@mergesignal/shared 0.6.0 → 0.8.0

package/dist/fixtures/assessmentFixtures.js

@@ -1,3 +1,4 @@
+import { emptyReachScope, emptyVerificationScope, minimalReviewFocalPoint, reachScopeFor, verificationScopeFor, withAssessmentScope, } from "./assessmentScopeFixtures.js";
 const safeToolingPresentation = {
     narrativeIntensity: "minimal",
     reachVisibility: "hidden",
@@ -12,7 +13,7 @@ const runtimeReviewPresentation = {
     insightEmissionFloor: "full",
     reportMode: "high_signal_pr",
 };
-export const assessmentTypescriptPatch = {
+export const assessmentTypescriptPatch = withAssessmentScope({
     posture: "safe",
     confidence: "high",
     primaryConcern: null,
@@ -20,15 +21,27 @@ export const assessmentTypescriptPatch = {
     factors: ["tooling_maintenance"],
     changeClasses: ["tooling_maintenance"],
     presentation: safeToolingPresentation,
-};
-export const assessmentPrettier = {
+}, {
+    reviewFocalPoint: minimalReviewFocalPoint(["typescript"]),
+    reachScope: emptyReachScope(),
+    verificationScope: emptyVerificationScope(),
+});
+export const assessmentPrettier = withAssessmentScope({
     ...assessmentTypescriptPatch,
     factors: ["tooling_maintenance"],
-};
-export const assessmentEslint = {
+}, {
+    reviewFocalPoint: minimalReviewFocalPoint(["prettier"]),
+    reachScope: emptyReachScope(),
+    verificationScope: emptyVerificationScope(),
+});
+export const assessmentEslint = withAssessmentScope({
     ...assessmentTypescriptPatch,
-};
-export const assessmentVitest = {
+}, {
+    reviewFocalPoint: minimalReviewFocalPoint(["eslint"]),
+    reachScope: emptyReachScope(),
+    verificationScope: emptyVerificationScope(),
+});
+export const assessmentVitest = withAssessmentScope({
     posture: "safe",
     confidence: "high",
     primaryConcern: null,
@@ -36,8 +49,12 @@ export const assessmentVitest = {
     factors: ["test_infra_change"],
     changeClasses: ["test_infra"],
     presentation: safeToolingPresentation,
-};
-export const assessmentFastifyRuntime = {
+}, {
+    reviewFocalPoint: minimalReviewFocalPoint(["vitest"]),
+    reachScope: emptyReachScope(),
+    verificationScope: emptyVerificationScope(),
+});
+export const assessmentFastifyRuntime = withAssessmentScope({
     posture: "needs_review",
     confidence: "medium",
     primaryConcern: "confirmed_runtime_usage",
@@ -52,8 +69,12 @@ export const assessmentFastifyRuntime = {
     factors: ["confirmed_runtime_usage", "http_framework_infrastructure"],
     changeClasses: ["runtime_upgrade"],
     presentation: runtimeReviewPresentation,
-};
-export const assessmentBullmq = {
+}, {
+    reviewFocalPoint: minimalReviewFocalPoint(["fastify"]),
+    reachScope: reachScopeFor(["fastify"]),
+    verificationScope: verificationScopeFor(["fastify"], ["routes", "middleware"]),
+});
+export const assessmentBullmq = withAssessmentScope({
     posture: "needs_review",
     confidence: "medium",
     primaryConcern: "confirmed_runtime_usage",
@@ -72,8 +93,12 @@ export const assessmentBullmq = {
     ],
     changeClasses: ["runtime_upgrade"],
     presentation: runtimeReviewPresentation,
-};
-export const assessmentNextAuth = {
+}, {
+    reviewFocalPoint: minimalReviewFocalPoint(["bullmq"]),
+    reachScope: reachScopeFor(["bullmq"]),
+    verificationScope: verificationScopeFor(["bullmq"], ["workers", "queue", "serialization"]),
