@mergesignal/shared 0.6.0 → 0.8.0

package/dist/affectedAreaLinkage.d.ts

@@ -0,0 +1,14 @@
+import type { AffectedAreaFact, ChangedPackageSemantics, NarrativePackageUsage, ScanNarrativeFacts } from "./scanNarrativeFacts.js";
+import type { Finding } from "./types.js";
+export declare function areaIdFromLabel(label: string): string;
+export declare function enrichAffectedAreaFacts(areas: Array<{
+    id: string;
+    label: string;
+}>, ctx: {
+    findings: Finding[];
+    packageUsage: NarrativePackageUsage[];
+    changedPackageSemantics: ChangedPackageSemantics[];
+    hotspots: ScanNarrativeFacts["hotspots"];
+    applicationAreaIds: ReadonlySet<string>;
+}): AffectedAreaFact[];
+//# sourceMappingURL=affectedAreaLinkage.d.ts.map

package/dist/affectedAreaLinkage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"affectedAreaLinkage.d.ts","sourceRoot":"","sources":["../src/affectedAreaLinkage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EAErB,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAQ1C,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAuGD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAC3C,GAAG,EAAE;IACH,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,qBAAqB,EAAE,CAAC;IACtC,uBAAuB,EAAE,uBAAuB,EAAE,CAAC;IACnD,QAAQ,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACzC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACzC,GACA,gBAAgB,EAAE,CAwBpB"}

package/dist/affectedAreaLinkage.js

@@ -0,0 +1,100 @@
+const EVIDENCE_STRENGTH_RANK = {
+    high: 3,
+    medium: 2,
+    low: 1,
+};
+export function areaIdFromLabel(label) {
+    return label.toLowerCase().replace(/\s+/g, "_").slice(0, 48);
+}
+function packagesForArea(area, packageUsage, applicationAreaIds) {
+    const linked = new Set();
+    for (const row of packageUsage) {
+        for (const usageArea of row.areas) {
+            if (areaIdFromLabel(usageArea) === area.id ||
+                usageArea.toLowerCase() === area.label.toLowerCase()) {
+                linked.add(row.packageName);
+            }
+        }
+    }
+    if (applicationAreaIds.has(area.id)) {
+        for (const row of packageUsage) {
+            linked.add(row.packageName);
+        }
+    }
+    return [...linked].sort((a, b) => a.localeCompare(b));
+}
+function findingIdsForPackages(findings, packages) {
+    if (packages.length === 0)
+        return [];
+    const pkgSet = new Set(packages);
+    return findings.filter((f) => pkgSet.has(f.packageName)).map((f) => f.id);
+}
+function pathsForPackages(packageUsage, packages) {
+    const pkgSet = new Set(packages);
+    const paths = [];
+    for (const row of packageUsage) {
+        if (!pkgSet.has(row.packageName))
+            continue;
+        paths.push(...row.paths, ...row.criticalPaths, ...row.files);
+    }
+    const seen = new Set();
+    return paths.filter((p) => {
+        if (!p || seen.has(p))
+            return false;
+        seen.add(p);
+        return true;
+    });
+}
+function evidenceStrengthForPackages(semantics, packages) {
+    const pkgSet = new Set(packages);
+    let best = null;
+    let bestRank = 0;
+    for (const row of semantics) {
+        if (!pkgSet.has(row.packageName) || !row.evidenceStrength)
+            continue;
+        const rank = EVIDENCE_STRENGTH_RANK[row.evidenceStrength];
+        if (rank > bestRank) {
+            bestRank = rank;
+            best = row.evidenceStrength;
+        }
+    }
+    return best;
+}
+function hotspotPackagesForPackages(hotspots, packages) {
+    const pkgSet = new Set(packages);
+    const linked = new Set();
+    for (const hotspot of hotspots) {
+        if (pkgSet.has(hotspot.packageName)) {
+            linked.add(hotspot.packageName);
+        }
+    }
+    return [...linked].sort((a, b) => a.localeCompare(b));
+}
+function verificationFocusForPackages(semantics, packages) {
+    const pkgSet = new Set(packages);
+    const focus = new Set();
+    for (const row of semantics) {
+        if (!pkgSet.has(row.packageName))
+            continue;
+        for (const item of row.verificationFocus) {
+            if (item.trim())
+                focus.add(item.trim());
+        }
+    }
+    return [...focus].sort((a, b) => a.localeCompare(b));
+}
+export function enrichAffectedAreaFacts(areas, ctx) {
+    return areas.map((area) => {
+        const packages = packagesForArea(area, ctx.packageUsage, ctx.applicationAreaIds);
+        return {
+            id: area.id,
+            label: area.label,
+            packages,
+            findingIds: findingIdsForPackages(ctx.findings, packages),
+            paths: pathsForPackages(ctx.packageUsage, packages),
+            evidenceStrength: evidenceStrengthForPackages(ctx.changedPackageSemantics, packages),
+            hotspotPackages: hotspotPackagesForPackages(ctx.hotspots, packages),
+            verificationFocus: verificationFocusForPackages(ctx.changedPackageSemantics, packages),
+        };
+    });
+}

