@mergesignal/shared 0.2.0

package/dist/scanSurfaceCopy.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scanSurfaceCopy.test.d.ts.map

package/dist/scanSurfaceCopy.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanSurfaceCopy.test.d.ts","sourceRoot":"","sources":["../src/scanSurfaceCopy.test.ts"],"names":[],"mappings":""}

package/dist/scanSurfaceCopy.test.js

@@ -0,0 +1,14 @@
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { scanSurfaceCopyFlat } from "./scanSurfaceCopy.js";
+describe("scanSurfaceCopy", () => {
+    it("matches generated CI JSON (no drift)", () => {
+        const root = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+        const jsonPath = join(root, "scripts/ci/scan-surface-copy.generated.json");
+        const onDisk = JSON.parse(readFileSync(jsonPath, "utf8"));
+        const fromTs = scanSurfaceCopyFlat();
+        expect(fromTs).toEqual(onDisk);
+    });
+});

package/dist/selectTopAffectedAreas.d.ts

@@ -0,0 +1,17 @@
+import type { ScanResult } from "./types.js";
+export type TopAreasOptions = {
+    max?: number;
+    maxLabelLen?: number;
+};
+/**
+ * Select up to `max` (default 3) compact human-readable area labels from a
+ * ScanResult, ordered by signal strength. Returns [] when nothing meaningful
+ * can be surfaced — callers should omit the UI block entirely in that case.
+ *
+ * Priority order (first-match-wins per slot, deduped):
+ *   1. explain.reasons sorted by |scoreImpact| (most impactful first)
+ *   2. insights[].message (dedupe by first sentence)
+ *   3. Layer names from layerScores (only when slots 1+2 yielded nothing)
+ */
+export declare function selectTopAffectedAreas(result: ScanResult | null | undefined, opts?: TopAreasOptions): string[];
+//# sourceMappingURL=selectTopAffectedAreas.d.ts.map

package/dist/selectTopAffectedAreas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selectTopAffectedAreas.d.ts","sourceRoot":"","sources":["../src/selectTopAffectedAreas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,EACrC,IAAI,GAAE,eAAoB,GACzB,MAAM,EAAE,CAuEV"}

package/dist/selectTopAffectedAreas.js

@@ -0,0 +1,80 @@
+/**
+ * Select up to `max` (default 3) compact human-readable area labels from a
+ * ScanResult, ordered by signal strength. Returns [] when nothing meaningful
+ * can be surfaced — callers should omit the UI block entirely in that case.
+ *
+ * Priority order (first-match-wins per slot, deduped):
+ *   1. explain.reasons sorted by |scoreImpact| (most impactful first)
+ *   2. insights[].message (dedupe by first sentence)
+ *   3. Layer names from layerScores (only when slots 1+2 yielded nothing)
+ */
+export function selectTopAffectedAreas(result, opts = {}) {
+    if (!result)
+        return [];
+    const max = opts.max ?? 3;
+    const maxLabelLen = opts.maxLabelLen ?? 38;
+    function trimLabel(raw) {
+        const clean = raw.replace(/^(Finding:\s*|Area:\s*)/i, "").trim();
+        return clean.length > maxLabelLen
+            ? clean.slice(0, maxLabelLen - 1) + "…"
+            : clean;
+    }
+    const seen = new Set();
+    const areas = [];
+    function add(label) {
+        if (areas.length >= max)
+            return false;
+        const t = trimLabel(label);
+        const key = t.toLowerCase();
+        if (!t || seen.has(key))
+            return false;
+        seen.add(key);
+        areas.push(t);
+        return areas.length < max;
+    }
+    // Priority 1: explain.reasons sorted by absolute scoreImpact
+    if (Array.isArray(result.explain?.reasons)) {
+        const sorted = [...result.explain.reasons]
+            .filter((r) => r.title)
+            .sort((a, b) => Math.abs(b.scoreImpact ?? 0) - Math.abs(a.scoreImpact ?? 0));
+        for (const r of sorted) {
+            if (!add(r.title))
+                break;
+        }
+    }
+    if (areas.length >= max)
+        return areas;
+    // Priority 2: PR insights — first sentence of message
+    if (Array.isArray(result.insights)) {
+        for (const ins of result.insights) {
+            if (!ins.message)
+                continue;
+            const firstSentence = ins.message.split(".")[0] ?? ins.message;
+            if (!add(firstSentence))
+                break;
+        }
+    }
+    if (areas.length >= max)
+        return areas;
+    // Priority 3: layer names only when nothing else surfaced
+    if (areas.length === 0) {
+        const LAYER_LABELS = {
+            security: "Security",
+            maintainability: "Maintainability",
+            ecosystem: "Ecosystem",
+            upgradeImpact: "Upgrade impact",
+        };
+        const layerScores = result.layerScores;
+        if (!layerScores || typeof layerScores !== "object")
+            return areas;
+        const sorted = Object.entries(layerScores)
+            .filter(([, v]) => typeof v === "number")
+            // highest score = most impactful layer (inverted: higher score = worse)
+            .sort(([, a], [, b]) => b - a);
+        for (const [layer] of sorted) {
+            if (!add(LAYER_LABELS[layer] ?? layer))
+                break;
+        }
+    }
+    return areas;
+}

