@mergesignal/shared 0.2.8 → 0.3.0

package/dist/deriveScanNarrative.d.ts

@@ -1,10 +1,7 @@
-import { normalizeReachabilityKind, normalizeRuntimeSurfaceKind } from "./repoIntelligenceSchema.js";
 import { type ScanNarrativeFacts } from "./scanNarrativeFacts.js";
 import type { ScanResult } from "./types.js";
 /**
  * Consumer-agnostic scan intelligence — structured facts only (no UI copy).
  */
 export declare function deriveScanNarrative(result: ScanResult | null | undefined): ScanNarrativeFacts;
-/** @internal Test helper — normalize loose engine strings. */
-export { normalizeReachabilityKind, normalizeRuntimeSurfaceKind };
 //# sourceMappingURL=deriveScanNarrative.d.ts.map

package/dist/deriveScanNarrative.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deriveScanNarrative.d.ts","sourceRoot":"","sources":["../src/deriveScanNarrative.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAM5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAYL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAKV,UAAU,EACX,MAAM,YAAY,CAAC;AAkZpB;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACpC,kBAAkB,CAiGpB;AAED,8DAA8D;AAC9D,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,CAAC"}
+{"version":3,"file":"deriveScanNarrative.d.ts","sourceRoot":"","sources":["../src/deriveScanNarrative.ts"],"names":[],"mappings":"AAMA,OAAO,EAaL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAKV,UAAU,EACX,MAAM,YAAY,CAAC;AAgapB;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACpC,kBAAkB,CAsGpB"}

