@nexart/cli 0.2.2 → 0.3.0

package/dist/__tests__/ai.test.js

@@ -0,0 +1,703 @@
+/**
+ * @nexart/cli v0.3.0 — AI command tests
+ *
+ * Tests:
+ * A) canonicalJson + computeBundleHash (unit)
+ * B) readInputJson — file input
+ * C) readInputJson — stdin input
+ * D) aiCreateCommand — request/response
+ * E) aiCertifyCommand — summary output
+ * F) aiCertifyCommand — --json output
+ * G) aiVerifyCommand — PASS
+ * H) aiVerifyCommand — FAIL (tampered hash)
+ * I) aiVerifyCommand — FAIL (wrong bundleType)
+ * J) aiVerifyCommand — attestation present/absent
+ * K) aiVerifyCommand — --json output
+ * L) backward compat — Code Mode exports exist
+ * M) callNodeApi — sets Authorization header and sends body
+ * N) aiCreateCommand — stdin input
+ * O) aiCertifyCommand — stdin input
+ * P) aiCreateCommand — saves --out file
+ * Q) aiCertifyCommand — 401 handling
+ */
+import { describe, it, before, after } from 'node:test';
+import * as assert from 'node:assert/strict';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import * as crypto from 'node:crypto';
+import { canonicalJson, computeBundleHash, readInputJson, callNodeApi, aiCreateCommand, aiCertifyCommand, aiVerifyCommand, hasAttestation, readStdinText, } from '../index.js';
+// ─── Helpers ────────────────────────────────────────────────────────────────
+const FIXED_TS = '2026-03-15T00:00:00.000Z';
+function sha256hex(data) {
+    return crypto.createHash('sha256').update(Buffer.from(data, 'utf-8')).digest('hex');
+}
+function makeTempDir() {
+    return fs.mkdtempSync(path.join(os.tmpdir(), 'nexart-cli-test-'));
+}
+function captureOutput() {
+    const stdout = [];
+    const stderr = [];
+    const origStdoutWrite = process.stdout.write.bind(process.stdout);
+    const origStderrWrite = process.stderr.write.bind(process.stderr);
+    const origConsoleLog = console.log.bind(console);
+    const origConsoleError = console.error.bind(console);
+    process.stdout.write = (chunk) => { stdout.push(String(chunk)); return true; };
+    process.stderr.write = (chunk) => { stderr.push(String(chunk)); return true; };
+    console.log = (...args) => { stdout.push(args.map(String).join(' ') + '\n'); };
+    console.error = (...args) => { stderr.push(args.map(String).join(' ') + '\n'); };
+    const restore = () => {
+        process.stdout.write = origStdoutWrite;
+        process.stderr.write = origStderrWrite;
+        console.log = origConsoleLog;
+        console.error = origConsoleError;
+    };
+    return { stdout, stderr, restore };
+}
+function mockExit() {
+    const state = { exitCode: null };
+    const orig = process.exit.bind(process);
+    process.exit = (code) => {
+        state.exitCode = code ?? 0;
+        throw new Error(`process.exit(${code})`);
+    };
+    return { get exitCode() { return state.exitCode; }, restore: () => { process.exit = orig; } };
+}
+function buildMinimalBundle(overrides = {}) {
+    const snapshot = {
+        bundleType: 'cer.ai.execution.v1',
+        executionId: 'test-001',
+        provider: 'openai',
+        model: 'gpt-4o',
+        input: 'hello',
+        output: 'world',
+        parameters: { temperature: 0, maxTokens: 100, topP: null, seed: null },
+        inputHash: 'sha256:' + sha256hex('hello'),
+        outputHash: 'sha256:' + sha256hex('world'),
+        timestamp: FIXED_TS,
+        sdkVersion: '0.8.0',
+        prompt: 'test prompt',
+        appId: null,
+        runId: null,
+        stepId: null,
+        stepIndex: null,
+        prevStepHash: null,
+        modelVersion: null,
+        toolCalls: undefined,
+    };
+    const protectedSet = {
+        bundleType: 'cer.ai.execution.v1',
+        version: '1',
+        createdAt: FIXED_TS,
+        snapshot,
+    };
+    const certificateHash = 'sha256:' + sha256hex(canonicalJson(protectedSet));
+    return {
+        bundleType: 'cer.ai.execution.v1',
+        version: '1',
