@mergesignal/shared 0.3.0 → 0.4.1

package/dist/repoIntelligenceMappers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repoIntelligenceMappers.d.ts","sourceRoot":"","sources":["../src/repoIntelligenceMappers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AAEjC,gEAAgE;AAChE,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAEpE,mDAAmD;AACnD,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;AAEhF,8CAA8C;AAC9C,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC;AAE/E,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,sBAAsB,GAC5B,gBAAgB,CAalB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,GAC5B,kBAAkB,CAapB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,MAAM,EAAE,wBAAwB,CAAC;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,oBAAoB,CAAC;CACvC,GAAG,gBAAgB,CAwBnB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKpD"}
+{"version":3,"file":"repoIntelligenceMappers.d.ts","sourceRoot":"","sources":["../src/repoIntelligenceMappers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AAEjC,gEAAgE;AAChE,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAEpE,mDAAmD;AACnD,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;AAEhF,8CAA8C;AAC9C,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC;AAE/E,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,sBAAsB,GAC5B,gBAAgB,CAalB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,GAC5B,kBAAkB,CAapB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,MAAM,EAAE,wBAAwB,CAAC;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,oBAAoB,CAAC;CACvC,GAAG,gBAAgB,CAgCnB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKpD"}

package/dist/repoIntelligenceMappers.js

@@ -48,7 +48,14 @@ export function mapReachabilityKind(input) {
         return "unreachable";
     }
     if (bucket === "moderate" || bucket === "high") {
-        return "on_runtime_paths";
+        if (dominantSurface === "test")
+            return "test_only";
+        if (dominantSurface === "build" ||
+            dominantSurface === "dev" ||
+            dominantSurface === "ci") {
+            return "build_only";
+        }
+        return "unknown";
     }
     return "unknown";
 }

package/dist/repoIntelligenceSchema.d.ts

@@ -9,7 +9,7 @@ import { z } from "zod";
 import type { ScanResult } from "./types.js";
 import type { BlastRadiusLevel } from "./scanNarrativeFacts.js";
 /** Bump when wire schema changes incompatibly. */
-export declare const REPO_INTELLIGENCE_ABI: "1";
+export declare const REPO_INTELLIGENCE_ABI: "2";
 /** Strict canonical wire schema — single source of truth. */
 export declare const repoIntelligenceWireSchema: z.ZodObject<{
     packages: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -34,6 +34,73 @@ export declare const repoIntelligenceWireSchema: z.ZodObject<{
             areas: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>;
         areas: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        dependencyClass: z.ZodOptional<z.ZodEnum<{
+            unknown: "unknown";
+            runtime: "runtime";
+            build: "build";
+            test: "test";
+            format: "format";
+            tooling: "tooling";
+            lint: "lint";
+            ci: "ci";
+        }>>;
+        packageRole: z.ZodOptional<z.ZodEnum<{
+            unknown: "unknown";
+            typechecker: "typechecker";
+            compiler: "compiler";
+            bundler: "bundler";
+            linter: "linter";
+            formatter: "formatter";
+            test_runner: "test_runner";
+            http_framework: "http_framework";
+            auth: "auth";
+            queue: "queue";
+            orm: "orm";
+        }>>;
+        lockfileKind: z.ZodOptional<z.ZodEnum<{
+            unknown: "unknown";
+            optional: "optional";
+            production: "production";
+            development: "development";
+        }>>;
+        runtimeImpact: z.ZodOptional<z.ZodEnum<{
+            unknown: "unknown";
+            confirmed: "confirmed";
+            none: "none";
+            possible: "possible";
+        }>>;
+        expectedImpact: z.ZodOptional<z.ZodEnum<{
+            unknown: "unknown";
+            runtime: "runtime";
+            build_time: "build_time";
+            typecheck: "typecheck";
+            test_time: "test_time";
+            development_only: "development_only";
+        }>>;
+        evidenceStrength: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>;
+        confidenceReason: z.ZodOptional<z.ZodString>;
+        verificationFocus: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        suppressRuntimeNarrative: z.ZodOptional<z.ZodBoolean>;
+        classificationProvenance: z.ZodOptional<z.ZodObject<{
+            dependencyClass: z.ZodEnum<{
+                unknown: "unknown";
+                graph: "graph";
+                registry: "registry";
+                lockfile: "lockfile";
+                heuristic: "heuristic";
+            }>;
+            packageRole: z.ZodEnum<{
+                unknown: "unknown";
+                graph: "graph";
+                registry: "registry";
+                heuristic: "heuristic";
+            }>;
+            registryEntryId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     packageUsage: z.ZodOptional<z.ZodArray<z.ZodObject<{
         packageName: z.ZodString;
@@ -69,6 +136,13 @@ export declare const repoIntelligenceWireSchema: z.ZodObject<{
         paths: z.ZodArray<z.ZodString>;
     }, z.core.$strip>>>;
     frameworks: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    semanticDiagnostics: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        packageName: z.ZodString;
+        ruleId: z.ZodString;
+        before: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        after: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        reason: z.ZodString;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
 export type RepoIntelligence = z.infer<typeof repoIntelligenceWireSchema>;
 export type ParseRepoIntelligenceSuccess = {

