@chainlesschain/personal-data-hub 0.4.28 → 0.4.30

package/__tests__/adapters/social-xiaohongshu-adb-sign-provider-injection.test.js

@@ -1,351 +0,0 @@
-"use strict";
-
-/**
- * Phase 6b — verify signProvider injection in XhsApiClient + collector.
- *
- * Tests both paths:
- *  - Bridge path (signedHeaders returns non-empty) → uses bridge headers
- *  - Fallback path (NullSignProvider OR bridge returns {}) → in-process md5
- *
- * Uses a fake fetch + fake signProvider to verify wiring without spawning
- * Electron WebContentsView.
- */
-
-import { describe, it, expect, vi } from "vitest";
-
-const {
-  XhsApiClient,
-} = require("../../lib/adapters/social-xiaohongshu-adb/api-client");
-const {
-  collect,
-} = require("../../lib/adapters/social-xiaohongshu-adb/collector");
-const { NULL_SIGN_PROVIDER } = require("../../lib/sign-providers");
-
-function makeFakeFetch(responses) {
-  const calls = [];
-  const fakeFetch = async (urlStr, opts) => {
-    calls.push({ url: urlStr, opts });
-    for (const [pattern, payload] of responses) {
-      if (urlStr.includes(pattern)) {
-        const resolved =
-          typeof payload === "function" ? await payload(urlStr, opts) : payload;
-        return {
-          ok: resolved.status == null || resolved.status === 200,
-          status: resolved.status || 200,
-          text: async () => resolved.body,
-        };
-      }
-    }
-    throw new Error("fake fetch: no response for " + urlStr);
-  };
-  return { fakeFetch, calls };
-}
-
-const HAPPY_RESPONSES = [
-  [
-    "/user/me",
-    {
-      body: JSON.stringify({
-        code: 0,
-        data: { user_id: "5e8c8f7e", nickname: "Alice" },
-      }),
-    },
-  ],
-  [
-    "user_posted",
-    {
-      body: JSON.stringify({
-        code: 0,
-        data: { notes: [{ note_id: "N1", title: "n", time: 1 }] },
-      }),
-    },
-  ],
-  [
-    "note/like/page",
-    {
-      body: JSON.stringify({
-        code: 0,
-        data: { notes: [{ note_id: "L1", title: "l" }] },
-      }),
-    },
-  ],
-  [
-    "user/follow/list",
-    {
-      body: JSON.stringify({
-        code: 0,
-        data: { users: [{ user_id: "U1", nickname: "x" }] },
-      }),
-    },
-  ],
-];
-
-// ─── XhsApiClient direct injection ──────────────────────────────────────
-
-describe("XhsApiClient — signProvider injection", () => {
-  it("defaults to NULL_SIGN_PROVIDER when no opts.signProvider", () => {
-    const client = new XhsApiClient({ fetch: () => {} });
-    expect(client.signProvider).toBe(NULL_SIGN_PROVIDER);
-  });
-
-  it("uses opts.signProvider verbatim when provided", () => {
-    const fakeProvider = { signedHeaders: vi.fn(async () => ({})) };
-    const client = new XhsApiClient({
-      fetch: () => {},
-      signProvider: fakeProvider,
-    });
-    expect(client.signProvider).toBe(fakeProvider);
-  });
-
-  it("falls back to in-process md5 when provider returns {}", async () => {
-    const { fakeFetch, calls } = makeFakeFetch(HAPPY_RESPONSES);
-    const fakeProvider = { signedHeaders: vi.fn(async () => ({})) };
-    const client = new XhsApiClient({
-      fetch: fakeFetch,
-      signProvider: fakeProvider,
-    });
-    await client.fetchNotes("a1=fp; web_session=s", "fp", "5e8c8f7e");
-    const notesCall = calls.find((c) => c.url.includes("user_posted"));
-    // Fallback used → in-process X-S/X-T headers should be set
-    expect(notesCall.opts.headers["X-S"]).toMatch(/^XYW_/);
-    expect(notesCall.opts.headers["X-T"]).toMatch(/^\d+$/);
-    expect(client._bridgeHits).toBe(0);
-    expect(client._fallbackHits).toBe(1);
-  });
-
-  it("uses bridge headers when provider returns non-empty", async () => {
-    const { fakeFetch, calls } = makeFakeFetch(HAPPY_RESPONSES);
-    const fakeProvider = {
-      signedHeaders: vi.fn(async () => ({
-        "X-s": "XYW_bridge_value",
-        "X-t": "1716383021000",
-        "X-s-common": "common_value",
