@mergesignal/shared 0.2.3 → 0.2.5

package/dist/scanSurfaceCopy.d.ts

@@ -75,6 +75,193 @@ export declare const scanSurfaceCopy: {
         /** Single line for UI/CLI/Actions parity (risk index semantics). */
         readonly riskIndexDirectionShort: "0 is best · 100 is worst";
     };
+    /** Scan detail page (`/scan/[id]`) — show-don't-teach reviewer copy. */
+    readonly scanDetail: {
+        readonly recommendedActionsHeading: "Recommended actions";
+        readonly signalSummaryHeading: "Signal summary";
+        /** @deprecated Use signalSummaryHeading */
+        readonly riskSummaryHeading: "Signal summary";
+        readonly operationalImpactHeading: "What this upgrade may affect";
+        readonly whyVerdictHeading: "Why this verdict";
+        readonly proofHeading: "Proof";
+        readonly nextStepsHeading: "Recommended next steps";
+        readonly topologySummary: "Dependency topology";
+        readonly topologyCollapsedHint: "Supporting detail — graph paths and depth";
+        readonly whereLabel: "Where";
+        readonly verifyLabel: "Verify";
+        readonly moreImpactsSummary: "More impacts";
+        readonly moreRecommendationsSummary: "More recommendations";
+        readonly moreFindingsSummary: "More findings";
+        readonly reachChip: {
+            readonly focused: "Focused reach";
+            readonly limited: "Limited reach";
+            readonly moderate: "Moderate reach";
+            readonly wide: "Wide reach";
+        };
+        readonly verdictLine: {
+            readonly safeNoBlockersNarrow: "No merge blockers · narrow footprint";
+            readonly safeNoBlockersModerate: "No merge blockers · moderate dependency footprint";
+            readonly safeNoBlockersWide: "No merge blockers · wide upgrade footprint";
+            readonly reviewBeforeMergeNarrow: "Review before merge · narrow footprint";
+            readonly reviewBeforeMergeModerate: "Review before merge · moderate dependency footprint";
+            readonly reviewBeforeMergeWide: "Review before merge · wide dependency footprint";
+            readonly riskyResolveNarrow: "Resolve blockers before merge · focused footprint";
+            readonly riskyResolveModerate: "Resolve blockers before merge · moderate dependency footprint";
+            readonly riskyResolveWide: "Resolve blockers before merge · wide transitive tree";
+        };
+        readonly tier1Fallback: {
+            /** Graph-only / lightweight PR baseline (pattern F3). */
+            readonly lightweightPr: "This PR has limited code-change signal. MergeSignal reviewed dependency structure; no runtime-impact indicators detected.";
+            /** Actionable structural redirect (pattern F4). */
+            readonly structuralProofBelow: "No runtime-impact indicators detected. Dependency risks, if any, are listed in proof below.";
+            /** Quiet safe (pattern Q). */
+            readonly quietSafe: "No application-level impact identified.";
+            /** Structural assessment completed (pattern F1). */
+            readonly structuralComplete: "Dependency structure assessed. No application-specific behavior changes identified for this PR.";
+        };
+        readonly confidenceCaveat: {
+            readonly medium: "Based on partial dependency signal";
+            readonly low: "Limited signal — treat this as directional";
+        };
+        readonly codeAnalysisTimeout: "Code analysis timed out — runtime impact may be incomplete";
+        readonly scanPipelineNote: "This page updates automatically.";
+        readonly recommendationDetail: {
+            readonly selectPrompt: "Select a recommendation to understand it";
+            readonly whyLabel: "Why";
+            readonly whyNowLabel: "Why now";
+            readonly signalsLabel: "Signals behind this recommendation";
+            readonly affectedPackagesLabel: "Affected packages";
+            readonly expectedBenefitLabel: "Expected benefit";
+            readonly defaultWhy: "This recommendation addresses a structural dependency pattern detected in this scan.";
+            readonly defaultWhyNow: "This scan surfaced dependency patterns worth addressing before or after merge.";
+            readonly defaultBenefit: "Reduced merge risk and easier dependency management.";
+            readonly insightBenefit: "Restores predictable runtime behavior and prevents regressions after merge.";
