@mergesignal/shared 0.2.0

package/dist/riskVocabulary.d.ts

@@ -0,0 +1,31 @@
+import type { PRDecisionRecommendation } from "./types.js";
+export type MergePosture = PRDecisionRecommendation;
+/** Canonical display strings for merge posture values. */
+export declare const MERGE_POSTURE_LABEL: Record<MergePosture, string>;
+/**
+ * Sorting weights: higher number = listed first (riskiest first).
+ * Use as: arr.sort((a, b) => MERGE_POSTURE_SORT_ORDER[b] - MERGE_POSTURE_SORT_ORDER[a])
+ */
+export declare const MERGE_POSTURE_SORT_ORDER: Record<MergePosture, number>;
+/** Normalize a raw `decision` string to a typed MergePosture, or null. */
+export declare function mergePostureFromDecision(decision: string | null | undefined): MergePosture | null;
+/** Returns the display label for a decision, or a fallback string. */
+export declare function mergePostureLabel(decision: string | null | undefined, fallback?: string): string;
+/**
+ * Accessible composite label for a merge posture badge.
+ * e.g. "Risky, risk score 72" or "Safe"
+ */
+export declare function ariaLabelForPosture(decision: string | null | undefined, score: number | null | undefined): string;
+export type SignalSeverity = "low" | "medium" | "high";
+/**
+ * Format a signal severity for prose use — always returns a qualified string
+ * so it cannot be confused with merge posture at a glance.
+ * e.g. "Severity: High"
+ */
+export declare function formatSignalSeverity(severity: string): string;
+/**
+ * Format a count + severity for compact prose.
+ * e.g. "3 high-severity findings"
+ */
+export declare function formatSeverityCount(count: number, severity: string): string;
+//# sourceMappingURL=riskVocabulary.d.ts.map

package/dist/riskVocabulary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"riskVocabulary.d.ts","sourceRoot":"","sources":["../src/riskVocabulary.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAkB3D,MAAM,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAEpD,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAI5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAIjE,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,YAAY,GAAG,IAAI,CASrB;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,QAAQ,SAAM,GACb,MAAM,CAGR;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAIR;AAMD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAQvD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG3E"}

package/dist/riskVocabulary.js

@@ -0,0 +1,62 @@
+/** Canonical display strings for merge posture values. */
+export const MERGE_POSTURE_LABEL = {
+    safe: "Safe",
+    needs_review: "Needs review",
+    risky: "Risky",
+};
+/**
+ * Sorting weights: higher number = listed first (riskiest first).
+ * Use as: arr.sort((a, b) => MERGE_POSTURE_SORT_ORDER[b] - MERGE_POSTURE_SORT_ORDER[a])
+ */
+export const MERGE_POSTURE_SORT_ORDER = {
+    risky: 2,
+    needs_review: 1,
+    safe: 0,
+};
+/** Normalize a raw `decision` string to a typed MergePosture, or null. */
+export function mergePostureFromDecision(decision) {
+    if (decision === "safe" ||
+        decision === "needs_review" ||
+        decision === "risky") {
+        return decision;
+    }
+    return null;
+}
+/** Returns the display label for a decision, or a fallback string. */
+export function mergePostureLabel(decision, fallback = "—") {
+    const posture = mergePostureFromDecision(decision);
+    return posture ? MERGE_POSTURE_LABEL[posture] : fallback;
+}
+/**
+ * Accessible composite label for a merge posture badge.
+ * e.g. "Risky, risk score 72" or "Safe"
+ */
+export function ariaLabelForPosture(decision, score) {
+    const label = mergePostureLabel(decision);
+    if (score != null)
+        return `${label}, risk score ${Math.round(score)}`;
+    return label;
+}
+const SIGNAL_SEVERITY_LABEL = {
+    low: "Low",
+    medium: "Medium",
+    high: "High",
+};
+/**
+ * Format a signal severity for prose use — always returns a qualified string
+ * so it cannot be confused with merge posture at a glance.
+ * e.g. "Severity: High"
+ */
+export function formatSignalSeverity(severity) {
+    const s = severity.toLowerCase();
+    const label = SIGNAL_SEVERITY_LABEL[s] ?? severity;
+    return `Severity: ${label}`;
+}
+/**
+ * Format a count + severity for compact prose.
+ * e.g. "3 high-severity findings"
+ */
+export function formatSeverityCount(count, severity) {
+    const s = severity.toLowerCase();
+    return `${count} ${s}-severity finding${count !== 1 ? "s" : ""}`;
+}