package/dist/repoIntelligenceSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repoIntelligenceSchema.d.ts","sourceRoot":"","sources":["../src/repoIntelligenceSchema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,kDAAkD;AAClD,eAAO,MAAM,qBAAqB,EAAG,GAAY,CAAC;AA+ClD,6DAA6D;AAC7D,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQrC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE1E,MAAM,MAAM,4BAA4B,GAAG;IACzC,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GACnC,4BAA4B,GAC5B,4BAA4B,CAAC;AAQjC,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAUlE;AAED,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,OAAO,GACX,2BAA2B,CAyC7B;AAED,uEAAuE;AACvE,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAM3E;AAED,mFAAmF;AACnF,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,UAAU,GACf,IAAI,CAGN;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,gBAAgB,GAAG,SAAS,GAClC,gBAAgB,GAAG,IAAI,CAKzB"}
+{"version":3,"file":"repoIntelligenceSchema.d.ts","sourceRoot":"","sources":["../src/repoIntelligenceSchema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,kDAAkD;AAClD,eAAO,MAAM,qBAAqB,EAAG,GAAY,CAAC;AA+HlD,6DAA6D;AAC7D,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBASrC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE1E,MAAM,MAAM,4BAA4B,GAAG;IACzC,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,gBAAgB,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GACnC,4BAA4B,GAC5B,4BAA4B,CAAC;AAQjC,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAUlE;AAED,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,OAAO,GACX,2BAA2B,CAyC7B;AAED,uEAAuE;AACvE,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAM3E;AAED,mFAAmF;AACnF,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,UAAU,GACf,IAAI,CAGN;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,gBAAgB,GAAG,SAAS,GAClC,gBAAgB,GAAG,IAAI,CAKzB"}