+            readonly securityFindingBenefit: "Reduced vulnerability exposure before code reaches production.";
+            readonly coveredByRecommendation: "Covered in recommended action";
+        };
+        readonly recommendationScanContext: {
+            readonly quietSafe: "MergeSignal reviewed this upgrade. No merge blockers or runtime-impact indicators detected.";
+            readonly needsReview: "MergeSignal reviewed dependency structure for this upgrade. Review the items below before merging.";
+            readonly risky: "MergeSignal detected blockers in this upgrade. Resolve the priorities below before merging.";
+            readonly lightweightGraph: "This PR has limited code-change signal. MergeSignal reviewed dependency structure for structural risks.";
+        };
+        readonly recommendationPriority: {
+            readonly high: "High Priority";
+            readonly medium: "Medium Priority";
+            readonly low: "Low Priority";
+        };
+        /** @deprecated Use recommendationPriority */
+        readonly guidanceUrgency: {
+            readonly beforeMerge: "High Priority";
+            readonly recommended: "Medium Priority";
+            readonly monitor: "Low Priority";
+        };
+        readonly guidancePlaybook: {
+            readonly mergeNormally: "Merge normally";
+            readonly scheduleCleanup: "Schedule routine dependency cleanup";
+            readonly continueMonitoring: "Continue monitoring dependency health";
+            readonly mergeAfterVerification: "Merge after verifying affected paths";
+            readonly reviewBeforeMerge: "Review dependency risks before merging";
+            readonly reviewDependencyStructure: "Review dependency structure before merging";
+            readonly reviewAffectedPaths: "Review affected dependency paths";
+            readonly monitorTransitiveChanges: "Monitor transitive changes after merge";
+            readonly riskyResolveBeforeMerge: "Resolve blockers before merging";
+            readonly riskyReviewVulnerable: "Review vulnerable transitive packages";
+            readonly riskyRerunAfterFixes: "Re-run scan after fixes";
+            readonly resolveCriticalBeforeMerge: "Resolve critical findings before merge";
+        };
+        readonly recommendationPlaybookDetail: {
+            readonly mergeNormally: {
+                readonly why: "Dependency structure looks stable for this upgrade scope.";
+                readonly whyNow: "No merge blockers or runtime-impact indicators were detected for this PR.";
+                readonly expectedBenefit: "Low-friction merge with minimal follow-up work.";
+                readonly signals: readonly ["No merge blockers detected", "Dependency structure reviewed"];
+            };
+            readonly scheduleCleanup: {
+                readonly why: "Even quiet upgrades accumulate semver drift over time.";
+                readonly whyNow: "Proactive cleanup keeps future upgrades cheaper as the tree evolves.";
+                readonly expectedBenefit: "Easier dependency management on the next upgrade cycle.";
+                readonly signals: readonly ["Routine maintenance opportunity"];
+            };
+            readonly continueMonitoring: {
+                readonly why: "Dependency health is stable now but benefits from ongoing observation.";
+                readonly whyNow: "Monitoring catches regressions that appear only after merge.";
+                readonly expectedBenefit: "Earlier detection of dependency regressions in production.";
+                readonly signals: readonly ["No immediate blockers — monitor after merge"];
+            };
+            readonly mergeAfterVerification: {
+                readonly why: "Wide upgrade footprints warrant a quick sanity check before merge.";
+                readonly whyNow: "This upgrade touches enough packages to validate affected paths once.";
+                readonly expectedBenefit: "More predictable merges with fewer surprise runtime interactions.";
+                readonly signals: readonly ["Wide upgrade footprint detected"];
+            };
+            readonly reviewBeforeMerge: {
+                readonly why: "Structural dependency signals warrant a focused review before merge.";
+                readonly whyNow: "This scan surfaced dependency risks that deserve a pre-merge pass.";
