@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/lib/org/inbound/project.test.mjs

@@ -1,287 +0,0 @@
-/**
- * project.test.mjs — the projection onto the EXISTING MessageEvent contract.
- *
- * The design promise is "the inbox pipeline needs no change", so these tests do
- * not stop at the MessageEvent: they push it through the real
- * `lib/channels/inbox-item.eventToInboxItem` and assert the flat item the daemon
- * actually reads. In particular:
- *
- *   - the per-surface `kind` SURVIVES `normalizeKind` (it would be silently
- *     rewritten to "message" if `contract.EVENT_KINDS` had not been extended),
- *   - the inbox `id` is stable across an at-least-once replay (it is the dedup
- *     key, and the cursor is advanced only after the write), and
- *   - the DM/call projections stay compatible with what `lib/org/messaging`
- *     produces today, so switching the tail on cannot re-deliver or re-shape the
- *     inbound that already works.
- *
- * Run: node --test lib/org/inbound/project.test.mjs
- */
-
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { toMessageEvent, inboxIdFor, messageIdFor, scopeFor } from "./project.mjs";
-import { classifyEvent } from "./directedness.mjs";
-import { SURFACES, SURFACE_EVENT_KINDS, resolveEnabledSurfaces, parseSurfaceEnv, defaultEnabledSurfaces } from "./surfaces.mjs";
-import { eventToInboxItem } from "../../channels/inbox-item.mjs";
-import { EVENT_KINDS, normalizeKind } from "../../channels/contract.mjs";
-
-const ME = "M-me";
-const THEM = "M-them";
-
-function ev(over) {
-  return { seq: 42, at: "2026-08-11T09:00:00.000Z", actor: THEM, ...over };
-}
-
-function project(candidate, surface, reason, hydrated, facts = {}) {
-  return toMessageEvent({
-    candidate,
-    verdict: { surface, reason, directed: true },
-    hydrated: { ok: true, ...hydrated },
-    me: ME,
-    facts,
-  });
-}
-
-// ---------------------------------------------------------------------------
-// contract drift — the whole routing hint depends on this
-// ---------------------------------------------------------------------------
-
-test("every surface kind is a REGISTERED EventKind (else normalizeKind eats it)", () => {
-  for (const kind of SURFACE_EVENT_KINDS) {
-    assert.ok(EVENT_KINDS.includes(kind), `contract.EVENT_KINDS is missing "${kind}"`);
-    assert.equal(normalizeKind(kind), kind, `"${kind}" would be rewritten to "message"`);
-  }
-});
-
-test("the five original chat kinds are untouched", () => {
-  for (const kind of ["message", "reaction", "channel_cc", "voice_note", "call"]) {
-    assert.ok(EVENT_KINDS.includes(kind));
-  }
-});
-
-test("email is the one surface OFF by default (the orgmail adapter already polls it)", () => {
-  const d = defaultEnabledSurfaces();
-  assert.equal(d.email, false);
-  for (const [name, on] of Object.entries(d)) {
-    if (name !== "email") assert.equal(on, true, `${name} should default on`);
-  }
-});
-
-test("surface overrides: array = exact set, object = delta, env grammar", () => {
-  assert.deepEqual(resolveEnabledSurfaces(["mention"]).enabled.mention, true);
-  assert.deepEqual(resolveEnabledSurfaces(["mention"]).enabled.dm, false);
-  assert.deepEqual(resolveEnabledSurfaces({ email: true }).enabled.email, true);
-  assert.deepEqual(resolveEnabledSurfaces({ email: true }).enabled.dm, true, "a delta keeps the rest");
-  assert.deepEqual(resolveEnabledSurfaces({ nope: true }).unknown, ["nope"]);
-
-  assert.equal(parseSurfaceEnv(""), undefined);
-  assert.equal(parseSurfaceEnv("default"), undefined);
-  assert.deepEqual(parseSurfaceEnv("mention,thread_reply"), ["mention", "thread_reply"]);
-  assert.deepEqual(parseSurfaceEnv("+email,-thread_reply"), { email: true, thread_reply: false });
-  assert.equal(parseSurfaceEnv("all").email, true);
-  assert.equal(parseSurfaceEnv("none").dm, false);
-});
-
-// ---------------------------------------------------------------------------
-// per-surface projection → real inbox item
-// ---------------------------------------------------------------------------
-
-test("an @mention projects to kind:'mention' and survives eventToInboxItem", () => {