package/dist/riskVocabulary.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=riskVocabulary.test.d.ts.map

package/dist/riskVocabulary.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"riskVocabulary.test.d.ts","sourceRoot":"","sources":["../src/riskVocabulary.test.ts"],"names":[],"mappings":""}

package/dist/riskVocabulary.test.js

@@ -0,0 +1,14 @@
+import { describe, expect, it } from "vitest";
+import { mergePostureFromDecision } from "./riskVocabulary.js";
+describe("mergePostureFromDecision", () => {
+    it("accepts only canonical lowercase merge posture tokens", () => {
+        expect(mergePostureFromDecision("safe")).toBe("safe");
+        expect(mergePostureFromDecision("needs_review")).toBe("needs_review");
+        expect(mergePostureFromDecision("risky")).toBe("risky");
+    });
+    it("rejects alternate engine spellings (no silent normalization)", () => {
+        expect(mergePostureFromDecision("SAFE")).toBeNull();
+        expect(mergePostureFromDecision("RISKY")).toBeNull();
+        expect(mergePostureFromDecision("BLOCK")).toBeNull();
+    });
+});

package/dist/scanResultSchema.d.ts

@@ -0,0 +1,116 @@
+import { z } from "zod";
+import type { EngineEmittedScanResult, ScanResult } from "./types.js";
+/** Bump when persisted `result` JSON validation rules change materially (relaxed / legacy-tolerant). */
+export declare const SCAN_RESULT_ABI: "1";
+/** Bump when strict fresh-engine-output validation rules change materially. */
+export declare const ENGINE_OUTPUT_SCAN_ABI: "2";
+/**
+ * Minimum structural invariants for **persisted** `scans.result` JSON and legacy reads.
+ * `methodologyVersion` stays optional so historical rows without it remain valid.
+ * Unknown top-level keys are preserved (forward-compatible with newer engines).
+ */
+export declare const scanResultSchema: z.ZodObject<{
+    totalScore: z.ZodNumber;
+    layerScores: z.ZodObject<{
+        security: z.ZodNumber;
+        maintainability: z.ZodNumber;
+        ecosystem: z.ZodNumber;
+        upgradeImpact: z.ZodNumber;
+    }, z.core.$strip>;
+    findings: z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodUnknown>, z.ZodNull]>>, z.ZodTransform<unknown[], unknown[] | null | undefined>>;
+    methodologyVersion: z.ZodOptional<z.ZodString>;
+    confidence: z.ZodOptional<z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+    }>>;
+    signals: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    contributions: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    recommendations: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    dataset: z.ZodOptional<z.ZodUnknown>;
+    explain: z.ZodOptional<z.ZodUnknown>;
+    graphInsights: z.ZodOptional<z.ZodUnknown>;
+    generatedAt: z.ZodString;
+    insights: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    decision: z.ZodOptional<z.ZodObject<{
+        recommendation: z.ZodEnum<{
+            safe: "safe";
+            needs_review: "needs_review";
+            risky: "risky";
+        }>;
+        confidence: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>;
+        reasoning: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$loose>>;
+    codeAnalysisMetrics: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$loose>;
+/**
+ * Stricter schema for **fresh** `analyze()` output only. Do not use when hydrating
+ * historical `scans.result` blobs from the database.
+ */
+export declare const engineOutputScanResultSchema: z.ZodObject<{
+    totalScore: z.ZodNumber;
+    layerScores: z.ZodObject<{
+        security: z.ZodNumber;
+        maintainability: z.ZodNumber;
+        ecosystem: z.ZodNumber;
+        upgradeImpact: z.ZodNumber;
+    }, z.core.$strip>;
+    findings: z.ZodPipe<z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodUnknown>, z.ZodNull]>>, z.ZodTransform<unknown[], unknown[] | null | undefined>>;
+    confidence: z.ZodOptional<z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+    }>>;
+    signals: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    contributions: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    recommendations: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    dataset: z.ZodOptional<z.ZodUnknown>;
+    explain: z.ZodOptional<z.ZodUnknown>;
+    graphInsights: z.ZodOptional<z.ZodUnknown>;
+    insights: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    decision: z.ZodOptional<z.ZodObject<{
+        recommendation: z.ZodEnum<{
+            safe: "safe";
+            needs_review: "needs_review";
+            risky: "risky";
+        }>;
+        confidence: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>;
+        reasoning: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$loose>>;
+    codeAnalysisMetrics: z.ZodOptional<z.ZodUnknown>;
+    methodologyVersion: z.ZodString;
+    generatedAt: z.ZodString;
+}, z.core.$loose>;
+export type EngineOutputScanResultParseFailure = {
+    ok: false;
+    message: string;
+    issues: string[];
+};
+export type EngineOutputScanResultParseSuccess = {
+    ok: true;
+    result: EngineEmittedScanResult;
+};
+export declare function safeParseEngineOutputScanResult(data: unknown): EngineOutputScanResultParseSuccess | EngineOutputScanResultParseFailure;
+/** Validates fresh engine output; throws on failure. Not for legacy persisted JSON. */
+export declare function parseEngineOutputScanResultOrThrow(data: unknown): EngineEmittedScanResult;
+export type ScanResultParseFailure = {
+    ok: false;
+    message: string;
+    issues: string[];
+};
+export type ScanResultParseSuccess = {
+    ok: true;
+    result: ScanResult;
+};
+export declare function safeParseScanResult(data: unknown): ScanResultParseSuccess | ScanResultParseFailure;
+/** Validates engine output at the worker boundary; throws on failure. */
+export declare function parseScanResultOrThrow(data: unknown): ScanResult;
+//# sourceMappingURL=scanResultSchema.d.ts.map