+                readonly expectedBenefit: "Lower chance of shipping hidden dependency regressions.";
+                readonly signals: readonly ["Elevated dependency review recommended"];
+            };
+            readonly reviewDependencyStructure: {
+                readonly why: "Limited code-change signal means dependency structure carries most of the review burden.";
+                readonly whyNow: "MergeSignal reviewed the lockfile graph because PR code signal was lightweight.";
+                readonly expectedBenefit: "Confidence that structural changes are understood before merge.";
+                readonly signals: readonly ["Graph-based structural review completed"];
+            };
+            readonly reviewAffectedPaths: {
+                readonly why: "Transitive paths can hide behavior changes behind a small direct diff.";
+                readonly whyNow: "Affected dependency paths in this scan exceed a narrow footprint.";
+                readonly expectedBenefit: "Clearer understanding of what this upgrade actually touches.";
+                readonly signals: readonly ["Multiple affected dependency paths"];
+            };
+            readonly monitorTransitiveChanges: {
+                readonly why: "Transitive changes can surface only after merge in integrated environments.";
+                readonly whyNow: "This upgrade shifts transitive dependencies that are worth watching post-merge.";
+                readonly expectedBenefit: "Earlier detection if transitive changes cause regressions.";
+                readonly signals: readonly ["Transitive dependency shift detected"];
+            };
+            readonly riskyResolveBeforeMerge: {
+                readonly why: "Blockers must be resolved before this upgrade is safe to merge.";
+                readonly whyNow: "This scan flagged issues that exceed acceptable merge risk.";
+                readonly expectedBenefit: "Safer merge with blockers addressed before release.";
+                readonly signals: readonly ["Merge blockers detected"];
+            };
+            readonly riskyReviewVulnerable: {
+                readonly why: "Known vulnerabilities in the dependency tree can reach production through this upgrade.";
+                readonly whyNow: "Vulnerable packages are reachable from packages changed in this PR.";
+                readonly expectedBenefit: "Reduced vulnerability exposure before code reaches production.";
+                readonly signals: readonly ["Vulnerable transitive packages detected"];
+            };
+            readonly riskyRerunAfterFixes: {
+                readonly why: "Fixes can change the dependency graph and scan conclusions.";
+                readonly whyNow: "Re-run after addressing blockers to confirm the upgrade is safe.";
+                readonly expectedBenefit: "Verified merge posture after remediation.";
+                readonly signals: readonly ["Re-scan recommended after fixes"];
+            };
+            readonly resolveCriticalBeforeMerge: {
+                readonly why: "Critical or high-severity findings block a safe merge posture.";
+                readonly whyNow: "This scan flagged findings that must be addressed before merge.";
+                readonly expectedBenefit: "Safer merge with critical issues resolved first.";
+                readonly signals: readonly ["High-severity findings detected"];
+            };
+        };
+        readonly signalSummary: {
+            readonly scoreCaption: "Dependency signal score";
+            readonly layersHeading: "Layer signals";
+            readonly gaugeAriaLabel: "Dependency signal score {score} — {band}";
+            readonly followUpImprovementIdentified: "1 follow-up improvement was identified";
+            readonly followUpImprovementsIdentified: "{count} follow-up improvements were identified";
+            readonly bandLabel: {
+                readonly low: "Low";
+                readonly moderate: "Moderate";
+                readonly high: "Elevated";
+            };
+            readonly signalLabel: {
+                readonly low: "Low";
+                readonly medium: "Moderate";
+                readonly high: "Elevated";
+            };
+        };
+    };
     readonly cli: {
         readonly stderrAnalysisIncomplete: "Analysis could not be completed.";
         readonly stderrOutputNotVerified: "These results could not be verified.";

