@nuggetslife/vc 0.0.28 → 0.0.30

package/W3C_CONFORMANCE.md

@@ -0,0 +1,47 @@
+# W3C Conformance Gate
+
+The CI runs the W3C JSON-LD 1.1 API and RDF Dataset Canonicalization (RDFC-1.0)
+test suites against this binding via `test_w3c_conformance.mjs`. The job fails
+only when a test that **previously passed** starts failing — never on tests
+that were already failing in the committed baseline.
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| `test_w3c_conformance.mjs` | Runner. Modes: `--check`, `--update`, `--verbose`, `--only <algo>`. |
+| `w3c-baseline.json` | Committed baseline. The "passing" set per algo is what CI gates against. |
+| `w3c-denylist.json` | Tests skipped because they trigger Rust-level deadlocks in clientffi. Each entry is a real bug — remove as fixed. |
+| `scripts/fetch-w3c-tests.sh` | Clones the W3C test suites at pinned SHAs into `tmp-w3c-tests/` (gitignored). |
+
+## Local usage
+
+```bash
+# Fetch test fixtures (one-off, ~50 MB)
+yarn fetch:w3c-tests
+
+# Verify nothing has regressed vs baseline
+yarn test:w3c
+
+# Re-run the suite and overwrite the baseline. Add `--runs 3` for
+# fast algos (canonize, fromRdf) to take the intersection of 3 runs
+# and filter out flaky tests.
+yarn test:w3c:update
+```
+
+## Adding a denylist entry
+
+If a new clientffi-side bug causes the runner to hang on a particular test,
+add the test ID to the relevant `algo` array in `w3c-denylist.json` and open
+an issue for the underlying bug.
+
+## Coverage caveats
+
+- `flatten` and `toRdf` algos are **not yet** in the gated baseline. Each has
+  multiple deep deadlocks in clientffi that the JS-level per-test timeout
+  cannot unblock. They will be added once the underlying issues are mapped
+  (or after the migration to a mature JSON-LD crate).
+- `expand` and `compact` use single-run baselines because intersection-of-3
+  runs exhausts the NAPI worker pool on these large suites. Minor flakes
+  (1-3 tests) may produce false regressions; rerun the CI job once before
+  investigating.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuggetslife/vc",
-  "version": "0.0.28",
+  "version": "0.0.30",
   "main": "index.js",
   "types": "index.d.ts",
   "napi": {
@@ -34,15 +34,18 @@
     "prepublishOnly": "napi prepublish -t npm",
     "test": "node test.mjs && node test_jose.mjs && node test_sd_jwt.mjs && node test_bbs_ietf.mjs && node test_bbs_2023.mjs && node test_jsonld_crossverify.mjs && node test_backward_compat.mjs",
     "universal": "napi universal",
-    "version": "napi version"
+    "version": "napi version",
+    "test:w3c": "node test_w3c_conformance.mjs --check",
+    "test:w3c:update": "node test_w3c_conformance.mjs --update",
+    "fetch:w3c-tests": "bash scripts/fetch-w3c-tests.sh"
   },
   "packageManager": "yarn@4.3.1",
   "optionalDependencies": {
-    "@nuggetslife/vc-darwin-arm64": "0.0.28",
-    "@nuggetslife/vc-linux-arm64-gnu": "0.0.28",
-    "@nuggetslife/vc-linux-arm64-musl": "0.0.28",
-    "@nuggetslife/vc-linux-x64-gnu": "0.0.28",
-    "@nuggetslife/vc-linux-x64-musl": "0.0.28"
+    "@nuggetslife/vc-darwin-arm64": "0.0.30",
+    "@nuggetslife/vc-linux-arm64-gnu": "0.0.30",
+    "@nuggetslife/vc-linux-arm64-musl": "0.0.30",
+    "@nuggetslife/vc-linux-x64-gnu": "0.0.30",
+    "@nuggetslife/vc-linux-x64-musl": "0.0.30"
   },
   "dependencies": {}
 }

