@useatlas/create 0.0.1

package/templates/docker/src/lib/slack/__tests__/format.test.ts

@@ -0,0 +1,237 @@
+/**
+ * Tests for Slack Block Kit formatter.
+ */
+
+import { describe, it, expect } from "bun:test";
+import {
+  formatQueryResponse,
+  formatErrorResponse,
+  formatActionApproval,
+  formatActionResult,
+  type SlackQueryResult,
+  type SlackBlock,
+} from "../format";
+import type { PendingAction } from "@atlas/api/lib/agent-query";
+
+/** Helper: extract text from a section block */
+function blockText(block: SlackBlock): string {
+  if (block.type === "section") return block.text.text;
+  return "";
+}
+
+/** Helper: extract context element texts */
+function contextTexts(block: SlackBlock): string[] {
+  if (block.type === "context") return block.elements.map((e) => e.text);
+  return [];
+}
+
+function makeResult(overrides: Partial<SlackQueryResult> = {}): SlackQueryResult {
+  return {
+    answer: "There were 1,234 active users last month.",
+    sql: ["SELECT COUNT(*) FROM users WHERE active = true"],
+    data: [
+      {
+        columns: ["count"],
+        rows: [{ count: 1234 }],
+      },
+    ],
+    steps: 3,
+    usage: { totalTokens: 5000 },
+    ...overrides,
+  };
+}
+
+describe("formatQueryResponse", () => {
+  it("formats a complete query response with answer, SQL, and data", () => {
+    const blocks = formatQueryResponse(makeResult());
+
+    expect(blocks.length).toBeGreaterThanOrEqual(3); // answer + SQL + data + context
+    expect(blocks[0].type).toBe("section");
+    expect(blockText(blocks[0])).toContain("1,234 active users");
+
+    // SQL block
+    expect(blockText(blocks[1])).toContain("```");
+    expect(blockText(blocks[1])).toContain("SELECT COUNT(*)");
+
+    // Context block (last)
+    const last = blocks[blocks.length - 1];
+    expect(last.type).toBe("context");
+    expect(contextTexts(last)[0]).toContain("3 steps");
+    expect(contextTexts(last)[0]).toContain("5,000 tokens");
+  });
+
+  it("handles missing SQL gracefully", () => {
+    const blocks = formatQueryResponse(makeResult({ sql: [] }));
+    const sqlBlocks = blocks.filter(
+      (b) => blockText(b).includes("```") && blockText(b).includes("SQL"),
+    );
+    expect(sqlBlocks.length).toBe(0);
+  });
+
+  it("handles empty data gracefully", () => {
+    const blocks = formatQueryResponse(makeResult({ data: [] }));
+    expect(blocks.length).toBeGreaterThanOrEqual(2);
+    expect(blockText(blocks[0])).toContain("active users");
+  });
+
+  it("handles missing answer with default text", () => {
+    const blocks = formatQueryResponse(makeResult({ answer: "" }));
+    expect(blockText(blocks[0])).toContain("No answer generated");
+  });
+
+  it("truncates large data tables", () => {
+    const manyRows = Array.from({ length: 50 }, (_, i) => ({
+      id: i,
+      name: `User ${i}`,
+      email: `user${i}@example.com`,
+    }));
+
+    const blocks = formatQueryResponse(
+      makeResult({
+        data: [
+          {
+            columns: ["id", "name", "email"],
+            rows: manyRows as Record<string, unknown>[],
+          },
+        ],
+      }),
+    );
+
+    const dataBlock = blocks.find(
+      (b) => blockText(b).includes("```") && !blockText(b).includes("SQL"),
+    );
+    expect(dataBlock).toBeDefined();
+    expect(blockText(dataBlock!)).toContain("Showing first");
+  });
+
+  it("stays within 50 block limit", () => {
+    const manyDatasets = Array.from({ length: 60 }, () => ({
+      columns: ["col"],
+      rows: [{ col: "value" }],
+    }));
+
+    const blocks = formatQueryResponse(makeResult({ data: manyDatasets }));
+    expect(blocks.length).toBeLessThanOrEqual(50);
+  });
+
+  it("truncates long answer text to 3000 chars", () => {
+    const longAnswer = "A".repeat(4000);
+    const blocks = formatQueryResponse(makeResult({ answer: longAnswer }));
+    expect(blockText(blocks[0]).length).toBeLessThanOrEqual(3000);
+    expect(blockText(blocks[0])).toEndWith("...");
+  });
+});
+
+describe("formatErrorResponse", () => {
+  it("formats an error message", () => {
+    const blocks = formatErrorResponse("Something went wrong");
+    expect(blocks.length).toBe(1);
+    expect(blocks[0].type).toBe("section");
