@mergesignal/shared 0.12.3 → 0.14.0

package/dist/assessment/schema.js

@@ -0,0 +1,162 @@
+import { z } from "zod";
+import { ABSTAIN_REASON_KINDS, ASSESSMENT_CONFIDENCES, ASSESSMENT_OUTCOMES, ASSESSMENT_POSTURES, ASSESSMENT_REPORT_MODES, BOUNDED_VERIFY_TARGET_KINDS, CHANGE_CLASSES, CLEARANCE_BASES, COVERAGE_CLASSES, DELTA_DIMENSION_KINDS, FOCAL_ELECTION_DIMENSIONS, INSIGHT_EMISSION_FLOORS, MERGE_CONCERN_KINDS, NARRATIVE_INTENSITIES, REACH_BUCKETS, REACH_VISIBILITIES, REVIEW_EPISODE_SHAPES, SUFFICIENCY_BLOCKER_KINDS, UNCLEARED_REASONS, VERIFICATION_INTENSITIES, } from "./literals.js";
+const assessmentConcernSchema = z.object({
+    kind: z.enum(MERGE_CONCERN_KINDS),
+    rank: z.number().int().nonnegative(),
+    packages: z.array(z.string()).optional(),
+    evidenceRefs: z.array(z.string()),
+    context: z.string().optional(),
+});
+const assessmentPresentationWireSchema = z.object({
+    narrativeIntensity: z.enum(NARRATIVE_INTENSITIES),
+    reachVisibility: z.enum(REACH_VISIBILITIES),
+    verificationIntensity: z.enum(VERIFICATION_INTENSITIES),
+    insightEmissionFloor: z.enum(INSIGHT_EMISSION_FLOORS),
+    reportMode: z.enum(ASSESSMENT_REPORT_MODES),
+});
+const reviewFocalPointSchema = z.object({
+    episodeShape: z.enum(REVIEW_EPISODE_SHAPES),
+    anchors: z.array(z.string()),
+    supportingPackages: z.array(z.string()).optional(),
+    election: z.object({
+        grounding: z.array(z.object({
+            packageName: z.string(),
+            reason: z.string(),
+            decidedBy: z.enum(FOCAL_ELECTION_DIMENSIONS),
+            evidenceRefs: z.array(z.string()),
+        })),
+        exclusions: z.array(z.object({
+            packageName: z.string(),
+            reason: z.string(),
+            lostOn: z.enum(FOCAL_ELECTION_DIMENSIONS),
+            evidenceRefs: z.array(z.string()),
+        })),
+    }),
+    electionSummary: z.string().optional(),
+});
+const reachScopeSchema = z.object({
+    packages: z.array(z.string()),
+    maxBucket: z.enum(REACH_BUCKETS),
+    entryPointFiles: z.array(z.string()).optional(),
+});
+const artifactGroundedVerificationScopeSchema = z.object({
+    packages: z.array(z.string()),
+    focus: z.array(z.string()),
+    artifactPaths: z.array(z.string()),
+});
+const verificationScopeSchema = z.object({
+    packages: z.array(z.string()),
+    focus: z.array(z.string()),
+    guidance: z.array(z.string()).optional(),
+    artifactGrounded: artifactGroundedVerificationScopeSchema.optional(),
+});
+// --- ABI 4 outcome model sub-schemas ---
+const abstainReasonSchema = z.object({
+    kind: z.enum(ABSTAIN_REASON_KINDS),
+    packageName: z.string().optional(),
+    detail: z.string().optional(),
+});
+const sufficiencyBlockerSchema = z.object({
+    kind: z.enum(SUFFICIENCY_BLOCKER_KINDS),
+    packageName: z.string().optional(),
+    detail: z.string().optional(),
+});
+const packageSufficiencySchema = z.object({
+    packageName: z.string(),
+    clearanceEligible: z.boolean(),
+    provenBrokenEligible: z.boolean(),
+    blockers: z.array(sufficiencyBlockerSchema),
+});
+const evidenceSufficiencyVerdictSchema = z.object({
+    sufficient: z.boolean(),
+    clearanceEligible: z.boolean(),
+    provenBrokenEligible: z.boolean(),
+    boundedVerifyEligible: z.boolean(),
+    blockers: z.array(sufficiencyBlockerSchema),
+    perPackage: z.record(z.string(), packageSufficiencySchema),
+});
+const boundedVerifyTargetSchema = z.object({
+    targetId: z.string(),