package/dist/selectTopAffectedAreas.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=selectTopAffectedAreas.test.d.ts.map

package/dist/selectTopAffectedAreas.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selectTopAffectedAreas.test.d.ts","sourceRoot":"","sources":["../src/selectTopAffectedAreas.test.ts"],"names":[],"mappings":""}

package/dist/selectTopAffectedAreas.test.js

@@ -0,0 +1,179 @@
+import { describe, it, expect } from "vitest";
+import { selectTopAffectedAreas } from "./selectTopAffectedAreas.js";
+function makeScanResult(overrides = {}) {
+    return {
+        totalScore: 60,
+        layerScores: {
+            security: 70,
+            maintainability: 50,
+            ecosystem: 40,
+            upgradeImpact: 30,
+        },
+        findings: [],
+        generatedAt: "2026-01-01T00:00:00Z",
+        ...overrides,
+    };
+}
+describe("selectTopAffectedAreas", () => {
+    it("returns [] for null input", () => {
+        expect(selectTopAffectedAreas(null)).toEqual([]);
+    });
+    it("returns [] for undefined input", () => {
+        expect(selectTopAffectedAreas(undefined)).toEqual([]);
+    });
+    it("returns at most 3 results by default", () => {
+        const result = makeScanResult({
+            explain: {
+                reasons: [
+                    { id: "r1", layer: "security", title: "Auth flow", scoreImpact: -20 },
+                    {
+                        id: "r2",
+                        layer: "security",
+                        title: "State sync",
+                        scoreImpact: -15,
+                    },
+                    {
+                        id: "r3",
+                        layer: "ecosystem",
+                        title: "Middleware",
+                        scoreImpact: -10,
+                    },
+                    {
+                        id: "r4",
+                        layer: "maintainability",
+                        title: "Extra area",
+                        scoreImpact: -5,
+                    },
+                ],
+            },
+        });
+        const areas = selectTopAffectedAreas(result);
+        expect(areas.length).toBe(3);
+        expect(areas).toEqual(["Auth flow", "State sync", "Middleware"]);
+    });
+    it("respects custom max", () => {
+        const result = makeScanResult({
+            explain: {
+                reasons: [
+                    { id: "r1", layer: "security", title: "Area A", scoreImpact: -20 },
+                    { id: "r2", layer: "security", title: "Area B", scoreImpact: -15 },
+                ],
+            },
+        });
+        expect(selectTopAffectedAreas(result, { max: 1 })).toEqual(["Area A"]);
+    });
+    it("sorts explain reasons by absolute scoreImpact descending", () => {
+        const result = makeScanResult({
+            explain: {
+                reasons: [
+                    { id: "r1", layer: "security", title: "Minor", scoreImpact: -2 },
+                    { id: "r2", layer: "security", title: "Critical", scoreImpact: -30 },
+                    { id: "r3", layer: "ecosystem", title: "Medium", scoreImpact: -15 },
+                ],
+            },
+        });
+        const areas = selectTopAffectedAreas(result);
+        expect(areas[0]).toBe("Critical");
+        expect(areas[1]).toBe("Medium");
+    });
+    it("falls back to insights when explain is empty", () => {
+        const result = makeScanResult({
+            insights: [
+                {
+                    type: "behavioral_change",
+                    priority: "high",
+                    confidence: "confirmed",
+                    scope: "changed",
