@mergesignal/shared 0.2.0

package/dist/index.js

@@ -0,0 +1,10 @@
+export * from "./types.js";
+export * from "./formatInsight.js";
+export * from "./riskVocabulary.js";
+export * from "./selectTopAffectedAreas.js";
+export * from "./deriveScanSummaryText.js";
+export * from "./scanResultSchema.js";
+export * from "./scanSurfaceCopy.js";
+export * from "./trustedScanGuards.js";
+export * from "./actionsStepSummary.js";
+export * from "./prCheckRunPresentation.js";

package/dist/prCheckRunPresentation.d.ts

@@ -0,0 +1,67 @@
+import type { ScanResult } from "./types.js";
+export declare const CHECK_RUN_MAX_WHY_BULLETS = 3;
+export declare const CHECK_RUN_MAX_ACTION_BULLETS = 3;
+export declare const CHECK_RUN_MAX_REPO_DRIVER_PHRASES = 2;
+export declare const CHECK_RUN_ACTION_BULLET_MAX_CHARS = 220;
+export declare const CHECK_RUN_SOFT_MAX_CHARS = 3800;
+export type PrCheckRunTitleOptions = {
+    baselineOnly?: boolean;
+};
+export type PrCheckRunSummaryContext = {
+    result: ScanResult;
+    scanId: string;
+    webAppOrigin: string;
+    baseline: boolean;
+};
+/** Policy flags — one place per product rule. */
+export type CheckRunPolicy = {
+    baseline: boolean;
+    showBaselineOutcome: boolean;
+    showRepoGraphContext: boolean;
+    showLayerScores: boolean;
+    useDetailsForLayers: boolean;
+    maxWhyBullets: number;
+    maxActionBullets: number;
+    maxRepoDriverPhrases: number;
+};
+export type CheckRunSection = {
+    kind: "lead";
+    posture: string;
+    riskIndexLine: string | null;
+} | {
+    kind: "why";
+    bullets: string[];
+} | {
+    kind: "actions";
+    bullets: string[];
+} | {
+    kind: "baselineOutcome";
+    primary: string;
+    scope?: string;
+} | {
+    kind: "repoContext";
+    score: number;
+    driverPhrases: string[];
+} | {
+    kind: "layerScores";
+    rows: Array<{
+        label: string;
+        score: string;
+        driver: string;
+    }>;
+} | {
+    kind: "footer";
+    url: string;
+    label: string;
+};
+export declare function formatScanDashboardUrl(webAppOrigin: string, scanId: string): string;
+export declare function buildPrCheckRunTitle(opts?: PrCheckRunTitleOptions): string;
+/** Strong drivers for optional repo-context line (full mode only). */
+export declare function hasStrongRepoGraphDrivers(result: ScanResult): boolean;
+export declare function deriveCheckRunPolicy(result: ScanResult, ctx: Pick<PrCheckRunSummaryContext, "baseline">): CheckRunPolicy;
+export declare function buildPrCheckRunSections(policy: CheckRunPolicy, result: ScanResult, ctx: PrCheckRunSummaryContext): CheckRunSection[];
+export declare function renderCheckRunMarkdown(sections: CheckRunSection[]): string;
+export declare function buildPrCheckRunSummaryMarkdown(ctx: PrCheckRunSummaryContext): string;
+/** Whether baseline scan has no actionable PR bullets (for tests / callers). */
+export declare function checkRunHasActionableContent(result: ScanResult): boolean;
+//# sourceMappingURL=prCheckRunPresentation.d.ts.map

package/dist/prCheckRunPresentation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prCheckRunPresentation.d.ts","sourceRoot":"","sources":["../src/prCheckRunPresentation.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAIV,UAAU,EAEX,MAAM,YAAY,CAAC;AAGpB,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,iCAAiC,IAAI,CAAC;AACnD,eAAO,MAAM,iCAAiC,MAAM,CAAC;AACrD,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAqB7C,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,iDAAiD;AACjD,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,GACD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAUnD,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,IAAI,GAAE,sBAA2B,GAChC,MAAM,CAMR;AA4BD,sEAAsE;AACtE,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAGrE;AAkGD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,IAAI,CAAC,wBAAwB,EAAE,UAAU,CAAC,GAC9C,cAAc,CA0BhB;AAqBD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,wBAAwB,GAC5B,eAAe,EAAE,CAmDnB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CA0E1E;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,wBAAwB,GAC5B,MAAM,CAIR;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAExE"}

package/dist/prCheckRunPresentation.js

@@ -0,0 +1,314 @@
+/**
+ * GitHub Check Run markdown — policy → sections → dumb renderer.