package/dist/scanSurfaceCopy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanSurfaceCopy.d.ts","sourceRoot":"","sources":["../src/scanSurfaceCopy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;QAgBxB,8EAA8E;;QAG9E,6DAA6D;;;;QAO7D,qDAAqD;;;;;QASrD,mEAAmE;;;;QAOnE,yFAAyF;;QAGzF,mFAAmF;;QAGnF,0EAA0E;;QAE1E,8FAA8F;;QAE9F,+DAA+D;;;QAI/D,6EAA6E;;;;;QAK7E,2CAA2C;;;QAK3C,2EAA2E;;QAE3E,4EAA4E;;;QAI5E,sEAAsE;;;IAGxE,2EAA2E;;;;;;;;;;;;;;QAiBzE,oEAAoE;;;;;;;IAOtE,sEAAsE;;;;;CAO9D,CAAC;AAEX,iEAAiE;AACjE,wBAAgB,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa5D"}
+{"version":3,"file":"scanSurfaceCopy.d.ts","sourceRoot":"","sources":["../src/scanSurfaceCopy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;QAgBxB,8EAA8E;;QAG9E,6DAA6D;;;;QAO7D,qDAAqD;;;;;QASrD,mEAAmE;;;;QAOnE,yFAAyF;;QAGzF,mFAAmF;;QAGnF,0EAA0E;;QAE1E,8FAA8F;;QAE9F,+DAA+D;;;QAI/D,6EAA6E;;;;;QAK7E,2CAA2C;;;QAK3C,2EAA2E;;QAE3E,4EAA4E;;;QAI5E,sEAAsE;;;IAGxE,2EAA2E;;;;;;;;;;;;;;QAiBzE,oEAAoE;;;IAGtE,wEAAwE;;;;QAItE,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAkCzC,yDAAyD;;YAGzD,mDAAmD;;YAGnD,8BAA8B;;YAE9B,oDAAoD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4CtD,6CAA6C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0I/C,sEAAsE;;;;;CAO9D,CAAC;AAEX,iEAAiE;AACjE,wBAAgB,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa5D"}

package/dist/scanSurfaceCopy.js

@@ -75,6 +75,196 @@ export const scanSurfaceCopy = {
         /** Single line for UI/CLI/Actions parity (risk index semantics). */
         riskIndexDirectionShort: "0 is best · 100 is worst",
     },
+    /** Scan detail page (`/scan/[id]`) — show-don't-teach reviewer copy. */
+    scanDetail: {
+        recommendedActionsHeading: "Recommended actions",
+        signalSummaryHeading: "Signal summary",
+        /** @deprecated Use signalSummaryHeading */
+        riskSummaryHeading: "Signal summary",
+        operationalImpactHeading: "What this upgrade may affect",
+        whyVerdictHeading: "Why this verdict",
+        proofHeading: "Proof",
+        nextStepsHeading: "Recommended next steps",
+        topologySummary: "Dependency topology",
+        topologyCollapsedHint: "Supporting detail — graph paths and depth",
+        whereLabel: "Where",
+        verifyLabel: "Verify",
+        moreImpactsSummary: "More impacts",
+        moreRecommendationsSummary: "More recommendations",
+        moreFindingsSummary: "More findings",
+        reachChip: {
+            focused: "Focused reach",
+            limited: "Limited reach",
+            moderate: "Moderate reach",
+            wide: "Wide reach",
+        },
+        verdictLine: {
+            safeNoBlockersNarrow: "No merge blockers · narrow footprint",
+            safeNoBlockersModerate: "No merge blockers · moderate dependency footprint",
+            safeNoBlockersWide: "No merge blockers · wide upgrade footprint",
+            reviewBeforeMergeNarrow: "Review before merge · narrow footprint",
+            reviewBeforeMergeModerate: "Review before merge · moderate dependency footprint",
+            reviewBeforeMergeWide: "Review before merge · wide dependency footprint",
+            riskyResolveNarrow: "Resolve blockers before merge · focused footprint",
+            riskyResolveModerate: "Resolve blockers before merge · moderate dependency footprint",
+            riskyResolveWide: "Resolve blockers before merge · wide transitive tree",
+        },
+        tier1Fallback: {
+            /** Graph-only / lightweight PR baseline (pattern F3). */
+            lightweightPr: "This PR has limited code-change signal. MergeSignal reviewed dependency structure; no runtime-impact indicators detected.",
+            /** Actionable structural redirect (pattern F4). */
+            structuralProofBelow: "No runtime-impact indicators detected. Dependency risks, if any, are listed in proof below.",
+            /** Quiet safe (pattern Q). */
+            quietSafe: "No application-level impact identified.",
+            /** Structural assessment completed (pattern F1). */
+            structuralComplete: "Dependency structure assessed. No application-specific behavior changes identified for this PR.",
+        },
+        confidenceCaveat: {
+            medium: "Based on partial dependency signal",
+            low: "Limited signal — treat this as directional",
+        },
+        codeAnalysisTimeout: "Code analysis timed out — runtime impact may be incomplete",
+        scanPipelineNote: "This page updates automatically.",
