@mergesignal/shared 0.7.0 → 0.8.1

package/dist/affectedAreaLinkage.d.ts

@@ -0,0 +1,14 @@
+import type { AffectedAreaFact, ChangedPackageSemantics, NarrativePackageUsage, ScanNarrativeFacts } from "./scanNarrativeFacts.js";
+import type { Finding } from "./types.js";
+export declare function areaIdFromLabel(label: string): string;
+export declare function enrichAffectedAreaFacts(areas: Array<{
+    id: string;
+    label: string;
+}>, ctx: {
+    findings: Finding[];
+    packageUsage: NarrativePackageUsage[];
+    changedPackageSemantics: ChangedPackageSemantics[];
+    hotspots: ScanNarrativeFacts["hotspots"];
+    applicationAreaIds: ReadonlySet<string>;
+}): AffectedAreaFact[];
+//# sourceMappingURL=affectedAreaLinkage.d.ts.map

package/dist/affectedAreaLinkage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"affectedAreaLinkage.d.ts","sourceRoot":"","sources":["../src/affectedAreaLinkage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EAErB,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAQ1C,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAuGD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAC3C,GAAG,EAAE;IACH,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,qBAAqB,EAAE,CAAC;IACtC,uBAAuB,EAAE,uBAAuB,EAAE,CAAC;IACnD,QAAQ,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACzC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACzC,GACA,gBAAgB,EAAE,CAwBpB"}

package/dist/affectedAreaLinkage.js

@@ -0,0 +1,100 @@
+const EVIDENCE_STRENGTH_RANK = {
+    high: 3,
+    medium: 2,
+    low: 1,
+};
+export function areaIdFromLabel(label) {
+    return label.toLowerCase().replace(/\s+/g, "_").slice(0, 48);
+}
+function packagesForArea(area, packageUsage, applicationAreaIds) {
+    const linked = new Set();
+    for (const row of packageUsage) {
+        for (const usageArea of row.areas) {
+            if (areaIdFromLabel(usageArea) === area.id ||
+                usageArea.toLowerCase() === area.label.toLowerCase()) {
+                linked.add(row.packageName);
+            }
+        }
+    }
+    if (applicationAreaIds.has(area.id)) {
+        for (const row of packageUsage) {
+            linked.add(row.packageName);
+        }
+    }
+    return [...linked].sort((a, b) => a.localeCompare(b));
+}
+function findingIdsForPackages(findings, packages) {
+    if (packages.length === 0)
+        return [];
+    const pkgSet = new Set(packages);
+    return findings.filter((f) => pkgSet.has(f.packageName)).map((f) => f.id);
+}
+function pathsForPackages(packageUsage, packages) {
+    const pkgSet = new Set(packages);
+    const paths = [];
+    for (const row of packageUsage) {
+        if (!pkgSet.has(row.packageName))
+            continue;
+        paths.push(...row.paths, ...row.criticalPaths, ...row.files);
+    }
+    const seen = new Set();
+    return paths.filter((p) => {
+        if (!p || seen.has(p))
+            return false;
+        seen.add(p);
+        return true;
+    });
+}
+function evidenceStrengthForPackages(semantics, packages) {
+    const pkgSet = new Set(packages);
+    let best = null;
+    let bestRank = 0;
+    for (const row of semantics) {
+        if (!pkgSet.has(row.packageName) || !row.evidenceStrength)
+            continue;
+        const rank = EVIDENCE_STRENGTH_RANK[row.evidenceStrength];
+        if (rank > bestRank) {
+            bestRank = rank;
+            best = row.evidenceStrength;
+        }
+    }
+    return best;
+}
+function hotspotPackagesForPackages(hotspots, packages) {
+    const pkgSet = new Set(packages);
+    const linked = new Set();
+    for (const hotspot of hotspots) {
+        if (pkgSet.has(hotspot.packageName)) {
+            linked.add(hotspot.packageName);
+        }
+    }
+    return [...linked].sort((a, b) => a.localeCompare(b));
+}
+function verificationFocusForPackages(semantics, packages) {
+    const pkgSet = new Set(packages);
+    const focus = new Set();
+    for (const row of semantics) {
+        if (!pkgSet.has(row.packageName))
+            continue;
+        for (const item of row.verificationFocus) {
+            if (item.trim())
+                focus.add(item.trim());
+        }
+    }
+    return [...focus].sort((a, b) => a.localeCompare(b));
+}
+export function enrichAffectedAreaFacts(areas, ctx) {
+    return areas.map((area) => {
+        const packages = packagesForArea(area, ctx.packageUsage, ctx.applicationAreaIds);
+        return {
+            id: area.id,
+            label: area.label,
+            packages,
+            findingIds: findingIdsForPackages(ctx.findings, packages),
+            paths: pathsForPackages(ctx.packageUsage, packages),
+            evidenceStrength: evidenceStrengthForPackages(ctx.changedPackageSemantics, packages),
+            hotspotPackages: hotspotPackagesForPackages(ctx.hotspots, packages),
+            verificationFocus: verificationFocusForPackages(ctx.changedPackageSemantics, packages),
+        };
+    });
+}

package/dist/deriveScanNarrative.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deriveScanNarrative.d.ts","sourceRoot":"","sources":["../src/deriveScanNarrative.ts"],"names":[],"mappings":"AAOA,OAAO,EAeL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAKV,UAAU,EACX,MAAM,YAAY,CAAC;AAqfpB;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACpC,kBAAkB,CAwGpB"}
+{"version":3,"file":"deriveScanNarrative.d.ts","sourceRoot":"","sources":["../src/deriveScanNarrative.ts"],"names":[],"mappings":"AAYA,OAAO,EAgBL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAMV,UAAU,EACX,MAAM,YAAY,CAAC;AAoiBpB;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACpC,kBAAkB,CAsIpB"}

