@asterxsk/kiln 0.3.0 → 0.4.0

package/agent.bak.20260905-190020/extensions/pi-web-access/test/config-path.test.mjs

@@ -1,283 +0,0 @@
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import { mkdir, mkdtemp, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { test } from "node:test";
-
-const utilsUrl = new URL("../utils.ts", import.meta.url).href;
-const exaUrl = new URL("../exa.ts", import.meta.url).href;
-const geminiApiUrl = new URL("../gemini-api.ts", import.meta.url).href;
-
-function runChild(script, env) {
-	const childEnv = { ...process.env };
-	delete childEnv.EXA_API_KEY;
-	delete childEnv.GEMINI_API_KEY;
-	delete childEnv.GOOGLE_GEMINI_BASE_URL;
-	delete childEnv.CLOUDFLARE_API_KEY;
-	for (const [key, value] of Object.entries(env)) {
-		if (value === undefined) {
-			delete childEnv[key];
-		} else {
-			childEnv[key] = value;
-		}
-	}
-	return spawnSync(process.execPath, ["--input-type=module"], {
-		input: script,
-		encoding: "utf8",
-		env: childEnv,
-	});
-}
-
-test("web-search config path uses PI_CODING_AGENT_DIR before XDG_CONFIG_HOME", async () => {
-	const root = await mkdtemp(join(tmpdir(), "pi-web-access-config-path-"));
-	const agentDir = join(root, "agent-dir");
-	const xdgDir = join(root, "xdg");
-	await mkdir(agentDir, { recursive: true });
-	await mkdir(join(xdgDir, "pi"), { recursive: true });
-	await writeFile(join(agentDir, "web-search.json"), JSON.stringify({ exaApiKey: "exa-from-agent" }) + "\n", "utf8");
-	await writeFile(join(xdgDir, "pi", "web-search.json"), JSON.stringify({}) + "\n", "utf8");
-
-	const child = runChild(`
-		const { getWebSearchConfigDir, getWebSearchConfigPath } = await import(${JSON.stringify(utilsUrl)});
-		const { isExaAvailable } = await import(${JSON.stringify(exaUrl)});
-		console.log(JSON.stringify({
-			dir: getWebSearchConfigDir(),
-			path: getWebSearchConfigPath(),
-			available: isExaAvailable(),
-		}));
-	`, {
-		PI_CODING_AGENT_DIR: agentDir,
-		XDG_CONFIG_HOME: xdgDir,
-		HOME: join(root, "home"),
-		USERPROFILE: join(root, "home"),
-	});
-
-	assert.equal(child.status, 0, child.stderr);
-	assert.deepEqual(JSON.parse(child.stdout), {
-		dir: agentDir,
-		path: join(agentDir, "web-search.json"),
-		available: true,
-	});
-});
-
-test("web-search config path uses XDG_CONFIG_HOME pi directory when agent dir is unset", async () => {
-	const root = await mkdtemp(join(tmpdir(), "pi-web-access-xdg-config-"));
-	const xdgDir = join(root, "xdg");
-	await mkdir(join(xdgDir, "pi"), { recursive: true });
-	await writeFile(join(xdgDir, "pi", "web-search.json"), JSON.stringify({ geminiApiKey: "gemini-from-xdg" }) + "\n", "utf8");
-
-	const child = runChild(`
-		const { getWebSearchConfigDir, getWebSearchConfigPath } = await import(${JSON.stringify(utilsUrl)});
-		const { isGeminiApiAvailable } = await import(${JSON.stringify(geminiApiUrl)});
-		console.log(JSON.stringify({
-			dir: getWebSearchConfigDir(),
-			path: getWebSearchConfigPath(),
-			available: isGeminiApiAvailable(),
-		}));
-	`, {
-		PI_CODING_AGENT_DIR: undefined,
-		XDG_CONFIG_HOME: xdgDir,
-		HOME: join(root, "home"),
-		USERPROFILE: join(root, "home"),
-	});
-
-	assert.equal(child.status, 0, child.stderr);
-	assert.deepEqual(JSON.parse(child.stdout), {
-		dir: join(xdgDir, "pi"),
-		path: join(xdgDir, "pi", "web-search.json"),
-		available: true,
-	});
-});
-
-test("Gemini base URL and Cloudflare auth use env before config", async () => {