package/dist/repoIntelligenceSchema.js

@@ -7,7 +7,7 @@
  */
 import { z } from "zod";
 /** Bump when wire schema changes incompatibly. */
-export const REPO_INTELLIGENCE_ABI = "1";
+export const REPO_INTELLIGENCE_ABI = "2";
 const surfaceKindSchema = z.enum(["runtime", "build", "test", "unknown"]);
 const reachabilityKindSchema = z.enum([
     "on_runtime_paths",
@@ -24,11 +24,83 @@ const packageUsageWireSchema = z.object({
     criticalPaths: z.array(z.string()).optional(),
     areas: z.array(z.string()).optional(),
 });
+const dependencyClassSchema = z.enum([
+    "runtime",
+    "tooling",
+    "test",
+    "lint",
+    "format",
+    "build",
+    "ci",
+    "unknown",
+]);
+const packageRoleSchema = z.enum([
+    "typechecker",
+    "compiler",
+    "bundler",
+    "linter",
+    "formatter",
+    "test_runner",
+    "http_framework",
+    "auth",
+    "queue",
+    "orm",
+    "unknown",
+]);
+const lockfileKindSchema = z.enum([
+    "production",
+    "development",
+    "optional",
+    "unknown",
+]);
+const runtimeImpactSchema = z.enum([
+    "none",
+    "possible",
+    "confirmed",
+    "unknown",
+]);
+const expectedImpactSchema = z.enum([
+    "runtime",
+    "build_time",
+    "typecheck",
+    "test_time",
+    "development_only",
+    "unknown",
+]);
+const evidenceStrengthSchema = z.enum(["high", "medium", "low"]);
+const classificationProvenanceSchema = z.object({
+    dependencyClass: z.enum([
+        "registry",
+        "graph",
+        "lockfile",
+        "heuristic",
+        "unknown",
+    ]),
+    packageRole: z.enum(["registry", "graph", "heuristic", "unknown"]),
+    registryEntryId: z.string().optional(),
+});
+const semanticDiagnosticSchema = z.object({
+    packageName: z.string().min(1),
+    ruleId: z.string().min(1),
+    before: z.record(z.string(), z.unknown()),
+    after: z.record(z.string(), z.unknown()),
+    reason: z.string().min(1),
+});
 const packageIntelWireSchema = z.object({
     runtimeSurface: surfaceKindSchema,
     reachability: reachabilityKindSchema,
     usage: packageUsageWireSchema,
     areas: z.array(z.string()).optional(),
+    dependencyClass: dependencyClassSchema.optional(),
+    packageRole: packageRoleSchema.optional(),
+    lockfileKind: lockfileKindSchema.optional(),
+    runtimeImpact: runtimeImpactSchema.optional(),
+    expectedImpact: expectedImpactSchema.optional(),
+    evidenceStrength: evidenceStrengthSchema.optional(),
+    confidenceReason: z.string().optional(),
+    verificationFocus: z.array(z.string()).optional(),
+    suppressRuntimeNarrative: z.boolean().optional(),
+    classificationProvenance: classificationProvenanceSchema.optional(),
 });
 const areaSchema = z.object({
     id: z.string().min(1),
@@ -54,6 +126,7 @@ export const repoIntelligenceWireSchema = z.object({
     affectedAreas: z.array(areaSchema).optional(),
     hotspots: z.array(hotspotWireSchema).optional(),
     frameworks: z.array(z.string().min(1)).optional(),
+    semanticDiagnostics: z.array(semanticDiagnosticSchema).optional(),
 });
 function formatZodIssues(error) {
     return error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`);

package/dist/repoIntelligenceSemantics.d.ts

@@ -0,0 +1,29 @@
+import type { RepoIntelligence } from "./repoIntelligenceSchema.js";
+export type DependencyClass = "runtime" | "tooling" | "test" | "lint" | "format" | "build" | "ci" | "unknown";
+export type PackageRole = "typechecker" | "compiler" | "bundler" | "linter" | "formatter" | "test_runner" | "http_framework" | "auth" | "queue" | "orm" | "unknown";
+export type LockfileKind = "production" | "development" | "optional" | "unknown";
+export type RuntimeImpact = "none" | "possible" | "confirmed" | "unknown";
+export type ExpectedImpact = "runtime" | "build_time" | "typecheck" | "test_time" | "development_only" | "unknown";
+export type EvidenceStrength = "high" | "medium" | "low";
+export type ClassificationSource = "registry" | "graph" | "lockfile" | "heuristic" | "unknown";
+export type SemanticDiagnostic = {
+    packageName: string;
+    ruleId: string;
+    before: Record<string, unknown>;
+    after: Record<string, unknown>;
+    reason: string;
+};
+export type SanitizeRepoIntelligenceResult = {
+    wire: RepoIntelligence;
+    diagnostics: SemanticDiagnostic[];
+    degradedPackages: string[];
+};
+type PackageRow = RepoIntelligence["packages"][string];
+/**
+ * Hard gate: normalize contradictory package intelligence before wire emit.
+ */
+export declare function sanitizeRepoIntelligenceSemantics(draft: RepoIntelligence): SanitizeRepoIntelligenceResult;
+/** Returns true when wire is safe for runtime narrative tier1. */
+export declare function isRuntimeNarrativeSafe(row: PackageRow | undefined): boolean;
+export {};
+//# sourceMappingURL=repoIntelligenceSemantics.d.ts.map