package/dist/deriveScanNarrative.js

@@ -1,6 +1,8 @@
 import { extractRepositoryContextFacts } from "./extractRepositoryContextFacts.js";
+import { areaIdFromLabel, enrichAffectedAreaFacts, } from "./affectedAreaLinkage.js";
 import { readBlastLevel, safeParseRepoIntelligence, } from "./repoIntelligenceSchema.js";
 import { isRuntimeNarrativeSafe } from "./repoIntelligenceSemantics.js";
+import { deriveRiskSignals } from "./riskSignals.js";
 import { EMPTY_SCAN_NARRATIVE_FACTS, NARRATIVE_FACT_MAX_AREAS, NARRATIVE_FACT_MAX_HOTSPOTS, NARRATIVE_FACT_MAX_PATHS, } from "./scanNarrativeFacts.js";
 import { mergePostureFromDecision } from "./riskVocabulary.js";
 import { selectTopAffectedAreas } from "./selectTopAffectedAreas.js";
@@ -224,13 +226,15 @@ function extractTier1FromRepoIntelligence(ri, changed) {
         }
         : null;
     const areasRaw = ri.applicationAreas ?? ri.affectedAreas ?? [];
+    const applicationAreaIds = new Set();
     const affectedAreas = [];
     for (const area of areasRaw) {
+        applicationAreaIds.add(area.id);
         affectedAreas.push({ id: area.id, label: area.label });
     }
     for (const row of packageUsage) {
         for (const label of row.areas) {
-            const id = label.toLowerCase().replace(/\s+/g, "_");
+            const id = areaIdFromLabel(label);
             if (!affectedAreas.some((a) => a.id === id)) {
                 affectedAreas.push({ id, label });
             }
@@ -247,6 +251,7 @@ function extractTier1FromRepoIntelligence(ri, changed) {
         blastRadius,
         affectedAreas: affectedAreas.slice(0, NARRATIVE_FACT_MAX_AREAS),
         hotspots: codeHotspots.slice(0, NARRATIVE_FACT_MAX_HOTSPOTS),
+        applicationAreaIds,
     };
 }
 function hasMeaningfulTier1(tier1) {
@@ -341,6 +346,7 @@ function emptyTier1Blocks() {
         blastRadius: null,
         affectedAreas: [],
         hotspots: [],
+        applicationAreaIds: new Set(),
     };
 }
 function blastRadiusFromChangedCount(count) {
@@ -368,6 +374,38 @@ function resolveTrustedRepoIntelligence(result) {
     }
     return { parsed: null, parseStatus: "invalid" };
 }
+function preparationWarningsFromResult(result) {
+    const warnings = result.analysisPreparation?.warnings;
+    if (!Array.isArray(warnings))
+        return [];
+    return warnings.map((w) => ({
+        code: w.code,
+        message: w.message,
+        ...(w.details != null ? { details: w.details } : {}),
+    }));
+}
+function resolveCorpusGateReason(input) {
+    if (input.corpusGate)
+        return "ok";
+    if (!input.codeIntelligenceAvailable)
+        return "no_code_intelligence";
+    if (input.repoIntelligenceParse === "invalid" ||
+        input.repoIntelligenceParse === "untrusted") {
+        return "repo_intelligence_invalid";
+    }
+    return "repo_intelligence_absent";
+}
+function assessmentConfidenceFromResult(result) {
+    const c = result.assessment?.confidence;
+    if (c === "low" || c === "medium" || c === "high")
+        return c;
+    return null;
+}
+function limitedContextDiagnostic(input) {
+    return (input.corpusGateReason !== "ok" ||
+        input.preparationWarnings.length > 0 ||
+        input.assessmentConfidence === "low");
+}
 /**
  * Consumer-agnostic scan intelligence — structured facts only (no UI copy).
  */
@@ -377,23 +415,29 @@ export function deriveScanNarrative(result) {
     }
     const changedPackages = changedPackagesFromAssessment(result);
     const mergePosture = mergePostureFromDecision(result.decision?.recommendation) ?? null;
-    const riskIndex = typeof result.totalScore === "number" && Number.isFinite(result.totalScore)
-        ? result.totalScore
-        : null;
+    const preparationWarnings = preparationWarningsFromResult(result);
     const codeIntelligenceAvailable = result.analysisPreparation?.codeIntelligenceAvailable !== false;
     const { parsed: parsedRi, parseStatus: repoIntelligenceParse } = resolveTrustedRepoIntelligence(result);
     const corpusGate = codeIntelligenceAvailable &&
         repoIntelligenceParse === "ok" &&
         parsedRi != null;
+    const corpusGateReason = resolveCorpusGateReason({
+        codeIntelligenceAvailable,
+        repoIntelligenceParse,
+        corpusGate,
+    });
     let tier1Blocks = emptyTier1Blocks();
+    let applicationAreaIds = tier1Blocks.applicationAreaIds;
     if (corpusGate && parsedRi) {
         tier1Blocks = extractTier1FromRepoIntelligence(parsedRi, changedPackages);
+        applicationAreaIds = tier1Blocks.applicationAreaIds;
     }
     else if (changedPackages.all.length > 0) {
         tier1Blocks = {
             ...emptyTier1Blocks(),
             blastRadius: blastRadiusFromChangedCount(changedPackages.all.length),
         };
+        applicationAreaIds = tier1Blocks.applicationAreaIds;
     }
     tier1Blocks.hotspots = mergeGraphHotspots(tier1Blocks.hotspots, result.graphInsights?.hotspots);
     const tier1 = corpusGate && hasMeaningfulTier1(tier1Blocks);
@@ -403,23 +447,40 @@ export function deriveScanNarrative(result) {
     const tier3 = repositoryContext.length > 0;
     const mode = resolveAvailabilityMode(tier1, tier2 || reviewerGuidance.length > 0, codeIntelligenceAvailable);
     const decisionConf = result.decision?.confidence;
+    const assessmentConfidence = assessmentConfidenceFromResult(result);
     const confidence = {
         decision: decisionConf === "low" ||
             decisionConf === "medium" ||
             decisionConf === "high"
             ? decisionConf
             : null,
+        assessment: assessmentConfidence,
+        limitedContext: limitedContextDiagnostic({
+            corpusGateReason,
+            preparationWarnings,
+            assessmentConfidence,
+        }),
     };
     if (!tier1 && mode === "graph_fallback" && changedPackages.all.length > 0) {
         tier1Blocks.blastRadius = blastRadiusFromChangedCount(changedPackages.all.length);
     }
-    let affectedAreas = tier1Blocks.affectedAreas;
-    if (affectedAreas.length === 0 && mode !== "pr_intelligence") {
-        affectedAreas = selectTopAffectedAreas(result, { max: 2 }).map((label) => ({
-            id: label.toLowerCase().replace(/\s+/g, "_").slice(0, 48),
+    let affectedAreaSeeds = tier1Blocks.affectedAreas;
+    if (affectedAreaSeeds.length === 0 && mode !== "pr_intelligence") {
+        affectedAreaSeeds = selectTopAffectedAreas(result, { max: 2 }).map((label) => ({
+            id: areaIdFromLabel(label),
             label,
         }));
     }
+    const findings = Array.isArray(result.findings) ? result.findings : [];
+    const affectedAreas = enrichAffectedAreaFacts(affectedAreaSeeds, {
+        findings,
+        packageUsage: tier1Blocks.packageUsage,
+        changedPackageSemantics: tier1Blocks.changedPackageSemantics,
+        hotspots: tier1Blocks.hotspots,
+        applicationAreaIds,
+    });
+    const riskSignals = deriveRiskSignals(result);
+    const riskIndex = riskSignals?.riskIndex ?? null;
     return {
         availability: {
             mode,
@@ -430,6 +491,8 @@ export function deriveScanNarrative(result) {
                 tier3,
             },
             repoIntelligenceParse,
+            preparationWarnings,
+            corpusGateReason,
         },
         changedPackages,
         packageUsage: tier1Blocks.packageUsage,
@@ -446,5 +509,6 @@ export function deriveScanNarrative(result) {
         repositoryContext,
         mergePosture,
         riskIndex,
+        riskSignals,
     };
 }