-  const c = classifyEvent(
-    ev({ family: "messaging", kind: "send", entity_id: "m1", payload: { actor: THEM, channelId: "C-pub", channelKind: "PUBLIC", mentionCount: 1 } }),
-  );
-  const facts = { channels: new Map([["C-pub", { id: "C-pub", kind: "PUBLIC", name: "General" }]]) };
-  const mev = project(c, "mention", "mention", {
-    text: "@Isla can you look?",
-    from: { id: THEM, name: "Casey" },
-    channelId: "C-pub",
-    channelLabel: "General",
-  }, facts);
-
-  assert.equal(mev.kind, "mention");
-  assert.equal(mev.subject, "Cohort @mention");
-  assert.equal(mev.priority_signals.mentions_agent, true);
-  assert.equal(mev.is_private, false, "a PUBLIC room is a positive public assertion");
-  assert.equal(mev.raw_ref, "cohort:mention:m1:42");
-
-  const item = eventToInboxItem(mev);
-  assert.equal(item.kind, "mention", "the routing hint must reach the daemon");
-  assert.equal(item.service, "cohort");
-  assert.equal(item.channel, "General");
-  assert.equal(item.content, "@Isla can you look?");
-  assert.equal(item.sender, "Casey");
-  assert.equal(item.is_private, false);
-});
-
-test("a board assignment projects to kind:'task_assigned' with the task as the thread", () => {
-  const c = classifyEvent(ev({ family: "board", kind: "item.assigned", entity_id: "T-1", payload: { actor: THEM, assignee: ME } }));
-  const mev = project(c, "task_assigned", "assignee", {
-    text: 'A board item was assigned to you — "Ship the thing"',
-    subjectDetail: "Ship the thing",
-    threadId: "T-1",
-    from: { id: THEM, name: "Casey" },
-    channelLabel: "task/Ship the thing",
-  });
-
-  assert.equal(mev.kind, "task_assigned");
-  assert.equal(mev.subject, "Cohort task assigned: Ship the thing");
-  assert.equal(mev.thread_id, "T-1");
-  assert.equal(mev.is_private, true, "a non-channel org surface is never public");
-  const item = eventToInboxItem(mev);
-  assert.equal(item.kind, "task_assigned");
-  assert.equal(item.thread_id, "T-1");
-  assert.equal(item.id, "cohort-task_assigned-42");
-});
-
-test("each remaining surface projects to its own kind", () => {
-  const cases = [
-    ["thread_reply", classifyEvent(ev({ family: "messaging", kind: "send", entity_id: "m2", payload: { actor: THEM, channelId: "C", channelKind: "PUBLIC", threaded: true } }))],
-    ["task_comment", classifyEvent(ev({ family: "board", kind: "item.commented", entity_id: "T-2", payload: { actor: THEM } }))],
-    ["file_comment", classifyEvent(ev({ family: "file", kind: "file.commented", entity_id: "fc1", payload: { fileKey: "k", channelId: "C" } }))],
-    ["doc_comment", classifyEvent(ev({ family: "files", kind: "doc.comment", entity_id: "F-1", payload: { name: "Spec" } }))],
-    ["approval", classifyEvent(ev({ family: "approval", kind: "approval.requested", entity_id: "A-1", payload: { requester: THEM } }))],
-    ["decision", classifyEvent(ev({ family: "decision", kind: "decision.comment", entity_id: "D-1", payload: { authorId: THEM } }))],
-    ["escalation", classifyEvent(ev({ family: "escalation", kind: "escalation.raised", entity_id: "E-1", payload: { actor: THEM } }))],
-    ["handoff", classifyEvent(ev({ family: "handoff", kind: "handoff.offered", entity_id: "R-1", payload: { from: THEM, to: ME } }))],
-    ["email", classifyEvent(ev({ family: "email", kind: "received", entity_id: "EM-1", payload: { memberId: ME, threadId: "ET-1" } }))],
-  ];
-  for (const [surface, cand] of cases) {
-    const mev = project(cand, surface, "direct", { text: "something happened", from: { id: THEM, name: "Casey" } });
-    assert.ok(mev, `${surface} must project`);
-    assert.equal(mev.kind, SURFACES[surface].kind, surface);
-    const item = eventToInboxItem(mev);
-    assert.equal(item.kind, SURFACES[surface].kind, `${surface} kind must survive serialisation`);
-    assert.equal(item.service, "cohort");
-    assert.ok(item.content, `${surface} must carry a body`);
-  }
-  // doc_comment and file_comment deliberately share one kind: they are the same
-  // thing to a classifier ("someone commented on a file of mine").