-      })),
-    };
-    const client = new XhsApiClient({
-      fetch: fakeFetch,
-      signProvider: fakeProvider,
-    });
-    await client.fetchNotes("a1=fp; web_session=s", "fp", "5e8c8f7e");
-    const notesCall = calls.find((c) => c.url.includes("user_posted"));
-    expect(notesCall.opts.headers["X-s"]).toBe("XYW_bridge_value");
-    expect(notesCall.opts.headers["X-t"]).toBe("1716383021000");
-    expect(notesCall.opts.headers["X-s-common"]).toBe("common_value");
-    // Bridge headers used — no fallback X-S/X-T injected
-    expect(notesCall.opts.headers["X-S"]).toBeUndefined();
-    expect(client._bridgeHits).toBe(1);
-    expect(client._fallbackHits).toBe(0);
-  });
-
-  it("does NOT call signedHeaders for /user/me (no X-S required)", async () => {
-    const { fakeFetch } = makeFakeFetch(HAPPY_RESPONSES);
-    const fakeProvider = { signedHeaders: vi.fn(async () => ({})) };
-    const client = new XhsApiClient({
-      fetch: fakeFetch,
-      signProvider: fakeProvider,
-    });
-    await client.fetchMe("a1=fp; web_session=s");
-    expect(fakeProvider.signedHeaders).not.toHaveBeenCalled();
-  });
-
-  it("calls signedHeaders for fetchNotes / fetchLiked / fetchFollows", async () => {
-    const { fakeFetch } = makeFakeFetch(HAPPY_RESPONSES);
-    const fakeProvider = { signedHeaders: vi.fn(async () => ({})) };
-    const client = new XhsApiClient({
-      fetch: fakeFetch,
-      signProvider: fakeProvider,
-    });
-    await client.fetchNotes("a1=fp; web_session=s", "fp", "5e8c8f7e");
-    await client.fetchLiked("a1=fp; web_session=s", "fp");
-    await client.fetchFollows("a1=fp; web_session=s", "fp", "5e8c8f7e");
-    expect(fakeProvider.signedHeaders).toHaveBeenCalledTimes(3);
-  });
-
-  it("forwards `<path>|` as purpose to signedHeaders", async () => {
-    const { fakeFetch } = makeFakeFetch(HAPPY_RESPONSES);
-    const fakeProvider = { signedHeaders: vi.fn(async () => ({})) };
-    const client = new XhsApiClient({
-      fetch: fakeFetch,
-      signProvider: fakeProvider,
-    });
-    await client.fetchNotes("a1=fp; web_session=s", "fp", "5e8c8f7e");
-    const [, purpose] = fakeProvider.signedHeaders.mock.calls[0];
-    expect(purpose).toMatch(/^\/api\/sns\/web\/v2\/user_posted.*\|$/);
-  });
-});
-
-// ─── collector lifecycle ────────────────────────────────────────────────
-
-describe("collector — signProvider lifecycle", () => {
-  it("warms up bridge before X-S endpoints", async () => {
-    const { fakeFetch } = makeFakeFetch(HAPPY_RESPONSES);
-    const apiClient = new XhsApiClient({ fetch: fakeFetch });
-    const warmedUp = [];
-    const fakeProvider = {
-      warmUp: vi.fn(async (cookie) => warmedUp.push(cookie)),
-      signedHeaders: vi.fn(async () => ({})),
-      shutdown: vi.fn(async () => {}),
-    };
-    const bridge = {
-      invoke: vi.fn(async () => ({
-        cookie: "a1=fp; web_session=s",
-        a1: "fp",
-        diagnostic: {},
-      })),
-    };
-    await collect(bridge, {
-      apiClient,
-      signProvider: fakeProvider,
-      stagingDir: require("node:os").tmpdir(),
-    });
-    expect(fakeProvider.warmUp).toHaveBeenCalledOnce();
-    expect(warmedUp[0]).toBe("a1=fp; web_session=s");
-  });
-
-  it("shuts down bridge in finally — happy path", async () => {
-    const { fakeFetch } = makeFakeFetch(HAPPY_RESPONSES);
-    const apiClient = new XhsApiClient({ fetch: fakeFetch });
-    const fakeProvider = {
-      warmUp: vi.fn(async () => {}),
-      signedHeaders: vi.fn(async () => ({})),
-      shutdown: vi.fn(async () => {}),
-    };
-    const bridge = {
-      invoke: vi.fn(async () => ({
-        cookie: "a1=fp; web_session=s",
-        a1: "fp",
-        diagnostic: {},
-      })),
-    };
-    await collect(bridge, {
-      apiClient,
-      signProvider: fakeProvider,
-      stagingDir: require("node:os").tmpdir(),
-    });