+ * Thin projection of ScanResult for PR decision support (not a presentation framework).
+ */
+import { deriveScanSummaryText } from "./deriveScanSummaryText.js";
+import { formatInsight } from "./formatInsight.js";
+import { humanizeEngineSurfaceText, layerDriverSummary, sortPRInsightsForDisplay, sortRecommendationsForDisplay, truncateWithEllipsis, } from "./actionsStepSummary.js";
+import { mergePostureLabel } from "./riskVocabulary.js";
+import { scanSurfaceCopy } from "./scanSurfaceCopy.js";
+// --- Caps (change only with tests) ---
+export const CHECK_RUN_MAX_WHY_BULLETS = 3;
+export const CHECK_RUN_MAX_ACTION_BULLETS = 3;
+export const CHECK_RUN_MAX_REPO_DRIVER_PHRASES = 2;
+export const CHECK_RUN_ACTION_BULLET_MAX_CHARS = 220;
+export const CHECK_RUN_SOFT_MAX_CHARS = 3800;
+const LAYER_LABELS = [
+    ["security", "Security"],
+    ["maintainability", "Maintainability"],
+    ["ecosystem", "Ecosystem"],
+    ["upgradeImpact", "Upgrade Impact"],
+];
+const DEFAULT_SECTION_ORDER = [
+    "lead",
+    "why",
+    "actions",
+    "baselineOutcome",
+    "repoContext",
+    "layerScores",
+    "footer",
+];
+function roundScore(n) {
+    return Math.round(n);
+}
+function normalizeOrigin(origin) {
+    return origin.replace(/\/+$/, "");
+}
+export function formatScanDashboardUrl(webAppOrigin, scanId) {
+    return `${normalizeOrigin(webAppOrigin)}/scan/${scanId}`;
+}
+export function buildPrCheckRunTitle(opts = {}) {
+    const base = scanSurfaceCopy.checkRun.titleBase;
+    if (opts.baselineOnly) {
+        return `${base} - ${scanSurfaceCopy.checkRun.titleBaselineSuffix}`;
+    }
+    return base;
+}
+function collectWhyBullets(result, max) {
+    const out = [];
+    const reasoning = result.decision?.reasoning;
+    if (Array.isArray(reasoning)) {
+        for (const r of reasoning) {
+            const s = humanizeEngineSurfaceText(String(r).trim());
+            if (s && !out.includes(s))
+                out.push(s);
+            if (out.length >= max)
+                return out;
+        }
+    }
+    const reasons = result.explain?.reasons;
+    if (Array.isArray(reasons) && out.length < max) {
+        for (const r of reasons) {
+            const title = String(r?.title ?? r?.id ?? "").trim();
+            const readable = humanizeEngineSurfaceText(title);
+            if (readable && !out.includes(readable))
+                out.push(readable);
+            if (out.length >= max)
+                break;
+        }
+    }
+    if (out.length === 0) {
+        const one = deriveScanSummaryText(result);
+        if (one)
+            out.push(one);
+    }
+    return out.slice(0, max);
+}
+/** Strong drivers for optional repo-context line (full mode only). */
+export function hasStrongRepoGraphDrivers(result) {
+    const phrases = collectWhyBullets(result, CHECK_RUN_MAX_REPO_DRIVER_PHRASES);
+    return phrases.some((p) => p.trim().length >= 12);
+}
+function hasActionableBullets(result) {
+    const insights = Array.isArray(result.insights) ? result.insights : [];
+    const recs = Array.isArray(result.recommendations)
+        ? result.recommendations
+        : [];
+    const findings = Array.isArray(result.findings) ? result.findings : [];
+    return insights.length > 0 || recs.length > 0 || findings.length > 0;
+}
+function insightToBullet(insight) {
+    const f = formatInsight(insight);
+    const msg = truncateWithEllipsis(f.message, CHECK_RUN_ACTION_BULLET_MAX_CHARS);
+    const action = f.action.trim();
+    if (action && action.length < 120) {
+        return `${msg} — ${truncateWithEllipsis(action, 100)}`;
+    }
+    return msg;
+}
+function recommendationToBullet(rec) {
+    const title = String(rec.title ?? "").trim();
+    const rat = String(rec.rationale ?? "").trim();
+    const pkgs = Array.isArray(rec.packages) && rec.packages.length > 0
+        ? ` (${rec.packages.slice(0, 3).join(", ")}${rec.packages.length > 3 ? ", …" : ""})`
