@mergesignal/shared 0.2.2 → 0.2.4

package/dist/scanDetailViewModel.d.ts

@@ -0,0 +1,108 @@
+import { type ScanDetailRecommendationCenter } from "./deriveScanDetailRecommendations.js";
+import { type ScanDetailSignalSummary } from "./deriveRiskScoreSummary.js";
+import { type MergePosture } from "./riskVocabulary.js";
+import type { FindingSeverity, ScanResult } from "./types.js";
+export declare const ACT2_MAX_THEMES = 4;
+export declare const ACT2_MAX_THEME_CHARS = 80;
+export declare const VERDICT_LINE_MAX_CHARS = 120;
+export declare const TIER1_MAX_VISIBLE_IMPACTS = 3;
+export declare const ACT3_EVIDENCE_COLLAPSE_THRESHOLD = 10;
+export type ScanDetailOperationalImpactItem = {
+    message: string;
+    where?: string;
+    verify?: string;
+    affectedFiles?: string[];
+};
+export type ScanDetailOperationalImpact = {
+    status: "rich" | "fallback" | "hidden";
+    items: ScanDetailOperationalImpactItem[];
+    fallbackMessage?: string;
+};
+export type ScanDetailVerdict = {
+    posture: MergePosture | null;
+    scopeChip: string | null;
+    verdictLine: string;
+    prLabel?: string;
+    statusLabel?: string;
+};
+export type ScanDetailAttentionPackage = {
+    name: string;
+    version?: string;
+    direct: boolean;
+    severity?: FindingSeverity;
+    evidence?: string;
+};
+export type ScanDetailAttentionArea = {
+    problemLabel: string;
+    problemDescription: string;
+    packages: ScanDetailAttentionPackage[];
+    overflowCount: number;
+};
+export type ScanDetailFindingRow = {
+    id: string;
+    severity: FindingSeverity;
+    title: string;
+    description: string;
+    packageName: string;
+    recommendation?: string;
+    source: "dependency" | "code";
+    coveredByRecommendationRank?: number;
+};
+export type ScanDetailTopology = {
+    summaryLine: string;
+    deepest: Array<{
+        packageName: string;
+        depth: number;
+        direct: boolean;
+        via: string[];
+    }>;
+};
+export type ScanDetailViewModel = {
+    verdict: ScanDetailVerdict;
+    signalSummary: ScanDetailSignalSummary | null;
+    followUpBridgeNote: string | null;
+    recommendedActions: ScanDetailRecommendationCenter;
+    operationalImpact: ScanDetailOperationalImpact;
+    because: {
+        themes: string[];
+        confidenceCaveat?: string;
+    } | null;
+    evidence: {
+        attentionAreas: ScanDetailAttentionArea[];
+        findings: ScanDetailFindingRow[];
+        findingsOverflowCount: number;
+        topology: ScanDetailTopology | null;
+    } | null;
+    repoContext: {
+        status: "hidden";
+    } | {
+        status: "loaded";
+        comparisonLine: string;
+    };
+    metadata: {
+        scanId: string;
+        generatedAt?: string;
+        methodologyVersion?: string | null;
+        changedPackagesSummary?: string;
+        codeAnalysisTimedOut?: boolean;
+    };
+};
+export type DeriveScanDetailOptions = {
+    scanId: string;
+    status: "queued" | "running" | "done" | "failed";
+    methodologyVersion?: string | null;
+    prNumber?: number | null;
+    repoContext?: ScanDetailViewModel["repoContext"];
+};
+/** Bridge copy from Signal summary to Recommended actions. */
+export declare function deriveFollowUpBridgeNote(actionCount: number): string | null;
+/** Act 2 theme sanitizer — strips package/CVE/version content. */
+export declare function sanitizeAct2Theme(raw: string): string | null;
+/** Verdict line from posture + reach band (scanSurfaceCopy.scanDetail.verdictLine). */
+export declare function deriveVerdictLine(posture: MergePosture | null, totalScore: number | null | undefined): string;
+export declare function deriveAct2Themes(result: ScanResult): string[];
+export declare function deriveOperationalImpact(result: ScanResult, verifyLabels?: Set<string>): ScanDetailOperationalImpact;
+export declare function deriveScanDetailViewModel(result: ScanResult | null | undefined, options: DeriveScanDetailOptions): ScanDetailViewModel | null;
