@mergesignal/shared 0.8.1 → 0.9.0

package/dist/presentation/orchestration/buildScanDetailsPresentation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buildScanDetailsPresentation.d.ts","sourceRoot":"","sources":["../../../src/presentation/orchestration/buildScanDetailsPresentation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,cAAc,CAAC;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,iCAAiC,GACvC,uBAAuB,GAAG,IAAI,CAiBhC"}
+{"version":3,"file":"buildScanDetailsPresentation.d.ts","sourceRoot":"","sources":["../../../src/presentation/orchestration/buildScanDetailsPresentation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,cAAc,CAAC;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,iCAAiC,GACvC,uBAAuB,GAAG,IAAI,CAgBhC"}

package/dist/presentation/orchestration/buildScanDetailsPresentation.js

@@ -7,7 +7,6 @@ export function buildScanDetailsPresentation(input) {
         result: input.result,
         pipelineStatus: input.pipelineStatus,
         decision: input.decision,
-        totalScore: input.totalScore,
     });
     if (!bundle)
         return null;

package/dist/presentation/orchestration/buildScanPresentationBundle.d.ts

@@ -5,7 +5,6 @@ export type BuildScanPresentationBundleInput = {
     result: ScanResult;
     pipelineStatus: PipelineStatus;
     decision?: string | null;
-    totalScore?: number | null;
 };
 /**
  * Mandatory orchestration entrypoint for completed-scan presentation.

package/dist/presentation/orchestration/buildScanPresentationBundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buildScanPresentationBundle.d.ts","sourceRoot":"","sources":["../../../src/presentation/orchestration/buildScanPresentationBundle.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAE1E,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,EAAE,UAAU,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,gCAAgC,GACtC,sBAAsB,GAAG,IAAI,CA4B/B"}
+{"version":3,"file":"buildScanPresentationBundle.d.ts","sourceRoot":"","sources":["../../../src/presentation/orchestration/buildScanPresentationBundle.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAE1E,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,EAAE,UAAU,CAAC;IACnB,cAAc,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,gCAAgC,GACtC,sBAAsB,GAAG,IAAI,CA4B/B"}

package/dist/presentation/presenters/presentCliScanSummary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"presentCliScanSummary.d.ts","sourceRoot":"","sources":["../../../src/presentation/presenters/presentCliScanSummary.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAGzF,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,sBAAsB,EAC9B,GAAG,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,mBAAmB,CA8BrB"}
+{"version":3,"file":"presentCliScanSummary.d.ts","sourceRoot":"","sources":["../../../src/presentation/presenters/presentCliScanSummary.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAGzF,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,sBAAsB,EAC9B,GAAG,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,mBAAmB,CAiCrB"}

package/dist/presentation/presenters/presentCliScanSummary.js

@@ -1,11 +1,14 @@
+import { scoreToBandLabel } from "../../prRiskBand.js";
+import { resolvePrRiskLayerScores } from "../../prRiskWire.js";
 import { buildNarrativeChannels, composeHeadline, composeSubheadline, composeSupportingContext, composeVerificationActions, evidenceContextFromProfile, projectCompactKeyPoints, } from "../compose/narrativeCompose.js";
 import { projectAssessmentFields } from "../projectAssessmentFields.js";
 export function presentCliScanSummary(bundle, ctx = {}) {
     const { facts, profile, result } = bundle;
-    const layers = result.layerScores;
-    const layerLine = layers
-        ? `security=${layers.security} maintainability=${layers.maintainability} ecosystem=${layers.ecosystem} upgradeImpact=${layers.upgradeImpact}`
+    const layerScores = resolvePrRiskLayerScores(result);
+    const layerLine = layerScores
+        ? `security=${layerScores.security} maintainability=${layerScores.maintainability} ecosystem=${layerScores.ecosystem} upgradeImpact=${layerScores.upgradeImpact}`
         : "";
+    const prRiskScore = facts.riskIndex ?? 0;
     return {
         ...projectAssessmentFields(bundle),
         header: {
@@ -22,7 +25,9 @@ export function presentCliScanSummary(bundle, ctx = {}) {
         keyPoints: projectCompactKeyPoints(buildNarrativeChannels(bundle), 6),
         verificationActions: composeVerificationActions(bundle, 5),
         metrics: {
-            riskIndex: facts.riskIndex ?? result.totalScore ?? 0,
+            prRiskScore,
+            prRiskBandLabel: scoreToBandLabel(prRiskScore) ?? undefined,
+            riskIndex: prRiskScore,
             layerLine,
             findingCount: result.findings?.length ?? 0,
             recommendationCount: result.recommendations?.length ?? 0,