+        : "";
+    if (rat && (!title || rat.length > title.length)) {
+        return truncateWithEllipsis(rat, CHECK_RUN_ACTION_BULLET_MAX_CHARS) + pkgs;
+    }
+    const line = title || "Review dependency guidance";
+    return truncateWithEllipsis(line, CHECK_RUN_ACTION_BULLET_MAX_CHARS) + pkgs;
+}
+function findingToBullet(f) {
+    const title = String(f.title ?? "").trim();
+    const pkg = f.packageName ? ` (\`${f.packageName}\`)` : "";
+    return (truncateWithEllipsis(title || f.description, CHECK_RUN_ACTION_BULLET_MAX_CHARS) + pkg);
+}
+function buildActionBullets(result, max) {
+    const out = [];
+    const sortedI = sortPRInsightsForDisplay(Array.isArray(result.insights) ? result.insights : []);
+    const sortedR = sortRecommendationsForDisplay(Array.isArray(result.recommendations) ? result.recommendations : []);
+    const findings = Array.isArray(result.findings) ? result.findings : [];
+    for (const ins of sortedI) {
+        if (out.length >= max)
+            break;
+        out.push(insightToBullet(ins));
+    }
+    for (const rec of sortedR) {
+        if (out.length >= max)
+            break;
+        out.push(recommendationToBullet(rec));
+    }
+    for (const f of findings) {
+        if (out.length >= max)
+            break;
+        if (f.severity === "high" || f.severity === "critical") {
+            out.push(findingToBullet(f));
+        }
+    }
+    return out.slice(0, max);
+}
+function layerScoreRows(result) {
+    const layers = result.layerScores ?? {};
+    const rows = [];
+    for (const [key, label] of LAYER_LABELS) {
+        const v = layers[key];
+        const n = typeof v === "number" && Number.isFinite(v) ? v : null;
+        if (n === null)
+            continue;
+        const drivers = layerDriverSummary(result, key, 120);
+        if (!drivers)
+            continue;
+        rows.push({
+            label,
+            score: String(roundScore(n)),
+            driver: drivers,
+        });
+    }
+    return rows;
+}
+export function deriveCheckRunPolicy(result, ctx) {
+    const baseline = ctx.baseline;
+    const actionBullets = buildActionBullets(result, CHECK_RUN_MAX_ACTION_BULLETS);
+    const layerRows = layerScoreRows(result);
+    const showRepoGraphContext = !baseline &&
+        hasStrongRepoGraphDrivers(result) &&
+        typeof result.totalScore === "number" &&
+        Number.isFinite(result.totalScore);
+    const showLayerScores = !baseline && layerRows.length > 0;
+    return {
+        baseline,
+        showBaselineOutcome: baseline && actionBullets.length === 0,
+        showRepoGraphContext,
+        showLayerScores,
+        useDetailsForLayers: showLayerScores && layerRows.length >= 2,
+        maxWhyBullets: CHECK_RUN_MAX_WHY_BULLETS,
+        maxActionBullets: CHECK_RUN_MAX_ACTION_BULLETS,
+        maxRepoDriverPhrases: CHECK_RUN_MAX_REPO_DRIVER_PHRASES,
+    };
+}
+function buildLeadSection(result, policy) {
+    const posture = result.decision?.recommendation
+        ? mergePostureLabel(result.decision.recommendation)
+        : scanSurfaceCopy.checkRun.mergePostureUnavailable;
+    const total = typeof result.totalScore === "number" && Number.isFinite(result.totalScore)
+        ? result.totalScore
+        : null;
+    const showRiskIndexInLead = !policy.baseline && !policy.showRepoGraphContext && total !== null;
+    const riskIndexLine = showRiskIndexInLead
+        ? `${scanSurfaceCopy.checkRun.repoContextLabel} ${roundScore(total)}/100 (${scanSurfaceCopy.product.riskIndexDirectionShort})`
+        : null;
+    return { kind: "lead", posture, riskIndexLine };
+}
+export function buildPrCheckRunSections(policy, result, ctx) {
+    const sections = {};
+    sections.lead = buildLeadSection(result, policy);
+    const why = collectWhyBullets(result, policy.maxWhyBullets);
+    if (why.length > 0) {
+        sections.why = { kind: "why", bullets: why };
