@mergesignal/shared 0.13.0 → 0.14.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. package/dist/assessment/literals.d.ts +1 -1
  2. package/dist/assessment/literals.d.ts.map +1 -1
  3. package/dist/assessment/literals.js +1 -1
  4. package/dist/assessment/schema.d.ts +2 -2
  5. package/dist/assessmentLabels.js +2 -2
  6. package/dist/assessmentProjection.js +2 -2
  7. package/dist/fixtures/assessmentFixtures.js +12 -12
  8. package/dist/presentation/profile/buildProfileFromAssessment.js +1 -1
  9. package/dist/scanResultSchema.d.ts +2 -2
  10. package/dist/scanSurfaceCopy.d.ts +1 -0
  11. package/dist/scanSurfaceCopy.d.ts.map +1 -1
  12. package/dist/scanSurfaceCopy.js +1 -0
  13. package/package.json +1 -1
package/dist/assessment/literals.d.ts CHANGED
@@ -5,7 +5,7 @@ export declare const ASSESSMENT_CONFIDENCES: readonly ["low", "medium", "high"];
5
5
  /** Per-package change classification tokens. */
6
6
  export declare const CHANGE_CLASSES: readonly ["tooling_maintenance", "test_infra", "runtime_patch", "runtime_upgrade", "security_advisory", "breaking_change", "ecosystem_unknown", "bulk_mixed", "removal"];
7
7
  /** Structured merge concern kinds. */
8
- export declare const MERGE_CONCERN_KINDS: readonly ["confirmed_runtime_usage", "security_finding", "breaking_or_major", "behavioral_change", "ecosystem_risk", "insufficient_evidence", "graph_baseline_only"];
8
+ export declare const MERGE_CONCERN_KINDS: readonly ["unresolved_runtime_exposure", "security_finding", "breaking_or_major", "behavioral_change", "ecosystem_risk", "insufficient_evidence", "graph_baseline_only"];
9
9
  /** Presentation narrative intensity. */
10
10
  export declare const NARRATIVE_INTENSITIES: readonly ["minimal", "standard", "elevated"];
11
11
  /** Presentation reach visibility. */
package/dist/assessment/literals.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"literals.d.ts","sourceRoot":"","sources":["../../src/assessment/literals.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,eAAO,MAAM,mBAAmB,4CAA6C,CAAC;AAE9E,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,oCAAqC,CAAC;AAEzE,gDAAgD;AAChD,eAAO,MAAM,cAAc,0KAUjB,CAAC;AAEX,sCAAsC;AACtC,eAAO,MAAM,mBAAmB,sKAQtB,CAAC;AAEX,wCAAwC;AACxC,eAAO,MAAM,qBAAqB,8CAIxB,CAAC;AAEX,qCAAqC;AACrC,eAAO,MAAM,kBAAkB,gDAIrB,CAAC;AAEX,2CAA2C;AAC3C,eAAO,MAAM,wBAAwB,2CAI3B,CAAC;AAEX,2CAA2C;AAC3C,eAAO,MAAM,uBAAuB,2CAI1B,CAAC;AAEX,wCAAwC;AACxC,eAAO,MAAM,uBAAuB,8DAG1B,CAAC;AAEX,yDAAyD;AACzD,eAAO,MAAM,qBAAqB,iHAOxB,CAAC;AAEX,yCAAyC;AACzC,eAAO,MAAM,yBAAyB,oGAM5B,CAAC;AAEX,8DAA8D;AAC9D,eAAO,MAAM,aAAa,kDAAmD,CAAC;AAE9E;;;GAGG;AACH,eAAO,MAAM,qBAAqB,kJASxB,CAAC;AAIX,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,oEAKtB,CAAC;AAEX,sCAAsC;AACtC,eAAO,MAAM,oBAAoB,0JAOvB,CAAC;AAEX,oDAAoD;AACpD,eAAO,MAAM,yBAAyB,wUAa5B,CAAC;AAEX,4CAA4C;AAC5C,eAAO,MAAM,2BAA2B,kEAI9B,CAAC;AAEX,gEAAgE;AAChE,eAAO,MAAM,eAAe,6CAA8C,CAAC;AAE3E,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,oLAQpB,CAAC;AAEX,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,6CAA8C,CAAC"}
1