+    packageName: z.string(),
+    kind: z.enum(BOUNDED_VERIFY_TARGET_KINDS),
+    file: z.string().optional(),
+    line: z.number().int().nonnegative().optional(),
+    configKey: z.string().optional(),
+    scenario: z.string().optional(),
+    whatToVerify: z.string(),
+    whyAutomationStopped: z.string(),
+    whatProofWouldResolveIt: z.string(),
+});
+const clearedDimensionSchema = z.object({
+    kind: z.enum(DELTA_DIMENSION_KINDS),
+    basis: z.enum(CLEARANCE_BASES),
+    proofArtifactRef: z.string().optional(),
+    noImpactProofRef: z.string().optional(),
+});
+const unclearedDimensionSchema = z.object({
+    kind: z.enum(DELTA_DIMENSION_KINDS),
+    reason: z.enum(UNCLEARED_REASONS),
+    boundedVerifyTarget: boundedVerifyTargetSchema.optional(),
+});
+const clearanceEnvelopeSchema = z.object({
+    packageName: z.string(),
+    clearedDimensions: z.array(clearedDimensionSchema),
+    unclearedDimensions: z.array(unclearedDimensionSchema),
+    coverageClass: z.enum(COVERAGE_CLASSES),
+});
+const packageOutcomeSchema = z.object({
+    packageName: z.string(),
+    outcome: z.enum(ASSESSMENT_OUTCOMES),
+    proofArtifactRefs: z.array(z.string()).optional(),
+    clearanceEnvelopeRef: z.string().optional(),
+    boundedVerifyTargetRefs: z.array(z.string()).optional(),
+});
+/** Root Assessment wire schema (ABI 4).
+ *
+ * All ABI 3 required fields are preserved. ABI 4 outcome model fields are optional,
+ * so ABI 3 payloads continue to parse successfully. Parsers must tolerate absent ABI 4
+ * fields and treat them as "shadow mode not yet active."
+ */
+export const assessmentSchema = z.object({
+    reviewFocalPoint: reviewFocalPointSchema,
+    reachScope: reachScopeSchema,
+    verificationScope: verificationScopeSchema,
+    posture: z.enum(ASSESSMENT_POSTURES),
+    confidence: z.enum(ASSESSMENT_CONFIDENCES),
+    primaryConcern: z.enum(MERGE_CONCERN_KINDS).nullable(),
+    concerns: z.array(assessmentConcernSchema),
+    factors: z.array(z.string()),
+    changeClasses: z.array(z.enum(CHANGE_CLASSES)),
+    presentation: assessmentPresentationWireSchema,
+    reasoning: z.array(z.string()),
+    confidenceRationale: z.string(),
+    notAffectedLine: z.string().nullable().optional(),
+    resolutionLine: z.string().nullable().optional(),
+    // ABI 4 optional outcome model fields — absent when shadow mode is inactive
+    outcome: z.enum(ASSESSMENT_OUTCOMES).optional(),
+    perPackageOutcome: z.record(z.string(), packageOutcomeSchema).optional(),
+    clearanceEnvelopes: z.record(z.string(), clearanceEnvelopeSchema).optional(),
+    boundedVerifyTargets: z.array(boundedVerifyTargetSchema).optional(),
+    evidenceSufficiencyVerdict: evidenceSufficiencyVerdictSchema.optional(),
+    abstainReasons: z.array(abstainReasonSchema).optional(),
+});
+export function parseAssessmentOrThrow(data) {
+    const parsed = assessmentSchema.safeParse(data);
+    if (!parsed.success) {
+        const issues = parsed.error.issues
+            .map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`)
+            .join("; ");
+        throw new Error(`assessment validation: ${issues}`);
+    }
+    return parsed.data;
+}
+export function safeParseAssessment(data) {
+    const parsed = assessmentSchema.safeParse(data);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            issues: parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`),
+        };
+    }
+    return { ok: true, value: parsed.data };
+}