-	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-base-url-"));
-	const agentDir = join(root, "agent-dir");
-	await mkdir(agentDir, { recursive: true });
-	await writeFile(join(agentDir, "web-search.json"), JSON.stringify({
-		geminiBaseUrl: "https://config.example.com/gemini/",
-		cloudflareApiKey: "config-cf-key",
-	}) + "\n", "utf8");
-
-	const child = runChild(`
-		const {
-			getApiHost,
-			getVersionedApiBase,
-			buildAuthHeaders,
-			isGeminiApiAvailable,
-		} = await import(${JSON.stringify(geminiApiUrl)});
-		console.log(JSON.stringify({
-			host: getApiHost(),
-			base: getVersionedApiBase(),
-			headers: buildAuthHeaders(),
-			available: isGeminiApiAvailable(),
-		}));
-	`, {
-		PI_CODING_AGENT_DIR: agentDir,
-		XDG_CONFIG_HOME: undefined,
-		HOME: join(root, "home"),
-		USERPROFILE: join(root, "home"),
-		GOOGLE_GEMINI_BASE_URL: "https://gateway.ai.cloudflare.com/v1/account/gateway/google-ai-studio/",
-		CLOUDFLARE_API_KEY: "env-cf-key",
-	});
-
-	assert.equal(child.status, 0, child.stderr);
-	assert.deepEqual(JSON.parse(child.stdout), {
-		host: "https://gateway.ai.cloudflare.com/v1/account/gateway/google-ai-studio",
-		base: "https://gateway.ai.cloudflare.com/v1/account/gateway/google-ai-studio/v1beta",
-		headers: { "cf-aig-authorization": "Bearer env-cf-key" },
-		available: true,
-	});
-});
-
-test("Gemini command source is lazy, overrides stale env, rotates, and uses header auth", async () => {
-	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-command-"));
-	const agentDir = join(root, "agent-dir");
-	const commandPath = join(root, "read-key.mjs");
-	const counterPath = join(root, "counter");
-	await mkdir(agentDir, { recursive: true });
-	await writeFile(commandPath, `import { existsSync, readFileSync, writeFileSync } from "node:fs";\nconst counterPath = process.argv[2];\nconst count = (existsSync(counterPath) ? Number(readFileSync(counterPath, "utf8")) : 0) + 1;\nwriteFileSync(counterPath, String(count));\nprocess.stdout.write("synthetic-gemini-" + count);\n`, "utf8");
-	await writeFile(join(agentDir, "web-search.json"), JSON.stringify({
-		geminiApiKey: `!${JSON.stringify(process.execPath)} ${JSON.stringify(commandPath)} ${JSON.stringify(counterPath)}`,
-	}) + "\n", "utf8");
-
-	const child = runChild(`
-		import { existsSync } from "node:fs";
-		const requests = [];
-		globalThis.fetch = async (url, init) => {
-			requests.push({ url: String(url), headers: Object.fromEntries(new Headers(init.headers)) });
-			return new Response(JSON.stringify({ candidates: [{ content: { parts: [{ text: "ok" }] } }] }), {
-				status: 200,
-				headers: { "content-type": "application/json" },
-			});
-		};
-		const { isGeminiApiAvailable, queryGeminiApiWithVideo } = await import(${JSON.stringify(geminiApiUrl)});
-		const available = isGeminiApiAvailable();
-		const lazy = !existsSync(${JSON.stringify(counterPath)});
-		await queryGeminiApiWithVideo("first", "files/one", { timeoutMs: 1000 });
-		await queryGeminiApiWithVideo("second", "files/two", { timeoutMs: 1000 });
-		console.log(JSON.stringify({ available, lazy, requests }));
-	`, {
-		PI_CODING_AGENT_DIR: agentDir,
-		XDG_CONFIG_HOME: undefined,
-		HOME: join(root, "home"),
-		USERPROFILE: join(root, "home"),
-		GEMINI_API_KEY: "stale-gemini-environment-value",
-	});
-
-	assert.equal(child.status, 0, child.stderr);
