@mergesignal/shared 0.2.0

package/dist/actionsStepSummary.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=actionsStepSummary.test.d.ts.map

package/dist/actionsStepSummary.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionsStepSummary.test.d.ts","sourceRoot":"","sources":["../src/actionsStepSummary.test.ts"],"names":[],"mappings":""}

package/dist/actionsStepSummary.test.js

@@ -0,0 +1,348 @@
+import { describe, it, expect } from "vitest";
+import { ACTIONS_SUMMARY_DEFAULT_MAX_CHARS, ACTIONS_SUMMARY_DEFAULT_MAX_LINES, actionsSummaryDefaultFoldPrefix, buildActionsStepSummaryMarkdown, humanizeEngineSurfaceText, layerDriverSummary, layerRiskBandLabel, sortPRInsightsForDisplay, sortRecommendationsForDisplay, } from "./actionsStepSummary.js";
+import { scanSurfaceCopyFlat } from "./scanSurfaceCopy.js";
+const copy = scanSurfaceCopyFlat();
+function makeInsight(overrides) {
+    return {
+        type: "usage_risk",
+        priority: "high",
+        confidence: "likely",
+        scope: "changed",
+        context: "ctx",
+        remediation: "fix",
+        ...overrides,
+    };
+}
+describe("layerRiskBandLabel", () => {
+    it("maps numeric layer scores to Low / Moderate / High", () => {
+        expect(layerRiskBandLabel(0)).toBe("Low");
+        expect(layerRiskBandLabel(19.9)).toBe("Low");
+        expect(layerRiskBandLabel(25)).toBe("Moderate");
+        expect(layerRiskBandLabel(50)).toBe("High");
+        expect(layerRiskBandLabel(null)).toBe("—");
+    });
+});
+describe("humanizeEngineSurfaceText", () => {
+    it("rewrites known graph metric tokens without adding new facts", () => {
+        expect(humanizeEngineSurfaceText("graph.depth")).toBe("Indirect dependency depth");
+        expect(humanizeEngineSurfaceText("graph.transitive volume")).toBe("Transitive dependency volume");
+        expect(humanizeEngineSurfaceText("graph.fan in max")).toBe("Many import paths converge on a few widely shared packages");
+    });
+    it("rewrites ecosystem surface and duplicate-path tokens", () => {
+        expect(humanizeEngineSurfaceText("Ecosystem.package surface")).toBe("Broad declared package footprint");
+        expect(humanizeEngineSurfaceText("Graph.duplicates")).toBe("Overlapping dependency paths to the same packages");
+    });
+    it("merges dependency depth phrasing into one canonical reviewer line", () => {
+        expect(humanizeEngineSurfaceText("dependency chain depth")).toBe("Indirect dependency depth");
+        expect(humanizeEngineSurfaceText("dependency depth")).toBe("Indirect dependency depth");
+    });
+    it("leaves ordinary explain titles mostly intact", () => {
+        expect(humanizeEngineSurfaceText("Duplicate majors on runtime boundary")).toBe("Duplicate majors on runtime boundary");
+    });
+});
+describe("sortPRInsightsForDisplay", () => {
+    it("orders by priority, confidence, then changed scope", () => {
+        const a = makeInsight({
+            message: "a",
+            priority: "medium",
+            confidence: "confirmed",
+            scope: "all",
+        });
+        const b = makeInsight({
+            message: "b",
+            priority: "high",
+            confidence: "likely",
+            scope: "changed",
+        });
+        const c = makeInsight({
+            message: "c",
+            priority: "high",
+            confidence: "confirmed",
+            scope: "all",
+        });
+        expect(sortPRInsightsForDisplay([a, b, c]).map((i) => i.message)).toEqual([
+            "c",
+            "b",
+            "a",
+        ]);
+    });
+});
+describe("sortRecommendationsForDisplay", () => {
+    it("orders by priorityScore then impact", () => {
+        const recs = [
+            {
+                id: "1",
+                title: "Low prio",
+                rationale: "",
+                impact: "low",
+                priorityScore: 10,
+            },
+            {
+                id: "2",
+                title: "High prio",
+                rationale: "",
+                impact: "high",
+                priorityScore: 90,
+            },
+        ];
+        expect(sortRecommendationsForDisplay(recs).map((r) => r.id)).toEqual([
+            "2",
+            "1",
+        ]);
+    });
+});
+describe("buildActionsStepSummaryMarkdown", () => {
+    const trustedBase = {
+        totalScore: 42,
+        layerScores: {
+            security: 10,
+            maintainability: 50,
+            ecosystem: 30,
+            upgradeImpact: 40,
+        },
+        findings: [],
+        recommendations: [],
+        generatedAt: "2026-01-01T00:00:00.000Z",
+        methodologyVersion: "engine-test-fixture/v1",
+        decision: {
+            recommendation: "needs_review",
+            confidence: "high",
+            reasoning: ["Transitive dependency depth increased on hot paths."],
+        },
+        insights: [],
+    };