package/dist/scanResultSchema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanResultSchema.d.ts","sourceRoot":"","sources":["../src/scanResultSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtE,wGAAwG;AACxG,eAAO,MAAM,eAAe,EAAG,GAAY,CAAC;AAE5C,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,EAAG,GAAY,CAAC;AASnD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4Bb,CAAC;AAUjB;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC/C,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC;AAEF,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,OAAO,GACZ,kCAAkC,GAAG,kCAAkC,CAazE;AAED,uFAAuF;AACvF,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,OAAO,GACZ,uBAAuB,CAMzB;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,GACZ,sBAAsB,GAAG,sBAAsB,CAajD;AAED,yEAAyE;AACzE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAMhE"}

package/dist/scanResultSchema.js

@@ -0,0 +1,100 @@
+import { z } from "zod";
+/** Bump when persisted `result` JSON validation rules change materially (relaxed / legacy-tolerant). */
+export const SCAN_RESULT_ABI = "1";
+/** Bump when strict fresh-engine-output validation rules change materially. */
+export const ENGINE_OUTPUT_SCAN_ABI = "2";
+const layerScoresSchema = z.object({
+    security: z.number(),
+    maintainability: z.number(),
+    ecosystem: z.number(),
+    upgradeImpact: z.number(),
+});
+/**
+ * Minimum structural invariants for **persisted** `scans.result` JSON and legacy reads.
+ * `methodologyVersion` stays optional so historical rows without it remain valid.
+ * Unknown top-level keys are preserved (forward-compatible with newer engines).
+ */
+export const scanResultSchema = z
+    .object({
+    totalScore: z.number().min(0).max(100),
+    layerScores: layerScoresSchema,
+    findings: z
+        .union([z.array(z.unknown()), z.null()])
+        .optional()
+        .transform((v) => (Array.isArray(v) ? v : [])),
+    methodologyVersion: z.string().optional(),
+    confidence: z.enum(["low", "medium", "high"]).optional(),
+    signals: z.array(z.unknown()).optional(),
+    contributions: z.array(z.unknown()).optional(),
+    recommendations: z.array(z.unknown()).optional(),
+    dataset: z.unknown().optional(),
+    explain: z.unknown().optional(),
+    graphInsights: z.unknown().optional(),
+    generatedAt: z.string().min(1),
+    insights: z.array(z.unknown()).optional(),
+    decision: z
+        .object({
+        recommendation: z.enum(["safe", "needs_review", "risky"]),
+        confidence: z.enum(["low", "medium", "high"]).optional(),
+        reasoning: z.array(z.string()).optional(),
+    })
+        .passthrough()
+        .optional(),
+    codeAnalysisMetrics: z.unknown().optional(),
+})
+    .passthrough();
+const engineOutputGeneratedAtSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .refine((s) => !Number.isNaN(Date.parse(s)), {
+    error: "generatedAt must be a parseable ISO-8601 timestamp",
+});
+/**
+ * Stricter schema for **fresh** `analyze()` output only. Do not use when hydrating
+ * historical `scans.result` blobs from the database.
+ */
+export const engineOutputScanResultSchema = scanResultSchema.extend({
+    methodologyVersion: z.string().trim().min(1),
+    generatedAt: engineOutputGeneratedAtSchema,
+});
+export function safeParseEngineOutputScanResult(data) {
+    const parsed = engineOutputScanResultSchema.safeParse(data);
+    if (!parsed.success) {
+        const issues = parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`);
+        return {
+            ok: false,
+            message: issues.join("; "),
+            issues,
+        };
+    }
+    return { ok: true, result: parsed.data };
+}
+/** Validates fresh engine output; throws on failure. Not for legacy persisted JSON. */
+export function parseEngineOutputScanResultOrThrow(data) {
+    const r = safeParseEngineOutputScanResult(data);
+    if (!r.ok) {
+        throw new Error(`validation: ${r.message}`);
+    }
+    return r.result;
+}
+export function safeParseScanResult(data) {
+    const parsed = scanResultSchema.safeParse(data);
+    if (!parsed.success) {
+        const issues = parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`);
+        return {
+            ok: false,
+            message: issues.join("; "),
+            issues,
+        };
+    }
+    return { ok: true, result: parsed.data };
+}
+/** Validates engine output at the worker boundary; throws on failure. */
+export function parseScanResultOrThrow(data) {
+    const r = safeParseScanResult(data);
+    if (!r.ok) {
+        throw new Error(`validation: ${r.message}`);
+    }
+    return r.result;
+}

package/dist/scanResultSchema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scanResultSchema.test.d.ts.map

package/dist/scanResultSchema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanResultSchema.test.d.ts","sourceRoot":"","sources":["../src/scanResultSchema.test.ts"],"names":[],"mappings":""}