package/dist/presentation/presenters/presentGitHubCheckRun.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"presentGitHubCheckRun.d.ts","sourceRoot":"","sources":["../../../src/presentation/presenters/presentGitHubCheckRun.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAGzF,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,sBAAsB,EAC9B,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAChE,0BAA0B,CAmC5B"}
+{"version":3,"file":"presentGitHubCheckRun.d.ts","sourceRoot":"","sources":["../../../src/presentation/presenters/presentGitHubCheckRun.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAGzF,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,sBAAsB,EAC9B,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAChE,0BAA0B,CA4C5B"}

package/dist/presentation/presenters/presentGitHubCheckRun.js

@@ -1,3 +1,4 @@
+import { scoreToBandLabel } from "../../prRiskBand.js";
 import { buildNarrativeChannels, composeHeadline, composeSubheadline, composeVerificationActions, evidenceContextFromProfile, projectCompactKeyPoints, } from "../compose/narrativeCompose.js";
 import { projectAssessmentFields } from "../projectAssessmentFields.js";
 export function presentGitHubCheckRun(bundle, ctx) {
@@ -12,6 +13,15 @@ export function presentGitHubCheckRun(bundle, ctx) {
             ? "failure"
             : "neutral";
     const sections = [];
+    const prRiskScore = bundle.facts.riskSignals?.riskIndex;
+    const prRiskBandLabelText = scoreToBandLabel(prRiskScore);
+    if (prRiskScore != null && prRiskBandLabelText) {
+        sections.push({
+            id: "why",
+            title: "PR Risk",
+            bullets: [`${prRiskScore} (${prRiskBandLabelText})`],
+        });
+    }
     if (keyPoints.length > 0) {
         sections.push({ id: "why", title: "Why", bullets: keyPoints });
     }

package/dist/presentation/presenters/presentGitHubPrComment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"presentGitHubPrComment.d.ts","sourceRoot":"","sources":["../../../src/presentation/presenters/presentGitHubPrComment.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAGzF,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,sBAAsB,GAC7B,2BAA2B,CA8B7B"}
+{"version":3,"file":"presentGitHubPrComment.d.ts","sourceRoot":"","sources":["../../../src/presentation/presenters/presentGitHubPrComment.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAGzF,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,sBAAsB,GAC7B,2BAA2B,CAmC7B"}

package/dist/presentation/presenters/presentGitHubPrComment.js

@@ -1,4 +1,5 @@
 import { MERGE_POSTURE_LABEL } from "../../riskVocabulary.js";
+import { scoreToBandLabel } from "../../prRiskBand.js";
 import { buildNarrativeChannels, evidenceContextFromProfile, } from "../compose/narrativeCompose.js";
 import { formatChangedPackagesShort } from "../../narrativePresentation.js";
 import { projectAssessmentFields } from "../projectAssessmentFields.js";
@@ -10,6 +11,11 @@ export function presentGitHubPrComment(bundle) {
     const changed = formatChangedPackagesShort(facts, 3);
     if (changed)
         introLines.push(`Changed: ${changed}`);
+    const prRiskScore = bundle.facts.riskSignals?.riskIndex;
+    const prRiskBandLabelText = scoreToBandLabel(prRiskScore);
+    if (prRiskScore != null && prRiskBandLabelText) {
+        introLines.push(`PR Risk: ${prRiskScore} (${prRiskBandLabelText})`);
+    }
     for (const line of assessmentFields.reasoning.slice(0, 2)) {
         introLines.push(line);
     }

package/dist/presentation/presenters/presentScanDetails.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"presentScanDetails.d.ts","sourceRoot":"","sources":["../../../src/presentation/presenters/presentScanDetails.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAGzF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAmDF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,sBAAsB,EAC9B,GAAG,EAAE,yBAAyB,GAC7B,uBAAuB,CAwEzB"}
+{"version":3,"file":"presentScanDetails.d.ts","sourceRoot":"","sources":["../../../src/presentation/presenters/presentScanDetails.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAGzF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AA6FF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,sBAAsB,EAC9B,GAAG,EAAE,yBAAyB,GAC7B,uBAAuB,CAiFzB"}

