@mergesignal/shared 0.9.0 → 0.9.1

package/dist/fixtures/engineAbi4Fixtures.d.ts

@@ -1,4 +1,16 @@
-import type { ScanResult } from "../types.js";
+import type { LayerScores, ScanResult } from "../types.js";
+type Abi4SplitScores = {
+    prRiskScore: number;
+    repositoryHealthScore: number;
+    layerScores?: LayerScores;
+};
+/**
+ * Attach differentiated ABI-4 prRisk + repositoryHealth wire blocks.
+ * `totalScore` mirrors repository health for legacy readers; presentation must
+ * consume `prRisk.score` via `deriveRiskSignals()`.
+ */
+export declare function withAbi4SplitScores<T extends ScanResult>(result: T, scores: Abi4SplitScores): T;
 /** Attach ABI-4 prRisk + repositoryHealth wire blocks for strict engine validation tests. */
 export declare function withAbi4EngineScores<T extends ScanResult>(result: T): T;
+export {};
 //# sourceMappingURL=engineAbi4Fixtures.d.ts.map

package/dist/fixtures/engineAbi4Fixtures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engineAbi4Fixtures.d.ts","sourceRoot":"","sources":["../../src/fixtures/engineAbi4Fixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,6FAA6F;AAC7F,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,UAAU,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAEvE"}
+{"version":3,"file":"engineAbi4Fixtures.d.ts","sourceRoot":"","sources":["../../src/fixtures/engineAbi4Fixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG3D,KAAK,eAAe,GAAG;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,UAAU,EACtD,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,eAAe,GACtB,CAAC,CAeH;AAED,6FAA6F;AAC7F,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,UAAU,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAEvE"}

package/dist/fixtures/engineAbi4Fixtures.js

@@ -1,4 +1,25 @@
 import { normalizeEngineOutputAbi4 } from "../scanResultSchema.js";
+/**
+ * Attach differentiated ABI-4 prRisk + repositoryHealth wire blocks.
+ * `totalScore` mirrors repository health for legacy readers; presentation must
+ * consume `prRisk.score` via `deriveRiskSignals()`.
+ */
+export function withAbi4SplitScores(result, scores) {
+    const layerScores = scores.layerScores ?? result.layerScores;
+    return {
+        ...result,
+        totalScore: scores.repositoryHealthScore,
+        layerScores,
+        prRisk: {
+            score: scores.prRiskScore,
+            layerScores: result.prRisk?.layerScores ?? layerScores,
+        },
+        repositoryHealth: {
+            totalScore: scores.repositoryHealthScore,
+            layerScores,
+        },
+    };
+}
 /** Attach ABI-4 prRisk + repositoryHealth wire blocks for strict engine validation tests. */
 export function withAbi4EngineScores(result) {
     return normalizeEngineOutputAbi4(result);

package/dist/prRiskWiringRegression.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=prRiskWiringRegression.test.d.ts.map

package/dist/prRiskWiringRegression.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prRiskWiringRegression.test.d.ts","sourceRoot":"","sources":["../src/prRiskWiringRegression.test.ts"],"names":[],"mappings":""}