+ {"version":3,"file":"literals.d.ts","sourceRoot":"","sources":["../../src/assessment/literals.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,eAAO,MAAM,mBAAmB,4CAA6C,CAAC;AAE9E,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,oCAAqC,CAAC;AAEzE,gDAAgD;AAChD,eAAO,MAAM,cAAc,0KAUjB,CAAC;AAEX,sCAAsC;AACtC,eAAO,MAAM,mBAAmB,0KAQtB,CAAC;AAEX,wCAAwC;AACxC,eAAO,MAAM,qBAAqB,8CAIxB,CAAC;AAEX,qCAAqC;AACrC,eAAO,MAAM,kBAAkB,gDAIrB,CAAC;AAEX,2CAA2C;AAC3C,eAAO,MAAM,wBAAwB,2CAI3B,CAAC;AAEX,2CAA2C;AAC3C,eAAO,MAAM,uBAAuB,2CAI1B,CAAC;AAEX,wCAAwC;AACxC,eAAO,MAAM,uBAAuB,8DAG1B,CAAC;AAEX,yDAAyD;AACzD,eAAO,MAAM,qBAAqB,iHAOxB,CAAC;AAEX,yCAAyC;AACzC,eAAO,MAAM,yBAAyB,oGAM5B,CAAC;AAEX,8DAA8D;AAC9D,eAAO,MAAM,aAAa,kDAAmD,CAAC;AAE9E;;;GAGG;AACH,eAAO,MAAM,qBAAqB,kJASxB,CAAC;AAIX,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,oEAKtB,CAAC;AAEX,sCAAsC;AACtC,eAAO,MAAM,oBAAoB,0JAOvB,CAAC;AAEX,oDAAoD;AACpD,eAAO,MAAM,yBAAyB,wUAa5B,CAAC;AAEX,4CAA4C;AAC5C,eAAO,MAAM,2BAA2B,kEAI9B,CAAC;AAEX,gEAAgE;AAChE,eAAO,MAAM,eAAe,6CAA8C,CAAC;AAE3E,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,oLAQpB,CAAC;AAEX,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB,6CAA8C,CAAC"}
package/dist/assessment/literals.js CHANGED
@@ -16,7 +16,7 @@ export const CHANGE_CLASSES = [
16
16
  ];
17
17
  /** Structured merge concern kinds. */
18
18
  export const MERGE_CONCERN_KINDS = [
19
- "confirmed_runtime_usage",
19
+ "unresolved_runtime_exposure",
20
20
  "security_finding",
21
21
  "breaking_or_major",
22
22
  "behavioral_change",
package/dist/assessment/schema.d.ts CHANGED
@@ -77,7 +77,7 @@ export declare const assessmentSchema: z.ZodObject<{
77
77
  high: "high";
78
78
  }>;
79
79
  primaryConcern: z.ZodNullable<z.ZodEnum<{
80
- confirmed_runtime_usage: "confirmed_runtime_usage";
80
+ unresolved_runtime_exposure: "unresolved_runtime_exposure";
81
81
  security_finding: "security_finding";
82
82
  breaking_or_major: "breaking_or_major";
83
83
  behavioral_change: "behavioral_change";
@@ -87,7 +87,7 @@ export declare const assessmentSchema: z.ZodObject<{
87
87
  }>>;
88
88
  concerns: z.ZodArray<z.ZodObject<{
89
89
  kind: z.ZodEnum<{
90
- confirmed_runtime_usage: "confirmed_runtime_usage";
90
+ unresolved_runtime_exposure: "unresolved_runtime_exposure";
91
91
  security_finding: "security_finding";
92
92
  breaking_or_major: "breaking_or_major";
93
93
  behavioral_change: "behavioral_change";
package/dist/assessmentLabels.js CHANGED
@@ -1,6 +1,6 @@
1
1
  /** Display labels for factor tokens (mirrors engine factor-registry labels). */
2
2
  export const ASSESSMENT_FACTOR_LABELS = {
3
- confirmed_runtime_usage: "Confirmed runtime usage",
3
+ unresolved_runtime_exposure: "Unresolved runtime exposure",
4
4
  queue_infrastructure: "Queue infrastructure",
5
5
  http_framework_infrastructure: "HTTP framework infrastructure",
6
6
  auth_infrastructure: "Authentication infrastructure",
@@ -20,7 +20,7 @@ export const ASSESSMENT_FACTOR_LABELS = {
20
20
  runtime_patch: "Runtime dependency patch",
21
21
  };
22
22
  export const MERGE_CONCERN_LABELS = {
23
