CheckItem, to: ReleaseRecord, from: ReleaseRecord | null): Signal;
+export declare function newDependenciesSignal(to: ReleaseRecord, base: ReturnType<typeof selectBaseline>, introduced: string[] | null, created: Map<string, CreatedAtFact>): Signal;
+export declare function withdrawnSignal(item: CheckItem, to: ReleaseRecord): Signal;
+export declare function upgradeTypeSignal(item: CheckItem): Signal;
+export declare function upgradeType(from: string | undefined, to: string): "patch" | "minor" | "major" | "downgrade" | "none" | "new_dependency" | "unknown";
+/** The item verdict and its one-line reason, from the strongest signal effect. */
+export declare function decide(signals: Signal[]): {
+    verdict: Verdict;
+    reason: string;
+};