@company-semantics/contracts 33.0.0 → 35.0.0

package/src/notifications/renderers/email/index.ts

@@ -0,0 +1,73 @@
+/**
+ * The email channel (ADR-CONTRACTS-086).
+ *
+ * `emailRenderer` is the first `Renderer` — email demoted from "the shape of the
+ * whole layer" to one channel among several. Everything that used to BE the
+ * render layer (the shells, the styling, the escaping, the box art) is now this
+ * directory's private business; what it exposes is a renderer and the type it
+ * returns. `src/email/` is gone, and this is what replaced it.
+ *
+ * INVARIANTS:
+ * - Pure. `render` is a function of `(content, context)` — no clock, no
+ *   environment, no I/O. The copyright year comes from
+ *   `context.brand.copyrightYear`.
+ * - Output is byte-identical to what the old `src/email/render` emitted. That is
+ *   the whole constraint of this migration, and `__tests__/render.test.ts`
+ *   proves it against the frozen output-parity golden — which, now that the old
+ *   layer is deleted, is the only surviving record of those bytes.
+ * - `supports` answers true for every element type: email is the rich channel,
+ *   and there is nothing in the content model it cannot depict.
+ */
+
+import type { NotificationContent, NotificationElement } from "../../content";
+import type { RenderContext } from "../../context";
+import type { Renderer } from "../../renderer";
+
+import type { Spacing } from "./constants";
+import { renderElement } from "./render";
+import { type EmailLine, htmlShell, textShell } from "./shells";
+
+/** One rendered email — the email channel's natural output type. */
+export interface RenderedEmail {
+  /** Subject line — the notification's `metadata.title`. */
+  subject: string;
+  /** Plain-text body. */
+  text: string;
+  /** HTML body (every kind is dual-output). */
+  html: string;
+}
+
+/**
+ * The gap after an element's last line.
+ *
+ * `signature` owns the blank line above its own rule, so whatever precedes it
+ * carries no trailing gap — the one positional rule the old templates stated
+ * out loud (every `footer(..., "none")` call, and `security.alert`'s Time row).
+ */
+function trailingSpacing(
+  elements: NotificationElement[],
+  index: number,
+): Spacing {
+  return elements[index + 1]?.type === "signature" ? "none" : "normal";
+}
+
+/** Email. Sections are one body — the seam email declines to split on. */
+export const emailRenderer: Renderer<RenderedEmail> = {
+  id: "email",
+  supports: () => true,
+  render: (content: NotificationContent, context: RenderContext) => {
+    const elements = content.sections
+      .flatMap((section) => section.elements)
+      .filter((element) => emailRenderer.supports(element.type));
+
+    const lines: EmailLine[] = elements.flatMap((element, index) =>
+      renderElement(element, context, trailingSpacing(elements, index)),
+    );
+
+    return {
+      subject: content.metadata.title,
+      text: textShell(lines),
+      html: htmlShell(lines),
+    };
+  },
+};