+});
+export const assessmentNextAuth = withAssessmentScope({
     posture: "needs_review",
     confidence: "medium",
     primaryConcern: "confirmed_runtime_usage",
@@ -88,8 +113,13 @@ export const assessmentNextAuth = {
     factors: ["confirmed_runtime_usage", "auth_infrastructure"],
     changeClasses: ["runtime_upgrade"],
     presentation: runtimeReviewPresentation,
-};
-export const assessmentMixedTypescriptFastify = {
+}, {
+    reviewFocalPoint: minimalReviewFocalPoint(["next-auth"]),
+    reachScope: reachScopeFor(["next-auth"]),
+    verificationScope: verificationScopeFor(["next-auth"], ["auth_flow", "session", "routes"]),
+});
+/** PR #26 — focal fastify despite typescript in changedPackages order. */
+export const assessmentMixedTypescriptFastify = withAssessmentScope({
     posture: "needs_review",
     confidence: "medium",
     primaryConcern: "confirmed_runtime_usage",
@@ -101,11 +131,22 @@ export const assessmentMixedTypescriptFastify = {
             evidenceRefs: ["fixture:fastify"],
         },
     ],
-    factors: ["confirmed_runtime_usage", "http_framework_infrastructure"],
+    factors: [
+        "confirmed_runtime_usage",
+        "queue_infrastructure",
+        "http_framework_infrastructure",
+    ],
     changeClasses: ["runtime_upgrade", "tooling_maintenance"],
     presentation: runtimeReviewPresentation,
-};
-export const assessmentLimitedContext = {
+}, {
+    reviewFocalPoint: minimalReviewFocalPoint(["fastify"], {
+        episodeShape: "parent_supporting",
+        supportingPackages: ["bullmq", "next-auth"],
+    }),
+    reachScope: reachScopeFor(["bullmq", "fastify", "next-auth"]),
+    verificationScope: verificationScopeFor(["bullmq", "fastify", "next-auth"], ["workers", "queue", "routes", "middleware"]),
+});
+export const assessmentLimitedContext = withAssessmentScope({
     posture: "needs_review",
     confidence: "low",
     primaryConcern: "insufficient_evidence",
@@ -125,8 +166,12 @@ export const assessmentLimitedContext = {
         insightEmissionFloor: "none",
         reportMode: "high_signal_pr",
     },
-};
-export const assessmentStub = {
+}, {
+    reviewFocalPoint: minimalReviewFocalPoint(["lodash"]),
+    reachScope: emptyReachScope(),
+    verificationScope: emptyVerificationScope(),
+});
+export const assessmentStub = withAssessmentScope({
     posture: "needs_review",
     confidence: "low",
     primaryConcern: "insufficient_evidence",
@@ -146,8 +191,14 @@ export const assessmentStub = {
         insightEmissionFloor: "none",
         reportMode: "high_signal_pr",
     },
-};
-export const assessmentUnknownSafe = {
+}, {
+    reviewFocalPoint: minimalReviewFocalPoint(["dependency_graph"], {
+        episodeShape: "structural",
+    }),
+    reachScope: emptyReachScope(),
+    verificationScope: emptyVerificationScope(),
+});
+export const assessmentUnknownSafe = withAssessmentScope({
     posture: "safe",
     confidence: "medium",
     primaryConcern: null,
@@ -161,4 +212,8 @@ export const assessmentUnknownSafe = {
         insightEmissionFloor: "explain_only",
         reportMode: "high_signal_pr",
     },
-};
+}, {
+    reviewFocalPoint: minimalReviewFocalPoint(["opaque-pkg"]),
+    reachScope: emptyReachScope(),
+    verificationScope: emptyVerificationScope(),
+});

