@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/cli-coverage.test.js

@@ -1,238 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Copyright (c) blamejs contributors
-"use strict";
-
-// Coverage for lib/cli.js branches not exercised by the per-command
-// cli-*.test.js files or test/00-primitives.js:
-//   - the `seed` subcommand (arg validation + a local-sqlite status run)
-//   - `dev --grace-ms` numeric validation
-//   - `api-snapshot` operator-supplied `--module` (capture + compare
-//     failure paths)
-//   - top-level `--help` / `-h` routing + unknown help topic fall-through
-// Everything drives the public b.cli.main(argv, ctx) surface with a
-// captured-output ctx; nothing here needs a live network/db backend
-// (the sqlite handle is a local temp file, same shape the existing
-// cli-audit-verify-chain / migrate tests use).
-
-var fs = require("node:fs");
-var os = require("node:os");
-var path = require("node:path");
-var helpers = require("../helpers");
-var check = helpers.check;
-var cli = require("../../lib/cli");
-
-function _captureCtx() {
-  var stdout = [];
-  var stderr = [];
-  return {
-    stdout: { write: function (s) { stdout.push(String(s)); } },
-    stderr: { write: function (s) { stderr.push(String(s)); } },
-    env:    {},
-    cwd:    process.cwd(),
-    out:    function () { return stdout.join(""); },
-    err:    function () { return stderr.join(""); },
-  };
-}
-
-function _tmpDir(prefix) {
-  return fs.mkdtempSync(path.join(os.tmpdir(), prefix + "-"));
-}
-
-async function run() {
-  var dir = _tmpDir("blamejs-cli-coverage");
-  try {
-    // =====================================================================
-    // seed — arg validation
-    // =====================================================================
-
-    // bare `seed` (no subcommand) → usage on stderr, exit 2
-    var cBare = _captureCtx();
-    var rcBare = await cli.main(["seed"], cBare);
-    check("seed: bare → exit 2",                rcBare === 2);
-    check("seed: bare → usage on stderr",       /Usage: blamejs seed/.test(cBare.err()));
-
-    // `seed help` → usage on stdout, exit 0
-    var cHelp = _captureCtx();
-    var rcHelp = await cli.main(["seed", "help"], cHelp);
-    check("seed help: exit 0",                  rcHelp === 0);
-    check("seed help: usage on stdout",         /Usage: blamejs seed/.test(cHelp.out()));
-    check("seed help: lists run + status",      /\brun\b/.test(cHelp.out()) && /\bstatus\b/.test(cHelp.out()));
-
-    // `help seed` (top-level help dispatch → SEED_USAGE)
-    var cTopHelpSeed = _captureCtx();
-    var rcTopHelpSeed = await cli.main(["help", "seed"], cTopHelpSeed);
-    check("help seed: exit 0",                  rcTopHelpSeed === 0);
-    check("help seed: prints SEED_USAGE",       /Usage: blamejs seed/.test(cTopHelpSeed.out()));
-
-    // unknown subcommand → exit 2 + usage
-    var cUnk = _captureCtx();
-    var rcUnk = await cli.main(["seed", "frobnicate"], cUnk);
-    check("seed unknown sub: exit 2",           rcUnk === 2);
-    check("seed unknown sub: names the sub",    /unknown subcommand 'frobnicate'/.test(cUnk.err()));
-
-    // run without --db → exit 2
-    var cNoDb = _captureCtx();
-    var rcNoDb = await cli.main(["seed", "run"], cNoDb);
-    check("seed run: missing --db → exit 2",    rcNoDb === 2);
-    check("seed run: missing --db message",     /--db <path> is required/.test(cNoDb.err()));
-
-    // --db present but bare (boolean flag, no value) → treated as missing
-    var cDbBool = _captureCtx();