package/src/notifications/renderers/email/render.ts

@@ -0,0 +1,225 @@
+/**
+ * What each `NotificationElement` looks like as email (ADR-CONTRACTS-086).
+ *
+ * This is the deleted `src/email/render/blocks` read the other way round. That
+ * module offered templates a component per intent (`greeting()`, `keyValue()`,
+ * `footer()`) and each template chose which to call; here the CONTENT names the
+ * intent and this module is the only thing that knows the markup. The strings
+ * are the same strings — the output-parity golden asserts them byte-for-byte.
+ *
+ * **Spacing is derived, because the content model does not carry it.** The old
+ * layer passed a `Spacing` per block, and `../../kinds` deliberately dropped it:
+ * a margin is a channel's answer. So this module has to re-derive one, and it
+ * does it with a single rule:
+ *
+ * > An element renders as one or more lines. Lines WITHIN an element hug
+ * > (`"tight"`); the element's LAST line carries the trailing gap, which is
+ * > `"normal"` — or `"none"` when a signature follows, because `signature`
+ * > owns the blank above its own rule.
+ *
+ * That rule reproduces every hand-authored spacing choice in the old templates,
+ * which is not a coincidence: "these lines are one thing, that gap separates two
+ * things" is what the authors were expressing, and the element boundaries are
+ * where they were expressing it. The one place it did NOT fall out was
+ * `security.alert`'s two-sentence paragraph, and the fix was to say so in the
+ * content (one `body` with a newline) rather than to special-case a kind here —
+ * see `../../kinds/security-alert`.
+ *
+ * INVARIANTS:
+ * - Pure. The copyright year and the brand come from `RenderContext`, never from
+ *   a clock — retiring the `new Date().getFullYear()` inside the old
+ *   `signature()`.
+ * - The `:` between a label and its value is PRESENTATION and lives in no
+ *   element (see `../../kinds/README.md`). This module puts it back, on
+ *   key/value rows and on the metadata heading.
+ * - Values arrive pre-formatted (dates, title-casing, truncation are `compose`'s
+ *   work). Nothing here re-formats a value.
+ */
+
+import type {
+  CallToAction,
+  KeyValueRow,
+  NotificationElement,
+} from "../../content";
+import type { RenderContext } from "../../context";
+
+import {
+  COMPANY_URL,
+  FONT_SIZE,
+  MONO,
+  SPACING,
+  type Spacing,
+} from "./constants";
+import { renderChatUnit } from "./chat";
+import { ctaButton } from "./cta";
+import { escapeHtml } from "./escape-html";
+import type { EmailLine } from "./shells";
+
+/** One `<p>` — the primitive every prose-ish element is built from. */
+function paragraph(html: string, text: string, spacing: Spacing): EmailLine {
+  return {
+    html: `<p style="${MONO} font-size: ${FONT_SIZE}; margin: ${SPACING[spacing]};">${html}</p>`,
+    text,
+    spacing,
+  };
+}
+
+/**
+ * Apply the spacing rule to one element's lines: everything but the last hugs,
+ * the last carries the element's trailing gap.
+ */
+function spaced(
+  lines: Array<{ html: string; text: string }>,
+  trailing: Spacing,
+): EmailLine[] {
+  return lines.map((line, i) =>
+    paragraph(
+      line.html,
+      line.text,
+      i === lines.length - 1 ? trailing : "tight",
+    ),
+  );
+}
+
+/** `Label: value` — the separator the content model does not carry. */
+function keyValueLine(row: KeyValueRow): { html: string; text: string } {
+  const text = `${row.label}: ${row.value}`;
+  return { html: escapeHtml(text), text };
+}
+
+/** The standalone `>> LABEL <<` box. */
+function ctaLine(cta: CallToAction, trailing: Spacing): EmailLine {
+  const { html, text } = ctaButton(cta, SPACING[trailing]);
+  return { html, text, spacing: trailing };
+}
+
+/** The trailing sign-off — a blank line, the `/* EOM *\/` rule, then the signer. */
+function signatureLine(signer: string, year: number): EmailLine {
+  const line = `ⓒ ${year} • ${signer}`;
+  return {
+    html: `<p style="${MONO} font-size: ${FONT_SIZE}; margin: ${SPACING.none};"><br><br><span style="color: #bbb;">/* EOM */</span><br>${escapeHtml(line)}<br><a href="${COMPANY_URL}" target="_blank" rel="noopener noreferrer" style="color: #0047FF; text-decoration: none;">${escapeHtml(COMPANY_URL)}</a></p>`,
+    text: `\n\n/* EOM */\n${line}\n${COMPANY_URL}`,
+    spacing: "none",
+  };
+}
+
+/**
+ * Render one element to its email lines.
+ *
+ * `trailing` is the gap after the element's last line, decided by what follows
+ * it — see the spacing rule at the top of this module.
+ */
+export function renderElement(
+  element: NotificationElement,
+  context: RenderContext,
+  trailing: Spacing,
+): EmailLine[] {
+  switch (element.type) {
+    case "greeting": {
+      const text = element.recipientName
+        ? `Hi ${element.recipientName},`
+        : "Hi there,";
+      return [paragraph(escapeHtml(text), text, trailing)];
+    }
+
+    case "body":
+      // A newline inside a body separates lines of ONE paragraph, so they hug;
+      // two paragraphs are two body elements. See `../../content.ts`.
+      return spaced(
+        element.text.split("\n").map((line) => ({
+          html: escapeHtml(line),
+          text: line,
+        })),
+        trailing,
+      );
+
+    case "keyValueTable":
+      return spaced(element.rows.map(keyValueLine), trailing);
+
+    case "metadata": {
+      // The heading's `:` is presentation: `label` is "Request details", and the
+      // colon the recipient reads is put back here.
+      const heading = element.label
+        ? [{ html: escapeHtml(`${element.label}:`), text: `${element.label}:` }]
+        : [];
+      return spaced([...heading, ...element.rows.map(keyValueLine)], trailing);
+    }
+
+    case "callToAction":
+      return [ctaLine(element, trailing)];
+
+    case "warning": {
+      // Fieldless by design — the banner IS the content, and its wording is the
+      // renderer's (see `../../content.ts`).
+      const text = "🆆🅰🆁🅽🅸🅽🅶";
+      return [paragraph(escapeHtml(text), text, trailing)];
+    }
+
+    case "notice":
+      // One paragraph, `<br>` between lines — the lines are one unit, so unlike
+      // a `body` they do not become separate `<p>`s.
+      return [
+        paragraph(
+          element.lines.map(escapeHtml).join("<br>"),
+          element.lines.join("\n"),
+          trailing,
+        ),
+      ];
+
+    case "chatUnit": {
+      const { html, text } = renderChatUnit(element.items);
+      return [{ html, text, spacing: trailing }];
+    }
+
+    case "signature":
+      return [
+        signatureLine(
+          element.signer ?? context.brand.name,
+          context.brand.copyrightYear,
+        ),
+      ];
+
+    // -------------------------------------------------------------------------
+    // Below: elements no notification says yet.
+    //
+    // The old email layer had no component for any of these and no kind composes
+    // one, so — unlike everything above — there are no bytes to reproduce and the
+    // markup here is invented. `supports` still answers true:
+    // email CAN depict a list, a rule and an image, and declining them would be
+    // a lie about the channel. The first kind to use one should expect to style
+    // it properly rather than trust these.
+    // -------------------------------------------------------------------------
+
+    case "list":
+      return spaced(
+        element.items.map((item, i) => {
+          const text = `${element.ordered ? `${i + 1}.` : "•"} ${item}`;
+          return { html: escapeHtml(text), text };
+        }),
+        trailing,
+      );
+
+    case "divider":
+      return [
+        {
+          html: `<hr style="border: none; border-top: 1px solid #bbb; margin: ${SPACING[trailing]};">`,
+          text: "---",
+          spacing: trailing,
+        },
+      ];
+
+    case "heroImage":
+      return [
+        {
+          html: `<img src="${element.src}" alt="${escapeHtml(element.alt)}" style="max-width: 100%; margin: ${SPACING[trailing]};">`,
+          text: element.alt,
+          spacing: trailing,
+        },
+      ];
+
+    default: {
+      const _exhaustive: never = element;
+      return _exhaustive;
+    }
+  }
+}