-	const output = JSON.parse(child.stdout);
-	assert.equal(output.available, true);
-	assert.equal(output.lazy, true);
-	assert.deepEqual(output.requests.map(request => request.headers["x-goog-api-key"]), [
-		"synthetic-gemini-1",
-		"synthetic-gemini-2",
-	]);
-	for (const request of output.requests) {
-		assert.equal(new URL(request.url).searchParams.has("key"), false);
-		assert.equal(new URL(request.url).searchParams.has("api_key"), false);
-		assert.equal(request.url.includes("stale-gemini-environment-value"), false);
-	}
-});
-
-test("Gemini API helper rejects credential query parameters before fetch", async () => {
-	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-query-reject-"));
-	const child = runChild(`
-		let fetchCalls = 0;
-		globalThis.fetch = async () => { fetchCalls += 1; return new Response("ok"); };
-		const { fetchGeminiApi } = await import(${JSON.stringify(geminiApiUrl)});
-		let message = "";
-		try {
-			await fetchGeminiApi("https://generativelanguage.googleapis.com/v1beta/models/test?API_KEY=synthetic-secret", {}, "synthetic-secret");
-		} catch (error) {
-			message = error.message;
-		}
-		console.log(JSON.stringify({ fetchCalls, message }));
-	`, {
-		PI_CODING_AGENT_DIR: undefined,
-		XDG_CONFIG_HOME: undefined,
-		HOME: join(root, "home"),
-		USERPROFILE: join(root, "home"),
-	});
-	assert.equal(child.status, 0, child.stderr);
-	const output = JSON.parse(child.stdout);
-	assert.equal(output.fetchCalls, 0);
-	assert.match(output.message, /query parameters are not allowed/);
-	assert.equal(output.message.includes("synthetic-secret"), false);
-});
-
-test("Gemini provider and transport errors redact the resolved credential", async () => {
-	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-redaction-"));
-	const secret = "SYNTHETIC_GEMINI_SECRET_MUST_NOT_ESCAPE";
-	const child = runChild(`
-		let call = 0;
-		globalThis.fetch = async () => {
-			call += 1;
-			if (call === 1) return new Response(${JSON.stringify("provider echoed SYNTHETIC_GEMINI_SECRET_MUST_NOT_ESCAPE")}, { status: 400 });
-			throw new Error(${JSON.stringify("transport echoed SYNTHETIC_GEMINI_SECRET_MUST_NOT_ESCAPE")});
-		};
-		const { queryGeminiApiWithVideo } = await import(${JSON.stringify(geminiApiUrl)});
-		const messages = [];
-		for (let index = 0; index < 2; index += 1) {
-			try { await queryGeminiApiWithVideo("describe", "files/test", { timeoutMs: 1000 }); }
-			catch (error) { messages.push(error.message); }
-		}
-		console.log(JSON.stringify(messages));
-	`, {
-		PI_CODING_AGENT_DIR: undefined,
-		XDG_CONFIG_HOME: undefined,
-		HOME: join(root, "home"),
-		USERPROFILE: join(root, "home"),
-		GEMINI_API_KEY: secret,
-	});
-	assert.equal(child.status, 0, child.stderr);
-	const messages = JSON.parse(child.stdout);
-	assert.equal(messages.length, 2);
-	for (const message of messages) {
-		assert.equal(message.includes(secret), false);
-		assert.equal(message.includes("[redacted]"), true);
-	}
-});
-
-test("Gemini API requests include role and gateway auth headers", async () => {
-	const root = await mkdtemp(join(tmpdir(), "pi-web-access-gemini-request-"));
-	const child = runChild(`
-		let capturedUrl = "";
-		let capturedHeaders = null;
-		let capturedBody = null;
-		globalThis.fetch = async (url, init) => {
-			capturedUrl = String(url);
-			capturedHeaders = Object.fromEntries(new Headers(init.headers));
-			capturedBody = JSON.parse(init.body);