- confirmed_runtime_usage: "Changed package has confirmed usage on runtime application paths in this repository.",
23
+ unresolved_runtime_exposure: "Changed package upgrade leaves unresolved runtime exposure that warrants review before merge.",
24
24
  security_finding: "Security advisory or vulnerability finding affects changed dependencies.",
25
25
  breaking_or_major: "Breaking change or major version bump warrants explicit review.",
26
26
  behavioral_change: "Behavioral change risk detected on changed dependencies.",
package/dist/assessmentProjection.js CHANGED
@@ -113,9 +113,9 @@ export function formatAssessmentHeadline(assessment, status) {
113
113
  const headline = copy.toolingPatchHeadline.replace("{package}", primaryPkg);
114
114
  return applyPostureVocabularyGuardHeadline(headline, status, primaryPkg);
115
115
  }
116
- if (assessment.primaryConcern === "confirmed_runtime_usage") {
116
+ if (assessment.primaryConcern === "unresolved_runtime_exposure") {
117
117
  const surface = surfaceHintFromAssessment(assessment);
118
- const headline = copy.runtimeUpgradeHeadline
118
+ const headline = copy.unresolvedRuntimeExposureHeadline
119
119
  .replace("{package}", primaryPkg)
120
120
  .replace("{surface}", surface);
121
121
  return applyPostureVocabularyGuardHeadline(headline, status, primaryPkg);
package/dist/fixtures/assessmentFixtures.js CHANGED
@@ -57,16 +57,16 @@ export const assessmentVitest = withAssessmentScope({
57
57
  export const assessmentFastifyRuntime = withAssessmentScope({
58
58
  posture: "needs_review",
59
59
  confidence: "medium",
60
- primaryConcern: "confirmed_runtime_usage",
60
+ primaryConcern: "unresolved_runtime_exposure",
61
61
  concerns: [
62
62
  {
63
- kind: "confirmed_runtime_usage",
63
+ kind: "unresolved_runtime_exposure",
64
64
  rank: 1,
65
65
  packages: ["fastify"],
66
66
  evidenceRefs: ["fixture:fastify"],
67
67
  },
68
68
  ],
69
- factors: ["confirmed_runtime_usage", "http_framework_infrastructure"],
69
+ factors: ["unresolved_runtime_exposure", "http_framework_infrastructure"],
70
70
  changeClasses: ["runtime_upgrade"],
71
71
  presentation: runtimeReviewPresentation,
72
72
  }, {
@@ -77,17 +77,17 @@ export const assessmentFastifyRuntime = withAssessmentScope({
77
77
  export const assessmentBullmq = withAssessmentScope({
78
78
  posture: "needs_review",
79
79
  confidence: "medium",
80
- primaryConcern: "confirmed_runtime_usage",
80
+ primaryConcern: "unresolved_runtime_exposure",
81
81
  concerns: [
82
82
  {
83
- kind: "confirmed_runtime_usage",
83
+ kind: "unresolved_runtime_exposure",
84
84
  rank: 1,
85
85
  packages: ["bullmq"],
86
86
  evidenceRefs: ["fixture:bullmq"],
87
87
  },
88
88
  ],
89
89
  factors: [
90
- "confirmed_runtime_usage",
90
+ "unresolved_runtime_exposure",
91
91
  "queue_infrastructure",
92
92
  "verification_required",
93
93
  ],
@@ -101,16 +101,16 @@ export const assessmentBullmq = withAssessmentScope({
101
101
  export const assessmentNextAuth = withAssessmentScope({
102
102
  posture: "needs_review",
103
103
  confidence: "medium",
104
- primaryConcern: "confirmed_runtime_usage",