package/dist/repoIntelligenceSemantics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repoIntelligenceSemantics.d.ts","sourceRoot":"","sources":["../src/repoIntelligenceSemantics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,SAAS,GACT,MAAM,GACN,MAAM,GACN,QAAQ,GACR,OAAO,GACP,IAAI,GACJ,SAAS,CAAC;AAEd,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,UAAU,GACV,SAAS,GACT,QAAQ,GACR,WAAW,GACX,aAAa,GACb,gBAAgB,GAChB,MAAM,GACN,OAAO,GACP,KAAK,GACL,SAAS,CAAC;AAEd,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,aAAa,GACb,UAAU,GACV,SAAS,CAAC;AAEd,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAE1E,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,YAAY,GACZ,WAAW,GACX,WAAW,GACX,kBAAkB,GAClB,SAAS,CAAC;AAEd,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEzD,MAAM,MAAM,oBAAoB,GAC5B,UAAU,GACV,OAAO,GACP,UAAU,GACV,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,gBAAgB,CAAC;IACvB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAyBF,KAAK,UAAU,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AA+IvD;;GAEG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,gBAAgB,GACtB,8BAA8B,CAoBhC;AAED,kEAAkE;AAClE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,GAAG,OAAO,CAa3E"}

package/dist/repoIntelligenceSemantics.js

@@ -0,0 +1,146 @@
+const TOOLING_CLASSES = new Set([
+    "tooling",
+    "test",
+    "lint",
+    "format",
+    "build",
+    "ci",
+]);
+const RUNTIME_VERIFICATION = new Set([
+    "auth_flow",
+    "route_handlers",
+    "routes",
+    "handlers",
+    "serialization",
+    "hooks",
+    "plugins",
+    "session",
+    "auth",
+    "queue",
+    "workers",
+]);
+function cloneWire(wire) {
+    return structuredClone(wire);
+}
+function isToolingClass(dc) {
+    return dc != null && TOOLING_CLASSES.has(dc);
+}
+function stripRuntimeVerification(focus) {
+    if (!focus?.length)
+        return [];
+    return focus.filter((f) => !RUNTIME_VERIFICATION.has(f));
+}
+function applyS1(row) {
+    return row.runtimeSurface === "runtime" && row.reachability === "unreachable";
+}
+function applyS2(row) {
+    return (row.runtimeImpact === "none" && row.reachability === "on_runtime_paths");
+}
+function applyS3(row) {
+    return (isToolingClass(row.dependencyClass) && row.runtimeImpact === "confirmed");
+}
+function applyS4(row) {
+    return (row.runtimeImpact === "confirmed" && (row.usage?.files?.length ?? 0) === 0);
+}
+function applyS5(row) {
+    if (!row.suppressRuntimeNarrative)
+        return false;
+    const focus = row.verificationFocus ?? [];
+    return focus.some((f) => RUNTIME_VERIFICATION.has(f));
+}
+function sanitizePackageRow(packageName, row) {
+    const diagnostics = [];
+    let degraded = false;
+    const next = { ...row };
+    const record = (ruleId, before, after, reason) => {
+        diagnostics.push({ packageName, ruleId, before, after, reason });
+        degraded = true;
+    };
+    if (applyS1(next)) {
+        const before = {
+            runtimeSurface: next.runtimeSurface,
+            reachability: next.reachability,
+        };
+        next.runtimeSurface = "build";
+        next.reachability = "build_only";
+        next.runtimeImpact = next.runtimeImpact ?? "none";
+        next.suppressRuntimeNarrative = true;
+        record("S1", before, { runtimeSurface: next.runtimeSurface, reachability: next.reachability }, "runtime_surface_unreachable");
+    }
+    if (applyS3(next)) {