package/dist/scanResultSchema.test.js

@@ -0,0 +1,105 @@
+import { describe, it, expect } from "vitest";
+import { safeParseScanResult, parseScanResultOrThrow, scanResultSchema, safeParseEngineOutputScanResult, parseEngineOutputScanResultOrThrow, } from "./scanResultSchema.js";
+const minimalValid = {
+    totalScore: 42,
+    layerScores: {
+        security: 10,
+        maintainability: 20,
+        ecosystem: 30,
+        upgradeImpact: 40,
+    },
+    findings: [],
+    generatedAt: "2026-01-01T00:00:00.000Z",
+};
+describe("scanResultSchema", () => {
+    it("accepts a minimal valid payload", () => {
+        const r = safeParseScanResult(minimalValid);
+        expect(r.ok).toBe(true);
+        if (r.ok)
+            expect(r.result.totalScore).toBe(42);
+    });
+    it("preserves unknown top-level keys (passthrough)", () => {
+        const r = safeParseScanResult({
+            ...minimalValid,
+            futureEngineField: { x: 1 },
+        });
+        expect(r.ok).toBe(true);
+        if (r.ok)
+            expect(r.result.futureEngineField).toEqual({
+                x: 1,
+            });
+    });
+    it("rejects missing layerScores", () => {
+        const r = safeParseScanResult({
+            totalScore: 1,
+            findings: [],
+            generatedAt: "2026-01-01T00:00:00.000Z",
+        });
+        expect(r.ok).toBe(false);
+    });
+    it("rejects out-of-range totalScore", () => {
+        const r = safeParseScanResult({
+            ...minimalValid,
+            totalScore: 101,
+        });
+        expect(r.ok).toBe(false);
+    });
+    it("rejects invalid decision.recommendation", () => {
+        const r = safeParseScanResult({
+            ...minimalValid,
+            decision: { recommendation: "maybe", reasoning: [] },
+        });
+        expect(r.ok).toBe(false);
+    });
+    it("rejects non-canonical merge posture tokens (e.g. proprietary uppercase)", () => {
+        const r = safeParseScanResult({
+            ...minimalValid,
+            decision: { recommendation: "SAFE", reasoning: [] },
+        });
+        expect(r.ok).toBe(false);
+    });
+    it("rejects empty generatedAt", () => {
+        const r = safeParseScanResult({
+            ...minimalValid,
+            generatedAt: "",
+        });
+        expect(r.ok).toBe(false);
+    });
+    it("parseScanResultOrThrow returns on success", () => {
+        expect(parseScanResultOrThrow(minimalValid).totalScore).toBe(42);
+    });
+    it("parseScanResultOrThrow throws with validation prefix", () => {
+        expect(() => parseScanResultOrThrow({})).toThrow(/^validation:/);
+    });
+    it("scanResultSchema default empty findings when omitted", () => {
+        const { findings: _f, ...rest } = minimalValid;
+        const parsed = scanResultSchema.parse(rest);
+        expect(parsed.findings).toEqual([]);
+    });
+});
+describe("engineOutputScanResultSchema (strict, fresh engine only)", () => {
+    const withMethodology = {
+        ...minimalValid,
+        methodologyVersion: "engine-test-fixture/v1",
+    };
+    it("rejects payload that relaxed parser accepts when methodology is missing", () => {
+        const r = safeParseEngineOutputScanResult(minimalValid);
+        expect(r.ok).toBe(false);
+    });
+    it("accepts when methodology and parseable generatedAt are present", () => {
+        const r = safeParseEngineOutputScanResult(withMethodology);
+        expect(r.ok).toBe(true);
+        if (r.ok)
+            expect(r.result.methodologyVersion).toBe("engine-test-fixture/v1");
+    });
+    it("parseEngineOutputScanResultOrThrow throws with validation prefix", () => {
+        expect(() => parseEngineOutputScanResultOrThrow(minimalValid)).toThrow(/^validation:/);
+    });
+    it("rejects unparseable generatedAt", () => {
+        const r = safeParseEngineOutputScanResult({
+            ...withMethodology,
+            generatedAt: "not-a-date",
+        });
+        expect(r.ok).toBe(false);
+    });
+});