+    it("trusted: includes posture, risk index direction, and score breakdown", () => {
+        const md = buildActionsStepSummaryMarkdown({
+            result: trustedBase,
+            profile: "trusted",
+            copy,
+        });
+        expect(md).toMatch(/# MergeSignal dependency review — Needs review/);
+        expect(md).toMatch(/Risk index 42\/100/);
+        expect(md).toContain(copy["actions.riskIndexDirectionShort"]);
+        expect(md).toContain("| Layer | Score | Layer risk |");
+        expect(md).toContain("| Security | 10 | Low |");
+        expect(md).toMatch(/<details>/);
+        expect(md).not.toContain(copy["actions.layerScoreGlossary"]);
+    });
+    it("trusted: surfaces top insights and moves remainder to details", () => {
+        const insights = [
+            makeInsight({ message: "First critical", priority: "critical" }),
+            makeInsight({ message: "Second high", priority: "high" }),
+            makeInsight({ message: "Third medium", priority: "medium" }),
+            makeInsight({ message: "Fourth overflow", priority: "medium" }),
+        ];
+        const md = buildActionsStepSummaryMarkdown({
+            result: { ...trustedBase, insights },
+            profile: "trusted",
+            copy,
+        });
+        expect(md).toContain("First critical");
+        expect(md).toContain(copy["actions.moreInsightsDetailsSummary"]);
+        expect(md).toContain("Fourth overflow");
+    });
+    it("trusted: no decision uses posture-unavailable copy", () => {
+        const { decision: _d, ...rest } = trustedBase;
+        const md = buildActionsStepSummaryMarkdown({
+            result: rest,
+            profile: "trusted",
+            copy,
+        });
+        expect(md).toContain(copy["actions.mergePostureUnavailableShort"]);
+    });
+    it("development + stub shows demo banner and score breakdown", () => {
+        const md = buildActionsStepSummaryMarkdown({
+            result: {
+                ...trustedBase,
+                methodologyVersion: "engine-stub/v2",
+                decision: {
+                    recommendation: "safe",
+                    confidence: "high",
+                    reasoning: [],
+                },
+            },
+            profile: "development",
+            copy,
+        });
+        expect(md).toContain(copy["actions.demoSummaryBanner"]);
+        expect(md).toContain("| Layer | Score | Layer risk |");
+        expect(md).toContain(copy["actions.layerScoreGlossary"]);
+    });
+    it("default-fold budget: heavy fixture stays within caps", () => {
+        const long = "x".repeat(400);
+        const insights = Array.from({ length: 12 }, (_, i) => makeInsight({
+            message: `${long} ${i}`,
+            priority: i === 0 ? "critical" : "medium",
+        }));
+        const recs = Array.from({ length: 8 }, (_, i) => ({
+            id: `r${i}`,
+            title: `Rec ${i}`,
+            rationale: long,
+            impact: "high",
+            priorityScore: 100 - i,
+        }));
+        const md = buildActionsStepSummaryMarkdown({
+            result: {
+                ...trustedBase,
+                insights,
+                recommendations: recs,
+                explain: {
+                    reasons: Array.from({ length: 10 }, (_, i) => ({
+                        id: `e${i}`,
+                        layer: "security",
+                        title: `Explain ${i}`,
+                        scoreImpact: 1,
+                    })),
+                },
+            },
+            profile: "trusted",
+            copy,
+        });
+        const prefix = actionsSummaryDefaultFoldPrefix(md);
+        expect(prefix.split("\n").length).toBeLessThanOrEqual(ACTIONS_SUMMARY_DEFAULT_MAX_LINES + 4);
+        expect(prefix.length).toBeLessThanOrEqual(ACTIONS_SUMMARY_DEFAULT_MAX_CHARS + 400);
+    });
+    it("includes scan-specific layer drivers from explain.reasons", () => {
+        const md = buildActionsStepSummaryMarkdown({
+            result: {
+                ...trustedBase,
+                layerScores: { ...trustedBase.layerScores, maintainability: 72 },
+                explain: {
+                    reasons: [
+                        {
+                            id: "x",
+                            layer: "maintainability",
+                            title: "Duplicate majors on runtime boundary",
+                            scoreImpact: 12,
+                        },
+                        {
+                            id: "y",
+                            layer: "maintainability",
+                            title: "Churn in devDependencies cluster",
+                            scoreImpact: 5,
+                        },
+                    ],
+                },
+            },
+            profile: "trusted",
+            copy,
+        });
+        expect(md).toContain(copy["actions.layerDriversHeading"]);