package/dist/deriveScanNarrative.js

@@ -1,5 +1,5 @@
 import { extractRepositoryContextFacts } from "./extractRepositoryContextFacts.js";
-import { normalizeReachabilityKind, normalizeRuntimeSurfaceKind, parseRepoIntelligence, readBlastLevel, readReachabilityFromLoose, readSurfaceFromLoose, } from "./repoIntelligenceSchema.js";
+import { readBlastLevel, safeParseRepoIntelligence, } from "./repoIntelligenceSchema.js";
 import { EMPTY_SCAN_NARRATIVE_FACTS, NARRATIVE_FACT_MAX_AREAS, NARRATIVE_FACT_MAX_HOTSPOTS, NARRATIVE_FACT_MAX_PATHS, } from "./scanNarrativeFacts.js";
 import { mergePostureFromDecision } from "./riskVocabulary.js";
 import { selectTopAffectedAreas } from "./selectTopAffectedAreas.js";
@@ -32,10 +32,6 @@ function uniqueStrings(values) {
     }
     return out;
 }
-function usageEntryPackageName(entry) {
-    const name = (entry.packageName ?? entry.package ?? "").trim();
-    return name || null;
-}
 function collectPackageUsageForChanged(ri, changed) {
     const byPackage = new Map();
     const ensure = (packageName) => {
@@ -53,8 +49,8 @@ function collectPackageUsageForChanged(ri, changed) {
         return row;
     };
     const mergeEntry = (entry, packageNameOverride) => {
-        const name = packageNameOverride ?? usageEntryPackageName(entry);
-        if (!name || !changed.all.includes(name))
+        const name = packageNameOverride ?? entry.packageName.trim();
+        if (!changed.all.includes(name))
             return;
         const row = ensure(name);
         row.paths = uniqueStrings([...row.paths, ...(entry.paths ?? [])]);
@@ -69,8 +65,6 @@ function collectPackageUsageForChanged(ri, changed) {
         const pkgIntel = ri.packages?.[name];
         if (pkgIntel?.usage)
             mergeEntry(pkgIntel.usage, name);
-        if (pkgIntel?.packageUsage)
-            mergeEntry(pkgIntel.packageUsage, name);
         if (pkgIntel?.areas?.length) {
             const row = ensure(name);
             row.areas = uniqueStrings([...row.areas, ...pkgIntel.areas]);
@@ -98,7 +92,7 @@ function collectFrameworks(ri) {
 function collectCodeHotspots(ri, primary) {
     const hotspots = [];
     const pkgIntel = primary && ri.packages?.[primary] ? ri.packages[primary] : undefined;
-    const riHotspots = ri.hotspots ?? pkgIntel?.hotspots ?? [];
+    const riHotspots = ri.hotspots ?? [];
     for (const h of riHotspots) {
         const name = (h.packageName ?? primary ?? "").trim();
         if (!name)
@@ -136,10 +130,8 @@ function extractTier1FromRepoIntelligence(ri, changed) {
     const packageUsage = collectPackageUsageForChanged(ri, changed);
     const frameworks = collectFrameworks(ri);
     const paths = allUsagePaths(packageUsage);
-    const runtimeRaw = pkgIntel?.runtimeSurface ?? ri.runtimeSurface ?? undefined;
-    const reachRaw = pkgIntel?.reachability ?? ri.reachability ?? undefined;
-    const runtimeKind = readSurfaceFromLoose(runtimeRaw) ?? (primary ? "unknown" : null);
-    const reachKind = readReachabilityFromLoose(reachRaw);
+    const runtimeKind = pkgIntel?.runtimeSurface ?? null;
+    const reachKind = pkgIntel?.reachability ?? null;
     const runtimeSurface = runtimeKind != null
         ? {
             kind: runtimeKind,
@@ -291,6 +283,24 @@ function blastRadiusFromChangedCount(count) {
         factors: [],
     };
 }
+function resolveTrustedRepoIntelligence(result) {
+    const raw = result.repoIntelligence;
+    const validationStatus = result.analysisPreparation?.repoIntelligenceValidation?.status;
+    if (raw == null) {
+        return { parsed: null, parseStatus: "absent" };
+    }
+    if (validationStatus === "invalid") {
+        return { parsed: null, parseStatus: "untrusted" };
+    }
+    if (validationStatus !== "valid") {
+        return { parsed: null, parseStatus: "absent" };
+    }
+    const parsed = safeParseRepoIntelligence(raw);
+    if (parsed.ok) {
+        return { parsed: parsed.value, parseStatus: "ok" };
+    }
+    return { parsed: null, parseStatus: "invalid" };
+}
 /**
  * Consumer-agnostic scan intelligence — structured facts only (no UI copy).
  */
@@ -304,8 +314,10 @@ export function deriveScanNarrative(result) {
         ? result.totalScore
         : null;
     const codeIntelligenceAvailable = result.analysisPreparation?.codeIntelligenceAvailable !== false;
-    const parsedRi = parseRepoIntelligence(result.repoIntelligence);
-    const corpusGate = codeIntelligenceAvailable && parsedRi != null;
+    const { parsed: parsedRi, parseStatus: repoIntelligenceParse } = resolveTrustedRepoIntelligence(result);
+    const corpusGate = codeIntelligenceAvailable &&
+        repoIntelligenceParse === "ok" &&
+        parsedRi != null;
     let tier1Blocks = emptyTier1Blocks();
     if (corpusGate && parsedRi) {
         tier1Blocks = extractTier1FromRepoIntelligence(parsedRi, changedPackages);
@@ -350,6 +362,7 @@ export function deriveScanNarrative(result) {
                 tier2: reviewerGuidance.length > 0,
                 tier3,
             },
+            repoIntelligenceParse,
         },
         changedPackages,
         packageUsage: tier1Blocks.packageUsage,
@@ -366,5 +379,3 @@ export function deriveScanNarrative(result) {
         riskIndex,
     };
 }
-/** @internal Test helper — normalize loose engine strings. */
-export { normalizeReachabilityKind, normalizeRuntimeSurfaceKind };