+                    message: "Auth middleware changed. Check tokens",
+                    context: "src/auth.ts",
+                    remediation: "Review carefully",
+                },
+            ],
+        });
+        const areas = selectTopAffectedAreas(result);
+        expect(areas).toEqual(["Auth middleware changed"]);
+    });
+    it("falls back to layer names when explain and insights are empty", () => {
+        const result = makeScanResult();
+        const areas = selectTopAffectedAreas(result);
+        expect(areas.length).toBeGreaterThan(0);
+        expect(areas.length).toBeLessThanOrEqual(3);
+        expect(areas).toContain("Security");
+    });
+    it("deduplicates normalized labels", () => {
+        const result = makeScanResult({
+            explain: {
+                reasons: [
+                    { id: "r1", layer: "security", title: "Auth flow", scoreImpact: -20 },
+                    { id: "r2", layer: "security", title: "auth flow", scoreImpact: -15 },
+                    {
+                        id: "r3",
+                        layer: "ecosystem",
+                        title: "Auth flow",
+                        scoreImpact: -10,
+                    },
+                ],
+            },
+        });
+        const areas = selectTopAffectedAreas(result);
+        const unique = new Set(areas.map((a) => a.toLowerCase()));
+        expect(unique.size).toBe(areas.length);
+        expect(areas).toContain("Auth flow");
+        expect(areas.filter((a) => a.toLowerCase() === "auth flow").length).toBe(1);
+    });
+    it("trims the 'Finding: ' prefix from labels", () => {
+        const result = makeScanResult({
+            explain: {
+                reasons: [
+                    {
+                        id: "r1",
+                        layer: "security",
+                        title: "Finding: Outdated lodash",
+                        scoreImpact: -20,
+                    },
+                ],
+            },
+        });
+        const areas = selectTopAffectedAreas(result);
+        expect(areas[0]).toBe("Outdated lodash");
+    });
+    it("truncates labels longer than maxLabelLen with ellipsis", () => {
+        const long = "A".repeat(50);
+        const result = makeScanResult({
+            explain: {
+                reasons: [
+                    { id: "r1", layer: "security", title: long, scoreImpact: -10 },
+                ],
+            },
+        });
+        const areas = selectTopAffectedAreas(result, { maxLabelLen: 10 });
+        expect(areas[0].length).toBeLessThanOrEqual(10);
+        expect(areas[0].endsWith("…")).toBe(true);
+    });
+    it("returns empty array when no useful signal at all", () => {
+        // Completely empty scan result with empty layerScores
+        const result = {
+            totalScore: 0,
+            layerScores: {
+                security: 0,
+                maintainability: 0,
+                ecosystem: 0,
+                upgradeImpact: 0,
+            },
+            findings: [],
+            generatedAt: "2026-01-01T00:00:00Z",
+        };
+        // With layer fallback this would return layer names; only truly empty when
+        // caller passes a result without layerScores entirely — validate max guard
+        const areas = selectTopAffectedAreas(result, { max: 3 });
+        expect(areas.length).toBeLessThanOrEqual(3);
+    });
+    it("returns [] when layerScores is missing and no explain/insights", () => {
+        const partial = {
+            totalScore: 10,
+            findings: [],
+            generatedAt: "2026-01-01T00:00:00Z",
+        };
+        expect(selectTopAffectedAreas(partial)).toEqual([]);
+    });
+});