+        const before = { runtimeImpact: next.runtimeImpact };
+        next.runtimeImpact = "none";
+        next.suppressRuntimeNarrative = true;
+        record("S3", before, { runtimeImpact: next.runtimeImpact }, "tooling_confirmed_without_proof");
+    }
+    if (applyS4(next)) {
+        const before = { runtimeImpact: next.runtimeImpact };
+        next.runtimeImpact = "none";
+        next.evidenceStrength = "low";
+        next.suppressRuntimeNarrative = true;
+        record("S4", before, { runtimeImpact: next.runtimeImpact }, "confirmed_without_imports");
+    }
+    if (applyS2(next)) {
+        const before = { reachability: next.reachability };
+        next.reachability = "unknown";
+        record("S2", before, { reachability: next.reachability }, "none_but_on_runtime_paths");
+    }
+    if (applyS5(next)) {
+        const before = { verificationFocus: next.verificationFocus };
+        next.verificationFocus = stripRuntimeVerification(next.verificationFocus);
+        record("S5", before, { verificationFocus: next.verificationFocus }, "runtime_focus_while_suppressed");
+    }
+    if (next.runtimeSurface === "runtime" &&
+        next.reachability === "unreachable") {
+        next.runtimeSurface = "unknown";
+        next.reachability = "unknown";
+        next.suppressRuntimeNarrative = true;
+        degraded = true;
+    }
+    if (next.suppressRuntimeNarrative && next.runtimeImpact === "confirmed") {
+        next.runtimeImpact = "unknown";
+        degraded = true;
+    }
+    return { row: next, diagnostics, degraded };
+}
+/**
+ * Hard gate: normalize contradictory package intelligence before wire emit.
+ */
+export function sanitizeRepoIntelligenceSemantics(draft) {
+    const wire = cloneWire(draft);
+    const diagnostics = [];
+    const degradedPackages = [];
+    for (const [packageName, row] of Object.entries(wire.packages)) {
+        const result = sanitizePackageRow(packageName, row);
+        wire.packages[packageName] = result.row;
+        diagnostics.push(...result.diagnostics);
+        if (result.degraded)
+            degradedPackages.push(packageName);
+    }
+    if (diagnostics.length > 0) {
+        wire.semanticDiagnostics = [
+            ...(wire.semanticDiagnostics ?? []),
+            ...diagnostics,
+        ];
+    }
+    return { wire, diagnostics, degradedPackages };
+}
+/** Returns true when wire is safe for runtime narrative tier1. */
+export function isRuntimeNarrativeSafe(row) {
+    if (!row)
+        return false;
+    if (row.suppressRuntimeNarrative === true)
+        return false;
+    if (row.runtimeImpact === "none")
+        return false;
+    if (row.runtimeSurface === "runtime" && row.reachability === "unreachable") {
+        return false;
+    }
+    if (row.runtimeImpact === "confirmed" || row.runtimeImpact === "possible") {
+        return true;
+    }
+    if (row.runtimeImpact === "unknown")
+        return false;
+    // ABI 1 wire without semantic fields: allow non-contradictory surface/reach pairs.
+    return row.runtimeSurface != null && row.reachability != null;
+}

package/dist/repoIntelligenceSemantics.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=repoIntelligenceSemantics.test.d.ts.map

package/dist/repoIntelligenceSemantics.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repoIntelligenceSemantics.test.d.ts","sourceRoot":"","sources":["../src/repoIntelligenceSemantics.test.ts"],"names":[],"mappings":""}