package/dist/fixtures/assessmentScopeFixtures.d.ts

@@ -0,0 +1,17 @@
+import type { Assessment, FocalElectionDimension, ReachScope, ReviewEpisodeShape, ReviewFocalPoint, VerificationScope } from "@mergesignal/contracts";
+export declare function minimalReviewFocalPoint(anchors: string[], opts?: {
+    episodeShape?: ReviewEpisodeShape;
+    supportingPackages?: string[];
+    decidedBy?: FocalElectionDimension;
+}): ReviewFocalPoint;
+export declare function emptyReachScope(): ReachScope;
+export declare function reachScopeFor(packages: string[], maxBucket?: ReachScope["maxBucket"]): ReachScope;
+export declare function emptyVerificationScope(): VerificationScope;
+export declare function verificationScopeFor(packages: string[], focus?: string[]): VerificationScope;
+/** Attach focal/scope fields required by assessmentSchema ABI 2. */
+export declare function withAssessmentScope(assessment: Omit<Assessment, "reviewFocalPoint" | "reachScope" | "verificationScope">, scope: {
+    reviewFocalPoint: ReviewFocalPoint;
+    reachScope?: ReachScope;
+    verificationScope?: VerificationScope;
+}): Assessment;
+//# sourceMappingURL=assessmentScopeFixtures.d.ts.map

package/dist/fixtures/assessmentScopeFixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assessmentScopeFixtures.d.ts","sourceRoot":"","sources":["../../src/fixtures/assessmentScopeFixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAEhC,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,CAAC,EAAE;IACL,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACpC,GACA,gBAAgB,CAoBlB;AAED,wBAAgB,eAAe,IAAI,UAAU,CAE5C;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAAE,EAClB,SAAS,GAAE,UAAU,CAAC,WAAW,CAAc,GAC9C,UAAU,CAEZ;AAED,wBAAgB,sBAAsB,IAAI,iBAAiB,CAE1D;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAAE,EAClB,KAAK,GAAE,MAAM,EAAO,GACnB,iBAAiB,CAEnB;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,IAAI,CACd,UAAU,EACV,kBAAkB,GAAG,YAAY,GAAG,mBAAmB,CACxD,EACD,KAAK,EAAE;IACL,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC,GACA,UAAU,CAOZ"}

package/dist/fixtures/assessmentScopeFixtures.js

@@ -0,0 +1,42 @@
+export function minimalReviewFocalPoint(anchors, opts) {
+    const episodeShape = opts?.episodeShape ?? "single_anchor";
+    const decidedBy = opts?.decidedBy ?? "reach";
+    const primary = anchors[0] ?? "dependency";
+    return {
+        episodeShape,
+        anchors,
+        supportingPackages: opts?.supportingPackages,
+        election: {
+            grounding: [
+                {
+                    packageName: primary,
+                    reason: "fixture",
+                    decidedBy,
+                    evidenceRefs: ["fixture:focal"],
+                },
+            ],
+            exclusions: [],
+        },
+    };
+}
+export function emptyReachScope() {
+    return { packages: [], maxBucket: "very_low" };
+}
+export function reachScopeFor(packages, maxBucket = "moderate") {
+    return { packages, maxBucket };
+}
+export function emptyVerificationScope() {
+    return { packages: [], focus: [] };
+}
+export function verificationScopeFor(packages, focus = []) {
+    return { packages, focus };
+}
+/** Attach focal/scope fields required by assessmentSchema ABI 2. */
+export function withAssessmentScope(assessment, scope) {
+    return {
+        ...assessment,
+        reviewFocalPoint: scope.reviewFocalPoint,
+        reachScope: scope.reachScope ?? emptyReachScope(),
+        verificationScope: scope.verificationScope ?? emptyVerificationScope(),
+    };
+}

package/dist/formatCardExposureDisplay.d.ts

@@ -1,6 +1,6 @@
 /**
- * Dashboard card exposure semantics — display-only interpretation of totalScore.
- * Not persisted; not an engine output; complements merge posture (Safe / Review / Risky).
+ * Canonical exposure bucket thresholds for numeric risk scores (0–100).
+ * Consumed by `deriveRiskSignals` for bundle facts; label formatters remain for aria copy.
  */
 export type CardExposureCategory = "minimal" | "limited" | "moderate" | "elevated" | "broad";
 export type CardExposureDisplay = {
@@ -11,7 +11,9 @@ export type CardExposureDisplay = {
 };
 /** User-facing exposure labels for docs and UI copy (low → high). */
 export declare const CARD_EXPOSURE_CATEGORY_LABELS: readonly string[];
-/** Map numeric totalScore to a fixed exposure category (card UX only). */
+/** Map numeric score to a fixed exposure category (canonical thresholds). */
+export declare function deriveCardExposureCategory(score: number | null | undefined): CardExposureCategory | null;
+/** Map numeric totalScore to exposure category + display label. */
 export declare function deriveCardExposureDisplay(score: number | null | undefined): CardExposureDisplay | null;
 /** Compact card line: exposure category label only. */
 export declare function formatCardExposureLine(score: number | null | undefined): string | null;