package/dist/deriveScanNarrative.test.js

@@ -1,6 +1,8 @@
 import { describe, expect, it } from "vitest";
 import { deriveScanNarrative } from "./deriveScanNarrative.js";
-import { fixtureRepoIntelligenceEmpty, fixtureRepoIntelligenceFastify, fixtureRepoIntelligenceMultiPackage, fixtureRepoIntelligenceTypescript, } from "./fixtures/repoIntelligenceFixtures.js";
+import { legacyEngineRepoIntelligenceJwt } from "./fixtures/legacyEngineRepoIntelligence.js";
+import { fixtureRepoIntelligenceFastify, fixtureRepoIntelligenceMultiPackage, fixtureRepoIntelligenceTypescript, } from "./fixtures/repoIntelligenceFixtures.js";
+import { analysisPreparationWithInvalidRepoIntel, analysisPreparationWithValidRepoIntel, } from "./fixtures/repoIntelligenceTestHelpers.js";
 const baseResult = {
     totalScore: 10,
     layerScores: {
@@ -18,15 +20,42 @@ describe("deriveScanNarrative", () => {
         expect(facts.availability.mode).toBe("denormalized");
         expect(facts.changedPackages.all).toEqual([]);
     });
+    it("ignores repoIntelligence when validation status is not valid", () => {
+        const result = {
+            ...baseResult,
+            changedPackages: ["fastify"],
+            analysisPreparation: {
+                codeIntelligenceAvailable: true,
+                warnings: [],
+            },
+            repoIntelligence: fixtureRepoIntelligenceFastify,
+        };
+        const facts = deriveScanNarrative(result);
+        expect(facts.availability.repoIntelligenceParse).toBe("absent");
+        expect(facts.availability.tiersPresent.tier1).toBe(false);
+    });
+    it("treats worker-invalid repoIntelligence as untrusted (raw retained, not consumed)", () => {
+        const result = {
+            ...baseResult,
+            changedPackages: ["jsonwebtoken"],
+            analysisPreparation: analysisPreparationWithInvalidRepoIntel(),
+            repoIntelligence: legacyEngineRepoIntelligenceJwt,
+        };
+        const facts = deriveScanNarrative(result);
+        expect(facts.availability.repoIntelligenceParse).toBe("untrusted");
+        expect(facts.availability.tiersPresent.tier1).toBe(false);
+        expect(facts.packageUsage).toHaveLength(0);
+    });
     it("populates tier1 from repoIntelligence when corpus available", () => {
         const result = {
             ...baseResult,
             changedPackages: ["fastify"],
-            analysisPreparation: { codeIntelligenceAvailable: true, warnings: [] },
+            analysisPreparation: analysisPreparationWithValidRepoIntel(),
             repoIntelligence: fixtureRepoIntelligenceFastify,
         };
         const facts = deriveScanNarrative(result);
         expect(facts.availability.mode).toBe("pr_intelligence");
+        expect(facts.availability.repoIntelligenceParse).toBe("ok");
         expect(facts.availability.codeIntelligenceAvailable).toBe(true);
         expect(facts.changedPackages.primary).toBe("fastify");
         expect(facts.runtimeSurface?.kind).toBe("runtime");
@@ -87,7 +116,7 @@ describe("deriveScanNarrative", () => {
         const result = {
             ...baseResult,
             changedPackages: ["typescript"],
-            analysisPreparation: { codeIntelligenceAvailable: true, warnings: [] },
+            analysisPreparation: analysisPreparationWithValidRepoIntel(),
             repoIntelligence: fixtureRepoIntelligenceTypescript,
         };
         const facts = deriveScanNarrative(result);
@@ -100,7 +129,7 @@ describe("deriveScanNarrative", () => {
         const result = {
             ...baseResult,
             changedPackages: ["lodash", "axios"],
-            analysisPreparation: { codeIntelligenceAvailable: true, warnings: [] },
+            analysisPreparation: analysisPreparationWithValidRepoIntel(),
             repoIntelligence: fixtureRepoIntelligenceMultiPackage,
         };
         const facts = deriveScanNarrative(result);
@@ -124,7 +153,7 @@ describe("deriveScanNarrative", () => {
         const result = {
             ...baseResult,
             changedPackages: ["fastify"],
-            analysisPreparation: { codeIntelligenceAvailable: true, warnings: [] },
+            analysisPreparation: analysisPreparationWithValidRepoIntel(),
             repoIntelligence: fixtureRepoIntelligenceFastify,
             graphInsights: {
                 maxDepth: 3,
@@ -151,14 +180,14 @@ describe("deriveScanNarrative", () => {
         expect(facts.hotspots.map((h) => h.packageName)).toContain("transitive-only-pkg");
         expect(facts.hotspots.filter((h) => h.packageName === "fastify")).toHaveLength(1);
     });
-    it("treats empty packages-only repoIntelligence as absent", () => {
+    it("does not tier1 when repoIntelligence block is omitted", () => {
         const result = {
             ...baseResult,
             changedPackages: ["react"],
-            analysisPreparation: { codeIntelligenceAvailable: true, warnings: [] },
-            repoIntelligence: fixtureRepoIntelligenceEmpty,
+            analysisPreparation: analysisPreparationWithValidRepoIntel(),
         };
         const facts = deriveScanNarrative(result);
+        expect(facts.availability.repoIntelligenceParse).toBe("absent");
         expect(facts.availability.tiersPresent.tier1).toBe(false);
     });
 });