+        createdAt: FIXED_TS,
+        snapshot,
+        certificateHash,
+        ...overrides,
+    };
+}
+// ─── A) canonicalJson + computeBundleHash ────────────────────────────────────
+describe('A: canonicalJson', () => {
+    it('sorts object keys lexicographically', () => {
+        assert.equal(canonicalJson({ z: 1, a: 2 }), '{"a":2,"z":1}');
+    });
+    it('does not sort arrays', () => {
+        assert.equal(canonicalJson([3, 1, 2]), '[3,1,2]');
+    });
+    it('handles null', () => {
+        assert.equal(canonicalJson(null), 'null');
+    });
+    it('handles nested objects', () => {
+        const out = canonicalJson({ b: { d: 4, c: 3 }, a: 1 });
+        assert.equal(out, '{"a":1,"b":{"c":3,"d":4}}');
+    });
+    it('omits undefined values', () => {
+        const out = canonicalJson({ a: 1, b: undefined, c: 3 });
+        assert.equal(out, '{"a":1,"c":3}');
+    });
+    it('handles primitives', () => {
+        assert.equal(canonicalJson(42), '42');
+        assert.equal(canonicalJson('hello'), '"hello"');
+        assert.equal(canonicalJson(true), 'true');
+    });
+    it('is stable for same input', () => {
+        const obj = { provider: 'openai', model: 'gpt-4o', temperature: 0 };
+        assert.equal(canonicalJson(obj), canonicalJson(obj));
+    });
+});
+describe('A: computeBundleHash', () => {
+    it('returns sha256: prefixed hash', () => {
+        const bundle = buildMinimalBundle();
+        const h = computeBundleHash(bundle);
+        assert.match(h, /^sha256:[0-9a-f]{64}$/);
+    });
+    it('matches bundle.certificateHash for valid bundle', () => {
+        const bundle = buildMinimalBundle();
+        assert.equal(computeBundleHash(bundle), bundle['certificateHash']);
+    });
+    it('differs when snapshot is tampered', () => {
+        const bundle = buildMinimalBundle();
+        const tampered = { ...bundle, snapshot: { ...bundle['snapshot'], output: 'tampered' } };
+        assert.notEqual(computeBundleHash(tampered), bundle['certificateHash']);
+    });
+    it('differs when createdAt changes', () => {
+        const bundle = buildMinimalBundle();
+        const modified = { ...bundle, createdAt: '2030-01-01T00:00:00.000Z' };
+        assert.notEqual(computeBundleHash(modified), bundle['certificateHash']);
+    });
+});
+// ─── B) readInputJson — file input ───────────────────────────────────────────
+describe('B: readInputJson — file input', () => {
+    let tmpDir;
+    before(() => { tmpDir = makeTempDir(); });
+    after(() => { fs.rmSync(tmpDir, { recursive: true, force: true }); });
+    it('reads valid JSON from a file', async () => {
+        const file = path.join(tmpDir, 'input.json');
+        const data = { executionId: 'test-001', provider: 'openai' };
+        fs.writeFileSync(file, JSON.stringify(data));
+        const result = await readInputJson(file);
+        assert.deepEqual(result, data);
+    });
+    it('exits on missing file', async () => {
+        const mock = mockExit();
+        const captured = captureOutput();
+        try {
+            await readInputJson('/nonexistent/path/file.json');
+            assert.fail('should have exited');
+        }
+        catch (e) {
+            assert.match(e.message, /exit/);
+            assert.equal(mock.exitCode, 1);
+        }
+        finally {
+            captured.restore();
+            mock.restore();
+        }
+    });
+});
+// ─── C) readInputJson — stdin ─────────────────────────────────────────────────
+describe('C: readInputJson — stdin input', () => {
+    it('reads JSON from injected stdin reader', async () => {
+        const data = { provider: 'anthropic', model: 'claude-3' };
+        const mockStdin = async () => JSON.stringify(data);
+        const result = await readInputJson(undefined, mockStdin);
+        assert.deepEqual(result, data);
+    });
+    it('exits on invalid JSON from stdin', async () => {