package/src/notifications/renderers/email/shells.ts

@@ -0,0 +1,60 @@
+/**
+ * The email shells — the `<!DOCTYPE>` wrapper and the plain-text joiner.
+ *
+ * Moved verbatim from the deleted `src/email/render/blocks`
+ * (ADR-CONTRACTS-086). These are what make one email dual-output: `render`
+ * composes ONE list of `EmailLine`s and both surfaces derive from it, so the two
+ * can never disagree about what the email says.
+ *
+ * INVARIANTS:
+ * - Pure functions of their input lines. No clock, no environment, no I/O.
+ * - Byte-identical to what that module emitted. These strings are the email's
+ *   actual markup; the output-parity golden asserts them character-for-character.
+ */
+
+import { MONO, type Spacing } from "./constants";
+
+/**
+ * One rendered line — both presentations of one thing the notification says,
+ * plus the gap that follows it.
+ *
+ * Named `EmailLine` rather than `Block`: `Block` was the old layer's canonical
+ * unit, and demoting it to a channel's internal detail is the point of
+ * ADR-CONTRACTS-086. One `NotificationElement` may produce several of these (a
+ * key/value table produces one per row).
+ */
+export interface EmailLine {
+  html: string;
+  text: string;
+  spacing: Spacing;
+}
+
+/** Wrap rendered lines in the shared `<!DOCTYPE>` monospace shell. */
+export function htmlShell(lines: EmailLine[]): string {
+  const inner = lines
+    .map((line) => line.html)
+    .filter(Boolean)
+    .join("\n");
+  return `<!DOCTYPE html>
+<html lang="en">
+<head><meta charset="UTF-8"></head>
+<body style="${MONO} color: #1a1a1a; margin: 0; padding: 0;">
+<div style="max-width: 520px; margin: 0 auto;">
+${inner}
+</div>
+</body>
+</html>`;
+}
+
+/**
+ * Join rendered lines into the plain-text email — separated per each line's
+ * spacing, with a trailing newline.
+ */
+export function textShell(lines: EmailLine[]): string {
+  let out = "";
+  lines.forEach((line, i) => {
+    out += line.text;
+    if (i < lines.length - 1) out += line.spacing === "normal" ? "\n\n" : "\n";
+  });
+  return out.trim() + "\n";
+}