+/** Tier 1 recall test helper — true when message describes application-level impact. */
+export declare function tier1PassesRecallTest(operationalImpact: ScanDetailOperationalImpact): boolean;
+//# sourceMappingURL=scanDetailViewModel.d.ts.map

package/dist/scanDetailViewModel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanDetailViewModel.d.ts","sourceRoot":"","sources":["../src/scanDetailViewModel.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,KAAK,8BAA8B,EACpC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EAEL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAGV,eAAe,EAGf,UAAU,EAEX,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAmBnD,MAAM,MAAM,+BAA+B,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;IACvC,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,0BAA0B,EAAE,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,YAAY,GAAG,MAAM,CAAC;IAC9B,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,KAAK,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,OAAO,CAAC;QAChB,GAAG,EAAE,MAAM,EAAE,CAAC;KACf,CAAC,CAAC;CACJ,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,aAAa,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC9C,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kBAAkB,EAAE,8BAA8B,CAAC;IACnD,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChE,QAAQ,EAAE;QACR,cAAc,EAAE,uBAAuB,EAAE,CAAC;QAC1C,QAAQ,EAAE,oBAAoB,EAAE,CAAC;QACjC,qBAAqB,EAAE,MAAM,CAAC;QAC9B,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;KACrC,GAAG,IAAI,CAAC;IACT,WAAW,EACP;QAAE,MAAM,EAAE,QAAQ,CAAA;KAAE,GACpB;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,QAAQ,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnC,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACjD,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC;CAClD,CAAC;AAEF,8DAA8D;AAC9D,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ3E;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI5D;AAWD,uFAAuF;AACvF,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,YAAY,GAAG,IAAI,EAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,MAAM,CAqBR;AA4DD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAa7D;AAwBD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,UAAU,EAClB,YAAY,GAAE,GAAG,CAAC,MAAM,CAAa,GACpC,2BAA2B,CAuD7B;AAkMD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,EACrC,OAAO,EAAE,uBAAuB,GAC/B,mBAAmB,GAAG,IAAI,CAuE5B;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CACnC,iBAAiB,EAAE,2BAA2B,GAC7C,OAAO,CAiBT"}

package/dist/scanDetailViewModel.js

@@ -0,0 +1,420 @@
+import { humanizeEngineSurfaceText, layerRiskBandLabel, sortPRInsightsForDisplay, truncateWithEllipsis, } from "./actionsStepSummary.js";
+import { mapFindingToCatalogPhrase, mapGraphInsightsToCatalogPhrases, phraseForFamily, } from "./cardObservationCatalog.js";
+import { deriveCardOperationalObservations } from "./deriveCardOperationalObservations.js";
+import { deriveScanDetailRecommendations, recommendationTitlesForDedupe, } from "./deriveScanDetailRecommendations.js";
+import { deriveSignalSummary, } from "./deriveRiskScoreSummary.js";
+import { deriveCardExposureDisplay, deriveDetailReachChip, } from "./formatCardExposureDisplay.js";
+import { formatInsight } from "./formatInsight.js";
+import { mergePostureFromDecision, } from "./riskVocabulary.js";
+import { scanSurfaceCopy } from "./scanSurfaceCopy.js";
+export const ACT2_MAX_THEMES = 4;
+export const ACT2_MAX_THEME_CHARS = 80;
+export const VERDICT_LINE_MAX_CHARS = 120;
+export const TIER1_MAX_VISIBLE_IMPACTS = 3;
+export const ACT3_EVIDENCE_COLLAPSE_THRESHOLD = 10;
+const ACT2_FORBIDDEN = /CVE-\d|@\d|\d+\.\d+\.\d+|[a-z0-9@./+-]+\/[a-z0-9@./+-]+/i;
+const SEVERITY_ORDER = {
+    critical: 4,
+    high: 3,
+    medium: 2,
+    low: 1,
+};
+const LAYER_ORDER = [
+    "security",
+    "maintainability",
+    "ecosystem",
+    "upgradeImpact",
+];
+/** Bridge copy from Signal summary to Recommended actions. */