-  assert.equal(SURFACES.doc_comment.kind, SURFACES.file_comment.kind);
-});
-
-// ---------------------------------------------------------------------------
-// the legacy DM / call shape must not move
-// ---------------------------------------------------------------------------
-
-test("a DM projects to the SAME kind/id/subject the current pullInbound produces", () => {
-  const c = classifyEvent(ev({ family: "messaging", kind: "send", entity_id: "m9", payload: { actor: THEM, channelId: "C-dm", channelKind: "DM" } }));
-  const facts = { channels: new Map([["C-dm", { id: "C-dm", kind: "DM", name: "them" }]]) };
-  const mev = project(c, "dm", "dm", { text: "ping", from: { id: THEM, name: "Casey" }, channelId: "C-dm", channelLabel: "them" }, facts);
-
-  assert.equal(mev.kind, "message", "an existing DM must NOT change kind");
-  assert.equal(mev.id, "cohort-m9", "the dedup id must not move");
-  assert.equal(mev.subject, "Cohort message");
-  assert.equal(mev.channel, "cohort");
-  assert.equal(mev.source.userScope, "dm");
-  assert.equal(mev.is_dm, true);
-
-  const item = eventToInboxItem(mev);
-  assert.equal("kind" in item, false, "kind 'message' stays omitted, as it is today");
-  assert.equal(item.id, "cohort-m9");
-});
-
-test("a call keeps kind:'call' and the call id", () => {
-  const c = classifyEvent(ev({ family: "calling", kind: "call.started", entity_id: "call-1", payload: { actor: THEM, callId: "call-1", channelId: "C-dm", topic: "sync" } }));
-  const mev = project(c, "call", "channel", { text: "Call invite: sync", subjectDetail: "sync", threadId: "call-1", from: { id: THEM, name: "Casey" }, channelId: "C-dm" });
-  assert.equal(mev.kind, "call");
-  assert.equal(mev.id, "cohort-call-1");
-  assert.equal(eventToInboxItem(mev).kind, "call");
-});
-
-// ---------------------------------------------------------------------------
-// dedup ids + replay stability
-// ---------------------------------------------------------------------------
-
-test("the inbox id is STABLE across a replay of the same ledger row", () => {
-  const mk = () => classifyEvent(ev({ family: "board", kind: "item.commented", entity_id: "T-1", payload: { actor: THEM } }));
-  const a = project(mk(), "task_comment", "assignee", { text: "a" });
-  const b = project(mk(), "task_comment", "assignee", { text: "a" });
-  assert.equal(a.id, b.id, "an at-least-once re-pull must dedup, not double-deliver");
-});
-
-test("two comments on the SAME task get different ids", () => {
-  const one = classifyEvent({ seq: 10, family: "board", kind: "item.commented", entity_id: "T-1", actor: THEM, payload: { actor: THEM } });
-  const two = classifyEvent({ seq: 11, family: "board", kind: "item.commented", entity_id: "T-1", actor: THEM, payload: { actor: THEM } });
-  assert.notEqual(
-    project(one, "task_comment", "assignee", { text: "a" }).id,
-    project(two, "task_comment", "assignee", { text: "b" }).id,
-  );
-});
-
-test("id/messageId helpers are explicit about their two regimes", () => {
-  const msg = { family: "messaging", ids: { messageId: "m1" }, entityId: "m1", seq: 5 };