package/dist/trustedScanGuards.d.ts

@@ -0,0 +1,39 @@
+import type { EngineEmittedScanResult, ScanResult } from "./types.js";
+/** True when methodology is tagged as the OSS stub engine. */
+export declare function isStubMethodologyVersion(methodologyVersion: string | undefined): boolean;
+/**
+ * Substrings that must not appear in a trusted GitHub Actions step summary.
+ * Keep literals short and tied to product copy — no dependency-name heuristics.
+ */
+export declare function trustedActionsSummaryDenylistPhrases(): readonly string[];
+/**
+ * Refuse to render a trusted Actions summary when methodology is stub-tagged.
+ * Mirrors legacy render script behavior; use from CLI and CI renderer.
+ */
+export declare function assertTrustedActionsSummaryAllowed(profile: string, methodologyVersion: string | undefined): void;
+/**
+ * Validates scan JSON after a trusted analysis run (CLI / worker boundary).
+ */
+export declare function assertTrustedScanResult(result: ScanResult): void;
+/**
+ * Strict structural validation for fresh engine JSON + trusted policy.
+ * Do not pass historical `scans.result` rows (may omit methodology).
+ */
+export declare function validateTrustedEngineScanResult(raw: unknown): EngineEmittedScanResult;
+export type TrustedActionsAuditResult = {
+    ok: true;
+} | {
+    ok: false;
+    errors: readonly string[];
+};
+/**
+ * Post-render audit for trusted Actions: methodology + explicit wording only.
+ */
+export declare function auditTrustedActionsOutput(opts: {
+    summaryText: string;
+    /** Raw scan JSON (e.g. from disk); validated with strict engine-output schema + trusted policy. */
+    scanResult: unknown;
+    /** When true, require trusted-analysis mode in process.env for this audit. */
+    requireTrustedEnv?: boolean;
+}): TrustedActionsAuditResult;
+//# sourceMappingURL=trustedScanGuards.d.ts.map

package/dist/trustedScanGuards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedScanGuards.d.ts","sourceRoot":"","sources":["../src/trustedScanGuards.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAKtE,8DAA8D;AAC9D,wBAAgB,wBAAwB,CACtC,kBAAkB,EAAE,MAAM,GAAG,SAAS,GACrC,OAAO,CAKT;AAED;;;GAGG;AACH,wBAAgB,oCAAoC,IAAI,SAAS,MAAM,EAAE,CAOxE;AAED;;;GAGG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,MAAM,EACf,kBAAkB,EAAE,MAAM,GAAG,SAAS,GACrC,IAAI,CAMN;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAchE;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,OAAO,GACX,uBAAuB,CAIzB;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAE7C;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,UAAU,EAAE,OAAO,CAAC;IACpB,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,yBAAyB,CAgC5B"}

