@mergesignal/shared 0.4.3 → 0.5.0

package/dist/deriveScanDetailRecommendations.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=deriveScanDetailRecommendations.test.d.ts.map

package/dist/deriveScanDetailRecommendations.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deriveScanDetailRecommendations.test.d.ts","sourceRoot":"","sources":["../src/deriveScanDetailRecommendations.test.ts"],"names":[],"mappings":""}

package/dist/deriveScanDetailRecommendations.test.js

@@ -1,181 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { primaryPrExample } from "./productMessaging.js";
-import { deriveScanDetailRecommendations, RECOMMENDATION_MAX_ITEMS, } from "./deriveScanDetailRecommendations.js";
-import { deriveScanDetailViewModel } from "./scanDetailViewModel.js";
-const baseResult = {
-    totalScore: 10,
-    layerScores: {
-        security: 1,
-        maintainability: 2,
-        ecosystem: 3,
-        upgradeImpact: 4,
-    },
-    findings: [],
-    generatedAt: "2026-01-01T00:00:00.000Z",
-};
-function minimalResult(overrides = {}) {
-    return {
-        totalScore: 42,
-        layerScores: {
-            security: 10,
-            maintainability: 20,
-            ecosystem: 30,
-            upgradeImpact: 15,
-        },
-        findings: [],
-        generatedAt: new Date().toISOString(),
-        decision: {
-            recommendation: "needs_review",
-            confidence: "medium",
-            reasoning: ["Lockfile adds transitive depth on shared utilities."],
-        },
-        ...overrides,
-    };
-}
-describe("deriveScanDetailRecommendations", () => {
-    it("always returns 1–3 enriched items with detail fields", () => {
-        const archetypes = [
-            {
-                ...baseResult,
-                decision: { recommendation: "safe", confidence: "high", reasoning: [] },
-            },
-            minimalResult(),
-            {
-                ...minimalResult(),
-                decision: {
-                    recommendation: "risky",
-                    confidence: "high",
-                    reasoning: [],
-                },
-                findings: [
-                    {
-                        id: "f1",
-                        severity: "critical",
-                        title: "Critical vulnerability",
-                        description: "Transitive CVE",
-                        packageName: "lodash",
-                        recommendation: "Upgrade lodash",
-                    },
-                ],
-            },
-        ];
-        for (const result of archetypes) {
-            const center = deriveScanDetailRecommendations(result);
-            expect(center.items.length).toBeGreaterThanOrEqual(1);
-            expect(center.items.length).toBeLessThanOrEqual(RECOMMENDATION_MAX_ITEMS);
-            expect(center.defaultSelectedId).toBe(center.items[0]?.id);
-            for (const item of center.items) {
-                expect(item.detail.why.length).toBeGreaterThan(0);
-                expect(item.detail.whyNow.length).toBeGreaterThan(0);
-                expect(item.detail.expectedBenefit.length).toBeGreaterThan(0);
-                expect(item.detail.why).not.toMatch(/CVE-\d|@\d|\d+\.\d+\.\d+/);
-            }
-        }
-    });
-    it("quiet safe scan uses posture playbook with scan context", () => {
-        const center = deriveScanDetailRecommendations({
-            ...baseResult,
-            decision: { recommendation: "safe", confidence: "high", reasoning: [] },
-        });
-        expect(center.posture).toBe("safe");
-        expect(center.scanContext).toBeTruthy();
-        expect(center.items[0]?.priority).toBe("low");
-        expect(center.items[0]?.title).toBe("Merge normally");
-    });
-    it("duplicate recommendation includes whyNow and signals with packages", () => {
-        const center = deriveScanDetailRecommendations({
-            ...minimalResult(),
-            recommendations: [
-                {
-                    id: "r1",
-                    title: "Reduce duplicate dependency versions",
-                    rationale: "semver overlap",
-                    impact: "high",
-                    packages: ["semver", "string-width", "@opentelemetry/api-logs"],
-                },
-            ],
-        });
-        const dup = center.items.find((i) => i.title.toLowerCase().includes("duplicate"));
-        expect(dup?.detail.whyNow.toLowerCase()).toContain("semver");
-        expect(dup?.detail.signals.length).toBeGreaterThan(0);
-        expect(dup?.detail.affectedPackages?.names).toContain("semver");
-    });
-    it("insight-rich scan has high priority and scan-specific whyNow", () => {
-        const center = deriveScanDetailRecommendations({
-            ...minimalResult(),
-            insights: [
-                {
-                    type: "behavioral_change",
-                    priority: "high",
-                    confidence: "confirmed",
-                    scope: "changed",
-                    message: primaryPrExample.message,
-                    context: primaryPrExample.where[0],
-                    remediation: "Confirm auth guards still run before protected handlers",
-                    affectedFiles: [...primaryPrExample.where],
-                },
-            ],
-        });
-        expect(center.items[0]?.source).toBe("insight");
-        expect(center.items[0]?.priority).toBe("high");
-        expect(center.items[0]?.detail.whyNow).toContain("middleware");
-    });
-    it("risky scan with critical findings leads with resolve guidance", () => {
-        const center = deriveScanDetailRecommendations({
-            ...minimalResult(),
-            decision: { recommendation: "risky", confidence: "high", reasoning: [] },
-            findings: [
-                {
-                    id: "f1",
-                    severity: "critical",
-                    title: "Critical vulnerability",
-                    description: "Transitive CVE",
-                    packageName: "lodash",
-                    recommendation: "Upgrade lodash",
-                },
-            ],
-        });
-        expect(center.items[0]?.title).toContain("Resolve critical findings");
-        expect(center.items[0]?.priority).toBe("high");
-        expect(center.items[0]?.proofRefs?.findingIds).toContain("f1");
-    });
-});
-describe("recommendedActions on scan detail view model", () => {
-    it("includes recommendedActions slice on done scans", () => {
-        const vm = deriveScanDetailViewModel(minimalResult(), {
-            scanId: "s1",
-            status: "done",
-        });
-        expect(vm?.recommendedActions.items.length).toBeGreaterThanOrEqual(1);
-    });
-    it("strips duplicate finding recommendations covered by recommended actions", () => {
-        const vm = deriveScanDetailViewModel({
-            ...minimalResult(),
-            decision: {
-                recommendation: "risky",
-                confidence: "high",
-                reasoning: [],
-            },
-            findings: [
-                {
-                    id: "f1",
-                    severity: "critical",
-                    title: "Critical vulnerability",
-                    description: "Transitive CVE",
-                    packageName: "lodash",
-                    recommendation: "Upgrade lodash",
-                },
-            ],
-        }, { scanId: "dedupe", status: "done" });
-        const finding = vm?.evidence?.findings.find((f) => f.id === "f1");
-        expect(finding?.recommendation).toBeUndefined();
-        expect(finding?.coveredByRecommendationRank).toBeGreaterThan(0);
-    });
-    it("does not expose Act 4 next steps", () => {
-        const vm = deriveScanDetailViewModel(minimalResult(), {
-            scanId: "s1",
-            status: "done",
-        });
-        expect(vm).not.toHaveProperty("next");
-    });
-});