package/dist/prRiskWiringRegression.test.js

@@ -0,0 +1,102 @@
+import { describe, expect, it } from "vitest";
+import { deriveScanNarrative } from "./deriveScanNarrative.js";
+import { resolveRepositoryHealthScore } from "./prRiskWire.js";
+import { buildScanPresentationBundle } from "./presentation/orchestration/buildScanPresentationBundle.js";
+import { presentDashboardCard } from "./presentation/presenters/presentDashboardCard.js";
+import { presentScanDetails } from "./presentation/presenters/presentScanDetails.js";
+import { presentCliScanSummary } from "./presentation/presenters/presentCliScanSummary.js";
+import { presentGitHubCheckRun } from "./presentation/presenters/presentGitHubCheckRun.js";
+import { presentGitHubPrComment } from "./presentation/presenters/presentGitHubPrComment.js";
+import { scanResultFastifyRuntime, scanResultTypescriptPatch, } from "./presentation/fixtures/scanResultFixtures.js";
+import { scanResultPrettier } from "./presentation/fixtures/presentationPersonaFixtures.js";
+const SCAN_ID = "22222222-2222-4222-8222-222222222222";
+const ORIGIN = "https://app.example.com";
+const validationPrShapes = [
+    {
+        id: "PR #27 fastify",
+        result: scanResultFastifyRuntime,
+        expectedPrRisk: 55,
+        expectedRepositoryHealth: 63,
+    },
+    {
+        id: "PR #28 typescript",
+        result: scanResultTypescriptPatch,
+        expectedPrRisk: 30,
+        expectedRepositoryHealth: 63,
+    },
+    {
+        id: "PR #29 prettier",
+        result: scanResultPrettier,
+        expectedPrRisk: 30,
+        expectedRepositoryHealth: 61,
+    },
+];
+function surfacesFor(result) {
+    const bundle = buildScanPresentationBundle({
+        result,
+        pipelineStatus: "done",
+    });
+    return {
+        bundle,
+        card: presentDashboardCard(bundle),
+        details: presentScanDetails(bundle, { scanId: SCAN_ID }),
+        cli: presentCliScanSummary(bundle, { repoLabel: "mergesignal/app" }),
+        check: presentGitHubCheckRun(bundle, {
+            scanId: SCAN_ID,
+            webAppOrigin: ORIGIN,
+        }),
+        comment: presentGitHubPrComment(bundle),
+    };
+}
+describe("PR Risk wiring regression (Investigation 1)", () => {
+    it.each(validationPrShapes)("$id: riskIndex follows prRisk.score, not repository health", ({ result, expectedPrRisk, expectedRepositoryHealth }) => {
+        expect(result.prRisk?.score).toBe(expectedPrRisk);
+        expect(result.repositoryHealth?.totalScore).toBe(expectedRepositoryHealth);
+        expect(result.totalScore).toBe(expectedRepositoryHealth);
+        expect(resolveRepositoryHealthScore(result)).toBe(expectedRepositoryHealth);
+        const facts = deriveScanNarrative(result);
+        expect(facts.riskSignals?.riskIndex).toBe(expectedPrRisk);
+        expect(facts.riskIndex).toBe(expectedPrRisk);
+        const { card, details, cli, check, comment } = surfacesFor(result);
+        expect(card.sortKey.riskIndex).toBe(expectedPrRisk);
+        expect(details.hero.prRiskScore).toBe(expectedPrRisk);
+        expect(details.signalSummary?.prRiskScore).toBe(expectedPrRisk);
+        expect(cli.metrics?.prRiskScore).toBe(expectedPrRisk);
+        expect(cli.metrics?.riskIndex).toBe(expectedPrRisk);
+        const prRiskSection = check.sections.find((s) => s.title === "PR Risk");
+        expect(prRiskSection?.bullets[0]).toMatch(new RegExp(`^${expectedPrRisk} \\(`));
+        expect(comment.introLines.some((l) => l.startsWith("PR Risk:"))).toBe(true);
+        expect(comment.introLines.find((l) => l.startsWith("PR Risk:"))).toContain(String(expectedPrRisk));
+    });
+    it("same repository health with different PR evidence yields different riskIndex", () => {
+        const fastify = surfacesFor(scanResultFastifyRuntime);
+        const typescript = surfacesFor(scanResultTypescriptPatch);
+        expect(resolveRepositoryHealthScore(scanResultFastifyRuntime)).toBe(resolveRepositoryHealthScore(scanResultTypescriptPatch));
+        expect(fastify.card.sortKey.riskIndex).not.toBe(typescript.card.sortKey.riskIndex);
+        expect(fastify.card.sortKey.riskIndex).toBe(55);
+        expect(typescript.card.sortKey.riskIndex).toBe(30);
+    });
+    it("historical fallback: missing prRisk uses totalScore for riskIndex", () => {
+        const historical = {
+            totalScore: 48,
+            layerScores: {
+                security: 10,
+                maintainability: 12,
+                ecosystem: 14,
+                upgradeImpact: 12,
+            },
+            findings: [],
+            generatedAt: "2026-01-01T00:00:00.000Z",
+            assessment: scanResultTypescriptPatch.assessment,
+            decision: scanResultTypescriptPatch.decision,
+        };
+        const facts = deriveScanNarrative(historical);
+        expect(facts.riskSignals?.riskIndex).toBe(48);
+        expect(facts.riskIndex).toBe(48);
+        const bundle = buildScanPresentationBundle({
+            result: historical,
+            pipelineStatus: "done",
+        });
+        expect(presentDashboardCard(bundle).sortKey.riskIndex).toBe(48);
+    });
+});

