@mergesignal/shared 0.2.0 → 0.2.2

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export * from "./formatInsight.js";
 export * from "./riskVocabulary.js";
 export * from "./selectTopAffectedAreas.js";
 export * from "./deriveScanSummaryText.js";
+export * from "./scanCardSummary.js";
 export * from "./scanResultSchema.js";
 export * from "./scanSurfaceCopy.js";
 export * from "./trustedScanGuards.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC"}

package/dist/index.js

@@ -3,6 +3,7 @@ export * from "./formatInsight.js";
 export * from "./riskVocabulary.js";
 export * from "./selectTopAffectedAreas.js";
 export * from "./deriveScanSummaryText.js";
+export * from "./scanCardSummary.js";
 export * from "./scanResultSchema.js";
 export * from "./scanSurfaceCopy.js";
 export * from "./trustedScanGuards.js";

package/dist/prCheckRunPresentation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prCheckRunPresentation.d.ts","sourceRoot":"","sources":["../src/prCheckRunPresentation.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAIV,UAAU,EAEX,MAAM,YAAY,CAAC;AAGpB,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,iCAAiC,IAAI,CAAC;AACnD,eAAO,MAAM,iCAAiC,MAAM,CAAC;AACrD,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAqB7C,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,iDAAiD;AACjD,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,GACD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAUnD,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,IAAI,GAAE,sBAA2B,GAChC,MAAM,CAMR;AA4BD,sEAAsE;AACtE,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAGrE;AAkGD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,IAAI,CAAC,wBAAwB,EAAE,UAAU,CAAC,GAC9C,cAAc,CA0BhB;AAqBD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,wBAAwB,GAC5B,eAAe,EAAE,CAmDnB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CA0E1E;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,wBAAwB,GAC5B,MAAM,CAIR;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAExE"}
+{"version":3,"file":"prCheckRunPresentation.d.ts","sourceRoot":"","sources":["../src/prCheckRunPresentation.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAIV,UAAU,EAEX,MAAM,YAAY,CAAC;AAGpB,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,iCAAiC,IAAI,CAAC;AACnD,eAAO,MAAM,iCAAiC,MAAM,CAAC;AACrD,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAqB7C,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,iDAAiD;AACjD,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,GACD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAUnD,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,IAAI,GAAE,sBAA2B,GAChC,MAAM,CAMR;AA4BD,sEAAsE;AACtE,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAGrE;AAkGD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,IAAI,CAAC,wBAAwB,EAAE,UAAU,CAAC,GAC9C,cAAc,CA0BhB;AAqBD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,wBAAwB,GAC5B,eAAe,EAAE,CAmDnB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CA4E1E;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,wBAAwB,GAC5B,MAAM,CAIR;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAExE"}

package/dist/prCheckRunPresentation.js

@@ -40,7 +40,7 @@ export function formatScanDashboardUrl(webAppOrigin, scanId) {
 export function buildPrCheckRunTitle(opts = {}) {
     const base = scanSurfaceCopy.checkRun.titleBase;
     if (opts.baselineOnly) {
-        return `${base} - ${scanSurfaceCopy.checkRun.titleBaselineSuffix}`;
+        return `${base} – ${scanSurfaceCopy.checkRun.titleBaselineSuffix}`;
     }
     return base;
 }
@@ -288,7 +288,7 @@ export function renderCheckRunMarkdown(sections) {
                 break;
             }
             case "footer": {
-                parts.push(`[${section.label}](${section.url})`);
+                parts.push(`<a href="${section.url}" target="_blank" rel="noopener noreferrer">${section.label}</a>`);
                 break;
             }
             default: {