package/dist/formatCardExposureDisplay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"formatCardExposureDisplay.d.ts","sourceRoot":"","sources":["../src/formatCardExposureDisplay.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,oBAAoB,GAC5B,SAAS,GACT,SAAS,GACT,UAAU,GACV,UAAU,GACV,OAAO,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAUF,qEAAqE;AACrE,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAM1D,CAAC;AAkBF,0EAA0E;AAC1E,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,mBAAmB,GAAG,IAAI,CAM5B;AAED,uDAAuD;AACvD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAIf;AAED,sDAAsD;AACtD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAIf"}
+{"version":3,"file":"formatCardExposureDisplay.d.ts","sourceRoot":"","sources":["../src/formatCardExposureDisplay.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,oBAAoB,GAC5B,SAAS,GACT,SAAS,GACT,UAAU,GACV,UAAU,GACV,OAAO,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAUF,qEAAqE;AACrE,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAM1D,CAAC;AAkBF,6EAA6E;AAC7E,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,oBAAoB,GAAG,IAAI,CAK7B;AAED,mEAAmE;AACnE,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,mBAAmB,GAAG,IAAI,CAK5B;AAED,uDAAuD;AACvD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAIf;AAED,sDAAsD;AACtD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAIf"}

package/dist/formatCardExposureDisplay.js

@@ -1,6 +1,6 @@
 /**
- * Dashboard card exposure semantics — display-only interpretation of totalScore.
- * Not persisted; not an engine output; complements merge posture (Safe / Review / Risky).
+ * Canonical exposure bucket thresholds for numeric risk scores (0–100).
+ * Consumed by `deriveRiskSignals` for bundle facts; label formatters remain for aria copy.
  */
 const EXPOSURE_LABEL = {
     minimal: "Minimal exposure",
@@ -31,13 +31,20 @@ function clampScore(score) {
         return 0;
     return Math.min(100, Math.max(0, Math.round(score)));
 }
-/** Map numeric totalScore to a fixed exposure category (card UX only). */
-export function deriveCardExposureDisplay(score) {
+/** Map numeric score to a fixed exposure category (canonical thresholds). */
+export function deriveCardExposureCategory(score) {
     if (score == null || !Number.isFinite(score))
         return null;
     const value = clampScore(score);
     const idx = EXPOSURE_UPPER_BOUND.findIndex((bound) => value <= bound);
-    const category = EXPOSURE_ORDER[idx >= 0 ? idx : EXPOSURE_ORDER.length - 1];
+    return EXPOSURE_ORDER[idx >= 0 ? idx : EXPOSURE_ORDER.length - 1];
+}
+/** Map numeric totalScore to exposure category + display label. */
+export function deriveCardExposureDisplay(score) {
+    const category = deriveCardExposureCategory(score);
+    if (category == null)
+        return null;
+    const value = clampScore(score);
     return { category, label: EXPOSURE_LABEL[category], value };
 }
 /** Compact card line: exposure category label only. */

package/dist/formatCardExposureDisplay.test.js

@@ -1,5 +1,13 @@
 import { describe, expect, it } from "vitest";
-import { deriveCardExposureDisplay, exposureAriaFragment, formatCardExposureLine, } from "./formatCardExposureDisplay.js";
+import { deriveCardExposureCategory, deriveCardExposureDisplay, exposureAriaFragment, formatCardExposureLine, } from "./formatCardExposureDisplay.js";
+describe("deriveCardExposureCategory", () => {
+    it("maps score ranges to exposure categories", () => {
+        expect(deriveCardExposureCategory(0)).toBe("minimal");
+        expect(deriveCardExposureCategory(45)).toBe("moderate");
+        expect(deriveCardExposureCategory(90)).toBe("broad");
+        expect(deriveCardExposureCategory(null)).toBeNull();
+    });
+});
 describe("deriveCardExposureDisplay", () => {
     it("maps score to five fixed exposure buckets", () => {
         expect(deriveCardExposureDisplay(0)?.category).toBe("minimal");