package/dist/scanSurfaceCopy.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Single source for short scan pipeline / Actions copy (not i18n — keep flat and small).
+ * Risk / merge posture labels stay in riskVocabulary / MERGE_POSTURE_LABEL.
+ */
+export declare const scanSurfaceCopy: {
+    readonly pipeline: {
+        readonly scanRunning: "Scan in progress";
+        readonly scanIncomplete: "Waiting for scan results";
+        readonly scanUnavailable: "Scan data unavailable";
+        readonly analysisIncomplete: "Analysis could not be completed";
+        readonly outputNotVerified: "These results could not be verified";
+    };
+    readonly actions: {
+        readonly failureTitle: "MergeSignal";
+        readonly failureBody: "Analysis could not be completed. Check the workflow logs for details.";
+        readonly demoSummaryTitle: "MergeSignal (demo output)";
+        readonly demoSummaryBanner: "Sample analysis only — not production MergeSignal results. Do not use for merge decisions.";
+        readonly trustedSummaryMethodologyLine: "Methodology";
+        /** Dogfood workflow: secret missing on same-repo runs (annotation + logs). */
+        readonly trustedWorkflowSecretMissing: "Trusted MergeSignal analysis is unavailable in this repository. Complete engine access setup, then re-run the workflow.";
+        /** Composite: trusted profile without engine token input. */
+        readonly trustedCompositeTokenMissing: "Trusted analysis is unavailable: engine access was not provided to this workflow run.";
+        readonly trustedEngineRepoLayoutInvalid: "MergeSignal could not prepare the analysis engine (unsupported project layout).";
+        readonly trustedEngineBuildOutputMissing: "MergeSignal could not prepare the analysis engine (expected build output was not found).";
+        /** Stub methodology or trusted summary preflight. */
+        readonly trustedSummaryStubBlocked: "Trusted analysis is unavailable: output did not meet verification requirements.";
+        readonly trustedMethodologyMissing: "Trusted analysis is unavailable: verified analysis metadata was missing.";
+        readonly trustedMethodologyPolicyMismatch: "Trusted analysis is unavailable: methodology output did not match the configured policy.";
+        readonly trustedAuditEnvInvalid: "Trusted analysis verification could not run in this environment.";
+        /** Post-render audit: summary text failed trusted verification. */
+        readonly trustedSummaryVerificationFailed: "MergeSignal could not verify this summary for trusted analysis.";
+        readonly prAnalysisUnavailableFork: "MergeSignal analysis is not available for this pull request (fork PRs use a restricted CI context).";
+        readonly prAnalysisUnavailableDependabot: "MergeSignal analysis is not available for automated dependency update PRs in this CI context.";
+        /** push/workflow_dispatch on a clone with no engine token configured (forks/mirrors). */
+        readonly pushTrustedScanSkippedNoEngineToken: "Trusted MergeSignal analysis was skipped because no engine access token is configured for this repository.";
+        /** Step summary when trusted scan cannot start (canonical repo, token missing). */
+        readonly trustedWorkflowCredentialHintBody: "The engine checkout token was not available to this workflow run. Add it under this repository's Actions secrets, or grant this repository access to an organization secret. Secrets that exist only on a GitHub Environment are not available here unless this job declares that environment.";
+        /** Trusted step summary H1 product line (before posture · risk index). */
+        readonly trustedStepSummaryTitlePrefix: "MergeSignal dependency review";