package/dist/presentation/presenters/presentScanDetails.js

@@ -1,10 +1,46 @@
 import { MERGE_CONCERN_LABELS } from "../../assessmentLabels.js";
 import { normalizedPackageUsagePaths } from "../../narrativePresentation.js";
+import { prRiskBandLabel, prRiskBandToGaugeBand, scoreToBandLabel, } from "../../prRiskBand.js";
 import { MERGE_POSTURE_LABEL } from "../../riskVocabulary.js";
 import { buildNarrativeChannels, composeSubheadline, composeSupportingContext, evidenceContextFromProfile, projectCompactKeyPoints, } from "../compose/narrativeCompose.js";
 import { normalizeGeneratedText, normalizeGeneratedTextNullable, } from "../../normalizeGeneratedText.js";
 import { scanSurfaceCopy } from "../../scanSurfaceCopy.js";
 import { projectAssessmentFields } from "../projectAssessmentFields.js";
+const LAYER_LABEL = {
+    security: "Security",
+    maintainability: "Maintainability",
+    ecosystem: "Ecosystem",
+    upgradeImpact: "Upgrade impact",
+};
+function gaugeBandToSignalBand(band) {
+    if (band === "high")
+        return "high";
+    if (band === "moderate")
+        return "medium";
+    return "low";
+}
+function mapSignalSummary(bundle) {
+    const riskSignals = bundle.facts.riskSignals;
+    const prRiskScore = riskSignals?.riskIndex;
+    if (!riskSignals || prRiskScore == null || !Number.isFinite(prRiskScore)) {
+        return undefined;
+    }
+    const band = riskSignals.band;
+    if (!band)
+        return undefined;
+    const gaugeBand = prRiskBandToGaugeBand(band);
+    const signalBand = gaugeBandToSignalBand(gaugeBand);
+    return {
+        prRiskScore,
+        band: signalBand,
+        layers: riskSignals.layers.map((layer) => ({
+            layer: layer.layer,
+            score: layer.score,
+            band: gaugeBandToSignalBand(prRiskBandToGaugeBand(layer.band)),
+            label: LAYER_LABEL[layer.layer],
+        })),
+    };
+}
 function mapUsage(bundle) {
     const { facts } = bundle;
     if (facts.packageUsage.length === 0 && facts.frameworks.length === 0) {
@@ -43,7 +79,7 @@ function mapEvidence(bundle) {
     };
 }
 export function presentScanDetails(bundle, ctx) {
-    const { assessment, facts, profile, result } = bundle;
+    const { assessment, facts, profile } = bundle;
     const assessmentFields = projectAssessmentFields(bundle);
     const channels = buildNarrativeChannels(bundle);
     const keyPoints = projectCompactKeyPoints(channels, 6);
@@ -74,6 +110,10 @@ export function presentScanDetails(bundle, ctx) {
                 : "low",
         rationale: action.detail,
     }));
+    const prRiskScore = facts.riskSignals?.riskIndex ?? null;
+    const prRiskBandLabelText = facts.riskSignals?.band != null
+        ? prRiskBandLabel(facts.riskSignals.band)
+        : scoreToBandLabel(prRiskScore);
     return {
         ...assessmentFields,
         evidenceContext: evidenceContextFromProfile(bundle),
@@ -87,8 +127,11 @@ export function presentScanDetails(bundle, ctx) {
             verdictLine: normalizeGeneratedText(verdictLine),
             scopeChip: channels.reachLabel,
             postureLabel,
-            riskIndex: result.totalScore,
+            prRiskScore,
+            prRiskBandLabel: prRiskBandLabelText ?? undefined,
+            riskIndex: prRiskScore,
         },
+        signalSummary: mapSignalSummary(bundle),
         narrative: {
             keyPoints: keyPoints.map((k) => normalizeGeneratedText(k)),
             changedPackages: facts.changedPackages.all,
@@ -102,7 +145,7 @@ export function presentScanDetails(bundle, ctx) {
         supportingContext,
         metadata: {
             scanId: ctx.scanId,
-            generatedAt: result.generatedAt,
+            generatedAt: bundle.result.generatedAt,
             methodologyVersion: ctx.methodologyVersion,
             changedPackagesSummary: facts.changedPackages.primary ?? facts.changedPackages.all.join(", "),
         },

package/dist/presentation/render/renderCliScanSummaryText.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"renderCliScanSummaryText.d.ts","sourceRoot":"","sources":["../../../src/presentation/render/renderCliScanSummaryText.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,mBAAmB,GAAG,MAAM,CA+BvE"}
+{"version":3,"file":"renderCliScanSummaryText.d.ts","sourceRoot":"","sources":["../../../src/presentation/render/renderCliScanSummaryText.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAkCvE"}