-    var rcDbBool = await cli.main(["seed", "run", "--db"], cDbBool);
-    check("seed run: --db with no value → exit 2", rcDbBool === 2);
-    check("seed run: --db no value message",       /--db <path> is required/.test(cDbBool.err()));
-
-    // --db present, --env missing → exit 2
-    var dbPath = path.join(dir, "seed.db");
-    var cNoEnv = _captureCtx();
-    var rcNoEnv = await cli.main(["seed", "status", "--db", dbPath], cNoEnv);
-    check("seed status: missing --env → exit 2", rcNoEnv === 2);
-    check("seed status: missing --env message",  /--env <name> is required/.test(cNoEnv.err()));
-
-    // bad db path (parent dir doesn't exist) → cannot open db, exit 1
-    var cBadDb = _captureCtx();
-    var rcBadDb = await cli.main(
-      ["seed", "status", "--db", path.join(dir, "no-such-dir", "x.db"), "--env", "dev"],
-      cBadDb);
-    check("seed status: unopenable db → exit 1", rcBadDb === 1);
-    check("seed status: cannot-open message",    /cannot open db/.test(cBadDb.err()));
-
-    // =====================================================================
-    // seed — status happy path against a local sqlite file + empty dir
-    // =====================================================================
-    var seedersDir = path.join(dir, "seeders-empty");
-    var cStatus = _captureCtx();
-    var rcStatus = await cli.main(
-      ["seed", "status", "--db", dbPath, "--env", "dev", "--dir", seedersDir],
-      cStatus);
-    check("seed status: empty dir → exit 0",     rcStatus === 0);
-    check("seed status: prints env line",        /env: dev/.test(cStatus.out()));
-    check("seed status: 0 applied of 0 total",   /applied: 0 \/ 0/.test(cStatus.out()));
-    check("seed status: 0 pending",              /pending: 0/.test(cStatus.out()));
-
-    // =====================================================================
-    // dev — --grace-ms numeric validation (returns before spawning a child)
-    // =====================================================================
-    var cGraceNeg = _captureCtx();
-    var rcGraceNeg = await cli.main(
-      ["dev", "--command", "node", "--grace-ms", "-5"], cGraceNeg);
-    check("dev --grace-ms negative → exit 2",    rcGraceNeg === 2);
-    check("dev --grace-ms negative message",     /--grace-ms must be a non-negative number/.test(cGraceNeg.err()));
-
-    var cGraceNaN = _captureCtx();
-    var rcGraceNaN = await cli.main(
-      ["dev", "--command", "node", "--grace-ms", "not-a-number"], cGraceNaN);
-    check("dev --grace-ms non-numeric → exit 2", rcGraceNaN === 2);
-    check("dev --grace-ms non-numeric message",  /--grace-ms must be a non-negative number/.test(cGraceNaN.err()));
-
-    // missing --command still exits 2 (guards the `dev` entry independent
-    // of the grace-ms path above)
-    var cDevNoCmd = _captureCtx();
-    var rcDevNoCmd = await cli.main(["dev"], cDevNoCmd);
-    check("dev: missing --command → exit 2",     rcDevNoCmd === 2);
-    check("dev: missing --command message",      /--command <cmd> is required/.test(cDevNoCmd.err()));
-
-    // =====================================================================
-    // dev — --ignore pattern refusal takes the standard exit-2 + stderr
-    // path, never rejects main(). An over-length pattern, a ReDoS-shape
-    // pattern guardRegex refuses, and a pattern RegExp() can't compile are
-    // all operator-input validation failures: they must return exit 2 like
-    // every other dev validation, not reject the awaited promise (which the
-    // bin shim would surface as a stack-trace + exit 1).