package/dist/deriveScanNarrative.test.js

@@ -210,4 +210,65 @@ describe("deriveScanNarrative", () => {
         expect(facts.availability.repoIntelligenceParse).toBe("absent");
         expect(facts.availability.tiersPresent.tier1).toBe(false);
     });
+    it("projects preparation warnings and corpus gate reason", () => {
+        const result = {
+            ...baseResult,
+            changedPackages: ["lodash"],
+            analysisPreparation: {
+                codeIntelligenceAvailable: false,
+                warnings: [
+                    {
+                        code: "base_lockfile_missing",
+                        message: "Base lockfile not available",
+                    },
+                ],
+            },
+        };
+        const facts = deriveScanNarrative(result);
+        expect(facts.availability.preparationWarnings).toHaveLength(1);
+        expect(facts.availability.preparationWarnings[0]?.code).toBe("base_lockfile_missing");
+        expect(facts.availability.corpusGateReason).toBe("no_code_intelligence");
+        expect(facts.confidence.limitedContext).toBe(true);
+    });
+    it("links affected areas to packages, findings, paths, and verification", () => {
+        const result = {
+            ...baseResult,
+            changedPackages: ["fastify"],
+            analysisPreparation: analysisPreparationWithValidRepoIntel(),
+            repoIntelligence: fixtureRepoIntelligenceFastify,
+            findings: [
+                {
+                    id: "f1",
+                    title: "Auth middleware",
+                    description: "d",
+                    severity: "high",
+                    packageName: "fastify",
+                },
+            ],
+        };
+        const facts = deriveScanNarrative(result);
+        const apiArea = facts.affectedAreas.find((a) => a.id === "api");
+        expect(apiArea).toBeDefined();
+        expect(apiArea?.packages).toContain("fastify");
+        expect(apiArea?.findingIds).toContain("f1");
+        expect(apiArea?.paths.length).toBeGreaterThan(0);
+        expect(apiArea?.evidenceStrength).toBe("high");
+        expect(apiArea?.hotspotPackages).toContain("fastify");
+        expect(apiArea?.verificationFocus).toContain("routes");
+    });
+    it("derives riskSignals with exposure layers", () => {
+        const facts = deriveScanNarrative(baseResult);
+        expect(facts.riskSignals?.riskIndex).toBe(10);
+        expect(facts.riskSignals?.exposure).toBe("minimal");
+        expect(facts.riskSignals?.layers).toHaveLength(4);
+        expect(facts.riskIndex).toBe(10);
+    });
+    it("projects assessment confidence verbatim", () => {
+        const result = {
+            ...baseResult,
+            assessment: assessmentFastifyRuntime,
+        };
+        const facts = deriveScanNarrative(result);
+        expect(facts.confidence.assessment).toBe("medium");
+    });
 });

package/dist/formatCardExposureDisplay.d.ts

@@ -1,6 +1,6 @@
 /**
- * Dashboard card exposure semantics — display-only interpretation of totalScore.
- * Not persisted; not an engine output; complements merge posture (Safe / Review / Risky).
+ * Canonical exposure bucket thresholds for numeric risk scores (0–100).
+ * Consumed by `deriveRiskSignals` for bundle facts; label formatters remain for aria copy.
  */
 export type CardExposureCategory = "minimal" | "limited" | "moderate" | "elevated" | "broad";
 export type CardExposureDisplay = {
@@ -11,7 +11,9 @@ export type CardExposureDisplay = {
 };
 /** User-facing exposure labels for docs and UI copy (low → high). */
 export declare const CARD_EXPOSURE_CATEGORY_LABELS: readonly string[];
-/** Map numeric totalScore to a fixed exposure category (card UX only). */
+/** Map numeric score to a fixed exposure category (canonical thresholds). */
+export declare function deriveCardExposureCategory(score: number | null | undefined): CardExposureCategory | null;
+/** Map numeric totalScore to exposure category + display label. */
 export declare function deriveCardExposureDisplay(score: number | null | undefined): CardExposureDisplay | null;
 /** Compact card line: exposure category label only. */
 export declare function formatCardExposureLine(score: number | null | undefined): string | null;

package/dist/formatCardExposureDisplay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"formatCardExposureDisplay.d.ts","sourceRoot":"","sources":["../src/formatCardExposureDisplay.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,oBAAoB,GAC5B,SAAS,GACT,SAAS,GACT,UAAU,GACV,UAAU,GACV,OAAO,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAUF,qEAAqE;AACrE,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAM1D,CAAC;AAkBF,0EAA0E;AAC1E,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,mBAAmB,GAAG,IAAI,CAM5B;AAED,uDAAuD;AACvD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAIf;AAED,sDAAsD;AACtD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAIf"}
+{"version":3,"file":"formatCardExposureDisplay.d.ts","sourceRoot":"","sources":["../src/formatCardExposureDisplay.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,oBAAoB,GAC5B,SAAS,GACT,SAAS,GACT,UAAU,GACV,UAAU,GACV,OAAO,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAUF,qEAAqE;AACrE,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAM1D,CAAC;AAkBF,6EAA6E;AAC7E,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,oBAAoB,GAAG,IAAI,CAK7B;AAED,mEAAmE;AACnE,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,mBAAmB,GAAG,IAAI,CAK5B;AAED,uDAAuD;AACvD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAIf;AAED,sDAAsD;AACtD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAIf"}