+    expect(blockText(blocks[0])).toContain("Something went wrong");
+    expect(blockText(blocks[0])).toContain(":warning:");
+  });
+
+  it("truncates long error messages", () => {
+    const longError = "E".repeat(500);
+    const blocks = formatErrorResponse(longError);
+    expect(blockText(blocks[0]).length).toBeLessThan(300);
+  });
+});
+
+/** Helper: build a PendingAction for tests */
+function makeAction(overrides: Partial<PendingAction> = {}): PendingAction {
+  return {
+    id: "act_123",
+    type: "executeSQL",
+    target: "SELECT 1",
+    summary: "Run a test query",
+    ...overrides,
+  };
+}
+
+describe("formatActionApproval", () => {
+  it("returns a section block and an actions block with two buttons", () => {
+    const blocks = formatActionApproval(makeAction());
+    expect(blocks.length).toBe(2);
+    expect(blocks[0].type).toBe("section");
+    expect(blocks[1].type).toBe("actions");
+    if (blocks[1].type === "actions") {
+      expect(blocks[1].elements.length).toBe(2);
+    }
+  });
+
+  it("approve button has correct action_id and value", () => {
+    const action = makeAction({ id: "act_abc" });
+    const blocks = formatActionApproval(action);
+    const actionsBlock = blocks[1];
+    if (actionsBlock.type === "actions") {
+      const approve = actionsBlock.elements[0];
+      expect(approve.action_id).toBe("atlas_action_approve");
+      expect(approve.value).toBe("act_abc");
+      expect(approve.style).toBe("primary");
+    }
+  });
+
+  it("deny button has correct action_id and value", () => {
+    const action = makeAction({ id: "act_xyz" });
+    const blocks = formatActionApproval(action);
+    const actionsBlock = blocks[1];
+    if (actionsBlock.type === "actions") {
+      const deny = actionsBlock.elements[1];
+      expect(deny.action_id).toBe("atlas_action_deny");
+      expect(deny.value).toBe("act_xyz");
+      expect(deny.style).toBe("danger");
+    }
+  });
+
+  it("falls back to action.type when summary is empty", () => {
+    const blocks = formatActionApproval(makeAction({ summary: "", type: "executeSQL" }));
+    expect(blockText(blocks[0])).toContain("executeSQL");
+    expect(blockText(blocks[0])).not.toContain("\n\n");
+  });
+
+  it("truncates very long summaries", () => {
+    const longSummary = "S".repeat(4000);
+    const blocks = formatActionApproval(makeAction({ summary: longSummary }));
+    expect(blockText(blocks[0]).length).toBeLessThanOrEqual(3000);
+  });
+});
+
+describe("formatActionResult", () => {
+  it("executed status produces check mark emoji", () => {
+    const blocks = formatActionResult(makeAction(), "executed");
+    expect(blockText(blocks[0])).toContain(":white_check_mark:");
+    expect(blockText(blocks[0])).toContain("executed");
+  });
+
+  it("denied status produces no_entry_sign emoji", () => {
+    const blocks = formatActionResult(makeAction(), "denied");
+    expect(blockText(blocks[0])).toContain(":no_entry_sign:");
+    expect(blockText(blocks[0])).toContain("denied");
+  });
+
+  it("failed status produces x emoji", () => {
+    const blocks = formatActionResult(makeAction(), "failed");
+    expect(blockText(blocks[0])).toContain(":x:");
+    expect(blockText(blocks[0])).toContain("failed");
+  });
+
+  it("appends error text when provided", () => {
+    const blocks = formatActionResult(makeAction(), "failed", "Connection timed out");
+    expect(blockText(blocks[0])).toContain("Connection timed out");
+  });
+
+  it("truncates very long error text", () => {
+    const longError = "E".repeat(500);
+    const blocks = formatActionResult(makeAction(), "failed", longError);
+    const text = blockText(blocks[0]);
+    // Error portion truncated to 200 chars (plus "..." = 203 max)
+    expect(text.length).toBeLessThan(500);
+    expect(text).toContain("...");
+  });
+
+  it("falls back to action.type when summary is empty", () => {
+    const blocks = formatActionResult(makeAction({ summary: "", type: "executeSQL" }), "executed");
+    expect(blockText(blocks[0])).toContain("executeSQL");
+  });
+});

package/templates/docker/src/lib/slack/__tests__/store.test.ts

@@ -0,0 +1,188 @@
+/**
+ * Tests for Slack installation storage (store.ts).