package/dist/deriveScanSummaryText.d.ts

@@ -1,7 +0,0 @@
-import type { ScanResult } from "./types.js";
-/**
- * One-line summary for PR scan list cards (server or client).
- * Prefers decision reasoning, then finding severity counts.
- */
-export declare function deriveScanSummaryText(result: ScanResult | null | undefined): string | null;
-//# sourceMappingURL=deriveScanSummaryText.d.ts.map

package/dist/deriveScanSummaryText.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deriveScanSummaryText.d.ts","sourceRoot":"","sources":["../src/deriveScanSummaryText.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACpC,MAAM,GAAG,IAAI,CAqBf"}

package/dist/deriveScanSummaryText.js

@@ -1,24 +0,0 @@
-/**
- * One-line summary for PR scan list cards (server or client).
- * Prefers decision reasoning, then finding severity counts.
- */
-export function deriveScanSummaryText(result) {
-    if (!result)
-        return null;
-    const decision = result.decision;
-    const reasoning = decision?.reasoning;
-    if (Array.isArray(reasoning) && reasoning.length > 0) {
-        const first = String(reasoning[0]).trim();
-        return first.length > 120 ? first.slice(0, 119) + "…" : first;
-    }
-    const findings = result.findings;
-    if (Array.isArray(findings) && findings.length > 0) {
-        const high = findings.filter((f) => f.severity === "high").length;
-        const medium = findings.filter((f) => f.severity === "medium").length;
-        if (high > 0)
-            return `${high} high-severity finding${high > 1 ? "s" : ""} detected`;
-        if (medium > 0)
-            return `${medium} medium-severity finding${medium > 1 ? "s" : ""} detected`;
-    }
-    return null;
-}