package/dist/repoIntelligenceSemantics.test.js

@@ -0,0 +1,63 @@
+import { describe, expect, it } from "vitest";
+import { isRuntimeNarrativeSafe, sanitizeRepoIntelligenceSemantics, } from "./repoIntelligenceSemantics.js";
+function basePkg(overrides = {}) {
+    return {
+        runtimeSurface: "runtime",
+        reachability: "unreachable",
+        usage: { packageName: "typescript", files: [] },
+        ...overrides,
+    };
+}
+describe("sanitizeRepoIntelligenceSemantics", () => {
+    it("S1: neutralizes runtime + unreachable", () => {
+        const draft = {
+            packages: {
+                typescript: basePkg({
+                    runtimeImpact: "unknown",
+                }),
+            },
+        };
+        const { wire, diagnostics } = sanitizeRepoIntelligenceSemantics(draft);
+        expect(wire.packages.typescript?.runtimeSurface).not.toBe("runtime");
+        expect(wire.packages.typescript?.reachability).not.toBe("unreachable");
+        expect(wire.packages.typescript?.suppressRuntimeNarrative).toBe(true);
+        expect(diagnostics.some((d) => d.ruleId === "S1")).toBe(true);
+    });
+    it("S3: tooling class cannot stay confirmed", () => {
+        const draft = {
+            packages: {
+                typescript: basePkg({
+                    dependencyClass: "tooling",
+                    runtimeImpact: "confirmed",
+                    runtimeSurface: "build",
+                    reachability: "build_only",
+                }),
+            },
+        };
+        const { wire } = sanitizeRepoIntelligenceSemantics(draft);
+        expect(wire.packages.typescript?.runtimeImpact).toBe("none");
+    });
+    it("S4: confirmed without imports downgrades", () => {
+        const draft = {
+            packages: {
+                fastify: basePkg({
+                    runtimeImpact: "confirmed",
+                    usage: { packageName: "fastify", files: [] },
+                }),
+            },
+        };
+        const { wire } = sanitizeRepoIntelligenceSemantics(draft);
+        expect(wire.packages.fastify?.runtimeImpact).toBe("none");
+    });
+});
+describe("isRuntimeNarrativeSafe", () => {
+    it("returns false for suppressed runtime narrative", () => {
+        expect(isRuntimeNarrativeSafe({
+            runtimeSurface: "runtime",
+            reachability: "on_runtime_paths",
+            usage: { packageName: "x", files: ["src/a.ts"] },
+            suppressRuntimeNarrative: true,
+            runtimeImpact: "none",
+        })).toBe(false);
+    });
+});

package/dist/scanCardSummary.d.ts

@@ -1,6 +1,4 @@
-import type { CatalogPhrase } from "./cardObservationCatalog.js";
-import type { NarrativeAvailabilityMode } from "./scanNarrativeFacts.js";
-import { type MergePosture } from "./riskVocabulary.js";
+import type { ScanCardPresentation } from "./presentation/dto/scanCardPresentation.js";
 import type { Finding, ScanResult } from "./types.js";
 export type ScanPipelineStatus = "queued" | "running" | "done" | "failed";
 export type ScanCardPresentationState = "not_scanned" | "scanning" | "analysis_failed" | "ready" | "stale";
@@ -11,38 +9,9 @@ export type FindingCountSummary = {
     medium: number;
     low: number;
 };
-export type ScanCardSummary = {
-    mergePosture: MergePosture | null;
-    riskIndex: number | null;
-    riskIndexBand: RiskIndexBand | null;
-    headline: string;
-    /** @deprecated Use operationalObservations */
-    summaryLine: string | null;
-    findingCounts: FindingCountSummary | null;
-    /** @deprecated Use affectedAreas */
-    topAffectedAreas: string[];
-    /** Catalog-mapped topology observations (0–3). Tier 3 repo context — legacy wire field. */
-    operationalObservations: CatalogPhrase[];
-    /** Optional quiet subline when exactly one observation is shown. */
-    supportingLine: string | null;
-    narrativeMode: NarrativeAvailabilityMode;
-    codeIntelligenceAvailable: boolean;
-    changedPackagesDisplay: string | null;
-    runtimeSurfaceLabel: string | null;
-    reachabilityLabel: string | null;
-    blastRadiusLabel: string | null;
-    affectedAreas: string[];
-    primaryInsight: string | null;
-    structuralOnlyDisclaimer: string | null;
-    /** One-line usage hint from packageUsage paths or areas. */
-    usageSummary: string | null;
-    /** Single verification prompt from changed-scope guidance or usage. */
-    verificationLine: string | null;
-    /** Optional blast factor subline when factors exist. */
-    blastRadiusDetail: string | null;
-    /** Short framework list (max 2 on card). */
-    frameworksSummary: string | null;
-};
+/** @deprecated Use ScanCardPresentation */
+export type ScanCardSummary = ScanCardPresentation;
+export { ScanCardPresentation };
 export declare const SCAN_CARD_SCANNING_SUMMARY = "Waiting for results...";
 export type PipelineCompletionEvidence = {
     scannedAt?: string | null;