+ *
+ * Mocks the internal DB layer to test DB-backed and env-var fallback paths.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, mock, type Mock } from "bun:test";
+
+// --- Mocks ---
+
+const mockHasInternalDB: Mock<() => boolean> = mock(() => true);
+const mockInternalQuery: Mock<(sql: string, params?: unknown[]) => Promise<Record<string, unknown>[]>> = mock(() =>
+  Promise.resolve([]),
+);
+
+const mockPoolQuery: Mock<(sql: string, params?: unknown[]) => Promise<void>> = mock(() =>
+  Promise.resolve(),
+);
+const mockGetInternalDB: Mock<() => { query: typeof mockPoolQuery }> = mock(() => ({
+  query: mockPoolQuery,
+}));
+
+mock.module("@atlas/api/lib/db/internal", () => ({
+  hasInternalDB: mockHasInternalDB,
+  internalQuery: mockInternalQuery,
+  getInternalDB: mockGetInternalDB,
+}));
+
+mock.module("@atlas/api/lib/logger", () => ({
+  createLogger: () => ({
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    debug: () => {},
+  }),
+}));
+
+// Import after mocks are registered
+const { getInstallation, saveInstallation, deleteInstallation, getBotToken } = await import("../store");
+
+describe("store", () => {
+  const savedBotToken = process.env.SLACK_BOT_TOKEN;
+
+  beforeEach(() => {
+    mockHasInternalDB.mockClear();
+    mockInternalQuery.mockClear();
+    mockPoolQuery.mockClear();
+    mockGetInternalDB.mockClear();
+    delete process.env.SLACK_BOT_TOKEN;
+  });
+
+  afterEach(() => {
+    if (savedBotToken !== undefined) process.env.SLACK_BOT_TOKEN = savedBotToken;
+    else delete process.env.SLACK_BOT_TOKEN;
+  });
+
+  describe("getInstallation", () => {
+    it("returns installation from DB when hasInternalDB() is true and row exists", async () => {
+      mockHasInternalDB.mockReturnValue(true);
+      mockInternalQuery.mockResolvedValue([
+        { team_id: "T123", bot_token: "xoxb-abc", installed_at: "2025-01-01T00:00:00Z" },
+      ]);
+
+      const result = await getInstallation("T123");
+      expect(result).toEqual({
+        team_id: "T123",
+        bot_token: "xoxb-abc",
+        installed_at: "2025-01-01T00:00:00Z",
+      });
+      expect(mockInternalQuery).toHaveBeenCalledTimes(1);
+    });
+
+    it("returns null when DB has no matching row", async () => {
+      mockHasInternalDB.mockReturnValue(true);
+      mockInternalQuery.mockResolvedValue([]);
+
+      const result = await getInstallation("T999");
+      expect(result).toBeNull();
+    });
+
+    it("throws when DB query fails (does NOT fall through to env var)", async () => {
+      mockHasInternalDB.mockReturnValue(true);
+      mockInternalQuery.mockRejectedValue(new Error("connection refused"));
+      process.env.SLACK_BOT_TOKEN = "xoxb-env-fallback";
+
+      await expect(getInstallation("T123")).rejects.toThrow("connection refused");
+    });
+
+    it("returns env var token when hasInternalDB() is false and SLACK_BOT_TOKEN is set", async () => {
+      mockHasInternalDB.mockReturnValue(false);
+      process.env.SLACK_BOT_TOKEN = "xoxb-env-token";
+
+      const result = await getInstallation("T123");
+      expect(result).not.toBeNull();
+      expect(result!.bot_token).toBe("xoxb-env-token");
+      expect(result!.team_id).toBe("T123");
+      expect(mockInternalQuery).not.toHaveBeenCalled();
+    });
+
+    it("returns null when hasInternalDB() is false and no env var", async () => {
+      mockHasInternalDB.mockReturnValue(false);