package/dist/assessmentLabels.d.ts

@@ -1,4 +1,4 @@
-import type { MergeConcernKind } from "./assessmentSchema.js";
+import type { MergeConcernKind } from "@mergesignal/contracts";
 /** Display labels for factor tokens (mirrors engine factor-registry labels). */
 export declare const ASSESSMENT_FACTOR_LABELS: Record<string, string>;
 export declare const MERGE_CONCERN_LABELS: Record<MergeConcernKind, string>;

package/dist/assessmentLabels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assessmentLabels.d.ts","sourceRoot":"","sources":["../src/assessmentLabels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAmB3D,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAcjE,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D"}
+{"version":3,"file":"assessmentLabels.d.ts","sourceRoot":"","sources":["../src/assessmentLabels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAmB3D,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAcjE,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/dist/assessmentPresentationUtils.d.ts

@@ -0,0 +1,6 @@
+import type { AssessmentPresentationPublic, AssessmentPresentationWire, NarrativeIntensity } from "@mergesignal/contracts";
+/** Public presentation subset — excludes engine policy fields. */
+export declare function toPublicPresentation(wire: AssessmentPresentationWire): AssessmentPresentationPublic;
+/** Map engine narrative intensity to presentation density (formatting only). */
+export declare function narrativeIntensityToDensity(intensity: NarrativeIntensity): "minimal" | "standard" | "rich";
+//# sourceMappingURL=assessmentPresentationUtils.d.ts.map

package/dist/assessmentPresentationUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assessmentPresentationUtils.d.ts","sourceRoot":"","sources":["../src/assessmentPresentationUtils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAEhC,kEAAkE;AAClE,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,0BAA0B,GAC/B,4BAA4B,CAO9B;AAED,gFAAgF;AAChF,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,kBAAkB,GAC5B,SAAS,GAAG,UAAU,GAAG,MAAM,CAIjC"}

package/dist/assessmentPresentationUtils.js

@@ -0,0 +1,17 @@
+/** Public presentation subset — excludes engine policy fields. */
+export function toPublicPresentation(wire) {
+    return {
+        narrativeIntensity: wire.narrativeIntensity,
+        reachVisibility: wire.reachVisibility,
+        verificationIntensity: wire.verificationIntensity,
+        reportMode: wire.reportMode,
+    };
+}
+/** Map engine narrative intensity to presentation density (formatting only). */
+export function narrativeIntensityToDensity(intensity) {
+    if (intensity === "minimal")
+        return "minimal";
+    if (intensity === "elevated")
+        return "rich";
+    return "standard";
+}