+        const mock = mockExit();
+        const mockStdin = async () => 'not-valid-json{{{';
+        try {
+            await readInputJson(undefined, mockStdin);
+            assert.fail('should have exited');
+        }
+        catch (e) {
+            assert.match(e.message, /exit/);
+            assert.equal(mock.exitCode, 1);
+        }
+        finally {
+            mock.restore();
+        }
+    });
+});
+// ─── D) aiCreateCommand — request/response ────────────────────────────────────
+describe('D: aiCreateCommand', () => {
+    let tmpDir;
+    before(() => { tmpDir = makeTempDir(); });
+    after(() => { fs.rmSync(tmpDir, { recursive: true, force: true }); });
+    it('sends POST to /v1/cer/ai/create and prints bundle JSON', async () => {
+        const inputFile = path.join(tmpDir, 'exec.json');
+        const input = { executionId: 'demo-001', provider: 'openai', model: 'gpt-4o-mini' };
+        fs.writeFileSync(inputFile, JSON.stringify(input));
+        const fakeBundle = { bundleType: 'cer.ai.execution.v1', certificateHash: 'sha256:aabbcc' };
+        const capturedRequests = [];
+        const mockFetch = async (url, init) => {
+            capturedRequests.push({ url, body: JSON.parse(init?.body || '{}') });
+            return new Response(JSON.stringify(fakeBundle), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        };
+        const stdoutChunks = [];
+        const origWrite = process.stdout.write.bind(process.stdout);
+        process.stdout.write = (chunk) => { stdoutChunks.push(String(chunk)); return true; };
+        try {
+            await aiCreateCommand(inputFile, { endpoint: 'http://localhost:4000', apiKey: undefined }, mockFetch);
+        }
+        finally {
+            process.stdout.write = origWrite;
+        }
+        assert.equal(capturedRequests.length, 1);
+        const req = capturedRequests[0];
+        assert.match(req.url, /\/v1\/cer\/ai\/create/);
+        assert.deepEqual(req.body, input);
+        const stdout = stdoutChunks.join('');
+        const parsed = JSON.parse(stdout);
+        assert.equal(parsed.bundleType, 'cer.ai.execution.v1');
+    });
+    it('sets Authorization header when apiKey provided', async () => {
+        const input = { executionId: 'x', provider: 'openai', model: 'gpt-4o' };
+        const stdinReader = async () => JSON.stringify(input);
+        const capturedHeaders = [];
+        const mockFetch = async (_url, init) => {
+            capturedHeaders.push(init?.headers || {});
+            return new Response(JSON.stringify({ bundleType: 'cer.ai.execution.v1' }), { status: 200 });
+        };
+        const origWrite = process.stdout.write.bind(process.stdout);
+        process.stdout.write = () => true;
+        try {
+            await aiCreateCommand(undefined, { endpoint: 'http://localhost:4000', apiKey: 'test-key-123' }, mockFetch, stdinReader);
+        }
+        finally {
+            process.stdout.write = origWrite;
+        }
+        assert.equal(capturedHeaders[0]?.['Authorization'], 'Bearer test-key-123');
+    });
+    it('exits on 401 response', async () => {
+        const input = { executionId: 'x' };
+        const stdinReader = async () => JSON.stringify(input);
+        const mockFetch = async () => new Response('{}', { status: 401 });
+        const mock = mockExit();
+        const origError = console.error;
+        console.error = () => { };
+        try {
+            await aiCreateCommand(undefined, { endpoint: 'http://localhost:4000', apiKey: 'bad-key' }, mockFetch, stdinReader);
+            assert.fail('should have exited');
+        }
+        catch (e) {
+            assert.equal(mock.exitCode, 1);
+        }
+        finally {
+            mock.restore();
+            console.error = origError;
+        }
+    });
+});
+// ─── E) aiCertifyCommand — summary output ─────────────────────────────────────