package/dist/presentation/render/renderCliScanSummaryText.js

@@ -9,7 +9,10 @@ export function renderCliScanSummaryText(p) {
         lines.push(p.subheadline);
     lines.push("", `Status: ${p.status} | Density: ${p.density} | Confidence: ${p.confidence}`);
     if (p.metrics) {
-        lines.push(`Risk index: ${p.metrics.riskIndex} (${scanSurfaceCopy.actions.riskIndexDirectionShort})`, p.metrics.layerLine, `Findings: ${p.metrics.findingCount} | Recommendations: ${p.metrics.recommendationCount}`);
+        const bandSuffix = p.metrics.prRiskBandLabel
+            ? ` (${p.metrics.prRiskBandLabel})`
+            : "";
+        lines.push(`${scanSurfaceCopy.actions.prRiskScoreLabel}: ${p.metrics.prRiskScore}${bandSuffix}`, p.metrics.layerLine, `Findings: ${p.metrics.findingCount} | Recommendations: ${p.metrics.recommendationCount}`);
     }
     if (p.keyPoints.length > 0) {
         lines.push("", "Key points:");

package/dist/productMessaging.d.ts

@@ -69,8 +69,8 @@ export declare const productMessaging: {
         readonly intro: "The repository dashboard is a runtime-aware review surface for open upgrade pull requests: triage by merge recommendation, then read operational context on each card.";
         readonly posture: `Posture indicates the merge recommendation (${string}, ${string}, ${string}).`;
         readonly exposure: "Reach indicates how prominently affected application paths are surfaced for this upgrade.";
-        readonly exposureCategoriesLead: "Risk index bands (supporting context) read as one of:";
-        readonly exposureCategories: readonly string[];
+        readonly prRiskBandsLead: "PR Risk bands (supporting context) read as one of:";
+        readonly prRiskBands: readonly string[];
         readonly cardBody: "Below the verdict, scanned cards lead with the changed package, affected areas, verification checks, and blast radius when code intelligence is available - focused on this PR, not the whole repository.";
     };
 };

package/dist/productMessaging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"productMessaging.d.ts","sourceRoot":"","sources":["../src/productMessaging.ts"],"names":[],"mappings":"AAGA;;GAEG;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmF3B,6FAA6F;;;;;;;;;CAarF,CAAC;AAEX,kFAAkF;AAClF,eAAO,MAAM,gBAAgB;;;;CAOnB,CAAC;AAEX,iEAAiE;AACjE,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAOnD"}
+{"version":3,"file":"productMessaging.d.ts","sourceRoot":"","sources":["../src/productMessaging.ts"],"names":[],"mappings":"AAGA;;GAEG;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmF3B,6FAA6F;;;;;;;;;CAYrF,CAAC;AAEX,kFAAkF;AAClF,eAAO,MAAM,gBAAgB;;;;CAOnB,CAAC;AAEX,iEAAiE;AACjE,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAOnD"}

package/dist/productMessaging.js

@@ -1,4 +1,4 @@
-import { CARD_EXPOSURE_CATEGORY_LABELS } from "./formatCardExposureDisplay.js";
+import { PR_RISK_BAND_LABELS } from "./prRiskBand.js";
 import { MERGE_POSTURE_LABEL } from "./riskVocabulary.js";
 /**
  * Canonical marketing / category copy. Operational scan strings stay in scanSurfaceCopy.
@@ -84,8 +84,8 @@ export const productMessaging = {
         intro: "The repository dashboard is a runtime-aware review surface for open upgrade pull requests: triage by merge recommendation, then read operational context on each card.",
         posture: `Posture indicates the merge recommendation (${MERGE_POSTURE_LABEL.safe}, ${MERGE_POSTURE_LABEL.needs_review}, ${MERGE_POSTURE_LABEL.risky}).`,
         exposure: "Reach indicates how prominently affected application paths are surfaced for this upgrade.",
-        exposureCategoriesLead: "Risk index bands (supporting context) read as one of:",
-        exposureCategories: CARD_EXPOSURE_CATEGORY_LABELS,
+        prRiskBandsLead: "PR Risk bands (supporting context) read as one of:",
+        prRiskBands: PR_RISK_BAND_LABELS,
         cardBody: "Below the verdict, scanned cards lead with the changed package, affected areas, verification checks, and blast radius when code intelligence is available - focused on this PR, not the whole repository.",
     },
 };