package/dist/engineWireRegression.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=engineWireRegression.test.d.ts.map

package/dist/engineWireRegression.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engineWireRegression.test.d.ts","sourceRoot":"","sources":["../src/engineWireRegression.test.ts"],"names":[],"mappings":""}

package/dist/engineWireRegression.test.js

@@ -0,0 +1,57 @@
+import { describe, expect, it } from "vitest";
+import { deriveScanCardSummary } from "./scanCardSummary.js";
+import { deriveScanNarrative } from "./deriveScanNarrative.js";
+import { fixtureRepoIntelligenceFastify, fixtureRepoIntelligenceMultiPackage, } from "./fixtures/repoIntelligenceFixtures.js";
+import { validateRepoIntelligenceWire } from "./repoIntelligenceSchema.js";
+const baseScan = {
+    totalScore: 55,
+    layerScores: {
+        security: 10,
+        maintainability: 20,
+        ecosystem: 30,
+        upgradeImpact: 15,
+    },
+    findings: [],
+    generatedAt: "2026-01-01T00:00:00.000Z",
+    analysisPreparation: {
+        codeIntelligenceAvailable: true,
+        warnings: [],
+        repoIntelligenceValidation: {
+            status: "valid",
+            abi: "1",
+            validatedAt: "2026-01-01T00:00:00.000Z",
+        },
+    },
+};
+describe("engine wire regression (canonical fixtures)", () => {
+    it("fastify fixture: parse → tier1 pr_intelligence → card usage lines", () => {
+        validateRepoIntelligenceWire(fixtureRepoIntelligenceFastify);
+        const result = {
+            ...baseScan,
+            changedPackages: ["fastify"],
+            repoIntelligence: fixtureRepoIntelligenceFastify,
+        };
+        const facts = deriveScanNarrative(result);
+        expect(facts.availability.tiersPresent.tier1).toBe(true);
+        expect(facts.availability.mode).toBe("pr_intelligence");
+        expect(facts.availability.repoIntelligenceParse).toBe("ok");
+        expect(facts.packageUsage[0]?.packageName).toBe("fastify");
+        const card = deriveScanCardSummary(result, "done");
+        expect(card.usageSummary).toBeTruthy();
+        expect(card.verificationLine).toBeTruthy();
+    });
+    it("multi-package fixture: both packages in packageUsage", () => {
+        validateRepoIntelligenceWire(fixtureRepoIntelligenceMultiPackage);
+        const result = {
+            ...baseScan,
+            changedPackages: ["lodash", "axios"],
+            repoIntelligence: fixtureRepoIntelligenceMultiPackage,
+        };
+        const facts = deriveScanNarrative(result);
+        expect(facts.availability.mode).toBe("pr_intelligence");
+        expect(facts.packageUsage.map((u) => u.packageName)).toEqual([
+            "lodash",
+            "axios",
+        ]);
+    });
+});

package/dist/fixtures/legacyEngineRepoIntelligence.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Pre-contract engine wire shape (Wave 1/2 drift). Used to assert strict schema rejection
+ * and narrative fallback while preserving raw payload for forensics.
+ */
+export declare const legacyEngineRepoIntelligenceJwt: {
+    readonly packageUsage: readonly [{
+        readonly name: "jsonwebtoken";
+        readonly files: readonly ["src/auth/auth.service.ts", "src/auth/login.controller.ts"];
+        readonly reachability: "moderate";
+        readonly runtimeSurface: "runtime";
+        readonly areas: readonly ["authentication"];
+        readonly blastRadius: "moderate";
+    }];
+    readonly hotspots: readonly [{
+        readonly file: "src/auth/auth.service.ts";
+        readonly fanIn: 2;
+        readonly areas: readonly ["authentication"];
+    }];
+    readonly frameworks: readonly [{
+        readonly framework: "express";
+        readonly roles: readonly ["middleware"];
+    }];
+    readonly blastRadius: {
+        readonly level: "large";
+        readonly factors: readonly ["reaches runtime application code"];
+    };
+};
+//# sourceMappingURL=legacyEngineRepoIntelligence.d.ts.map