package/dist/assessmentProjection.d.ts

@@ -1,10 +1,10 @@
 import type { ScanResult } from "./types.js";
 import { type RepoIntelligence } from "./repoIntelligenceSchema.js";
-import type { Assessment, AssessmentPresentationPublic, ReachVisibility } from "./assessmentSchema.js";
+import type { Assessment, AssessmentPresentationPublic, ReachVisibility } from "@mergesignal/contracts";
 import type { PresentationStatus } from "./presentation/dto/types.js";
 export declare function collectVerificationFocus(result: ScanResult): string[];
 export declare function reachVisibilityLabel(visibility: ReachVisibility): string | undefined;
-export declare function formatAssessmentHeadline(assessment: Assessment, result: ScanResult, status: PresentationStatus): string;
+export declare function formatAssessmentHeadline(assessment: Assessment, status: PresentationStatus): string;
 export declare function projectReasoningLines(result: ScanResult): string[];
 export declare function projectInsightLines(assessment: Assessment, result: ScanResult): string[];
 export declare function projectVerificationActions(assessment: Assessment, presentation: AssessmentPresentationPublic, result: ScanResult, max: number): string[];

package/dist/assessmentProjection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assessmentProjection.d.ts","sourceRoot":"","sources":["../src/assessmentProjection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACV,UAAU,EACV,4BAA4B,EAC5B,eAAe,EAChB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAgBrE;AAED,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,eAAe,GAC1B,MAAM,GAAG,SAAS,CAWpB;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,kBAAkB,GACzB,MAAM,CAqDR;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAIlE;AAED,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,UAAU,GACjB,MAAM,EAAE,CAaV;AAED,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,4BAA4B,EAC1C,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,GACV,MAAM,EAAE,CAIV;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,EAAE,CAI3E"}
+{"version":3,"file":"assessmentProjection.d.ts","sourceRoot":"","sources":["../src/assessmentProjection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACV,UAAU,EACV,4BAA4B,EAC5B,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAgCtE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAkBrE;AAED,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,eAAe,GAC1B,MAAM,GAAG,SAAS,CAWpB;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,kBAAkB,GACzB,MAAM,CAiDR;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAIlE;AAED,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,UAAU,GACjB,MAAM,EAAE,CAaV;AAED,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,4BAA4B,EAC1C,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,GACV,MAAM,EAAE,CAIV;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,EAAE,CAI3E"}