package/dist/productMessaging.test.js

@@ -60,21 +60,21 @@ describe("productMessaging", () => {
         expect(productMessaging.hero.h1).not.toContain("Dependabot");
         expect(productMessaging.hero.lead).not.toContain("Dependabot");
     });
-    it("describes dashboard posture and exposure without scoring jargon", () => {
+    it("describes dashboard posture and PR Risk bands without scoring jargon", () => {
         const d = productMessaging.dashboardPrCard;
         const text = [
             d.intro,
             d.posture,
             d.exposure,
-            d.exposureCategoriesLead,
-            ...d.exposureCategories,
+            d.prRiskBandsLead,
+            ...d.prRiskBands,
             d.cardBody,
         ].join(" ");
         expect(text).toContain("merge recommendation");
         expect(text).toContain("affected application paths");
         expect(text).not.toMatch(/total score|0-100|formula|weight/i);
-        expect(d.exposureCategories).toHaveLength(5);
-        expect(d.exposureCategories).toContain("Elevated exposure");
+        expect(d.prRiskBands).toHaveLength(5);
+        expect(d.prRiskBands).toContain("Medium");
     });
 });
 function collectMarketingStrings() {
@@ -92,6 +92,6 @@ function collectMarketingStrings() {
         out.push(body);
     }
     const d = productMessaging.dashboardPrCard;
-    out.push(d.intro, d.posture, d.exposure, d.exposureCategoriesLead, d.cardBody, ...d.exposureCategories);
+    out.push(d.intro, d.posture, d.exposure, d.prRiskBandsLead, d.cardBody, ...d.prRiskBands);
     return out;
 }

package/dist/resolvePipelineStatus.d.ts

@@ -2,13 +2,14 @@ export type ScanPipelineStatus = "queued" | "running" | "done" | "failed";
 export type PipelineCompletionEvidence = {
     scannedAt?: string | null;
     decision?: string | null;
-    totalScore?: number | null;
+    /** Denormalized or resolved PR risk score — completion signal only. */
+    prRiskScore?: number | null;
     hasResult?: boolean;
 };
-/** Scan completion signals — decision/totalScore/result are only set after analysis. */
+/** Scan completion signals — decision/prRiskScore/result are set after analysis. */
 export declare function hasScanCompletionEvidence(evidence: PipelineCompletionEvidence): boolean;
 /**
- * Resolve wire status using completion evidence (decision, totalScore, result).
+ * Resolve wire status using completion evidence (decision, prRiskScore, result).
  * Handles races where denormalized columns are written before status flips to done.
  */
 export declare function resolvePipelineStatus(status: string | undefined, evidence: PipelineCompletionEvidence): ScanPipelineStatus;

package/dist/resolvePipelineStatus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolvePipelineStatus.d.ts","sourceRoot":"","sources":["../src/resolvePipelineStatus.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE1E,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAsBF,wFAAwF;AACxF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAQT;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,0BAA0B,GACnC,kBAAkB,CAKpB"}
+{"version":3,"file":"resolvePipelineStatus.d.ts","sourceRoot":"","sources":["../src/resolvePipelineStatus.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE1E,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAsBF,oFAAoF;AACpF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAQT;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,0BAA0B,GACnC,kBAAkB,CAKpB"}

package/dist/resolvePipelineStatus.js

@@ -10,13 +10,13 @@ function normalizePipelineStatus(status) {
 function isMergePostureDecision(decision) {
     return (decision === "safe" || decision === "needs_review" || decision === "risky");
 }
-/** Scan completion signals — decision/totalScore/result are only set after analysis. */
+/** Scan completion signals — decision/prRiskScore/result are set after analysis. */
 export function hasScanCompletionEvidence(evidence) {
     if (isMergePostureDecision(evidence.decision))
         return true;
     if (evidence.hasResult === true)
         return true;
-    if (evidence.totalScore != null && Number.isFinite(evidence.totalScore)) {
+    if (evidence.prRiskScore != null && Number.isFinite(evidence.prRiskScore)) {
         return true;
     }
     if (evidence.scannedAt?.trim())
@@ -24,7 +24,7 @@ export function hasScanCompletionEvidence(evidence) {
     return false;
 }
 /**
- * Resolve wire status using completion evidence (decision, totalScore, result).
+ * Resolve wire status using completion evidence (decision, prRiskScore, result).
  * Handles races where denormalized columns are written before status flips to done.
  */
 export function resolvePipelineStatus(status, evidence) {