-    expect(fakeProvider.shutdown).toHaveBeenCalledOnce();
-  });
-
-  it("shuts down bridge in finally — even on fetchMe failure", async () => {
-    const { fakeFetch } = makeFakeFetch([
-      ["/user/me", { body: JSON.stringify({ code: 0, data: {} }) }],
-    ]);
-    const apiClient = new XhsApiClient({ fetch: fakeFetch });
-    const fakeProvider = {
-      warmUp: vi.fn(async () => {}),
-      signedHeaders: vi.fn(async () => ({})),
-      shutdown: vi.fn(async () => {}),
-    };
-    const bridge = {
-      invoke: vi.fn(async () => ({
-        cookie: "a1=fp; web_session=s",
-        a1: "fp",
-        diagnostic: {},
-      })),
-    };
-    const result = await collect(bridge, {
-      apiClient,
-      signProvider: fakeProvider,
-      stagingDir: require("node:os").tmpdir(),
-    });
-    expect(result.meFetchFailed).toBe(true);
-    expect(fakeProvider.shutdown).toHaveBeenCalledOnce();
-  });
-
-  it("tolerates warmUp throw (falls back to in-process md5)", async () => {
-    const { fakeFetch } = makeFakeFetch(HAPPY_RESPONSES);
-    const fakeProvider = {
-      warmUp: vi.fn(async () => {
-        throw new Error("xhs.com 403 — anti-bot blocked");
-      }),
-      signedHeaders: vi.fn(async () => ({})),
-      shutdown: vi.fn(async () => {}),
-    };
-    // Inject same provider into the apiClient too — real wiring path
-    // creates them together inside collector.
-    const apiClient = new XhsApiClient({
-      fetch: fakeFetch,
-      signProvider: fakeProvider,
-    });
-    const bridge = {
-      invoke: vi.fn(async () => ({
-        cookie: "a1=fp; web_session=s",
-        a1: "fp",
-        diagnostic: {},
-      })),
-    };
-    const result = await collect(bridge, {
-      apiClient,
-      signProvider: fakeProvider,
-      stagingDir: require("node:os").tmpdir(),
-    });
-    // Sync proceeded — fallback md5 used instead of bridge for all 3
-    // X-S endpoints (bridge.signedHeaders returns {} so client falls
-    // back). Note lastErrorCode gets cleared by successful subsequent
-    // fetchMe so we check _fallbackHits instead.
-    expect(result.meFetchFailed).toBe(false);
-    expect(apiClient._fallbackHits).toBeGreaterThanOrEqual(3);
-    expect(apiClient._bridgeHits).toBe(0);
-    // shutdown still runs in finally
-    expect(fakeProvider.shutdown).toHaveBeenCalledOnce();
-  });
-
-  it("reports signProvider diagnostic in collect result", async () => {
-    const { fakeFetch } = makeFakeFetch(HAPPY_RESPONSES);
-    // Subclass to control constructor.name (vitest mocks can't override it
-    // on plain object literals — constructor.name is read-only on Object).
-    class XhsSignBridge {
-      constructor() {
-        this.warmUp = vi.fn(async () => {});
-        this.signedHeaders = vi.fn(async () => ({
-          "X-s": "bridge",
-          "X-t": "1",
-          "X-s-common": "c",
-        }));
-        this.shutdown = vi.fn(async () => {});
-      }
-    }
-    const fakeProvider = new XhsSignBridge();
-    const apiClient = new XhsApiClient({
-      fetch: fakeFetch,
-      signProvider: fakeProvider,
-    });
-    const bridge = {
-      invoke: vi.fn(async () => ({
-        cookie: "a1=fp; web_session=s",
-        a1: "fp",
-        diagnostic: {},
-      })),
-    };
-    const result = await collect(bridge, {
-      apiClient,
-      signProvider: fakeProvider,
-      stagingDir: require("node:os").tmpdir(),
-    });
-    expect(result.signProviderUsed).toBe("XhsSignBridge");
-    expect(result.signProviderHits).toBe(3); // 3 X-S endpoints all hit bridge
-    expect(result.signProviderFallbacks).toBe(0);
-  });
-
-  it("undefined signProvider → no warmUp/shutdown, fallback md5 used", async () => {
-    const { fakeFetch } = makeFakeFetch(HAPPY_RESPONSES);
-    // Pre-construct apiClient with fakeFetch but no signProvider — client
-    // defaults to NULL_SIGN_PROVIDER which returns {} from signedHeaders.