+        /** GitHub Actions step summary: risk index direction (shared with web/CLI where imported). */
+        readonly riskIndexDirectionShort: "0 = lowest merge risk, 100 = highest merge risk";
+        /** When `decision` is missing on scan JSON (legacy output). */
+        readonly mergePostureUnavailableShort: "Posture unavailable";
+        readonly mergePostureUnavailableDetail: "This scan did not include a merge posture verdict; use the risk index as a coarse signal only.";
+        /** `<summary>` lines for collapsible sections (keep short for GitHub UI). */
+        readonly scoreBreakdownDetailsSummary: "Layer scores — this scan";
+        readonly dependencyGraphDetailsSummary: "Graph context";
+        readonly moreActionsDetailsSummary: "More guidance";
+        readonly moreInsightsDetailsSummary: "More insights";
+        /** Inside dependency graph `<details>`. */
+        readonly supportingGraphContextNote: "Supporting context — not a merge verdict by itself.";
+        readonly layerScoreGlossary: "*Higher column scores = more risk in that dimension (0 best → 100 worst).*";
+        /** After layer table: scan-specific drivers from explain/contributions. */
+        readonly layerDriversHeading: "Signals behind elevated scores";
+        /** When surfacing recommendation rationale first (trusted default fold). */
+        readonly recReviewLeadPrefix: "**For this PR:**";
+        readonly vulnerableReviewerHint: "If vulnerable packages are listed, confirm they apply to your usage before treating counts as merge blockers.";
+        /** Development profile: no recommendations or actionable insights. */
+        readonly devNoImmediateActions: "No immediate actions required";
+    };
+    /** GitHub App Check Run (PR) — calm, concise; not Actions step summary. */
+    readonly checkRun: {
+        readonly titleBase: "MergeSignal scan - PR dependency change";
+        readonly titleBaselineSuffix: "baseline scan only";
+        readonly baselineOutcomePrimary: "No actionable dependency concerns showed up for this PR in this scan.";
+        readonly baselineOutcomeScope: "This run emphasizes repository-wide context; open the scan for PR-specific detail when available.";
+        readonly baselineBoundaryNote: "PR-targeted dependency signals are not included in baseline-only runs.";
+        readonly footerLinkLabel: "View full scan";
+        readonly layerScoresDetailsSummary: "Layer scores";
+        readonly layerNoDrivers: "No notable drivers surfaced for this dimension.";
+        readonly repoContextLabel: "Risk index";
+        readonly mergePostureUnavailable: "Posture unavailable";
+    };
+    readonly product: {
+        /** Single line for UI/CLI/Actions parity (risk index semantics). */
+        readonly riskIndexDirectionShort: "0 is best · 100 is worst";
+    };
+    readonly cli: {
+        readonly stderrAnalysisIncomplete: "Analysis could not be completed.";
+        readonly stderrOutputNotVerified: "These results could not be verified.";
+    };
+    /** @mergesignal/engine loader (stderr / thrown when impl missing). */
+    readonly engineLoader: {
+        readonly implRequiredTrustedScan: "Trusted analysis requires a configured analysis engine. Use demo output only when you explicitly intend to run without a real engine.";
+        readonly implRequiredProduction: "A configured analysis engine is required in this environment. Use demo output only when you explicitly intend to run without a real engine.";
+    };
+};
+/** Flatten for `scripts/ci/*.mjs` consumers (generated JSON). */
+export declare function scanSurfaceCopyFlat(): Record<string, string>;
+//# sourceMappingURL=scanSurfaceCopy.d.ts.map