package/dist/trustedScanGuards.js

@@ -0,0 +1,88 @@
+import { parseEngineOutputScanResultOrThrow } from "./scanResultSchema.js";
+import { scanSurfaceCopy } from "./scanSurfaceCopy.js";
+const STUB_METHODOLOGY = /^engine-stub\//i;
+/** True when methodology is tagged as the OSS stub engine. */
+export function isStubMethodologyVersion(methodologyVersion) {
+    return (methodologyVersion != null &&
+        STUB_METHODOLOGY.test(String(methodologyVersion).trim()));
+}
+/**
+ * Substrings that must not appear in a trusted GitHub Actions step summary.
+ * Keep literals short and tied to product copy — no dependency-name heuristics.
+ */
+export function trustedActionsSummaryDenylistPhrases() {
+    return [
+        scanSurfaceCopy.actions.demoSummaryTitle,
+        scanSurfaceCopy.actions.demoSummaryBanner,
+        "engine-stub/",
+        "engine-stub/v2",
+    ];
+}
+/**
+ * Refuse to render a trusted Actions summary when methodology is stub-tagged.
+ * Mirrors legacy render script behavior; use from CLI and CI renderer.
+ */
+export function assertTrustedActionsSummaryAllowed(profile, methodologyVersion) {
+    const p = String(profile ?? "").trim();
+    if (p !== "trusted")
+        return;
+    if (isStubMethodologyVersion(methodologyVersion)) {
+        throw new Error(scanSurfaceCopy.actions.trustedSummaryStubBlocked);
+    }
+}
+/**
+ * Validates scan JSON after a trusted analysis run (CLI / worker boundary).
+ */
+export function assertTrustedScanResult(result) {
+    if (isStubMethodologyVersion(result.methodologyVersion)) {
+        throw new Error(scanSurfaceCopy.actions.trustedSummaryStubBlocked);
+    }
+    const mv = result.methodologyVersion?.trim();
+    if (!mv) {
+        throw new Error(scanSurfaceCopy.actions.trustedMethodologyMissing);
+    }
+    const prefix = String(process.env.MERGESIGNAL_TRUSTED_METHODOLOGY_PREFIX ?? "").trim();
+    if (prefix && !mv.startsWith(prefix)) {
+        throw new Error(scanSurfaceCopy.actions.trustedMethodologyPolicyMismatch);
+    }
+}
+/**
+ * Strict structural validation for fresh engine JSON + trusted policy.
+ * Do not pass historical `scans.result` rows (may omit methodology).
+ */
+export function validateTrustedEngineScanResult(raw) {
+    const result = parseEngineOutputScanResultOrThrow(raw);
+    assertTrustedScanResult(result);
+    return result;
+}
+/**
+ * Post-render audit for trusted Actions: methodology + explicit wording only.
+ */
+export function auditTrustedActionsOutput(opts) {
+    const errors = [];
+    if (opts.requireTrustedEnv &&
+        process.env.MERGESIGNAL_TRUSTED_ANALYSIS !== "1") {
+        errors.push(scanSurfaceCopy.actions.trustedAuditEnvInvalid);
+    }
+    let scanResult;
+    try {
+        scanResult = validateTrustedEngineScanResult(opts.scanResult);
+    }
+    catch (e) {
+        errors.push(e instanceof Error ? e.message : String(e));
+    }
+    if (scanResult) {
+        const text = opts.summaryText;
+        let denylistHit = false;
+        for (const phrase of trustedActionsSummaryDenylistPhrases()) {
+            if (phrase && text.includes(phrase)) {
+                denylistHit = true;
+                break;
+            }
+        }
+        if (denylistHit) {
+            errors.push(scanSurfaceCopy.actions.trustedSummaryVerificationFailed);
+        }
+    }
+    return errors.length ? { ok: false, errors } : { ok: true };
+}

package/dist/trustedScanGuards.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=trustedScanGuards.test.d.ts.map

package/dist/trustedScanGuards.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedScanGuards.test.d.ts","sourceRoot":"","sources":["../src/trustedScanGuards.test.ts"],"names":[],"mappings":""}