+describe('E: aiCertifyCommand — summary output', () => {
+    let tmpDir;
+    before(() => { tmpDir = makeTempDir(); });
+    after(() => { fs.rmSync(tmpDir, { recursive: true, force: true }); });
+    it('prints certificateHash / verificationUrl / attestationId summary', async () => {
+        const inputFile = path.join(tmpDir, 'exec.json');
+        fs.writeFileSync(inputFile, JSON.stringify({ executionId: 'c-001', provider: 'openai' }));
+        const certifyResponse = {
+            certificateHash: 'sha256:' + 'a'.repeat(64),
+            verificationUrl: 'https://verify.nexart.io/e/abc123',
+            attestationId: 'attest-xyz',
+        };
+        const mockFetch = async () => new Response(JSON.stringify(certifyResponse), { status: 200 });
+        const stdoutLines = [];
+        const origLog = console.log;
+        console.log = (...args) => { stdoutLines.push(args.map(String).join(' ')); };
+        try {
+            await aiCertifyCommand(inputFile, { json: false, endpoint: 'http://localhost:4000', apiKey: undefined }, mockFetch);
+        }
+        finally {
+            console.log = origLog;
+        }
+        const output = stdoutLines.join('\n');
+        assert.match(output, /CER certified/);
+        assert.match(output, /certificateHash: sha256:/);
+        assert.match(output, /verificationUrl: https:\/\/verify\.nexart\.io/);
+        assert.match(output, /attestationId:\s+attest-xyz/);
+    });
+    it('uses (not provided) when fields are absent', async () => {
+        const input = { executionId: 'c-002' };
+        const stdinReader = async () => JSON.stringify(input);
+        const mockFetch = async () => new Response(JSON.stringify({ ok: true }), { status: 200 });
+        const stdoutLines = [];
+        const origLog = console.log;
+        console.log = (...args) => { stdoutLines.push(args.map(String).join(' ')); };
+        try {
+            await aiCertifyCommand(undefined, { json: false, endpoint: 'http://localhost:4000', apiKey: undefined }, mockFetch, stdinReader);
+        }
+        finally {
+            console.log = origLog;
+        }
+        const output = stdoutLines.join('\n');
+        assert.match(output, /not provided/);
+    });
+});
+// ─── F) aiCertifyCommand — --json output ──────────────────────────────────────
+describe('F: aiCertifyCommand — --json output', () => {
+    it('prints full JSON response when json=true', async () => {
+        const input = { executionId: 'f-001' };
+        const stdinReader = async () => JSON.stringify(input);
+        const certifyResponse = {
+            certificateHash: 'sha256:' + 'b'.repeat(64),
+            verificationUrl: 'https://verify.nexart.io/e/def456',
+            attestationId: 'attest-abc',
+            extra: 'field',
+        };
+        const mockFetch = async () => new Response(JSON.stringify(certifyResponse), { status: 200 });
+        const stdoutChunks = [];
+        const origWrite = process.stdout.write.bind(process.stdout);
+        process.stdout.write = (chunk) => { stdoutChunks.push(String(chunk)); return true; };
+        try {
+            await aiCertifyCommand(undefined, { json: true, endpoint: 'http://localhost:4000', apiKey: undefined }, mockFetch, stdinReader);
+        }
+        finally {
+            process.stdout.write = origWrite;
+        }
+        const parsed = JSON.parse(stdoutChunks.join(''));
+        assert.equal(parsed.certificateHash, certifyResponse.certificateHash);
+        assert.equal(parsed.verificationUrl, certifyResponse.verificationUrl);
+        assert.equal(parsed.attestationId, certifyResponse.attestationId);
+        assert.equal(parsed.extra, 'field');
+    });
+});
+// ─── G) aiVerifyCommand — PASS ───────────────────────────────────────────────
+describe('G: aiVerifyCommand — PASS', () => {
+    let tmpDir;