+        expect(md).toContain("Duplicate majors on runtime boundary");
+    });
+    it("layerDriverSummary returns null when no explain data for layer", () => {
+        expect(layerDriverSummary(trustedBase, "security", 120)).toBeNull();
+    });
+    it("generic recommendation titles lead with rationale in default fold", () => {
+        const md = buildActionsStepSummaryMarkdown({
+            result: {
+                ...trustedBase,
+                insights: [],
+                recommendations: [
+                    {
+                        id: "r1",
+                        title: "Reduce transitive dependency surface area",
+                        rationale: "This PR adds lodash twice at incompatible semver ranges pulled through different path aliases, widening the install tree.",
+                        impact: "high",
+                        priorityScore: 90,
+                    },
+                ],
+            },
+            profile: "trusted",
+            copy,
+        });
+        expect(md).toContain(copy["actions.recReviewLeadPrefix"]);
+        expect(md).toContain("incompatible semver");
+        expect(md).toContain("*Focus:*");
+        expect(md).toContain("Reduce transitive dependency surface area");
+    });
+    it("applies rec review prefix only to the first rationale-first recommendation", () => {
+        const md = buildActionsStepSummaryMarkdown({
+            result: {
+                ...trustedBase,
+                insights: [],
+                recommendations: [
+                    {
+                        id: "r1",
+                        title: "Reduce transitive dependency surface area",
+                        rationale: "This PR adds lodash twice at incompatible semver ranges pulled through different path aliases, widening the install tree.",
+                        impact: "high",
+                        priorityScore: 90,
+                    },
+                    {
+                        id: "r2",
+                        title: "Minimize dependency footprint in the service layer",
+                        rationale: "Several packages are pulled in only for types while runtime bundles still resolve overlapping majors, which increases upgrade coupling across services.",
+                        impact: "high",
+                        priorityScore: 85,
+                    },
+                ],
+            },
+            profile: "trusted",
+            copy,
+        });
+        const prefix = copy["actions.recReviewLeadPrefix"];
+        const first = md.indexOf(prefix);
+        const second = md.indexOf(prefix, first + 1);
+        expect(first).toBeGreaterThan(-1);
+        expect(second).toBe(-1);
+    });
+    it("humanizes graph metric tokens in explain-driven layer drivers", () => {
+        const md = buildActionsStepSummaryMarkdown({
+            result: {
+                ...trustedBase,
+                layerScores: { ...trustedBase.layerScores, maintainability: 72 },
+                explain: {
+                    reasons: [
+                        {
+                            id: "gdepth",
+                            layer: "maintainability",
+                            title: "graph.depth",
+                            scoreImpact: 12,
+                        },
+                    ],
+                },
+            },
+            profile: "trusted",
+            copy,
+        });
+        expect(md).toContain("Indirect dependency depth");
+        expect(md).not.toContain("graph.depth");
+    });
+    it("includes graph details when graphInsights present", () => {
+        const md = buildActionsStepSummaryMarkdown({
+            result: {
+                ...trustedBase,
+                graphInsights: {
+                    maxDepth: 7,
+                    nodes: 900,
+                    edges: 1200,
+                    deepest: [
+                        {
+                            kind: "deep",
+                            packageName: "lodash",
+                            direct: false,
+                            depth: 7,
+                            via: ["a", "b"],
+                        },
+                    ],
+                    hotspots: [
+                        {
+                            kind: "hotspot",
+                            packageName: "x",
+                            direct: true,
+                            depth: 1,
+                        },
+                    ],
+                    vulnerable: [],
+                },
+            },
+            profile: "trusted",
+            copy,
+        });
+        expect(md).toContain(copy["actions.dependencyGraphDetailsSummary"]);
+        expect(md).toContain("moderately deep");
+        expect(md).toContain("fairly broad");
+        expect(md).toMatch(/> \*max chain length 7 · 900 resolved packages\*/);
+    });
+});