+        recommendationDetail: {
+            selectPrompt: "Select a recommendation to understand it",
+            whyLabel: "Why",
+            whyNowLabel: "Why now",
+            signalsLabel: "Signals behind this recommendation",
+            affectedPackagesLabel: "Affected packages",
+            expectedBenefitLabel: "Expected benefit",
+            defaultWhy: "This recommendation addresses a structural dependency pattern detected in this scan.",
+            defaultWhyNow: "This scan surfaced dependency patterns worth addressing before or after merge.",
+            defaultBenefit: "Reduced merge risk and easier dependency management.",
+            insightBenefit: "Restores predictable runtime behavior and prevents regressions after merge.",
+            securityFindingBenefit: "Reduced vulnerability exposure before code reaches production.",
+            coveredByRecommendation: "Covered in recommended action",
+        },
+        recommendationScanContext: {
+            quietSafe: "MergeSignal reviewed this upgrade. No merge blockers or runtime-impact indicators detected.",
+            needsReview: "MergeSignal reviewed dependency structure for this upgrade. Review the items below before merging.",
+            risky: "MergeSignal detected blockers in this upgrade. Resolve the priorities below before merging.",
+            lightweightGraph: "This PR has limited code-change signal. MergeSignal reviewed dependency structure for structural risks.",
+        },
+        recommendationPriority: {
+            high: "High Priority",
+            medium: "Medium Priority",
+            low: "Low Priority",
+        },
+        /** @deprecated Use recommendationPriority */
+        guidanceUrgency: {
+            beforeMerge: "High Priority",
+            recommended: "Medium Priority",
+            monitor: "Low Priority",
+        },
+        guidancePlaybook: {
+            mergeNormally: "Merge normally",
+            scheduleCleanup: "Schedule routine dependency cleanup",
+            continueMonitoring: "Continue monitoring dependency health",
+            mergeAfterVerification: "Merge after verifying affected paths",
+            reviewBeforeMerge: "Review dependency risks before merging",
+            reviewDependencyStructure: "Review dependency structure before merging",
+            reviewAffectedPaths: "Review affected dependency paths",
+            monitorTransitiveChanges: "Monitor transitive changes after merge",
+            riskyResolveBeforeMerge: "Resolve blockers before merging",
+            riskyReviewVulnerable: "Review vulnerable transitive packages",
+            riskyRerunAfterFixes: "Re-run scan after fixes",
+            resolveCriticalBeforeMerge: "Resolve critical findings before merge",
+        },
+        recommendationPlaybookDetail: {
+            mergeNormally: {
+                why: "Dependency structure looks stable for this upgrade scope.",
+                whyNow: "No merge blockers or runtime-impact indicators were detected for this PR.",
+                expectedBenefit: "Low-friction merge with minimal follow-up work.",
+                signals: [
+                    "No merge blockers detected",
+                    "Dependency structure reviewed",
+                ],
+            },
+            scheduleCleanup: {
+                why: "Even quiet upgrades accumulate semver drift over time.",
+                whyNow: "Proactive cleanup keeps future upgrades cheaper as the tree evolves.",
+                expectedBenefit: "Easier dependency management on the next upgrade cycle.",
+                signals: ["Routine maintenance opportunity"],
+            },
+            continueMonitoring: {
+                why: "Dependency health is stable now but benefits from ongoing observation.",
+                whyNow: "Monitoring catches regressions that appear only after merge.",
+                expectedBenefit: "Earlier detection of dependency regressions in production.",
+                signals: ["No immediate blockers — monitor after merge"],
+            },
+            mergeAfterVerification: {
+                why: "Wide upgrade footprints warrant a quick sanity check before merge.",
+                whyNow: "This upgrade touches enough packages to validate affected paths once.",
+                expectedBenefit: "More predictable merges with fewer surprise runtime interactions.",