package/dist/fixtures/legacyEngineRepoIntelligence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacyEngineRepoIntelligence.d.ts","sourceRoot":"","sources":["../../src/fixtures/legacyEngineRepoIntelligence.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;CAuBlC,CAAC"}

package/dist/fixtures/legacyEngineRepoIntelligence.js

@@ -0,0 +1,28 @@
+/**
+ * Pre-contract engine wire shape (Wave 1/2 drift). Used to assert strict schema rejection
+ * and narrative fallback while preserving raw payload for forensics.
+ */
+export const legacyEngineRepoIntelligenceJwt = {
+    packageUsage: [
+        {
+            name: "jsonwebtoken",
+            files: ["src/auth/auth.service.ts", "src/auth/login.controller.ts"],
+            reachability: "moderate",
+            runtimeSurface: "runtime",
+            areas: ["authentication"],
+            blastRadius: "moderate",
+        },
+    ],
+    hotspots: [
+        {
+            file: "src/auth/auth.service.ts",
+            fanIn: 2,
+            areas: ["authentication"],
+        },
+    ],
+    frameworks: [{ framework: "express", roles: ["middleware"] }],
+    blastRadius: {
+        level: "large",
+        factors: ["reaches runtime application code"],
+    },
+};

package/dist/fixtures/repoIntelligenceFixtures.d.ts

@@ -3,8 +3,6 @@ import type { RepoIntelligence } from "../repoIntelligenceSchema.js";
 export declare const fixtureRepoIntelligenceFastify: RepoIntelligence;
 /** Build-only toolchain change — no runtime paths. */
 export declare const fixtureRepoIntelligenceTypescript: RepoIntelligence;
-/** Empty corpus stub (engine-test-fixture default). */
-export declare const fixtureRepoIntelligenceEmpty: RepoIntelligence;
 /** Multi-package PR with distinct usage per package. */
 export declare const fixtureRepoIntelligenceMultiPackage: RepoIntelligence;
 //# sourceMappingURL=repoIntelligenceFixtures.d.ts.map

package/dist/fixtures/repoIntelligenceFixtures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repoIntelligenceFixtures.d.ts","sourceRoot":"","sources":["../../src/fixtures/repoIntelligenceFixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,iEAAiE;AACjE,eAAO,MAAM,8BAA8B,EAAE,gBA8B5C,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,iCAAiC,EAAE,gBAS/C,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,4BAA4B,EAAE,gBAE1C,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,mCAAmC,EAAE,gBA4CjD,CAAC"}
+{"version":3,"file":"repoIntelligenceFixtures.d.ts","sourceRoot":"","sources":["../../src/fixtures/repoIntelligenceFixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,iEAAiE;AACjE,eAAO,MAAM,8BAA8B,EAAE,gBAmC5C,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,iCAAiC,EAAE,gBAc/C,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,mCAAmC,EAAE,gBAgDjD,CAAC"}