-    // =====================================================================
-    async function _devIgnore(pattern) {
-      var c = _captureCtx();
-      var rejected = false;
-      var rc;
-      try {
-        rc = await cli.main(["dev", "--command", "node", "--ignore", pattern], c);
-      } catch (_e) {
-        rejected = true;
-      }
-      return { rc: rc, rejected: rejected, err: c.err() };
-    }
-
-    var igLong = await _devIgnore("a".repeat(300));
-    check("dev --ignore over-length → never rejects main()", igLong.rejected === false);
-    check("dev --ignore over-length → exit 2",               igLong.rc === 2);
-    check("dev --ignore over-length message",                /exceeds max length/.test(igLong.err));
-
-    var igReDoS = await _devIgnore("(a+)+$");
-    check("dev --ignore ReDoS-shape → never rejects main()", igReDoS.rejected === false);
-    check("dev --ignore ReDoS-shape → exit 2",               igReDoS.rc === 2);
-    check("dev --ignore ReDoS-shape message",                /refused by guardRegex/.test(igReDoS.err));
-
-    var igBadRe = await _devIgnore("(");
-    check("dev --ignore uncompilable → never rejects main()", igBadRe.rejected === false);
-    check("dev --ignore uncompilable → exit 2",               igBadRe.rc === 2);
-    check("dev --ignore uncompilable message",                /--ignore pattern/.test(igBadRe.err));
-
-    // =====================================================================
-    // api-snapshot — operator-supplied --module
-    // =====================================================================
-
-    // capture from a non-existent module → cannot load, exit 1
-    var cModBad = _captureCtx();
-    var rcModBad = await cli.main(
-      ["api-snapshot", "capture", "--module", path.join(dir, "no-module.js")], cModBad);
-    check("api-snapshot capture bad --module → exit 1", rcModBad === 1);
-    check("api-snapshot capture bad --module message",
-          /cannot load module/.test(cModBad.err()));
-
-    // capture from a valid operator module → wrote snapshot, exit 0
-    var customMod = path.join(dir, "custom-mod.js");
-    fs.writeFileSync(customMod,
-      "module.exports = { version: \"9.9.9\", greet: function greet() {} };");
-    var customSnap = path.join(dir, "custom-snap.json");
-    var cModOk = _captureCtx();
-    var rcModOk = await cli.main(
-      ["api-snapshot", "capture", "--file", customSnap, "--module", customMod], cModOk);
-    check("api-snapshot capture custom --module → exit 0", rcModOk === 0);
-    check("api-snapshot capture custom --module wrote file", fs.existsSync(customSnap));
-    check("api-snapshot capture custom --module reports version",
-          /frameworkVersion 9\.9\.9/.test(cModOk.out()));
-
-    // compare where the saved snapshot reads fine but capturing the CURRENT
-    // surface fails (bad --module) → "cannot capture current surface", exit 1
-    var cCmpBad = _captureCtx();
-    var rcCmpBad = await cli.main(
-      ["api-snapshot", "compare", "--file", customSnap, "--module", path.join(dir, "gone.js")],
-      cCmpBad);
-    check("api-snapshot compare uncapturable current → exit 1", rcCmpBad === 1);
-    check("api-snapshot compare uncapturable current message",
-          /cannot capture current surface/.test(cCmpBad.err()));
-
-    // =====================================================================
-    // top-level dispatch — help routing edges
-    // =====================================================================
-
-    // `<cmd> --help` synthesizes `help <cmd>` → that command's usage
-    var cMigHelp = _captureCtx();
-    var rcMigHelp = await cli.main(["migrate", "--help"], cMigHelp);
-    check("migrate --help → exit 0",             rcMigHelp === 0);
-    check("migrate --help prints migrate usage", /Usage: blamejs migrate/.test(cMigHelp.out()));
-
-    // `-h` short flag takes the same route
-    var cMigH = _captureCtx();
-    var rcMigH = await cli.main(["migrate", "-h"], cMigH);
-    check("migrate -h → exit 0",                 rcMigH === 0);
-    check("migrate -h prints migrate usage",     /Usage: blamejs migrate/.test(cMigH.out()));
-
-    // `help <unknown-topic>` falls through to the top-level usage
-    var cBogus = _captureCtx();
-    var rcBogus = await cli.main(["help", "totally-bogus-topic"], cBogus);
-    check("help unknown-topic → exit 0",         rcBogus === 0);
-    check("help unknown-topic prints top usage", /blamejs <command>/.test(cBogus.out()));
-  } finally {
-    try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_e) { /* best-effort */ }
-  }
-}
-
-module.exports = { run: run };
-
-if (require.main === module) {
-  run().then(
-    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
-    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
-  );
-}

package/lib/vendor/blamejs/test/layer-0-primitives/content-credentials-coverage.test.js

@@ -1,319 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Copyright (c) blamejs contributors
-"use strict";
-/**
- * b.contentCredentials — error-path + adversarial-input coverage.
- *
- * Complements content-credentials.test.js (happy-path + round-trips) by
- * driving the validation refusals, malformed-input rejections, wrong-state
- * protocol errors, and fail-closed verdicts the round-trip tests never
- * reach: bad build opts, missing required fields, signCose timestamp-
- * posture and reuse-signature refusals, verifyCose malformed-CBOR / bad
- * hashAlg / wrong-key verdicts, CAWG identity-assertion shape + trust-
- * resolution refusals, and the GB 45438-2025 CAC implicit-label gate.
