refactor(security): keep scan identity internal

src/gateway/server-methods/plugins.test.ts

@@ -5,10 +5,11 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import type {
   InstallPolicyWarningDetails,
   InstallPolicyWarningOccurrence,
-  InstallPolicyWarningScanIdentity,
 } from "../../plugins/install-security-scan.types.js";
 import type { ManagedPluginSourceInstallRequest } from "../../plugins/management-service.js";
 
+type InstallPolicyWarningScanIdentity = InstallPolicyWarningOccurrence["scan"];
+
 const managementMocks = vi.hoisted(() => {
   class ManagedPluginLifecycleError extends Error {
     readonly kind: "invalid-request" | "unavailable";

src/plugins/install-security-scan.types.ts

@@ -11,7 +11,7 @@ export type InstallPolicyWarningDetails = {
 };
 
 /** Stable policy-stage facts that scope an approval without exposing scan internals to clients. */
-export type InstallPolicyWarningScanIdentity = {
+type InstallPolicyWarningScanIdentity = {
   requestKind: InstallPolicyRequestKind;
   originType: string;
   pluginContentType?: "bundle" | "package" | "file" | "dependency-tree";