package/dist/presentation/fixtures/presentationPersonaFixtures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"presentationPersonaFixtures.d.ts","sourceRoot":"","sources":["../../../src/presentation/fixtures/presentationPersonaFixtures.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAkBjD,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EAC1B,MAAM,yBAAyB,CAAC;AA+KjC,eAAO,MAAM,gBAAgB,EAAE,UAG7B,CAAC;AAEH,eAAO,MAAM,kBAAkB,EAAE,UAG/B,CAAC;AAEH,eAAO,MAAM,gBAAgB,EAAE,UAG7B,CAAC;AAEH,eAAO,MAAM,kBAAkB,EAAE,UAI/B,CAAC;AAEH,eAAO,MAAM,gBAAgB,EAAE,UAa7B,CAAC;AAEH,eAAO,MAAM,qBAAqB,EAAE,UAMnC,CAAC;AAEF,eAAO,MAAM,gCAAgC,EAAE,UAO9C,CAAC;AAEF,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,GAC1B,CAAC"}
+{"version":3,"file":"presentationPersonaFixtures.d.ts","sourceRoot":"","sources":["../../../src/presentation/fixtures/presentationPersonaFixtures.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAmBjD,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EAC1B,MAAM,yBAAyB,CAAC;AA+KjC,eAAO,MAAM,gBAAgB,EAAE,UAG7B,CAAC;AAEH,eAAO,MAAM,kBAAkB,EAAE,UAShC,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UAG7B,CAAC;AAEH,eAAO,MAAM,kBAAkB,EAAE,UAI/B,CAAC;AAEH,eAAO,MAAM,gBAAgB,EAAE,UAa7B,CAAC;AAEH,eAAO,MAAM,qBAAqB,EAAE,UAMnC,CAAC;AAEF,eAAO,MAAM,gCAAgC,EAAE,UAO9C,CAAC;AAEF,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,GAC1B,CAAC"}

package/dist/presentation/fixtures/presentationPersonaFixtures.js

@@ -1,5 +1,6 @@
 import { assessmentBullmq, assessmentEslint, assessmentMixedTypescriptFastify, assessmentNextAuth, assessmentPrettier, assessmentUnknownSafe, assessmentVitest, } from "../../fixtures/assessmentFixtures.js";
 import { fixtureRepoIntelligenceFastify, fixtureRepoIntelligenceTypescript, } from "../../fixtures/repoIntelligenceFixtures.js";
+import { withAbi4SplitScores } from "../../fixtures/engineAbi4Fixtures.js";
 import { analysisPreparationWithValidRepoIntel } from "../../fixtures/repoIntelligenceTestHelpers.js";
 import { scanResultFastifyRuntime, scanResultLimitedContext, scanResultTypescriptPatch, } from "./scanResultFixtures.js";
 const basePrep = analysisPreparationWithValidRepoIntel();
@@ -165,9 +166,12 @@ export const scanResultEslint = scanBase(assessmentEslint, {
     changedPackages: ["eslint"],
     repoIntelligence: fixtureRepoIntelligenceEslint,
 });
-export const scanResultPrettier = scanBase(assessmentPrettier, {
+export const scanResultPrettier = withAbi4SplitScores(scanBase(assessmentPrettier, {
     changedPackages: ["prettier"],
     repoIntelligence: fixtureRepoIntelligencePrettier,
+}), {
+    prRiskScore: 30,
+    repositoryHealthScore: 61,
 });
 export const scanResultVitest = scanBase(assessmentVitest, {
     changedPackages: ["vitest"],