package/dist/riskSignals.d.ts

@@ -1,19 +1,19 @@
-import { type CardExposureCategory } from "./formatCardExposureDisplay.js";
+import { type PrRiskBand } from "./prRiskBand.js";
 import type { ScanResult, ScoreLayer } from "./types.js";
 export type RiskSignalLayer = {
     layer: ScoreLayer;
     score: number;
-    exposure: CardExposureCategory;
+    band: PrRiskBand;
 };
-/** Canonical exposure classification for totalScore and layerScores. */
+/** Canonical PR Risk classification for prRisk.score and layer scores. */
 export type RiskSignals = {
     riskIndex: number | null;
-    exposure: CardExposureCategory | null;
+    band: PrRiskBand | null;
     layers: RiskSignalLayer[];
 };
 /**
- * Single owner for numeric risk index + exposure bucket classification.
- * Surfaces must consume `facts.riskSignals` in future phases — do not re-derive bands.
+ * Single owner for PR risk index + band classification.
+ * Surfaces must consume `facts.riskSignals` — do not re-derive bands.
  */
 export declare function deriveRiskSignals(result: ScanResult): RiskSignals | null;
 //# sourceMappingURL=riskSignals.d.ts.map

package/dist/riskSignals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"riskSignals.d.ts","sourceRoot":"","sources":["../src/riskSignals.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAe,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,oBAAoB,CAAC;CAChC,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B,CAAC;AASF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI,CAwBxE"}
+{"version":3,"file":"riskSignals.d.ts","sourceRoot":"","sources":["../src/riskSignals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE/D,OAAO,KAAK,EAAe,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;CAClB,CAAC;AAEF,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B,CAAC;AASF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI,CAqBxE"}

package/dist/riskSignals.js

@@ -1,4 +1,5 @@
-import { deriveCardExposureCategory, } from "./formatCardExposureDisplay.js";
+import { scoreToBand } from "./prRiskBand.js";
+import { resolvePrRiskLayerScores, resolvePrRiskScore } from "./prRiskWire.js";
 const LAYER_ORDER = [
     "security",
     "maintainability",
@@ -6,27 +7,25 @@ const LAYER_ORDER = [
     "upgradeImpact",
 ];
 /**
- * Single owner for numeric risk index + exposure bucket classification.
- * Surfaces must consume `facts.riskSignals` in future phases — do not re-derive bands.
+ * Single owner for PR risk index + band classification.
+ * Surfaces must consume `facts.riskSignals` — do not re-derive bands.
  */
 export function deriveRiskSignals(result) {
-    const riskIndex = typeof result.totalScore === "number" && Number.isFinite(result.totalScore)
-        ? result.totalScore
-        : null;
-    const layerScores = result.layerScores;
+    const riskIndex = resolvePrRiskScore(result);
+    const layerScores = resolvePrRiskLayerScores(result);
     if (riskIndex == null && layerScores == null) {
         return null;
     }
-    const exposure = deriveCardExposureCategory(riskIndex);
+    const band = scoreToBand(riskIndex);
     const layers = layerScores
         ? LAYER_ORDER.map((layer) => {
             const score = layerScores[layer];
             return {
                 layer,
                 score,
-                exposure: deriveCardExposureCategory(score) ?? "minimal",
+                band: scoreToBand(score) ?? "very_low",
             };
         })
         : [];
-    return { riskIndex, exposure, layers };
+    return { riskIndex, band, layers };
 }

package/dist/riskVocabulary.js

@@ -1,4 +1,4 @@
-import { exposureAriaFragment } from "./formatCardExposureDisplay.js";
+import { prRiskBandAriaFragment } from "./prRiskBand.js";
 /** Canonical display strings for merge posture values. */
 export const MERGE_POSTURE_LABEL = {
     safe: "Safe",
@@ -44,17 +44,17 @@ export function mergePostureLabel(decision, fallback = "-") {
  */
 export function ariaLabelForPosture(decision, score) {
     const label = mergePostureLabel(decision);
-    const exposure = exposureAriaFragment(score);
-    if (exposure)
-        return `${label}, ${exposure}`;
+    const bandFragment = prRiskBandAriaFragment(score);
+    if (bandFragment)
+        return `${label}, ${bandFragment}`;
     return label;
 }
 /** Accessible label for unified PR card findings block. */
 export function ariaLabelForCardSummary(postureLabel, riskIndex, observations, supportingLine) {
     const parts = [postureLabel];
-    const exposure = exposureAriaFragment(riskIndex);
-    if (exposure)
-        parts.push(exposure);
+    const bandFragment = prRiskBandAriaFragment(riskIndex);
+    if (bandFragment)
+        parts.push(bandFragment);
     for (const obs of observations ?? []) {
         if (obs?.trim())
             parts.push(obs.trim());