package/dist/formatCardExposureDisplay.js

@@ -1,6 +1,6 @@
 /**
- * Dashboard card exposure semantics — display-only interpretation of totalScore.
- * Not persisted; not an engine output; complements merge posture (Safe / Review / Risky).
+ * Canonical exposure bucket thresholds for numeric risk scores (0–100).
+ * Consumed by `deriveRiskSignals` for bundle facts; label formatters remain for aria copy.
  */
 const EXPOSURE_LABEL = {
     minimal: "Minimal exposure",
@@ -31,13 +31,20 @@ function clampScore(score) {
         return 0;
     return Math.min(100, Math.max(0, Math.round(score)));
 }
-/** Map numeric totalScore to a fixed exposure category (card UX only). */
-export function deriveCardExposureDisplay(score) {
+/** Map numeric score to a fixed exposure category (canonical thresholds). */
+export function deriveCardExposureCategory(score) {
     if (score == null || !Number.isFinite(score))
         return null;
     const value = clampScore(score);
     const idx = EXPOSURE_UPPER_BOUND.findIndex((bound) => value <= bound);
-    const category = EXPOSURE_ORDER[idx >= 0 ? idx : EXPOSURE_ORDER.length - 1];
+    return EXPOSURE_ORDER[idx >= 0 ? idx : EXPOSURE_ORDER.length - 1];
+}
+/** Map numeric totalScore to exposure category + display label. */
+export function deriveCardExposureDisplay(score) {
+    const category = deriveCardExposureCategory(score);
+    if (category == null)
+        return null;
+    const value = clampScore(score);
     return { category, label: EXPOSURE_LABEL[category], value };
 }
 /** Compact card line: exposure category label only. */

package/dist/formatCardExposureDisplay.test.js

@@ -1,5 +1,13 @@
 import { describe, expect, it } from "vitest";
-import { deriveCardExposureDisplay, exposureAriaFragment, formatCardExposureLine, } from "./formatCardExposureDisplay.js";
+import { deriveCardExposureCategory, deriveCardExposureDisplay, exposureAriaFragment, formatCardExposureLine, } from "./formatCardExposureDisplay.js";
+describe("deriveCardExposureCategory", () => {
+    it("maps score ranges to exposure categories", () => {
+        expect(deriveCardExposureCategory(0)).toBe("minimal");
+        expect(deriveCardExposureCategory(45)).toBe("moderate");
+        expect(deriveCardExposureCategory(90)).toBe("broad");
+        expect(deriveCardExposureCategory(null)).toBeNull();
+    });
+});
 describe("deriveCardExposureDisplay", () => {
     it("maps score to five fixed exposure buckets", () => {
         expect(deriveCardExposureDisplay(0)?.category).toBe("minimal");

package/dist/narrativePresentation.d.ts

@@ -1,4 +1,6 @@
-import type { ScanNarrativeFacts } from "./scanNarrativeFacts.js";
+import type { NarrativePackageUsage, ScanNarrativeFacts } from "./scanNarrativeFacts.js";
+/** Deduplicated union of wire usage path buckets — matches reachability/linkage semantics. */
+export declare function normalizedPackageUsagePaths(row: NarrativePackageUsage): string[];
 export type SummarizePackageUsageOptions = {
     maxPaths?: number;
     maxPackages?: number;

package/dist/narrativePresentation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"narrativePresentation.d.ts","sourceRoot":"","sources":["../src/narrativePresentation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGlE,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC,CAAC;AAEF,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kBAAkB,GACxB,MAAM,GAAG,IAAI,CAEf;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,kBAAkB,EACzB,QAAQ,SAAI,GACX,MAAM,GAAG,IAAI,CAQf;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kBAAkB,GACxB,MAAM,EAAE,CAEV;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,4BAAiC,GACzC,mBAAmB,GAAG,IAAI,CA6B5B;AAED,iBAAS,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAIrE;AAED,iBAAS,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED,iBAAS,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,kBAAkB,EACzB,QAAQ,SAAI,GACX,mBAAmB,CAUrB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,kBAAkB,EACzB,UAAU,SAAI,GACb,kBAAkB,CAOpB;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,kBAAkB,EACzB,GAAG,SAAI,GACN,KAAK,CAAC;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC,CAMD;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,CAAC,EAAE,SAAS,GAAG,KAAK,GAAG,KAAK,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,6BAAkC,GAC1C,kBAAkB,CAAC,kBAAkB,CAAC,CASxC;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,kBAAkB,GACxB,MAAM,GAAG,IAAI,CAYf;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,kBAAkB,EACzB,QAAQ,SAAI,GACX,MAAM,GAAG,IAAI,CAiBf;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kBAAkB,EACzB,UAAU,SAAI,GACb,MAAM,GAAG,IAAI,CAQf;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,kBAAkB,EACzB,GAAG,SAAI,GACN,MAAM,GAAG,IAAI,CAKf;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/D,MAAM,GAAG,IAAI,CAgCf;AAED,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,CAAC"}
+{"version":3,"file":"narrativePresentation.d.ts","sourceRoot":"","sources":["../src/narrativePresentation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AAGjC,8FAA8F;AAC9F,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,qBAAqB,GACzB,MAAM,EAAE,CASV;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC,CAAC;AAEF,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kBAAkB,GACxB,MAAM,GAAG,IAAI,CAEf;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,kBAAkB,EACzB,QAAQ,SAAI,GACX,MAAM,GAAG,IAAI,CAQf;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kBAAkB,GACxB,MAAM,EAAE,CAEV;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,4BAAiC,GACzC,mBAAmB,GAAG,IAAI,CA2B5B;AAED,iBAAS,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAIrE;AAED,iBAAS,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED,iBAAS,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,kBAAkB,EACzB,QAAQ,SAAI,GACX,mBAAmB,CAUrB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,kBAAkB,EACzB,UAAU,SAAI,GACb,kBAAkB,CAOpB;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,kBAAkB,EACzB,GAAG,SAAI,GACN,KAAK,CAAC;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC,CAMD;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,CAAC,EAAE,SAAS,GAAG,KAAK,GAAG,KAAK,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,6BAAkC,GAC1C,kBAAkB,CAAC,kBAAkB,CAAC,CASxC;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,kBAAkB,GACxB,MAAM,GAAG,IAAI,CAYf;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,kBAAkB,EACzB,QAAQ,SAAI,GACX,MAAM,GAAG,IAAI,CAiBf;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kBAAkB,EACzB,UAAU,SAAI,GACb,MAAM,GAAG,IAAI,CAQf;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,kBAAkB,EACzB,GAAG,SAAI,GACN,MAAM,GAAG,IAAI,CAKf;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/D,MAAM,GAAG,IAAI,CAgCf;AAED,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/narrativePresentation.js

