@bridge-ds/mcp 0.9.0 → 0.10.0

package/LICENSE

@@ -0,0 +1,110 @@
+# Functional Source License, Version 1.1, MIT Future License
+
+## Abbreviation
+
+FSL-1.1-MIT
+
+## Notice
+
+Copyright 2026 Florian Gouloubi
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the MIT license that is effective on the second anniversary of the date we make
+the Software available. On or after that date, you may use the Software under
+the MIT license, in which case the following will apply:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -4,7 +4,7 @@ An MCP server that connects your own Claude (Claude Code, Claude Desktop or any
 design system repo. Claude can read your DTCG tokens, components and docs, run your contrast gate, and
 propose token changes as reviewable branches and pull requests. It never writes to `main`.
 
-Free and open source (MIT). Local, no backend, no account: it reads files on your disk, or a GitHub repo
+Free and source available (FSL-1.1-MIT, each version becomes MIT after two years). Local, no backend, no account: it reads files on your disk, or a GitHub repo
 with your own token.
 
 ## Run it

package/dist/branches.d.ts

@@ -93,6 +93,7 @@ export declare function branchFacts(ctx: BridgeContext, gh: GitHubClient, n: num
     tokenValues: boolean;
     autoShip: boolean;
     statusLabel: string;
+    publishedBy: string | null;
 }>;
 /** One branch, the way Studio shows it: status, what blocks the merge and who acts, how it stands against main. */
 export declare function branchStatus(ctx: BridgeContext, a: {
@@ -104,6 +105,7 @@ export declare function branchStatus(ctx: BridgeContext, a: {
         shipsByItself: boolean;
         said: string;
     } | undefined;
+    published?: string | undefined;
     pr: number;
     title: string;
     url: string;

package/dist/{chunk-ZVORAO5H.js → chunk-BZEPCY42.js}

@@ -722,7 +722,8 @@ function defineConfig(input) {
         }
       } : {},
       ...g.rights ? { rights: normalizeRights(g.rights) } : {},
-      ...g.soloOwnerCanApproveBoth === true ? { soloOwnerCanApproveBoth: true } : {}
+      ...g.soloOwnerCanApproveBoth === true ? { soloOwnerCanApproveBoth: true } : {},
+      ...g.leadsPublishTier1 === false ? { leadsPublishTier1: false } : {}
     },
     products: input.products?.length ? input.products.map((p) => ({ ...p })) : DEFAULT_PRODUCTS.map((p) => ({ ...p })),
     changes: input.changes === "direct" ? "direct" : DEFAULT_CHANGES_MODE,
@@ -850,6 +851,7 @@ function loadConfig(source) {
       }
       problems.push(...rightsProblems(gov.rights));
       if (gov.soloOwnerCanApproveBoth !== void 0 && typeof gov.soloOwnerCanApproveBoth !== "boolean") problems.push('"governance.soloOwnerCanApproveBoth" must be true or false');
+      if (gov.leadsPublishTier1 !== void 0 && typeof gov.leadsPublishTier1 !== "boolean") problems.push('"governance.leadsPublishTier1" must be true or false');
     }
   }
   problems.push(...visualImpactProblems(d.visualImpact));
@@ -1071,164 +1073,6 @@ function parseContrastChecks(text) {
   return out;
 }
 