-  assert.equal(messageIdFor(msg, {}), "m1");
-  assert.equal(inboxIdFor(msg, { surface: "dm" }, "m1", "5"), "cohort-m1");
-  const task = { family: "board", ids: { taskId: "T-1" }, entityId: "T-1", seq: 5 };
-  assert.equal(messageIdFor(task, {}), "5");
-  assert.equal(inboxIdFor(task, { surface: "task_comment" }, "5", "5"), "cohort-task_comment-5");
-});
-
-// ---------------------------------------------------------------------------
-// signals + refusals
-// ---------------------------------------------------------------------------
-
-test("mentions_agent is only true for a real direct address", () => {
-  const c = classifyEvent(ev({ family: "board", kind: "item.commented", entity_id: "T-1", payload: { actor: THEM } }));
-  assert.equal(project(c, "task_comment", "assignee", { text: "x" }).priority_signals.mentions_agent, false);
-  assert.equal(project(c, "task_comment", "direct", { text: "x" }).priority_signals.mentions_agent, true);
-});
-
-test("urgency and deadline signals come off the hydrated body, and blocks are urgent", () => {
-  const c = classifyEvent(ev({ family: "board", kind: "board.blocked", entity_id: "T-1", payload: { actor: THEM, reason: "waiting" } }));
-  const mev = project(c, "task_comment", "assignee", { text: "this is blocked, need it by Friday" });
-  assert.equal(mev.priority_signals.tagged_urgent, true);
-  assert.equal(mev.priority_signals.contains_deadline, true);
-});
-
-test("projection REFUSES an unhydrated, bodyless or surfaceless item", () => {
-  const c = classifyEvent(ev({ family: "board", kind: "item.commented", entity_id: "T-1", payload: { actor: THEM } }));
-  assert.equal(toMessageEvent({ candidate: c, verdict: { surface: "task_comment" }, hydrated: { ok: false }, me: ME }), null);
-  assert.equal(project(c, "task_comment", "assignee", { text: "   " }), null);
-  assert.equal(toMessageEvent({ candidate: c, verdict: { surface: "nope" }, hydrated: { ok: true, text: "x" }, me: ME }), null);
-  assert.equal(toMessageEvent({}), null);
-});
-
-test("is_private is stamped only when the room class is actually known", () => {
-  const c = classifyEvent(ev({ family: "messaging", kind: "send", entity_id: "m1", payload: { actor: THEM, channelId: "C", channelKind: "PRIVATE" } }));
-  assert.equal(project(c, "mention", "mention", { text: "x", channelId: "C" }).is_private, true);
-
-  const noKind = classifyEvent(ev({ family: "file", kind: "file.commented", entity_id: "fc", payload: { fileKey: "k", channelId: "C-unknown" } }));
-  const mev = project(noKind, "file_comment", "channel", { text: "x", channelId: "C-unknown" });
-  assert.equal("is_private" in mev, false, "an unknown room class must not forge a confidentiality assertion");
-});
-
-test("channel_id is ONLY ever a real channel id — never an entity id in disguise", () => {
-  // `responder.sendCohortReply` does `messaging.send({channel: item.channel_id})`.
-  // A task id here would post to a non-channel and 400, so a room-less surface
-  // must leave it blank and be routed by `kind` + `raw_ref` instead.