package/dist/assessment/types.d.ts

@@ -0,0 +1,197 @@
+import type { ABSTAIN_REASON_KINDS, ASSESSMENT_CONFIDENCES, ASSESSMENT_OUTCOMES, ASSESSMENT_POSTURES, ASSESSMENT_REPORT_MODES, BOUNDED_VERIFY_TARGET_KINDS, CHANGE_CLASSES, CLEARANCE_BASES, COVERAGE_CLASSES, DELTA_DIMENSION_KINDS, FOCAL_ELECTION_DIMENSIONS, INSIGHT_EMISSION_FLOORS, MERGE_CONCERN_KINDS, NARRATIVE_INTENSITIES, REACH_BUCKETS, REACH_VISIBILITIES, REVIEW_EPISODE_SHAPES, SUFFICIENCY_BLOCKER_KINDS, UNCLEARED_REASONS, VERIFICATION_INTENSITIES } from "./literals.js";
+/**
+ * Assessment Contract — canonical public decision and explainability wire types.
+ * Assessment is the sole authority for posture and presentation intensity on the wire.
+ */
+export type AssessmentPosture = (typeof ASSESSMENT_POSTURES)[number];
+export type AssessmentConfidence = (typeof ASSESSMENT_CONFIDENCES)[number];
+export type ChangeClass = (typeof CHANGE_CLASSES)[number];
+export type MergeConcernKind = (typeof MERGE_CONCERN_KINDS)[number];
+export type NarrativeIntensity = (typeof NARRATIVE_INTENSITIES)[number];
+export type ReachVisibility = (typeof REACH_VISIBILITIES)[number];
+export type VerificationIntensity = (typeof VERIFICATION_INTENSITIES)[number];
+export type InsightEmissionFloor = (typeof INSIGHT_EMISSION_FLOORS)[number];
+export type AssessmentReportMode = (typeof ASSESSMENT_REPORT_MODES)[number];
+export type ReviewEpisodeShape = (typeof REVIEW_EPISODE_SHAPES)[number];
+export type FocalElectionDimension = (typeof FOCAL_ELECTION_DIMENSIONS)[number];
+export type ReachBucket = (typeof REACH_BUCKETS)[number];
+export type DeltaDimensionKind = (typeof DELTA_DIMENSION_KINDS)[number];
+export type AssessmentConcern = {
+    kind: MergeConcernKind;
+    rank: number;
+    packages?: string[];
+    evidenceRefs: string[];
+    /** One sentence of repository-specific context; absent when no repo-specific content. */
+    context?: string;
+};
+export type AssessmentPresentation = {
+    narrativeIntensity: NarrativeIntensity;
+    reachVisibility: ReachVisibility;
+    verificationIntensity: VerificationIntensity;
+    insightEmissionFloor: InsightEmissionFloor;
+    reportMode: AssessmentReportMode;
+};
+export type FocalElectionGrounding = {
+    packageName: string;
+    reason: string;
+    decidedBy: FocalElectionDimension;
+    evidenceRefs: string[];
+};
+export type FocalElectionExclusion = {
+    packageName: string;
+    reason: string;
+    lostOn: FocalElectionDimension;
+    evidenceRefs: string[];
+};
+export type ReviewFocalPoint = {
+    episodeShape: ReviewEpisodeShape;
+    anchors: string[];
+    supportingPackages?: string[];
+    election: {
+        grounding: FocalElectionGrounding[];
+        exclusions: FocalElectionExclusion[];
+    };
+    /** One sentence explaining the anchor election; absent for structural episodes or uncontested elections. */
+    electionSummary?: string;
+};
+export type ReachScope = {
+    packages: string[];
+    maxBucket: ReachBucket;
+    /** Repository entry paths grounded by propagation evidence (Phase 3.5). */
+    entryPointFiles?: string[];
+};
+export type VerificationScope = {
+    packages: string[];
+    focus: string[];
+    /** Actionable verification sentences; absent when verificationIntensity === 'none'. */
+    guidance?: string[];
+    /** Advisory artifact-grounded verification (tooling packages only). */
+    artifactGrounded?: ArtifactGroundedVerificationScope;
+};
+export type ArtifactGroundedVerificationScope = {
+    packages: string[];
+    focus: string[];
+    artifactPaths: string[];
+};
+/** Assessment wire contract (ABI 4 — adds outcome model fields; ABI 3 expression fields preserved). */
+export type Assessment = {
+    reviewFocalPoint: ReviewFocalPoint;
+    reachScope: ReachScope;
+    verificationScope: VerificationScope;
+    posture: AssessmentPosture;
+    confidence: AssessmentConfidence;
+    primaryConcern: MergeConcernKind | null;
+    concerns: AssessmentConcern[];
+    factors: string[];
+    changeClasses: ChangeClass[];
+    presentation: AssessmentPresentation;
+    /** Repository-specific reasoning sentences explaining this posture. Always produced. */
+    reasoning: string[];
+    /** One sentence explaining this confidence level. Always produced. */
+    confidenceRationale: string;
+    /**
+     * Q8 answer: "What is not affected?" — authored for `cleared` outcome when at least one
+     * dimension was proven unused. Detail/CLI only; absent when nothing was proven unused.
+     */
+    notAffectedLine?: string | null;
+    /**
+     * Q9 answer: "What would make this deterministic?" — authored in Expression for
+     * `bounded_verify` and `abstain` outcomes. Absent for `cleared` and `proven_broken`.
+     */
+    resolutionLine?: string | null;
+    /** Primary product outcome surface (ABI 4). Absent until shadow mode is active. */
+    outcome?: AssessmentOutcome;
+    perPackageOutcome?: Record<string, PackageOutcome>;
+    clearanceEnvelopes?: Record<string, ClearanceEnvelope>;
+    /** Bounded verify targets, capped at 3 per PR. */
+    boundedVerifyTargets?: BoundedVerifyTarget[];
+    evidenceSufficiencyVerdict?: EvidenceSufficiencyVerdict;
+    abstainReasons?: AbstainReason[];
+};
+/** Wire presentation subset — excludes engine policy fields. */
+export type AssessmentPresentationPublic = Pick<AssessmentPresentation, "narrativeIntensity" | "reachVisibility" | "verificationIntensity" | "reportMode">;
