@chainlesschain/personal-data-hub 0.4.29 → 0.4.31

package/lib/forensics/qq-nt-collect.js

@@ -0,0 +1,190 @@
+'use strict';
+/**
+ * qq-nt-collect — on-device-ready QQNT (nt_msg.db) decrypt + protobuf-parse.
+ *
+ * Pure Node (crypto + a caller-provided better-sqlite3 ctor) — NO frida, NO adb.
+ * This is the bundle-shipped core behind `cc hub collect-qq`, which the Android
+ * `CollectQqNativeTool` invokes after su-staging the encrypted DB + uid list. The
+ * exact same logic runs on PC (USB pull) and on-device (app su-read).
+ *
+ * Method (key DERIVED, no frida): `key = MD5(MD5(uid) + rand)` → SQLCipher
+ * PBKDF2-HMAC-SHA512/1 (iter 4000) → AES-256-CBC. `rand` is read from the 1024-byte
+ * plaintext header; `uid` (QQNT `u_...`) is brute-forced from candidates — page 1
+ * decrypting to a valid SQLite header identifies the self uid. (See
+ * scripts/android/pdh-qq-android-decrypt.mjs for the standalone PC tool this was
+ * extracted from; behaviour is byte-identical.)
+ */
+const crypto = require('crypto');
+const md5 = (s) => crypto.createHash('md5').update(s).digest('hex');
+
+/** Read `rand` (protobuf field after "QQ_NT DB") from the plaintext header. */
+function extractRand(raw) {
+  const head = raw.subarray(0, 256).toString('latin1');
+  const i = head.indexOf('QQ_NT DB');
+  if (i < 0) return null;
+  const m = head.slice(i + 8, i + 40).match(/[A-Za-z0-9]{6,12}/);
+  return m ? m[0] : null;
+}
+
+/** Detect HMAC algo named in the header (informational). */
+function headerHmac(raw) {
+  return (/HMAC_SHA\d+/.exec(raw.subarray(0, 256).toString('latin1')) || [])[0] || null;
+}
+
+// decrypt one page slice. p1=true → page 1 (first 16 bytes = salt, skipped).
+function decPage(page, encKey, reserve, ivOff, p1) {
+  const ro = page.length - reserve;
+  const ct = page.subarray(p1 ? 16 : 0, ro);
+  const iv = page.subarray(ro + ivOff, ro + ivOff + 16);
+  if (iv.length < 16) return null;
+  try {
+    const d = crypto.createDecipheriv('aes-256-cbc', encKey, iv);
+    d.setAutoPadding(false);
+    return Buffer.concat([d.update(ct), d.final()]);
+  } catch {
+    return null;
+  }
+}
+const validHdr = (pt) => pt && pt.length > 8 && pt[5] === 64 && pt[6] === 32 && pt[7] === 32;
+const CFG = [[4096, 48, 0], [4096, 80, 0], [4096, 48, 20]];
+
+/**
+ * Brute the key over uid candidates, then decrypt every page.
+ * @returns {{decrypted: Buffer, uid: string, kdf: string}|null} null = no uid matched.