package/dist/assessmentProjection.js

@@ -2,14 +2,47 @@ import { safeParseRepoIntelligence, } from "./repoIntelligenceSchema.js";
 import { labelAssessmentFactor, MERGE_CONCERN_LABELS, } from "./assessmentLabels.js";
 import { scanSurfaceCopy } from "./scanSurfaceCopy.js";
 import { applyPostureVocabularyGuardHeadline } from "./presentation/intent/applyPostureVocabularyGuard.js";
+function focalDisplayPackage(assessment) {
+    const anchors = assessment.reviewFocalPoint.anchors;
+    if (anchors.length === 0)
+        return "dependency";
+    const token = anchors[0];
+    if (token === "dependency_graph")
+        return "dependencies";
+    if (token.includes("+"))
+        return token.split("+")[0];
+    return token;
+}
+function focalHeadlinePackages(assessment) {
+    const focal = assessment.reviewFocalPoint;
+    if (focal.episodeShape === "multi_anchor") {
+        return focal.anchors.join(", ");
+    }
+    return focalDisplayPackage(assessment);
+}
+/** Copy-formatting only — fills {surface} in runtime headline template. */
+function surfaceHintFromAssessment(assessment) {
+    const factors = assessment.factors;
+    const anchor = focalDisplayPackage(assessment);
+    if (anchor === "bullmq" || factors.includes("queue_infrastructure")) {
+        return "workers and queues";
+    }
+    if (anchor === "next-auth" || factors.includes("auth_infrastructure")) {
+        return "authentication flows";
+    }
+    return "application code";
+}
 export function collectVerificationFocus(result) {
+    const scope = result.assessment?.verificationScope;
+    if (scope?.focus?.length)
+        return [...scope.focus];
+    const packages = scope?.packages ?? [];
     const parsed = safeParseRepoIntelligence(result.repoIntelligence);
     if (!parsed.ok)
         return [];
-    const changed = new Set(result.changedPackages ?? []);
     const labels = [];
     const seen = new Set();
-    for (const pkg of changed) {
+    for (const pkg of packages) {
         const row = parsed.value.packages[pkg];
         for (const focus of row?.verificationFocus ?? []) {
             const t = focus.trim();
@@ -33,13 +66,13 @@ export function reachVisibilityLabel(visibility) {
             return undefined;
     }
 }
-export function formatAssessmentHeadline(assessment, result, status) {
+export function formatAssessmentHeadline(assessment, status) {
     const copy = scanSurfaceCopy.presentation;
-    const runtimePkg = assessment.concerns.find((c) => c.kind === "confirmed_runtime_usage")?.packages?.[0];
-    const primaryPkg = runtimePkg ??
-        result.changedPackages?.[0] ??
-        assessment.concerns.find((c) => c.packages?.length)?.packages?.[0] ??
-        "dependency";
+    const primaryPkg = focalHeadlinePackages(assessment);
+    if (assessment.reviewFocalPoint.episodeShape === "structural") {
+        const headline = copy.defaultUpgradeHeadline.replace("{package}", "dependencies");
+        return applyPostureVocabularyGuardHeadline(headline, status, null);
+    }
     if (assessment.primaryConcern === "insufficient_evidence") {
         return applyPostureVocabularyGuardHeadline(copy.limitedContextHeadline, status, primaryPkg);
     }
@@ -50,11 +83,7 @@ export function formatAssessmentHeadline(assessment, result, status) {
         return applyPostureVocabularyGuardHeadline(headline, status, primaryPkg);
     }
     if (assessment.primaryConcern === "confirmed_runtime_usage") {
-        const surface = assessment.factors.includes("queue_infrastructure")
-            ? "workers and queues"
-            : assessment.factors.includes("auth_infrastructure")
-                ? "authentication flows"
-                : "application code";
+        const surface = surfaceHintFromAssessment(assessment);
         const headline = copy.runtimeUpgradeHeadline
             .replace("{package}", primaryPkg)
             .replace("{surface}", surface);

package/dist/deriveScanNarrative.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deriveScanNarrative.d.ts","sourceRoot":"","sources":["../src/deriveScanNarrative.ts"],"names":[],"mappings":"AAOA,OAAO,EAeL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAKV,UAAU,EACX,MAAM,YAAY,CAAC;AA+dpB;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACpC,kBAAkB,CAwGpB"}
+{"version":3,"file":"deriveScanNarrative.d.ts","sourceRoot":"","sources":["../src/deriveScanNarrative.ts"],"names":[],"mappings":"AAYA,OAAO,EAgBL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAMV,UAAU,EACX,MAAM,YAAY,CAAC;AAoiBpB;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACpC,kBAAkB,CAsIpB"}