+    }
+    const actions = buildActionBullets(result, policy.maxActionBullets);
+    if (actions.length > 0) {
+        sections.actions = { kind: "actions", bullets: actions };
+    }
+    if (policy.showBaselineOutcome) {
+        sections.baselineOutcome = {
+            kind: "baselineOutcome",
+            primary: scanSurfaceCopy.checkRun.baselineOutcomePrimary,
+            scope: scanSurfaceCopy.checkRun.baselineOutcomeScope,
+        };
+    }
+    if (policy.showRepoGraphContext) {
+        const score = roundScore(result.totalScore);
+        sections.repoContext = {
+            kind: "repoContext",
+            score,
+            driverPhrases: collectWhyBullets(result, policy.maxRepoDriverPhrases),
+        };
+    }
+    if (policy.showLayerScores) {
+        const rows = layerScoreRows(result);
+        if (rows.length > 0) {
+            sections.layerScores = { kind: "layerScores", rows };
+        }
+    }
+    sections.footer = {
+        kind: "footer",
+        url: formatScanDashboardUrl(ctx.webAppOrigin, ctx.scanId),
+        label: scanSurfaceCopy.checkRun.footerLinkLabel,
+    };
+    const out = [];
+    for (const key of DEFAULT_SECTION_ORDER) {
+        const s = sections[key];
+        if (s)
+            out.push(s);
+    }
+    return out;
+}
+export function renderCheckRunMarkdown(sections) {
+    const parts = [];
+    for (const section of sections) {
+        switch (section.kind) {
+            case "lead": {
+                parts.push(`**${section.posture}**`);
+                if (section.riskIndexLine) {
+                    parts.push(section.riskIndexLine);
+                }
+                parts.push("");
+                break;
+            }
+            case "why": {
+                for (const b of section.bullets) {
+                    parts.push(`- ${b}`);
+                }
+                parts.push("");
+                break;
+            }
+            case "actions": {
+                for (const b of section.bullets) {
+                    parts.push(`- ${b}`);
+                }
+                parts.push("");
+                break;
+            }
+            case "baselineOutcome": {
+                parts.push(section.primary);
+                if (section.scope) {
+                    parts.push("");
+                    parts.push(section.scope);
+                }
+                parts.push("");
+                break;
+            }
+            case "repoContext": {
+                const drivers = section.driverPhrases.join(" · ");
+                parts.push(`${scanSurfaceCopy.checkRun.repoContextLabel} ${section.score}/100 — ${drivers}`);
+                parts.push("");
+                break;
+            }
+            case "layerScores": {
+                parts.push("<details>");
+                parts.push(`<summary>${scanSurfaceCopy.checkRun.layerScoresDetailsSummary}</summary>`);
+                parts.push("");
+                for (const row of section.rows) {
+                    parts.push(`- **${row.label}** ${row.score}/100 — ${row.driver}`);
+                }
+                parts.push("");
+                parts.push("</details>");
+                parts.push("");
+                break;
+            }
+            case "footer": {
+                parts.push(`[${section.label}](${section.url})`);
+                break;
+            }
+            default: {
+                const _exhaustive = section;
+                void _exhaustive;
+            }
+        }
+    }
+    let md = parts.join("\n").trimEnd();
+    if (md.length > CHECK_RUN_SOFT_MAX_CHARS) {
+        md = md.slice(0, CHECK_RUN_SOFT_MAX_CHARS - 1) + "…";
+    }
+    return md;
+}
+export function buildPrCheckRunSummaryMarkdown(ctx) {
+    const policy = deriveCheckRunPolicy(ctx.result, { baseline: ctx.baseline });
+    const sections = buildPrCheckRunSections(policy, ctx.result, ctx);