+ */
+function deriveAndDecrypt(raw, uids, rand) {
+  if (!raw || raw.length <= 1024 || !rand || !uids || !uids.length) return null;
+  const body = raw.subarray(1024);
+  const salt = body.subarray(0, 16);
+  let hit = null;
+  for (const uid of uids) {
+    const pass = md5(md5(uid) + rand);
+    for (const algo of ['sha512', 'sha1']) {
+      const ek = crypto.pbkdf2Sync(Buffer.from(pass, 'utf8'), salt, 4000, 32, algo);
+      for (const [pg, rs, iv] of CFG) {
+        if (validHdr(decPage(body.subarray(0, pg), ek, rs, iv, true))) {
+          hit = { uid, algo, page: pg, reserve: rs, ivOff: iv, ek };
+          break;
+        }
+      }
+      if (hit) break;
+    }
+    if (hit) break;
+  }
+  if (!hit) return null;
+  const { ek, page, reserve, ivOff } = hit;
+  const n = Math.floor(body.length / page);
+  const out = [];
+  for (let i = 0; i < n; i++) {
+    const pt = decPage(body.subarray(i * page, (i + 1) * page), ek, reserve, ivOff, i === 0);
+    const full = Buffer.alloc(page);
+    if (i === 0) {
+      Buffer.from('SQLite format 3\0').copy(full, 0);
+      if (pt) pt.copy(full, 16);
+    } else if (pt) {
+      pt.copy(full, 0);
+    }
+    out.push(full);
+  }
+  return { decrypted: Buffer.concat(out), uid: hit.uid, kdf: hit.algo };
+}
+
+// ── protobuf message-body → readable text (from pdh-qq-ingest.mjs) ──────────
+function readVarint(buf, p) {
+  let shift = 0, r = 0n;
+  while (p < buf.length) {
+    const b = buf[p++];
+    r |= BigInt(b & 0x7f) << BigInt(shift);
+    if (!(b & 0x80)) break;
+    shift += 7;
+  }
+  return [r, p];
+}
+function* fields(buf) {
+  let p = 0;
+  while (p < buf.length) {
+    let tag;[tag, p] = readVarint(buf, p); tag = Number(tag);
+    const wire = tag & 7;
+    if (wire === 0) { let v;[v, p] = readVarint(buf, p); } else if (wire === 2) {
+      let len;[len, p] = readVarint(buf, p); len = Number(len);
+      const data = buf.subarray(p, p + len); p += len; yield data;
+    } else if (wire === 5) p += 4; else if (wire === 1) p += 8; else return;
+  }
+}
+const readable = (s) => s && /[一-鿿　-ヿA-Za-z0-9]/.test(s) && !/[�]/.test(s) &&
+  [...s].every((c) => c.charCodeAt(0) >= 32 || c === '\n');
+function extractTexts(buf, depth, out) {
+  if (depth > 6 || !buf || buf.length === 0) return;
+  for (const data of fields(buf)) {
+    if (!data || data.length === 0) continue;
+    let s = null; try { s = data.toString('utf8'); } catch {}
+    if (s && Buffer.from(s, 'utf8').equals(data) && readable(s) && s.length <= 1000 &&
+      !/^https?:\/\/\S+$/.test(s)) out.push(s);
+    if (data.length >= 2) extractTexts(data, depth + 1, out);
+  }
+}
+function bodyText(blob) {
+  if (!Buffer.isBuffer(blob)) return null;
+  const out = []; extractTexts(blob, 0, out);
+  const cjk = out.filter((t) => /[一-鿿]/.test(t)).sort((a, b) => b.length - a.length);
+  return cjk[0] || out.sort((a, b) => b.length - a.length)[0] || null;
+}
+
+/**
+ * Parse a DECRYPTED nt_msg.db into vault events (qq-pc adapter shape).
+ * @param Database  a better-sqlite3 constructor (injected by the caller/bundle)
+ * @param dbPath    path to the decrypted nt_msg.db
+ * @param self      the user's own QQ number (attribution fallback)
+ * @returns {Array} event objects ready for vault.putEvent
+ */
+function parseEvents(Database, dbPath, self) {
+  const src = new Database(dbPath, { readonly: true });
+  const events = [];
+  const num = (v) => (typeof v === 'bigint' ? Number(v) : v);
+  const ingestTable = (table, isGroup) => {
+    let rows;
+    try {
+      rows = src.prepare(
+        `SELECT [40001] msgId,[40020] uid,[40011] type,[40033] sender,[40021] peer,` +
+        `[40050] t,[40800] body FROM ${table}`,
+      ).safeIntegers().all();
+    } catch { return; }
+    for (const r of rows) {
+      const type = num(r.type);
+      if (type === 5 || type === 9) continue; // grey-bar / system
+      const text = bodyText(r.body);
+      if (!text || !/[一-鿿A-Za-z0-9]/.test(text)) continue;
+      // QQ service/gray-tip config messages (e.g. com.tencent.* push configs) —
+      // not real chat; drop so the vault holds conversation, not service noise.