+      delete process.env.SLACK_BOT_TOKEN;
+
+      const result = await getInstallation("T123");
+      expect(result).toBeNull();
+    });
+
+    it("returns null for invalid DB record (non-string bot_token)", async () => {
+      mockHasInternalDB.mockReturnValue(true);
+      mockInternalQuery.mockResolvedValue([
+        { team_id: "T123", bot_token: 12345, installed_at: "2025-01-01T00:00:00Z" },
+      ]);
+
+      const result = await getInstallation("T123");
+      expect(result).toBeNull();
+    });
+  });
+
+  describe("saveInstallation", () => {
+    it("resolves when DB write succeeds", async () => {
+      mockHasInternalDB.mockReturnValue(true);
+      mockPoolQuery.mockResolvedValue(undefined as never);
+
+      await expect(saveInstallation("T123", "xoxb-new")).resolves.toBeUndefined();
+      expect(mockPoolQuery).toHaveBeenCalledTimes(1);
+      // Verify the SQL contains INSERT and the params
+      const [sql, params] = mockPoolQuery.mock.calls[0];
+      expect(sql).toContain("INSERT INTO slack_installations");
+      expect(params).toEqual(["T123", "xoxb-new"]);
+    });
+
+    it("throws when no internal DB", async () => {
+      mockHasInternalDB.mockReturnValue(false);
+
+      await expect(saveInstallation("T123", "xoxb-token")).rejects.toThrow(
+        "no internal database configured",
+      );
+    });
+
+    it("throws when DB write fails", async () => {
+      mockHasInternalDB.mockReturnValue(true);
+      mockPoolQuery.mockRejectedValue(new Error("disk full"));
+
+      await expect(saveInstallation("T123", "xoxb-token")).rejects.toThrow("disk full");
+    });
+  });
+
+  describe("deleteInstallation", () => {
+    it("resolves when DB delete succeeds", async () => {
+      mockHasInternalDB.mockReturnValue(true);
+      mockPoolQuery.mockResolvedValue(undefined as never);
+
+      await expect(deleteInstallation("T123")).resolves.toBeUndefined();
+      expect(mockPoolQuery).toHaveBeenCalledTimes(1);
+      const [sql, params] = mockPoolQuery.mock.calls[0];
+      expect(sql).toContain("DELETE FROM slack_installations");
+      expect(params).toEqual(["T123"]);
+    });
+
+    it("resolves (with warning) when no internal DB", async () => {
+      mockHasInternalDB.mockReturnValue(false);
+
+      // Should not throw — just logs a warning and returns
+      await expect(deleteInstallation("T123")).resolves.toBeUndefined();
+      expect(mockPoolQuery).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("getBotToken", () => {
+    it("returns the token string from getInstallation", async () => {
+      mockHasInternalDB.mockReturnValue(true);
+      mockInternalQuery.mockResolvedValue([
+        { team_id: "T123", bot_token: "xoxb-from-db", installed_at: "2025-01-01T00:00:00Z" },
+      ]);
+
+      const token = await getBotToken("T123");
+      expect(token).toBe("xoxb-from-db");
+    });
+
+    it("returns null when no installation exists", async () => {
+      mockHasInternalDB.mockReturnValue(true);
+      mockInternalQuery.mockResolvedValue([]);
+
+      const token = await getBotToken("T999");
+      expect(token).toBeNull();
+    });
+  });
+});

package/templates/docker/src/lib/slack/__tests__/threads.test.ts

@@ -0,0 +1,112 @@
+/**
+ * Tests for Slack thread → Atlas conversation ID mapping (threads.ts).
+ *
+ * Mocks the internal DB layer to test lookup and persistence paths.