+export type AssessmentPresentationWire = AssessmentPresentation;
+export type AssessmentOutcome = (typeof ASSESSMENT_OUTCOMES)[number];
+export type AbstainReasonKind = (typeof ABSTAIN_REASON_KINDS)[number];
+export type SufficiencyBlockerKind = (typeof SUFFICIENCY_BLOCKER_KINDS)[number];
+export type BoundedVerifyTargetKind = (typeof BOUNDED_VERIFY_TARGET_KINDS)[number];
+export type ClearanceBasis = (typeof CLEARANCE_BASES)[number];
+export type UnclearedReason = (typeof UNCLEARED_REASONS)[number];
+export type CoverageClass = (typeof COVERAGE_CLASSES)[number];
+export type AbstainReason = {
+    kind: AbstainReasonKind;
+    packageName?: string;
+    detail?: string;
+};
+export type SufficiencyBlocker = {
+    kind: SufficiencyBlockerKind;
+    packageName?: string;
+    detail?: string;
+};
+export type PackageSufficiency = {
+    packageName: string;
+    clearanceEligible: boolean;
+    provenBrokenEligible: boolean;
+    blockers: SufficiencyBlocker[];
+};
+export type EvidenceSufficiencyVerdict = {
+    sufficient: boolean;
+    clearanceEligible: boolean;
+    provenBrokenEligible: boolean;
+    boundedVerifyEligible: boolean;
+    blockers: SufficiencyBlocker[];
+    perPackage: Record<string, PackageSufficiency>;
+};
+export type BoundedVerifyTarget = {
+    targetId: string;
+    packageName: string;
+    kind: BoundedVerifyTargetKind;
+    file?: string;
+    line?: number;
+    configKey?: string;
+    /**
+     * Internal engine metadata identifying the scenario type.
+     * NEVER rendered directly in developer-facing output — vocabulary firewall.
+     * Expression uses `whatToVerify` (noun phrase) to compose the developer sentence.
+     */
+    scenario?: string;
+    /**
+     * Noun phrase describing the subject of verification.
+     * Expression's BOUNDED_VERIFY_SENTENCE templates compose the full developer sentence.
+     *
+     * Correct:   "constraint ranges for `pkg-a`"
+     * Incorrect: "Verify `pkg-a` constraint ranges are satisfied." (complete sentence — causes double-verb)
+     */
+    whatToVerify: string;
+    whyAutomationStopped: string;
+    /**
+     * Internal proof-kind slug identifying what evidence would close this target.
+     * NEVER rendered directly — Expression maps this to resolutionLine prose.
+     */
+    whatProofWouldResolveIt: string;
+};
+export type ClearedDimension = {
+    kind: DeltaDimensionKind;
+    basis: ClearanceBasis;
+    proofArtifactRef?: string;
+    noImpactProofRef?: string;
+};
+export type UnclearedDimension = {
+    kind: DeltaDimensionKind;
+    reason: UnclearedReason;
+    boundedVerifyTarget?: BoundedVerifyTarget;
+};
+export type ClearanceEnvelope = {
+    packageName: string;
+    clearedDimensions: ClearedDimension[];
+    unclearedDimensions: UnclearedDimension[];
+    coverageClass: CoverageClass;
+};
+export type PackageOutcome = {
+    packageName: string;
+    outcome: AssessmentOutcome;
+    proofArtifactRefs?: string[];
+    clearanceEnvelopeRef?: string;
+    boundedVerifyTargetRefs?: string[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/assessment/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/assessment/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,2BAA2B,EAC3B,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,eAAe,CAAC;AAEvB;;;GAGG;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,eAAe,EAAE,eAAe,CAAC;IACjC,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,UAAU,EAAE,oBAAoB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,sBAAsB,CAAC;IAClC,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,sBAAsB,CAAC;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,YAAY,EAAE,kBAAkB,CAAC;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,QAAQ,EAAE;QACR,SAAS,EAAE,sBAAsB,EAAE,CAAC;QACpC,UAAU,EAAE,sBAAsB,EAAE,CAAC;KACtC,CAAC;IACF,4GAA4G;IAC5G,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,WAAW,CAAC;IACvB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,iCAAiC,CAAC;CACtD,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AAEF,uGAAuG;AACvG,MAAM,MAAM,UAAU,GAAG;IACvB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,UAAU,EAAE,UAAU,CAAC;IACvB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,UAAU,EAAE,oBAAoB,CAAC;IACjC,cAAc,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,YAAY,EAAE,sBAAsB,CAAC;IACrC,wFAAwF;IACxF,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sEAAsE;IACtE,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B,mFAAmF;IACnF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnD,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACvD,kDAAkD;IAClD,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC7C,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC,CAAC;AAEF,gEAAgE;AAChE,MAAM,MAAM,4BAA4B,GAAG,IAAI,CAC7C,sBAAsB,EACpB,oBAAoB,GACpB,iBAAiB,GACjB,uBAAuB,GACvB,YAAY,CACf,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAIhE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/C,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,iBAAiB,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,sBAAsB,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,uBAAuB,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,cAAc,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,kBAAkB,CAAC;IACzB,MAAM,EAAE,eAAe,CAAC;IACxB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IACtC,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C,aAAa,EAAE,aAAa,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;CACpC,CAAC"}