-    const apiClient = new XhsApiClient({ fetch: fakeFetch });
-    const bridge = {
-      invoke: vi.fn(async () => ({
-        cookie: "a1=fp; web_session=s",
-        a1: "fp",
-        diagnostic: {},
-      })),
-    };
-    const result = await collect(bridge, {
-      apiClient,
-      stagingDir: require("node:os").tmpdir(),
-    });
-    // No bridge → in-process fallback throughout
-    expect(result.signProviderUsed).toBe("none");
-    expect(result.signProviderHits).toBe(0);
-    // 3 X-S endpoints called fallback md5 each
-    expect(result.signProviderFallbacks).toBeGreaterThanOrEqual(3);
-  });
-});

package/__tests__/adapters/social-xiaohongshu-adb-sign.test.js

@@ -1,130 +0,0 @@
-"use strict";
-
-import { describe, it, expect } from "vitest";
-
-const {
-  computeXsXt,
-  extractA1,
-  XS_PREFIX,
-} = require("../../lib/adapters/social-xiaohongshu-adb/sign");
-
-// ─── computeXsXt ────────────────────────────────────────────────────────
-
-describe("computeXsXt — X-S signature byte-parity check", () => {
-  it("produces stable XYW_ prefix + base64 md5 hex", () => {
-    const result = computeXsXt(
-      "/api/sns/web/v1/user/me",
-      null,
-      "18d6e123abc",
-      { now: () => 1716383021000 },
-    );
-    expect(result.xs).toMatch(/^XYW_[A-Za-z0-9+/]+$/);
-    expect(result.xs).not.toMatch(/=$/); // no padding
-    expect(result.xt).toBe("1716383021000");
-  });
-
-  it("byte-parity golden vector from Kotlin reference", () => {
-    // Reproduce: md5("1716383021000" + "url=/api/sns/web/v1/user/me" + "test_a1")
-    //   .toUtf8Bytes().base64() with NO_PADDING + NO_WRAP
-    // Computed via node:crypto cross-check; this is the exact value
-    // Kotlin XhsApiClient.kt:computeXsXt produces for the same inputs.
-    const result = computeXsXt(
-      "/api/sns/web/v1/user/me",
-      null,
-      "test_a1",
-      { now: () => 1716383021000 },
-    );
-    // The actual md5 hex of "1716383021000url=/api/sns/web/v1/user/me" + "test_a1":
-    // npm crypto md5 → "9b6e0a..." (varies); base64 of that hex string
-    // Lock the value computed by this very module so future changes are
-    // caught.
-    expect(result.xs).toBe(
-      "XYW_" +
-        Buffer.from(
-          require("node:crypto")
-            .createHash("md5")
-            .update("1716383021000url=/api/sns/web/v1/user/metest_a1", "utf8")
-            .digest("hex"),
-          "utf8",
-        )
-          .toString("base64")
-          .replace(/=+$/, ""),
-    );
-  });
-
-  it("includes body in payload (POST case)", () => {
-    const noBody = computeXsXt("/api/x", null, "a1", { now: () => 1000 });
-    const withBody = computeXsXt("/api/x", '{"foo":1}', "a1", {
-      now: () => 1000,
-    });
-    expect(noBody.xs).not.toBe(withBody.xs);
-  });
-
-  it("different ts → different X-S", () => {
-    const r1 = computeXsXt("/api/x", null, "a1", { now: () => 1000 });
-    const r2 = computeXsXt("/api/x", null, "a1", { now: () => 2000 });
-    expect(r1.xs).not.toBe(r2.xs);
-    expect(r1.xt).toBe("1000");
-    expect(r2.xt).toBe("2000");
-  });
-
-  it("different a1 → different X-S", () => {
-    const r1 = computeXsXt("/api/x", null, "a1_v1", { now: () => 1000 });
-    const r2 = computeXsXt("/api/x", null, "a1_v2", { now: () => 1000 });
-    expect(r1.xs).not.toBe(r2.xs);
-  });
-
-  it("rejects empty / non-string urlPathWithQuery", () => {
-    expect(() => computeXsXt("", null, "a1")).toThrow(TypeError);
-    expect(() => computeXsXt(null, null, "a1")).toThrow(TypeError);
-  });
-
-  it("rejects empty / non-string a1", () => {
-    expect(() => computeXsXt("/x", null, "")).toThrow(TypeError);
-    expect(() => computeXsXt("/x", null, null)).toThrow(TypeError);