+    before(() => { tmpDir = makeTempDir(); });
+    after(() => { fs.rmSync(tmpDir, { recursive: true, force: true }); });
+    it('prints PASS for a valid bundle and exits 0', async () => {
+        const bundle = buildMinimalBundle();
+        const bundleFile = path.join(tmpDir, 'bundle.json');
+        fs.writeFileSync(bundleFile, JSON.stringify(bundle));
+        const stdoutLines = [];
+        const origLog = console.log;
+        console.log = (...args) => { stdoutLines.push(args.map(String).join(' ')); };
+        const mock = mockExit();
+        try {
+            await aiVerifyCommand(bundleFile, { json: false });
+        }
+        catch (e) {
+            assert.match(e.message, /exit\(0\)/);
+        }
+        finally {
+            console.log = origLog;
+            mock.restore();
+        }
+        const output = stdoutLines.join('\n');
+        assert.match(output, /Verification result: PASS/);
+        assert.match(output, /bundleIntegrity: PASS/);
+        assert.equal(mock.exitCode, 0);
+    });
+});
+// ─── H) aiVerifyCommand — FAIL (tampered) ─────────────────────────────────────
+describe('H: aiVerifyCommand — FAIL (tampered hash)', () => {
+    let tmpDir;
+    before(() => { tmpDir = makeTempDir(); });
+    after(() => { fs.rmSync(tmpDir, { recursive: true, force: true }); });
+    it('prints FAIL when certificateHash does not match contents', async () => {
+        const bundle = buildMinimalBundle({ certificateHash: 'sha256:' + 'dead'.repeat(16) });
+        const bundleFile = path.join(tmpDir, 'tampered.json');
+        fs.writeFileSync(bundleFile, JSON.stringify(bundle));
+        const stdoutLines = [];
+        const origLog = console.log;
+        const origError = console.error;
+        console.log = (...args) => { stdoutLines.push(args.map(String).join(' ')); };
+        console.error = () => { };
+        const mock = mockExit();
+        try {
+            await aiVerifyCommand(bundleFile, { json: false });
+        }
+        catch (e) {
+            assert.match(e.message, /exit\(1\)/);
+        }
+        finally {
+            console.log = origLog;
+            console.error = origError;
+            mock.restore();
+        }
+        const output = stdoutLines.join('\n');
+        assert.match(output, /Verification result: FAIL/);
+        assert.match(output, /bundleIntegrity: FAIL/);
+        assert.equal(mock.exitCode, 1);
+    });
+});
+// ─── I) aiVerifyCommand — FAIL (wrong bundleType) ─────────────────────────────
+describe('I: aiVerifyCommand — wrong bundleType', () => {
+    it('exits with error for non-CER bundle', async () => {
+        const input = { bundleType: 'nexart.codemode.v1', outputHash: 'sha256:abc' };
+        const stdinReader = async () => JSON.stringify(input);
+        const origError = console.error;
+        console.error = () => { };
+        const mock = mockExit();
+        try {
+            await aiVerifyCommand(undefined, { json: false }, stdinReader);
+            assert.fail('should have exited');
+        }
+        catch (e) {
+            assert.match(e.message, /exit/);
+            assert.equal(mock.exitCode, 1);
+        }
+        finally {
+            console.error = origError;
+            mock.restore();
+        }
+    });
+});
+// ─── J) aiVerifyCommand — attestation present/absent ──────────────────────────
+describe('J: aiVerifyCommand — attestation reporting', () => {
+    it('reports PRESENT when attestationId is set', async () => {
+        const bundle = buildMinimalBundle({ attestationId: 'attest-live-xyz' });
+        const stdinReader = async () => JSON.stringify(bundle);
+        const stdoutLines = [];
+        const origLog = console.log;
+        console.log = (...args) => { stdoutLines.push(args.map(String).join(' ')); };
+        const mock = mockExit();
+        try {
+            await aiVerifyCommand(undefined, { json: false }, stdinReader);