package/dist/presentation/fixtures/scanResultFixtures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanResultFixtures.d.ts","sourceRoot":"","sources":["../../../src/presentation/fixtures/scanResultFixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAYjD,eAAO,MAAM,wBAAwB,EAAE,UA0CtC,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,UA2BvC,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,UAqCtC,CAAC"}
+{"version":3,"file":"scanResultFixtures.d.ts","sourceRoot":"","sources":["../../../src/presentation/fixtures/scanResultFixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAoBjD,eAAO,MAAM,wBAAwB,EAAE,UA4CtC,CAAC;AASF,eAAO,MAAM,yBAAyB,EAAE,UA6BvC,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,UAqCtC,CAAC"}

package/dist/presentation/fixtures/scanResultFixtures.js

@@ -1,14 +1,16 @@
+import { withAbi4SplitScores } from "../../fixtures/engineAbi4Fixtures.js";
 import { assessmentFastifyRuntime, assessmentLimitedContext, assessmentTypescriptPatch, } from "../../fixtures/assessmentFixtures.js";
 import { fixtureRepoIntelligenceFastify, fixtureRepoIntelligenceTypescript, } from "../../fixtures/repoIntelligenceFixtures.js";
 import { analysisPreparationWithValidRepoIntel } from "../../fixtures/repoIntelligenceTestHelpers.js";
-export const scanResultFastifyRuntime = {
-    totalScore: 55,
-    layerScores: {
-        security: 10,
-        maintainability: 20,
-        ecosystem: 30,
-        upgradeImpact: 15,
-    },
+const fastifyLayerScores = {
+    security: 10,
+    maintainability: 20,
+    ecosystem: 30,
+    upgradeImpact: 15,
+};
+export const scanResultFastifyRuntime = withAbi4SplitScores({
+    totalScore: 63,
+    layerScores: fastifyLayerScores,
     findings: [
         {
             id: "finding-fastify-runtime",
@@ -43,15 +45,20 @@ export const scanResultFastifyRuntime = {
             remediation: "Run auth smoke tests",
         },
     ],
+}, {
+    prRiskScore: 55,
+    repositoryHealthScore: 63,
+    layerScores: fastifyLayerScores,
+});
+const typescriptLayerScores = {
+    security: 5,
+    maintainability: 8,
+    ecosystem: 10,
+    upgradeImpact: 5,
 };
-export const scanResultTypescriptPatch = {
-    totalScore: 18,
-    layerScores: {
-        security: 5,
-        maintainability: 8,
-        ecosystem: 10,
-        upgradeImpact: 5,
-    },
+export const scanResultTypescriptPatch = withAbi4SplitScores({
+    totalScore: 63,
+    layerScores: typescriptLayerScores,
     findings: [],
     generatedAt: "2026-01-01T00:00:00.000Z",
     changedPackages: ["typescript"],
@@ -71,7 +78,11 @@ export const scanResultTypescriptPatch = {
         edges: 340,
         hotspots: [],
     },
-};
+}, {
+    prRiskScore: 30,
+    repositoryHealthScore: 63,
+    layerScores: typescriptLayerScores,
+});
 export const scanResultLimitedContext = {
     totalScore: 40,
     layerScores: {

package/dist/presentation/presenters/presentCliScanSummary.js

@@ -8,7 +8,7 @@ export function presentCliScanSummary(bundle, ctx = {}) {
     const layerLine = layerScores
         ? `security=${layerScores.security} maintainability=${layerScores.maintainability} ecosystem=${layerScores.ecosystem} upgradeImpact=${layerScores.upgradeImpact}`
         : "";
-    const prRiskScore = facts.riskIndex ?? 0;
+    const prRiskScore = facts.riskSignals?.riskIndex ?? facts.riskIndex ?? 0;
     return {
         ...projectAssessmentFields(bundle),
         header: {