104
+ primaryConcern: "unresolved_runtime_exposure",
105
105
  concerns: [
106
106
  {
107
- kind: "confirmed_runtime_usage",
107
+ kind: "unresolved_runtime_exposure",
108
108
  rank: 1,
109
109
  packages: ["next-auth"],
110
110
  evidenceRefs: ["fixture:nextauth"],
111
111
  },
112
112
  ],
113
- factors: ["confirmed_runtime_usage", "auth_infrastructure"],
113
+ factors: ["unresolved_runtime_exposure", "auth_infrastructure"],
114
114
  changeClasses: ["runtime_upgrade"],
115
115
  presentation: runtimeReviewPresentation,
116
116
  }, {
@@ -122,17 +122,17 @@ export const assessmentNextAuth = withAssessmentScope({
122
122
  export const assessmentMixedTypescriptFastify = withAssessmentScope({
123
123
  posture: "needs_review",
124
124
  confidence: "medium",
125
- primaryConcern: "confirmed_runtime_usage",
125
+ primaryConcern: "unresolved_runtime_exposure",
126
126
  concerns: [
127
127
  {
128
- kind: "confirmed_runtime_usage",
128
+ kind: "unresolved_runtime_exposure",
129
129
  rank: 1,
130
130
  packages: ["fastify"],
131
131
  evidenceRefs: ["fixture:fastify"],
132
132
  },
133
133
  ],
134
134
  factors: [
135
- "confirmed_runtime_usage",
135
+ "unresolved_runtime_exposure",
136
136
  "queue_infrastructure",
137
137
  "http_framework_infrastructure",
138
138
  ],
package/dist/presentation/profile/buildProfileFromAssessment.js CHANGED
@@ -25,7 +25,7 @@ function buildInterpretation(assessment, presentation, result) {
25
25
  else if (assessment.changeClasses.includes("tooling_maintenance")) {
26
26
  intent = "tooling_patch";
27
27
  }
28
- else if (assessment.primaryConcern === "confirmed_runtime_usage") {
28
+ else if (assessment.primaryConcern === "unresolved_runtime_exposure") {
29
29
  if (assessment.factors.includes("queue_infrastructure")) {
30
30
  intent = "queue_runtime_upgrade";
31
31
  }
package/dist/scanResultSchema.d.ts CHANGED
@@ -182,7 +182,7 @@ export declare const engineOutputScanResultSchema: z.ZodObject<{
182
182
  high: "high";
183
183
  }>;
184
184
  primaryConcern: z.ZodNullable<z.ZodEnum<{
185
- confirmed_runtime_usage: "confirmed_runtime_usage";
185
+ unresolved_runtime_exposure: "unresolved_runtime_exposure";
186
186
  security_finding: "security_finding";
187
187
  breaking_or_major: "breaking_or_major";
188
188
  behavioral_change: "behavioral_change";
@@ -192,7 +192,7 @@ export declare const engineOutputScanResultSchema: z.ZodObject<{
192
192
  }>>;
193
193
  concerns: z.ZodArray<z.ZodObject<{
194
194
  kind: z.ZodEnum<{
195
- confirmed_runtime_usage: "confirmed_runtime_usage";
195
+ unresolved_runtime_exposure: "unresolved_runtime_exposure";
196
196
  security_finding: "security_finding";
197
197
  breaking_or_major: "breaking_or_major";
198
198
  behavioral_change: "behavioral_change";
package/dist/scanSurfaceCopy.d.ts CHANGED
@@ -304,6 +304,7 @@ export declare const scanSurfaceCopy: {
304
304
  readonly toolingPatchHeadline: "{package} patch upgrade";
305
305
  readonly toolingUpgradeHeadline: "{package} tooling upgrade";
306
306
  readonly runtimeUpgradeHeadline: "{package} runtime upgrade affects {surface}";