+      if (text.includes('com.tencent.') || text.includes('public desc')) continue;
+      const msgId = typeof r.msgId === 'bigint' ? r.msgId.toString() : String(r.msgId);
+      const sender = String(num(r.sender) || '');
+      const peer = String(num(r.peer) || '');
+      const occurredAt = num(r.t) * 1000;
+      if (!occurredAt) continue;
+      const actor = sender ? `person-qq-${sender}` : `person-qq-${self}`;
+      const participants = [actor];
+      participants.push(isGroup ? `group-qq-${peer}` : `person-qq-${peer}`);
+      events.push({
+        type: 'event', subtype: 'message', id: `qq:${table}:${msgId}`,
+        occurredAt, actor, participants,
+        content: { text: isGroup ? `[群${peer}] ${text}` : text },
+        topics: isGroup ? [`group-qq-${peer}`] : undefined,
+        source: {
+          adapter: 'qq-pc', adapterVersion: '0.1.0', originalId: `${table}:${msgId}`,
+          capturedAt: occurredAt, capturedBy: 'sqlite',
+        },
+        ingestedAt: Date.now(),
+      });
+    }
+  };
+  try {
+    ingestTable('c2c_msg_table', false);
+    ingestTable('group_msg_table', true);
+  } finally {
+    src.close();
+  }
+  return events;
+}
+
+module.exports = { extractRand, headerHmac, deriveAndDecrypt, bodyText, parseEvents };

package/lib/prompt-builder.js

@@ -48,11 +48,25 @@ const CROSS_APP_HEADER = "CROSS_APP_OVERVIEW (跨 app 汇聚画像 — 各 app
  * Trim an event down to the fields the LLM actually needs. Saves tokens +
  * reduces prompt injection surface (no raw `extra` blob).
  */
+// Local-time "YYYY-MM-DD HH:mm" for the LLM. Passing the raw epoch-ms integer
+// (e.g. 1781706182375) made the model unreliable on "when did I…" questions —
+// it can't dependably convert epoch ms to a date. buildPrompt runs on the
+// user's own machine (cc hub / desktop), so local getters are the user's TZ.
+function fmtLocalDateTime(ms) {
+  const d = new Date(ms);
+  if (!Number.isFinite(d.getTime())) return null;
+  const p = (n) => String(n).padStart(2, "0");
+  return (
+    `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ` +
+    `${p(d.getHours())}:${p(d.getMinutes())}`
+  );
+}
+
 function summarizeEvent(e) {
   const out = {
     id: e.id,
     type: e.subtype,
-    at: e.occurredAt,
+    at: fmtLocalDateTime(e.occurredAt) || e.occurredAt,
     source: e.source && e.source.adapter,
   };
   if (e.actor) out.actor = e.actor;

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "@chainlesschain/personal-data-hub",
-  "version": "0.4.29",
+  "version": "0.4.31",
   "description": "Personal Data Hub — UnifiedSchema + validators + KG ingest helpers for the data-back-to-the-individual middleware",
   "type": "commonjs",
   "main": "lib/index.js",
+  "files": [
+    "lib/"
+  ],
   "exports": {
     ".": "./lib/index.js",
     "./constants": "./lib/constants.js",
@@ -70,7 +73,8 @@
     "./adapters/messaging-whatsapp": "./lib/adapters/messaging-whatsapp/index.js",
     "./sidecar": "./lib/sidecar/index.js",
     "./forensics/leaf-salvage": "./lib/forensics/leaf-salvage.js",
-    "./forensics/salvage-ingest": "./lib/forensics/salvage-ingest.js"
+    "./forensics/salvage-ingest": "./lib/forensics/salvage-ingest.js",