package/dist/deriveScanNarrative.js

@@ -1,6 +1,8 @@
 import { extractRepositoryContextFacts } from "./extractRepositoryContextFacts.js";
+import { areaIdFromLabel, enrichAffectedAreaFacts, } from "./affectedAreaLinkage.js";
 import { readBlastLevel, safeParseRepoIntelligence, } from "./repoIntelligenceSchema.js";
 import { isRuntimeNarrativeSafe } from "./repoIntelligenceSemantics.js";
+import { deriveRiskSignals } from "./riskSignals.js";
 import { EMPTY_SCAN_NARRATIVE_FACTS, NARRATIVE_FACT_MAX_AREAS, NARRATIVE_FACT_MAX_HOTSPOTS, NARRATIVE_FACT_MAX_PATHS, } from "./scanNarrativeFacts.js";
 import { mergePostureFromDecision } from "./riskVocabulary.js";
 import { selectTopAffectedAreas } from "./selectTopAffectedAreas.js";
@@ -14,6 +16,25 @@ function parseChangedPackages(changed) {
         all,
     };
 }
+function changedPackagesFromAssessment(result) {
+    const assessment = result.assessment;
+    const focal = assessment?.reviewFocalPoint;
+    // Follow-up: remove parseChangedPackages fallback after historical scan re-scan window.
+    if (focal?.anchors?.length && focal.anchors[0] !== "dependency_graph") {
+        const token = focal.anchors[0];
+        const primary = token.includes("+") ? token.split("+")[0] : token;
+        const supporting = focal.supportingPackages ?? [];
+        const all = [
+            ...new Set([primary, ...supporting, ...(result.changedPackages ?? [])]),
+        ].sort((a, b) => a.localeCompare(b));
+        return {
+            primary,
+            others: all.filter((p) => p !== primary),
+            all,
+        };
+    }
+    return parseChangedPackages(result.changedPackages);
+}
 function blastLevelFromChangedCount(count) {
     if (count >= 8)
         return "wide";
@@ -205,13 +226,15 @@ function extractTier1FromRepoIntelligence(ri, changed) {
         }
         : null;
     const areasRaw = ri.applicationAreas ?? ri.affectedAreas ?? [];
+    const applicationAreaIds = new Set();
     const affectedAreas = [];
     for (const area of areasRaw) {
+        applicationAreaIds.add(area.id);
         affectedAreas.push({ id: area.id, label: area.label });
     }
     for (const row of packageUsage) {
         for (const label of row.areas) {
-            const id = label.toLowerCase().replace(/\s+/g, "_");
+            const id = areaIdFromLabel(label);
             if (!affectedAreas.some((a) => a.id === id)) {
                 affectedAreas.push({ id, label });
             }
@@ -228,6 +251,7 @@ function extractTier1FromRepoIntelligence(ri, changed) {
         blastRadius,
         affectedAreas: affectedAreas.slice(0, NARRATIVE_FACT_MAX_AREAS),
         hotspots: codeHotspots.slice(0, NARRATIVE_FACT_MAX_HOTSPOTS),
+        applicationAreaIds,
     };
 }
 function hasMeaningfulTier1(tier1) {
@@ -322,6 +346,7 @@ function emptyTier1Blocks() {
         blastRadius: null,
         affectedAreas: [],
         hotspots: [],
+        applicationAreaIds: new Set(),
     };
 }
 function blastRadiusFromChangedCount(count) {
@@ -349,6 +374,38 @@ function resolveTrustedRepoIntelligence(result) {
     }
     return { parsed: null, parseStatus: "invalid" };
 }
+function preparationWarningsFromResult(result) {
+    const warnings = result.analysisPreparation?.warnings;
+    if (!Array.isArray(warnings))
+        return [];
+    return warnings.map((w) => ({
+        code: w.code,
+        message: w.message,
+        ...(w.details != null ? { details: w.details } : {}),
+    }));
+}
+function resolveCorpusGateReason(input) {
+    if (input.corpusGate)
+        return "ok";
+    if (!input.codeIntelligenceAvailable)
+        return "no_code_intelligence";
+    if (input.repoIntelligenceParse === "invalid" ||
+        input.repoIntelligenceParse === "untrusted") {
+        return "repo_intelligence_invalid";
+    }
+    return "repo_intelligence_absent";
+}
+function assessmentConfidenceFromResult(result) {
+    const c = result.assessment?.confidence;
+    if (c === "low" || c === "medium" || c === "high")
+        return c;
+    return null;
+}
+function limitedContextDiagnostic(input) {
+    return (input.corpusGateReason !== "ok" ||
+        input.preparationWarnings.length > 0 ||
+        input.assessmentConfidence === "low");
+}
 /**
  * Consumer-agnostic scan intelligence — structured facts only (no UI copy).
  */