package/dist/presentation/presenters/presentDashboardCard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"presentDashboardCard.d.ts","sourceRoot":"","sources":["../../../src/presentation/presenters/presentDashboardCard.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAoEzF,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,sBAAsB,GAC7B,yBAAyB,CA8C3B;AAED,wBAAgB,sCAAsC,IAAI,yBAAyB,CAelF;AAED,wBAAgB,4BAA4B,CAC1C,cAAc,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAC9C,yBAAyB,CAqB3B"}
+{"version":3,"file":"presentDashboardCard.d.ts","sourceRoot":"","sources":["../../../src/presentation/presenters/presentDashboardCard.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAoEzF,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,sBAAsB,GAC7B,yBAAyB,CA+C3B;AAED,wBAAgB,sCAAsC,IAAI,yBAAyB,CAelF;AAED,wBAAgB,4BAA4B,CAC1C,cAAc,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAC9C,yBAAyB,CAqB3B"}

package/dist/presentation/presenters/presentDashboardCard.js

@@ -59,8 +59,9 @@ export function presentDashboardCard(bundle) {
     const { facts, profile } = bundle;
     const channels = buildNarrativeChannels(bundle);
     const posture = profile.status;
-    const riskIndex = facts.riskIndex != null && Number.isFinite(facts.riskIndex)
-        ? facts.riskIndex
+    const riskIndex = facts.riskSignals?.riskIndex != null &&
+        Number.isFinite(facts.riskSignals.riskIndex)
+        ? facts.riskSignals.riskIndex
         : -1;
     const insights = channels.insights.slice(0, INSIGHTS_CAP);
     const scopeAreas = channels.scopeAreas.length > 0

package/dist/riskSignals.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=riskSignals.test.d.ts.map

package/dist/riskSignals.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"riskSignals.test.d.ts","sourceRoot":"","sources":["../src/riskSignals.test.ts"],"names":[],"mappings":""}

package/dist/riskSignals.test.js

@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+import { deriveRiskSignals } from "./riskSignals.js";
+import { resolveRepositoryHealthScore } from "./prRiskWire.js";
+function baseResult(overrides = {}) {
+    return {
+        totalScore: 63,
+        layerScores: {
+            security: 10,
+            maintainability: 20,
+            ecosystem: 30,
+            upgradeImpact: 15,
+        },
+        findings: [],
+        generatedAt: "2026-01-01T00:00:00.000Z",
+        ...overrides,
+    };
+}
+describe("deriveRiskSignals", () => {
+    it("prefers prRisk.score over totalScore and repositoryHealth", () => {
+        const result = baseResult({
+            prRisk: { score: 55 },
+            repositoryHealth: { totalScore: 63 },
+            totalScore: 63,
+        });
+        expect(deriveRiskSignals(result)?.riskIndex).toBe(55);
+        expect(resolveRepositoryHealthScore(result)).toBe(63);
+    });
+    it("falls back to totalScore when prRisk is missing (historical scans)", () => {
+        const result = baseResult({ totalScore: 48 });
+        expect(deriveRiskSignals(result)?.riskIndex).toBe(48);
+    });
+});

package/dist/scanPresentationBundle.golden.test.js

@@ -58,8 +58,8 @@ describe("scanPresentationBundle golden — proof model", () => {
         const { facts } = bundle;
         expect(facts.availability.corpusGateReason).toBe("ok");
         expect(facts.packageSemantics?.dependencyClass).toBe("tooling");
-        expect(facts.riskSignals?.riskIndex).toBe(18);
-        expect(facts.riskSignals?.band).toBe(scoreToBand(18));
+        expect(facts.riskSignals?.riskIndex).toBe(30);
+        expect(facts.riskSignals?.band).toBe(scoreToBand(30));
     });
     it("affected areas always carry linkage arrays (structure)", () => {
         for (const { result } of validationPersonas) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mergesignal/shared",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "MergeSignal shared scan contract, presentation policy, and trusted validation",
   "type": "module",
   "main": "./dist/index.js",