package/dist/fixtures/repoIntelligenceFixtures.js

@@ -6,6 +6,11 @@ export const fixtureRepoIntelligenceFastify = {
             reachability: "on_runtime_paths",
             usage: {
                 packageName: "fastify",
+                files: [
+                    "apps/api/src/server.ts",
+                    "apps/api/src/routes/account.ts",
+                    "apps/api/src/middleware/auth.ts",
+                ],
                 paths: ["apps/api/src/server.ts", "apps/api/src/routes/account.ts"],
                 criticalPaths: ["apps/api/src/middleware/auth.ts"],
                 areas: ["API", "Auth middleware"],
@@ -36,15 +41,16 @@ export const fixtureRepoIntelligenceTypescript = {
         typescript: {
             runtimeSurface: "build",
             reachability: "build_only",
+            usage: {
+                packageName: "typescript",
+                files: ["tsconfig.json"],
+                paths: [],
+            },
         },
     },
     blastRadius: { level: "narrow", changedPackageCount: 1 },
     applicationAreas: [],
 };
-/** Empty corpus stub (engine-test-fixture default). */
-export const fixtureRepoIntelligenceEmpty = {
-    packages: {},
-};
 /** Multi-package PR with distinct usage per package. */
 export const fixtureRepoIntelligenceMultiPackage = {
     packages: {
@@ -53,6 +59,7 @@ export const fixtureRepoIntelligenceMultiPackage = {
             reachability: "on_runtime_paths",
             usage: {
                 packageName: "lodash",
+                files: ["apps/billing/export.ts"],
                 paths: ["apps/billing/export.ts"],
                 areas: ["Billing"],
             },
@@ -62,6 +69,7 @@ export const fixtureRepoIntelligenceMultiPackage = {
             reachability: "on_runtime_paths",
             usage: {
                 packageName: "axios",
+                files: ["apps/api/client.ts"],
                 paths: ["apps/api/client.ts"],
                 areas: ["API"],
             },
@@ -70,10 +78,12 @@ export const fixtureRepoIntelligenceMultiPackage = {
     packageUsage: [
         {
             packageName: "lodash",
+            files: ["apps/billing/export.ts"],
             paths: ["apps/billing/export.ts"],
         },
         {
             packageName: "axios",
+            files: ["apps/api/client.ts"],
             paths: ["apps/api/client.ts"],
         },
     ],

package/dist/fixtures/repoIntelligenceTestHelpers.d.ts

@@ -0,0 +1,5 @@
+import type { AnalysisPreparation } from "../types.js";
+/** Worker-shaped preparation for tests that consume trusted repoIntelligence. */
+export declare function analysisPreparationWithValidRepoIntel(over?: Partial<AnalysisPreparation>): AnalysisPreparation;
+export declare function analysisPreparationWithInvalidRepoIntel(over?: Partial<AnalysisPreparation>): AnalysisPreparation;
+//# sourceMappingURL=repoIntelligenceTestHelpers.d.ts.map

package/dist/fixtures/repoIntelligenceTestHelpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repoIntelligenceTestHelpers.d.ts","sourceRoot":"","sources":["../../src/fixtures/repoIntelligenceTestHelpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGvD,iFAAiF;AACjF,wBAAgB,qCAAqC,CACnD,IAAI,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAClC,mBAAmB,CAWrB;AAED,wBAAgB,uCAAuC,CACrD,IAAI,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAClC,mBAAmB,CAarB"}

package/dist/fixtures/repoIntelligenceTestHelpers.js

@@ -0,0 +1,28 @@
+import { REPO_INTELLIGENCE_ABI } from "../repoIntelligenceSchema.js";
+/** Worker-shaped preparation for tests that consume trusted repoIntelligence. */
+export function analysisPreparationWithValidRepoIntel(over) {
+    return {
+        codeIntelligenceAvailable: true,
+        warnings: [],
+        repoIntelligenceValidation: {
+            status: "valid",
+            abi: REPO_INTELLIGENCE_ABI,
+            validatedAt: "2026-01-01T00:00:00.000Z",
+        },
+        ...over,
+    };
+}
+export function analysisPreparationWithInvalidRepoIntel(over) {
+    return {
+        codeIntelligenceAvailable: true,
+        warnings: [],
+        repoIntelligenceValidation: {
+            status: "invalid",
+            abi: REPO_INTELLIGENCE_ABI,
+            issueCount: 1,
+            representativeIssues: ["packages: at least one package required"],
+            validatedAt: "2026-01-01T00:00:00.000Z",
+        },
+        ...over,
+    };
+}