package/dist/prCheckRunPresentation.test.js

@@ -32,12 +32,13 @@ function minimalResult(overrides = {}) {
     };
 }
 describe("buildPrCheckRunTitle", () => {
-    it("uses hyphenated product title", () => {
-        expect(buildPrCheckRunTitle()).toBe("MergeSignal scan - PR dependency change");
+    it("uses short product title without app prefix", () => {
+        expect(buildPrCheckRunTitle()).toBe("PR dependency change");
+        expect(buildPrCheckRunTitle()).not.toContain("MergeSignal scan");
         expect(buildPrCheckRunTitle()).not.toContain("—");
     });
     it("appends baseline suffix when requested", () => {
-        expect(buildPrCheckRunTitle({ baselineOnly: true })).toBe("MergeSignal scan - PR dependency change - baseline scan only");
+        expect(buildPrCheckRunTitle({ baselineOnly: true })).toBe("PR dependency change – baseline scan only");
     });
 });
 describe("formatScanDashboardUrl", () => {
@@ -99,7 +100,7 @@ describe("buildPrCheckRunSummaryMarkdown", () => {
             webAppOrigin: ORIGIN,
             baseline: false,
         });
-        expect(md).toContain(`[View full scan](${ORIGIN}/scan/${SCAN_ID})`);
+        expect(md).toContain(`<a href="${ORIGIN}/scan/${SCAN_ID}" target="_blank" rel="noopener noreferrer">View full scan</a>`);
     });
     it("baseline body omits repo graph score lines", () => {
         const md = buildPrCheckRunSummaryMarkdown({

package/dist/riskVocabulary.d.ts

@@ -16,6 +16,8 @@ export declare function mergePostureLabel(decision: string | null | undefined, f
  * e.g. "Risky, risk score 72" or "Safe"
  */
 export declare function ariaLabelForPosture(decision: string | null | undefined, score: number | null | undefined): string;
+/** Accessible label for unified PR card risk block. */
+export declare function ariaLabelForCardSummary(headline: string, riskIndex: number | null | undefined, summaryLine: string | null | undefined): string;
 export type SignalSeverity = "low" | "medium" | "high";
 /**
  * Format a signal severity for prose use — always returns a qualified string

package/dist/riskVocabulary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"riskVocabulary.d.ts","sourceRoot":"","sources":["../src/riskVocabulary.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAkB3D,MAAM,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAEpD,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAI5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAIjE,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,YAAY,GAAG,IAAI,CASrB;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,QAAQ,SAAM,GACb,MAAM,CAGR;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAIR;AAMD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAQvD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG3E"}
+{"version":3,"file":"riskVocabulary.d.ts","sourceRoot":"","sources":["../src/riskVocabulary.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAkB3D,MAAM,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAEpD,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAI5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAIjE,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,YAAY,GAAG,IAAI,CASrB;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,QAAQ,SAAM,GACb,MAAM,CAGR;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAIR;AAED,uDAAuD;AACvD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACrC,MAAM,CAKR;AAMD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAQvD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG3E"}

package/dist/riskVocabulary.js

@@ -37,6 +37,15 @@ export function ariaLabelForPosture(decision, score) {
         return `${label}, risk score ${Math.round(score)}`;
     return label;
 }
+/** Accessible label for unified PR card risk block. */
+export function ariaLabelForCardSummary(headline, riskIndex, summaryLine) {
+    const parts = [headline];
+    if (riskIndex != null)
+        parts.push(`risk index ${Math.round(riskIndex)}`);
+    if (summaryLine?.trim())
+        parts.push(summaryLine.trim());
+    return parts.join(". ");
+}
 const SIGNAL_SEVERITY_LABEL = {
     low: "Low",
     medium: "Medium",