package/dist/deriveScanSummaryText.d.ts

@@ -0,0 +1,7 @@
+import type { ScanResult } from "./types.js";
+/**
+ * One-line summary for PR scan list cards (server or client).
+ * Prefers decision reasoning, then finding severity counts.
+ */
+export declare function deriveScanSummaryText(result: ScanResult | null | undefined): string | null;
+//# sourceMappingURL=deriveScanSummaryText.d.ts.map

package/dist/deriveScanSummaryText.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deriveScanSummaryText.d.ts","sourceRoot":"","sources":["../src/deriveScanSummaryText.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACpC,MAAM,GAAG,IAAI,CAqBf"}

package/dist/deriveScanSummaryText.js

@@ -0,0 +1,24 @@
+/**
+ * One-line summary for PR scan list cards (server or client).
+ * Prefers decision reasoning, then finding severity counts.
+ */
+export function deriveScanSummaryText(result) {
+    if (!result)
+        return null;
+    const decision = result.decision;
+    const reasoning = decision?.reasoning;
+    if (Array.isArray(reasoning) && reasoning.length > 0) {
+        const first = String(reasoning[0]).trim();
+        return first.length > 120 ? first.slice(0, 119) + "…" : first;
+    }
+    const findings = result.findings;
+    if (Array.isArray(findings) && findings.length > 0) {
+        const high = findings.filter((f) => f.severity === "high").length;
+        const medium = findings.filter((f) => f.severity === "medium").length;
+        if (high > 0)
+            return `${high} high-severity finding${high > 1 ? "s" : ""} detected`;
+        if (medium > 0)
+            return `${medium} medium-severity finding${medium > 1 ? "s" : ""} detected`;
+    }
+    return null;
+}

package/dist/deriveScanSummaryText.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deriveScanSummaryText.test.d.ts.map

package/dist/deriveScanSummaryText.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deriveScanSummaryText.test.d.ts","sourceRoot":"","sources":["../src/deriveScanSummaryText.test.ts"],"names":[],"mappings":""}

package/dist/deriveScanSummaryText.test.js

@@ -0,0 +1,77 @@
+import { describe, it, expect } from "vitest";
+import { deriveScanSummaryText } from "./deriveScanSummaryText.js";
+describe("deriveScanSummaryText", () => {
+    it("returns null for empty input", () => {
+        expect(deriveScanSummaryText(undefined)).toBeNull();
+        expect(deriveScanSummaryText(null)).toBeNull();
+    });
+    it("uses first decision reasoning", () => {
+        const r = {
+            totalScore: 10,
+            layerScores: {
+                security: 1,
+                maintainability: 2,
+                ecosystem: 3,
+                upgradeImpact: 4,
+            },
+            findings: [],
+            generatedAt: "2026-01-01T00:00:00.000Z",
+            decision: {
+                recommendation: "needs_review",
+                confidence: "medium",
+                reasoning: ["First reason line", "Second"],
+            },
+        };
+        expect(deriveScanSummaryText(r)).toBe("First reason line");
+    });
+    it("truncates long reasoning", () => {
+        const long = "a".repeat(130);
+        const r = {
+            totalScore: 10,
+            layerScores: {
+                security: 1,
+                maintainability: 2,
+                ecosystem: 3,
+                upgradeImpact: 4,
+            },
+            findings: [],
+            generatedAt: "2026-01-01T00:00:00.000Z",
+            decision: {
+                recommendation: "safe",
+                confidence: "high",
+                reasoning: [long],
+            },
+        };
+        expect(deriveScanSummaryText(r).length).toBe(120);
+        expect(deriveScanSummaryText(r).endsWith("…")).toBe(true);
+    });
+    it("falls back to high-severity findings", () => {
+        const r = {
+            totalScore: 80,
+            layerScores: {
+                security: 80,
+                maintainability: 10,
+                ecosystem: 10,
+                upgradeImpact: 10,
+            },
+            findings: [
+                {
+                    id: "1",
+                    title: "x",
+                    description: "d",
+                    severity: "high",
+                    packageName: "p",
+                },
+                {
+                    id: "2",
+                    title: "y",
+                    description: "d",
+                    severity: "high",
+                    packageName: "q",
+                },
+            ],
+            generatedAt: "2026-01-01T00:00:00.000Z",
+        };
+        expect(deriveScanSummaryText(r)).toBe("2 high-severity findings detected");
+    });
+});