+        }
+        catch (e) {
+            assert.match(e.message, /exit\(0\)/);
+        }
+        finally {
+            console.log = origLog;
+            mock.restore();
+        }
+        assert.match(stdoutLines.join('\n'), /nodeAttestation: PRESENT/);
+    });
+    it('reports ABSENT when no attestationId', async () => {
+        const bundle = buildMinimalBundle();
+        const stdinReader = async () => JSON.stringify(bundle);
+        const stdoutLines = [];
+        const origLog = console.log;
+        console.log = (...args) => { stdoutLines.push(args.map(String).join(' ')); };
+        const mock = mockExit();
+        try {
+            await aiVerifyCommand(undefined, { json: false }, stdinReader);
+        }
+        catch (e) {
+            assert.match(e.message, /exit\(0\)/);
+        }
+        finally {
+            console.log = origLog;
+            mock.restore();
+        }
+        assert.match(stdoutLines.join('\n'), /nodeAttestation: ABSENT/);
+    });
+});
+// ─── K) aiVerifyCommand — --json output ───────────────────────────────────────
+describe('K: aiVerifyCommand — --json output', () => {
+    it('prints machine-readable JSON for PASS', async () => {
+        const bundle = buildMinimalBundle();
+        const stdinReader = async () => JSON.stringify(bundle);
+        const stdoutChunks = [];
+        const origWrite = process.stdout.write.bind(process.stdout);
+        process.stdout.write = (chunk) => { stdoutChunks.push(String(chunk)); return true; };
+        const mock = mockExit();
+        try {
+            await aiVerifyCommand(undefined, { json: true }, stdinReader);
+        }
+        catch (e) {
+            assert.match(e.message, /exit\(0\)/);
+        }
+        finally {
+            process.stdout.write = origWrite;
+            mock.restore();
+        }
+        const parsed = JSON.parse(stdoutChunks.join(''));
+        assert.equal(parsed.result, 'PASS');
+        assert.equal(parsed.bundleIntegrity, 'PASS');
+        assert.equal(parsed.nodeAttestation, 'ABSENT');
+    });
+    it('includes hash mismatch details in --json FAIL output', async () => {
+        const bundle = buildMinimalBundle({ certificateHash: 'sha256:' + 'dead'.repeat(16) });
+        const stdinReader = async () => JSON.stringify(bundle);
+        const stdoutChunks = [];
+        const origWrite = process.stdout.write.bind(process.stdout);
+        const origError = console.error;
+        process.stdout.write = (chunk) => { stdoutChunks.push(String(chunk)); return true; };
+        console.error = () => { };
+        const mock = mockExit();
+        try {
+            await aiVerifyCommand(undefined, { json: true }, stdinReader);
+        }
+        catch (e) {
+            assert.match(e.message, /exit\(1\)/);
+        }
+        finally {
+            process.stdout.write = origWrite;
+            console.error = origError;
+            mock.restore();
+        }
+        const parsed = JSON.parse(stdoutChunks.join(''));
+        assert.equal(parsed.result, 'FAIL');
+        assert.equal(parsed.bundleIntegrity, 'FAIL');
+        assert.ok(typeof parsed.computed === 'string');
+        assert.ok(typeof parsed.expected === 'string');
+    });
+});
+// ─── L) Backward compatibility — Code Mode exports ───────────────────────────
+describe('L: backward compat — module exports', () => {
+    it('exports canonicalJson, computeBundleHash, readInputJson, callNodeApi', () => {
+        assert.equal(typeof canonicalJson, 'function');
+        assert.equal(typeof computeBundleHash, 'function');
+        assert.equal(typeof readInputJson, 'function');
+        assert.equal(typeof callNodeApi, 'function');
+    });
+    it('exports aiCreateCommand, aiCertifyCommand, aiVerifyCommand', () => {
+        assert.equal(typeof aiCreateCommand, 'function');
+        assert.equal(typeof aiCertifyCommand, 'function');