- */
-
-var helpers = require("../helpers");
-var b     = helpers.b;
-var check = helpers.check;
-var nodeCrypto = require("node:crypto");
-
-var cc = b.contentCredentials;
-
-// Capture the error a thrower raises (or null when it does not throw) —
-// one definition so the many config-time refusal checks below don't each
-// re-roll a `threw = null; try {} catch {}` block.
-function _err(fn) {
-  try { fn(); return null; } catch (e) { return e; }
-}
-
-var VALID_BUILD = {
-  provider: "Acme AI Inc.", system: "acme-image-v3",
-  systemVersion: "3.2.1", contentId: "img-001",
-};
-function _buildOpts(overrides) {
-  return Object.assign({}, VALID_BUILD, overrides);
-}
-
-async function run() {
-  var e;
-
-  // ---- build() / _validateBuildOpts adversarial input ----
-  check("build(null) rejected as bad-opts",
-    (e = _err(function () { cc.build(null); })) && e.code === "content-credentials/bad-opts");
-  check("build('str') rejected as bad-opts",
-    (e = _err(function () { cc.build("nope"); })) && e.code === "content-credentials/bad-opts");
-
-  check("build missing system rejected",
-    (e = _err(function () { cc.build({ provider: "x", systemVersion: "1.0.0", contentId: "y" }); })) &&
-    e.code === "MISSING_SYSTEM");
-  check("build missing systemVersion rejected",
-    (e = _err(function () { cc.build({ provider: "x", system: "s", contentId: "y" }); })) &&
-    e.code === "MISSING_SYSTEMVERSION");
-  check("build missing contentId rejected",
-    (e = _err(function () { cc.build({ provider: "x", system: "s", systemVersion: "1.0.0" }); })) &&
-    e.code === "MISSING_CONTENTID");
-
-  check("build provider over 256 chars rejected",
-    (e = _err(function () { cc.build(_buildOpts({ provider: "a".repeat(257) })); })) &&
-    e.code === "content-credentials/bad-provider");
-  check("build system with illegal chars rejected",
-    (e = _err(function () { cc.build(_buildOpts({ system: "has space!" })); })) &&
-    e.code === "content-credentials/bad-system");
-  check("build systemVersion over 64 chars rejected",
-    (e = _err(function () { cc.build(_buildOpts({ systemVersion: "1.0.0-" + "a".repeat(60) })); })) &&
-    e.code === "content-credentials/bad-version");
-  check("build contentId with illegal chars rejected",
-    (e = _err(function () { cc.build(_buildOpts({ contentId: "bad id!" })); })) &&
-    e.code === "content-credentials/bad-content-id");
-  check("build contentSha3 wrong length rejected",
-    (e = _err(function () { cc.build(_buildOpts({ contentSha3: "abc123" })); })) &&
-    e.code === "content-credentials/bad-content-hash");
-  check("build contentSha3 non-hex rejected",
-    (e = _err(function () { cc.build(_buildOpts({ contentSha3: "z".repeat(128) })); })) &&
-    e.code === "content-credentials/bad-content-hash");
-
-  // Valid optional fields flow through (providerContact / sha3 / visibleDisclosure).
-  var mFull = cc.build(_buildOpts({
-    providerContact: "https://acme.example/contact",
-    contentType: "image/png", contentSha3: "a".repeat(128),
-    visibleDisclosure: "AI-generated by Acme",
-  }));
-  check("build carries optional contentSha3", mFull.content.sha3_512 === "a".repeat(128));
-  check("build carries providerContact", mFull.provider.contact === "https://acme.example/contact");
-  check("build carries visibleDisclosure", mFull.visibleDisclosure === "AI-generated by Acme");
-
-  // Adversarial numeric generatedAt (NaN) must not yield a manifest whose
-  // ISO timestamp is a broken value — either a clean rejection or a valid
-  // ISO string is acceptable; an unparseable generatedAtIso is not.
