@mergesignal/shared 0.2.0

package/dist/types.d.ts

@@ -0,0 +1,362 @@
+export type LayerScores = {
+    security: number;
+    maintainability: number;
+    ecosystem: number;
+    upgradeImpact: number;
+};
+export type FindingSeverity = "low" | "medium" | "high" | "critical";
+/**
+ * Producer-authored classification for {@link Finding}. Prefer this over inferring from `id` strings.
+ */
+export type FindingCategory = "graph_structure" | "input_coverage" | "security_vulnerability" | "ecosystem_registry" | "ecosystem_adoption" | "ecosystem_github" | "breaking_change" | "deprecation" | "major_version" | "unknown";
+/** Structured lockfile delta (optional; from worker base vs head comparison). */
+export type LockfilePackageDelta = {
+    added: string[];
+    removed: string[];
+    /** Package names whose resolved version changed between base and head. */
+    updated: string[];
+};
+export type Finding = {
+    id: string;
+    title: string;
+    description: string;
+    severity: FindingSeverity;
+    packageName: string;
+    recommendation?: string;
+    /** When set, drives insight-layer mapping; omit only for external/legacy fixtures. */
+    category?: FindingCategory;
+    /** Optional structured hints (e.g. OSV ids); omit if public contract forbids extra keys. */
+    evidence?: Record<string, unknown>;
+};
+export type LockfileManager = "pnpm" | "npm" | "yarn";
+export type ScanLockfileInput = {
+    manager: LockfileManager;
+    content: string;
+    path?: string;
+};
+export type RepoSource = {
+    provider: "github";
+    owner: string;
+    repo: string;
+    sha: string;
+    installationId: number;
+};
+export type CodeAnalysisMetrics = {
+    fromCache: boolean;
+    analysisTimeMs?: number;
+    timedOut?: boolean;
+    filesAnalyzed: number;
+};
+/** Subset of PR identity passed into analysis (no installation tokens). */
+export type ScanRequestGithubContext = {
+    owner: string;
+    repo: string;
+    prNumber: number;
+};
+export type ScanRequest = {
+    repoId: string;
+    dependencyGraph: unknown;
+    lockfile?: ScanLockfileInput;
+    /** Base branch lockfile for PR scans (optional). */
+    baseLockfile?: ScanLockfileInput;
+    repoSource?: RepoSource;
+    /** Optional PR context for engine/logging (no installation id). */
+    github?: ScanRequestGithubContext;
+    changedPackages?: string[];
+    /** When both base and head lockfiles were compared in the worker. */
+    lockfilePackageDelta?: LockfilePackageDelta;
+    changedFiles?: string[];
+    codeAnalysisMetrics?: CodeAnalysisMetrics;
+};
+export type ScoreLayer = keyof LayerScores;
+export type RiskConfidence = "low" | "medium" | "high";
+export type RiskSignal = {
+    id: string;
+    layer: ScoreLayer;
+    name: string;
+    value: number;
+    weight: number;
+    scoreImpact: number;
+    evidence?: Record<string, unknown>;
+};
+export type ScoreContribution = {
+    id: string;
+    layer: ScoreLayer;
+    scoreImpact: number;
+    evidence?: Record<string, unknown>;
+};
+export type Recommendation = {
+    id: string;
+    title: string;
+    rationale: string;
+    impact: "low" | "medium" | "high";
+    packages?: string[];
+    rank?: number;
+    priorityScore?: number;
+    estimatedScoreDelta?: number;
+    layers?: ScoreLayer[];
+    evidence?: Record<string, unknown>;
+};
+export type PackageHealthObservation = {
+    name: string;
+    registry: "npm";
+    fetchedAt: string;
+    latestVersion: string | null;
+    latestPublishedAt: string | null;
+    modifiedAt: string | null;
+    deprecated: boolean;
+    maintainersCount: number | null;
+    repositoryUrl: string | null;
+};
+export type ScanDataset = {
+    packageHealth?: PackageHealthObservation[];
+};
+export type ExplainReason = {
+    id: string;
+    layer: ScoreLayer;
+    title: string;
+    value?: number;
+    scoreImpact: number;
+    evidence?: Record<string, unknown>;
+};
+export type ExplainBlock = {
+    reasons: ExplainReason[];
+};
+export type DependencyGraphInsightKind = "hidden" | "vulnerable" | "deep" | "hotspot";
+export type DependencyGraphInsight = {
+    kind: DependencyGraphInsightKind;
+    packageName: string;
+    version?: string;
+    direct: boolean;
+    depth: number;
+    via?: string[];
+    evidence?: Record<string, unknown>;
+};
+export type DependencyGraphInsights = {
+    maxDepth: number;
+    nodes: number;
+    edges: number;
+    deepest?: DependencyGraphInsight[];
+    hotspots?: DependencyGraphInsight[];
+    vulnerable?: DependencyGraphInsight[];
+};
+export type PRInsightType = "behavioral_change" | "usage_risk" | "dependency_risk" | "hot_path_impact" | "complexity_creep";
+export type PRInsightPriority = "critical" | "high" | "medium";
+export type InsightConfidence = "confirmed" | "likely" | "speculative";
+export type InsightScope = "changed" | "all";
+/** PR-facing merge decision vocabulary per insight (emitted insights use RISKY | BLOCK only). */
+export type InsightDecisionLevel = "SAFE" | "RISKY" | "BLOCK";
+/** Bar for whether an insight may appear on a PR (strict gate: only `high` emits). */
+export type EmissionConfidenceLevel = "low" | "medium" | "high";
+/**
+ * Per-repo threshold controlling which emission confidence levels trigger a PR comment.