package/dist/scanPresentationBundle.golden.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { deriveCardExposureCategory } from "./formatCardExposureDisplay.js";
+import { scoreToBand } from "./prRiskBand.js";
 import { buildScanPresentationBundle } from "./presentation/orchestration/buildScanPresentationBundle.js";
 import { scanResultBullmq, scanResultEslint, scanResultFastifyRuntime, scanResultLimitedContext, scanResultMixedTypescriptFastify, scanResultPrettier, scanResultTypescriptPatch, scanResultVitest, } from "./presentation/fixtures/presentationPersonaFixtures.js";
 const validationPersonas = [
@@ -42,7 +42,7 @@ describe("scanPresentationBundle golden — proof model", () => {
         expect(apiArea?.hotspotPackages).toContain("fastify");
         expect(apiArea?.verificationFocus.length).toBeGreaterThan(0);
         expect(facts.riskSignals?.riskIndex).toBe(55);
-        expect(facts.riskSignals?.exposure).toBe(deriveCardExposureCategory(55));
+        expect(facts.riskSignals?.band).toBe(scoreToBand(55));
         expect(facts.riskIndex).toBe(facts.riskSignals?.riskIndex);
     });
     it("limited-context — diagnostics without synthetic confidence", () => {
@@ -59,7 +59,7 @@ describe("scanPresentationBundle golden — proof model", () => {
         expect(facts.availability.corpusGateReason).toBe("ok");
         expect(facts.packageSemantics?.dependencyClass).toBe("tooling");
         expect(facts.riskSignals?.riskIndex).toBe(18);
-        expect(facts.riskSignals?.exposure).toBe(deriveCardExposureCategory(18));
+        expect(facts.riskSignals?.band).toBe(scoreToBand(18));
     });
     it("affected areas always carry linkage arrays (structure)", () => {
         for (const { result } of validationPersonas) {

package/dist/scanResultSchema.d.ts

@@ -3,7 +3,12 @@ import type { EngineEmittedScanResult, ScanResult } from "./types.js";
 /** Bump when persisted `result` JSON validation rules change materially (relaxed / legacy-tolerant). */
 export declare const SCAN_RESULT_ABI: "2";
 /** Bump when strict fresh-engine-output validation rules change materially. */
-export declare const ENGINE_OUTPUT_SCAN_ABI: "3";
+export declare const ENGINE_OUTPUT_SCAN_ABI: "4";
+/**
+ * Synthesize ABI-4 prRisk/repositoryHealth from legacy totalScore when an engine
+ * has not yet adopted the dual-score wire (transitional bridge).
+ */
+export declare function normalizeEngineOutputAbi4(raw: unknown): unknown;
 /**
  * Minimum structural invariants for **persisted** `scans.result` JSON and legacy reads.
  * `methodologyVersion` stays optional so historical rows without it remain valid.
@@ -17,6 +22,24 @@ export declare const scanResultSchema: z.ZodObject<{
         ecosystem: z.ZodNumber;
         upgradeImpact: z.ZodNumber;
     }, z.core.$strip>;
+    prRisk: z.ZodOptional<z.ZodObject<{
+        score: z.ZodNumber;
+        layerScores: z.ZodOptional<z.ZodObject<{
+            security: z.ZodNumber;
+            maintainability: z.ZodNumber;
+            ecosystem: z.ZodNumber;
+            upgradeImpact: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    repositoryHealth: z.ZodOptional<z.ZodObject<{
+        totalScore: z.ZodNumber;
+        layerScores: z.ZodOptional<z.ZodObject<{
+            security: z.ZodNumber;
+            maintainability: z.ZodNumber;
+            ecosystem: z.ZodNumber;
+            upgradeImpact: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     findings: z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodUnknown>, z.ZodNull]>>, z.ZodTransform<unknown[], unknown[] | null | undefined>>;
     methodologyVersion: z.ZodOptional<z.ZodString>;
     confidence: z.ZodOptional<z.ZodEnum<{
@@ -210,6 +233,24 @@ export declare const engineOutputScanResultSchema: z.ZodObject<{
             }>;
         }, z.core.$strip>;
     }, z.core.$strip>;
+    prRisk: z.ZodObject<{
+        score: z.ZodNumber;
+        layerScores: z.ZodOptional<z.ZodObject<{
+            security: z.ZodNumber;
+            maintainability: z.ZodNumber;
+            ecosystem: z.ZodNumber;
+            upgradeImpact: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    repositoryHealth: z.ZodObject<{
+        totalScore: z.ZodNumber;
+        layerScores: z.ZodOptional<z.ZodObject<{
+            security: z.ZodNumber;
+            maintainability: z.ZodNumber;
+            ecosystem: z.ZodNumber;
+            upgradeImpact: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
 }, z.core.$loose>;
 export type EngineOutputScanResultParseFailure = {
     ok: false;