+                signals: ["Wide upgrade footprint detected"],
+            },
+            reviewBeforeMerge: {
+                why: "Structural dependency signals warrant a focused review before merge.",
+                whyNow: "This scan surfaced dependency risks that deserve a pre-merge pass.",
+                expectedBenefit: "Lower chance of shipping hidden dependency regressions.",
+                signals: ["Elevated dependency review recommended"],
+            },
+            reviewDependencyStructure: {
+                why: "Limited code-change signal means dependency structure carries most of the review burden.",
+                whyNow: "MergeSignal reviewed the lockfile graph because PR code signal was lightweight.",
+                expectedBenefit: "Confidence that structural changes are understood before merge.",
+                signals: ["Graph-based structural review completed"],
+            },
+            reviewAffectedPaths: {
+                why: "Transitive paths can hide behavior changes behind a small direct diff.",
+                whyNow: "Affected dependency paths in this scan exceed a narrow footprint.",
+                expectedBenefit: "Clearer understanding of what this upgrade actually touches.",
+                signals: ["Multiple affected dependency paths"],
+            },
+            monitorTransitiveChanges: {
+                why: "Transitive changes can surface only after merge in integrated environments.",
+                whyNow: "This upgrade shifts transitive dependencies that are worth watching post-merge.",
+                expectedBenefit: "Earlier detection if transitive changes cause regressions.",
+                signals: ["Transitive dependency shift detected"],
+            },
+            riskyResolveBeforeMerge: {
+                why: "Blockers must be resolved before this upgrade is safe to merge.",
+                whyNow: "This scan flagged issues that exceed acceptable merge risk.",
+                expectedBenefit: "Safer merge with blockers addressed before release.",
+                signals: ["Merge blockers detected"],
+            },
+            riskyReviewVulnerable: {
+                why: "Known vulnerabilities in the dependency tree can reach production through this upgrade.",
+                whyNow: "Vulnerable packages are reachable from packages changed in this PR.",
+                expectedBenefit: "Reduced vulnerability exposure before code reaches production.",
+                signals: ["Vulnerable transitive packages detected"],
+            },
+            riskyRerunAfterFixes: {
+                why: "Fixes can change the dependency graph and scan conclusions.",
+                whyNow: "Re-run after addressing blockers to confirm the upgrade is safe.",
+                expectedBenefit: "Verified merge posture after remediation.",
+                signals: ["Re-scan recommended after fixes"],
+            },
+            resolveCriticalBeforeMerge: {
+                why: "Critical or high-severity findings block a safe merge posture.",
+                whyNow: "This scan flagged findings that must be addressed before merge.",
+                expectedBenefit: "Safer merge with critical issues resolved first.",
+                signals: ["High-severity findings detected"],
+            },
+        },
+        signalSummary: {
+            scoreCaption: "Dependency signal score",
+            layersHeading: "Layer signals",
+            gaugeAriaLabel: "Dependency signal score {score} — {band}",
+            followUpImprovementIdentified: "1 follow-up improvement was identified",
+            followUpImprovementsIdentified: "{count} follow-up improvements were identified",
+            bandLabel: {
+                low: "Low",
+                moderate: "Moderate",
+                high: "Elevated",
+            },
+            signalLabel: {
+                low: "Low",
+                medium: "Moderate",
+                high: "Elevated",
+            },
+        },
+    },
     cli: {
         stderrAnalysisIncomplete: "Analysis could not be completed.",
         stderrOutputNotVerified: "These results could not be verified.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mergesignal/shared",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "MergeSignal shared scan contract, presentation policy, and trusted validation",
   "type": "module",
   "main": "./dist/index.js",