package/dist/index.d.ts

@@ -1,5 +1,4 @@
 export * from "./types.js";
-export * from "./assessmentSchema.js";
 export * from "./assessmentLabels.js";
 export * from "./assessmentProjection.js";
 export * from "./formatInsight.js";
@@ -29,4 +28,6 @@ export * from "./trustedScanGuards.js";
 export * from "./actionsStepSummary.js";
 export * from "./productMessaging.js";
 export * from "./presentation/index.js";
+export { emptyReachScope, emptyVerificationScope, minimalReviewFocalPoint, reachScopeFor, verificationScopeFor, withAssessmentScope, } from "./fixtures/assessmentScopeFixtures.js";
+export { assessmentStub, assessmentTypescriptPatch, } from "./fixtures/assessmentFixtures.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,0BAA0B,CAAC;AACzC,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,OAAO,EAAE,wCAAwC,EAAE,MAAM,6BAA6B,CAAC;AACvF,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,0BAA0B,CAAC;AACzC,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,OAAO,EAAE,wCAAwC,EAAE,MAAM,6BAA6B,CAAC;AACvF,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,cAAc,EACd,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -1,5 +1,4 @@
 export * from "./types.js";
-export * from "./assessmentSchema.js";
 export * from "./assessmentLabels.js";
 export * from "./assessmentProjection.js";
 export * from "./formatInsight.js";
@@ -29,3 +28,5 @@ export * from "./trustedScanGuards.js";
 export * from "./actionsStepSummary.js";
 export * from "./productMessaging.js";
 export * from "./presentation/index.js";
+export { emptyReachScope, emptyVerificationScope, minimalReviewFocalPoint, reachScopeFor, verificationScopeFor, withAssessmentScope, } from "./fixtures/assessmentScopeFixtures.js";
+export { assessmentStub, assessmentTypescriptPatch, } from "./fixtures/assessmentFixtures.js";