@@ -1,4 +1,16 @@
 import { scanSurfaceCopy } from "./scanSurfaceCopy.js";
+/** Deduplicated union of wire usage path buckets — matches reachability/linkage semantics. */
+export function normalizedPackageUsagePaths(row) {
+    const paths = [];
+    const seen = new Set();
+    for (const p of [...row.paths, ...row.criticalPaths, ...row.files]) {
+        if (!p || seen.has(p))
+            continue;
+        seen.add(p);
+        paths.push(p);
+    }
+    return paths;
+}
 export function selectPrimaryChangedPackage(facts) {
     return facts.changedPackages.primary;
 }
@@ -28,7 +40,7 @@ export function summarizePackageUsage(facts, options = {}) {
     const packageNames = [];
     for (const row of rows) {
         packageNames.push(row.packageName);
-        const rowPaths = [...row.paths, ...row.criticalPaths, ...row.files].filter(Boolean);
+        const rowPaths = normalizedPackageUsagePaths(row);
         pathCount += rowPaths.length;
         for (const p of rowPaths) {
             if (pathSamples.length >= maxPaths)

package/dist/presentation/fixtures/scanResultFixtures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanResultFixtures.d.ts","sourceRoot":"","sources":["../../../src/presentation/fixtures/scanResultFixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAYjD,eAAO,MAAM,wBAAwB,EAAE,UAiCtC,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,UA2BvC,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,UA4BtC,CAAC"}
+{"version":3,"file":"scanResultFixtures.d.ts","sourceRoot":"","sources":["../../../src/presentation/fixtures/scanResultFixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAYjD,eAAO,MAAM,wBAAwB,EAAE,UA0CtC,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,UA2BvC,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,UAqCtC,CAAC"}

package/dist/presentation/fixtures/scanResultFixtures.js

@@ -9,7 +9,16 @@ export const scanResultFastifyRuntime = {
         ecosystem: 30,
         upgradeImpact: 15,
     },
-    findings: [],
+    findings: [
+        {
+            id: "finding-fastify-runtime",
+            title: "Runtime middleware coupling",
+            description: "Fastify middleware ordering may affect auth paths.",
+            severity: "medium",
+            packageName: "fastify",
+            recommendation: "Run auth smoke tests",
+        },
+    ],
     generatedAt: "2026-01-01T00:00:00.000Z",
     changedPackages: ["fastify"],
     analysisPreparation: analysisPreparationWithValidRepoIntel(),
@@ -74,6 +83,15 @@ export const scanResultLimitedContext = {
     findings: [],
     generatedAt: "2026-01-01T00:00:00.000Z",
     changedPackages: ["lodash"],
+    analysisPreparation: {
+        codeIntelligenceAvailable: false,
+        warnings: [
+            {
+                code: "base_lockfile_missing",
+                message: "Base lockfile not available for diff",
+            },
+        ],
+    },
     repoIntelligence: { invalid: true },
     assessment: assessmentLimitedContext,
     graphInsights: {

package/dist/presentation/presentation.test.js

@@ -6,6 +6,7 @@ import { presentGitHubCheckRun } from "./presenters/presentGitHubCheckRun.js";
 import { presentGitHubPrComment } from "./presenters/presentGitHubPrComment.js";
 import { presentCliScanSummary } from "./presenters/presentCliScanSummary.js";
 import { scanResultFastifyRuntime, scanResultLimitedContext, scanResultTypescriptPatch, } from "./fixtures/scanResultFixtures.js";
+import { scanResultEslint } from "./fixtures/presentationPersonaFixtures.js";
 const SCAN_ID = "22222222-2222-4222-8222-222222222222";
 const ORIGIN = "https://app.example.com";
 describe("buildScanPresentationBundle", () => {
@@ -69,6 +70,33 @@ describe("presentDashboardCard personas", () => {
         expect(card.verification.length).toBe(0);
     });
 });
+describe("presentScanDetails usage paths", () => {
+    it("maps wire usage.files into detailPresentation.usage.items[].paths", () => {
+        const bundle = buildScanPresentationBundle({
+            result: scanResultEslint,
+            pipelineStatus: "done",
+        });
+        const details = presentScanDetails(bundle, { scanId: SCAN_ID });
+        const eslintUsage = details.usage?.items.find((item) => item.packageName === "eslint");
+        expect(eslintUsage).toBeDefined();
+        expect(eslintUsage.paths).toEqual([".eslintrc.cjs"]);
+        expect(bundle.facts.packageUsage[0]?.paths).toEqual([]);
+        expect(bundle.facts.packageUsage[0]?.files).toEqual([".eslintrc.cjs"]);
+    });
+    it("deduplicates paths across paths, criticalPaths, and files buckets", () => {
+        const bundle = buildScanPresentationBundle({
+            result: scanResultFastifyRuntime,
+            pipelineStatus: "done",
+        });
+        const details = presentScanDetails(bundle, { scanId: SCAN_ID });
+        const fastifyUsage = details.usage?.items.find((item) => item.packageName === "fastify");
+        expect(fastifyUsage).toBeDefined();
+        expect(fastifyUsage.paths.length).toBeGreaterThan(0);
+        expect(fastifyUsage.paths).toContain("apps/api/src/server.ts");
+        expect(fastifyUsage.paths).toContain("apps/api/src/middleware/auth.ts");
+        expect(new Set(fastifyUsage.paths).size).toBe(fastifyUsage.paths.length);
+    });
+});
 describe("presentation parity across surfaces", () => {
     it("same bundle drives card, details, GitHub, CLI with identical profile", () => {
         const bundle = buildScanPresentationBundle({

package/dist/presentation/presenters/presentScanDetails.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"presentScanDetails.d.ts","sourceRoot":"","sources":["../../../src/presentation/presenters/presentScanDetails.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAGzF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAmDF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,sBAAsB,EAC9B,GAAG,EAAE,yBAAyB,GAC7B,uBAAuB,CAwEzB"}
+{"version":3,"file":"presentScanDetails.d.ts","sourceRoot":"","sources":["../../../src/presentation/presenters/presentScanDetails.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAGzF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAmDF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,sBAAsB,EAC9B,GAAG,EAAE,yBAAyB,GAC7B,uBAAuB,CAwEzB"}

package/dist/presentation/presenters/presentScanDetails.js

@@ -1,4 +1,5 @@
 import { MERGE_CONCERN_LABELS } from "../../assessmentLabels.js";
+import { normalizedPackageUsagePaths } from "../../narrativePresentation.js";
 import { MERGE_POSTURE_LABEL } from "../../riskVocabulary.js";
 import { buildNarrativeChannels, composeSubheadline, composeSupportingContext, evidenceContextFromProfile, projectCompactKeyPoints, } from "../compose/narrativeCompose.js";
 import { normalizeGeneratedText, normalizeGeneratedTextNullable, } from "../../normalizeGeneratedText.js";
@@ -15,7 +16,7 @@ function mapUsage(bundle) {
             : undefined,
         items: facts.packageUsage.map((row) => ({
             packageName: row.packageName,
-            paths: row.paths,
+            paths: normalizedPackageUsagePaths(row),
             areas: row.areas,
             criticalPaths: row.criticalPaths,
         })),