package/dist/deriveScanSummaryText.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=deriveScanSummaryText.test.d.ts.map

package/dist/deriveScanSummaryText.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deriveScanSummaryText.test.d.ts","sourceRoot":"","sources":["../src/deriveScanSummaryText.test.ts"],"names":[],"mappings":""}

package/dist/deriveScanSummaryText.test.js

@@ -1,77 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { deriveScanSummaryText } from "./deriveScanSummaryText.js";
-describe("deriveScanSummaryText", () => {
-    it("returns null for empty input", () => {
-        expect(deriveScanSummaryText(undefined)).toBeNull();
-        expect(deriveScanSummaryText(null)).toBeNull();
-    });
-    it("uses first decision reasoning", () => {
-        const r = {
-            totalScore: 10,
-            layerScores: {
-                security: 1,
-                maintainability: 2,
-                ecosystem: 3,
-                upgradeImpact: 4,
-            },
-            findings: [],
-            generatedAt: "2026-01-01T00:00:00.000Z",
-            decision: {
-                recommendation: "needs_review",
-                confidence: "medium",
-                reasoning: ["First reason line", "Second"],
-            },
-        };
-        expect(deriveScanSummaryText(r)).toBe("First reason line");
-    });
-    it("truncates long reasoning", () => {
-        const long = "a".repeat(130);
-        const r = {
-            totalScore: 10,
-            layerScores: {
-                security: 1,
-                maintainability: 2,
-                ecosystem: 3,
-                upgradeImpact: 4,
-            },
-            findings: [],
-            generatedAt: "2026-01-01T00:00:00.000Z",
-            decision: {
-                recommendation: "safe",
-                confidence: "high",
-                reasoning: [long],
-            },
-        };
-        expect(deriveScanSummaryText(r).length).toBe(120);
-        expect(deriveScanSummaryText(r).endsWith("…")).toBe(true);
-    });
-    it("falls back to high-severity findings", () => {
-        const r = {
-            totalScore: 80,
-            layerScores: {
-                security: 80,
-                maintainability: 10,
-                ecosystem: 10,
-                upgradeImpact: 10,
-            },
-            findings: [
-                {
-                    id: "1",
-                    title: "x",
-                    description: "d",
-                    severity: "high",
-                    packageName: "p",
-                },
-                {
-                    id: "2",
-                    title: "y",
-                    description: "d",
-                    severity: "high",
-                    packageName: "q",
-                },
-            ],
-            generatedAt: "2026-01-01T00:00:00.000Z",
-        };
-        expect(deriveScanSummaryText(r)).toBe("2 high-severity findings detected");
-    });
-});

package/dist/formatCardEvidenceCounts.d.ts

@@ -1,7 +0,0 @@
-import type { FindingCountSummary } from "./scanCardSummary.js";
-import type { MergePosture } from "./riskVocabulary.js";
-/**
- * One soft evidence phrase for dashboard cards (not scanner-style metrics).
- */
-export declare function formatCardEvidenceCounts(counts: FindingCountSummary | null | undefined, posture: MergePosture | null): string | null;
-//# sourceMappingURL=formatCardEvidenceCounts.d.ts.map

package/dist/formatCardEvidenceCounts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"formatCardEvidenceCounts.d.ts","sourceRoot":"","sources":["../src/formatCardEvidenceCounts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,EAAE,YAAY,GAAG,IAAI,GAC3B,MAAM,GAAG,IAAI,CAaf"}

package/dist/formatCardEvidenceCounts.js

@@ -1,19 +0,0 @@
-/**
- * One soft evidence phrase for dashboard cards (not scanner-style metrics).
- */
-export function formatCardEvidenceCounts(counts, posture) {
-    if (!counts || !posture || posture === "safe")
-        return null;
-    const { critical, high } = counts;
-    if (critical > 0 && posture === "risky") {
-        if (critical === 1)
-            return "1 critical finding";
-        return "Critical findings present";
-    }
-    if (high > 0 && (posture === "risky" || posture === "needs_review")) {
-        if (high === 1)
-            return "1 high-severity finding";
-        return `${high} high-severity findings`;
-    }
-    return null;
-}