package/dist/index.d.ts

@@ -13,6 +13,8 @@ export * from "./deriveCardOperationalObservations.js";
 export * from "./deriveCardDisplaySummary.js";
 export * from "./scanNarrativeFacts.js";
 export * from "./repoIntelligenceSchema.js";
+export * from "./repoIntelligenceMappers.js";
+export * from "./repoIntelligenceValidation.js";
 export * from "./deriveScanNarrative.js";
 export * from "./extractRepositoryContextFacts.js";
 export * from "./presentScanCardSummary.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sCAAsC,CAAC;AACrD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wCAAwC,CAAC;AACvD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,0BAA0B,CAAC;AACzC,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sCAAsC,CAAC;AACrD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -13,6 +13,8 @@ export * from "./deriveCardOperationalObservations.js";
 export * from "./deriveCardDisplaySummary.js";
 export * from "./scanNarrativeFacts.js";
 export * from "./repoIntelligenceSchema.js";
+export * from "./repoIntelligenceMappers.js";
+export * from "./repoIntelligenceValidation.js";
 export * from "./deriveScanNarrative.js";
 export * from "./extractRepositoryContextFacts.js";
 export * from "./presentScanCardSummary.js";

package/dist/narrativeParity.test.js

@@ -5,6 +5,7 @@ import { deriveScanCardSummary } from "./scanCardSummary.js";
 import { deriveScanDetailViewModel } from "./scanDetailViewModel.js";
 import { presentGitHubPrComment } from "./presentGitHubPrComment.js";
 import { fixtureRepoIntelligenceFastify } from "./fixtures/repoIntelligenceFixtures.js";
+import { analysisPreparationWithValidRepoIntel } from "./fixtures/repoIntelligenceTestHelpers.js";
 const ORIGIN = "https://app.example.com";
 const SCAN_ID = "22222222-2222-4222-8222-222222222222";
 describe("narrative parity across consumers", () => {
@@ -20,7 +21,7 @@ describe("narrative parity across consumers", () => {
             findings: [],
             generatedAt: "2026-01-01T00:00:00.000Z",
             changedPackages: ["fastify"],
-            analysisPreparation: { codeIntelligenceAvailable: true, warnings: [] },
+            analysisPreparation: analysisPreparationWithValidRepoIntel(),
             repoIntelligence: fixtureRepoIntelligenceFastify,
             decision: {
                 recommendation: "needs_review",

package/dist/narrativePresentation.test.js

@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vitest";
 import { deriveScanNarrative } from "./deriveScanNarrative.js";
 import { fixtureRepoIntelligenceFastify } from "./fixtures/repoIntelligenceFixtures.js";
+import { analysisPreparationWithValidRepoIntel } from "./fixtures/repoIntelligenceTestHelpers.js";
 import { composeVerificationPrompt, formatChangedPackagesShort, formatUsageSummaryLine, summarizePackageUsage, } from "./narrativePresentation.js";
 const baseResult = {
     totalScore: 10,
@@ -25,7 +26,7 @@ describe("narrativePresentation", () => {
         const facts = deriveScanNarrative({
             ...baseResult,
             changedPackages: ["fastify"],
-            analysisPreparation: { codeIntelligenceAvailable: true, warnings: [] },
+            analysisPreparation: analysisPreparationWithValidRepoIntel(),
             repoIntelligence: fixtureRepoIntelligenceFastify,
         });
         const usage = summarizePackageUsage(facts);

package/dist/repoIntelligenceMappers.d.ts

@@ -0,0 +1,20 @@
+import type { BlastRadiusLevel, ReachabilityKind, RuntimeSurfaceKind } from "./scanNarrativeFacts.js";
+/** Engine-internal blast radius vocabulary → canonical wire. */
+export type EngineBlastRadiusLevel = "small" | "moderate" | "large";
+/** Engine-internal reachability spread buckets. */
+export type EngineReachabilityBucket = "very_low" | "low" | "moderate" | "high";
+/** Engine-internal runtime surface labels. */
+export type EngineRuntimeSurface = "runtime" | "test" | "build" | "dev" | "ci";
+export declare function mapBlastRadiusLevel(level: EngineBlastRadiusLevel): BlastRadiusLevel;
+export declare function mapRuntimeSurfaceKind(surface: EngineRuntimeSurface): RuntimeSurfaceKind;
+/**
+ * Maps engine reachability spread + runtime classification to narrative reachability kind.
+ * Documented in repoIntelligenceSchema.ts header.
+ */
+export declare function mapReachabilityKind(input: {
+    bucket: EngineReachabilityBucket;
+    reachesRuntime: boolean;
+    dominantSurface: EngineRuntimeSurface;
+}): ReachabilityKind;
+export declare function areaSlugToLabel(slug: string): string;
+//# sourceMappingURL=repoIntelligenceMappers.d.ts.map