package/dist/presentation/buildGitHubCheckRunOutput.test.js

@@ -1,22 +1,10 @@
 import { describe, expect, it } from "vitest";
+import { assessmentFastifyRuntime, assessmentTypescriptPatch, } from "../fixtures/assessmentFixtures.js";
+import { withAssessmentScope, minimalReviewFocalPoint, emptyReachScope, emptyVerificationScope, reachScopeFor, } from "../fixtures/assessmentScopeFixtures.js";
 import { buildScanPresentationBundle, presentDashboardCard } from "./index.js";
 import { buildGitHubCheckRunOutput } from "./buildGitHubCheckRunOutput.js";
-const safeAssessment = {
-    posture: "safe",
-    confidence: "high",
-    primaryConcern: null,
-    concerns: [],
-    factors: ["tooling_maintenance"],
-    changeClasses: ["tooling_maintenance"],
-    presentation: {
-        narrativeIntensity: "minimal",
-        reachVisibility: "hidden",
-        verificationIntensity: "advisory",
-        insightEmissionFloor: "none",
-        reportMode: "high_signal_pr",
-    },
-};
-const baselineAssessment = {
+const safeAssessment = assessmentTypescriptPatch;
+const baselineAssessment = withAssessmentScope({
     posture: "safe",
     confidence: "medium",
     primaryConcern: "graph_baseline_only",
@@ -36,30 +24,13 @@ const baselineAssessment = {
         insightEmissionFloor: "none",
         reportMode: "lightweight_pr_graph_baseline",
     },
-};
-const needsReviewAssessment = {
-    posture: "needs_review",
-    confidence: "medium",
-    primaryConcern: "confirmed_runtime_usage",
-    concerns: [
-        {
-            kind: "confirmed_runtime_usage",
-            rank: 1,
-            packages: ["fastify"],
-            evidenceRefs: ["fixture:fastify"],
-        },
-    ],
-    factors: ["confirmed_runtime_usage", "http_framework_infrastructure"],
-    changeClasses: ["runtime_upgrade"],
-    presentation: {
-        narrativeIntensity: "elevated",
-        reachVisibility: "prominent",
-        verificationIntensity: "required",
-        insightEmissionFloor: "full",
-        reportMode: "high_signal_pr",
-    },
-};
-const riskyAssessment = {
+}, {
+    reviewFocalPoint: minimalReviewFocalPoint(["@types/minimist"]),
+    reachScope: emptyReachScope(),
+    verificationScope: emptyVerificationScope(),
+});
+const needsReviewAssessment = assessmentFastifyRuntime;
+const riskyAssessment = withAssessmentScope({
     posture: "risky",
     confidence: "high",
     primaryConcern: "breaking_or_major",
@@ -80,7 +51,11 @@ const riskyAssessment = {
         insightEmissionFloor: "full",
         reportMode: "high_signal_pr",
     },
-};
+}, {
+    reviewFocalPoint: minimalReviewFocalPoint(["react"]),
+    reachScope: reachScopeFor(["react"], "high"),
+    verificationScope: emptyVerificationScope(),
+});
 function assertNoLegacyCheckRunMarkers(summary) {
     expect(summary).not.toContain("Risk index");
     expect(summary).not.toContain("Layer scores");

package/dist/presentation/compose/narrativeChannels.js

@@ -19,7 +19,7 @@ export function buildNarrativeChannels(bundle) {
     const { assessment, presentation, profile, result } = bundle;
     const reachLabel = reachVisibilityLabel(presentation.reachVisibility);
     return {
-        headline: formatAssessmentHeadline(assessment, result, profile.status),
+        headline: formatAssessmentHeadline(assessment, profile.status),
         limitedContextMessage: profile.degradedMessage ?? undefined,
         reachLabel,
         insights: projectInsightLines(assessment, result),

package/dist/presentation/dto/assessmentPresentationFields.d.ts

@@ -1,5 +1,4 @@
-import type { MergeConcernKind } from "../../assessmentSchema.js";
-import type { NarrativeIntensity, ReachVisibility } from "../../assessmentSchema.js";
+import type { MergeConcernKind, NarrativeIntensity, ReachVisibility } from "@mergesignal/contracts";
 /** Assessment-aligned fields projected identically across surfaces. */
 export type AssessmentPresentationFields = {
     posture: "safe" | "needs_review" | "risky";

package/dist/presentation/dto/assessmentPresentationFields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assessmentPresentationFields.d.ts","sourceRoot":"","sources":["../../../src/presentation/dto/assessmentPresentationFields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EAEhB,MAAM,2BAA2B,CAAC;AAEnC,uEAAuE;AACvE,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,OAAO,CAAC;IAC3C,cAAc,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC,CAAC"}
+{"version":3,"file":"assessmentPresentationFields.d.ts","sourceRoot":"","sources":["../../../src/presentation/dto/assessmentPresentationFields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EAEhB,MAAM,wBAAwB,CAAC;AAEhC,uEAAuE;AACvE,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,OAAO,CAAC;IAC3C,cAAc,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC,CAAC"}

package/dist/presentation/fixtures/scanResultFixtures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanResultFixtures.d.ts","sourceRoot":"","sources":["../../../src/presentation/fixtures/scanResultFixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAYjD,eAAO,MAAM,wBAAwB,EAAE,UAiCtC,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,UA2BvC,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,UA4BtC,CAAC"}
+{"version":3,"file":"scanResultFixtures.d.ts","sourceRoot":"","sources":["../../../src/presentation/fixtures/scanResultFixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAYjD,eAAO,MAAM,wBAAwB,EAAE,UA0CtC,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,UA2BvC,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,UAqCtC,CAAC"}