-// ../core/src/scopes.ts
-var has = (segments, ...names) => names.some((n) => segments.includes(n));
-function defaultScopes(path, type, tier) {
-  const s = path.split(".");
-  switch (type) {
-    case "color":
-      if (tier === "primitive" || tier === "brand" && s[0] === "palette") return [];
-      if (has(s, "text")) return ["TEXT_FILL"];
-      if (has(s, "border", "ring", "outline")) return ["STROKE_COLOR"];
-      if (has(s, "bg", "surface", "background")) return ["FRAME_FILL", "SHAPE_FILL"];
-      if (has(s, "shadow")) return ["EFFECT_COLOR"];
-      return ["FRAME_FILL", "SHAPE_FILL", "TEXT_FILL", "STROKE_COLOR"];
-    case "dimension":
-      if (has(s, "radius")) return ["CORNER_RADIUS"];
-      if (has(s, "border", "width", "stroke")) return ["STROKE_FLOAT"];
-      if (has(s, "space", "spacing", "gap")) return ["GAP", "WIDTH_HEIGHT"];
-      if (has(s, "size") && has(s, "font")) return ["FONT_SIZE"];
-      if (has(s, "letter-spacing")) return ["LETTER_SPACING"];
-      return ["WIDTH_HEIGHT", "GAP"];
-    case "fontWeight":
-      return ["FONT_WEIGHT"];
-    case "fontFamily":
-      return ["FONT_FAMILY"];
-    case "number":
-      if (has(s, "line-height", "lineHeight")) return ["LINE_HEIGHT"];
-      if (has(s, "opacity")) return ["OPACITY"];
-      return ["WIDTH_HEIGHT", "GAP"];
-    case "string":
-      return ["TEXT_CONTENT"];
-    default:
-      return [];
-  }
-}
-var sameScopes = (a, b) => {
-  const sa = [...new Set(a)].sort();
-  const sb = [...new Set(b)].sort();
-  return sa.length === sb.length && sa.every((x, i) => x === sb[i]);
-};
-var effectiveScopes = (t) => t.scopes ?? defaultScopes(t.path, t.type, t.tier);
-
-// ../core/src/diff-engine.ts
-var normDesc = (d) => (d ?? "").trim();
-function fieldChanges(a, b) {
-  const out = [];
-  if (a.path !== b.path) out.push({ field: "path", before: a.path, after: b.path });
-  if (a.type !== b.type) out.push({ field: "type", before: a.type, after: b.type });
-  const modes = [.../* @__PURE__ */ new Set([...Object.keys(a.values), ...Object.keys(b.values)])];
-  for (const mode of modes) {
-    if (!valuesEqual(b.type, a.values[mode], b.values[mode])) out.push({ field: "value", mode, before: a.values[mode], after: b.values[mode] });
-  }
-  if (normDesc(a.description) !== normDesc(b.description)) out.push({ field: "description", before: a.description, after: b.description });
-  const sa = effectiveScopes(a);
-  const sb = effectiveScopes(b);
-  if (!sameScopes(sa, sb)) out.push({ field: "scopes", before: sa, after: sb });
-  return out;
-}
-function sameToken(a, b) {
-  if (!a || !b) return a === b;
-  return fieldChanges(a, b).length === 0;
-}
-function sideChange(from, to) {
-  if (!from && !to) return void 0;
-  if (!from) return { kind: "added", fields: [] };
-  if (!to) return { kind: "removed", fields: [] };
-  const fields = fieldChanges(from, to);
-  if (!fields.length) return void 0;
-  return { kind: fields.some((f) => f.field === "path") ? "renamed" : "changed", fields };
-}
-function threeWayDiff(base, figma, head) {
-  const ids = /* @__PURE__ */ new Set([...base?.keys() ?? [], ...figma.keys(), ...head.keys()]);
-  const result = { local: [], remote: [], conflicts: [], unchanged: 0 };
-  for (const id of [...ids].sort()) {
-    const b = base?.get(id);
-    const f = figma.get(id);
-    const h = head.get(id);
-    const local = sideChange(b, f);
-    const remote = sideChange(b, h);
-    if (!local && !remote || f && h && sameToken(f, h) || !f && !h) {
-      result.unchanged++;
-      continue;
-    }
-    const entry = { id, path: (f ?? h ?? b).path, base: b, figma: f, head: h, local, remote, conflict: false };
-    if (local && !remote) {
-      entry.path = (f ?? b).path;
-      result.local.push(entry);
-    } else if (remote && !local) {
-      entry.path = (h ?? b).path;
-      result.remote.push(entry);
-    } else {
-      entry.conflict = true;
-      result.conflicts.push(entry);
-    }
-  }
-  const byPath = (a, b) => a.path.localeCompare(b.path);
-  result.local.sort(byPath);