package/dist/assessment/types.js

@@ -0,0 +1 @@
+export {};

package/dist/assessment/version.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Assessment wire ABI — canonical authority for MergeSignal public Assessment contracts.
+ * Bump only on incompatible Assessment wire shape changes.
+ *
+ * ABI 4: adds optional outcome model fields (outcome, perPackageOutcome,
+ * clearanceEnvelopes, boundedVerifyTargets, evidenceSufficiencyVerdict, abstainReasons).
+ * Backward-compatible: all new fields are optional; ABI 3 payloads remain valid.
+ */
+export declare const ASSESSMENT_ABI: "4";
+export type AssessmentAbi = typeof ASSESSMENT_ABI;
+//# sourceMappingURL=version.d.ts.map

package/dist/assessment/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../src/assessment/version.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,EAAG,GAAY,CAAC;AAE3C,MAAM,MAAM,aAAa,GAAG,OAAO,cAAc,CAAC"}

package/dist/assessment/version.js

@@ -0,0 +1,9 @@
+/**
+ * Assessment wire ABI — canonical authority for MergeSignal public Assessment contracts.
+ * Bump only on incompatible Assessment wire shape changes.
+ *
+ * ABI 4: adds optional outcome model fields (outcome, perPackageOutcome,
+ * clearanceEnvelopes, boundedVerifyTargets, evidenceSufficiencyVerdict, abstainReasons).
+ * Backward-compatible: all new fields are optional; ABI 3 payloads remain valid.
+ */
+export const ASSESSMENT_ABI = "4";

package/dist/assessmentLabels.d.ts

@@ -1,4 +1,4 @@
-import type { MergeConcernKind } from "@mergesignal/contracts";
+import type { MergeConcernKind } from "./assessment/types.js";
 /** Display labels for factor tokens (mirrors engine factor-registry labels). */
 export declare const ASSESSMENT_FACTOR_LABELS: Record<string, string>;
 export declare const MERGE_CONCERN_LABELS: Record<MergeConcernKind, string>;

package/dist/assessmentLabels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assessmentLabels.d.ts","sourceRoot":"","sources":["../src/assessmentLabels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAmB3D,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAcjE,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D"}
+{"version":3,"file":"assessmentLabels.d.ts","sourceRoot":"","sources":["../src/assessmentLabels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAmB3D,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAcjE,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/dist/assessmentLabels.js

@@ -1,6 +1,6 @@
 /** Display labels for factor tokens (mirrors engine factor-registry labels). */
 export const ASSESSMENT_FACTOR_LABELS = {
-    confirmed_runtime_usage: "Confirmed runtime usage",
+    unresolved_runtime_exposure: "Unresolved runtime exposure",
     queue_infrastructure: "Queue infrastructure",
     http_framework_infrastructure: "HTTP framework infrastructure",
     auth_infrastructure: "Authentication infrastructure",
@@ -20,7 +20,7 @@ export const ASSESSMENT_FACTOR_LABELS = {
     runtime_patch: "Runtime dependency patch",
 };
 export const MERGE_CONCERN_LABELS = {
-    confirmed_runtime_usage: "Changed package has confirmed usage on runtime application paths in this repository.",
+    unresolved_runtime_exposure: "Changed package upgrade leaves unresolved runtime exposure that warrants review before merge.",
     security_finding: "Security advisory or vulnerability finding affects changed dependencies.",
     breaking_or_major: "Breaking change or major version bump warrants explicit review.",
     behavioral_change: "Behavioral change risk detected on changed dependencies.",

