agent-canvas 0.2.1 → 0.6.0

package/daemon/src/share-e2e.test.ts

@@ -1,277 +0,0 @@
-/**
- * End-to-end test: exercises daemon-side encryption + the real worker
- * fetch handler against in-memory R2/KV stubs, then plays the role of
- * the browser to decrypt the canvas JS and meta, and finally the role of
- * a reviewer to submit encrypted feedback and verify the daemon poller
- * decrypts it back.
- *
- * No network, no Miniflare — just direct fetch-handler invocation, which
- * exercises every production code path except the actual Workers runtime.
- */
-
-import { describe, expect, test } from "bun:test";
-import { mkdtempSync, rmSync } from "fs";
-import { join } from "path";
-import { tmpdir } from "os";
-
-import workerHandler from "../../workers/canvas-share/src/index";
-import type { Env } from "../../workers/canvas-share/src/types";
-import { SessionManager } from "@fabrika/canvas-kernel/server";
-import { buildSharePayload, encryptSharePayload } from "./share";
-import {
-  generateShareKey,
-  exportShareKey,
-  importShareKey,
-  encryptString,
-  decryptString,
-  ENCRYPTION_META,
-} from "../client/shareCrypto";
-
-// ---- Minimal in-memory R2 / KV stubs ---------------------------------------
-
-function makeR2(): R2Bucket {
-  const store = new Map<string, { body: Uint8Array; contentType?: string }>();
-  return {
-    async put(key: string, value: any, opts?: any) {
-      const bytes = typeof value === "string"
-        ? new TextEncoder().encode(value)
-        : value instanceof Uint8Array
-          ? value
-          : new Uint8Array(await new Response(value).arrayBuffer());
-      store.set(key, { body: bytes, contentType: opts?.httpMetadata?.contentType });
-      return null as any;
-    },
-    async get(key: string) {
-      const v = store.get(key);
-      if (!v) return null;
-      return {
-        body: new Response(v.body).body,
-        async text() { return new TextDecoder().decode(v.body); },
-        async json() { return JSON.parse(new TextDecoder().decode(v.body)); },
-        async arrayBuffer() { return v.body.buffer; },
-        httpMetadata: { contentType: v.contentType },
-      } as any;
-    },
-    async delete(key: string) { store.delete(key); },
-    async list(opts?: any) {
-      const prefix = opts?.prefix ?? "";
-      const objects = [];
-      for (const k of store.keys()) {
-        if (k.startsWith(prefix)) objects.push({ key: k });
-      }
-      return { objects, truncated: false, delimitedPrefixes: [] } as any;
-    },
-  } as unknown as R2Bucket;
-}
-
-function makeKV(): KVNamespace {
-  const store = new Map<string, { value: string; meta?: any; expireAt?: number }>();
-  return {
-    async put(key: string, value: string, opts?: any) {
-      const expireAt = opts?.expirationTtl ? Date.now() + opts.expirationTtl * 1000 : undefined;
-      store.set(key, { value, meta: opts?.metadata, expireAt });
-    },
-    async get(key: string) {
-      const v = store.get(key);
-      if (!v) return null;
-      if (v.expireAt && v.expireAt < Date.now()) { store.delete(key); return null; }
-      return v.value;
-    },
-    async delete(key: string) { store.delete(key); },
-    async list(opts?: any) {
-      const prefix = opts?.prefix ?? "";
-      const keys = [];
-      for (const [k, v] of store.entries()) {
-        if (!k.startsWith(prefix)) continue;
-        if (v.expireAt && v.expireAt < Date.now()) continue;
-        keys.push({ name: k, metadata: v.meta });
-      }
-      return { keys, list_complete: true, cursor: "" } as any;
-    },
-  } as unknown as KVNamespace;
-}
-
-function makeEnv(): Env {
-  return {
-    BLOBS: makeR2(),
-    FEEDBACK: makeKV(),
-    ASSETS: { fetch: async () => new Response("asset", { status: 200 }) } as any,
-  };
-}
-
-// ---- The full flow ---------------------------------------------------------
-
-describe("encrypted share e2e (daemon → worker → browser → reviewer → daemon)", () => {
-  test("round-trips canvas JS, meta, and feedback through the real worker handler", async () => {
-    const testDir = mkdtempSync(join(tmpdir(), "canvas-e2e-"));