package/dist/trustedScanGuards.test.js

@@ -0,0 +1,143 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { assertTrustedActionsSummaryAllowed, assertTrustedScanResult, auditTrustedActionsOutput, isStubMethodologyVersion, trustedActionsSummaryDenylistPhrases, validateTrustedEngineScanResult, } from "./trustedScanGuards.js";
+import { scanSurfaceCopy } from "./scanSurfaceCopy.js";
+const baseResult = {
+    totalScore: 10,
+    layerScores: {
+        security: 10,
+        maintainability: 10,
+        ecosystem: 10,
+        upgradeImpact: 10,
+    },
+    findings: [],
+    recommendations: [],
+    generatedAt: "2026-01-01T00:00:00.000Z",
+    methodologyVersion: "engine-stub/v2",
+};
+describe("trustedScanGuards", () => {
+    it("detects stub methodology", () => {
+        expect(isStubMethodologyVersion("engine-stub/v2")).toBe(true);
+        expect(isStubMethodologyVersion("Engine-Stub/v1")).toBe(true);
+        expect(isStubMethodologyVersion("acme-engine/v1")).toBe(false);
+        expect(isStubMethodologyVersion(undefined)).toBe(false);
+    });
+    it("denylist includes demo copy", () => {
+        const d = trustedActionsSummaryDenylistPhrases();
+        expect(d).toContain(scanSurfaceCopy.actions.demoSummaryTitle);
+        expect(d).toContain(scanSurfaceCopy.actions.demoSummaryBanner);
+    });
+    it("assertTrustedActionsSummaryAllowed throws for trusted + stub", () => {
+        expect(() => assertTrustedActionsSummaryAllowed("trusted", "engine-stub/v2")).toThrow(/verification requirements/);
+    });
+    it("assertTrustedActionsSummaryAllowed allows trusted + real methodology", () => {
+        expect(() => assertTrustedActionsSummaryAllowed("trusted", "acme-prod/v3")).not.toThrow();
+    });
+    it("assertTrustedActionsSummaryAllowed ignores non-trusted profile", () => {
+        expect(() => assertTrustedActionsSummaryAllowed("development", "engine-stub/v2")).not.toThrow();
+    });
+    describe("assertTrustedScanResult", () => {
+        const originalEnv = process.env;
+        beforeEach(() => {
+            process.env = { ...originalEnv };
+            delete process.env.MERGESIGNAL_TRUSTED_METHODOLOGY_PREFIX;
+        });
+        afterEach(() => {
+            process.env = originalEnv;
+        });
+        it("rejects stub methodology", () => {
+            expect(() => assertTrustedScanResult(baseResult)).toThrow(/verification requirements/);
+        });
+        it("accepts non-stub methodology", () => {
+            expect(() => assertTrustedScanResult({
+                ...baseResult,
+                methodologyVersion: "engine-test-fixture/v1",
+            })).not.toThrow();
+        });
+        it("enforces methodology prefix when env set", () => {
+            process.env.MERGESIGNAL_TRUSTED_METHODOLOGY_PREFIX =
+                "engine-test-fixture/";
+            expect(() => assertTrustedScanResult({
+                ...baseResult,
+                methodologyVersion: "engine-test-fixture/v1",
+            })).not.toThrow();
+            expect(() => assertTrustedScanResult({
+                ...baseResult,
+                methodologyVersion: "other/v1",
+            })).toThrow(/methodology output did not match/);
+        });
+    });
+    describe("validateTrustedEngineScanResult", () => {
+        const originalEnv = process.env;
+        beforeEach(() => {
+            process.env = { ...originalEnv };
+            delete process.env.MERGESIGNAL_TRUSTED_METHODOLOGY_PREFIX;
+        });
+        afterEach(() => {
+            process.env = originalEnv;
+        });
+        it("rejects structurally valid relaxed payload without methodologyVersion", () => {
+            expect(() => validateTrustedEngineScanResult({
+                totalScore: 10,
+                layerScores: {
+                    security: 10,
+                    maintainability: 10,
+                    ecosystem: 10,
+                    upgradeImpact: 10,
+                },
+                findings: [],
+                generatedAt: "2026-01-01T00:00:00.000Z",
+            })).toThrow(/^validation:/);
+        });
+        it("returns result when strict schema and trusted policy pass", () => {
+            const r = validateTrustedEngineScanResult({
+                ...baseResult,
+                methodologyVersion: "acme-prod/v2",
+            });
+            expect(r.methodologyVersion).toBe("acme-prod/v2");
+        });
+    });
+    describe("auditTrustedActionsOutput", () => {
+        it("fails when summary contains demo title", () => {
+            const r = auditTrustedActionsOutput({
+                summaryText: `Hello ${scanSurfaceCopy.actions.demoSummaryTitle} world`,
+                scanResult: {
+                    ...baseResult,
+                    methodologyVersion: "acme/v1",
+                },
+            });
+            expect(r.ok).toBe(false);
+            if (!r.ok)
+                expect(r.errors.length).toBeGreaterThan(0);
+        });
+        it("passes for clean summary and valid methodology", () => {
+            const r = auditTrustedActionsOutput({
+                summaryText: "# MergeSignal\n\nLow risk posture.",
+                scanResult: {
+                    ...baseResult,
+                    methodologyVersion: "acme-prod/v2",
+                },
+            });
+            expect(r).toEqual({ ok: true });
+        });
+        it("fails when scan JSON omits methodology (strict engine contract)", () => {
+            const r = auditTrustedActionsOutput({
+                summaryText: "# MergeSignal\n\nLow risk posture.",
+                scanResult: {
+                    totalScore: 10,
+                    layerScores: {
+                        security: 10,
+                        maintainability: 10,
+                        ecosystem: 10,
+                        upgradeImpact: 10,
+                    },
+                    findings: [],
+                    generatedAt: "2026-01-01T00:00:00.000Z",
+                },
+            });
+            expect(r.ok).toBe(false);
+            if (!r.ok) {
+                expect(r.errors.some((e) => e.startsWith("validation:"))).toBe(true);
+            }
+        });
+    });
+});