package/dist/riskSignals.d.ts

@@ -0,0 +1,19 @@
+import { type CardExposureCategory } from "./formatCardExposureDisplay.js";
+import type { ScanResult, ScoreLayer } from "./types.js";
+export type RiskSignalLayer = {
+    layer: ScoreLayer;
+    score: number;
+    exposure: CardExposureCategory;
+};
+/** Canonical exposure classification for totalScore and layerScores. */
+export type RiskSignals = {
+    riskIndex: number | null;
+    exposure: CardExposureCategory | null;
+    layers: RiskSignalLayer[];
+};
+/**
+ * Single owner for numeric risk index + exposure bucket classification.
+ * Surfaces must consume `facts.riskSignals` in future phases — do not re-derive bands.
+ */
+export declare function deriveRiskSignals(result: ScanResult): RiskSignals | null;
+//# sourceMappingURL=riskSignals.d.ts.map

package/dist/riskSignals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"riskSignals.d.ts","sourceRoot":"","sources":["../src/riskSignals.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAe,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,oBAAoB,CAAC;CAChC,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B,CAAC;AASF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI,CAwBxE"}

package/dist/riskSignals.js

@@ -0,0 +1,32 @@
+import { deriveCardExposureCategory, } from "./formatCardExposureDisplay.js";
+const LAYER_ORDER = [
+    "security",
+    "maintainability",
+    "ecosystem",
+    "upgradeImpact",
+];
+/**
+ * Single owner for numeric risk index + exposure bucket classification.
+ * Surfaces must consume `facts.riskSignals` in future phases — do not re-derive bands.
+ */
+export function deriveRiskSignals(result) {
+    const riskIndex = typeof result.totalScore === "number" && Number.isFinite(result.totalScore)
+        ? result.totalScore
+        : null;
+    const layerScores = result.layerScores;
+    if (riskIndex == null && layerScores == null) {
+        return null;
+    }
+    const exposure = deriveCardExposureCategory(riskIndex);
+    const layers = layerScores
+        ? LAYER_ORDER.map((layer) => {
+            const score = layerScores[layer];
+            return {
+                layer,
+                score,
+                exposure: deriveCardExposureCategory(score) ?? "minimal",
+            };
+        })
+        : [];
+    return { riskIndex, exposure, layers };
+}

package/dist/scanNarrativeFacts.d.ts

@@ -1,5 +1,7 @@
 import type { ObservationSignalFamily } from "./cardObservationCatalog.js";
 import type { MergePosture } from "./riskVocabulary.js";
+import type { RiskSignals } from "./riskSignals.js";
+import type { AnalysisContextWarning } from "./types.js";
 export type NarrativeAvailabilityMode = "pr_intelligence" | "insights" | "graph_fallback" | "denormalized";
 export type RuntimeSurfaceKind = "runtime" | "build" | "test" | "unknown";
 export type ReachabilityKind = "on_runtime_paths" | "build_only" | "test_only" | "unreachable" | "unknown";
@@ -20,6 +22,23 @@ export type PackageRoleKind = "typechecker" | "compiler" | "bundler" | "linter"
 export type PackageRuntimeImpact = "none" | "possible" | "confirmed" | "unknown";
 export type PackageExpectedImpact = "runtime" | "build_time" | "typecheck" | "test_time" | "development_only" | "unknown";
 export type PackageEvidenceStrength = "high" | "medium" | "low";
+export type CorpusGateReason = "ok" | "no_code_intelligence" | "repo_intelligence_invalid" | "repo_intelligence_absent";
+/** Enriched affected area with proof-chain linkage (Phase 3). */
+export type AffectedAreaFact = {
+    id: string;
+    label: string;
+    packages: string[];
+    findingIds: string[];
+    paths: string[];
+    evidenceStrength: PackageEvidenceStrength | null;
+    hotspotPackages: string[];
+    verificationFocus: string[];
+};
+export type ScanNarrativeConfidenceFacts = {
+    decision: "low" | "medium" | "high" | null;
+    assessment: "low" | "medium" | "high" | null;
+    limitedContext: boolean;
+};
 /** Engine semantic projection for one changed package (wire copy only). */
 export type ChangedPackageSemantics = {
     packageName: string;
@@ -52,6 +71,8 @@ export type ScanNarrativeFacts = {
             tier3: boolean;
         };
         repoIntelligenceParse: RepoIntelligenceParseStatus;
+        preparationWarnings: AnalysisContextWarning[];
+        corpusGateReason: CorpusGateReason;
     };
     changedPackages: {
         primary: string | null;
@@ -83,10 +104,7 @@ export type ScanNarrativeFacts = {
         changedPackageCount?: number;
         factors: string[];
     } | null;
-    affectedAreas: Array<{
-        id: string;
-        label: string;
-    }>;
+    affectedAreas: AffectedAreaFact[];
     hotspots: Array<{
         packageName: string;
         source: "code" | "graph";
@@ -103,9 +121,7 @@ export type ScanNarrativeFacts = {
         remediation?: string;
         affectedFiles?: string[];
     }>;
-    confidence: {
-        decision: "low" | "medium" | "high" | null;
-    };
+    confidence: ScanNarrativeConfidenceFacts;
     repositoryContext: Array<{
         family: ObservationSignalFamily;
         source: RepositoryContextSource;
@@ -115,7 +131,9 @@ export type ScanNarrativeFacts = {
         };
     }>;
     mergePosture: MergePosture | null;
+    /** @deprecated Use `riskSignals.riskIndex` — kept for frozen surface presenters. */
     riskIndex: number | null;
+    riskSignals: RiskSignals | null;
 };
 export declare const EMPTY_SCAN_NARRATIVE_FACTS: ScanNarrativeFacts;
 /** Derivation caps — presenters apply tighter channel limits. */