package/dist/scanCardSummary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanCardSummary.d.ts","sourceRoot":"","sources":["../src/scanCardSummary.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE1E,MAAM,MAAM,yBAAyB,GACjC,aAAa,GACb,UAAU,GACV,iBAAiB,GACjB,OAAO,GACP,OAAO,CAAC;AAEZ,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAClC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC1C,oCAAoC;IACpC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,2FAA2F;IAC3F,uBAAuB,EAAE,aAAa,EAAE,CAAC;IACzC,oEAAoE;IACpE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,yBAAyB,CAAC;IACzC,yBAAyB,EAAE,OAAO,CAAC;IACnC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,4DAA4D;IAC5D,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,4CAA4C;IAC5C,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAGF,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAEnE,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAsBF,wFAAwF;AACxF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAQT;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,0BAA0B,GACnC,kBAAkB,CAKpB;AAED,8EAA8E;AAC9E,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO,CAST;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAUvE;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,aAAa,GAAG,IAAI,CAKtB;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,GAAG,SAAS,GACrC,mBAAmB,CAgBrB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,EACrC,cAAc,EAAE,kBAAkB,GACjC,eAAe,CAyBjB;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,2FAA2F;AAC3F,wBAAgB,qCAAqC,CACnD,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,cAAc,EAAE,kBAAkB,GACjC,eAAe,CAuBjB;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,sBAAsB,GAC5B,eAAe,CAkDjB"}
+{"version":3,"file":"scanCardSummary.d.ts","sourceRoot":"","sources":["../src/scanCardSummary.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAMvF,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE1E,MAAM,MAAM,yBAAyB,GACjC,aAAa,GACb,UAAU,GACV,iBAAiB,GACjB,OAAO,GACP,OAAO,CAAC;AAEZ,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,2CAA2C;AAC3C,MAAM,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAGhC,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAEnE,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAsBF,wFAAwF;AACxF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAQT;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,0BAA0B,GACnC,kBAAkB,CAKpB;AAED,8EAA8E;AAC9E,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO,CAST;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAEvE;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,aAAa,GAAG,IAAI,CAKtB;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,GAAG,SAAS,GACrC,mBAAmB,CAgBrB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,EACrC,cAAc,EAAE,kBAAkB,GACjC,eAAe,CAOjB;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,2FAA2F;AAC3F,wBAAgB,qCAAqC,CACnD,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,cAAc,EAAE,kBAAkB,GACjC,eAAe,CAuBjB;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,sBAAsB,GAC5B,eAAe,CAcjB"}