package/dist/formatInsight.d.ts

@@ -0,0 +1,10 @@
+import type { PRInsight, PRDecision, PRDecisionRecommendation } from "./types.js";
+export type FormattedInsight = {
+    message: string;
+    where: string;
+    action: string;
+};
+export declare function decisionTitle(recommendation: PRDecisionRecommendation): string;
+export declare function formatInsight(insight: PRInsight): FormattedInsight;
+export declare function renderInsightsAsMarkdown(insights: PRInsight[], decision: PRDecision): string;
+//# sourceMappingURL=formatInsight.d.ts.map

package/dist/formatInsight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatInsight.d.ts","sourceRoot":"","sources":["../src/formatInsight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EACV,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAGpB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AASF,wBAAgB,aAAa,CAC3B,cAAc,EAAE,wBAAwB,GACvC,MAAM,CAER;AAgBD,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,gBAAgB,CAMlE;AAkBD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,SAAS,EAAE,EACrB,QAAQ,EAAE,UAAU,GACnB,MAAM,CAMR"}

package/dist/formatInsight.js

@@ -0,0 +1,49 @@
+const DECISION_TITLES = {
+    safe: "No significant dependency risks detected",
+    needs_review: "Elevated dependency merge risk",
+    risky: "Merge blocked — critical dependency risk",
+};
+// Title rendered once per PR comment, not per insight
+export function decisionTitle(recommendation) {
+    return DECISION_TITLES[recommendation];
+}
+/**
+ * Normalizes typographic punctuation to ASCII equivalents so that LLM output
+ * renders consistently across PR comments, the web UI, and CLI output.
+ * Only targets characters that cause visual/encoding inconsistency; other
+ * characters (including XSS payloads) are passed through unchanged — HTML
+ * escaping is the renderer's responsibility.
+ */
+function normalizeToAscii(s) {
+    return s
+        .replace(/\u2014/g, "-") // em dash —
+        .replace(/\u2013/g, "-"); // en dash –
+}
+// Maps one PRInsight to its display fields (no title)
+export function formatInsight(insight) {
+    return {
+        message: normalizeToAscii(insight.message),
+        where: normalizeToAscii(insight.context),
+        action: normalizeToAscii(insight.remediation),
+    };
+}
+// Renders a single formatted insight as markdown (no title, no divider)
+function renderInsightAsMarkdown(f) {
+    return [
+        f.message,
+        "",
+        "**Where it shows up**",
+        "",
+        f.where,
+        "",
+        "**What to do**",
+        "",
+        f.action,
+    ].join("\n");
+}
+// Renders a full PR comment: one bold title + all insights separated by dividers
+export function renderInsightsAsMarkdown(insights, decision) {
+    const title = `**${decisionTitle(decision.recommendation)}**`;
+    const blocks = insights.map((insight) => renderInsightAsMarkdown(formatInsight(insight)));
+    return [title, "", ...blocks].join("\n\n---\n\n").trimEnd();
+}

package/dist/formatInsight.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=formatInsight.test.d.ts.map

package/dist/formatInsight.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatInsight.test.d.ts","sourceRoot":"","sources":["../src/formatInsight.test.ts"],"names":[],"mappings":""}