-    try {
-      // ----- 1. Daemon side: prepare a session + revision ------------------
-      const sm = new SessionManager(testDir);
-      const sid = "sess-secret-id";
-      const SECRET_LABEL = "Secret quarterly plan";
-      const SECRET_COMPILED = "/* SECRET */ export default function Plan(){ return null; }";
-      const SECRET_JSX = "<Section title='Top secret'>Confidential strategy.</Section>";
-
-      sm.upsert(sid, new Map([["plan.jsx", SECRET_JSX]]), "/tmp", SECRET_LABEL);
-      sm.saveCompiled(sid, "plan.jsx", SECRET_COMPILED);
-
-      // ----- 2. Daemon encrypts the payload --------------------------------
-      const plaintext = buildSharePayload(sm, sid, 1, "1.0.0");
-      const key = await generateShareKey();
-      const encodedKey = await exportShareKey(key);
-      const encryptedPayload = await encryptSharePayload(plaintext, key);
-
-      // ----- 3. POST it to the real worker handler -------------------------
-      const env = makeEnv();
-      const createRes = await workerHandler.fetch(
-        new Request("https://example.com/shares", {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify(encryptedPayload),
-        }),
-        env,
-      );
-      expect(createRes.status).toBe(200);
-      const created = await createRes.json() as { shareId: string; url: string; ownerToken: string };
-      expect(created.shareId).toMatch(/^[a-f0-9]{24}$/);
-      expect(created.url).toBe(`https://example.com/s/${created.shareId}`);
-
-      // ----- 4. Confirm what's stored in R2 is ciphertext, NOT plaintext ----
-      const storedPayloadObj = await env.BLOBS.get(`shares/${created.shareId}/payload.json`);
-      const storedPayload = JSON.parse(await storedPayloadObj!.text()) as any;
-      expect(storedPayload.encryption).toEqual({ alg: "AES-GCM", v: 1 });
-      expect(storedPayload.origin.sessionId).not.toBe(sid);
-      expect(storedPayload.origin.label).not.toBe(SECRET_LABEL);
-      expect(JSON.stringify(storedPayload)).not.toContain(SECRET_LABEL);
-      expect(JSON.stringify(storedPayload)).not.toContain("SECRET");
-      expect(JSON.stringify(storedPayload)).not.toContain("Confidential");
-
-      const storedCanvasJsObj = await env.BLOBS.get(`shares/${created.shareId}/canvas/plan.js`);
-      const storedCanvasJs = await storedCanvasJsObj!.text();
-      expect(storedCanvasJs).not.toContain("SECRET");
-      expect(storedCanvasJs).not.toContain("function Plan");
-
-      // ----- 5. Browser side: fetch /meta, decrypt origin.label/sessionId --
-      const metaRes = await workerHandler.fetch(
-        new Request(`https://example.com/s/${created.shareId}/meta`),
-        env,
-      );
-      expect(metaRes.status).toBe(200);
-      const meta = await metaRes.json() as any;
-      expect(meta.encryption).toEqual({ alg: "AES-GCM", v: 1 });
-
-      const browserKey = await importShareKey(encodedKey);
-      const decryptedSessionId = await decryptString(browserKey, meta.origin.sessionId);
-      const decryptedLabel = await decryptString(browserKey, meta.origin.label);
-      expect(decryptedSessionId).toBe(sid);
-      expect(decryptedLabel).toBe(SECRET_LABEL);
-
-      // ----- 6. Browser fetches canvas JS and decrypts it -------------------
-      const canvasRes = await workerHandler.fetch(
-        new Request(`https://example.com/s/${created.shareId}/canvas/plan.js`),
-        env,
-      );
-      expect(canvasRes.status).toBe(200);
-      const ciphertextBody = await canvasRes.text();
-      const decryptedJs = await decryptString(browserKey, ciphertextBody);
-      expect(decryptedJs).toBe(SECRET_COMPILED);
-
-      // ----- 7. Reviewer submits encrypted feedback ------------------------
-      const SECRET_NAME = "Dr. Confidential";
-      const SECRET_NOTE = "This section reveals our pricing strategy.";
-      const SECRET_GENERAL = "Overall: please redact slide 3 before sharing further.";
-      const encryptedFeedback = {
-        author: {
-          id: "reviewer-1",
-          name: await encryptString(browserKey, SECRET_NAME),
-        },