package/dist/scanResultSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanResultSchema.d.ts","sourceRoot":"","sources":["../src/scanResultSchema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtE,wGAAwG;AACxG,eAAO,MAAM,eAAe,EAAG,GAAY,CAAC;AAE5C,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,EAAG,GAAY,CAAC;AASnD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4Bb,CAAC;AAUjB;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIvC,CAAC;AAEH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC/C,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC;AAEF,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,OAAO,GACZ,kCAAkC,GAAG,kCAAkC,CAazE;AAED,uFAAuF;AACvF,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,OAAO,GACZ,uBAAuB,CAMzB;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,GACZ,sBAAsB,GAAG,sBAAsB,CAajD;AAED,yEAAyE;AACzE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAMhE"}
+{"version":3,"file":"scanResultSchema.d.ts","sourceRoot":"","sources":["../src/scanResultSchema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtE,wGAAwG;AACxG,eAAO,MAAM,eAAe,EAAG,GAAY,CAAC;AAE5C,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,EAAG,GAAY,CAAC;AAmBnD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAc/D;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8Bb,CAAC;AAUjB;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMvC,CAAC;AAEH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC/C,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC;AAEF,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,OAAO,GACZ,kCAAkC,GAAG,kCAAkC,CAezE;AAED,uFAAuF;AACvF,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,OAAO,GACZ,uBAAuB,CAMzB;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,GACZ,sBAAsB,GAAG,sBAAsB,CAajD;AAED,yEAAyE;AACzE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAMhE"}

package/dist/scanResultSchema.js

@@ -3,13 +3,42 @@ import { z } from "zod";
 /** Bump when persisted `result` JSON validation rules change materially (relaxed / legacy-tolerant). */
 export const SCAN_RESULT_ABI = "2";
 /** Bump when strict fresh-engine-output validation rules change materially. */
-export const ENGINE_OUTPUT_SCAN_ABI = "3";
+export const ENGINE_OUTPUT_SCAN_ABI = "4";
 const layerScoresSchema = z.object({
     security: z.number(),
     maintainability: z.number(),
     ecosystem: z.number(),
     upgradeImpact: z.number(),
 });
+const prRiskSchema = z.object({
+    score: z.number().min(0).max(100),
+    layerScores: layerScoresSchema.optional(),
+});
+const repositoryHealthSchema = z.object({
+    totalScore: z.number().min(0).max(100),
+    layerScores: layerScoresSchema.optional(),
+});
+/**
+ * Synthesize ABI-4 prRisk/repositoryHealth from legacy totalScore when an engine
+ * has not yet adopted the dual-score wire (transitional bridge).
+ */
+export function normalizeEngineOutputAbi4(raw) {
+    if (!raw || typeof raw !== "object")
+        return raw;
+    const obj = raw;
+    const totalScore = obj.totalScore;
+    const layerScores = obj.layerScores;
+    if (typeof totalScore !== "number" || !Number.isFinite(totalScore)) {
+        return raw;
+    }
+    if (!layerScores || typeof layerScores !== "object")
+        return raw;
+    return {
+        ...obj,
+        prRisk: obj.prRisk ?? { score: totalScore, layerScores },
+        repositoryHealth: obj.repositoryHealth ?? { totalScore, layerScores },
+    };
+}
 /**
  * Minimum structural invariants for **persisted** `scans.result` JSON and legacy reads.
  * `methodologyVersion` stays optional so historical rows without it remain valid.
@@ -19,6 +48,8 @@ export const scanResultSchema = z
     .object({
     totalScore: z.number().min(0).max(100),
     layerScores: layerScoresSchema,
+    prRisk: prRiskSchema.optional(),
+    repositoryHealth: repositoryHealthSchema.optional(),
     findings: z
         .union([z.array(z.unknown()), z.null()])
         .optional()
@@ -59,9 +90,11 @@ export const engineOutputScanResultSchema = scanResultSchema.extend({
     methodologyVersion: z.string().trim().min(1),
     generatedAt: engineOutputGeneratedAtSchema,
     assessment: assessmentSchema,
+    prRisk: prRiskSchema,
+    repositoryHealth: repositoryHealthSchema,
 });
 export function safeParseEngineOutputScanResult(data) {
-    const parsed = engineOutputScanResultSchema.safeParse(data);
+    const parsed = engineOutputScanResultSchema.safeParse(normalizeEngineOutputAbi4(data));
     if (!parsed.success) {
         const issues = parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`);
         return {