test: harden reporting governance surface contracts

plugins/reporting-governance/test/exports-boundary.integration.test.mjs

@@ -71,6 +71,7 @@ test('package root export resolves public package surface only', () => {
         hasPlanDecisionExecution: typeof plugin.planDecisionExecution,
         hasExecuteGovernanceContract: typeof plugin.executeGovernanceContract,
         hasExecuteRuntimeIntegratedGovernance: typeof plugin.executeRuntimeIntegratedGovernance,
+        hasCreateRuntimeBinding: typeof plugin.createRuntimeBinding,
         hasCreateDecisionRecordArtifact: typeof plugin.createDecisionRecordArtifact,
         hasCreateFileDecisionStore: typeof plugin.createFileDecisionStore,
       }));
@@ -85,6 +86,7 @@ test('package root export resolves public package surface only', () => {
     assert.equal(result.hasPlanDecisionExecution, 'function');
     assert.equal(result.hasExecuteGovernanceContract, 'function');
     assert.equal(result.hasExecuteRuntimeIntegratedGovernance, 'function');
+    assert.equal(result.hasCreateRuntimeBinding, 'function');
     assert.equal(result.hasCreateDecisionRecordArtifact, 'function');
     assert.equal(result.hasCreateFileDecisionStore, 'function');
   } finally {
@@ -115,6 +117,36 @@ test('adapters subpath export resolves package-owned adapter entrypoints only',
   }
 });
 
+test('storage/profile-artifact deep subpaths stay outside package exports boundary', () => {
+  const root = createFixtureRoot();
+  try {
+    installPackageAlias(root);
+    const result = runNodeEval(root, `
+      import('@openclaw/plugin-reporting-governance/src/storage/profile-artifact.mjs')
+        .then(() => {
+          process.stdout.write(JSON.stringify({ ok: true }));
+        })
+        .catch((error) => {
+          process.stdout.write(JSON.stringify({
+            ok: false,
+            code: error?.code ?? null,
+            name: error?.name ?? null,
+            message: error?.message ?? null,
+          }));
+        });
+    `);
+
+    assert.equal(result.status, 0, result.stderr);
+    const payload = JSON.parse((result.stdout ?? '').trim());
+    assert.equal(payload.ok, false);
+    assert.equal(payload.code, 'ERR_PACKAGE_PATH_NOT_EXPORTED');
+    assert.equal(payload.name, 'Error');
+    assert.match(payload.message ?? '', /Package subpath '\.\/src\/storage\/profile-artifact\.mjs' is not defined by "exports"/);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test('deep runtime-binding subpath stays outside package exports boundary', () => {
   const root = createFixtureRoot();
   try {