package/dist/repoIntelligenceMappers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repoIntelligenceMappers.d.ts","sourceRoot":"","sources":["../src/repoIntelligenceMappers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AAEjC,gEAAgE;AAChE,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAEpE,mDAAmD;AACnD,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;AAEhF,8CAA8C;AAC9C,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC;AAE/E,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,sBAAsB,GAC5B,gBAAgB,CAalB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,GAC5B,kBAAkB,CAapB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,MAAM,EAAE,wBAAwB,CAAC;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,oBAAoB,CAAC;CACvC,GAAG,gBAAgB,CAwBnB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKpD"}

package/dist/repoIntelligenceMappers.js

@@ -0,0 +1,60 @@
+export function mapBlastRadiusLevel(level) {
+    switch (level) {
+        case "small":
+            return "narrow";
+        case "moderate":
+            return "moderate";
+        case "large":
+            return "wide";
+        default: {
+            const x = level;
+            return x;
+        }
+    }
+}
+export function mapRuntimeSurfaceKind(surface) {
+    switch (surface) {
+        case "runtime":
+            return "runtime";
+        case "test":
+            return "test";
+        case "build":
+        case "dev":
+        case "ci":
+            return "build";
+        default:
+            return "unknown";
+    }
+}
+/**
+ * Maps engine reachability spread + runtime classification to narrative reachability kind.
+ * Documented in repoIntelligenceSchema.ts header.
+ */
+export function mapReachabilityKind(input) {
+    const { bucket, reachesRuntime, dominantSurface } = input;
+    if (dominantSurface === "test" && !reachesRuntime) {
+        return "test_only";
+    }
+    if ((dominantSurface === "build" ||
+        dominantSurface === "dev" ||
+        dominantSurface === "ci") &&
+        !reachesRuntime) {
+        return "build_only";
+    }
+    if (reachesRuntime) {
+        return "on_runtime_paths";
+    }
+    if (bucket === "very_low" || bucket === "low") {
+        return "unreachable";
+    }
+    if (bucket === "moderate" || bucket === "high") {
+        return "on_runtime_paths";
+    }
+    return "unknown";
+}
+export function areaSlugToLabel(slug) {
+    return slug
+        .split("_")
+        .map((w) => (w ? w[0].toUpperCase() + w.slice(1) : w))
+        .join(" ");
+}

package/dist/repoIntelligenceSchema.contract.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=repoIntelligenceSchema.contract.test.d.ts.map

package/dist/repoIntelligenceSchema.contract.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repoIntelligenceSchema.contract.test.d.ts","sourceRoot":"","sources":["../src/repoIntelligenceSchema.contract.test.ts"],"names":[],"mappings":""}

package/dist/repoIntelligenceSchema.contract.test.js

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+import { fixtureRepoIntelligenceFastify, fixtureRepoIntelligenceMultiPackage, } from "./fixtures/repoIntelligenceFixtures.js";
+import { legacyEngineRepoIntelligenceJwt } from "./fixtures/legacyEngineRepoIntelligence.js";
+import { safeParseRepoIntelligence, validateRepoIntelligenceWire, } from "./repoIntelligenceSchema.js";
+describe("repoIntelligenceWireSchema contract", () => {
+    it("accepts canonical consumer fixtures", () => {
+        expect(() => validateRepoIntelligenceWire(fixtureRepoIntelligenceFastify)).not.toThrow();
+        expect(() => validateRepoIntelligenceWire(fixtureRepoIntelligenceMultiPackage)).not.toThrow();
+    });
+    it("rejects legacy engine wire (name, large blast, object frameworks, file hotspots)", () => {
+        const r = safeParseRepoIntelligence(legacyEngineRepoIntelligenceJwt);
+        expect(r.ok).toBe(false);
+        if (r.ok)
+            return;
+        expect(r.issueCount).toBeGreaterThan(0);
+        const joined = r.issues.join(" ");
+        expect(joined.length).toBeGreaterThan(0);
+    });
+});