+ * - `'high'`   → only `emissionConfidence === 'high'` (default; free tier)
+ * - `'medium'` → `'high' | 'medium'` (paid tier opt-in)
+ * - `'low'`    → all confidence levels (reserved; no analyzer produces low-confidence today)
+ */
+export type CommentThreshold = "high" | "medium" | "low";
+export type PRInsight = {
+    type: PRInsightType;
+    priority: PRInsightPriority;
+    confidence: InsightConfidence;
+    scope: InsightScope;
+    message: string;
+    context: string;
+    remediation: string;
+    affectedFiles?: string[];
+    details?: Record<string, unknown>;
+    /**
+     * Decision-first contract. Optional on analyzer drafts; required on {@link PRInsightEmission}.
+     */
+    decisionLevel?: InsightDecisionLevel;
+    emissionConfidence?: EmissionConfidenceLevel;
+    mechanism?: string;
+    action?: string;
+};
+/** Insights returned from `analyze()` after synthesis + emission contract. */
+export type PRInsightEmission = PRInsight & {
+    decisionLevel: InsightDecisionLevel;
+    emissionConfidence: EmissionConfidenceLevel;
+    mechanism: string;
+    action: string;
+};
+/**
+ * Canonical merge posture tokens for `ScanResult.decision.recommendation` and
+ * persisted/API `decision` fields. Analysis engines must emit **only** these
+ * lowercase strings (no alternate vocabularies in the wire contract).
+ */
+export declare const MERGE_POSTURE_RECOMMENDATIONS: readonly ["safe", "needs_review", "risky"];
+export type PRDecisionRecommendation = (typeof MERGE_POSTURE_RECOMMENDATIONS)[number];
+export type PRDecisionConfidence = "low" | "medium" | "high";
+export type PRDecision = {
+    recommendation: PRDecisionRecommendation;
+    confidence: PRDecisionConfidence;
+    reasoning: string[];
+};
+/** Presentation-only: how the engine surfaces results when PR-local signal is weak vs strong. */
+export type ReportPresentationMode = "high_signal_pr" | "lightweight_pr_graph_baseline";
+export type ReportPresentation = {
+    mode: ReportPresentationMode;
+};
+/**
+ * Optional bounded engineering trace for `MERGESIGNAL_ENGINEERING_TRACE=1`.
+ * Not end-user telemetry; deterministic, size-capped, for debugging narrative/emission ordering.
+ */
+export type EngineeringTrace = {
+    narrativeProfileSnapshot: {
+        dominantKind: string;
+        dominantTuple: readonly [number, number, number];
+        runnerUpKind: string | null;
+        decidedAtStep: string;
+        marginApplied: boolean;
+        prChangedPackages: readonly string[];
+    };
+    explainDriverIds: readonly string[];
+    orderingTrace: readonly {
+        messagePreview: string;
+        narrativeTier: number;
+        qualityPass: boolean;
+        priority: PRInsightPriority;
+        type: PRInsightType;
+    }[];
+    emissionDrops: readonly {
+        ruleId: string;
+    }[];
+    analyzerContributions: Readonly<Record<string, number>>;
+};
+export type ScanResult = {
+    totalScore: number;
+    layerScores: LayerScores;
+    findings: Finding[];
+    methodologyVersion?: string;
+    confidence?: RiskConfidence;
+    signals?: RiskSignal[];
+    contributions?: ScoreContribution[];
+    recommendations?: Recommendation[];
+    dataset?: ScanDataset;
+    explain?: ExplainBlock;
+    graphInsights?: DependencyGraphInsights;
+    generatedAt: string;
+    insights?: PRInsight[];
+    decision?: PRDecision;
+    codeAnalysisMetrics?: CodeAnalysisMetrics;
+    /** Present when `MERGESIGNAL_ENGINEERING_TRACE=1` during analysis (bounded, deterministic). */
+    engineeringTrace?: EngineeringTrace;
+    /**
+     * Binary presentation policy (fallback vs high-signal). Does not drive analyzer or scoring logic.