-  const roomless = [
-    ["task_comment", classifyEvent(ev({ family: "board", kind: "item.commented", entity_id: "T-1", payload: { actor: THEM } }))],
-    ["decision", classifyEvent(ev({ family: "decision", kind: "decision.comment", entity_id: "D-1", payload: { authorId: THEM } }))],
-    ["approval", classifyEvent(ev({ family: "approval", kind: "approval.requested", entity_id: "A-1", payload: { requester: THEM } }))],
-    ["doc_comment", classifyEvent(ev({ family: "files", kind: "doc.comment", entity_id: "F-1", payload: { name: "Spec" } }))],
-    ["handoff", classifyEvent(ev({ family: "handoff", kind: "handoff.offered", entity_id: "R-1", payload: { from: THEM, to: ME } }))],
-  ];
-  for (const [surface, cand] of roomless) {
-    const mev = project(cand, surface, "direct", { text: "x", threadId: "X-1" });
-    assert.equal(mev.channel_id, "", `${surface} must not fake a channel id`);
-    assert.equal(eventToInboxItem(mev).channel_id, "", surface);
-    // The routing information is still there, on fields the converter keeps.
-    assert.match(eventToInboxItem(mev).raw_ref, new RegExp(`^cohort:${surface}:`));
-    assert.ok(eventToInboxItem(mev).thread_id, `${surface} must carry a reply anchor`);
-  }
-
-  // A board item that DOES live in a channel keeps it, so a reply can go there.
-  const inChannel = classifyEvent(ev({ family: "board", kind: "item.commented", entity_id: "T-2", payload: { actor: THEM, channelId: "C-eng" } }));
-  assert.equal(project(inChannel, "task_comment", "assignee", { text: "x", channelId: "C-eng" }).channel_id, "C-eng");
-});
-
-test("scopeFor maps room class to the daemon's audience vocabulary", () => {
-  assert.equal(scopeFor("dm", "DM", "channel"), "dm");
-  assert.equal(scopeFor("dm", "GROUP_DM", "channel"), "group");
-  assert.equal(scopeFor("mention", "PUBLIC", "channel"), "channel");
-  assert.equal(scopeFor("approval", "", "dm"), "dm");
-});

package/lib/org/integration-tools.test.mjs

@@ -1,160 +0,0 @@
-/**
- * integration-tools.test.mjs — the versioned integration-tools cache (SP5).
- *
- * Hermetic: the hq fetch rides an injected `call` (no network). Disk tests write
- * into a fresh mkdtemp root. Run: node --test lib/org/integration-tools.test.mjs
- */
-
-"use strict";
-
-import { test, beforeEach, after } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, readFileSync, existsSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import {
-  maybeRefresh,
-  getIntegrationTools,
-  currentToolsetVersion,
-  writeIntegrationToolsToDisk,
-  integrationToolsetPath,
-  _resetForTest,
-} from "./integration-tools.mjs";
-
-/** A fake `call` that answers the two SP1 read-methods from a canned set. */
-function makeCall({ version, tools }) {
-  const calls = [];
-  const call = async (method, params) => {
-    calls.push({ method, params });
-    if (method === "integration.toolsetVersion") {
-      return { ok: true, result: { version, updatedAt: null } };
-    }
-    if (method === "integration.listAgentTools") {
-      return { ok: true, result: { version, tools } };
-    }
-    return { ok: false, error: { code: "NOT_FOUND", message: "?" } };
-  };
-  return { call, calls };
-}
-
-const TOOLS_V5 = [
-  {
-    slug: "open-meteo",
-    name: "forecast",
-    description: "Get the forecast",
-    inputSchema: { type: "object", properties: { city: { type: "string" } } },
-    outputSchema: { type: "object" },
-  },
-];
-
-const roots = [];
-function freshRoot() {
-  const r = mkdtempSync(join(tmpdir(), "int-tools-"));
-  roots.push(r);
-  return r;
-}
-
-beforeEach(() => _resetForTest());
-after(() => {
-  for (const r of roots) {
-    try {
-      rmSync(r, { recursive: true, force: true });
-    } catch {
-      /* best-effort */
-    }
-  }
-});
-
-test("first refresh populates the cache from version + tools", async () => {
-  const { call, calls } = makeCall({ version: 5, tools: TOOLS_V5 });
-  const cache = await maybeRefresh({ call });
-  assert.equal(cache.version, 5);
-  assert.equal(currentToolsetVersion(), 5);
-  const got = getIntegrationTools();
-  assert.equal(got.length, 1);
-  const t = got[0];
-  assert.equal(t.name, "plugin__open_meteo__forecast");
-  assert.equal(t.access, "write");
-  assert.equal(t.binding.kind, "rpc");
-  assert.equal(t.binding.method, "integration.invokeTool");
-  assert.deepEqual(t.integration, { slug: "open-meteo", tool: "forecast" });
-  assert.deepEqual(t.input_schema, TOOLS_V5[0].inputSchema);
-  // Both reads happened on the first refresh.