@@ -356,25 +413,31 @@ export function deriveScanNarrative(result) {
     if (!result) {
         return { ...EMPTY_SCAN_NARRATIVE_FACTS };
     }
-    const changedPackages = parseChangedPackages(result.changedPackages);
+    const changedPackages = changedPackagesFromAssessment(result);
     const mergePosture = mergePostureFromDecision(result.decision?.recommendation) ?? null;
-    const riskIndex = typeof result.totalScore === "number" && Number.isFinite(result.totalScore)
-        ? result.totalScore
-        : null;
+    const preparationWarnings = preparationWarningsFromResult(result);
     const codeIntelligenceAvailable = result.analysisPreparation?.codeIntelligenceAvailable !== false;
     const { parsed: parsedRi, parseStatus: repoIntelligenceParse } = resolveTrustedRepoIntelligence(result);
     const corpusGate = codeIntelligenceAvailable &&
         repoIntelligenceParse === "ok" &&
         parsedRi != null;
+    const corpusGateReason = resolveCorpusGateReason({
+        codeIntelligenceAvailable,
+        repoIntelligenceParse,
+        corpusGate,
+    });
     let tier1Blocks = emptyTier1Blocks();
+    let applicationAreaIds = tier1Blocks.applicationAreaIds;
     if (corpusGate && parsedRi) {
         tier1Blocks = extractTier1FromRepoIntelligence(parsedRi, changedPackages);
+        applicationAreaIds = tier1Blocks.applicationAreaIds;
     }
     else if (changedPackages.all.length > 0) {
         tier1Blocks = {
             ...emptyTier1Blocks(),
             blastRadius: blastRadiusFromChangedCount(changedPackages.all.length),
         };
+        applicationAreaIds = tier1Blocks.applicationAreaIds;
     }
     tier1Blocks.hotspots = mergeGraphHotspots(tier1Blocks.hotspots, result.graphInsights?.hotspots);
     const tier1 = corpusGate && hasMeaningfulTier1(tier1Blocks);
@@ -384,23 +447,40 @@ export function deriveScanNarrative(result) {
     const tier3 = repositoryContext.length > 0;
     const mode = resolveAvailabilityMode(tier1, tier2 || reviewerGuidance.length > 0, codeIntelligenceAvailable);
     const decisionConf = result.decision?.confidence;
+    const assessmentConfidence = assessmentConfidenceFromResult(result);
     const confidence = {
         decision: decisionConf === "low" ||
             decisionConf === "medium" ||
             decisionConf === "high"
             ? decisionConf
             : null,
+        assessment: assessmentConfidence,
+        limitedContext: limitedContextDiagnostic({
+            corpusGateReason,
+            preparationWarnings,
+            assessmentConfidence,
+        }),
     };
     if (!tier1 && mode === "graph_fallback" && changedPackages.all.length > 0) {
         tier1Blocks.blastRadius = blastRadiusFromChangedCount(changedPackages.all.length);
     }
-    let affectedAreas = tier1Blocks.affectedAreas;
-    if (affectedAreas.length === 0 && mode !== "pr_intelligence") {
-        affectedAreas = selectTopAffectedAreas(result, { max: 2 }).map((label) => ({
-            id: label.toLowerCase().replace(/\s+/g, "_").slice(0, 48),
+    let affectedAreaSeeds = tier1Blocks.affectedAreas;
+    if (affectedAreaSeeds.length === 0 && mode !== "pr_intelligence") {
+        affectedAreaSeeds = selectTopAffectedAreas(result, { max: 2 }).map((label) => ({
+            id: areaIdFromLabel(label),
             label,
         }));
     }
+    const findings = Array.isArray(result.findings) ? result.findings : [];
+    const affectedAreas = enrichAffectedAreaFacts(affectedAreaSeeds, {
+        findings,
+        packageUsage: tier1Blocks.packageUsage,
+        changedPackageSemantics: tier1Blocks.changedPackageSemantics,
+        hotspots: tier1Blocks.hotspots,
+        applicationAreaIds,
+    });
+    const riskSignals = deriveRiskSignals(result);
+    const riskIndex = riskSignals?.riskIndex ?? null;
     return {
         availability: {
             mode,
@@ -411,6 +491,8 @@ export function deriveScanNarrative(result) {
                 tier3,
             },
             repoIntelligenceParse,
+            preparationWarnings,
+            corpusGateReason,
         },
         changedPackages,
         packageUsage: tier1Blocks.packageUsage,
@@ -427,5 +509,6 @@ export function deriveScanNarrative(result) {
         repositoryContext,
         mergePosture,
         riskIndex,
+        riskSignals,
     };
 }