package/dist/scanSurfaceCopy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanSurfaceCopy.d.ts","sourceRoot":"","sources":["../src/scanSurfaceCopy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;QAgBxB,8EAA8E;;QAG9E,6DAA6D;;;;QAO7D,qDAAqD;;;;;QASrD,mEAAmE;;;;QAOnE,yFAAyF;;QAGzF,mFAAmF;;QAGnF,0EAA0E;;QAE1E,8FAA8F;;QAE9F,+DAA+D;;;QAI/D,6EAA6E;;;;;QAK7E,2CAA2C;;;QAK3C,2EAA2E;;QAE3E,4EAA4E;;;QAI5E,sEAAsE;;;IAGxE,2EAA2E;;;;;;;;;;;;;;QAiBzE,oEAAoE;;;;;;;IAOtE,sEAAsE;;;;;CAO9D,CAAC;AAEX,iEAAiE;AACjE,wBAAgB,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa5D"}

package/dist/scanSurfaceCopy.js

@@ -0,0 +1,104 @@
+/**
+ * Single source for short scan pipeline / Actions copy (not i18n — keep flat and small).
+ * Risk / merge posture labels stay in riskVocabulary / MERGE_POSTURE_LABEL.
+ */
+export const scanSurfaceCopy = {
+    pipeline: {
+        scanRunning: "Scan in progress",
+        scanIncomplete: "Waiting for scan results",
+        scanUnavailable: "Scan data unavailable",
+        analysisIncomplete: "Analysis could not be completed",
+        outputNotVerified: "These results could not be verified",
+    },
+    actions: {
+        failureTitle: "MergeSignal",
+        failureBody: "Analysis could not be completed. Check the workflow logs for details.",
+        demoSummaryTitle: "MergeSignal (demo output)",
+        demoSummaryBanner: "Sample analysis only — not production MergeSignal results. Do not use for merge decisions.",
+        trustedSummaryMethodologyLine: "Methodology",
+        /** Dogfood workflow: secret missing on same-repo runs (annotation + logs). */
+        trustedWorkflowSecretMissing: "Trusted MergeSignal analysis is unavailable in this repository. Complete engine access setup, then re-run the workflow.",
+        /** Composite: trusted profile without engine token input. */
+        trustedCompositeTokenMissing: "Trusted analysis is unavailable: engine access was not provided to this workflow run.",
+        trustedEngineRepoLayoutInvalid: "MergeSignal could not prepare the analysis engine (unsupported project layout).",
+        trustedEngineBuildOutputMissing: "MergeSignal could not prepare the analysis engine (expected build output was not found).",
+        /** Stub methodology or trusted summary preflight. */
+        trustedSummaryStubBlocked: "Trusted analysis is unavailable: output did not meet verification requirements.",
+        trustedMethodologyMissing: "Trusted analysis is unavailable: verified analysis metadata was missing.",
+        trustedMethodologyPolicyMismatch: "Trusted analysis is unavailable: methodology output did not match the configured policy.",
+        trustedAuditEnvInvalid: "Trusted analysis verification could not run in this environment.",
+        /** Post-render audit: summary text failed trusted verification. */
+        trustedSummaryVerificationFailed: "MergeSignal could not verify this summary for trusted analysis.",
+        prAnalysisUnavailableFork: "MergeSignal analysis is not available for this pull request (fork PRs use a restricted CI context).",
+        prAnalysisUnavailableDependabot: "MergeSignal analysis is not available for automated dependency update PRs in this CI context.",
+        /** push/workflow_dispatch on a clone with no engine token configured (forks/mirrors). */
+        pushTrustedScanSkippedNoEngineToken: "Trusted MergeSignal analysis was skipped because no engine access token is configured for this repository.",
+        /** Step summary when trusted scan cannot start (canonical repo, token missing). */
+        trustedWorkflowCredentialHintBody: "The engine checkout token was not available to this workflow run. Add it under this repository's Actions secrets, or grant this repository access to an organization secret. Secrets that exist only on a GitHub Environment are not available here unless this job declares that environment.",