package/dist/scanNarrativeFacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanNarrativeFacts.d.ts","sourceRoot":"","sources":["../src/scanNarrativeFacts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,MAAM,yBAAyB,GACjC,iBAAiB,GACjB,UAAU,GACV,gBAAgB,GAChB,cAAc,CAAC;AAEnB,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GACxB,kBAAkB,GAClB,YAAY,GACZ,WAAW,GACX,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE9D,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAE5E,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;AAElE,MAAM,MAAM,uBAAuB,GAAG,eAAe,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9E,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GACnC,IAAI,GACJ,SAAS,GACT,QAAQ,GACR,WAAW,CAAC;AAEhB,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,SAAS,GACT,MAAM,GACN,MAAM,GACN,QAAQ,GACR,OAAO,GACP,IAAI,GACJ,SAAS,CAAC;AAEd,MAAM,MAAM,eAAe,GACvB,aAAa,GACb,UAAU,GACV,SAAS,GACT,QAAQ,GACR,WAAW,GACX,aAAa,GACb,gBAAgB,GAChB,MAAM,GACN,OAAO,GACP,KAAK,GACL,SAAS,CAAC;AAEd,MAAM,MAAM,oBAAoB,GAC5B,MAAM,GACN,UAAU,GACV,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,MAAM,qBAAqB,GAC7B,SAAS,GACT,YAAY,GACZ,WAAW,GACX,WAAW,GACX,kBAAkB,GAClB,SAAS,CAAC;AAEd,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEhE,2EAA2E;AAC3E,MAAM,MAAM,uBAAuB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC/C,WAAW,EAAE,eAAe,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC3C,cAAc,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC7C,wBAAwB,EAAE,OAAO,CAAC;IAClC,gBAAgB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACjD,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,eAAe,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC/C,WAAW,EAAE,eAAe,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC3C,cAAc,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC7C,wBAAwB,EAAE,OAAO,CAAC;IAClC,gBAAgB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACjD,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE;QACZ,IAAI,EAAE,yBAAyB,CAAC;QAChC,yBAAyB,EAAE,OAAO,CAAC;QACnC,YAAY,EAAE;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,KAAK,EAAE,OAAO,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAE,CAAC;QACjE,qBAAqB,EAAE,2BAA2B,CAAC;KACpD,CAAC;IAEF,eAAe,EAAE;QACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,GAAG,EAAE,MAAM,EAAE,CAAC;KACf,CAAC;IAEF,YAAY,EAAE,qBAAqB,EAAE,CAAC;IAEtC,UAAU,EAAE,MAAM,EAAE,CAAC;IAErB,cAAc,EAAE;QACd,IAAI,EAAE,kBAAkB,CAAC;QACzB,QAAQ,EAAE;YAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAAC,KAAK,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;KACnD,GAAG,IAAI,CAAC;IAET,YAAY,EAAE;QACZ,IAAI,EAAE,gBAAgB,CAAC;QACvB,QAAQ,EAAE;YAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAAC,UAAU,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;KACrD,GAAG,IAAI,CAAC;IAET,iEAAiE;IACjE,gBAAgB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAEjD,+EAA+E;IAC/E,uBAAuB,EAAE,uBAAuB,EAAE,CAAC;IAEnD,WAAW,EAAE;QACX,KAAK,EAAE,gBAAgB,CAAC;QACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,IAAI,CAAC;IAET,aAAa,EAAE,KAAK,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;IAEH,QAAQ,EAAE,KAAK,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,CAAC;IAEH,gBAAgB,EAAE,KAAK,CAAC;QACtB,IAAI,EAAE,oBAAoB,CAAC;QAC3B,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,qBAAqB,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC,CAAC;IAEH,UAAU,EAAE;QACV,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC;KAC5C,CAAC;IAEF,iBAAiB,EAAE,KAAK,CAAC;QACvB,MAAM,EAAE,uBAAuB,CAAC;QAChC,MAAM,EAAE,uBAAuB,CAAC;QAChC,IAAI,CAAC,EAAE;YAAE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAAC;KACrE,CAAC,CAAC;IAEH,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAClC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,kBAsBxC,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,2BAA2B,KAAK,CAAC"}
+{"version":3,"file":"scanNarrativeFacts.d.ts","sourceRoot":"","sources":["../src/scanNarrativeFacts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,MAAM,yBAAyB,GACjC,iBAAiB,GACjB,UAAU,GACV,gBAAgB,GAChB,cAAc,CAAC;AAEnB,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GACxB,kBAAkB,GAClB,YAAY,GACZ,WAAW,GACX,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE9D,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAE5E,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;AAElE,MAAM,MAAM,uBAAuB,GAAG,eAAe,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9E,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GACnC,IAAI,GACJ,SAAS,GACT,QAAQ,GACR,WAAW,CAAC;AAEhB,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,SAAS,GACT,MAAM,GACN,MAAM,GACN,QAAQ,GACR,OAAO,GACP,IAAI,GACJ,SAAS,CAAC;AAEd,MAAM,MAAM,eAAe,GACvB,aAAa,GACb,UAAU,GACV,SAAS,GACT,QAAQ,GACR,WAAW,GACX,aAAa,GACb,gBAAgB,GAChB,MAAM,GACN,OAAO,GACP,KAAK,GACL,SAAS,CAAC;AAEd,MAAM,MAAM,oBAAoB,GAC5B,MAAM,GACN,UAAU,GACV,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,MAAM,qBAAqB,GAC7B,SAAS,GACT,YAAY,GACZ,WAAW,GACX,WAAW,GACX,kBAAkB,GAClB,SAAS,CAAC;AAEd,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,sBAAsB,GACtB,2BAA2B,GAC3B,0BAA0B,CAAC;AAE/B,iEAAiE;AACjE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gBAAgB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACjD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3C,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC;IAC7C,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,uBAAuB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC/C,WAAW,EAAE,eAAe,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC3C,cAAc,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC7C,wBAAwB,EAAE,OAAO,CAAC;IAClC,gBAAgB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACjD,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,eAAe,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC/C,WAAW,EAAE,eAAe,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC3C,cAAc,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC7C,wBAAwB,EAAE,OAAO,CAAC;IAClC,gBAAgB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACjD,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE;QACZ,IAAI,EAAE,yBAAyB,CAAC;QAChC,yBAAyB,EAAE,OAAO,CAAC;QACnC,YAAY,EAAE;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,KAAK,EAAE,OAAO,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAE,CAAC;QACjE,qBAAqB,EAAE,2BAA2B,CAAC;QACnD,mBAAmB,EAAE,sBAAsB,EAAE,CAAC;QAC9C,gBAAgB,EAAE,gBAAgB,CAAC;KACpC,CAAC;IAEF,eAAe,EAAE;QACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,GAAG,EAAE,MAAM,EAAE,CAAC;KACf,CAAC;IAEF,YAAY,EAAE,qBAAqB,EAAE,CAAC;IAEtC,UAAU,EAAE,MAAM,EAAE,CAAC;IAErB,cAAc,EAAE;QACd,IAAI,EAAE,kBAAkB,CAAC;QACzB,QAAQ,EAAE;YAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAAC,KAAK,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;KACnD,GAAG,IAAI,CAAC;IAET,YAAY,EAAE;QACZ,IAAI,EAAE,gBAAgB,CAAC;QACvB,QAAQ,EAAE;YAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAAC,UAAU,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;KACrD,GAAG,IAAI,CAAC;IAET,iEAAiE;IACjE,gBAAgB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAEjD,+EAA+E;IAC/E,uBAAuB,EAAE,uBAAuB,EAAE,CAAC;IAEnD,WAAW,EAAE;QACX,KAAK,EAAE,gBAAgB,CAAC;QACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,IAAI,CAAC;IAET,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAElC,QAAQ,EAAE,KAAK,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,CAAC;IAEH,gBAAgB,EAAE,KAAK,CAAC;QACtB,IAAI,EAAE,oBAAoB,CAAC;QAC3B,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,qBAAqB,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC,CAAC;IAEH,UAAU,EAAE,4BAA4B,CAAC;IAEzC,iBAAiB,EAAE,KAAK,CAAC;QACvB,MAAM,EAAE,uBAAuB,CAAC;QAChC,MAAM,EAAE,uBAAuB,CAAC;QAChC,IAAI,CAAC,EAAE;YAAE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAAC;KACrE,CAAC,CAAC;IAEH,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAClC,oFAAoF;IACpF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CACjC,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,kBAyBxC,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,2BAA2B,KAAK,CAAC"}