+     */
+    reportPresentation?: ReportPresentation;
+    /** Echo of `ScanRequest.changedPackages` when non-empty (e.g. lockfile diff); for Check Run / UI copy. */
+    changedPackages?: string[];
+};
+/** Provenance the analysis engine must set on fresh output (historical DB rows may omit methodology). */
+export type ScanProvenanceFields = Pick<ScanResult, "methodologyVersion" | "generatedAt">;
+/** Result that passed strict engine-output validation (non-empty methodology). */
+export type EngineEmittedScanResult = ScanResult & Required<Pick<ScanResult, "methodologyVersion">>;
+export type UpgradeTarget = {
+    packageName: string;
+    targetVersion?: string;
+};
+export type UpgradeSimulationRequest = {
+    repoId: string;
+    currentLockfile: ScanLockfileInput;
+    proposedLockfile?: ScanLockfileInput;
+    target?: UpgradeTarget;
+};
+export type UpgradeSimulationDelta = {
+    totalScoreDelta?: number;
+    layerScoreDeltas?: Partial<Record<ScoreLayer, number>>;
+    topSignalDeltas?: Array<{
+        id: string;
+        layer: ScoreLayer;
+        before?: number;
+        after?: number;
+        scoreImpactBefore?: number;
+        scoreImpactAfter?: number;
+    }>;
+    dependencyDelta?: {
+        directKnown?: boolean;
+        directAdded: number;
+        directRemoved: number;
+        directUpdated: number;
+        packagesAdded: number;
+        packagesRemoved: number;
+        topDirectAdded?: string[];
+        topDirectRemoved?: string[];
+        topDirectUpdated?: string[];
+    };
+};
+export type UpgradeSimulationImpact = {
+    packageName?: string;
+    observedVersions?: string[];
+    fanIn?: number;
+    rootBlastRadius?: number;
+};
+export type UpgradeSimulationResult = {
+    before: ScanResult;
+    after?: ScanResult;
+    delta?: UpgradeSimulationDelta;
+    impact?: UpgradeSimulationImpact;
+    generatedAt: string;
+};
+export type BreakingChangeSource = "semver" | "changelog" | "manual";
+export type BreakingChangeSeverity = "low" | "medium" | "high";
+export type BreakingChange = {
+    source: BreakingChangeSource;
+    severity: BreakingChangeSeverity;
+    description: string;
+    affectedAPIs?: string[];
+};
+export type UsageReport = {
+    filesUsingPackage: string[];
+    importedSymbols: string[];
+    criticalPaths: string[];
+    usageCount: number;
+};
+export type CriticalPathScore = {
+    isCritical: boolean;
+    score: number;
+    reasons: string[];
+};
+export type ImpactInsightType = "breaking_change_used" | "breaking_change_unused" | "critical_path_affected" | "high_usage_detected" | "safe_upgrade";
+export type ImpactInsightSeverity = "low" | "medium" | "high";
+export type ImpactInsight = {
+    type: ImpactInsightType;
+    severity: ImpactInsightSeverity;
+    message: string;
+    affectedFiles?: string[];
+    affectedSymbols?: string[];
+    breakingChange?: BreakingChange;
+};
+export type PRAnalysisResult = {
+    decision: PRDecisionRecommendation;
+    breakingChanges: BreakingChange[];
+    usageImpact: UsageReport[];
+    criticalPath?: CriticalPathScore;
+    insights: ImpactInsight[];
+    generatedAt: string;
+};
+/** BullMQ queue name shared by API (producer) and worker (consumer). */
+export declare const SCAN_QUEUE_NAME: "scan-queue";
+export type ScanQueueGithubContext = {
+    owner: string;
+    repo: string;
+    prNumber: number;
+    headSha: string;
+    baseSha?: string;
+    baseRef?: string;
+    installationId: number;
+    deliveryId?: string;
+};
+/** BullMQ job payload for scan jobs. */
+export type ScanQueueJob = {
+    scanId: string;
+    repoId: string;
+    dependencyGraph: unknown;
+    lockfile?: ScanLockfileInput;
+    baseLockfile?: ScanLockfileInput;
+    repoSource?: RepoSource;
+    changedFiles?: string[];
+    github?: ScanQueueGithubContext;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAErE;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,gBAAgB,GAChB,wBAAwB,GACxB,oBAAoB,GACpB,oBAAoB,GACpB,kBAAkB,GAClB,iBAAiB,GACjB,aAAa,GACb,eAAe,GACf,SAAS,CAAC;AAEd,iFAAiF;AACjF,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;AAEtD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,oDAAoD;IACpD,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mEAAmE;IACnE,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC;AAE3C,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEvD,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,UAAU,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,aAAa,CAAC,EAAE,wBAAwB,EAAE,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAClC,QAAQ,GACR,YAAY,GACZ,