package/dist/assessmentPresentationUtils.d.ts

@@ -1,4 +1,4 @@
-import type { AssessmentPresentationPublic, AssessmentPresentationWire, NarrativeIntensity } from "@mergesignal/contracts";
+import type { AssessmentPresentationPublic, AssessmentPresentationWire, NarrativeIntensity } from "./assessment/types.js";
 /** Public presentation subset — excludes engine policy fields. */
 export declare function toPublicPresentation(wire: AssessmentPresentationWire): AssessmentPresentationPublic;
 /** Map engine narrative intensity to presentation density (formatting only). */

package/dist/assessmentPresentationUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assessmentPresentationUtils.d.ts","sourceRoot":"","sources":["../src/assessmentPresentationUtils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAEhC,kEAAkE;AAClE,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,0BAA0B,GAC/B,4BAA4B,CAO9B;AAED,gFAAgF;AAChF,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,kBAAkB,GAC5B,SAAS,GAAG,UAAU,GAAG,MAAM,CAIjC"}
+{"version":3,"file":"assessmentPresentationUtils.d.ts","sourceRoot":"","sources":["../src/assessmentPresentationUtils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAE/B,kEAAkE;AAClE,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,0BAA0B,GAC/B,4BAA4B,CAO9B;AAED,gFAAgF;AAChF,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,kBAAkB,GAC5B,SAAS,GAAG,UAAU,GAAG,MAAM,CAIjC"}

package/dist/assessmentProjection.d.ts

@@ -1,6 +1,6 @@
 import type { ScanResult } from "./types.js";
 import { type RepoIntelligence } from "./repoIntelligenceSchema.js";
-import type { Assessment, AssessmentPresentationPublic, ReachVisibility, VerificationIntensity } from "@mergesignal/contracts";
+import type { Assessment, AssessmentPresentationPublic, ReachVisibility, VerificationIntensity } from "./assessment/types.js";
 import type { PresentationStatus } from "./presentation/dto/types.js";
 export type VerificationChannel = "runtime" | "artifact" | "none";
 export declare function resolveVerificationChannel(intensity: VerificationIntensity): VerificationChannel;

package/dist/assessmentProjection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assessmentProjection.d.ts","sourceRoot":"","sources":["../src/assessmentProjection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACV,UAAU,EACV,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAmDlE,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,qBAAqB,GAC/B,mBAAmB,CAIrB;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAQ5E;AAED,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAS7E;AAED,wBAAgB,uCAAuC,CACrD,YAAY,EAAE,4BAA4B,EAC1C,MAAM,EAAE,UAAU,GACjB;IAAE,OAAO,EAAE,mBAAmB,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAWnD;AAED,8FAA8F;AAC9F,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAErE;AAED,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,eAAe,GAC1B,MAAM,GAAG,SAAS,CAWpB;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,kBAAkB,GACzB,MAAM,CAiDR;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAMlE;AAED,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,UAAU,GACjB,MAAM,EAAE,CAaV;AAED,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,4BAA4B,EAC1C,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,GACV,MAAM,EAAE,CAWV;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,EAAE,CAI3E"}
+{"version":3,"file":"assessmentProjection.d.ts","sourceRoot":"","sources":["../src/assessmentProjection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACV,UAAU,EACV,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAmDlE,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,qBAAqB,GAC/B,mBAAmB,CAIrB;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAQ5E;AAED,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAS7E;AAED,wBAAgB,uCAAuC,CACrD,YAAY,EAAE,4BAA4B,EAC1C,MAAM,EAAE,UAAU,GACjB;IAAE,OAAO,EAAE,mBAAmB,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAWnD;AAED,8FAA8F;AAC9F,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAErE;AAED,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,eAAe,GAC1B,MAAM,GAAG,SAAS,CAWpB;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,kBAAkB,GACzB,MAAM,CAiDR;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAMlE;AAED,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,UAAU,GACjB,MAAM,EAAE,CAaV;AAED,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,4BAA4B,EAC1C,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,GACV,MAAM,EAAE,CAWV;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,EAAE,CAI3E"}

package/dist/assessmentProjection.js

@@ -113,9 +113,9 @@ export function formatAssessmentHeadline(assessment, status) {
         const headline = copy.toolingPatchHeadline.replace("{package}", primaryPkg);
         return applyPostureVocabularyGuardHeadline(headline, status, primaryPkg);
     }
-    if (assessment.primaryConcern === "confirmed_runtime_usage") {
+    if (assessment.primaryConcern === "unresolved_runtime_exposure") {
         const surface = surfaceHintFromAssessment(assessment);
-        const headline = copy.runtimeUpgradeHeadline
+        const headline = copy.unresolvedRuntimeExposureHeadline
             .replace("{package}", primaryPkg)
             .replace("{surface}", surface);
         return applyPostureVocabularyGuardHeadline(headline, status, primaryPkg);