-			return new Response(JSON.stringify({ candidates: [{ content: { parts: [{ text: "ok" }] } }] }), {
-				status: 200,
-				headers: { "content-type": "application/json" },
-			});
-		};
-
-		const { queryGeminiApiWithVideo } = await import(${JSON.stringify(geminiApiUrl)});
-		const text = await queryGeminiApiWithVideo("Describe", "files/test", { model: "gemini-test", timeoutMs: 1000 });
-		console.log(JSON.stringify({ text, capturedUrl, capturedHeaders, capturedBody }));
-	`, {
-		PI_CODING_AGENT_DIR: undefined,
-		XDG_CONFIG_HOME: undefined,
-		HOME: join(root, "home"),
-		USERPROFILE: join(root, "home"),
-		GOOGLE_GEMINI_BASE_URL: "https://gateway.ai.cloudflare.com/v1/account/gateway/google-ai-studio",
-		CLOUDFLARE_API_KEY: "env-cf-key",
-	});
-
-	assert.equal(child.status, 0, child.stderr);
-	const output = JSON.parse(child.stdout);
-	assert.equal(output.text, "ok");
-	assert.equal(output.capturedUrl, "https://gateway.ai.cloudflare.com/v1/account/gateway/google-ai-studio/v1beta/models/gemini-test:generateContent");
-	assert.equal(output.capturedHeaders["cf-aig-authorization"], "Bearer env-cf-key");
-	assert.equal(output.capturedHeaders["content-type"], "application/json");
-	assert.deepEqual(output.capturedBody.contents, [{
-		role: "user",
-		parts: [
-			{ fileData: { fileUri: "files/test" } },
-			{ text: "Describe" },
-		],
-	}]);
-});

package/agent.bak.20260905-190020/extensions/pi-web-access/test/content-find.test.mjs

@@ -1,25 +0,0 @@
-import assert from "node:assert/strict";
-import { test } from "node:test";
-
-import { findContent } from "../content-find.ts";
-
-test("findContent supports exact, case-insensitive, and fuzzy matches", () => {
-	const text = "Alpha configuration guide.\n\nThe server configuraton value is 42.";
-
-	assert.equal(findContent(text, ["configuration"], "exact").matchCount, 1);
-	assert.equal(findContent(text, ["ALPHA"], "case-insensitive").matchCount, 1);
-	assert.equal(findContent(text, ["configuration value"], "fuzzy").matchCount, 1);
-});
-
-test("findContent caps the complete formatted response", () => {
-	const query = "x".repeat(500);
-	const text = Array.from(
-		{ length: 30 },
-		(_, index) => `${"a".repeat(500)} ${query} ${"b".repeat(500)} ${index}`,
-	).join("\n\n");
-	const result = findContent(text, [query], "exact");
-
-	assert.equal(result.matchCount, 30);
-	assert.ok(result.returnedMatches < result.matchCount);
-	assert.ok(result.text.length <= 20_000);
-});

package/agent.bak.20260905-190020/extensions/pi-web-access/test/credential-source.test.mjs

@@ -1,118 +0,0 @@
-import assert from "node:assert/strict";
-import { test } from "node:test";
-
-import {
-	CredentialResolutionError,
-	hasCredentialSource,
-	resolveCredential,
-} from "../credential-source.ts";
-
-const fake = value => async () => ({ stdout: value });
-
-function options(configuredValue, environmentValue) {
-	return { provider: "Synthetic", configuredValue, environmentValue };
-}
-
-test("literal and legacy environment credentials preserve existing precedence", async () => {
-	assert.equal(await resolveCredential(options("literal-value", "environment-value")), "environment-value");
-	assert.equal(await resolveCredential(options("literal-value", undefined)), "literal-value");
-	assert.equal(await resolveCredential(options(undefined, "environment-value")), "environment-value");