-  result.remote.sort(byPath);
-  result.conflicts.sort(byPath);
-  return result;
-}
-
-// ../core/src/risk.ts
-var RISK_LABELS = {
-  1: "Tier 1: low risk, one code owner",
-  2: "Tier 2: medium risk, design review then design + tech approval",
-  3: "Tier 3: token change, needs design + tech approval"
-};
-function figmaPushTierLabel(tier, changes) {
-  const waits = changes.some((c) => c.kind === "renamed" || c.kind === "removed");
-  return `Tier ${tier}: token change. From Figma: design-approved, ${waits ? "waits for a developer OK (a token renamed or removed can break product code)" : "ships once the checks pass"}`;
-}
-var figmaPushNextLine = (changes) => changes.some((c) => c.kind === "renamed" || c.kind === "removed") ? "Pushed from Figma, so design-approved. A developer OKs the rename or removal before it merges." : "Pushed from Figma, so design-approved. Bridge merges it once the automatic checks pass; Undo is in History in Bridge Studio.";
-var BUMP_RANK = { patch: 0, minor: 1, major: 2 };
-var LOW = [/\.md$/, /^docs\//, /\.stories\.tsx?$/, /\.docs\.json$/, /\.test\.tsx?$/, /^\.changeset\//];
-var isSummary = (c) => "kind" in c;
-function summarizeTokenChange(c) {
-  if (isSummary(c)) return c;
-  const path = (c.target ?? c.current).path;
-  if (!c.target) return { kind: "removed", path };
-  if (!c.current) return { kind: "added", path };
-  if (c.current.path !== c.target.path) return { kind: "renamed", path };
-  const fields = fieldChanges(c.current, c.target);
-  return { kind: "changed", path, descriptionOnly: fields.length > 0 && fields.every((f) => f.field === "description") };
-}
-function tokenBump(changes) {
-  let bump;
-  for (const c of changes.map(summarizeTokenChange)) {
-    const b = c.kind === "removed" || c.kind === "renamed" ? "major" : c.kind === "changed" && c.descriptionOnly ? "patch" : "minor";
-    if (!bump || BUMP_RANK[b] > BUMP_RANK[bump]) bump = b;
-  }
-  return bump;
-}
-function isGuardrail(path, config) {
-  const list2 = config ? [...config.governance.guardrails, CONFIG_FILE, ...config.contrast ? [config.contrast.path] : []] : DEFAULT_GOVERNANCE.guardrails;
-  return list2.some((g) => g.endsWith("/") ? path.startsWith(g) : path === g) || path.startsWith(".github/") || path.endsWith("/contrast.checks.json") || path === "contrast.checks.json";
-}
-function classifyRisk(input) {
-  const reasons = [];
-  const tokenChanges = (input.tokenChanges ?? []).map(summarizeTokenChange);
-  for (const c of tokenChanges) {
-    if (c.kind === "changed" && c.descriptionOnly) reasons.push({ tier: 1, text: `Token description changed: ${c.path}` });
-    else reasons.push({ tier: 3, text: `Token ${c.kind}: ${c.path}` });
-  }
-  const bump = tokenBump(tokenChanges);
-  const componentsDir = input.config?.components?.dir;
-  for (const f of input.files ?? []) {
-    const p = f.path.replace(/^\/+/, "");
-    if (p.endsWith(".tokens.json")) {
-      if (!input.tokenChanges) reasons.push({ tier: 3, text: `Token file ${f.status ?? "changed"}: ${p}` });
-    } else if (isGuardrail(p, input.config)) reasons.push({ tier: 3, text: `Guardrail file changed: ${p}` });
-    else if (LOW.some((r) => r.test(p))) reasons.push({ tier: 1, text: `Docs, story or test: ${p}` });
-    else if (componentsDir && p.startsWith(`${componentsDir}/`)) reasons.push({ tier: 2, text: `Component source ${f.status ?? "changed"}: ${p}` });
-    else reasons.push({ tier: 2, text: `Source file changed: ${p}` });
-  }
-  reasons.sort((a, b) => b.tier - a.tier);
-  const tier = reasons[0]?.tier ?? 1;
-  return { tier, label: RISK_LABELS[tier], reasons: reasons.map((r) => r.text), bump };
-}
-
 // ../core/src/layered.ts
 var DTCG_TYPES = /* @__PURE__ */ new Set(["color", "dimension", "fontFamily", "fontWeight", "duration", "cubicBezier", "number", "strokeStyle", "border", "transition", "shadow", "gradient", "typography", "fontStyle", "string", "boolean"]);
 var aliasOf = (v) => isAlias(v) ? aliasTarget(v) : null;
@@ -1596,6 +1440,164 @@ function layeredParityIssues(set) {
   return out;
 }
 