+export function deriveFollowUpBridgeNote(actionCount) {
+    if (actionCount <= 0)
+        return null;
+    const copy = scanSurfaceCopy.scanDetail.signalSummary;
+    if (actionCount === 1)
+        return copy.followUpImprovementIdentified;
+    return copy.followUpImprovementsIdentified.replace("{count}", String(actionCount));
+}
+/** Act 2 theme sanitizer — strips package/CVE/version content. */
+export function sanitizeAct2Theme(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed || ACT2_FORBIDDEN.test(trimmed))
+        return null;
+    return truncateWithEllipsis(trimmed, ACT2_MAX_THEME_CHARS);
+}
+function reachBand(category) {
+    if (!category || category === "minimal" || category === "limited")
+        return "narrow";
+    if (category === "moderate")
+        return "moderate";
+    return "wide";
+}
+/** Verdict line from posture + reach band (scanSurfaceCopy.scanDetail.verdictLine). */
+export function deriveVerdictLine(posture, totalScore) {
+    const copy = scanSurfaceCopy.scanDetail.verdictLine;
+    const category = deriveCardExposureDisplay(totalScore)?.category;
+    const band = reachBand(category);
+    if (posture === "safe") {
+        if (band === "wide")
+            return copy.safeNoBlockersWide;
+        if (band === "moderate")
+            return copy.safeNoBlockersModerate;
+        return copy.safeNoBlockersNarrow;
+    }
+    if (posture === "risky") {
+        if (band === "wide")
+            return copy.riskyResolveWide;
+        if (band === "moderate")
+            return copy.riskyResolveModerate;
+        return copy.riskyResolveNarrow;
+    }
+    if (posture === "needs_review") {
+        if (band === "wide")
+            return copy.reviewBeforeMergeWide;
+        if (band === "moderate")
+            return copy.reviewBeforeMergeModerate;
+        return copy.reviewBeforeMergeNarrow;
+    }
+    return scanSurfaceCopy.pipeline.scanIncomplete;
+}
+function themeFromCatalogPhrase(phrase) {
+    const map = {
+        "Vulnerable transitive packages detected": "Known vulnerabilities in the transitive tree",
+        "Transitive dependency hotspots detected": "Shared packages concentrate dependency risk",
+        "Duplicate dependency versions detected": "Overlapping dependency paths detected",
+        "Large upgrade blast radius": "Large upgrade footprint across the graph",
+        "High transitive dependency volume": "High transitive dependency volume in the graph",
+        "Deep indirect dependency chains": "Deep indirect dependency chains",
+        "Broad package surface area": "Broad declared package footprint",
+        "Stale ecosystem dependencies detected": "Stale ecosystem dependencies detected",
+        "Overlapping dependency paths detected": "Overlapping dependency paths detected",
+    };
+    return map[phrase] ?? phrase;
+}
+function collectAct2ThemeCandidates(result) {
+    const candidates = [];
+    const posture = mergePostureFromDecision(result.decision?.recommendation);
+    const observations = deriveCardOperationalObservations(result, {
+        mergePosture: posture,
+        hasFullResult: true,
+        max: ACT2_MAX_THEMES + 2,
+    });
+    for (const phrase of observations.operationalObservations) {
+        candidates.push(themeFromCatalogPhrase(phrase));
+    }
+    for (const phrase of mapGraphInsightsToCatalogPhrases(result.graphInsights)) {
+        candidates.push(themeFromCatalogPhrase(phrase.phrase));
+    }
+    if (Array.isArray(result.decision?.reasoning)) {
+        for (const reason of result.decision.reasoning) {
+            const humanized = humanizeEngineSurfaceText(reason);
+            if (humanized)
+                candidates.push(humanized);
+        }
+    }
+    for (const layer of LAYER_ORDER) {
+        const layerScore = result.layerScores?.[layer];
+        const band = layerRiskBandLabel(layerScore);
+        if (band !== "Moderate" && band !== "High")