package/dist/deriveScanNarrative.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deriveScanNarrative.d.ts","sourceRoot":"","sources":["../src/deriveScanNarrative.ts"],"names":[],"mappings":"AAYA,OAAO,EAgBL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAMV,UAAU,EACX,MAAM,YAAY,CAAC;AAwiBpB;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACpC,kBAAkB,CAsIpB"}
+{"version":3,"file":"deriveScanNarrative.d.ts","sourceRoot":"","sources":["../src/deriveScanNarrative.ts"],"names":[],"mappings":"AAYA,OAAO,EAgBL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAMV,UAAU,EACX,MAAM,YAAY,CAAC;AAwiBpB;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACpC,kBAAkB,CAsIpB"}

package/dist/deriveScanNarrative.js

@@ -5,6 +5,7 @@ import { isRuntimeNarrativeSafe } from "./repoIntelligenceSemantics.js";
 import { deriveRiskSignals } from "./riskSignals.js";
 import { EMPTY_SCAN_NARRATIVE_FACTS, NARRATIVE_FACT_MAX_AREAS, NARRATIVE_FACT_MAX_HOTSPOTS, NARRATIVE_FACT_MAX_PATHS, } from "./scanNarrativeFacts.js";
 import { mergePostureFromDecision } from "./riskVocabulary.js";
+import { hasPreparationUncertaintyWarnings } from "./lockfileEvidence.js";
 import { selectTopAffectedAreas } from "./selectTopAffectedAreas.js";
 function parseChangedPackages(changed) {
     const all = Array.isArray(changed)
@@ -407,7 +408,7 @@ function assessmentConfidenceFromResult(result) {
 }
 function limitedContextDiagnostic(input) {
     return (input.corpusGateReason !== "ok" ||
-        input.preparationWarnings.length > 0 ||
+        hasPreparationUncertaintyWarnings(input.preparationWarnings) ||
         input.assessmentConfidence === "low");
 }
 /**

package/dist/fixtures/assessmentFixtures.d.ts

@@ -1,4 +1,4 @@
-import type { Assessment } from "@mergesignal/contracts";
+import type { Assessment } from "../assessment/types.js";
 export declare const assessmentTypescriptPatch: Assessment;
 export declare const assessmentEslint: Assessment;
 export declare const assessmentPrettier: Assessment;

package/dist/fixtures/assessmentFixtures.js

@@ -57,16 +57,16 @@ export const assessmentVitest = withAssessmentScope({
 export const assessmentFastifyRuntime = withAssessmentScope({
     posture: "needs_review",
     confidence: "medium",
-    primaryConcern: "confirmed_runtime_usage",
+    primaryConcern: "unresolved_runtime_exposure",
     concerns: [
         {
-            kind: "confirmed_runtime_usage",
+            kind: "unresolved_runtime_exposure",
             rank: 1,
             packages: ["fastify"],
             evidenceRefs: ["fixture:fastify"],
         },
     ],
-    factors: ["confirmed_runtime_usage", "http_framework_infrastructure"],
+    factors: ["unresolved_runtime_exposure", "http_framework_infrastructure"],
     changeClasses: ["runtime_upgrade"],
     presentation: runtimeReviewPresentation,
 }, {
@@ -77,17 +77,17 @@ export const assessmentFastifyRuntime = withAssessmentScope({
 export const assessmentBullmq = withAssessmentScope({
     posture: "needs_review",
     confidence: "medium",
-    primaryConcern: "confirmed_runtime_usage",
+    primaryConcern: "unresolved_runtime_exposure",
     concerns: [
         {
-            kind: "confirmed_runtime_usage",
+            kind: "unresolved_runtime_exposure",
             rank: 1,
             packages: ["bullmq"],
             evidenceRefs: ["fixture:bullmq"],
         },
     ],
     factors: [
-        "confirmed_runtime_usage",
+        "unresolved_runtime_exposure",
         "queue_infrastructure",
         "verification_required",
     ],
@@ -101,16 +101,16 @@ export const assessmentBullmq = withAssessmentScope({
 export const assessmentNextAuth = withAssessmentScope({
     posture: "needs_review",
     confidence: "medium",
-    primaryConcern: "confirmed_runtime_usage",
+    primaryConcern: "unresolved_runtime_exposure",
     concerns: [
         {
-            kind: "confirmed_runtime_usage",
+            kind: "unresolved_runtime_exposure",
             rank: 1,
             packages: ["next-auth"],
             evidenceRefs: ["fixture:nextauth"],
         },
     ],
-    factors: ["confirmed_runtime_usage", "auth_infrastructure"],
+    factors: ["unresolved_runtime_exposure", "auth_infrastructure"],
     changeClasses: ["runtime_upgrade"],
     presentation: runtimeReviewPresentation,
 }, {
@@ -122,17 +122,17 @@ export const assessmentNextAuth = withAssessmentScope({
 export const assessmentMixedTypescriptFastify = withAssessmentScope({
     posture: "needs_review",
     confidence: "medium",
-    primaryConcern: "confirmed_runtime_usage",
+    primaryConcern: "unresolved_runtime_exposure",
     concerns: [
         {
-            kind: "confirmed_runtime_usage",
+            kind: "unresolved_runtime_exposure",
             rank: 1,
             packages: ["fastify"],
             evidenceRefs: ["fixture:fastify"],
         },
     ],
     factors: [
-        "confirmed_runtime_usage",
+        "unresolved_runtime_exposure",
         "queue_infrastructure",
         "http_framework_infrastructure",
     ],