+// ../core/src/scopes.ts
+var has = (segments, ...names) => names.some((n) => segments.includes(n));
+function defaultScopes(path, type, tier) {
+  const s = path.split(".");
+  switch (type) {
+    case "color":
+      if (tier === "primitive" || tier === "brand" && s[0] === "palette") return [];
+      if (has(s, "text")) return ["TEXT_FILL"];
+      if (has(s, "border", "ring", "outline")) return ["STROKE_COLOR"];
+      if (has(s, "bg", "surface", "background")) return ["FRAME_FILL", "SHAPE_FILL"];
+      if (has(s, "shadow")) return ["EFFECT_COLOR"];
+      return ["FRAME_FILL", "SHAPE_FILL", "TEXT_FILL", "STROKE_COLOR"];
+    case "dimension":
+      if (has(s, "radius")) return ["CORNER_RADIUS"];
+      if (has(s, "border", "width", "stroke")) return ["STROKE_FLOAT"];
+      if (has(s, "space", "spacing", "gap")) return ["GAP", "WIDTH_HEIGHT"];
+      if (has(s, "size") && has(s, "font")) return ["FONT_SIZE"];
+      if (has(s, "letter-spacing")) return ["LETTER_SPACING"];
+      return ["WIDTH_HEIGHT", "GAP"];
+    case "fontWeight":
+      return ["FONT_WEIGHT"];
+    case "fontFamily":
+      return ["FONT_FAMILY"];
+    case "number":
+      if (has(s, "line-height", "lineHeight")) return ["LINE_HEIGHT"];
+      if (has(s, "opacity")) return ["OPACITY"];
+      return ["WIDTH_HEIGHT", "GAP"];
+    case "string":
+      return ["TEXT_CONTENT"];
+    default:
+      return [];
+  }
+}
+var sameScopes = (a, b) => {
+  const sa = [...new Set(a)].sort();
+  const sb = [...new Set(b)].sort();
+  return sa.length === sb.length && sa.every((x, i) => x === sb[i]);
+};
+var effectiveScopes = (t) => t.scopes ?? defaultScopes(t.path, t.type, t.tier);
+
+// ../core/src/diff-engine.ts
+var normDesc = (d) => (d ?? "").trim();
+function fieldChanges(a, b) {
+  const out = [];
+  if (a.path !== b.path) out.push({ field: "path", before: a.path, after: b.path });
+  if (a.type !== b.type) out.push({ field: "type", before: a.type, after: b.type });
+  const modes = [.../* @__PURE__ */ new Set([...Object.keys(a.values), ...Object.keys(b.values)])];
+  for (const mode of modes) {
+    if (!valuesEqual(b.type, a.values[mode], b.values[mode])) out.push({ field: "value", mode, before: a.values[mode], after: b.values[mode] });
+  }
+  if (normDesc(a.description) !== normDesc(b.description)) out.push({ field: "description", before: a.description, after: b.description });
+  const sa = effectiveScopes(a);
+  const sb = effectiveScopes(b);
+  if (!sameScopes(sa, sb)) out.push({ field: "scopes", before: sa, after: sb });
+  return out;
+}
+function sameToken(a, b) {
+  if (!a || !b) return a === b;
+  return fieldChanges(a, b).length === 0;
+}
+function sideChange(from, to) {
+  if (!from && !to) return void 0;
+  if (!from) return { kind: "added", fields: [] };
+  if (!to) return { kind: "removed", fields: [] };
+  const fields = fieldChanges(from, to);
+  if (!fields.length) return void 0;
+  return { kind: fields.some((f) => f.field === "path") ? "renamed" : "changed", fields };
+}
+function threeWayDiff(base, figma, head) {
+  const ids = /* @__PURE__ */ new Set([...base?.keys() ?? [], ...figma.keys(), ...head.keys()]);
+  const result = { local: [], remote: [], conflicts: [], unchanged: 0 };
+  for (const id of [...ids].sort()) {
+    const b = base?.get(id);
+    const f = figma.get(id);
+    const h = head.get(id);
+    const local = sideChange(b, f);
+    const remote = sideChange(b, h);
+    if (!local && !remote || f && h && sameToken(f, h) || !f && !h) {
+      result.unchanged++;
+      continue;
+    }
+    const entry = { id, path: (f ?? h ?? b).path, base: b, figma: f, head: h, local, remote, conflict: false };
+    if (local && !remote) {
+      entry.path = (f ?? b).path;
+      result.local.push(entry);
+    } else if (remote && !local) {
+      entry.path = (h ?? b).path;
+      result.remote.push(entry);
+    } else {
+      entry.conflict = true;
+      result.conflicts.push(entry);