+            continue;
+        const drivers = humanizeEngineSurfaceText(`${layer} ${band.toLowerCase()} contribution`);
+        if (drivers)
+            candidates.push(`${layer} dimension elevated`);
+    }
+    return candidates;
+}
+export function deriveAct2Themes(result) {
+    const seen = new Set();
+    const themes = [];
+    for (const candidate of collectAct2ThemeCandidates(result)) {
+        const sanitized = sanitizeAct2Theme(candidate);
+        if (!sanitized)
+            continue;
+        const key = sanitized.toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        themes.push(sanitized);
+        if (themes.length >= ACT2_MAX_THEMES)
+            break;
+    }
+    return themes;
+}
+function insightToImpactItem(insight, verifyLabels) {
+    const formatted = formatInsight(insight);
+    const verify = formatted.action &&
+        !verifyLabels.has(formatted.action.toLowerCase().replace(/\s+/g, " ").trim())
+        ? formatted.action
+        : undefined;
+    return {
+        message: formatted.message,
+        where: formatted.where ?? undefined,
+        verify,
+        affectedFiles: insight.affectedFiles?.length
+            ? insight.affectedFiles
+            : undefined,
+    };
+}
+export function deriveOperationalImpact(result, verifyLabels = new Set()) {
+    const insights = sortPRInsightsForDisplay(Array.isArray(result.insights) ? result.insights : []);
+    const copy = scanSurfaceCopy.scanDetail.tier1Fallback;
+    const posture = mergePostureFromDecision(result.decision?.recommendation);
+    const reachCategory = deriveCardExposureDisplay(result.totalScore)?.category;
+    if (insights.length > 0) {
+        return {
+            status: "rich",
+            items: insights.map((insight) => insightToImpactItem(insight, verifyLabels)),
+        };
+    }
+    const isQuietSafe = posture === "safe" &&
+        (reachCategory === "minimal" || reachCategory === "limited");
+    if (result.reportPresentation?.mode === "lightweight_pr_graph_baseline") {
+        return {
+            status: "fallback",
+            items: [],
+            fallbackMessage: copy.lightweightPr,
+        };
+    }
+    const hasGraphProof = (result.graphInsights?.vulnerable?.length ?? 0) > 0 ||
+        (result.graphInsights?.hotspots?.length ?? 0) > 0 ||
+        (result.findings?.length ?? 0) > 0;
+    if (hasGraphProof && posture !== "safe") {
+        return {
+            status: "fallback",
+            items: [],
+            fallbackMessage: copy.structuralProofBelow,
+        };
+    }
+    if (isQuietSafe) {
+        return {
+            status: "fallback",
+            items: [],
+            fallbackMessage: copy.quietSafe,
+        };
+    }
+    return {
+        status: "fallback",
+        items: [],
+        fallbackMessage: copy.structuralComplete,
+    };
+}
+function graphInsightToPackage(item, severity, evidence) {
+    return {
+        name: item.packageName,
+        version: item.version,
+        direct: item.direct,
+        severity,
+        evidence,
+    };
+}
+function buildAttentionAreas(result) {
+    const areas = [];
+    const gi = result.graphInsights;
+    const vulnerable = Array.isArray(gi?.vulnerable) ? gi.vulnerable : [];
+    if (vulnerable.length > 0) {
+        const packages = vulnerable.map((v) => graphInsightToPackage(v));
+        areas.push({
+            problemLabel: phraseForFamily("vulnerable_transitive"),
+            problemDescription: "Packages with known security advisories in the dependency tree.",
+            packages: packages.slice(0, ACT3_EVIDENCE_COLLAPSE_THRESHOLD),
+            overflowCount: Math.max(0, packages.length - ACT3_EVIDENCE_COLLAPSE_THRESHOLD),
+        });
+    }
+    const hotspots = Array.isArray(gi?.hotspots) ? gi.hotspots : [];
+    if (hotspots.length > 0) {
+        const packages = hotspots.map((h) => graphInsightToPackage(h));