-  assert.deepEqual(
-    calls.map((c) => c.method),
-    ["integration.toolsetVersion", "integration.listAgentTools"],
-  );
-});
-
-test("same version → no refetch of listAgentTools", async () => {
-  const first = makeCall({ version: 5, tools: TOOLS_V5 });
-  await maybeRefresh({ call: first.call });
-  const second = makeCall({ version: 5, tools: TOOLS_V5 });
-  await maybeRefresh({ call: second.call });
-  assert.deepEqual(
-    second.calls.map((c) => c.method),
-    ["integration.toolsetVersion"],
-    "a matching version polls the cheap version read only",
-  );
-});
-
-test("a bumped version refetches + swaps in the new tools", async () => {
-  await maybeRefresh(makeCall({ version: 5, tools: TOOLS_V5 }));
-  const v6Tools = [
-    { slug: "stripe", name: "list_charges", description: "List charges", inputSchema: {} },
-  ];
-  await maybeRefresh(makeCall({ version: 6, tools: v6Tools }));
-  assert.equal(currentToolsetVersion(), 6);
-  const names = getIntegrationTools().map((t) => t.name);
-  assert.deepEqual(names, ["plugin__stripe__list_charges"]);
-});
-
-test("passes agentMemberId through to listAgentTools when given", async () => {
-  const { call, calls } = makeCall({ version: 1, tools: TOOLS_V5 });
-  await maybeRefresh({ call, agentMemberId: "wm_agent" });
-  const list = calls.find((c) => c.method === "integration.listAgentTools");
-  assert.deepEqual(list.params, { agentMemberId: "wm_agent" });
-});
-
-test("a non-numeric version leaves the cache untouched (fail-open)", async () => {
-  const call = async () => ({ ok: true, result: {} }); // no version
-  const cache = await maybeRefresh({ call });
-  assert.equal(cache.version, 0);
-  assert.equal(getIntegrationTools().length, 0);
-});
-
-test("a throwing call fails open to the existing cache", async () => {
-  await maybeRefresh(makeCall({ version: 2, tools: TOOLS_V5 }));
-  const boom = async () => {
-    throw new Error("network down");
-  };
-  const cache = await maybeRefresh({ call: boom });
-  assert.equal(cache.version, 2, "kept the last-good cache");
-  assert.equal(getIntegrationTools().length, 1);
-});
-
-test("the mcp name sanitizes non-alnum slug chars and caps at 64", async () => {
-  const tools = [
-    { slug: "My.Weird-Slug", name: "do_thing", description: "d", inputSchema: {} },
-  ];
-  await maybeRefresh(makeCall({ version: 1, tools }));
-  const [t] = getIntegrationTools();
-  assert.equal(t.name, "plugin__My_Weird_Slug__do_thing");
-  assert.ok(t.name.length <= 64);
-});
-
-test("writeIntegrationToolsToDisk persists {version,tools} atomically", async () => {
-  const root = freshRoot();
-  await maybeRefresh(makeCall({ version: 9, tools: TOOLS_V5 }));
-  writeIntegrationToolsToDisk(root, {
-    version: currentToolsetVersion(),
-    tools: getIntegrationTools(),
-  });
-  const p = integrationToolsetPath(root);
-  assert.ok(existsSync(p), "toolset.json exists");
-  const doc = JSON.parse(readFileSync(p, "utf8"));
-  assert.equal(doc.version, 9);
-  assert.equal(doc.tools.length, 1);
-  assert.equal(doc.tools[0].name, "plugin__open_meteo__forecast");
-});

package/lib/org/keys.test.mjs

@@ -1,92 +0,0 @@
-/**
- * keys.test.mjs — device keypair crypto round-trips + tamper rejection.