-  var nanRes = null, nanErr = null;
-  try { nanRes = cc.build(_buildOpts({ generatedAt: NaN })); } catch (ne) { nanErr = ne; }
-  check("build NaN generatedAt: rejected or valid ISO (no Invalid-Date manifest)",
-    nanErr !== null || (nanRes && !isNaN(Date.parse(nanRes.generatedAtIso))));
-
-  // ---- required() ----
-  check("required(null) returns opts-required",
-    JSON.stringify(cc.required(null)) === JSON.stringify(["opts-required"]));
-  check("required('str') returns opts-required",
-    JSON.stringify(cc.required("x")) === JSON.stringify(["opts-required"]));
-  var reqNonString = cc.required({ provider: 123, system: "s", systemVersion: "1.0.0", contentId: "c" });
-  check("required treats non-string provider as missing",
-    reqNonString.length === 1 && reqNonString[0] === "missing-provider");
-
-  // ---- sign() ----
-  var pair = b.crypto.generateSigningKeyPair("ml-dsa-87");
-  var manifest = cc.build(VALID_BUILD);
-
-  check("sign(null) rejected as bad-manifest",
-    (e = _err(function () { cc.sign(null, { privateKeyPem: pair.privateKey }); })) &&
-    e.code === "content-credentials/bad-manifest");
-  check("sign missing privateKeyPem rejected",
-    (e = _err(function () { cc.sign(manifest, {}); })) && e.code === "BAD_KEY");
-  check("sign no opts rejected",
-    (e = _err(function () { cc.sign(manifest); })) && e.code === "BAD_KEY");
-
-  // ---- verify() fail-closed verdicts (never throws) ----
-  var env = cc.sign(manifest, { privateKeyPem: pair.privateKey, audit: false });
-  check("verify(null) returns envelope-shape", cc.verify(null, pair.publicKey, { audit: false }).reason === "envelope-shape");
-  check("verify({}) returns envelope-shape", cc.verify({}, pair.publicKey, { audit: false }).reason === "envelope-shape");
-  check("verify empty signature returns envelope-shape",
-    cc.verify({ manifest: manifest, signature: "" }, pair.publicKey, { audit: false }).reason === "envelope-shape");
-  check("verify non-string key returns public-key-required",
-    cc.verify(env, 123, { audit: false }).reason === "public-key-required");
-  check("verify empty key returns public-key-required",
-    cc.verify(env, "", { audit: false }).reason === "public-key-required");
-
-  // A cryptographically valid signature over a payload that is NOT a
-  // complete SB-942 manifest must still fail the required-field gate.
-  var envPartial = cc.sign({ foo: "bar" }, { privateKeyPem: pair.privateKey, audit: false });
-  var vPartial = cc.verify(envPartial, pair.publicKey, { audit: false });
-  check("verify valid-sig-but-incomplete-manifest returns missing-required",
-    vPartial.valid === false && vPartial.reason.indexOf("missing-required") === 0);
-
-  // ---- signCose() config-time refusals ----
-  check("signCose(null) rejected as bad-manifest",
-    (e = _err(function () { cc.signCose(null, { privateKeyPem: pair.privateKey }); })) &&
-    e.code === "content-credentials/bad-manifest");
-  check("signCose missing privateKeyPem rejected",
-    (e = _err(function () { cc.signCose(manifest, { alg: "ml-dsa-87", timestamp: false, timestampOptOutReason: "x" }); })) &&
-    e.code === "BAD_KEY");
-  check("signCose timestamp as string rejected",
-    (e = _err(function () { cc.signCose(manifest, { privateKeyPem: pair.privateKey, timestamp: "soon" }); })) &&
-    e.code === "content-credentials/bad-timestamp");
-  check("signCose timestamp as array rejected",
-    (e = _err(function () { cc.signCose(manifest, { privateKeyPem: pair.privateKey, timestamp: [] }); })) &&
-    e.code === "content-credentials/bad-timestamp");
-  check("signCose timestamp with unknown key rejected",
-    (e = _err(function () { cc.signCose(manifest, { privateKeyPem: pair.privateKey, timestamp: { bogus: 1 } }); })) &&
-    /unknown option/.test(e.message));
-  check("signCose timestamp.token non-Buffer rejected",
-    (e = _err(function () { cc.signCose(manifest, { privateKeyPem: pair.privateKey, timestamp: { token: "not-a-buffer" } }); })) &&
-    e.code === "content-credentials/bad-timestamp-token");
-  check("signCose timestamp.signature empty rejected",
-    (e = _err(function () { cc.signCose(manifest, { privateKeyPem: pair.privateKey, timestamp: { token: Buffer.from([1]), signature: "" } }); })) &&
-    e.code === "content-credentials/bad-reuse-signature");
-
-  // Reused (pinned) signature that does not verify against this manifest+key
-  // is refused — a stale or foreign signature can't be re-embedded.