-	assert.equal(await resolveCredential(options(undefined, undefined)), null);
-});
-
-test("explicit environment sources use only the named variable", async () => {
-	assert.equal(await resolveCredential({
-		...options("${SCOPED_SYNTHETIC_KEY}", "stale-legacy-value"),
-		environment: { SCOPED_SYNTHETIC_KEY: "scoped-value" },
-	}), "scoped-value");
-	await assert.rejects(
-		resolveCredential({
-			...options("$SCOPED_SYNTHETIC_KEY", "stale-legacy-value"),
-			environment: {},
-		}),
-		err => err instanceof CredentialResolutionError && err.category === "environment-empty",
-	);
-});
-
-test("command sources override stale values, remain lazy, and rotate per resolution", async () => {
-	let calls = 0;
-	const runCommand = async (command, runOptions) => {
-		calls += 1;
-		assert.equal(command, "/trusted/read synthetic");
-		assert.deepEqual(runOptions.environment, {
-			HOME: "/synthetic/home",
-			PATH: "/usr/bin:/bin",
-			OP_SESSION_my: "synthetic-password-manager-session",
-		});
-		return { stdout: calls === 1 ? "first-value\n" : "second-value\n" };
-	};
-	const commandOptions = {
-		...options("!/trusted/read synthetic", "stale-environment-value"),
-		runCommand,
-		environment: {
-			HOME: "/synthetic/home",
-			PATH: "/usr/bin:/bin",
-			EXA_API_KEY: "stale-provider-key-must-not-reach-command",
-			OP_SESSION_my: "synthetic-password-manager-session",
-			OP_SERVICE_ACCOUNT_TOKEN: "must-not-reach-command",
-			NODE_OPTIONS: "--require=untrusted.js",
-		},
-	};
-
-	assert.equal(hasCredentialSource(commandOptions), true);
-	assert.equal(calls, 0);
-	assert.equal(await resolveCredential(commandOptions), "first-value");
-	assert.equal(await resolveCredential(commandOptions), "second-value");
-	assert.equal(calls, 2);
-});
-
-test("command output must be one non-empty bounded value", async () => {
-	for (const [stdout, category] of [
-		["", "command-empty"],
-		["one\ntwo\n", "command-invalid-output"],
-		["x".repeat(16_385), "command-output-too-large"],
-	]) {
-		await assert.rejects(
-			resolveCredential({ ...options("!ignored", undefined), runCommand: fake(stdout) }),
-			err => err instanceof CredentialResolutionError && err.category === category,
-		);
-	}
-});
-
-test("command failures are categorized and redact command output", async () => {
-	const secret = "SYNTHETIC_SECRET_MUST_NOT_ESCAPE";
-	for (const [failure, category] of [
-		[Object.assign(new Error(`spawn failed ${secret}`), { code: "ENOENT", stderr: secret }), "command-failed"],
-		[Object.assign(new Error(`timed out ${secret}`), { killed: true, stderr: secret }), "command-timeout"],
-		[Object.assign(new Error(`too large ${secret}`), { code: "ERR_CHILD_PROCESS_STDIO_MAXBUFFER", stderr: secret }), "command-output-too-large"],
-	]) {
-		await assert.rejects(
-			resolveCredential({
-				...options("!/trusted/read synthetic", "stale-value"),
-				runCommand: async () => { throw failure; },
-			}),
-			err => {
-				assert.equal(err instanceof CredentialResolutionError, true);
-				assert.equal(err.category, category);
-				assert.equal(err.message.includes(secret), false);
-				assert.equal(err.message.includes("/trusted/read"), false);
-				return true;
-			},
-		);
-	}
-});
-
-test("escaped source prefixes remain literal and override legacy environment values", async () => {
-	assert.equal(await resolveCredential(options("$$OPENAI_API_KEY", "legacy-value")), "$OPENAI_API_KEY");