+    return renderCheckRunMarkdown(sections);
+}
+/** Whether baseline scan has no actionable PR bullets (for tests / callers). */
+export function checkRunHasActionableContent(result) {
+    return hasActionableBullets(result);
+}

package/dist/prCheckRunPresentation.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=prCheckRunPresentation.test.d.ts.map

package/dist/prCheckRunPresentation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prCheckRunPresentation.test.d.ts","sourceRoot":"","sources":["../src/prCheckRunPresentation.test.ts"],"names":[],"mappings":""}

package/dist/prCheckRunPresentation.test.js

@@ -0,0 +1,277 @@
+import { describe, expect, it } from "vitest";
+import { CHECK_RUN_MAX_ACTION_BULLETS, CHECK_RUN_SOFT_MAX_CHARS, buildPrCheckRunSummaryMarkdown, buildPrCheckRunTitle, deriveCheckRunPolicy, formatScanDashboardUrl, hasStrongRepoGraphDrivers, } from "./prCheckRunPresentation.js";
+const ORIGIN = "https://mergesignal-web.fly.dev";
+const SCAN_ID = "11111111-1111-4111-8111-111111111111";
+function minimalResult(overrides = {}) {
+    return {
+        totalScore: 42,
+        layerScores: {
+            security: 10,
+            maintainability: 20,
+            ecosystem: 30,
+            upgradeImpact: 15,
+        },
+        findings: [],
+        generatedAt: new Date().toISOString(),
+        decision: {
+            recommendation: "needs_review",
+            confidence: "medium",
+            reasoning: ["Lockfile adds transitive depth on shared utilities."],
+        },
+        explain: {
+            reasons: [
+                {
+                    id: "graph.depth",
+                    layer: "ecosystem",
+                    title: "graph.depth",
+                    scoreImpact: 12,
+                },
+            ],
+        },
+        ...overrides,
+    };
+}
+describe("buildPrCheckRunTitle", () => {
+    it("uses hyphenated product title", () => {
+        expect(buildPrCheckRunTitle()).toBe("MergeSignal scan - PR dependency change");
+        expect(buildPrCheckRunTitle()).not.toContain("—");
+    });
+    it("appends baseline suffix when requested", () => {
+        expect(buildPrCheckRunTitle({ baselineOnly: true })).toBe("MergeSignal scan - PR dependency change - baseline scan only");
+    });
+});
+describe("formatScanDashboardUrl", () => {
+    it("strips trailing slash from origin", () => {
+        expect(formatScanDashboardUrl(`${ORIGIN}/`, SCAN_ID)).toBe(`${ORIGIN}/scan/${SCAN_ID}`);
+    });
+});
+describe("deriveCheckRunPolicy", () => {
+    it("never shows repo graph context in baseline", () => {
+        const rich = minimalResult({
+            totalScore: 68,
+            explain: {
+                reasons: [
+                    {
+                        id: "graph.transitive",
+                        layer: "ecosystem",
+                        title: "Large transitive dependency volume",
+                        scoreImpact: 20,
+                    },
+                ],
+            },
+        });
+        const policy = deriveCheckRunPolicy(rich, { baseline: true });
+        expect(policy.showRepoGraphContext).toBe(false);
+        expect(policy.baseline).toBe(true);
+    });
+    it("shows repo graph context in full only with strong drivers", () => {
+        const weak = minimalResult({
+            explain: { reasons: [] },
+            decision: {
+                recommendation: "safe",
+                confidence: "high",
+                reasoning: [],
+            },
+        });
+        expect(hasStrongRepoGraphDrivers(weak)).toBe(false);
+        expect(deriveCheckRunPolicy(weak, { baseline: false }).showRepoGraphContext).toBe(false);
+        const strong = minimalResult({
+            explain: {
+                reasons: [
+                    {
+                        id: "graph.depth",
+                        layer: "ecosystem",