+        assert.equal(typeof aiVerifyCommand, 'function');
+    });
+    it('exports hasAttestation', () => {
+        assert.equal(typeof hasAttestation, 'function');
+        assert.equal(hasAttestation({ attestationId: 'abc' }), true);
+        assert.equal(hasAttestation({ attestationId: '' }), false);
+        assert.equal(hasAttestation({}), false);
+    });
+    it('exports readStdinText', () => {
+        assert.equal(typeof readStdinText, 'function');
+    });
+});
+// ─── M) callNodeApi ───────────────────────────────────────────────────────────
+describe('M: callNodeApi', () => {
+    it('constructs correct URL and sends JSON body', async () => {
+        const capturedCalls = [];
+        const mockFetch = async (url, init) => {
+            capturedCalls.push({ url, method: init?.method, body: JSON.parse(init?.body) });
+            return new Response(JSON.stringify({ ok: true }), { status: 200 });
+        };
+        const result = await callNodeApi('https://node.nexart.art', '/v1/cer/ai/create', { executionId: 'test' }, 'my-api-key', mockFetch);
+        assert.equal(result.status, 200);
+        assert.deepEqual(result.data, { ok: true });
+        const call = capturedCalls[0];
+        assert.equal(call.url, 'https://node.nexart.art/v1/cer/ai/create');
+        assert.equal(call.method, 'POST');
+        assert.deepEqual(call.body, { executionId: 'test' });
+    });
+    it('includes Authorization header when apiKey provided', async () => {
+        const capturedHeaders = [];
+        const mockFetch = async (_url, init) => {
+            capturedHeaders.push((init?.headers || {}));
+            return new Response('{}', { status: 200 });
+        };
+        await callNodeApi('https://node.nexart.art', '/v1/test', {}, 'Bearer-key', mockFetch);
+        assert.equal(capturedHeaders[0]?.['Authorization'], 'Bearer Bearer-key');
+    });
+    it('omits Authorization header when no apiKey', async () => {
+        const capturedHeaders = [];
+        const mockFetch = async (_url, init) => {
+            capturedHeaders.push((init?.headers || {}));
+            return new Response('{}', { status: 200 });
+        };
+        await callNodeApi('http://localhost:4000', '/v1/test', {}, undefined, mockFetch);
+        assert.equal(capturedHeaders[0]?.['Authorization'], undefined);
+    });
+});
+// ─── N) aiCreateCommand — stdin input ────────────────────────────────────────
+describe('N: aiCreateCommand — stdin input', () => {
+    it('reads input from injected stdinReader', async () => {
+        const input = { executionId: 'stdin-001', provider: 'openai' };
+        const stdinReader = async () => JSON.stringify(input);
+        const capturedBodies = [];
+        const mockFetch = async (_url, init) => {
+            capturedBodies.push(JSON.parse(init?.body));
+            return new Response(JSON.stringify({ bundleType: 'cer.ai.execution.v1' }), { status: 200 });
+        };
+        const origWrite = process.stdout.write.bind(process.stdout);
+        process.stdout.write = () => true;
+        try {
+            await aiCreateCommand(undefined, { endpoint: 'http://localhost:4000', apiKey: undefined }, mockFetch, stdinReader);
+        }
+        finally {
+            process.stdout.write = origWrite;
+        }
+        assert.deepEqual(capturedBodies[0], input);
+    });
+});
+// ─── O) aiCertifyCommand — stdin input ────────────────────────────────────────
+describe('O: aiCertifyCommand — stdin input', () => {
+    it('reads input from injected stdinReader', async () => {
+        const input = { executionId: 'stdin-c-001', provider: 'anthropic' };
+        const stdinReader = async () => JSON.stringify(input);
+        const capturedBodies = [];
+        const mockFetch = async (_url, init) => {
+            capturedBodies.push(JSON.parse(init?.body));