package/dist/scanCardSummary.d.ts

@@ -0,0 +1,63 @@
+import { type MergePosture } from "./riskVocabulary.js";
+import type { Finding, ScanResult } from "./types.js";
+export type ScanPipelineStatus = "queued" | "running" | "done" | "failed";
+export type ScanCardPresentationState = "not_scanned" | "scanning" | "analysis_failed" | "ready" | "stale";
+export type RiskIndexBand = "low" | "medium" | "high";
+export type FindingCountSummary = {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+};
+export type ScanCardSummary = {
+    mergePosture: MergePosture | null;
+    riskIndex: number | null;
+    riskIndexBand: RiskIndexBand | null;
+    headline: string;
+    summaryLine: string | null;
+    findingCounts: FindingCountSummary | null;
+    topAffectedAreas: string[];
+};
+export declare const SCAN_CARD_SCANNING_SUMMARY = "Waiting for results\u2026";
+export type PipelineCompletionEvidence = {
+    scannedAt?: string | null;
+    decision?: string | null;
+    totalScore?: number | null;
+    hasResult?: boolean;
+};
+/** Scan completion signals — decision/totalScore/result are only set after analysis. */
+export declare function hasScanCompletionEvidence(evidence: PipelineCompletionEvidence): boolean;
+/**
+ * Resolve wire status using completion evidence (decision, totalScore, result).
+ * Handles races where denormalized columns are written before status flips to done.
+ */
+export declare function resolvePipelineStatus(status: string | undefined, evidence: PipelineCompletionEvidence): ScanPipelineStatus;
+/** Pipeline lifecycle copy that must never appear on completed scan cards. */
+export declare function isPipelinePlaceholderCopy(text: string | null | undefined): boolean;
+/** True when summary reflects pipeline lifecycle, not merge posture. */
+export declare function isPipelineCardSummary(summary: ScanCardSummary): boolean;
+/** Single source for risk index color bands (aligns with decision score bands). */
+export declare function deriveRiskIndexBand(score: number | null | undefined): RiskIndexBand | null;
+export declare function aggregateFindingCounts(findings: Finding[] | null | undefined): FindingCountSummary;
+/**
+ * Server-side card summary for PR dashboard list views.
+ * Pipeline lifecycle copy is included when `pipelineStatus !== "done"`.
+ */
+export declare function deriveScanCardSummary(result: ScanResult | null | undefined, pipelineStatus: ScanPipelineStatus): ScanCardSummary;
+/** Subline appended when scan results are stale (head SHA mismatch). */
+export declare function staleScanSubline(): string;
+/** Rebuild card summary from denormalized scan columns when result JSON is unavailable. */
+export declare function deriveScanCardSummaryFromDenormalized(decision: string | null, totalScore: number | null, summaryText: string | null, pipelineStatus: ScanPipelineStatus): ScanCardSummary;
+export type PrScanCardSummaryInput = {
+    pipelineStatus: string;
+    decision: string | null;
+    totalScore: number | null;
+    summaryText: string | null;
+    result: ScanResult | null;
+    scannedAt?: string | null;
+};
+/**
+ * Canonical card summary for PR list/dashboard — single derivation path for API + web.
+ */
+export declare function resolvePrScanCardSummary(input: PrScanCardSummaryInput): ScanCardSummary;
+//# sourceMappingURL=scanCardSummary.d.ts.map

package/dist/scanCardSummary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanCardSummary.d.ts","sourceRoot":"","sources":["../src/scanCardSummary.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE1E,MAAM,MAAM,yBAAyB,GACjC,aAAa,GACb,UAAU,GACV,iBAAiB,GACjB,OAAO,GACP,OAAO,CAAC;AAEZ,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAClC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC1C,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAIF,eAAO,MAAM,0BAA0B,8BAAyB,CAAC;AAEjE,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAsBF,wFAAwF;AACxF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAQT;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,0BAA0B,GACnC,kBAAkB,CAKpB;AAED,8EAA8E;AAC9E,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO,CAST;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CASvE;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,aAAa,GAAG,IAAI,CAKtB;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,GAAG,SAAS,GACrC,mBAAmB,CAgBrB;AAiBD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,EACrC,cAAc,EAAE,kBAAkB,GACjC,eAAe,CA6DjB;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,2FAA2F;AAC3F,wBAAgB,qCAAqC,CACnD,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,cAAc,EAAE,kBAAkB,GACjC,eAAe,CAsCjB;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,sBAAsB,GAC5B,eAAe,CAkDjB"}