-        revision: 1,
-        annotations: [{
-          id: "ann-1",
-          createdAt: "2026-05-18T12:00:00Z",
-          snippet: await encryptString(browserKey, "[Section] Top secret"),
-          note: await encryptString(browserKey, SECRET_NOTE),
-          canvasFile: await encryptString(browserKey, "plan.jsx"),
-        }],
-        generalNote: await encryptString(browserKey, SECRET_GENERAL),
-        encryption: ENCRYPTION_META,
-      };
-
-      const submitRes = await workerHandler.fetch(
-        new Request(`https://example.com/s/${created.shareId}/feedback`, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify(encryptedFeedback),
-        }),
-        env,
-      );
-      expect(submitRes.status).toBe(200);
-
-      // ----- 8. Confirm KV-stored feedback has no plaintext leakage --------
-      const kvList = await (env.FEEDBACK as any).list({ prefix: `fb:${created.shareId}:` });
-      expect(kvList.keys.length).toBe(1);
-      const kvValueRaw = await env.FEEDBACK.get(kvList.keys[0].name);
-      expect(kvValueRaw).not.toBeNull();
-      expect(kvValueRaw!).not.toContain(SECRET_NAME);
-      expect(kvValueRaw!).not.toContain(SECRET_NOTE);
-      expect(kvValueRaw!).not.toContain(SECRET_GENERAL);
-      expect(kvValueRaw!).not.toContain("plan.jsx");
-
-      // ----- 9. Daemon polls /feedback and decrypts ------------------------
-      const pollRes = await workerHandler.fetch(
-        new Request(`https://example.com/shares/${created.shareId}/feedback`),
-        env,
-      );
-      expect(pollRes.status).toBe(200);
-      const polled = await pollRes.json() as { entries: any[] };
-      expect(polled.entries.length).toBe(1);
-      const wireEntry = polled.entries[0];
-      expect(wireEntry.encryption).toEqual({ alg: "AES-GCM", v: 1 });
-
-      // Daemon-side key (same encodedKey, freshly imported as the poller does)
-      const daemonKey = await importShareKey(encodedKey);
-      const decryptedName = await decryptString(daemonKey, wireEntry.author.name);
-      const decryptedSnippet = await decryptString(daemonKey, wireEntry.annotations[0].snippet);
-      const decryptedNote = await decryptString(daemonKey, wireEntry.annotations[0].note);
-      const decryptedCanvasFile = await decryptString(daemonKey, wireEntry.annotations[0].canvasFile);
-      const decryptedGeneral = await decryptString(daemonKey, wireEntry.generalNote);
-
-      expect(decryptedName).toBe(SECRET_NAME);
-      expect(decryptedSnippet).toBe("[Section] Top secret");
-      expect(decryptedNote).toBe(SECRET_NOTE);
-      expect(decryptedCanvasFile).toBe("plan.jsx");
-      expect(decryptedGeneral).toBe(SECRET_GENERAL);
-
-      // ----- 10. Legacy unencrypted share still works ----------------------
-      const legacyEnv = makeEnv();
-      const legacyCreate = await workerHandler.fetch(
-        new Request("https://example.com/shares", {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify(plaintext),
-        }),
-        legacyEnv,
-      );
-      expect(legacyCreate.status).toBe(200);
-      const legacy = await legacyCreate.json() as { shareId: string };
-
-      const legacyMeta = await (await workerHandler.fetch(
-        new Request(`https://example.com/s/${legacy.shareId}/meta`),
-        legacyEnv,
-      )).json() as any;
-      expect(legacyMeta.encryption).toBeUndefined();
-      expect(legacyMeta.origin.sessionId).toBe(sid);
-      expect(legacyMeta.origin.label).toBe(SECRET_LABEL);
-
-      const legacyCanvas = await (await workerHandler.fetch(
-        new Request(`https://example.com/s/${legacy.shareId}/canvas/plan.js`),
-        legacyEnv,
-      )).text();
-      expect(legacyCanvas).toBe(SECRET_COMPILED);
-
-      sm.remove(sid);
-    } finally {
-      try { rmSync(testDir, { recursive: true, force: true }); } catch {}
-    }
-  });
-});

package/daemon/src/share.test.ts

@@ -1,289 +0,0 @@
-/**
- * Unit tests for the share packager. Uses a temp directory to back a real
- * SessionManager so we exercise the actual disk persistence path. The
- * worker push itself is mocked via fetch override.