+                        title: "Indirect dependency depth exceeds typical baseline",
+                        scoreImpact: 15,
+                    },
+                ],
+            },
+        });
+        expect(hasStrongRepoGraphDrivers(strong)).toBe(true);
+        expect(deriveCheckRunPolicy(strong, { baseline: false }).showRepoGraphContext).toBe(true);
+    });
+});
+describe("buildPrCheckRunSummaryMarkdown", () => {
+    it("always includes dashboard footer link", () => {
+        const md = buildPrCheckRunSummaryMarkdown({
+            result: minimalResult(),
+            scanId: SCAN_ID,
+            webAppOrigin: ORIGIN,
+            baseline: false,
+        });
+        expect(md).toContain(`[View full scan](${ORIGIN}/scan/${SCAN_ID})`);
+    });
+    it("baseline body omits repo graph score lines", () => {
+        const md = buildPrCheckRunSummaryMarkdown({
+            result: minimalResult({ totalScore: 68 }),
+            scanId: SCAN_ID,
+            webAppOrigin: ORIGIN,
+            baseline: true,
+        });
+        expect(md).not.toMatch(/68\/100/);
+        expect(md).not.toMatch(/moderate risk/i);
+        expect(md).not.toMatch(/Repository graph/i);
+    });
+    it("full mode omits unexplained score when drivers are weak", () => {
+        const md = buildPrCheckRunSummaryMarkdown({
+            result: minimalResult({
+                totalScore: 68,
+                explain: { reasons: [] },
+                decision: { recommendation: "safe", confidence: "high", reasoning: [] },
+            }),
+            scanId: SCAN_ID,
+            webAppOrigin: ORIGIN,
+            baseline: false,
+        });
+        expect(md).not.toMatch(/68\/100 —/);
+    });
+    it("shows baseline outcome when baseline and no actionable bullets", () => {
+        const md = buildPrCheckRunSummaryMarkdown({
+            result: minimalResult({
+                insights: [],
+                recommendations: [],
+                findings: [],
+                decision: {
+                    recommendation: "safe",
+                    confidence: "high",
+                    reasoning: [],
+                },
+                explain: { reasons: [] },
+            }),
+            scanId: SCAN_ID,
+            webAppOrigin: ORIGIN,
+            baseline: true,
+        });
+        expect(md).toContain("No actionable dependency concerns showed up for this PR");
+        expect(md).not.toMatch(/high-confidence/i);
+        expect(md).not.toMatch(/did not emit/i);
+    });
+    it("does not include standalone changed packages list", () => {
+        const md = buildPrCheckRunSummaryMarkdown({
+            result: minimalResult({
+                insights: [
+                    {
+                        type: "usage_risk",
+                        priority: "high",
+                        confidence: "likely",
+                        scope: "changed",
+                        message: "Runtime path may load updated semver helpers.",
+                        context: "src/version.ts",
+                        remediation: "Run integration tests for version parsing.",
+                    },
+                ],
+            }),
+            scanId: SCAN_ID,
+            webAppOrigin: ORIGIN,
+            baseline: false,
+        });
+        expect(md).not.toMatch(/^Changed packages:/m);
+        expect(md).not.toMatch(/^@types\/semver/m);
+    });
+    it("caps action bullets and stays under soft char limit for fat ScanResult", () => {
+        const fat = {
+            ...minimalResult(),
+            totalScore: 72,
+            graphInsights: {
+                maxDepth: 14,
+                nodes: 2400,
+                edges: 9000,
+                deepest: Array.from({ length: 20 }, (_, i) => ({
+                    kind: "deep",
+                    packageName: `pkg-${i}`,
+                    depth: 10 + i,
+                    direct: false,