package/dist/scanCardSummary.js

@@ -0,0 +1,248 @@
+import { deriveScanSummaryText } from "./deriveScanSummaryText.js";
+import { mergePostureFromDecision, MERGE_POSTURE_LABEL, } from "./riskVocabulary.js";
+import { scanSurfaceCopy } from "./scanSurfaceCopy.js";
+import { selectTopAffectedAreas } from "./selectTopAffectedAreas.js";
+const SAFE_SUMMARY = "No merge blockers detected";
+const STALE_SUBLINE = "Based on earlier commit";
+export const SCAN_CARD_SCANNING_SUMMARY = "Waiting for results…";
+function normalizePipelineStatus(status) {
+    const st = String(status ?? "")
+        .trim()
+        .toLowerCase();
+    if (st === "queued" || st === "running" || st === "done" || st === "failed") {
+        return st;
+    }
+    return "failed";
+}
+function isMergePostureDecision(decision) {
+    return (decision === "safe" || decision === "needs_review" || decision === "risky");
+}
+/** Scan completion signals — decision/totalScore/result are only set after analysis. */
+export function hasScanCompletionEvidence(evidence) {
+    if (isMergePostureDecision(evidence.decision))
+        return true;
+    if (evidence.hasResult === true)
+        return true;
+    if (evidence.totalScore != null && Number.isFinite(evidence.totalScore)) {
+        return true;
+    }
+    if (evidence.scannedAt?.trim())
+        return true;
+    return false;
+}
+/**
+ * Resolve wire status using completion evidence (decision, totalScore, result).
+ * Handles races where denormalized columns are written before status flips to done.
+ */
+export function resolvePipelineStatus(status, evidence) {
+    const normalized = normalizePipelineStatus(status);
+    if (normalized === "done" || normalized === "failed")
+        return normalized;
+    if (hasScanCompletionEvidence(evidence))
+        return "done";
+    return normalized;
+}
+/** Pipeline lifecycle copy that must never appear on completed scan cards. */
+export function isPipelinePlaceholderCopy(text) {
+    if (!text?.trim())
+        return false;
+    const t = text.trim();
+    return (t === SCAN_CARD_SCANNING_SUMMARY ||
+        t === scanSurfaceCopy.pipeline.scanRunning ||
+        t === scanSurfaceCopy.pipeline.scanIncomplete ||
+        t === scanSurfaceCopy.pipeline.scanUnavailable);
+}
+/** True when summary reflects pipeline lifecycle, not merge posture. */
+export function isPipelineCardSummary(summary) {
+    if (isPipelinePlaceholderCopy(summary.summaryLine))
+        return true;
+    return (summary.mergePosture === null &&
+        summary.riskIndex === null &&
+        (summary.headline === scanSurfaceCopy.pipeline.scanRunning ||
+            summary.headline === scanSurfaceCopy.pipeline.analysisIncomplete ||
+            summary.headline === scanSurfaceCopy.pipeline.scanUnavailable));
+}
+/** Single source for risk index color bands (aligns with decision score bands). */
+export function deriveRiskIndexBand(score) {
+    if (score == null || !Number.isFinite(score))
+        return null;
+    if (score > 60)
+        return "high";
+    if (score > 30)
+        return "medium";
+    return "low";
+}
+export function aggregateFindingCounts(findings) {
+    const counts = {
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0,
+    };
+    if (!Array.isArray(findings))
+        return counts;
+    for (const f of findings) {
+        const s = f.severity;
+        if (s === "critical")
+            counts.critical += 1;
+        else if (s === "high")
+            counts.high += 1;
+        else if (s === "medium")
+            counts.medium += 1;
+        else if (s === "low")
+            counts.low += 1;
+    }
+    return counts;
+}
+function hasActionableFindings(counts) {
+    return counts.critical + counts.high + counts.medium + counts.low > 0;
+}
+function deriveSafeSummaryLine(posture, counts, fallback) {
+    if (posture === "safe" && !hasActionableFindings(counts)) {
+        return SAFE_SUMMARY;
+    }
+    return fallback;
+}
+/**
+ * Server-side card summary for PR dashboard list views.
+ * Pipeline lifecycle copy is included when `pipelineStatus !== "done"`.
+ */
+export function deriveScanCardSummary(result, pipelineStatus) {
+    if (pipelineStatus === "queued" || pipelineStatus === "running") {
+        return {
+            mergePosture: null,
+            riskIndex: null,
+            riskIndexBand: null,
+            headline: scanSurfaceCopy.pipeline.scanRunning,
+            summaryLine: SCAN_CARD_SCANNING_SUMMARY,
+            findingCounts: null,
+            topAffectedAreas: [],
+        };
+    }
+    if (pipelineStatus === "failed") {
+        return {
+            mergePosture: null,
+            riskIndex: null,