-	assert.equal(await resolveCredential(options("$!literal-command", "legacy-value")), "!literal-command");
-	assert.equal(hasCredentialSource(options("$$OPENAI_API_KEY", undefined)), true);
-});
-
-test("malformed explicit sources fail closed instead of becoming literals", async () => {
-	for (const source of ["!", "$BAD-NAME", "${UNCLOSED"]) {
-		await assert.rejects(
-			resolveCredential(options(source, "stale-value")),
-			err => err instanceof CredentialResolutionError && err.category === "invalid-source",
-		);
-	}
-});

package/agent.bak.20260905-190020/extensions/pi-web-access/test/data-uri-sanitize.test.mjs

@@ -1,210 +0,0 @@
-import assert from "node:assert/strict";
-import { Buffer } from "node:buffer";
-import { createHash } from "node:crypto";
-import { performance } from "node:perf_hooks";
-import { test } from "node:test";
-
-import { sanitizeInlineDataUris } from "../data-uri-sanitize.ts";
-
-const DATA_URI_MARKER_PREFIX = "[pi-web-access inline data URI omitted;";
-
-function markerCount(text) {
-	return text.split(DATA_URI_MARKER_PREFIX).length - 1;
-}
-
-function assertRequiredMarkerFields(markerText, ordinal, sourcePath) {
-	assert.match(markerText, new RegExp(`ordinal=${ordinal}(?:;|\\])`));
-	assert.ok(markerText.includes(`source=${sourcePath};`));
-	assert.match(markerText, /mime=[a-z0-9!#$&^_.+\/-]+;/);
-	assert.match(markerText, /encoding=(?:base64|percent-encoded);/);
-	assert.match(markerText, /encodedBytes=\d+;/);
-	assert.match(markerText, /decodedBytes=(?:\d+|unknown)(?:;|\])/);
-	assert.match(markerText, /sha256=[a-f0-9]{64};/);
-	assert.match(markerText, /digestBasis=(?:decoded|encoded);/);
-	assert.match(markerText, /retrieval=not-retained\]/);
-}
-
-test("original 21-image failure shape collapses to bounded markers", { timeout: 20_000 }, () => {
-	const encoded = Buffer.alloc(240 * 1024, 0xa5).toString("base64");
-	const content = Array.from({ length: 21 }, (_, index) =>
-		`Prose ${index} before ![OSF screenshot ${index}](data:image/png;base64,${encoded}) prose ${index} after.`,
-	).join("\n\n");
-	assert.ok(Buffer.byteLength(content, "utf8") > 4 * 1024 * 1024);
-
-	const started = performance.now();
-	const { text, omissions } = sanitizeInlineDataUris(content, "urls[0].content");
-	const elapsedMs = performance.now() - started;
-
-	assert.equal(omissions.length, 21);
-	assert.equal(markerCount(text), 21);
-	assert.doesNotMatch(text, /data:image\/png;base64,/i);
-	for (let ordinal = 1; ordinal <= 21; ordinal++) {
-		assertRequiredMarkerFields(text, ordinal, "urls[0].content");
-	}
-	assert.ok(Buffer.byteLength(text, "utf8") < 32 * 1024);
-	assert.ok(elapsedMs < 15_000, `6-8 MiB sanitization took ${Math.round(elapsedMs)}ms`);
-});
-
-test("many individually small images have no per-payload exemption", { timeout: 20_000 }, () => {
-	const count = 4_300;
-	const encoded = Buffer.alloc(768, 0x5a).toString("base64");
-	const content = Array.from(
-		{ length: count },
-		(_, index) => `Paragraph ${index} ![small ${index}](data:image/png;base64,${encoded}) end ${index}.`,
-	).join("\n");
-
-	const { text, omissions } = sanitizeInlineDataUris(content, "urls[0].content");
-	assert.equal(omissions.length, count);
-	assert.equal(markerCount(text), count);
-	assert.doesNotMatch(text, /data:image\/png;base64,/i);
-});
-
-test("readable prose and Markdown alt text remain unchanged around replacements", () => {