package/dist/scanCardSummary.js

@@ -1,5 +1,4 @@
-import { deriveScanNarrative } from "./deriveScanNarrative.js";
-import { presentScanCardSummary } from "./presentScanCardSummary.js";
+import { buildScanCardPresentation } from "./presentation/orchestration/buildScanCardPresentation.js";
 import { mergePostureFromDecision, } from "./riskVocabulary.js";
 import { scanSurfaceCopy } from "./scanSurfaceCopy.js";
 const STALE_SUBLINE = "Based on earlier commit";
@@ -53,14 +52,7 @@ export function isPipelinePlaceholderCopy(text) {
 }
 /** True when summary reflects pipeline lifecycle, not merge posture. */
 export function isPipelineCardSummary(summary) {
-    if (isPipelinePlaceholderCopy(summary.summaryLine))
-        return true;
-    return (summary.mergePosture === null &&
-        summary.riskIndex === null &&
-        (summary.headline === scanSurfaceCopy.pipeline.scanRunning ||
-            summary.headline === scanSurfaceCopy.pipeline.analysisIncomplete ||
-            summary.headline === scanSurfaceCopy.pipeline.scanUnavailable) &&
-        summary.narrativeMode === "denormalized");
+    return summary.pipeline != null;
 }
 /** Single source for risk index color bands (aligns with decision score bands). */
 export function deriveRiskIndexBand(score) {
@@ -101,26 +93,11 @@ export function aggregateFindingCounts(findings) {
  * Quiet safe cards with no mappable signals show posture + exposure only.
  */
 export function deriveScanCardSummary(result, pipelineStatus) {
-    if (pipelineStatus === "queued" || pipelineStatus === "running") {
-        return presentScanCardSummary(deriveScanNarrative(null), {
-            pipelineStatus,
-        });
-    }
-    if (pipelineStatus === "failed") {
-        return presentScanCardSummary(deriveScanNarrative(null), {
-            pipelineStatus: "failed",
-        });
-    }
-    if (!result) {
-        return {
-            ...presentScanCardSummary(deriveScanNarrative(null), { pipelineStatus }),
-            headline: scanSurfaceCopy.pipeline.scanUnavailable,
-        };
-    }
-    const facts = deriveScanNarrative(result);
-    return presentScanCardSummary(facts, {
+    return buildScanCardPresentation({
         pipelineStatus,
-        findings: result.findings,
+        result: result ?? null,
+        decision: result?.decision?.recommendation,
+        totalScore: result?.totalScore,
     });
 }
 /** Subline appended when scan results are stale (head SHA mismatch). */
@@ -160,38 +137,10 @@ export function resolvePrScanCardSummary(input) {
         hasResult: input.result != null,
         scannedAt: input.scannedAt,
     });
-    if (effectivePipeline === "done") {
-        const scanResult = input.result ??
-            (hasScanCompletionEvidence({
-                decision: input.decision,
-                totalScore: input.totalScore,
-                hasResult: false,
-            })
-                ? {
-                    totalScore: input.totalScore ?? 0,
-                    layerScores: {
-                        security: 0,
-                        maintainability: 0,
-                        ecosystem: 0,
-                        upgradeImpact: 0,
-                    },
-                    findings: [],
-                    generatedAt: new Date().toISOString(),
-                    decision: mergePostureFromDecision(input.decision)
-                        ? {
-                            recommendation: mergePostureFromDecision(input.decision),
-                            confidence: "medium",
-                            reasoning: [],
-                        }
-                        : undefined,
-                }
-                : null);
-        if (scanResult) {
-            const fromResult = deriveScanCardSummary(scanResult, "done");
-            if (!isPipelineCardSummary(fromResult))
-                return fromResult;
-        }
-        return deriveScanCardSummaryFromDenormalized(input.decision, input.totalScore, input.summaryText, "done");
-    }
-    return deriveScanCardSummary(input.result, effectivePipeline);
+    return buildScanCardPresentation({
+        pipelineStatus: effectivePipeline,
+        result: input.result,
+        decision: input.decision,
+        totalScore: input.totalScore,
+    });
 }