+                    via: ["a", "b", "c"],
+                })),
+                hotspots: Array.from({ length: 12 }, (_, i) => ({
+                    kind: "hotspot",
+                    packageName: `hot-${i}`,
+                    depth: 3,
+                    direct: false,
+                })),
+                vulnerable: Array.from({ length: 8 }, (_, i) => ({
+                    kind: "vulnerable",
+                    packageName: `vuln-${i}`,
+                    depth: 2,
+                    direct: false,
+                })),
+            },
+            insights: Array.from({ length: 30 }, (_, i) => ({
+                type: "behavioral_change",
+                priority: "high",
+                confidence: "confirmed",
+                scope: "changed",
+                message: `Insight message ${i} with extra detail about runtime behavior and dependency coupling.`,
+                context: `src/module-${i}/index.ts`,
+                remediation: `Remediation step ${i} including verify, test, and document.`,
+            })),
+            recommendations: Array.from({ length: 25 }, (_, i) => ({
+                id: `rec-${i}`,
+                title: `Recommendation title ${i}`,
+                rationale: `Long rationale ${i} explaining ecosystem overlap and transitive churn in multiple sentences.`,
+                impact: "high",
+                packages: [`pkg-a-${i}`, `pkg-b-${i}`],
+            })),
+            explain: {
+                reasons: Array.from({ length: 40 }, (_, i) => ({
+                    id: `graph.metric.${i}`,
+                    layer: (["security", "maintainability", "ecosystem", "upgradeImpact"][i % 4] ?? "ecosystem"),
+                    title: `graph.transitive volume cluster ${i}`,
+                    scoreImpact: 5 + i,
+                })),
+            },
+        };
+        const md = buildPrCheckRunSummaryMarkdown({
+            result: fat,
+            scanId: SCAN_ID,
+            webAppOrigin: ORIGIN,
+            baseline: false,
+        });
+        expect(md).toContain("Insight message 0");
+        expect(md).not.toContain("Insight message 3");
+        const insightBullets = md
+            .split("\n")
+            .filter((l) => l.includes("Insight message"));
+        expect(insightBullets.length).toBeLessThanOrEqual(CHECK_RUN_MAX_ACTION_BULLETS);
+        expect(md.length).toBeLessThanOrEqual(CHECK_RUN_SOFT_MAX_CHARS);
+        expect(md).not.toContain("pkg-0 is reached transitively");
+        expect(md).not.toContain("topology");
+        expect(md).not.toMatch(/moderate risk/i);
+    });
+    it("pairs layer scores with drivers in details when shown", () => {
+        const md = buildPrCheckRunSummaryMarkdown({
+            result: minimalResult({
+                layerScores: {
+                    security: 0,
+                    maintainability: 45,
+                    ecosystem: 50,
+                    upgradeImpact: 10,
+                },
+                explain: {
+                    reasons: [
+                        {
+                            id: "maint.band",
+                            layer: "maintainability",
+                            title: "Stale releases on multiple direct dependencies",
+                            scoreImpact: 18,
+                        },
+                    ],
+                },
+                contributions: [
+                    {
+                        id: "maint-stale",
+                        layer: "maintainability",
+                        scoreImpact: 10,
+                    },
+                ],
+            }),
+            scanId: SCAN_ID,
+            webAppOrigin: ORIGIN,
+            baseline: false,
+        });
+        if (md.includes("Layer scores")) {
+            expect(md).toMatch(/Maintainability.*\/100 —/);
+            expect(md).not.toMatch(/\| Security \| 0 \|/);
+        }
+    });
+});