+    "./forensics/qq-nt-collect": "./lib/forensics/qq-nt-collect.js"
   },
   "scripts": {
     "test": "vitest run",
@@ -101,7 +105,8 @@
   "optionalDependencies": {
     "imapflow": "^1.0.183",
     "adm-zip": "^0.5.16",
-    "iconv-lite": "^0.6.3"
+    "iconv-lite": "^0.6.3",
+    "pdf-parse": "^1.1.1"
   },
   "devDependencies": {
     "vitest": "^4.1.5"

package/__tests__/adapter-guide.test.js

@@ -1,47 +0,0 @@
-"use strict";
-
-import { describe, it, expect } from "vitest";
-
-const { getAdapterGuide, ADAPTER_OVERRIDES } = require("../lib/adapter-guide");
-
-describe("adapter-guide", () => {
-  it("wechat-pc guide reflects the 4.0 one-click reality (no manual PyWxDump as primary)", () => {
-    const g = getAdapterGuide("wechat-pc", "device");
-    // primary method is the automatic one-click, not manual decryption
-    const primary = g.methods[0];
-    expect(primary.recommended).toBe(true);
-    expect(primary.label).toMatch(/一键|自动/);
-    expect(primary.steps.join(" ")).toMatch(/一键采集|自动/);
-    // summary mentions the full coverage we now capture
-    expect(g.summary).toMatch(/公众号/);
-    expect(g.summary).toMatch(/朋友圈/);
-    expect(g.summary).toMatch(/收藏/);
-    // manual 3.x path is still offered as a fallback
-    expect(g.methods.some((m) => /3\.x|PyWxDump|手动/.test(m.label + m.steps.join(" ")))).toBe(true);
-  });
-
-  it("the 6 social platforms all have a tailored one-click ADB guide", () => {
-    for (const name of [
-      "social-bilibili",
-      "social-weibo",
-      "social-douyin",
-      "social-xiaohongshu",
-      "social-toutiao",
-      "social-kuaishou",
-    ]) {
-      expect(ADAPTER_OVERRIDES[name]).toBeTruthy();
-      const g = getAdapterGuide(name, "device");
-      const primary = g.methods[0];
-      expect(primary.recommended).toBe(true);
-      // recommended path is root-phone + one-click, not "go log in on the web"
-      expect(primary.label + primary.steps.join(" ")).toMatch(/一键|ADB|USB|root/i);
-    }
-  });
-
-  it("unknown adapter falls back to a category guide without throwing", () => {
-    const g = getAdapterGuide("totally-unknown", "snapshot");
-    expect(g.category).toBe("snapshot");
-    expect(Array.isArray(g.methods)).toBe(true);
-    expect(g.methods.length).toBeGreaterThan(0);
-  });
-});

package/__tests__/adapter-spec.test.js

@@ -1,78 +0,0 @@
-"use strict";
-
-import { describe, it, expect } from "vitest";
-
-const { assertAdapter, SENSITIVITY_LEVELS } = require("../lib/adapter-spec");
-const { MockAdapter } = require("../lib/mock-adapter");
-
-describe("assertAdapter", () => {
-  it("accepts a fully-valid adapter (MockAdapter)", () => {
-    const r = assertAdapter(new MockAdapter());
-    expect(r.ok).toBe(true);
-  });
-
-  it("rejects non-object input", () => {
-    expect(assertAdapter(null).ok).toBe(false);
-    expect(assertAdapter(undefined).ok).toBe(false);
-    expect(assertAdapter("oops").ok).toBe(false);
-  });
-
-  it("rejects missing required fields (collects all errors, no throw)", () => {
-    const r = assertAdapter({});
-    expect(r.ok).toBe(false);
-    // Many fields missing — at least name + version + capabilities + dataDisclosure + methods.