-	const input = "Before ![architecture diagram](data:image/png;base64,SGk=) between <img src=\"data:text/plain,hello%20world\" alt=\"inline\"> after.";
-	const { text, omissions } = sanitizeInlineDataUris(input, "urls[0].content");
-	assert.equal(omissions.length, 2);
-	assert.ok(text.startsWith("Before ![architecture diagram]("));
-	assert.ok(text.includes(") between <img src=\""));
-	assert.ok(text.endsWith("\" alt=\"inline\"> after."));
-	assert.ok(text.includes("architecture diagram"));
-	assert.ok(text.includes("alt=\"inline\""));
-	assert.equal(markerCount(text), 2);
-	assert.doesNotMatch(text, /data:/i);
-});
-
-test("small legitimate SVG is explicitly omitted with decoded digest metadata", () => {
-	const decoded = "<svg xmlns=\"http://www.w3.org/2000/svg\"><path d=\"M0 0\"/></svg>";
-	const payload = encodeURIComponent(decoded);
-	const { text, omissions } = sanitizeInlineDataUris(
-		`Diagram: ![tiny vector](data:image/svg+xml;charset=utf-8,${payload}) done`,
-		"urls[0].content",
-	);
-	assert.equal(omissions.length, 1);
-	const omission = omissions[0];
-	assert.equal(omission.mimeType, "image/svg+xml");
-	assert.equal(omission.encoding, "percent-encoded");
-	assert.equal(omission.encodedBytes, Buffer.byteLength(payload));
-	assert.equal(omission.decodedBytes, Buffer.byteLength(decoded));
-	assert.equal(omission.sha256, createHash("sha256").update(decoded).digest("hex"));
-	assert.equal(omission.digestBasis, "decoded");
-	assert.equal(omission.retrieval, "not-retained");
-	assert.ok(text.includes("![tiny vector]("));
-	assertRequiredMarkerFields(text, 1, "urls[0].content");
-	assert.doesNotMatch(text, /data:/i);
-});
-
-test("data URI variants are handled without payload-bearing errors", () => {
-	const fixtures = {
-		base64: "data:image/png;base64,SGVsbG8=",
-		percent: "data:text/plain,hello%20world",
-		missingMime: "data:;base64,SGk=",
-		parameters: "data:text/plain;charset=utf-8,hello%2Cworld",
-		quoted: "<img src='data:image/gif;base64,R0lGODlhAQABAIAAAAUEBA=='>",
-		quotedApostrophe: "<img src=\"data:text/plain,it's\">",
-		markdown: "![alt](data:application/octet-stream;base64,AAEC)",
-		invalidBase64: "data:image/png;base64,***not-base64***",
-		mixedCase: "DATA:IMAGE/PNG;BASE64,UE5H",
-	};
-	const byKey = new Map();
-	for (const [key, input] of Object.entries(fixtures)) {
-		const result = sanitizeInlineDataUris(input, key);
-		assert.equal(result.omissions.length, 1, `expected one omission for ${key}`);
-		assert.doesNotMatch(result.text, /data:/i);
-		byKey.set(key, { omission: result.omissions[0], text: result.text });
-	}
-	assert.equal(byKey.get("missingMime").omission.mimeType, "text/plain");
-	assert.equal(byKey.get("missingMime").omission.encoding, "base64");
-	assert.equal(byKey.get("parameters").omission.decodedBytes, 11);
-	assert.equal(byKey.get("mixedCase").omission.mimeType, "image/png");
-	const invalid = byKey.get("invalidBase64");
-	assert.equal(invalid.omission.decodedBytes, null);
-	assert.equal(invalid.omission.digestBasis, "encoded");
-	assert.equal(invalid.omission.decodeError, "invalid-base64-character");
-	assert.ok(invalid.text.includes("decodedBytes=unknown"));
-	assert.ok(invalid.text.includes("decodeError=invalid-base64-character"));
-	assert.ok(!invalid.text.includes("not-base64"));
-});
-
-test("malformed enclosed data URIs are wholly removed without payload suffix leakage", () => {
-	const cases = [
-		{