package/dist/presentation/fixtures/scanResultFixtures.js

@@ -9,7 +9,16 @@ export const scanResultFastifyRuntime = {
         ecosystem: 30,
         upgradeImpact: 15,
     },
-    findings: [],
+    findings: [
+        {
+            id: "finding-fastify-runtime",
+            title: "Runtime middleware coupling",
+            description: "Fastify middleware ordering may affect auth paths.",
+            severity: "medium",
+            packageName: "fastify",
+            recommendation: "Run auth smoke tests",
+        },
+    ],
     generatedAt: "2026-01-01T00:00:00.000Z",
     changedPackages: ["fastify"],
     analysisPreparation: analysisPreparationWithValidRepoIntel(),
@@ -74,6 +83,15 @@ export const scanResultLimitedContext = {
     findings: [],
     generatedAt: "2026-01-01T00:00:00.000Z",
     changedPackages: ["lodash"],
+    analysisPreparation: {
+        codeIntelligenceAvailable: false,
+        warnings: [
+            {
+                code: "base_lockfile_missing",
+                message: "Base lockfile not available for diff",
+            },
+        ],
+    },
     repoIntelligence: { invalid: true },
     assessment: assessmentLimitedContext,
     graphInsights: {

package/dist/presentation/orchestration/buildScanPresentationBundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buildScanPresentationBundle.d.ts","sourceRoot":"","sources":["../../../src/presentation/orchestration/buildScanPresentationBundle.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAE1E,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,EAAE,UAAU,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,gCAAgC,GACtC,sBAAsB,GAAG,IAAI,CAsB/B"}
+{"version":3,"file":"buildScanPresentationBundle.d.ts","sourceRoot":"","sources":["../../../src/presentation/orchestration/buildScanPresentationBundle.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAE1E,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,EAAE,UAAU,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,gCAAgC,GACtC,sBAAsB,GAAG,IAAI,CA4B/B"}

package/dist/presentation/orchestration/buildScanPresentationBundle.js

@@ -1,4 +1,5 @@
-import { parseAssessmentOrThrow, toPublicPresentation, } from "../../assessmentSchema.js";
+import { parseAssessmentOrThrow } from "@mergesignal/contracts";
+import { toPublicPresentation } from "../../assessmentPresentationUtils.js";
 import { deriveScanNarrative } from "../../deriveScanNarrative.js";
 import { buildProfileFromAssessment } from "../profile/buildProfileFromAssessment.js";
 /**
@@ -11,12 +12,18 @@ export function buildScanPresentationBundle(input) {
     const assessment = input.result.assessment;
     if (!assessment)
         return null;
-    parseAssessmentOrThrow(assessment);
-    const presentation = toPublicPresentation(assessment.presentation);
-    const profile = buildProfileFromAssessment(assessment, presentation, input.result);
+    let normalized;
+    try {
+        normalized = parseAssessmentOrThrow(assessment);
+    }
+    catch {
+        return null;
+    }
+    const presentation = toPublicPresentation(normalized.presentation);
+    const profile = buildProfileFromAssessment(normalized, presentation, input.result);
     const facts = deriveScanNarrative(input.result);
     return {
-        assessment,
+        assessment: normalized,
         presentation,
         profile,
         facts,

package/dist/presentation/orchestration/buildScanPresentationBundle.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=buildScanPresentationBundle.test.d.ts.map

package/dist/presentation/orchestration/buildScanPresentationBundle.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildScanPresentationBundle.test.d.ts","sourceRoot":"","sources":["../../../src/presentation/orchestration/buildScanPresentationBundle.test.ts"],"names":[],"mappings":""}