+        /** Trusted step summary H1 product line (before posture · risk index). */
+        trustedStepSummaryTitlePrefix: "MergeSignal dependency review",
+        /** GitHub Actions step summary: risk index direction (shared with web/CLI where imported). */
+        riskIndexDirectionShort: "0 = lowest merge risk, 100 = highest merge risk",
+        /** When `decision` is missing on scan JSON (legacy output). */
+        mergePostureUnavailableShort: "Posture unavailable",
+        mergePostureUnavailableDetail: "This scan did not include a merge posture verdict; use the risk index as a coarse signal only.",
+        /** `<summary>` lines for collapsible sections (keep short for GitHub UI). */
+        scoreBreakdownDetailsSummary: "Layer scores — this scan",
+        dependencyGraphDetailsSummary: "Graph context",
+        moreActionsDetailsSummary: "More guidance",
+        moreInsightsDetailsSummary: "More insights",
+        /** Inside dependency graph `<details>`. */
+        supportingGraphContextNote: "Supporting context — not a merge verdict by itself.",
+        layerScoreGlossary: "*Higher column scores = more risk in that dimension (0 best → 100 worst).*",
+        /** After layer table: scan-specific drivers from explain/contributions. */
+        layerDriversHeading: "Signals behind elevated scores",
+        /** When surfacing recommendation rationale first (trusted default fold). */
+        recReviewLeadPrefix: "**For this PR:**",
+        vulnerableReviewerHint: "If vulnerable packages are listed, confirm they apply to your usage before treating counts as merge blockers.",
+        /** Development profile: no recommendations or actionable insights. */
+        devNoImmediateActions: "No immediate actions required",
+    },
+    /** GitHub App Check Run (PR) — calm, concise; not Actions step summary. */
+    checkRun: {
+        titleBase: "MergeSignal scan - PR dependency change",
+        titleBaselineSuffix: "baseline scan only",
+        baselineOutcomePrimary: "No actionable dependency concerns showed up for this PR in this scan.",
+        baselineOutcomeScope: "This run emphasizes repository-wide context; open the scan for PR-specific detail when available.",
+        baselineBoundaryNote: "PR-targeted dependency signals are not included in baseline-only runs.",
+        footerLinkLabel: "View full scan",
+        layerScoresDetailsSummary: "Layer scores",
+        layerNoDrivers: "No notable drivers surfaced for this dimension.",
+        repoContextLabel: "Risk index",
+        mergePostureUnavailable: "Posture unavailable",
+    },
+    product: {
+        /** Single line for UI/CLI/Actions parity (risk index semantics). */
+        riskIndexDirectionShort: "0 is best · 100 is worst",
+    },
+    cli: {
+        stderrAnalysisIncomplete: "Analysis could not be completed.",
+        stderrOutputNotVerified: "These results could not be verified.",
+    },
+    /** @mergesignal/engine loader (stderr / thrown when impl missing). */
+    engineLoader: {
+        implRequiredTrustedScan: "Trusted analysis requires a configured analysis engine. Use demo output only when you explicitly intend to run without a real engine.",
+        implRequiredProduction: "A configured analysis engine is required in this environment. Use demo output only when you explicitly intend to run without a real engine.",
+    },
+};
+/** Flatten for `scripts/ci/*.mjs` consumers (generated JSON). */
+export function scanSurfaceCopyFlat() {
+    const out = {};
+    const walk = (prefix, obj) => {
+        if (obj && typeof obj === "object" && !Array.isArray(obj)) {
+            for (const [k, v] of Object.entries(obj)) {
+                const key = prefix ? `${prefix}.${k}` : k;
+                if (typeof v === "string")
+                    out[key] = v;
+                else
+                    walk(key, v);
+            }
+        }
+    };
+    walk("", scanSurfaceCopy);
+    return out;
+}