- */
-
-import { describe, expect, test, beforeEach, afterEach } from "bun:test";
-import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "fs";
-import { join } from "path";
-import { tmpdir } from "os";
-import { SessionManager } from "@fabrika/canvas-kernel/server";
-import { buildSharePayload, pushShareToWorker, shareRevision, loadShareConfig, encryptSharePayload } from "./share";
-import { generateShareKey, importShareKey, decryptString } from "../client/shareCrypto";
-
-let testDir: string;
-let originalSessionsDir: string | undefined;
-
-beforeEach(() => {
-  testDir = mkdtempSync(join(tmpdir(), "canvas-share-test-"));
-  // Override SESSIONS_DIR via env (paths.ts reads at module load — for
-  // these tests we instead seed a SessionManager and inject revisions
-  // through its public API rather than touching its private dirs).
-  originalSessionsDir = process.env.CANVAS_TEST_SESSIONS_DIR;
-});
-
-afterEach(() => {
-  try { rmSync(testDir, { recursive: true, force: true }); } catch {}
-  if (originalSessionsDir !== undefined) {
-    process.env.CANVAS_TEST_SESSIONS_DIR = originalSessionsDir;
-  } else {
-    delete process.env.CANVAS_TEST_SESSIONS_DIR;
-  }
-});
-
-describe("loadShareConfig", () => {
-  test("strips trailing slashes", () => {
-    process.env.CANVAS_SHARE_ENDPOINT = "https://example.com/";
-    const cfg = loadShareConfig("0.0.0");
-    expect(cfg?.endpoint).toBe("https://example.com");
-    delete process.env.CANVAS_SHARE_ENDPOINT;
-  });
-
-  test("includes auth token when set", () => {
-    process.env.CANVAS_SHARE_ENDPOINT = "https://example.com";
-    process.env.CANVAS_SHARE_AUTH_TOKEN = "secret";
-    const cfg = loadShareConfig("0.0.0");
-    expect(cfg?.authToken).toBe("secret");
-    delete process.env.CANVAS_SHARE_ENDPOINT;
-    delete process.env.CANVAS_SHARE_AUTH_TOKEN;
-  });
-});
-
-describe("buildSharePayload", () => {
-  test("packages compiled JS + JSX source", () => {
-    const sm = new SessionManager(testDir);
-    const sid = `test-${Date.now()}`;
-    const files = new Map([["plan.jsx", "<Section>hi</Section>"]]);
-    sm.upsert(sid, files, "/tmp", "Test label");
-    sm.saveCompiled(sid, "plan.jsx", "/* compiled */ export default ()=>null");
-
-    const payload = buildSharePayload(sm, sid, 1, "0.1.27");
-    expect(payload.version).toBe(1);
-    expect(payload.origin.sessionId).toBe(sid);
-    expect(payload.origin.revision).toBe(1);
-    expect(payload.origin.label).toBe("Test label");
-    expect(payload.canvasFiles).toHaveLength(1);
-    expect(payload.canvasFiles[0].filename).toBe("plan.jsx");
-    expect(payload.canvasFiles[0].compiledJs).toContain("/* compiled */");
-    expect(payload.canvasFiles[0].sourceJsx).toContain("<Section>hi</Section>");
-    expect(payload.runtime.componentsVersion).toBe("0.1.27");
-
-    sm.remove(sid);
-  });
-
-  test("throws when revision missing", () => {
-    const sm = new SessionManager(testDir);
-    const sid = `test-${Date.now()}`;
-    sm.upsert(sid, new Map([["plan.jsx", "x"]]), "/tmp");
-    sm.saveCompiled(sid, "plan.jsx", "x");
-    expect(() => buildSharePayload(sm, sid, 99, "0.0.0")).toThrow();
-    sm.remove(sid);
-  });
-
-  test("throws when no compiled JS", () => {
-    const sm = new SessionManager(testDir);
-    const sid = `test-${Date.now()}`;
-    sm.upsert(sid, new Map([["plan.jsx", "x"]]), "/tmp");
-    // Intentionally skip saveCompiled
-    expect(() => buildSharePayload(sm, sid, 1, "0.0.0")).toThrow();
-    sm.remove(sid);
-  });
-});
-
-describe("pushShareToWorker", () => {
-  const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
-
-  test("posts JSON and unwraps the response", async () => {
-    let captured: { url: string; init: RequestInit } | null = null;
-    (globalThis as any).fetch = async (url: any, init: any) => {
-      captured = { url: String(url), init };