- * Run: node --test lib/org/keys.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, existsSync, statSync, rmSync, readFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import {
-  generateDeviceKey,
-  signWith,
-  verifySignature,
-  ensureDeviceKey,
-} from "./keys.mjs";
-
-function tmpRoot() {
-  return mkdtempSync(join(tmpdir(), "cohort-keys-"));
-}
-
-test("generateDeviceKey: emits SPKI public + PKCS#8 private PEM", () => {
-  const { publicKeyPem, privateKeyPem } = generateDeviceKey();
-  assert.match(publicKeyPem, /-----BEGIN PUBLIC KEY-----/);
-  assert.match(privateKeyPem, /-----BEGIN PRIVATE KEY-----/);
-});
-
-test("sign/verify: round-trip succeeds", () => {
-  const { publicKeyPem, privateKeyPem } = generateDeviceKey();
-  const msg = Buffer.from("the org snapshot bytes");
-  const sig = signWith(privateKeyPem, msg);
-  assert.equal(typeof sig, "string");
-  assert.equal(verifySignature(publicKeyPem, msg, sig), true);
-  // string payload accepted too
-  assert.equal(verifySignature(publicKeyPem, "the org snapshot bytes", sig), true);
-});
-
-test("verify: rejects tampered message", () => {
-  const { publicKeyPem, privateKeyPem } = generateDeviceKey();
-  const sig = signWith(privateKeyPem, Buffer.from("original"));
-  assert.equal(verifySignature(publicKeyPem, Buffer.from("tampered"), sig), false);
-});
-
-test("verify: rejects signature from a different key", () => {
-  const a = generateDeviceKey();
-  const b = generateDeviceKey();
-  const msg = Buffer.from("payload");
-  const sig = signWith(a.privateKeyPem, msg);
-  assert.equal(verifySignature(b.publicKeyPem, msg, sig), false);
-});
-
-test("verify: never throws on garbage inputs", () => {
-  assert.equal(verifySignature("not a pem", Buffer.from("x"), "AAAA"), false);
-  assert.equal(verifySignature(generateDeviceKey().publicKeyPem, Buffer.from("x"), ""), false);
-  assert.equal(verifySignature(generateDeviceKey().publicKeyPem, Buffer.from("x"), "!!!notb64"), false);
-});
-
-test("ensureDeviceKey: creates 0600 key under state/org and returns signer", () => {
-  const root = tmpRoot();
-  try {
-    const { publicKeyPem, sign } = ensureDeviceKey(root);
-    assert.match(publicKeyPem, /BEGIN PUBLIC KEY/);
-    const path = join(root, "state", "org", "device-key.pem");
-    assert.equal(existsSync(path), true);
-    // perms must be owner-only (0600)
-    const mode = statSync(path).mode & 0o777;
-    assert.equal(mode, 0o600);
-    // the returned signer signs verifiably against the returned public key
-    const sig = sign(Buffer.from("hello"));
-    assert.equal(verifySignature(publicKeyPem, Buffer.from("hello"), sig), true);
-    // private PEM is on disk but never returned
-    assert.match(readFileSync(path, "utf8"), /BEGIN PRIVATE KEY/);
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-test("ensureDeviceKey: idempotent — reload returns the SAME identity", () => {
-  const root = tmpRoot();
-  try {
-    const first = ensureDeviceKey(root);
-    const second = ensureDeviceKey(root);
-    assert.equal(first.publicKeyPem, second.publicKeyPem);
-    // a signature from the first loader verifies under the second's public key
-    const sig = first.sign(Buffer.from("cross"));
-    assert.equal(verifySignature(second.publicKeyPem, Buffer.from("cross"), sig), true);
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});