-  check("signCose reuse-signature that does not verify is refused",
-    (e = _err(function () {
-      cc.signCose(manifest, { privateKeyPem: pair.privateKey,
-        timestamp: { token: Buffer.from([1, 2, 3]), signature: nodeCrypto.randomBytes(32).toString("base64") } });
-    })) && e.code === "content-credentials/reuse-signature-mismatch");
-
-  // certChain emission — single-cert and multi-cert branches (bytes are
-  // carried opaquely; a non-Buffer entry is rejected, not silently kept).
-  var coseSingle = cc.signCose(manifest, {
-    privateKeyPem: pair.privateKey, timestamp: false, timestampOptOutReason: "x",
-    certChain: [Buffer.from([1, 2, 3])], audit: false,
-  });
-  var coseMulti = cc.signCose(manifest, {
-    privateKeyPem: pair.privateKey, timestamp: false, timestampOptOutReason: "x",
-    certChain: [Buffer.from([1, 2, 3]), Buffer.from([4, 5, 6])], audit: false,
-  });
-  check("signCose single-cert certChain produces COSE bytes", Buffer.isBuffer(coseSingle.coseSign1));
-  check("signCose multi-cert certChain grows COSE bytes", coseMulti.coseSign1.length > coseSingle.coseSign1.length);
-  check("signCose non-Buffer certChain entry is rejected (throws)",
-    _err(function () {
-      cc.signCose(manifest, { privateKeyPem: pair.privateKey, timestamp: false,
-        timestampOptOutReason: "x", certChain: ["not a buffer"] });
-    }) !== null);
-
-  // ---- verifyCose() fail-closed verdicts (never throws) ----
-  var optout = cc.signCose(manifest, {
-    privateKeyPem: pair.privateKey, alg: "ml-dsa-87",
-    timestamp: false, timestampOptOutReason: "no TSA in test", audit: false,
-  });
-  check("verifyCose bad timestampHashAlg returns bad-tst-hash verdict",
-    cc.verifyCose(optout.coseSign1, pair.publicKey, { timestampHashAlg: "MD5", audit: false }).reason === "content-credentials/bad-tst-hash");
-  check("verifyCose non-CBOR (0x00) returns cose-malformed verdict",
-    cc.verifyCose(Buffer.from([0x00]), pair.publicKey, { audit: false }).reason === "content-credentials/cose-malformed");
-  check("verifyCose undecodable CBOR (0xff) returns cose-malformed verdict",
-    cc.verifyCose(Buffer.from([0xff]), pair.publicKey, { audit: false }).reason === "content-credentials/cose-malformed");
-  var otherPair = b.crypto.generateSigningKeyPair("ml-dsa-87");
-  var vWrongKey = cc.verifyCose(optout.coseSign1, otherPair.publicKey, { requireTimestamp: false, audit: false });
-  check("verifyCose wrong key returns signature-mismatch verdict",
-    vWrongKey.valid === false && vWrongKey.reason === "signature-mismatch");
-
-  // ---- attachIdentityAssertion() config-time refusals ----
-  var refs = [{ label: "c2pa.actions", data: { action: "c2pa.created" } }];
-  check("attach() no args rejected (bad binding)",
-    (e = _err(function () { cc.attachIdentityAssertion(); })) && e.code === "content-credentials/bad-identity-binding");
-  check("attach subject non-object rejected",
-    (e = _err(function () { cc.attachIdentityAssertion({ binding: "x509", subject: "nope", referencedAssertions: refs, privateKeyPem: pair.privateKey }); })) &&
-    e.code === "content-credentials/bad-identity-subject");
-  check("attach subject array rejected",
-    (e = _err(function () { cc.attachIdentityAssertion({ binding: "x509", subject: [], referencedAssertions: refs, privateKeyPem: pair.privateKey }); })) &&
-    e.code === "content-credentials/bad-identity-subject");
-  check("attach subject empty object rejected",
-    (e = _err(function () { cc.attachIdentityAssertion({ binding: "x509", subject: {}, referencedAssertions: refs, privateKeyPem: pair.privateKey }); })) &&
-    e.code === "content-credentials/bad-identity-subject");
-  check("attach referencedAssertions non-array rejected",