-			input: '<img src="data:image/png;base64,QUFB QkJC">',
-			forbidden: ["QUFB", "QkJC"],
-			error: "invalid-base64-character",
-		},
-		{
-			input: "![x](data:text/plain,abc(def)ghi)",
-			forbidden: ["abc(def)ghi", "ghi)"],
-			decodedBytes: 11,
-		},
-		{
-			input: "data:text/plain,abc(def)ghi",
-			forbidden: ["abc(def)ghi"],
-			decodedBytes: 11,
-		},
-		{
-			input: "![x](data:image/png;base64,SGVs\nbG8=)",
-			forbidden: ["SGVs", "bG8="],
-			error: "invalid-base64-character",
-		},
-		{
-			input: '<img src="data:image/png;base64">',
-			forbidden: ["data:image/png;base64"],
-			error: "missing-comma",
-			encodedBytes: Buffer.byteLength("image/png;base64"),
-		},
-	];
-
-	for (const fixture of cases) {
-		const result = sanitizeInlineDataUris(fixture.input, "urls[0].content");
-		assert.equal(result.omissions.length, 1);
-		assert.equal(markerCount(result.text), 1);
-		assert.doesNotMatch(result.text, /data:/i);
-		for (const fragment of fixture.forbidden) assert.ok(!result.text.includes(fragment));
-		if (fixture.error) assert.equal(result.omissions[0].decodeError, fixture.error);
-		if (fixture.encodedBytes !== undefined) assert.equal(result.omissions[0].encodedBytes, fixture.encodedBytes);
-		if (fixture.decodedBytes !== undefined) assert.equal(result.omissions[0].decodedBytes, fixture.decodedBytes);
-	}
-	assert.equal(
-		sanitizeInlineDataUris("ordinary data: value", "urls[0].content").text,
-		"ordinary data: value",
-	);
-});
-
-test("valid RFC MIME token characters are normalized without truncating the URI", () => {
-	for (const mimeType of ["application/x.foo~bar", "application/x.foo*bar", "application/x.foo'bar"]) {
-		const result = sanitizeInlineDataUris(`<img src=\"data:${mimeType},ok\">`, "urls[0].content");
-		assert.equal(result.omissions.length, 1);
-		assert.equal(result.omissions[0].mimeType, mimeType);
-		assert.equal(result.omissions[0].decodedBytes, 2);
-		assert.doesNotMatch(result.text, /data:/i);
-	}
-});
-
-test("malformed comma-less candidates scale linearly and are explicitly marked", { timeout: 15_000 }, () => {
-	function measure(count) {
-		const input = Array.from({ length: count }, () => "data:x;").join(" ");
-		const started = performance.now();
-		const result = sanitizeInlineDataUris(input, "urls[0].content");
-		const elapsedMs = performance.now() - started;
-		assert.equal(result.omissions.length, count);
-		assert.ok(result.omissions.every((item) => item.decodeError === "missing-comma"));
-		assert.doesNotMatch(result.text, /data:/i);
-		return elapsedMs;
-	}
-	const smallMs = measure(2_000);
-	const largeMs = measure(4_000);
-	assert.ok(largeMs < 10_000, `malformed scan took ${Math.round(largeMs)}ms`);
-	assert.ok(largeMs <= smallMs * 4 + 500, `nonlinear malformed scan: ${smallMs}ms -> ${largeMs}ms`);
-});
-
-test("overlong headers are bounded and classified without retaining header or payload", () => {
-	const header = `image/png;name=${"x".repeat(2_048)};base64`;
-	const result = sanitizeInlineDataUris(`![x](data:${header},SGVsbG8=)`, "urls[0].content");
-	assert.equal(result.omissions.length, 1);
-	assert.equal(result.omissions[0].decodedBytes, null);
-	assert.equal(result.omissions[0].decodeError, "header-too-long");
-	assert.equal(result.omissions[0].digestBasis, "encoded");
-	assert.ok(!result.text.includes("x".repeat(128)));
-	assert.doesNotMatch(result.text, /data:/i);
-});