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,0BAA0B,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACnC,QAAQ,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACpC,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,YAAY,GACZ,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,CAAC;AAEvB,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE/D,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,QAAQ,GAAG,aAAa,CAAC;AACvE,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,KAAK,CAAC;AAE7C,iGAAiG;AACjG,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAE9D,sFAAsF;AACtF,MAAM,MAAM,uBAAuB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEzD,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC;;OAEG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG;IAC1C,aAAa,EAAE,oBAAoB,CAAC;IACpC,kBAAkB,EAAE,uBAAuB,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,4CAIhC,CAAC;AAEX,MAAM,MAAM,wBAAwB,GAClC,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE7D,MAAM,MAAM,UAAU,GAAG;IACvB,cAAc,EAAE,wBAAwB,CAAC;IACzC,UAAU,EAAE,oBAAoB,CAAC;IACjC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF,iGAAiG;AACjG,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,+BAA+B,CAAC;AAEpC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,sBAAsB,CAAC;CAC9B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,wBAAwB,EAAE;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,OAAO,CAAC;QACvB,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,aAAa,EAAE,SAAS;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,OAAO,CAAC;QACrB,QAAQ,EAAE,iBAAiB,CAAC;QAC5B,IAAI,EAAE,aAAa,CAAC;KACrB,EAAE,CAAC;IACJ,aAAa,EAAE,SAAS;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,aAAa,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACpC,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;OAEG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0GAA0G;IAC1G,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,yGAAyG;AACzG,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACrC,UAAU,EACV,oBAAoB,GAAG,aAAa,CACrC,CAAC;AAEF,kFAAkF;AAClF,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAC9C,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAEnD,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,iBAAiB,CAAC;IACnC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,eAAe,CAAC,EAAE,KAAK,CAAC;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,UAAU,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC,CAAC;IACH,eAAe,CAAC,EAAE;QAChB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;AAErE,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE/D,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,sBAAsB,GACtB,wBAAwB,GACxB,wBAAwB,GACxB,qBAAqB,GACrB,cAAc,CAAC;AAEnB,MAAM,MAAM,qBAAqB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE9D,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,EAAE,qBAAqB,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,wBAAwB,CAAC;IACnC,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,WAAW,EAAE,WAAW,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,eAAe,EAAG,YAAqB,CAAC;AAErD,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wCAAwC;AACxC,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,sBAAsB,CAAC;CACjC,CAAC"}

package/dist/types.js

@@ -0,0 +1,12 @@
+/**
+ * Canonical merge posture tokens for `ScanResult.decision.recommendation` and
+ * persisted/API `decision` fields. Analysis engines must emit **only** these
+ * lowercase strings (no alternate vocabularies in the wire contract).
+ */
+export const MERGE_POSTURE_RECOMMENDATIONS = [
+    "safe",
+    "needs_review",
+    "risky",
+];
+/** BullMQ queue name shared by API (producer) and worker (consumer). */
+export const SCAN_QUEUE_NAME = "scan-queue";

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@mergesignal/shared",
+  "version": "0.2.0",
+  "description": "MergeSignal shared scan contract, presentation policy, and trusted validation",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MergeSignal/mergesignal.git",
+    "directory": "packages/shared"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./types": {
+      "types": "./dist/types.d.ts",
+      "import": "./dist/types.js",
+      "default": "./dist/types.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && pnpm run generate:ci-copy",
+    "prepublishOnly": "pnpm run build",
+    "generate:ci-copy": "tsx scripts/emit-scan-surface-copy.ts",
+    "typecheck": "tsc --noEmit",
+    "check-types": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.3",
+    "tsx": "^4.21.0",
+    "typescript": "^5.3.0",
+    "vitest": "^2.1.8"
+  },
+  "license": "MIT"
+}