-    (e = _err(function () { cc.attachIdentityAssertion({ binding: "x509", subject: { name: "x" }, referencedAssertions: "nope", privateKeyPem: pair.privateKey }); })) &&
-    e.code === "content-credentials/bad-referenced-assertions");
-  check("attach referencedAssertions empty rejected",
-    (e = _err(function () { cc.attachIdentityAssertion({ binding: "x509", subject: { name: "x" }, referencedAssertions: [], privateKeyPem: pair.privateKey }); })) &&
-    e.code === "content-credentials/bad-referenced-assertions");
-  check("attach missing privateKeyPem rejected",
-    (e = _err(function () { cc.attachIdentityAssertion({ binding: "x509", subject: { name: "x" }, referencedAssertions: refs }); })) &&
-    e.code === "BAD_KEY");
-  check("attach unknown opt key rejected",
-    (e = _err(function () { cc.attachIdentityAssertion({ binding: "x509", subject: { name: "x" }, referencedAssertions: refs, privateKeyPem: pair.privateKey, bogus: 1 }); })) &&
-    /unknown option/.test(e.message));
-
-  // ---- verifyIdentityAssertion() fail-closed verdicts (never throws) ----
-  var ia = cc.attachIdentityAssertion({
-    binding: "x509", subject: { name: "Acme Newsroom" },
-    referencedAssertions: refs, privateKeyPem: pair.privateKey, audit: false,
-  });
-  check("verifyIdentity null assertion returns assertion-shape",
-    cc.verifyIdentityAssertion(null, pair.publicKey, { referencedAssertions: refs }).reason === "assertion-shape");
-  check("verifyIdentity missing signer_payload returns assertion-shape",
-    cc.verifyIdentityAssertion({ signature: "x" }, pair.publicKey, { referencedAssertions: refs }).reason === "assertion-shape");
-  check("verifyIdentity non-string key returns public-key-required",
-    cc.verifyIdentityAssertion(ia, 123, { referencedAssertions: refs }).reason === "public-key-required");
-  check("verifyIdentity bad signer_payload binding returns signer-payload-shape",
-    cc.verifyIdentityAssertion({ signer_payload: { binding: "bogus", referenced_assertions: [] }, signature: "AA==" }, pair.publicKey, { referencedAssertions: refs }).reason === "signer-payload-shape");
-  check("verifyIdentity missing referencedAssertions opt returns referenced-assertions-required",
-    cc.verifyIdentityAssertion(ia, pair.publicKey, { audit: false }).reason === "referenced-assertions-required");
-  check("verifyIdentity referencedAssertions count mismatch returns count-mismatch",
-    cc.verifyIdentityAssertion(ia, pair.publicKey, { referencedAssertions: [refs[0], { label: "b" }], audit: false }).reason === "referenced-assertions-count-mismatch");
-
-  // x509 trust-resolution reason branches (self-asserted -> verified:false).
-  var vNoChain = cc.verifyIdentityAssertion(ia, pair.publicKey, {
-    referencedAssertions: refs, identityTrustAnchorsPem: "anchor-pem", audit: false,
-  });
-  check("verifyIdentity anchor but no chain -> verified:false no-cert-chain",
-    vNoChain.valid === true && vNoChain.verified === false && vNoChain.reason === "no-cert-chain");
-  var vBadAnchors = cc.verifyIdentityAssertion(ia, pair.publicKey, {
-    referencedAssertions: refs, identityCertChainPem: "chain-pem", identityTrustAnchorsPem: "", audit: false,
-  });
-  check("verifyIdentity empty trust anchor -> verified:false bad-trust-anchors",
-    vBadAnchors.verified === false && vBadAnchors.reason === "bad-trust-anchors");
-  var vBadChain = cc.verifyIdentityAssertion(ia, pair.publicKey, {
-    referencedAssertions: refs, identityCertChainPem: "not a pem", identityTrustAnchorsPem: "also not a pem", audit: false,
-  });
-  check("verifyIdentity unparseable chain cert -> verified:false bad-chain-cert",
-    vBadChain.verified === false && vBadChain.reason === "bad-chain-cert");
-
-  // ---- cacImplicitLabel() GB 45438-2025 gate ----