package/dist/fixtures/assessmentScopeFixtures.d.ts

@@ -1,4 +1,4 @@
-import type { ArtifactGroundedVerificationScope, Assessment, FocalElectionDimension, ReachScope, ReviewEpisodeShape, ReviewFocalPoint, VerificationScope } from "@mergesignal/contracts";
+import type { ArtifactGroundedVerificationScope, Assessment, FocalElectionDimension, ReachScope, ReviewEpisodeShape, ReviewFocalPoint, VerificationScope } from "../assessment/types.js";
 export declare function minimalReviewFocalPoint(anchors: string[], opts?: {
     episodeShape?: ReviewEpisodeShape;
     supportingPackages?: string[];

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 export * from "./types.js";
+export * from "./assessment/index.js";
+export * from "./lockfileEvidence.js";
 export * from "./assessmentLabels.js";
 export * from "./assessmentProjection.js";
 export * from "./riskVocabulary.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,0BAA0B,CAAC;AACzC,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,OAAO,EAAE,wCAAwC,EAAE,MAAM,6BAA6B,CAAC;AACvF,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,cAAc,EACd,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,0BAA0B,CAAC;AACzC,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,OAAO,EAAE,wCAAwC,EAAE,MAAM,6BAA6B,CAAC;AACvF,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,cAAc,EACd,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -1,4 +1,6 @@
 export * from "./types.js";
+export * from "./assessment/index.js";
+export * from "./lockfileEvidence.js";
 export * from "./assessmentLabels.js";
 export * from "./assessmentProjection.js";
 export * from "./riskVocabulary.js";

package/dist/lockfileEvidence.d.ts

@@ -0,0 +1,22 @@
+import type { AnalysisContextWarning } from "./types.js";
+/** Authoritative lockfile comparison outcome from Scan Preparation. */
+export type LockfileEvidenceStatus = {
+    kind: "not_applicable";
+} | {
+    kind: "verified";
+    delta: "empty" | "changed";
+} | {
+    kind: "unavailable";
+    reason: "incomplete_parse" | "missing_head" | "missing_base" | "manager_mismatch" | "comparison_failed";
+};
+/** Lockfile warnings that limit evidence confidence for merge decisions. */
+export declare const LOCKFILE_UNCERTAINTY_WARNING_CODES: readonly ["lockfile_evidence_incomplete", "lockfile_head_missing", "base_lockfile_missing", "lockfile_diff_skipped", "lockfile_diff_failed"];
+export type LockfileUncertaintyWarningCode = (typeof LOCKFILE_UNCERTAINTY_WARNING_CODES)[number];
+/** Preparation warnings that limit scan context confidence (excludes informational events). */
+export declare const PREPARATION_UNCERTAINTY_WARNING_CODES: readonly ["lockfile_evidence_incomplete", "lockfile_head_missing", "base_lockfile_missing", "lockfile_diff_skipped", "lockfile_diff_failed", "code_fetch_failed", "code_fetch_auth_failure", "code_fetch_timeout", "code_fetch_rate_limit", "code_corpus_empty", "repo_intelligence_contract_invalid"];
+export type PreparationUncertaintyWarningCode = (typeof PREPARATION_UNCERTAINTY_WARNING_CODES)[number];
+export declare function isLockfileUncertaintyWarningCode(code: string): code is LockfileUncertaintyWarningCode;
+export declare function isPreparationUncertaintyWarning(warning: AnalysisContextWarning): boolean;
+export declare function hasLockfileUncertaintyWarnings(warnings: readonly AnalysisContextWarning[]): boolean;
+export declare function hasPreparationUncertaintyWarnings(warnings: readonly AnalysisContextWarning[]): boolean;
+//# sourceMappingURL=lockfileEvidence.d.ts.map