+ */
+
+import { describe, it, expect, beforeEach, mock, type Mock } from "bun:test";
+
+// --- Mocks ---
+
+const mockHasInternalDB: Mock<() => boolean> = mock(() => true);
+const mockInternalQuery: Mock<(sql: string, params?: unknown[]) => Promise<Record<string, unknown>[]>> = mock(() =>
+  Promise.resolve([]),
+);
+
+const mockPoolQuery: Mock<(sql: string, params?: unknown[]) => Promise<void>> = mock(() =>
+  Promise.resolve(),
+);
+const mockGetInternalDB: Mock<() => { query: typeof mockPoolQuery }> = mock(() => ({
+  query: mockPoolQuery,
+}));
+
+mock.module("@atlas/api/lib/db/internal", () => ({
+  hasInternalDB: mockHasInternalDB,
+  internalQuery: mockInternalQuery,
+  getInternalDB: mockGetInternalDB,
+}));
+
+mock.module("@atlas/api/lib/logger", () => ({
+  createLogger: () => ({
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    debug: () => {},
+  }),
+}));
+
+// Import after mocks are registered
+const { getConversationId, setConversationId } = await import("../threads");
+
+describe("threads", () => {
+  beforeEach(() => {
+    mockHasInternalDB.mockClear();
+    mockInternalQuery.mockClear();
+    mockPoolQuery.mockClear();
+    mockGetInternalDB.mockClear();
+  });
+
+  describe("getConversationId", () => {
+    it("returns null when hasInternalDB() is false", async () => {
+      mockHasInternalDB.mockReturnValue(false);
+
+      const result = await getConversationId("C123", "1234567890.000001");
+      expect(result).toBeNull();
+      expect(mockInternalQuery).not.toHaveBeenCalled();
+    });
+
+    it("returns conversation ID when mapping exists", async () => {
+      mockHasInternalDB.mockReturnValue(true);
+      mockInternalQuery.mockResolvedValue([{ conversation_id: "conv-abc-123" }]);
+
+      const result = await getConversationId("C123", "1234567890.000001");
+      expect(result).toBe("conv-abc-123");
+      expect(mockInternalQuery).toHaveBeenCalledTimes(1);
+      const [sql, params] = mockInternalQuery.mock.calls[0];
+      expect(sql).toContain("SELECT conversation_id FROM slack_threads");
+      expect(params).toEqual(["C123", "1234567890.000001"]);
+    });
+
+    it("returns null when no mapping exists", async () => {
+      mockHasInternalDB.mockReturnValue(true);
+      mockInternalQuery.mockResolvedValue([]);
+
+      const result = await getConversationId("C123", "1234567890.000001");
+      expect(result).toBeNull();
+    });
+
+    it("returns null on DB error (logs error)", async () => {
+      mockHasInternalDB.mockReturnValue(true);
+      mockInternalQuery.mockRejectedValue(new Error("table does not exist"));
+
+      // Should catch the error and return null, not throw
+      const result = await getConversationId("C123", "1234567890.000001");
+      expect(result).toBeNull();
+    });
+  });
+
+  describe("setConversationId", () => {
+    it("writes correct UPSERT to DB", async () => {
+      mockHasInternalDB.mockReturnValue(true);
+      mockPoolQuery.mockResolvedValue(undefined as never);
+
+      await setConversationId("C123", "1234567890.000001", "conv-xyz-789");
+
+      expect(mockGetInternalDB).toHaveBeenCalledTimes(1);
+      expect(mockPoolQuery).toHaveBeenCalledTimes(1);
+      const [sql, params] = mockPoolQuery.mock.calls[0];
+      expect(sql).toContain("INSERT INTO slack_threads");
+      expect(sql).toContain("ON CONFLICT");
+      expect(params).toEqual(["C123", "1234567890.000001", "conv-xyz-789"]);
+    });
+
+    it("is silent no-op when no internal DB", async () => {
+      mockHasInternalDB.mockReturnValue(false);
+
+      // Should return without error and without calling DB
+      await expect(setConversationId("C123", "1234567890.000001", "conv-abc")).resolves.toBeUndefined();
+      expect(mockGetInternalDB).not.toHaveBeenCalled();
+      expect(mockPoolQuery).not.toHaveBeenCalled();
+    });
+  });
+});

package/templates/docker/src/lib/slack/__tests__/verify.test.ts

@@ -0,0 +1,111 @@
+/**
+ * Tests for Slack request signature verification.