-  });
-
-  it("XS_PREFIX export = 'XYW_'", () => {
-    expect(XS_PREFIX).toBe("XYW_");
-  });
-});
-
-// ─── extractA1 ──────────────────────────────────────────────────────────
-
-describe("extractA1", () => {
-  it("extracts a1 from full xhs cookie", () => {
-    const cookie =
-      "web_session=session_token; a1=18d6e1234567890abcdef; xsec_token=xxx";
-    expect(extractA1(cookie)).toBe("18d6e1234567890abcdef");
-  });
-
-  it("handles a1 as first cookie field", () => {
-    expect(extractA1("a1=fingerprint_value; web_session=s")).toBe(
-      "fingerprint_value",
-    );
-  });
-
-  it("handles a1 as last cookie field", () => {
-    expect(extractA1("web_session=s; a1=fingerprint_value")).toBe(
-      "fingerprint_value",
-    );
-  });
-
-  it("returns null when a1 missing", () => {
-    expect(extractA1("web_session=s; xsec_token=t")).toBe(null);
-  });
-
-  it("returns null when a1 empty", () => {
-    expect(extractA1("a1=; web_session=s")).toBe(null);
-  });
-
-  it("returns null for non-string / null", () => {
-    expect(extractA1(null)).toBe(null);
-    expect(extractA1(undefined)).toBe(null);
-    expect(extractA1(123)).toBe(null);
-  });
-
-  it("trims whitespace around cookie parts", () => {
-    expect(extractA1("web_session=s ;  a1=val  ; xsec=x")).toBe("val");
-  });
-});

package/__tests__/adapters/social-xiaohongshu-adb-snapshot-builder.test.js

@@ -1,200 +0,0 @@
-"use strict";
-
-import { describe, it, expect } from "vitest";
-const fs = require("node:fs");
-const path = require("node:path");
-const os = require("node:os");
-
-const {
-  buildSnapshot,
-  writeSnapshotJson,
-  cleanupSnapshotJson,
-  SNAPSHOT_SCHEMA_VERSION,
-} = require("../../lib/adapters/social-xiaohongshu-adb/snapshot-builder");
-
-describe("SNAPSHOT_SCHEMA_VERSION", () => {
-  it("is 1 (matches existing social-xiaohongshu adapter)", () => {
-    expect(SNAPSHOT_SCHEMA_VERSION).toBe(1);
-  });
-});
-
-describe("buildSnapshot", () => {
-  it("throws on missing / empty userId", () => {
-    expect(() => buildSnapshot({})).toThrow(/userId must be a non-empty string/);
-    expect(() => buildSnapshot({ userId: "" })).toThrow(
-      /userId must be a non-empty string/,
-    );
-    expect(() => buildSnapshot(null)).toThrow(TypeError);
-  });
-
-  it("keeps account.userId as string passthrough (xhs uid is NOT numeric)", () => {
-    const snap = buildSnapshot({
-      userId: "5e8c8f7e000000000100abcd",
-      nickname: "Alice",
-      snapshottedAt: 1716383021000,
-    });
-    expect(snap.schemaVersion).toBe(1);
-    expect(snap.snapshottedAt).toBe(1716383021000);
-    expect(snap.account).toEqual({
-      userId: "5e8c8f7e000000000100abcd",
-      nickname: "Alice",
-    });
-    expect(snap.events).toEqual([]);
-  });
-
-  it("defaults nickname to empty string", () => {
-    const snap = buildSnapshot({ userId: "U1" });
-    expect(snap.account.nickname).toBe("");
-  });
-
-  it("emits note events with metadata + createdAt", () => {
-    const snap = buildSnapshot({
-      userId: "U1",
-      snapshottedAt: 1716000000000,
-      notes: [
-        {
-          noteId: "N1",
-          title: "Note one",
-          desc: "d",
-          type: "video",
-          createdAt: 1700000000000,
-          likedCount: 12000,
-          collectedCount: 100000,
-          commentCount: 234,
-        },
-      ],
-    });
-    const n = snap.events.filter((e) => e.kind === "note");
-    expect(n).toHaveLength(1);
-    expect(n[0]).toEqual({
-      kind: "note",
-      id: "note-N1",
-      capturedAt: 1700000000000,
-      noteId: "N1",
-      title: "Note one",
-      desc: "d",
-      type: "video",
-      likedCount: 12000,
-      collectedCount: 100000,