package/src/notifications/renderers/slack/README.md

@@ -0,0 +1,73 @@
+# notifications/renderers/slack/
+
+## Purpose
+
+The Slack channel (ADR-CONTRACTS-086) — `slackRenderer: Renderer<SlackMessage>`. A
+**non-functional placeholder**.
+
+Where `../sms` proves the content model survives the poorest channel, this proves
+the other edge: a channel whose output is a tree of typed blocks — neither a
+string nor email's `{ subject, text, html }`. Between the three, `Out` has been a
+record, a string and a different record, which is `../../renderer.ts`'s "each
+renderer returns its natural type" held by real modules rather than asserted about
+the type itself.
+
+The whole channel is one `index.ts` — the Block Kit subset, the escaping, and the
+renderer. `../email` splits across seven modules because it carries real markup; a
+stub that sprawls is a stub pretending.
+
+## What "placeholder" means here
+
+- **It does not send.** No token, no channel id, no `chat.postMessage`. A renderer
+  renders; delivery and the decision to deliver are the backend's.
+- **It is low fidelity.** `SlackBlock` is a minimal, hand-written subset of Block
+  Kit — enough to carry every element the channel admits, and no more. It is not
+  the Slack API's types and is not generated from them. The wording is invented
+  rather than relocated: there is no golden here, unlike `../email`.
+
+The field names are snake_case (`image_url`, `alt_text`) because Block Kit is a
+wire format and those are its names. That is deliberate, not a lapse in the
+repo's camelCase convention.
+
+## The one decline
+
+`supports` answers `false` for `chatUnit` alone. Block Kit has no vocabulary for
+turn-taking, and flattening a conversation into a run of sections drops the
+attribution that IS the meaning — which the content model names as the reason to
+decline a whole element rather than approximate it.
+
+Everything else Slack genuinely depicts, **including the `heroImage` that `../sms`
+has no surface for**. That difference is the point of shipping two stubs rather
+than one: same `NotificationContent`, no channel tags on it, three channels of
+differing capability each keeping what they can show.
+
+`metadata` and `notice` become `context` blocks — Slack's own device for
+de-emphasised small print, which is exactly what `MetadataElement` exists to be.
+
+## Invariants
+
+- PURE. `render` is a function of `(content, context)` — no clock, no
+  environment, no I/O. The brand and the copyright year come from `context.brand`.
+  `signature` is the element that used to hide a `new Date()`; here there is
+  nowhere to hide.
+- `supports` is total over `NotificationElementType` and AGREES with `render`:
+  `chatUnit` is omitted, never approximated and never thrown on.
+- Every user-controlled string reaching an mrkdwn surface passes through
+  `escapeMrkdwn` first — the same rule `../email` applies with `escapeHtml`. This
+  is the one thing in a low-fidelity stub that would be a real defect rather than
+  a fidelity gap, so `__tests__/index.test.ts` pins it.
+- `renderElement` switches over all TWELVE element types, not the eleven
+  `supports` admits. The declined arm is unreachable; writing it out is what makes
+  the compiler prove the two lists agree. Do not collapse it into a `default` —
+  that would silently swallow a thirteenth member of the union.
+- A `callToAction` with no `href` becomes text, never a button. `href` absent
+  means the label IS the payload (an OTP code); a button with no destination is a
+  lie about what the notification is asking for.
+- `SlackMessage.text` is `metadata.title` — the fallback Slack shows where blocks
+  cannot render. The same content-level fact email spends as its subject, which is
+  why it lives on the content rather than in a channel's registry.
+- Nothing here reads `metadata.kind`. A renderer that special-cases a kind has
+  lost the model; the fix for a missing fact is upstream in `compose`.
+- This channel is unreachable from `../../render.ts`'s `renderEmail` and touches
+  no parity fixture. It cannot change a sent email, and it must not acquire the
+  ability to.