package/dist/deriveScanNarrative.test.js

@@ -3,6 +3,7 @@ import { deriveScanNarrative } from "./deriveScanNarrative.js";
 import { legacyEngineRepoIntelligenceJwt } from "./fixtures/legacyEngineRepoIntelligence.js";
 import { fixtureRepoIntelligenceFastify, fixtureRepoIntelligenceMultiPackage, fixtureRepoIntelligenceTypescript, } from "./fixtures/repoIntelligenceFixtures.js";
 import { analysisPreparationWithInvalidRepoIntel, analysisPreparationWithValidRepoIntel, } from "./fixtures/repoIntelligenceTestHelpers.js";
+import { assessmentFastifyRuntime } from "./fixtures/assessmentFixtures.js";
 const baseResult = {
     totalScore: 10,
     layerScores: {
@@ -64,6 +65,18 @@ describe("deriveScanNarrative", () => {
         expect(facts.affectedAreas.map((a) => a.id)).toContain("api");
         expect(facts.hotspots[0]?.source).toBe("code");
     });
+    it("changedPackages.primary follows reviewFocalPoint anchor, not changedPackages order", () => {
+        const result = {
+            ...baseResult,
+            changedPackages: ["typescript", "fastify"],
+            assessment: assessmentFastifyRuntime,
+            analysisPreparation: analysisPreparationWithValidRepoIntel(),
+            repoIntelligence: fixtureRepoIntelligenceFastify,
+        };
+        const facts = deriveScanNarrative(result);
+        expect(facts.changedPackages.primary).toBe("fastify");
+        expect(result.changedPackages?.[0]).toBe("typescript");
+    });
     it("prefers changed-scope insights for reviewer guidance ordering", () => {
         const result = {
             ...baseResult,
@@ -197,4 +210,65 @@ describe("deriveScanNarrative", () => {
         expect(facts.availability.repoIntelligenceParse).toBe("absent");
         expect(facts.availability.tiersPresent.tier1).toBe(false);
     });
+    it("projects preparation warnings and corpus gate reason", () => {
+        const result = {
+            ...baseResult,
+            changedPackages: ["lodash"],
+            analysisPreparation: {
+                codeIntelligenceAvailable: false,
+                warnings: [
+                    {
+                        code: "base_lockfile_missing",
+                        message: "Base lockfile not available",
+                    },
+                ],
+            },
+        };
+        const facts = deriveScanNarrative(result);
+        expect(facts.availability.preparationWarnings).toHaveLength(1);
+        expect(facts.availability.preparationWarnings[0]?.code).toBe("base_lockfile_missing");
+        expect(facts.availability.corpusGateReason).toBe("no_code_intelligence");
+        expect(facts.confidence.limitedContext).toBe(true);
+    });
+    it("links affected areas to packages, findings, paths, and verification", () => {
+        const result = {
+            ...baseResult,
+            changedPackages: ["fastify"],
+            analysisPreparation: analysisPreparationWithValidRepoIntel(),
+            repoIntelligence: fixtureRepoIntelligenceFastify,
+            findings: [
+                {
+                    id: "f1",
+                    title: "Auth middleware",
+                    description: "d",
+                    severity: "high",
+                    packageName: "fastify",
+                },
+            ],
+        };
+        const facts = deriveScanNarrative(result);
+        const apiArea = facts.affectedAreas.find((a) => a.id === "api");
+        expect(apiArea).toBeDefined();
+        expect(apiArea?.packages).toContain("fastify");
+        expect(apiArea?.findingIds).toContain("f1");
+        expect(apiArea?.paths.length).toBeGreaterThan(0);
+        expect(apiArea?.evidenceStrength).toBe("high");
+        expect(apiArea?.hotspotPackages).toContain("fastify");
+        expect(apiArea?.verificationFocus).toContain("routes");
+    });
+    it("derives riskSignals with exposure layers", () => {
+        const facts = deriveScanNarrative(baseResult);
+        expect(facts.riskSignals?.riskIndex).toBe(10);
+        expect(facts.riskSignals?.exposure).toBe("minimal");
+        expect(facts.riskSignals?.layers).toHaveLength(4);
+        expect(facts.riskIndex).toBe(10);
+    });
+    it("projects assessment confidence verbatim", () => {
+        const result = {
+            ...baseResult,
+            assessment: assessmentFastifyRuntime,
+        };
+        const facts = deriveScanNarrative(result);
+        expect(facts.confidence.assessment).toBe("medium");
+    });
 });