-      return new Response(JSON.stringify({
-        shareId: "deadbeef",
-        url: "https://example.com/s/deadbeef",
-        ownerToken: "ot",
-        expiresAt: "2026-12-31T00:00:00Z",
-      }), { status: 200, headers: { "Content-Type": "application/json" } });
-    };
-
-    const result = await pushShareToWorker(
-      {
-        version: 1,
-        origin: { sessionId: "x", revision: 1, createdAt: "2026-01-01T00:00:00Z" },
-        canvasFiles: [{ filename: "p.jsx", compiledJs: "x" }],
-        runtime: { componentsVersion: "1.0.0" },
-      },
-      { endpoint: "https://example.com", componentsVersion: "1.0.0" },
-    );
-
-    expect(result.shareId).toBe("deadbeef");
-    expect(result.url).toBe("https://example.com/s/deadbeef");
-    expect(result.ownerToken).toBe("ot");
-    expect(captured!.url).toBe("https://example.com/shares");
-    expect(captured!.init.method).toBe("POST");
-  });
-
-  test("includes Authorization header when authToken set", async () => {
-    let captured: any = null;
-    (globalThis as any).fetch = async (_url: any, init: any) => {
-      captured = init;
-      return new Response(JSON.stringify({ shareId: "x", url: "x" }), { status: 200 });
-    };
-
-    await pushShareToWorker(
-      {
-        version: 1,
-        origin: { sessionId: "x", revision: 1, createdAt: "2026-01-01T00:00:00Z" },
-        canvasFiles: [{ filename: "p.jsx", compiledJs: "x" }],
-        runtime: { componentsVersion: "1.0.0" },
-      },
-      { endpoint: "https://example.com", componentsVersion: "1.0.0", authToken: "topsecret" },
-    );
-
-    expect(captured.headers["Authorization"]).toBe("Bearer topsecret");
-  });
-
-  test("throws on non-2xx", async () => {
-    (globalThis as any).fetch = async () => new Response("nope", { status: 500 });
-    await expect(
-      pushShareToWorker(
-        {
-          version: 1,
-          origin: { sessionId: "x", revision: 1, createdAt: "2026-01-01T00:00:00Z" },
-          canvasFiles: [{ filename: "p.jsx", compiledJs: "x" }],
-          runtime: { componentsVersion: "1.0.0" },
-        },
-        { endpoint: "https://example.com", componentsVersion: "1.0.0" },
-      ),
-    ).rejects.toThrow(/500/);
-  });
-
-  test("throws on malformed response", async () => {
-    (globalThis as any).fetch = async () => new Response(JSON.stringify({ shareId: "x" }), { status: 200 });
-    await expect(
-      pushShareToWorker(
-        {
-          version: 1,
-          origin: { sessionId: "x", revision: 1, createdAt: "2026-01-01T00:00:00Z" },
-          canvasFiles: [{ filename: "p.jsx", compiledJs: "x" }],
-          runtime: { componentsVersion: "1.0.0" },
-        },
-        { endpoint: "https://example.com", componentsVersion: "1.0.0" },
-      ),
-    ).rejects.toThrow(/invalid response/);
-  });
-});
-
-describe("shareRevision", () => {
-  const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
-
-  test("records share entry on the session", async () => {
-    (globalThis as any).fetch = async () =>
-      new Response(JSON.stringify({
-        shareId: "abc123def456",
-        url: "https://example.com/s/abc123def456",
-        ownerToken: "owner",
-        expiresAt: "2026-12-31T00:00:00Z",
-      }), { status: 200 });
-
-    const sm = new SessionManager(testDir);
-    const sid = `test-${Date.now()}`;
-    sm.upsert(sid, new Map([["plan.jsx", "x"]]), "/tmp");
-    sm.saveCompiled(sid, "plan.jsx", "x");
-
-    const entry = await shareRevision(sm, sid, 1, {
-      endpoint: "https://example.com",
-      componentsVersion: "1.0.0",
-      encryption: false,
-    });
-
-    expect(entry.shareId).toBe("abc123def456");
-    expect(entry.revision).toBe(1);
-    expect(entry.ownerToken).toBe("owner");
-    expect(entry.expiresAt).toBe("2026-12-31T00:00:00Z");
-    // Legacy unencrypted share: no key recorded, no #k= fragment.