-    expect(r.errors.length).toBeGreaterThan(4);
-    expect(r.errors.some((e) => e.includes("name"))).toBe(true);
-    expect(r.errors.some((e) => e.includes("version"))).toBe(true);
-    expect(r.errors.some((e) => e.includes("authenticate"))).toBe(true);
-    expect(r.errors.some((e) => e.includes("sync"))).toBe(true);
-  });
-
-  it("rejects invalid sensitivity", () => {
-    const a = new MockAdapter();
-    a.dataDisclosure = { ...a.dataDisclosure, sensitivity: "extreme" };
-    const r = assertAdapter(a);
-    expect(r.ok).toBe(false);
-    expect(r.errors.some((e) => e.includes("sensitivity"))).toBe(true);
-  });
-
-  it("rejects non-boolean legalGate", () => {
-    const a = new MockAdapter();
-    a.dataDisclosure = { ...a.dataDisclosure, legalGate: "yes" };
-    const r = assertAdapter(a);
-    expect(r.ok).toBe(false);
-  });
-
-  it("rejects non-array capabilities", () => {
-    const a = new MockAdapter();
-    a.capabilities = "sync";
-    const r = assertAdapter(a);
-    expect(r.ok).toBe(false);
-  });
-
-  it("rejects rateLimits with negative value", () => {
-    const a = new MockAdapter();
-    a.rateLimits = { perMinute: -1 };
-    expect(assertAdapter(a).ok).toBe(false);
-  });
-
-  it("accepts adapter without rateLimits (optional field)", () => {
-    const a = new MockAdapter();
-    delete a.rateLimits;
-    expect(assertAdapter(a).ok).toBe(true);
-  });
-
-  it("rejects non-function authenticate / sync / normalize / healthCheck", () => {
-    const a = new MockAdapter();
-    a.authenticate = "not a function";
-    expect(assertAdapter(a).ok).toBe(false);
-
-    const b = new MockAdapter();
-    b.normalize = 42;
-    expect(assertAdapter(b).ok).toBe(false);
-  });
-
-  it("SENSITIVITY_LEVELS lists low/medium/high", () => {
-    expect(SENSITIVITY_LEVELS).toEqual(["low", "medium", "high"]);
-  });
-});

package/__tests__/adapters/ai-chat-cookie-capture-spec.test.js

@@ -1,211 +0,0 @@
-"use strict";
-
-import { describe, it, expect } from "vitest";
-
-const {
-  COOKIE_SPEC_VERSION,
-  KNOWN_VENDORS,
-  COOKIE_CAPTURE_SPECS,
-  getSpec,
-  listVendors,
-  classifyProbedCookies,
-  validateCookieCaptureSpec,
-  _internal,
-} = require("../../lib/adapters/ai-chat-history/cookie-capture-spec");
-
-describe("cookie-capture-spec — Phase 10.3.1 matrix", () => {
-  it("exposes a positive integer COOKIE_SPEC_VERSION", () => {
-    expect(Number.isInteger(COOKIE_SPEC_VERSION)).toBe(true);
-    expect(COOKIE_SPEC_VERSION).toBeGreaterThanOrEqual(1);
-  });
-
-  it("KNOWN_VENDORS contains exactly the 9 wired vendors", () => {
-    expect(KNOWN_VENDORS).toEqual([
-      "deepseek",
-      "kimi",
-      "tongyi",
-      "zhipu",
-      "hunyuan",
-      "qianfan",
-      "coze",
-      "dreamina",
-      "doubao",
-    ]);
-    // Defensive — frozen so contributors don't accidentally mutate at runtime.