+    }
+  }
+  const byPath = (a, b) => a.path.localeCompare(b.path);
+  result.local.sort(byPath);
+  result.remote.sort(byPath);
+  result.conflicts.sort(byPath);
+  return result;
+}
+
+// ../core/src/risk.ts
+var RISK_LABELS = {
+  1: "Tier 1: low risk, one code owner",
+  2: "Tier 2: medium risk, design review then design + tech approval",
+  3: "Tier 3: token change, needs design + tech approval"
+};
+function figmaPushTierLabel(tier, changes) {
+  const waits = changes.some((c) => c.kind === "renamed" || c.kind === "removed");
+  return `Tier ${tier}: token change. From Figma: design-approved, ${waits ? "waits for a developer OK (a token renamed or removed can break product code)" : "ships once the checks pass"}`;
+}
+var figmaPushNextLine = (changes) => changes.some((c) => c.kind === "renamed" || c.kind === "removed") ? "Pushed from Figma, so design-approved. A developer OKs the rename or removal before it merges." : "Pushed from Figma, so design-approved. Bridge merges it once the automatic checks pass; Undo is in History in Bridge Studio.";
+var BUMP_RANK = { patch: 0, minor: 1, major: 2 };
+var LOW = [/\.md$/, /^docs\//, /\.stories\.tsx?$/, /\.docs\.json$/, /\.test\.tsx?$/, /^\.changeset\//];
+var isSummary = (c) => "kind" in c;
+function summarizeTokenChange(c) {
+  if (isSummary(c)) return c;
+  const path = (c.target ?? c.current).path;
+  if (!c.target) return { kind: "removed", path };
+  if (!c.current) return { kind: "added", path };
+  if (c.current.path !== c.target.path) return { kind: "renamed", path };
+  const fields = fieldChanges(c.current, c.target);
+  return { kind: "changed", path, descriptionOnly: fields.length > 0 && fields.every((f) => f.field === "description") };
+}
+function tokenBump(changes) {
+  let bump;
+  for (const c of changes.map(summarizeTokenChange)) {
+    const b = c.kind === "removed" || c.kind === "renamed" ? "major" : c.kind === "changed" && c.descriptionOnly ? "patch" : "minor";
+    if (!bump || BUMP_RANK[b] > BUMP_RANK[bump]) bump = b;
+  }
+  return bump;
+}
+function isGuardrail(path, config) {
+  const list2 = config ? [...config.governance.guardrails, CONFIG_FILE, ...config.contrast ? [config.contrast.path] : []] : DEFAULT_GOVERNANCE.guardrails;
+  return list2.some((g) => g.endsWith("/") ? path.startsWith(g) : path === g) || path.startsWith(".github/") || path.endsWith("/contrast.checks.json") || path === "contrast.checks.json";
+}
+function classifyRisk(input) {
+  const reasons = [];
+  const tokenChanges = (input.tokenChanges ?? []).map(summarizeTokenChange);
+  for (const c of tokenChanges) {
+    if (c.kind === "changed" && c.descriptionOnly) reasons.push({ tier: 1, text: `Token description changed: ${c.path}` });
+    else reasons.push({ tier: 3, text: `Token ${c.kind}: ${c.path}` });
+  }
+  const bump = tokenBump(tokenChanges);
+  const componentsDir = input.config?.components?.dir;
+  for (const f of input.files ?? []) {
+    const p = f.path.replace(/^\/+/, "");
+    if (p.endsWith(".tokens.json")) {
+      if (!input.tokenChanges) reasons.push({ tier: 3, text: `Token file ${f.status ?? "changed"}: ${p}` });
+    } else if (isGuardrail(p, input.config)) reasons.push({ tier: 3, text: `Guardrail file changed: ${p}` });
+    else if (LOW.some((r) => r.test(p))) reasons.push({ tier: 1, text: `Docs, story or test: ${p}` });
+    else if (componentsDir && p.startsWith(`${componentsDir}/`)) reasons.push({ tier: 2, text: `Component source ${f.status ?? "changed"}: ${p}` });
+    else reasons.push({ tier: 2, text: `Source file changed: ${p}` });
+  }
+  reasons.sort((a, b) => b.tier - a.tier);
+  const tier = reasons[0]?.tier ?? 1;
+  return { tier, label: RISK_LABELS[tier], reasons: reasons.map((r) => r.text), bump };
+}
+
 // ../core/src/layered-review.ts
 function checkLayeredPair(set, pair, combo) {
   const base = { fg: pair.foreground, bg: pair.background, min: pair.min, modes: comboKey(combo) };