-      commentCount: 234,
-    });
-  });
-
-  it("falls back to index id + snapshottedAt when note lacks noteId/createdAt", () => {
-    const snap = buildSnapshot({
-      userId: "U1",
-      snapshottedAt: 1716000000000,
-      notes: [{ title: "no id" }],
-    });
-    const n = snap.events[0];
-    expect(n.id).toBe("note-0");
-    expect(n.noteId).toBe(null);
-    expect(n.capturedAt).toBe(1716000000000);
-    expect(n.type).toBe("normal");
-    expect(n.likedCount).toBe(0);
-  });
-
-  it("emits liked events pinned to snapshottedAt (xhs has no liked_at)", () => {
-    const snap = buildSnapshot({
-      userId: "U1",
-      snapshottedAt: 1716100000000,
-      liked: [
-        { noteId: "L1", title: "Liked one", authorNickname: "AuthorX" },
-      ],
-    });
-    const l = snap.events.filter((e) => e.kind === "liked");
-    expect(l).toHaveLength(1);
-    expect(l[0]).toEqual({
-      kind: "liked",
-      id: "liked-L1",
-      capturedAt: 1716100000000,
-      noteId: "L1",
-      title: "Liked one",
-      authorNickname: "AuthorX",
-    });
-  });
-
-  it("emits follow events keyed by followed userId", () => {
-    const snap = buildSnapshot({
-      userId: "U1",
-      snapshottedAt: 1716200000000,
-      follows: [
-        { userId: "F1", nickname: "FollowOne", image: "https://a/f1.jpg" },
-      ],
-    });
-    const f = snap.events.filter((e) => e.kind === "follow");
-    expect(f).toHaveLength(1);
-    expect(f[0]).toEqual({
-      kind: "follow",
-      id: "follow-F1",
-      capturedAt: 1716200000000,
-      userId: "F1",
-      nickname: "FollowOne",
-      image: "https://a/f1.jpg",
-    });
-  });
-
-  it("skips non-object entries but keeps the rest", () => {
-    const snap = buildSnapshot({
-      userId: "U1",
-      notes: [null, "junk", { noteId: "OK" }],
-      liked: [undefined],
-      follows: [42],
-    });
-    expect(snap.events).toHaveLength(1);
-    expect(snap.events[0].id).toBe("note-OK");
-  });
-
-  it("emits all 3 kinds at once", () => {
-    const snap = buildSnapshot({
-      userId: "U1",
-      notes: [{ noteId: "N1" }],
-      liked: [{ noteId: "L1" }],
-      follows: [{ userId: "F1" }],
-    });
-    expect(snap.events.map((e) => e.kind).sort()).toEqual([
-      "follow",
-      "liked",
-      "note",
-    ]);
-  });
-
-  it("defaults snapshottedAt to now when invalid", () => {
-    const before = Date.now();
-    const snap = buildSnapshot({ userId: "U1", snapshottedAt: -5 });
-    expect(snap.snapshottedAt).toBeGreaterThanOrEqual(before);
-  });
-});
-
-describe("writeSnapshotJson + cleanupSnapshotJson", () => {
-  it("writes valid JSON roundtrip", () => {
-    const snap = buildSnapshot({ userId: "U1", nickname: "A" });
-    const full = writeSnapshotJson(snap);
-    try {
-      expect(fs.existsSync(full)).toBe(true);
-      const round = JSON.parse(fs.readFileSync(full, "utf-8"));
-      expect(round.account.userId).toBe("U1");
-      expect(round.schemaVersion).toBe(1);
-    } finally {
-      cleanupSnapshotJson(full);
-      expect(fs.existsSync(full)).toBe(false);
-    }
-  });
-
-  it("rejects fileName with path separator", () => {
-    const snap = buildSnapshot({ userId: "U1" });
-    expect(() =>
-      writeSnapshotJson(snap, { fileName: "../escape.json" }),
-    ).toThrow(/basename, not a path/);
-    expect(() =>
-      writeSnapshotJson(snap, { fileName: "sub\\escape.json" }),
-    ).toThrow(/basename, not a path/);
-  });
-
-  it("cleanup tolerates null / missing file", () => {
-    expect(() => cleanupSnapshotJson(null)).not.toThrow();
-    expect(() =>
-      cleanupSnapshotJson(path.join(os.tmpdir(), "nonexistent-xhs.json")),
-    ).not.toThrow();
-  });
-});