-    expect(Object.isFrozen(KNOWN_VENDORS)).toBe(true);
-  });
-
-  it("ships 9 specs, one per KNOWN_VENDORS entry, no duplicates", () => {
-    expect(COOKIE_CAPTURE_SPECS.length).toBe(KNOWN_VENDORS.length);
-    const seen = new Set();
-    for (const s of COOKIE_CAPTURE_SPECS) {
-      expect(KNOWN_VENDORS).toContain(s.vendor);
-      expect(seen.has(s.vendor)).toBe(false);
-      seen.add(s.vendor);
-    }
-  });
-
-  it("validates the shipped spec set without errors", () => {
-    const r = validateCookieCaptureSpec(undefined, { throwOnError: false });
-    expect(r.errors).toEqual([]);
-    expect(r.ok).toBe(true);
-  });
-
-  it("each loginUrl host matches at least one cookieDomains entry", () => {
-    for (const s of COOKIE_CAPTURE_SPECS) {
-      const host = new URL(s.loginUrl).host;
-      const matched = s.cookieDomains.some((d) =>
-        d.startsWith(".") ? host.endsWith(d.slice(1)) : host === d,
-      );
-      expect({ vendor: s.vendor, host, matched }).toEqual({ vendor: s.vendor, host, matched: true });
-    }
-  });
-
-  it("each spec has non-empty requiredCookies + postLoginPathHints + positive maxAge", () => {
-    for (const s of COOKIE_CAPTURE_SPECS) {
-      expect(Array.isArray(s.requiredCookies)).toBe(true);
-      expect(s.requiredCookies.length).toBeGreaterThan(0);
-      expect(Array.isArray(s.postLoginPathHints)).toBe(true);
-      expect(s.postLoginPathHints.length).toBeGreaterThan(0);
-      expect(Number.isInteger(s.cookieMaxAgeHintDays)).toBe(true);
-      expect(s.cookieMaxAgeHintDays).toBeGreaterThan(0);
-      expect(typeof s.notes).toBe("string");
-      expect(s.notes.length).toBeGreaterThan(0);
-    }
-  });
-
-  it("getSpec returns the right spec for a known vendor and null for unknown", () => {
-    const ds = getSpec("deepseek");
-    expect(ds).toBeTruthy();
-    expect(ds.vendor).toBe("deepseek");
-    expect(getSpec("notarealvendor")).toBeNull();
-    expect(getSpec("")).toBeNull();
-    expect(getSpec(undefined)).toBeNull();
-    expect(getSpec(null)).toBeNull();
-  });
-
-  it("listVendors returns a copy (mutation does not affect KNOWN_VENDORS)", () => {
-    const arr = listVendors();
-    expect(arr).toEqual([...KNOWN_VENDORS]);
-    arr.push("hacked");
-    expect(KNOWN_VENDORS.includes("hacked")).toBe(false);
-  });
-});
-
-describe("classifyProbedCookies — required vs optional vs missing", () => {
-  it("returns ok=true when all required cookies present (object input)", () => {
-    const r = classifyProbedCookies("deepseek", {
-      userToken: "abc",
-      "intercom-session-deepseek": "xyz",
-    });
-    expect(r.ok).toBe(true);
-    expect(r.foundRequired).toEqual(["userToken"]);
-    expect(r.missingRequired).toEqual([]);
-    expect(r.foundOptional).toEqual(["intercom-session-deepseek"]);
-  });
-
-  it("returns ok=false when a required cookie is missing", () => {
-    const r = classifyProbedCookies("kimi", { refresh_token: "rt", session_id: "sid" });
-    expect(r.ok).toBe(false);
-    expect(r.missingRequired).toEqual(["access_token"]);
-    expect(r.foundOptional.sort()).toEqual(["refresh_token", "session_id"]);
-  });
-
-  it("accepts Electron Cookie[] shape (array of { name, value })", () => {
-    const r = classifyProbedCookies("zhipu", [
-      { name: "chatglm_token", value: "tok" },
-      { name: "cgsessionid", value: "sid" },
-      { name: "unrelated", value: "x" },
-    ]);
-    expect(r.ok).toBe(true);
-    expect(r.foundRequired).toEqual(["chatglm_token"]);
-    expect(r.foundOptional).toContain("cgsessionid");
-  });
-
-  it("accepts raw 'k=v; k=v' string (web-shell paste fallback)", () => {
-    const raw = "sessionid=abc; sid_guard=xyz; passport_csrf_token=csrf;  ;junk";
-    const r = classifyProbedCookies("doubao", raw);
-    expect(r.ok).toBe(true);
-    expect(r.foundRequired).toEqual(["sessionid"]);
-    expect(r.foundOptional.sort()).toEqual(["passport_csrf_token", "sid_guard"]);
-  });
-
-  it("string parser tolerates values containing '=' (e.g. base64)", () => {
-    // sessionid is base64 with '=' padding; only the FIRST '=' is the delimiter.