+ */
+
+import { describe, it, expect } from "bun:test";
+import crypto from "crypto";
+import { verifySlackSignature } from "../verify";
+
+const SIGNING_SECRET = "test_signing_secret_12345";
+
+function makeSignature(secret: string, timestamp: string, body: string): string {
+  const sigBasestring = `v0:${timestamp}:${body}`;
+  return (
+    "v0=" + crypto.createHmac("sha256", secret).update(sigBasestring).digest("hex")
+  );
+}
+
+function currentTimestamp(): string {
+  return String(Math.floor(Date.now() / 1000));
+}
+
+describe("verifySlackSignature", () => {
+  it("accepts a valid signature", () => {
+    const timestamp = currentTimestamp();
+    const body = "token=xxx&team_id=T123&text=hello";
+    const signature = makeSignature(SIGNING_SECRET, timestamp, body);
+
+    const result = verifySlackSignature(SIGNING_SECRET, signature, timestamp, body);
+    expect(result.valid).toBe(true);
+    expect("error" in result).toBe(false);
+  });
+
+  it("rejects an invalid signature", () => {
+    const timestamp = currentTimestamp();
+    const body = "token=xxx&team_id=T123&text=hello";
+    const signature = "v0=deadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678";
+
+    const result = verifySlackSignature(SIGNING_SECRET, signature, timestamp, body);
+    expect(result.valid).toBe(false);
+    if (!result.valid) expect(result.error).toBe("Invalid signature");
+  });
+
+  it("rejects missing signature header", () => {
+    const timestamp = currentTimestamp();
+    const body = "token=xxx";
+
+    const result = verifySlackSignature(SIGNING_SECRET, null, timestamp, body);
+    expect(result.valid).toBe(false);
+    if (!result.valid) expect(result.error).toBe("Missing signature or timestamp headers");
+  });
+
+  it("rejects missing timestamp header", () => {
+    const body = "token=xxx";
+    const signature = "v0=something";
+
+    const result = verifySlackSignature(SIGNING_SECRET, signature, null, body);
+    expect(result.valid).toBe(false);
+    if (!result.valid) expect(result.error).toBe("Missing signature or timestamp headers");
+  });
+
+  it("rejects expired timestamp (>5 minutes old)", () => {
+    const oldTimestamp = String(Math.floor(Date.now() / 1000) - 400); // 6+ minutes ago
+    const body = "token=xxx";
+    const signature = makeSignature(SIGNING_SECRET, oldTimestamp, body);
+
+    const result = verifySlackSignature(SIGNING_SECRET, signature, oldTimestamp, body);
+    expect(result.valid).toBe(false);
+    if (!result.valid) expect(result.error).toBe("Request timestamp too old");
+  });
+
+  it("accepts timestamp within 5-minute window", () => {
+    const recentTimestamp = String(Math.floor(Date.now() / 1000) - 200); // ~3 minutes ago
+    const body = "token=xxx";
+    const signature = makeSignature(SIGNING_SECRET, recentTimestamp, body);
+
+    const result = verifySlackSignature(SIGNING_SECRET, signature, recentTimestamp, body);
+    expect(result.valid).toBe(true);
+  });
+
+  it("rejects invalid (non-numeric) timestamp", () => {
+    const body = "token=xxx";
+    const result = verifySlackSignature(SIGNING_SECRET, "v0=abc", "not-a-number", body);
+    expect(result.valid).toBe(false);
+    if (!result.valid) expect(result.error).toBe("Invalid timestamp");
+  });
+
+  it("rejects signature with wrong secret", () => {
+    const timestamp = currentTimestamp();
+    const body = "token=xxx";
+    const signature = makeSignature("wrong_secret", timestamp, body);
+
+    const result = verifySlackSignature(SIGNING_SECRET, signature, timestamp, body);
+    expect(result.valid).toBe(false);
+    if (!result.valid) expect(result.error).toBe("Invalid signature");
+  });
+
+  it("rejects tampered body", () => {
+    const timestamp = currentTimestamp();
+    const body = "token=xxx&text=original";
+    const signature = makeSignature(SIGNING_SECRET, timestamp, body);
+
+    const result = verifySlackSignature(
+      SIGNING_SECRET,
+      signature,
+      timestamp,
+      "token=xxx&text=tampered",
+    );
+    expect(result.valid).toBe(false);
+    if (!result.valid) expect(result.error).toBe("Invalid signature");
+  });
+});