+            riskIndexBand: null,
+            headline: scanSurfaceCopy.pipeline.analysisIncomplete,
+            summaryLine: null,
+            findingCounts: null,
+            topAffectedAreas: [],
+        };
+    }
+    if (!result) {
+        return {
+            mergePosture: null,
+            riskIndex: null,
+            riskIndexBand: null,
+            headline: scanSurfaceCopy.pipeline.scanUnavailable,
+            summaryLine: null,
+            findingCounts: null,
+            topAffectedAreas: [],
+        };
+    }
+    const posture = mergePostureFromDecision(result.decision?.recommendation) ?? null;
+    const riskIndex = typeof result.totalScore === "number" ? result.totalScore : null;
+    const riskIndexBand = deriveRiskIndexBand(riskIndex);
+    const findingCounts = aggregateFindingCounts(result.findings);
+    const summaryFromText = deriveScanSummaryText(result);
+    const headline = posture
+        ? MERGE_POSTURE_LABEL[posture]
+        : scanSurfaceCopy.checkRun.mergePostureUnavailable;
+    const summaryLine = posture
+        ? deriveSafeSummaryLine(posture, findingCounts, summaryFromText)
+        : summaryFromText;
+    return {
+        mergePosture: posture,
+        riskIndex,
+        riskIndexBand,
+        headline,
+        summaryLine,
+        findingCounts,
+        topAffectedAreas: selectTopAffectedAreas(result, { max: 2 }),
+    };
+}
+/** Subline appended when scan results are stale (head SHA mismatch). */
+export function staleScanSubline() {
+    return STALE_SUBLINE;
+}
+/** Rebuild card summary from denormalized scan columns when result JSON is unavailable. */
+export function deriveScanCardSummaryFromDenormalized(decision, totalScore, summaryText, pipelineStatus) {
+    if (pipelineStatus !== "done") {
+        return deriveScanCardSummary(null, pipelineStatus);
+    }
+    const posture = mergePostureFromDecision(decision);
+    const minimalResult = {
+        totalScore: totalScore ?? 0,
+        layerScores: {
+            security: 0,
+            maintainability: 0,
+            ecosystem: 0,
+            upgradeImpact: 0,
+        },
+        findings: [],
+        generatedAt: new Date().toISOString(),
+        decision: posture
+            ? { recommendation: posture, confidence: "medium", reasoning: [] }
+            : undefined,
+    };
+    const summary = deriveScanCardSummary(minimalResult, "done");
+    const sanitized = isPipelinePlaceholderCopy(summaryText)
+        ? null
+        : (summaryText?.trim() ?? null);
+    if (sanitized && !summary.summaryLine) {
+        return { ...summary, summaryLine: sanitized };
+    }
+    if (sanitized &&
+        posture &&
+        summary.summaryLine === SAFE_SUMMARY &&
+        sanitized !== SAFE_SUMMARY) {
+        return { ...summary, summaryLine: sanitized };
+    }
+    return summary;
+}
+/**
+ * Canonical card summary for PR list/dashboard — single derivation path for API + web.
+ */
+export function resolvePrScanCardSummary(input) {
+    const effectivePipeline = resolvePipelineStatus(input.pipelineStatus, {
+        decision: input.decision,
+        totalScore: input.totalScore,
+        hasResult: input.result != null,
+        scannedAt: input.scannedAt,
+    });
+    if (effectivePipeline === "done") {
+        const scanResult = input.result ??
+            (hasScanCompletionEvidence({
+                decision: input.decision,
+                totalScore: input.totalScore,
+                hasResult: false,
+            })
+                ? {
+                    totalScore: input.totalScore ?? 0,
+                    layerScores: {
+                        security: 0,
+                        maintainability: 0,
+                        ecosystem: 0,
+                        upgradeImpact: 0,
+                    },
+                    findings: [],
+                    generatedAt: new Date().toISOString(),
+                    decision: mergePostureFromDecision(input.decision)
+                        ? {
+                            recommendation: mergePostureFromDecision(input.decision),
+                            confidence: "medium",
+                            reasoning: [],
+                        }
+                        : undefined,
+                }
+                : null);
+        if (scanResult) {
+            const fromResult = deriveScanCardSummary(scanResult, "done");
+            if (!isPipelineCardSummary(fromResult))
+                return fromResult;
+        }
+        return deriveScanCardSummaryFromDenormalized(input.decision, input.totalScore, input.summaryText, "done");
+    }
+    return deriveScanCardSummary(input.result, effectivePipeline);
+}