+            return new Response(JSON.stringify({
+                certificateHash: 'sha256:aabb',
+                verificationUrl: 'https://verify.nexart.io/e/x',
+                attestationId: 'a1',
+            }), { status: 200 });
+        };
+        const origLog = console.log;
+        console.log = () => { };
+        try {
+            await aiCertifyCommand(undefined, { json: false, endpoint: 'http://localhost:4000', apiKey: undefined }, mockFetch, stdinReader);
+        }
+        finally {
+            console.log = origLog;
+        }
+        assert.deepEqual(capturedBodies[0], input);
+    });
+});
+// ─── P) aiCreateCommand — saves --out file ─────────────────────────────────────
+describe('P: aiCreateCommand — --out file', () => {
+    let tmpDir;
+    before(() => { tmpDir = makeTempDir(); });
+    after(() => { fs.rmSync(tmpDir, { recursive: true, force: true }); });
+    it('saves CER bundle JSON to --out file', async () => {
+        const input = { executionId: 'out-001' };
+        const stdinReader = async () => JSON.stringify(input);
+        const fakeBundle = { bundleType: 'cer.ai.execution.v1', certificateHash: 'sha256:cc' };
+        const outPath = path.join(tmpDir, 'output.json');
+        const mockFetch = async () => new Response(JSON.stringify(fakeBundle), { status: 200 });
+        const origWrite = process.stdout.write.bind(process.stdout);
+        const origError = console.error;
+        process.stdout.write = () => true;
+        console.error = () => { };
+        try {
+            await aiCreateCommand(undefined, { out: outPath, endpoint: 'http://localhost:4000', apiKey: undefined }, mockFetch, stdinReader);
+        }
+        finally {
+            process.stdout.write = origWrite;
+            console.error = origError;
+        }
+        assert.ok(fs.existsSync(outPath));
+        const saved = JSON.parse(fs.readFileSync(outPath, 'utf-8'));
+        assert.equal(saved.bundleType, 'cer.ai.execution.v1');
+    });
+});
+// ─── Q) aiCertifyCommand — 401 handling ───────────────────────────────────────
+describe('Q: aiCertifyCommand — error handling', () => {
+    it('exits 1 on 401 Unauthorized', async () => {
+        const input = { executionId: 'q-001' };
+        const stdinReader = async () => JSON.stringify(input);
+        const mockFetch = async () => new Response('{}', { status: 401 });
+        const origError = console.error;
+        console.error = () => { };
+        const mock = mockExit();
+        try {
+            await aiCertifyCommand(undefined, { json: false, endpoint: 'http://localhost:4000', apiKey: 'bad' }, mockFetch, stdinReader);
+            assert.fail('should have exited');
+        }
+        catch (e) {
+            assert.equal(mock.exitCode, 1);
+        }
+        finally {
+            console.error = origError;
+            mock.restore();
+        }
+    });
+    it('exits 1 on server error with error message', async () => {
+        const input = { executionId: 'q-002' };
+        const stdinReader = async () => JSON.stringify(input);
+        const mockFetch = async () => new Response(JSON.stringify({ error: 'Invalid execution schema' }), { status: 422 });
+        const origError = console.error;
+        const errLines = [];
+        console.error = (...args) => { errLines.push(args.map(String).join(' ')); };
+        const mock = mockExit();
+        try {
+            await aiCertifyCommand(undefined, { json: false, endpoint: 'http://localhost:4000', apiKey: 'key' }, mockFetch, stdinReader);
+            assert.fail('should have exited');
+        }
+        catch (e) {
+            assert.equal(mock.exitCode, 1);
+            assert.ok(errLines.some(l => l.includes('Invalid execution schema')));
+        }
+        finally {
+            console.error = origError;
+            mock.restore();
+        }
+    });
+});
+//# sourceMappingURL=ai.test.js.map