package/dist/prCheckRunPresentation.d.ts

@@ -1,68 +0,0 @@
-import type { ScanNarrativeFacts } from "./scanNarrativeFacts.js";
-import type { ScanResult } from "./types.js";
-export declare const CHECK_RUN_MAX_WHY_BULLETS = 3;
-export declare const CHECK_RUN_MAX_ACTION_BULLETS = 3;
-export declare const CHECK_RUN_MAX_REPO_DRIVER_PHRASES = 2;
-export declare const CHECK_RUN_ACTION_BULLET_MAX_CHARS = 220;
-export declare const CHECK_RUN_SOFT_MAX_CHARS = 3800;
-export type PrCheckRunTitleOptions = {
-    baselineOnly?: boolean;
-};
-export type PrCheckRunSummaryContext = {
-    result: ScanResult;
-    scanId: string;
-    webAppOrigin: string;
-    baseline: boolean;
-};
-/** Policy flags — one place per product rule. */
-export type CheckRunPolicy = {
-    baseline: boolean;
-    showBaselineOutcome: boolean;
-    showRepoGraphContext: boolean;
-    showLayerScores: boolean;
-    useDetailsForLayers: boolean;
-    maxWhyBullets: number;
-    maxActionBullets: number;
-    maxRepoDriverPhrases: number;
-};
-export type CheckRunSection = {
-    kind: "lead";
-    posture: string;
-    riskIndexLine: string | null;
-} | {
-    kind: "why";
-    bullets: string[];
-} | {
-    kind: "actions";
-    bullets: string[];
-} | {
-    kind: "baselineOutcome";
-    primary: string;
-    scope?: string;
-} | {
-    kind: "repoContext";
-    score: number;
-    driverPhrases: string[];
-} | {
-    kind: "layerScores";
-    rows: Array<{
-        label: string;
-        score: string;
-        driver: string;
-    }>;
-} | {
-    kind: "footer";
-    url: string;
-    label: string;
-};
-export declare function formatScanDashboardUrl(webAppOrigin: string, scanId: string): string;
-export declare function buildPrCheckRunTitle(opts?: PrCheckRunTitleOptions): string;
-/** Strong drivers for optional repo-context line (full mode only). */
-export declare function hasStrongRepoGraphDrivers(result: ScanResult, facts?: ScanNarrativeFacts): boolean;
-export declare function deriveCheckRunPolicy(result: ScanResult, ctx: Pick<PrCheckRunSummaryContext, "baseline">, facts?: ScanNarrativeFacts): CheckRunPolicy;
-export declare function buildPrCheckRunSections(policy: CheckRunPolicy, result: ScanResult, ctx: PrCheckRunSummaryContext, facts?: ScanNarrativeFacts): CheckRunSection[];
-export declare function renderCheckRunMarkdown(sections: CheckRunSection[]): string;
-export declare function buildPrCheckRunSummaryMarkdown(ctx: PrCheckRunSummaryContext): string;
-/** Whether baseline scan has no actionable PR bullets (for tests / callers). */
-export declare function checkRunHasActionableContent(result: ScanResult): boolean;
-//# sourceMappingURL=prCheckRunPresentation.d.ts.map

package/dist/prCheckRunPresentation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"prCheckRunPresentation.d.ts","sourceRoot":"","sources":["../src/prCheckRunPresentation.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAUlE,OAAO,KAAK,EAIV,UAAU,EAEX,MAAM,YAAY,CAAC;AAGpB,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,iCAAiC,IAAI,CAAC;AACnD,eAAO,MAAM,iCAAiC,MAAM,CAAC;AACrD,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAqB7C,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,iDAAiD;AACjD,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,GACD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAUnD,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,IAAI,GAAE,sBAA2B,GAChC,MAAM,CAMR;AAED,sEAAsE;AACtE,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,UAAU,EAClB,KAAK,CAAC,EAAE,kBAAkB,GACzB,OAAO,CAaT;AA4ID,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,IAAI,CAAC,wBAAwB,EAAE,UAAU,CAAC,EAC/C,KAAK,CAAC,EAAE,kBAAkB,GACzB,cAAc,CA4BhB;AAqBD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,wBAAwB,EAC7B,KAAK,CAAC,EAAE,kBAAkB,GACzB,eAAe,EAAE,CA4DnB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CAkF1E;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,wBAAwB,GAC5B,MAAM,CASR;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAExE"}