package/dist/scanCardSummary.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scanCardSummary.test.d.ts.map

package/dist/scanCardSummary.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanCardSummary.test.d.ts","sourceRoot":"","sources":["../src/scanCardSummary.test.ts"],"names":[],"mappings":""}

package/dist/scanCardSummary.test.js

@@ -0,0 +1,199 @@
+import { describe, it, expect } from "vitest";
+import { aggregateFindingCounts, deriveRiskIndexBand, deriveScanCardSummary, deriveScanCardSummaryFromDenormalized, isPipelineCardSummary, isPipelinePlaceholderCopy, resolvePipelineStatus, resolvePrScanCardSummary, staleScanSubline, } from "./scanCardSummary.js";
+const baseResult = {
+    totalScore: 10,
+    layerScores: {
+        security: 1,
+        maintainability: 2,
+        ecosystem: 3,
+        upgradeImpact: 4,
+    },
+    findings: [],
+    generatedAt: "2026-01-01T00:00:00.000Z",
+};
+describe("deriveRiskIndexBand", () => {
+    it("maps score thresholds", () => {
+        expect(deriveRiskIndexBand(0)).toBe("low");
+        expect(deriveRiskIndexBand(30)).toBe("low");
+        expect(deriveRiskIndexBand(31)).toBe("medium");
+        expect(deriveRiskIndexBand(60)).toBe("medium");
+        expect(deriveRiskIndexBand(61)).toBe("high");
+        expect(deriveRiskIndexBand(null)).toBeNull();
+    });
+});
+describe("aggregateFindingCounts", () => {
+    it("counts by severity", () => {
+        expect(aggregateFindingCounts([
+            {
+                id: "1",
+                title: "a",
+                description: "d",
+                severity: "critical",
+                packageName: "p",
+            },
+            {
+                id: "2",
+                title: "b",
+                description: "d",
+                severity: "high",
+                packageName: "p",
+            },
+            {
+                id: "3",
+                title: "c",
+                description: "d",
+                severity: "high",
+                packageName: "p",
+            },
+        ])).toEqual({ critical: 1, high: 2, medium: 0, low: 0 });
+    });
+});
+describe("deriveScanCardSummary", () => {
+    it("returns scanning copy for queued/running", () => {
+        const queued = deriveScanCardSummary(null, "queued");
+        expect(queued.headline).toBe("Scan in progress");
+        expect(queued.summaryLine).toBe("Waiting for results…");
+        expect(queued.mergePosture).toBeNull();
+        const running = deriveScanCardSummary(null, "running");
+        expect(running.headline).toBe("Scan in progress");
+    });
+    it("returns failed copy", () => {
+        const failed = deriveScanCardSummary(null, "failed");
+        expect(failed.headline).toBe("Analysis could not be completed");
+        expect(failed.mergePosture).toBeNull();
+    });
+    it("derives posture headline and risk index for done scans", () => {
+        const r = {
+            ...baseResult,
+            totalScore: 72,
+            decision: {
+                recommendation: "risky",
+                confidence: "high",
+                reasoning: ["Auth boundary change"],
+            },
+        };
+        const summary = deriveScanCardSummary(r, "done");
+        expect(summary.mergePosture).toBe("risky");
+        expect(summary.headline).toBe("Risky");
+        expect(summary.riskIndex).toBe(72);
+        expect(summary.riskIndexBand).toBe("high");
+        expect(summary.summaryLine).toBe("Auth boundary change");
+    });
+    it("uses safe copy when posture is safe and no findings", () => {
+        const r = {
+            ...baseResult,
+            totalScore: 12,
+            decision: {
+                recommendation: "safe",
+                confidence: "high",
+                reasoning: [],
+            },
+        };
+        const summary = deriveScanCardSummary(r, "done");
+        expect(summary.summaryLine).toBe("No merge blockers detected");
+    });
+    it("caps top affected areas at 2", () => {
+        const r = {
+            ...baseResult,
+            decision: {
+                recommendation: "needs_review",
+                confidence: "medium",
+                reasoning: ["Review needed"],
+            },
+            explain: {
+                reasons: [
+                    { id: "1", layer: "security", title: "A", scoreImpact: -10 },
+                    { id: "2", layer: "security", title: "B", scoreImpact: -9 },
+                    { id: "3", layer: "security", title: "C", scoreImpact: -8 },
+                ],
+            },
+        };
+        const summary = deriveScanCardSummary(r, "done");
+        expect(summary.topAffectedAreas).toHaveLength(2);
+    });
+    it("exports stale subline constant", () => {
+        expect(staleScanSubline()).toBe("Based on earlier commit");
+    });
+});
+describe("resolvePipelineStatus", () => {
+    it("promotes running to done when completion evidence exists", () => {
+        expect(resolvePipelineStatus("running", {
+            scannedAt: "2026-01-01T00:00:00.000Z",
+            decision: "risky",
+        })).toBe("done");
+    });
+    it("promotes running to done with decision only (no scannedAt)", () => {
+        expect(resolvePipelineStatus("running", {
+            decision: "risky",
+        })).toBe("done");
+    });
+    it("promotes running to done with totalScore only", () => {
+        expect(resolvePipelineStatus("running", { totalScore: 72 })).toBe("done");
+    });
+    it("promotes running to done with scannedAt only", () => {
+        expect(resolvePipelineStatus("running", {
+            scannedAt: "2026-01-01T00:00:00.000Z",
+        })).toBe("done");
+    });
+    it("keeps running when no completion evidence", () => {
+        expect(resolvePipelineStatus("running", {})).toBe("running");
+    });
+});
+describe("isPipelineCardSummary", () => {
+    it("detects scanning placeholder summaries", () => {
+        expect(isPipelineCardSummary({
+            mergePosture: null,
+            riskIndex: null,
+            riskIndexBand: null,
+            headline: "Scan in progress",
+            summaryLine: "Waiting for results…",
+            findingCounts: null,
+            topAffectedAreas: [],
+        })).toBe(true);
+    });
+    it("detects hybrid completed posture with pipeline summary line", () => {
+        expect(isPipelineCardSummary({
+            mergePosture: "risky",
+            riskIndex: 72,
+            riskIndexBand: "high",
+            headline: "Risky",
+            summaryLine: "Waiting for results…",
+            findingCounts: null,
+            topAffectedAreas: [],
+        })).toBe(true);
+    });
+});
+describe("isPipelinePlaceholderCopy", () => {
+    it("identifies waiting copy", () => {
+        expect(isPipelinePlaceholderCopy("Waiting for results…")).toBe(true);
+        expect(isPipelinePlaceholderCopy("Auth change")).toBe(false);
+    });
+});
+describe("deriveScanCardSummaryFromDenormalized", () => {
+    it("builds risky summary from denormalized columns", () => {
+        const summary = deriveScanCardSummaryFromDenormalized("risky", 72, "Auth boundary change", "done");
+        expect(summary.mergePosture).toBe("risky");
+        expect(summary.headline).toBe("Risky");
+        expect(summary.riskIndex).toBe(72);
+        expect(summary.summaryLine).toBe("Auth boundary change");
+    });
+    it("does not inject pipeline placeholder summaryText", () => {
+        const summary = deriveScanCardSummaryFromDenormalized("risky", 72, "Waiting for results…", "done");
+        expect(summary.mergePosture).toBe("risky");
+        expect(summary.summaryLine).not.toBe("Waiting for results…");
+    });
+});
+describe("resolvePrScanCardSummary", () => {
+    it("returns risk summary when wire status is running but decision exists", () => {
+        const summary = resolvePrScanCardSummary({
+            pipelineStatus: "running",
+            decision: "risky",
+            totalScore: 80,
+            summaryText: "Waiting for results…",
+            result: null,
+        });
+        expect(summary.mergePosture).toBe("risky");
+        expect(summary.headline).toBe("Risky");
+        expect(summary.summaryLine).not.toBe("Waiting for results…");
+    });
+});