-    const raw = "sessionid=YWJjZGVmZ2g=; sid_guard=v1=";
-    const r = classifyProbedCookies("coze", raw);
-    expect(r.ok).toBe(true);
-    expect(r.foundRequired).toEqual(["sessionid"]);
-    // raw cookie value must be preserved verbatim including the trailing '='
-    const jar = _internal._normalizeCookieJar(raw);
-    expect(jar.sessionid).toBe("YWJjZGVmZ2g=");
-  });
-
-  it("empty string / null / undefined / wrong type all produce ok=false", () => {
-    for (const input of ["", null, undefined, 42, true]) {
-      const r = classifyProbedCookies("doubao", input);
-      expect(r.ok).toBe(false);
-      expect(r.missingRequired).toEqual(["sessionid"]);
-    }
-  });
-
-  it("returns UNKNOWN_VENDOR reason for an unregistered vendor name", () => {
-    const r = classifyProbedCookies("notarealvendor", { anything: "x" });
-    expect(r.ok).toBe(false);
-    expect(r.reason).toBe("UNKNOWN_VENDOR");
-  });
-
-  it("treats empty-string cookie value as missing (not present)", () => {
-    const r = classifyProbedCookies("deepseek", { userToken: "" });
-    expect(r.ok).toBe(false);
-    expect(r.foundRequired).toEqual([]);
-    expect(r.missingRequired).toEqual(["userToken"]);
-  });
-});
-
-describe("validateCookieCaptureSpec — defensive guard catches malformed specs", () => {
-  it("flags unknown vendor", () => {
-    const { ok, errors } = validateCookieCaptureSpec(
-      [{ ...COOKIE_CAPTURE_SPECS[0], vendor: "ghostvendor" }],
-      { throwOnError: false },
-    );
-    expect(ok).toBe(false);
-    expect(errors.join(" ")).toMatch(/unknown vendor/);
-  });
-
-  it("flags loginUrl host not matching any cookieDomain", () => {
-    const broken = {
-      ...COOKIE_CAPTURE_SPECS[0],
-      loginUrl: "https://malicious.example.com/",
-    };
-    const { ok, errors } = validateCookieCaptureSpec([broken], { throwOnError: false });
-    expect(ok).toBe(false);
-    expect(errors.join(" ")).toMatch(/does not match any cookieDomain/);
-  });
-
-  it("flags empty requiredCookies / postLoginPathHints / invalid maxAge", () => {
-    const broken = {
-      ...COOKIE_CAPTURE_SPECS[0],
-      requiredCookies: [],
-      postLoginPathHints: [],
-      cookieMaxAgeHintDays: 0,
-    };
-    const { ok, errors } = validateCookieCaptureSpec([broken], { throwOnError: false });
-    expect(ok).toBe(false);
-    const joined = errors.join(" ");
-    expect(joined).toMatch(/requiredCookies/);
-    expect(joined).toMatch(/postLoginPathHints/);
-    expect(joined).toMatch(/cookieMaxAgeHintDays/);
-  });
-
-  it("flags duplicate vendor entries", () => {
-    const dup = [COOKIE_CAPTURE_SPECS[0], { ...COOKIE_CAPTURE_SPECS[0] }];
-    const { ok, errors } = validateCookieCaptureSpec(dup, { throwOnError: false });
-    expect(ok).toBe(false);
-    expect(errors.join(" ")).toMatch(/duplicate vendor/);
-  });
-
-  it("throws by default when malformed (no opts)", () => {
-    expect(() => validateCookieCaptureSpec([{ vendor: "ghost" }])).toThrow(/Invalid cookie capture spec/);
-  });
-});