package/dist/presentation/orchestration/buildScanPresentationBundle.test.js

@@ -0,0 +1,99 @@
+import { parseAssessmentOrThrow } from "@mergesignal/contracts";
+import { describe, expect, it } from "vitest";
+import { assessmentTypescriptPatch } from "../../fixtures/assessmentFixtures.js";
+import { buildScanCardPresentation } from "./buildScanCardPresentation.js";
+import { buildScanPresentationBundle } from "./buildScanPresentationBundle.js";
+const abi1Assessment = {
+    posture: "safe",
+    confidence: "high",
+    primaryConcern: null,
+    concerns: [],
+    factors: ["tooling_maintenance"],
+    changeClasses: ["tooling_maintenance"],
+    presentation: {
+        narrativeIntensity: "minimal",
+        reachVisibility: "hidden",
+        verificationIntensity: "advisory",
+        insightEmissionFloor: "none",
+        reportMode: "high_signal_pr",
+    },
+};
+function minimalScanResult(assessment) {
+    return {
+        totalScore: 42,
+        layerScores: {
+            security: 10,
+            maintainability: 20,
+            ecosystem: 30,
+            upgradeImpact: 40,
+        },
+        findings: [],
+        generatedAt: "2026-01-01T00:00:00.000Z",
+        decision: {
+            recommendation: "safe",
+            confidence: "high",
+            reasoning: [],
+        },
+        assessment,
+    };
+}
+describe("buildScanPresentationBundle (presentation boundary)", () => {
+    it("ABI-2 assessment produces a bundle", () => {
+        const result = minimalScanResult(assessmentTypescriptPatch);
+        const bundle = buildScanPresentationBundle({
+            result,
+            pipelineStatus: "done",
+        });
+        expect(bundle).not.toBeNull();
+        expect(bundle.assessment.reviewFocalPoint.anchors).toContain("typescript");
+    });
+    it("ABI-2 assessment renders a dashboard card headline", () => {
+        const result = minimalScanResult(assessmentTypescriptPatch);
+        const card = buildScanCardPresentation({
+            pipelineStatus: "done",
+            result,
+        });
+        expect(card.headline.length).toBeGreaterThan(0);
+    });
+    it("ABI-1 assessment returns null without throwing", () => {
+        const result = minimalScanResult(abi1Assessment);
+        expect(() => buildScanPresentationBundle({
+            result,
+            pipelineStatus: "done",
+        })).not.toThrow();
+        expect(buildScanPresentationBundle({
+            result,
+            pipelineStatus: "done",
+        })).toBeNull();
+    });
+    it("ABI-1 assessment does not mutate stored assessment JSON", () => {
+        const result = minimalScanResult(structuredClone(abi1Assessment));
+        const before = JSON.stringify(result.assessment);
+        buildScanPresentationBundle({ result, pipelineStatus: "done" });
+        expect(JSON.stringify(result.assessment)).toBe(before);
+        expect(result.assessment).not.toHaveProperty("reviewFocalPoint");
+    });
+    it("ABI-1 direct parseAssessmentOrThrow still throws (contracts strict)", () => {
+        expect(() => parseAssessmentOrThrow(abi1Assessment)).toThrow();
+    });
+    it("mixed PR index: ABI-2 ok and ABI-1 degraded without throw", () => {
+        const abi2 = minimalScanResult(assessmentTypescriptPatch);
+        const abi1 = minimalScanResult(abi1Assessment);
+        for (const result of [abi2, abi1]) {
+            expect(() => buildScanCardPresentation({
+                pipelineStatus: "done",
+                result,
+            })).not.toThrow();
+        }
+        const abi2Card = buildScanCardPresentation({
+            pipelineStatus: "done",
+            result: abi2,
+        });
+        const abi1Card = buildScanCardPresentation({
+            pipelineStatus: "done",
+            result: abi1,
+        });
+        expect(abi2Card.headline.length).toBeGreaterThan(0);
+        expect(abi1Card.pipeline?.status).toBe("failed");
+    });
+});

package/dist/presentation/orchestration/scanPresentationBundle.d.ts

@@ -1,4 +1,4 @@
-import type { Assessment, AssessmentPresentationPublic } from "../../assessmentSchema.js";
+import type { Assessment, AssessmentPresentationPublic } from "@mergesignal/contracts";
 import type { ScanNarrativeFacts } from "../../scanNarrativeFacts.js";
 import type { ScanResult } from "../../types.js";
 import type { PresentationProfile } from "../profile/presentationProfile.js";