package/dist/scanSurfaceCopy.d.ts

@@ -60,7 +60,7 @@ export declare const scanSurfaceCopy: {
     };
     /** GitHub App Check Run (PR) — calm, concise; not Actions step summary. */
     readonly checkRun: {
-        readonly titleBase: "MergeSignal scan - PR dependency change";
+        readonly titleBase: "PR dependency change";
         readonly titleBaselineSuffix: "baseline scan only";
         readonly baselineOutcomePrimary: "No actionable dependency concerns showed up for this PR in this scan.";
         readonly baselineOutcomeScope: "This run emphasizes repository-wide context; open the scan for PR-specific detail when available.";

package/dist/scanSurfaceCopy.js

@@ -60,7 +60,7 @@ export const scanSurfaceCopy = {
     },
     /** GitHub App Check Run (PR) — calm, concise; not Actions step summary. */
     checkRun: {
-        titleBase: "MergeSignal scan - PR dependency change",
+        titleBase: "PR dependency change",
         titleBaselineSuffix: "baseline scan only",
         baselineOutcomePrimary: "No actionable dependency concerns showed up for this PR in this scan.",
         baselineOutcomeScope: "This run emphasizes repository-wide context; open the scan for PR-specific detail when available.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mergesignal/shared",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "MergeSignal shared scan contract, presentation policy, and trusted validation",
   "type": "module",
   "main": "./dist/index.js",