package/dist/formatInsight.test.js

@@ -0,0 +1,102 @@
+import { describe, expect, it } from "vitest";
+import { formatInsight, renderInsightsAsMarkdown } from "./formatInsight.js";
+function makeInsight(overrides = {}) {
+    return {
+        type: "behavioral_change",
+        priority: "high",
+        confidence: "confirmed",
+        scope: "changed",
+        message: "default message",
+        context: "default context",
+        remediation: "default remediation",
+        ...overrides,
+    };
+}
+describe("formatInsight", () => {
+    describe("typographic dash normalization", () => {
+        it("replaces em dashes with ASCII hyphens in message", () => {
+            const result = formatInsight(makeInsight({ message: "A \u2014 B" }));
+            expect(result.message).toBe("A - B");
+        });
+        it("replaces en dashes with ASCII hyphens in message", () => {
+            const result = formatInsight(makeInsight({ message: "A \u2013 B" }));
+            expect(result.message).toBe("A - B");
+        });
+        it("normalizes all three fields: message, context, remediation", () => {
+            const result = formatInsight(makeInsight({
+                message: "A \u2014 B",
+                context: "C \u2013 D",
+                remediation: "E \u2014 F",
+            }));
+            expect(result.message).toBe("A - B");
+            expect(result.where).toBe("C - D");
+            expect(result.action).toBe("E - F");
+        });
+        it("handles multiple dashes in a single field", () => {
+            const result = formatInsight(makeInsight({ message: "X \u2014 Y \u2013 Z" }));
+            expect(result.message).toBe("X - Y - Z");
+        });
+    });
+    describe("XSS payload pass-through", () => {
+        it("does not alter script tag payloads — escaping is the renderer's job", () => {
+            const payload = "<script>alert(1)</script>";
+            const result = formatInsight(makeInsight({ message: payload }));
+            expect(result.message).toBe(payload);
+        });
+        it("does not alter img onerror payloads", () => {
+            const payload = "<img src=x onerror=alert(1)>";
+            const result = formatInsight(makeInsight({ context: payload }));
+            expect(result.where).toBe(payload);
+        });
+        it("does not alter javascript: URL payloads", () => {
+            const payload = "[x](javascript:alert(1))";
+            const result = formatInsight(makeInsight({ remediation: payload }));
+            expect(result.action).toBe(payload);
+        });
+    });
+    describe("edge cases", () => {
+        it("handles empty strings in all fields without throwing", () => {
+            const result = formatInsight(makeInsight({ message: "", context: "", remediation: "" }));
+            expect(result.message).toBe("");
+            expect(result.where).toBe("");
+            expect(result.action).toBe("");
+        });
+        it("maps fields correctly: context → where, remediation → action", () => {
+            const result = formatInsight(makeInsight({ message: "msg", context: "ctx", remediation: "fix" }));
+            expect(result.message).toBe("msg");
+            expect(result.where).toBe("ctx");
+            expect(result.action).toBe("fix");
+        });
+    });
+});
+describe("renderInsightsAsMarkdown", () => {
+    const decision = {
+        recommendation: "needs_review",
+        confidence: "high",
+        reasoning: ["reason 1"],
+    };
+    it("does not alter or escape XSS payloads — sanitization is deferred to MarkdownContent", () => {
+        const xssPayload = "<script>alert(1)</script>";
+        const insight = makeInsight({ message: xssPayload });
+        const output = renderInsightsAsMarkdown([insight], decision);
+        expect(output).toContain(xssPayload);
+    });
+    it("includes the decision title and all insight fields", () => {
+        const insight = makeInsight({
+            message: "msg text",
+            context: "ctx text",
+            remediation: "fix text",
+        });
+        const output = renderInsightsAsMarkdown([insight], decision);
+        expect(output).toContain("Elevated dependency merge risk");
+        expect(output).toContain("msg text");
+        expect(output).toContain("ctx text");
+        expect(output).toContain("fix text");
+    });
+    it("normalizes typographic dashes in rendered markdown output", () => {
+        const insight = makeInsight({ message: "A \u2014 B" });
+        const output = renderInsightsAsMarkdown([insight], decision);
+        expect(output).toContain("A - B");
+        expect(output).not.toContain("\u2014");
+    });
+});

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export * from "./types.js";
+export * from "./formatInsight.js";
+export * from "./riskVocabulary.js";
+export * from "./selectTopAffectedAreas.js";
+export * from "./deriveScanSummaryText.js";
+export * from "./scanResultSchema.js";
+export * from "./scanSurfaceCopy.js";
+export * from "./trustedScanGuards.js";
+export * from "./actionsStepSummary.js";
+export * from "./prCheckRunPresentation.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC"}