-  var CAC_VALID = {
-    providerName: "Example AI", providerCode: "91110000600037341A",
-    contentId: "asset-2026-05-17-abc123", contentKind: "image",
-    generatedAt: "2026-05-17T20:00:00Z",
-  };
-  function _cac(overrides) { return Object.assign({}, CAC_VALID, overrides); }
-
-  var label = cc.cacImplicitLabel(CAC_VALID);
-  check("cacImplicitLabel valid returns frozen AIGC block",
-    Object.isFrozen(label) && label.aigcMarker === "AIGC" && label.providerCode === "91110000600037341A");
-  check("cacImplicitLabel(null) rejected",
-    (e = _err(function () { cc.cacImplicitLabel(null); })) && e.code === "cac-implicit-label/bad-opts");
-  check("cacImplicitLabel missing providerName rejected",
-    (e = _err(function () { cc.cacImplicitLabel(_cac({ providerName: undefined })); })) &&
-    e.code === "cac-implicit-label/bad-provider-name");
-  check("cacImplicitLabel oversize providerName rejected",
-    (e = _err(function () { cc.cacImplicitLabel(_cac({ providerName: "a".repeat(257) })); })) &&
-    e.code === "cac-implicit-label/oversize-provider-name");
-  check("cacImplicitLabel bad providerCode rejected",
-    (e = _err(function () { cc.cacImplicitLabel(_cac({ providerCode: "123" })); })) &&
-    e.code === "cac-implicit-label/bad-provider-code");
-  check("cacImplicitLabel illegal contentId rejected",
-    (e = _err(function () { cc.cacImplicitLabel(_cac({ contentId: "bad id!" })); })) &&
-    e.code === "cac-implicit-label/bad-content-id");
-  check("cacImplicitLabel unknown contentKind rejected",
-    (e = _err(function () { cc.cacImplicitLabel(_cac({ contentKind: "hologram" })); })) &&
-    e.code === "cac-implicit-label/bad-content-kind");
-  check("cacImplicitLabel non-ISO generatedAt rejected",
-    (e = _err(function () { cc.cacImplicitLabel(_cac({ generatedAt: "yesterday" })); })) &&
-    e.code === "cac-implicit-label/bad-generated-at");
-
-  // ---- cacImplicitLabelRead() parser ----
-  check("cacImplicitLabelRead object input",
-    cc.cacImplicitLabelRead(Object.assign({ aigcMarker: "AIGC" }, CAC_VALID)).aigcMarker === "AIGC");
-  check("cacImplicitLabelRead string input",
-    cc.cacImplicitLabelRead(JSON.stringify(Object.assign({ aigcMarker: "AIGC" }, CAC_VALID))).contentKind === "image");
-  check("cacImplicitLabelRead Buffer input",
-    cc.cacImplicitLabelRead(Buffer.from(JSON.stringify(Object.assign({ aigcMarker: "AIGC" }, CAC_VALID)))).providerCode === "91110000600037341A");
-  check("cacImplicitLabelRead malformed JSON string rejected",
-    (e = _err(function () { cc.cacImplicitLabelRead("{not json"); })) && e.code === "cac-implicit-label/bad-json");
-  check("cacImplicitLabelRead malformed JSON Buffer rejected",
-    (e = _err(function () { cc.cacImplicitLabelRead(Buffer.from("{not json")); })) && e.code === "cac-implicit-label/bad-json");
-  check("cacImplicitLabelRead numeric input rejected",
-    (e = _err(function () { cc.cacImplicitLabelRead(42); })) && e.code === "cac-implicit-label/bad-input");
-  check("cacImplicitLabelRead missing AIGC marker rejected",
-    (e = _err(function () { cc.cacImplicitLabelRead({ providerName: "x" }); })) &&
-    e.code === "cac-implicit-label/missing-aigc-marker");
-  check("cacImplicitLabelRead re-applies field gate",
-    (e = _err(function () { cc.cacImplicitLabelRead(Object.assign({ aigcMarker: "AIGC" }, CAC_VALID, { providerCode: "BAD" })); })) &&
-    e.code === "cac-implicit-label/bad-provider-code");
-}
-
-module.exports = { run: run };
-
-if (require.main === module) {
-  run().then(
-    function () { console.log("[content-credentials-coverage] OK — " + helpers.getChecks() + " checks passed"); },
-    function (e) { console.error("FAIL:", (e && e.stack) || e); process.exit(1); }
-  );
-}