+        areas.push({
+            problemLabel: phraseForFamily("transitive_hotspots"),
+            problemDescription: "Packages many dependency paths converge on.",
+            packages: packages.slice(0, ACT3_EVIDENCE_COLLAPSE_THRESHOLD),
+            overflowCount: Math.max(0, packages.length - ACT3_EVIDENCE_COLLAPSE_THRESHOLD),
+        });
+    }
+    const findings = Array.isArray(result.findings) ? result.findings : [];
+    const duplicateFindings = findings.filter((f) => {
+        const mapped = mapFindingToCatalogPhrase(f);
+        return mapped?.family === "duplicate_versions";
+    });
+    if (duplicateFindings.length > 0) {
+        const packages = duplicateFindings.map((f) => ({
+            name: f.packageName,
+            direct: true,
+            severity: f.severity,
+        }));
+        areas.push({
+            problemLabel: phraseForFamily("duplicate_versions"),
+            problemDescription: "Multiple resolved versions of the same dependency.",
+            packages: packages.slice(0, ACT3_EVIDENCE_COLLAPSE_THRESHOLD),
+            overflowCount: Math.max(0, packages.length - ACT3_EVIDENCE_COLLAPSE_THRESHOLD),
+        });
+    }
+    const changed = Array.isArray(result.changedPackages)
+        ? result.changedPackages
+        : [];
+    if (changed.length >= 8) {
+        const packages = changed
+            .slice(0, ACT3_EVIDENCE_COLLAPSE_THRESHOLD)
+            .map((name) => ({
+            name,
+            direct: true,
+        }));
+        areas.push({
+            problemLabel: phraseForFamily("blast_radius"),
+            problemDescription: "Many packages changed in this upgrade.",
+            packages,
+            overflowCount: Math.max(0, changed.length - ACT3_EVIDENCE_COLLAPSE_THRESHOLD),
+        });
+    }
+    return areas;
+}
+function findingToRow(f, source) {
+    return {
+        id: f.id,
+        severity: f.severity,
+        title: f.title,
+        description: f.description,
+        packageName: f.packageName,
+        recommendation: f.recommendation,
+        source,
+    };
+}
+function sortFindings(findings) {
+    return [...findings].sort((a, b) => {
+        const sd = SEVERITY_ORDER[b.severity] - SEVERITY_ORDER[a.severity];
+        if (sd !== 0)
+            return sd;
+        return a.packageName.localeCompare(b.packageName);
+    });
+}
+function buildFindingRows(result) {
+    const rows = [];
+    for (const f of Array.isArray(result.findings) ? result.findings : []) {
+        rows.push(findingToRow(f, "dependency"));
+    }
+    return sortFindings(rows);
+}
+function buildTopology(result) {
+    const gi = result.graphInsights;
+    if (!gi)
+        return null;
+    const nodes = typeof gi.nodes === "number" ? gi.nodes : 0;
+    const edges = typeof gi.edges === "number" ? gi.edges : 0;
+    const maxDepth = typeof gi.maxDepth === "number" ? gi.maxDepth : 0;
+    if (nodes === 0 && edges === 0 && maxDepth === 0)
+        return null;
+    const deepest = Array.isArray(gi.deepest)
+        ? gi.deepest.slice(0, 5).map((d) => ({
+            packageName: d.packageName,
+            depth: d.depth,
+            direct: d.direct,
+            via: Array.isArray(d.via) ? d.via : [],
+        }))
+        : [];
+    return {
+        summaryLine: `${nodes} packages · ${edges} edges · max depth ${maxDepth}`,
+        deepest,
+    };
+}
+function annotateFindingsWithCoverage(rows, center) {
+    const rankByFindingId = new Map();
+    for (const item of center.items) {
+        for (const findingId of item.proofRefs?.findingIds ?? []) {
+            if (!rankByFindingId.has(findingId)) {
+                rankByFindingId.set(findingId, item.rank);
+            }
+        }
+    }
+    return rows.map((row) => {
+        const rank = rankByFindingId.get(row.id);
+        if (!rank)
+            return row;
+        return {
+            ...row,
+            recommendation: undefined,