package/src/notifications/renderers/slack/__tests__/README.md

@@ -0,0 +1,33 @@
+# notifications/renderers/slack/\_\_tests\_\_/
+
+## Purpose
+
+Tests for the Slack channel (ADR-CONTRACTS-086).
+
+The channel is a placeholder, so — as in `../../sms/__tests__/` — these tests do
+not pin the Block Kit wording. They pin the contract a placeholder still owes:
+`supports` total and in agreement with `render`, `render` pure, the brand and year
+read from `RenderContext`, and a content carrying all twelve element types
+rendering without throwing.
+
+One exception: the mrkdwn escaping IS pinned exactly. Everything else here is a
+fidelity gap that a real Slack kind will close; unescaped user input would be a
+real defect shipped in a published package.
+
+## Invariants
+
+- The Block Kit shape is NOT the specification. When a real Slack kind lands and
+  reworks these blocks, updating this file is expected. When `supports` and
+  `render` stop agreeing, or when escaping regresses, that is a defect — keep
+  assertions about SHAPE separate from assertions about copy so the two failures
+  stay easy to tell apart.
+- The "takes the hero image the SMS channel has no surface for" test is the
+  cross-channel claim, and it is why two stubs exist rather than one: the same
+  `NotificationContent`, carrying no channel tags, keeps different elements on
+  channels of different capability. It is not redundant with the totality loop.
+- NO fake timers. The year is a field on `RenderContext` (see
+  `../../../__tests__/README.md`).
+- `ALL_TYPES` is duplicated from the sibling suites rather than shared. The list
+  is the totality claim itself; importing it from one place would let a new
+  element type be added to the union and to the shared list in one move, with no
+  channel noticing.