package/dist/engineWireRegression.test.js

@@ -70,8 +70,8 @@ describe("engine wire regression (canonical fixtures)", () => {
         const facts = deriveScanNarrative(result);
         expect(facts.availability.mode).toBe("pr_intelligence");
         expect(facts.packageUsage.map((u) => u.packageName)).toEqual([
-            "lodash",
             "axios",
+            "lodash",
         ]);
     });
 });

package/dist/fixtures/assessmentFixtures.d.ts

@@ -1,4 +1,4 @@
-import type { Assessment } from "../assessmentSchema.js";
+import type { Assessment } from "@mergesignal/contracts";
 export declare const assessmentTypescriptPatch: Assessment;
 export declare const assessmentPrettier: Assessment;
 export declare const assessmentEslint: Assessment;
@@ -6,6 +6,7 @@ export declare const assessmentVitest: Assessment;
 export declare const assessmentFastifyRuntime: Assessment;
 export declare const assessmentBullmq: Assessment;
 export declare const assessmentNextAuth: Assessment;
+/** PR #26 — focal fastify despite typescript in changedPackages order. */
 export declare const assessmentMixedTypescriptFastify: Assessment;
 export declare const assessmentLimitedContext: Assessment;
 export declare const assessmentStub: Assessment;

package/dist/fixtures/assessmentFixtures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assessmentFixtures.d.ts","sourceRoot":"","sources":["../../src/fixtures/assessmentFixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAkBzD,eAAO,MAAM,yBAAyB,EAAE,UAQvC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,UAGhC,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UAE9B,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UAQ9B,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,UAetC,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UAmB9B,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,UAehC,CAAC;AAEF,eAAO,MAAM,gCAAgC,EAAE,UAe9C,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,UAoBtC,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,UAoB5B,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,UAcnC,CAAC"}
+{"version":3,"file":"assessmentFixtures.d.ts","sourceRoot":"","sources":["../../src/fixtures/assessmentFixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AA0BzD,eAAO,MAAM,yBAAyB,EAAE,UAevC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,UAUhC,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UAS9B,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UAe9B,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,UAyBtC,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UA6B9B,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,UAyBhC,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,EAAE,UAgC9C,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,UA2BtC,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,UA6B5B,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,UAqBnC,CAAC"}