+            coveredByRecommendationRank: rank,
+        };
+    });
+}
+function deriveConfidenceCaveat(result) {
+    const confidence = result.decision?.confidence;
+    if (confidence === "medium") {
+        return scanSurfaceCopy.scanDetail.confidenceCaveat.medium;
+    }
+    if (confidence === "low") {
+        return scanSurfaceCopy.scanDetail.confidenceCaveat.low;
+    }
+    return undefined;
+}
+function changedPackagesSummary(changed) {
+    if (!changed?.length)
+        return undefined;
+    if (changed.length === 1)
+        return changed[0];
+    return `${changed[0]} +${changed.length - 1} changed`;
+}
+export function deriveScanDetailViewModel(result, options) {
+    if (!result || options.status !== "done")
+        return null;
+    const posture = mergePostureFromDecision(result.decision?.recommendation);
+    const scopeChip = deriveDetailReachChip(result.totalScore);
+    const verdictLine = truncateWithEllipsis(deriveVerdictLine(posture, result.totalScore), VERDICT_LINE_MAX_CHARS);
+    const recommendedActions = deriveScanDetailRecommendations(result);
+    const signalSummary = deriveSignalSummary(result);
+    const verifyLabels = recommendationTitlesForDedupe(recommendedActions);
+    const operationalImpact = deriveOperationalImpact(result, verifyLabels);
+    const themes = deriveAct2Themes(result);
+    const confidenceCaveat = deriveConfidenceCaveat(result);
+    const because = themes.length > 0 || confidenceCaveat
+        ? {
+            themes,
+            confidenceCaveat,
+        }
+        : null;
+    const attentionAreas = buildAttentionAreas(result);
+    const allFindings = annotateFindingsWithCoverage(buildFindingRows(result), recommendedActions);
+    const findings = allFindings;
+    const topology = buildTopology(result);
+    const hasEvidence = attentionAreas.length > 0 || allFindings.length > 0 || topology !== null;
+    const evidence = hasEvidence
+        ? {
+            attentionAreas,
+            findings,
+            findingsOverflowCount: Math.max(0, allFindings.length - ACT3_EVIDENCE_COLLAPSE_THRESHOLD),
+            topology,
+        }
+        : null;
+    return {
+        verdict: {
+            posture,
+            scopeChip,
+            verdictLine,
+            prLabel: options.prNumber != null ? `#${options.prNumber}` : undefined,
+        },
+        signalSummary,
+        followUpBridgeNote: deriveFollowUpBridgeNote(recommendedActions.items.length),
+        recommendedActions,
+        operationalImpact,
+        because,
+        evidence,
+        repoContext: options.repoContext ?? { status: "hidden" },
+        metadata: {
+            scanId: options.scanId,
+            generatedAt: result.generatedAt,
+            methodologyVersion: options.methodologyVersion,
+            changedPackagesSummary: changedPackagesSummary(result.changedPackages),
+            codeAnalysisTimedOut: result.codeAnalysisMetrics?.timedOut === true,
+        },
+    };
+}
+/** Tier 1 recall test helper — true when message describes application-level impact. */
+export function tier1PassesRecallTest(operationalImpact) {
+    if (operationalImpact.status === "rich") {
+        return operationalImpact.items.some((item) => item.message.trim().length > 10);
+    }
+    if (operationalImpact.status === "fallback" &&
+        operationalImpact.fallbackMessage) {
+        return (operationalImpact.fallbackMessage.includes("Dependency") ||
+            operationalImpact.fallbackMessage.includes("runtime") ||
+            operationalImpact.fallbackMessage.includes("application"));
+    }
+    return false;
+}

package/dist/scanDetailViewModel.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scanDetailViewModel.test.d.ts.map

package/dist/scanDetailViewModel.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanDetailViewModel.test.d.ts","sourceRoot":"","sources":["../src/scanDetailViewModel.test.ts"],"names":[],"mappings":""}