package/src/notifications/renderers/slack/__tests__/index.test.ts

@@ -0,0 +1,201 @@
+/**
+ * The Slack channel is a placeholder, so what is pinned here is the contract a
+ * placeholder still owes — `supports` total and in agreement with `render`,
+ * `render` pure and reading the brand and year from the context, every element
+ * type rendering without throwing — and NOT the Block Kit wording, which is
+ * invented and expected to change when a kind is actually posted to Slack.
+ *
+ * The mrkdwn escaping IS pinned. It is the one thing here that would be a real
+ * defect rather than a fidelity gap.
+ */
+
+import { describe, expect, it } from "vitest";
+
+import type {
+  NotificationContent,
+  NotificationElementType,
+} from "../../../content";
+import type { RenderContext } from "../../../context";
+import { slackRenderer } from "../index";
+
+const CONTEXT: RenderContext = {
+  brand: { name: "Company Semantics", copyrightYear: 2026 },
+};
+
+/** Every element type, so `render` is exercised over the whole union. */
+const CONTENT: NotificationContent = {
+  metadata: { kind: "org.invite", title: "Join Acme" },
+  sections: [
+    {
+      elements: [
+        { type: "heroImage", src: "https://example.test/h.png", alt: "Acme" },
+        { type: "greeting", recipientName: "Ada" },
+        { type: "body", text: "Acme uses Company Semantics." },
+        { type: "keyValueTable", rows: [{ label: "Org", value: "Acme" }] },
+        { type: "list", items: ["Read", "Write"] },
+        { type: "divider" },
+        { type: "warning" },
+        {
+          type: "chatUnit",
+          items: [{ type: "message", role: "user", text: "Hello?" }],
+        },
+        {
+          type: "metadata",
+          label: "Request details",
+          rows: [{ label: "IP", value: "203.0.113.7" }],
+        },
+        { type: "notice", lines: ["Not expecting this?"] },
+        { type: "callToAction", label: "JOIN", href: "https://example.test/j" },
+        { type: "signature" },
+      ],
+    },
+  ],
+};
+
+const ALL_TYPES: NotificationElementType[] = [
+  "greeting",
+  "body",
+  "keyValueTable",
+  "callToAction",
+  "list",
+  "divider",
+  "warning",
+  "metadata",
+  "notice",
+  "chatUnit",
+  "signature",
+  "heroImage",
+];
+
+describe("slackRenderer", () => {
+  it("declares a stable channel id", () => {
+    expect(slackRenderer.id).toBe("slack");
+  });
+
+  it("answers supports() for every element type — the predicate is total", () => {
+    for (const type of ALL_TYPES) {
+      expect(typeof slackRenderer.supports(type), type).toBe("boolean");
+    }
+  });
+
+  it("declines only chatUnit — Block Kit cannot depict turn-taking", () => {
+    for (const type of ALL_TYPES) {
+      expect(slackRenderer.supports(type), type).toBe(type !== "chatUnit");
+    }
+  });
+
+  it("renders a content carrying every element type without throwing", () => {
+    expect(() => slackRenderer.render(CONTENT, CONTEXT)).not.toThrow();
+  });
+
+  it("omits the declined element rather than flattening it", () => {
+    const rendered = slackRenderer.render(CONTENT, CONTEXT);
+
+    expect(JSON.stringify(rendered)).not.toContain("Hello?");
+    // Eleven admitted elements, each yielding exactly one block here.
+    expect(rendered.blocks).toHaveLength(11);
+  });
+
+  it("returns its natural type — a Block Kit record, not a string", () => {
+    const rendered = slackRenderer.render(CONTENT, CONTEXT);
+
+    // `text` is the fallback Slack shows where blocks cannot render. It is
+    // metadata.title — the same field email spends as its subject.
+    expect(rendered.text).toBe("Join Acme");
+    expect(rendered.blocks.map((block) => block.type)).toEqual([
+      "image",
+      "section",
+      "section",
+      "section",
+      "section",
+      "divider",
+      "section",
+      "context",
+      "context",
+      "actions",
+      "context",
+    ]);
+  });
+
+  it("takes the hero image the SMS channel has no surface for", () => {
+    // The two stubs exist to differ: same content, no channel tags on it, and
+    // each channel keeps what it can depict.
+    expect(slackRenderer.render(CONTENT, CONTEXT).blocks).toContainEqual({
+      type: "image",
+      image_url: "https://example.test/h.png",
+      alt_text: "Acme",
+    });
+  });
+
+  it("renders a call to action with an href as a button", () => {
+    expect(slackRenderer.render(CONTENT, CONTEXT).blocks).toContainEqual({
+      type: "actions",
+      elements: [
+        {
+          type: "button",
+          text: { type: "plain_text", text: "JOIN" },
+          url: "https://example.test/j",
+        },
+      ],
+    });
+  });
+
+  it("renders a call to action without an href as text, not a button", () => {
+    // `href` absent means the label IS the payload (an OTP code). A button with
+    // no destination would be a lie about what the notification is asking for.
+    const otp: NotificationContent = {
+      metadata: { kind: "auth.otp", title: "Your code" },
+      sections: [{ elements: [{ type: "callToAction", label: "123456" }] }],
+    };
+    expect(slackRenderer.render(otp, CONTEXT).blocks).toEqual([
+      { type: "section", text: { type: "mrkdwn", text: "*123456*" } },
+    ]);
+  });
+
+  it("escapes Slack's reserved characters in user-controlled fields", () => {
+    const hostile: NotificationContent = {
+      metadata: { kind: "org.invite", title: "Join Acme" },
+      sections: [
+        { elements: [{ type: "body", text: "a & b <c> <!channel>" }] },
+      ],
+    };
+    expect(slackRenderer.render(hostile, CONTEXT).blocks).toEqual([
+      {
+        type: "section",
+        text: {
+          type: "mrkdwn",
+          text: "a &amp; b &lt;c&gt; &lt;!channel&gt;",
+        },
+      },
+    ]);
+  });
+
+  it("reads the brand and year from context, never from a clock", () => {
+    // No fake timer in this file: swapping the context moves the copyright line.
+    const pinned: RenderContext = {
+      brand: { name: "Acme", copyrightYear: 1999 },
+    };
+    expect(JSON.stringify(slackRenderer.render(CONTENT, pinned))).toContain(
+      "© 1999 Acme",
+    );
+  });
+
+  it("lets an element's signer override the context brand", () => {
+    const onBehalf: NotificationContent = {
+      metadata: { kind: "org.invite", title: "Join Acme" },
+      sections: [{ elements: [{ type: "signature", signer: "Grace" }] }],
+    };
+    expect(slackRenderer.render(onBehalf, CONTEXT).blocks).toEqual([
+      {
+        type: "context",
+        elements: [{ type: "mrkdwn", text: "© 2026 Grace" }],
+      },
+    ]);
+  });
+
+  it("is pure — same inputs, same output", () => {
+    expect(slackRenderer.render(CONTENT, CONTEXT)).toEqual(
+      slackRenderer.render(CONTENT, CONTEXT),
+    );
+  });
+});