307
+ readonly unresolvedRuntimeExposureHeadline: "{package} upgrade leaves unresolved exposure on {surface}";
307
308
  readonly safeNeutralHeadline: "{package} dependency upgrade";
308
309
  readonly defaultUpgradeHeadline: "{package} dependency upgrade needs review";
309
310
  readonly changedPackageKeyPoint: "Changed package: {package}";
package/dist/scanSurfaceCopy.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"scanSurfaceCopy.d.ts","sourceRoot":"","sources":["../src/scanSurfaceCopy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;QAoBxB,8EAA8E;;QAG9E,6DAA6D;;;;QAO7D,qDAAqD;;;;;QASrD,mEAAmE;;;;QAOnE,yFAAyF;;QAGzF,mFAAmF;;QAGnF,4EAA4E;;QAE5E,oDAAoD;;QAEpD,iGAAiG;;QAEjG,+DAA+D;;;QAI/D,6EAA6E;;;;;QAK7E,2CAA2C;;;QAK3C,2EAA2E;;QAE3E,4EAA4E;;;QAI5E,sEAAsE;;;IAGxE,2EAA2E;;;;;;;;;;;;;;QAiBzE,oEAAoE;;;IAGtE,wEAAwE;;;;;;QAOtE,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAkCzC,yDAAyD;;YAGzD,mDAAmD;;YAGnD,8BAA8B;;YAE9B,oDAAoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4CtD,6CAA6C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAsI/C,uFAAuF;;;;;;;;;;;;;;;;;;;;;;;;IAwBvF,kFAAkF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuClF,sEAAsE;;;;;CAO9D,CAAC;AAEX,iEAAiE;AACjE,wBAAgB,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa5D"}
1
+ {"version":3,"file":"scanSurfaceCopy.d.ts","sourceRoot":"","sources":["../src/scanSurfaceCopy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;QAoBxB,8EAA8E;;QAG9E,6DAA6D;;;;QAO7D,qDAAqD;;;;;QASrD,mEAAmE;;;;QAOnE,yFAAyF;;QAGzF,mFAAmF;;QAGnF,4EAA4E;;QAE5E,oDAAoD;;QAEpD,iGAAiG;;QAEjG,+DAA+D;;;QAI/D,6EAA6E;;;;;QAK7E,2CAA2C;;;QAK3C,2EAA2E;;QAE3E,4EAA4E;;;QAI5E,sEAAsE;;;IAGxE,2EAA2E;;;;;;;;;;;;;;QAiBzE,oEAAoE;;;IAGtE,wEAAwE;;;;;;QAOtE,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAkCzC,yDAAyD;;YAGzD,mDAAmD;;YAGnD,8BAA8B;;YAE9B,oDAAoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4CtD,6CAA6C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAsI/C,uFAAuF;;;;;;;;;;;;;;;;;;;;;;;;IAwBvF,kFAAkF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyClF,sEAAsE;;;;;CAO9D,CAAC;AAEX,iEAAiE;AACjE,wBAAgB,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa5D"}
package/dist/scanSurfaceCopy.js CHANGED
@@ -307,6 +307,7 @@ export const scanSurfaceCopy = {
307
307
  toolingPatchHeadline: "{package} patch upgrade",
308
308
  toolingUpgradeHeadline: "{package} tooling upgrade",
309
309
  runtimeUpgradeHeadline: "{package} runtime upgrade affects {surface}",
310
+ unresolvedRuntimeExposureHeadline: "{package} upgrade leaves unresolved exposure on {surface}",
310
311
  safeNeutralHeadline: "{package} dependency upgrade",
311
312
  defaultUpgradeHeadline: "{package} dependency upgrade needs review",
312
313
  changedPackageKeyPoint: "Changed package: {package}",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mergesignal/shared",
3
- "version": "0.13.0",
3
+ "version": "0.14.0",
4
4
  "description": "MergeSignal shared scan contract, presentation policy, and trusted validation",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",