-    expect(entry.encryptionKey).toBeUndefined();
-    expect(entry.url).toBe("https://example.com/s/abc123def456");
-
-    const shares = sm.getShares(sid);
-    expect(shares).toHaveLength(1);
-    expect(shares[0].shareId).toBe("abc123def456");
-
-    sm.remove(sid);
-  });
-
-  test("encrypts payload by default and appends #k= fragment to URL", async () => {
-    let captured: any = null;
-    (globalThis as any).fetch = async (_url: any, init: any) => {
-      captured = JSON.parse(init.body);
-      return new Response(JSON.stringify({
-        shareId: "encshareid01",
-        url: "https://example.com/s/encshareid01",
-        ownerToken: "owner",
-      }), { status: 200 });
-    };
-
-    const sm = new SessionManager(testDir);
-    const sid = `enc-${Date.now()}`;
-    sm.upsert(sid, new Map([["plan.jsx", "<Section>hi</Section>"]]), "/tmp", "Secret Label");
-    sm.saveCompiled(sid, "plan.jsx", "/* SECRET-COMPILED */ export default ()=>null");
-
-    const entry = await shareRevision(sm, sid, 1, {
-      endpoint: "https://example.com",
-      componentsVersion: "1.0.0",
-      encryption: true,
-    });
-
-    // Payload going to the worker must be ciphertext, not plaintext.
-    expect(captured.encryption).toEqual({ alg: "AES-GCM", v: 1 });
-    expect(captured.origin.sessionId).not.toBe(sid);
-    expect(captured.origin.label).not.toBe("Secret Label");
-    expect(captured.canvasFiles[0].compiledJs).not.toContain("SECRET-COMPILED");
-    expect(captured.origin.revision).toBe(1); // revision stays plaintext (routing)
-    expect(captured.canvasFiles[0].filename).toBe("plan.jsx"); // filename stays plaintext
-
-    // The URL handed to the user includes the key as a fragment, and the
-    // ShareEntry retains a local copy so the daemon can decrypt feedback.
-    expect(entry.url.startsWith("https://example.com/s/encshareid01#k=")).toBe(true);
-    expect(typeof entry.encryptionKey).toBe("string");
-
-    // Round-trip: import the stored key and confirm it decrypts the
-    // ciphertext that was actually sent to the worker.
-    const key = await importShareKey(entry.encryptionKey!);
-    expect(await decryptString(key, captured.origin.sessionId)).toBe(sid);
-    expect(await decryptString(key, captured.origin.label)).toBe("Secret Label");
-    expect(await decryptString(key, captured.canvasFiles[0].compiledJs)).toContain("SECRET-COMPILED");
-
-    sm.remove(sid);
-  });
-});
-
-describe("encryptSharePayload", () => {
-  test("leaves routing fields plaintext, encrypts secrets", async () => {
-    const key = await generateShareKey();
-    const result = await encryptSharePayload(
-      {
-        version: 1,
-        origin: { sessionId: "sess", revision: 7, label: "lbl", createdAt: "2026-04-09T00:00:00.000Z" },
-        canvasFiles: [
-          { filename: "plan.jsx", compiledJs: "JS-BODY", sourceJsx: "JSX-BODY" },
-        ],
-        runtime: { componentsVersion: "9.9.9" },
-      },
-      key,
-    );
-    expect(result.encryption).toEqual({ alg: "AES-GCM", v: 1 });
-    expect(result.origin.revision).toBe(7);
-    expect(result.origin.createdAt).toBe("2026-04-09T00:00:00.000Z");
-    expect(result.runtime.componentsVersion).toBe("9.9.9");
-    expect(result.canvasFiles[0].filename).toBe("plan.jsx");
-    expect(result.origin.sessionId).not.toBe("sess");
-    expect(result.canvasFiles[0].compiledJs).not.toBe("JS-BODY");
-    expect(result.canvasFiles[0].sourceJsx).not.toBe("JSX-BODY");
-  });
-});
-
-void mkdirSync;
-void writeFileSync;