package/dist/scanNarrativeFacts.js

@@ -4,6 +4,8 @@ export const EMPTY_SCAN_NARRATIVE_FACTS = {
         codeIntelligenceAvailable: false,
         tiersPresent: { tier1: false, tier2: false, tier3: false },
         repoIntelligenceParse: "absent",
+        preparationWarnings: [],
+        corpusGateReason: "repo_intelligence_absent",
     },
     changedPackages: { primary: null, others: [], all: [] },
     packageUsage: [],
@@ -16,10 +18,11 @@ export const EMPTY_SCAN_NARRATIVE_FACTS = {
     affectedAreas: [],
     hotspots: [],
     reviewerGuidance: [],
-    confidence: { decision: null },
+    confidence: { decision: null, assessment: null, limitedContext: false },
     repositoryContext: [],
     mergePosture: null,
     riskIndex: null,
+    riskSignals: null,
 };
 /** Derivation caps — presenters apply tighter channel limits. */
 export const NARRATIVE_FACT_MAX_PATHS = 20;

package/dist/scanPresentationBundle.golden.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scanPresentationBundle.golden.test.d.ts.map

package/dist/scanPresentationBundle.golden.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanPresentationBundle.golden.test.d.ts","sourceRoot":"","sources":["../src/scanPresentationBundle.golden.test.ts"],"names":[],"mappings":""}

package/dist/scanPresentationBundle.golden.test.js

@@ -0,0 +1,78 @@
+import { describe, expect, it } from "vitest";
+import { deriveCardExposureCategory } from "./formatCardExposureDisplay.js";
+import { buildScanPresentationBundle } from "./presentation/orchestration/buildScanPresentationBundle.js";
+import { scanResultBullmq, scanResultEslint, scanResultFastifyRuntime, scanResultLimitedContext, scanResultMixedTypescriptFastify, scanResultPrettier, scanResultTypescriptPatch, scanResultVitest, } from "./presentation/fixtures/presentationPersonaFixtures.js";
+const validationPersonas = [
+    { id: "fastify-runtime", result: scanResultFastifyRuntime },
+    { id: "typescript-patch", result: scanResultTypescriptPatch },
+    { id: "mixed-ts-fastify", result: scanResultMixedTypescriptFastify },
+    { id: "prettier", result: scanResultPrettier },
+    { id: "bullmq", result: scanResultBullmq },
+    { id: "eslint", result: scanResultEslint },
+    { id: "vitest", result: scanResultVitest },
+    { id: "limited-context", result: scanResultLimitedContext },
+];
+function bundleFor(result) {
+    return buildScanPresentationBundle({
+        result,
+        pipelineStatus: "done",
+    });
+}
+describe("scanPresentationBundle golden — proof model", () => {
+    it.each(validationPersonas)("builds bundle for $id", ({ result }) => {
+        const bundle = bundleFor(result);
+        expect(bundle).not.toBeNull();
+        expect(bundle.facts.availability.corpusGateReason).toBeDefined();
+        expect(bundle.facts.confidence).toMatchObject({
+            limitedContext: expect.any(Boolean),
+        });
+        expect(bundle.facts.riskSignals).not.toBeNull();
+        expect(bundle.facts.riskSignals.layers).toHaveLength(4);
+    });
+    it("fastify-runtime — linkage and diagnostics", () => {
+        const bundle = bundleFor(scanResultFastifyRuntime);
+        const { facts } = bundle;
+        expect(facts.availability.corpusGateReason).toBe("ok");
+        expect(facts.confidence.limitedContext).toBe(false);
+        expect(facts.confidence.assessment).toBe("medium");
+        const apiArea = facts.affectedAreas.find((a) => a.id === "api");
+        expect(apiArea?.packages).toContain("fastify");
+        expect(apiArea?.findingIds).toContain("finding-fastify-runtime");
+        expect(apiArea?.paths.length).toBeGreaterThan(0);
+        expect(apiArea?.hotspotPackages).toContain("fastify");
+        expect(apiArea?.verificationFocus.length).toBeGreaterThan(0);
+        expect(facts.riskSignals?.riskIndex).toBe(55);
+        expect(facts.riskSignals?.exposure).toBe(deriveCardExposureCategory(55));
+        expect(facts.riskIndex).toBe(facts.riskSignals?.riskIndex);
+    });
+    it("limited-context — diagnostics without synthetic confidence", () => {
+        const bundle = bundleFor(scanResultLimitedContext);
+        const { facts } = bundle;
+        expect(facts.availability.corpusGateReason).toBe("no_code_intelligence");
+        expect(facts.availability.preparationWarnings.some((w) => w.code === "base_lockfile_missing")).toBe(true);
+        expect(facts.confidence.assessment).toBe("low");
+        expect(facts.confidence.limitedContext).toBe(true);
+    });
+    it("typescript-patch — tooling semantics with risk signals", () => {
+        const bundle = bundleFor(scanResultTypescriptPatch);
+        const { facts } = bundle;
+        expect(facts.availability.corpusGateReason).toBe("ok");
+        expect(facts.packageSemantics?.dependencyClass).toBe("tooling");
+        expect(facts.riskSignals?.riskIndex).toBe(18);
+        expect(facts.riskSignals?.exposure).toBe(deriveCardExposureCategory(18));
+    });
+    it("affected areas always carry linkage arrays (structure)", () => {
+        for (const { result } of validationPersonas) {
+            const bundle = bundleFor(result);
+            if (!bundle)
+                continue;
+            for (const area of bundle.facts.affectedAreas) {
+                expect(Array.isArray(area.packages)).toBe(true);
+                expect(Array.isArray(area.findingIds)).toBe(true);
+                expect(Array.isArray(area.paths)).toBe(true);
+                expect(Array.isArray(area.hotspotPackages)).toBe(true);
+                expect(Array.isArray(area.verificationFocus)).toBe(true);
+            }
+        }
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mergesignal/shared",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "MergeSignal shared scan contract, presentation policy, and trusted validation",
   "type": "module",
   "main": "./dist/index.js",