package/scripts/fetch-w3c-tests.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Clone the W3C JSON-LD 1.1 API and RDF Dataset Canonicalization test suites
+# into vc/js/tmp-w3c-tests/. Pinned to specific commits for reproducibility.
+
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+JLD_API_REPO="https://github.com/w3c/json-ld-api.git"
+JLD_API_SHA="04a4eb7dc7cbc313f3f5be7ad9a3b06e87741693"
+
+RDF_CANON_REPO="https://github.com/w3c/rdf-canon.git"
+RDF_CANON_SHA="15619df2fda7a4ca88308733789b6774517f9638"
+
+mkdir -p tmp-w3c-tests
+cd tmp-w3c-tests
+
+if [ ! -d json-ld-api ]; then
+    git clone --filter=blob:none "$JLD_API_REPO"
+fi
+(cd json-ld-api && git fetch --depth=1 origin "$JLD_API_SHA" && git checkout --detach "$JLD_API_SHA")
+
+if [ ! -d rdf-canon ]; then
+    git clone --filter=blob:none "$RDF_CANON_REPO"
+fi
+(cd rdf-canon && git fetch --depth=1 origin "$RDF_CANON_SHA" && git checkout --detach "$RDF_CANON_SHA")
+
+echo "W3C suites fetched at pinned SHAs."

package/test_jsonld_crossverify.mjs

@@ -254,3 +254,179 @@ test('cross-verify: expand → toRDF → fromRDF round-trip matches JS reference
 
     assert.deepStrictEqual(napiResult, jsResult);
 });
+
+//
+// Regression: subjects without @id must get blank node identifiers
+// (https://github.com/NuggetsLtd/montpellier/issues/4642)
+//
+
+test('cross-verify: toRDF preserves nested typed objects without @id', async () => {
+    const doc = {
+        "@context": {
+            "schema": "http://schema.org/",
+            "metrics": "schema:metrics",
+            "name": "schema:name",
+            "count": "schema:count",
+            "MyType": {
+                "@id": "schema:MyType",
+                "@context": {
+                    "type": "@type",
+                    "count": { "@id": "schema:count", "@type": "http://www.w3.org/2001/XMLSchema#integer" },
+                },
+            },
+        },
+        "@id": "http://example.org/thing",
+        "name": "Test",
+        "metrics": {
+            "type": "MyType",
+            "count": 42,
+        },
+    };
+
+    const proc = new JsonLd();
+
+    const napiResult = await proc.toRDF(doc, { format: 'application/n-quads' });
+    const jsResult = await jsonld.toRDF(doc, { format: 'application/n-quads' });
+
+    const napiStmts = napiResult.split('\n').filter(s => s.trim()).sort();
+    const jsStmts = jsResult.split('\n').filter(s => s.trim()).sort();
+
+    assert.strictEqual(napiStmts.length, jsStmts.length,
+        `Statement count mismatch: NAPI=${napiStmts.length}, JS=${jsStmts.length}`);
+});
+
+test('cross-verify: canonize preserves nested typed objects without @id', async () => {
+    const doc = {
+        "@context": {
+            "schema": "http://schema.org/",
+            "metrics": "schema:metrics",
+            "name": "schema:name",
+            "MyType": {
+                "@id": "schema:MyType",
+                "@context": {
+                    "type": "@type",
+                    "count": { "@id": "schema:count", "@type": "http://www.w3.org/2001/XMLSchema#integer" },
+                },
+            },
+        },
+        "@id": "http://example.org/thing",
+        "name": "Test",
+        "metrics": {
+            "type": "MyType",
+            "count": 42,
+        },
+    };
+
+    const proc = new JsonLd();
+
+    const napiResult = await proc.canonize(doc);
+    const jsResult = await jsonld.canonize(doc, {
+        algorithm: 'URDNA2015',
+        format: 'application/n-quads',
+        safe: false,
+    });
+
+    assert.strictEqual(napiResult, jsResult);
+});
+
+//
+// Regression: terms with @type: "@json" must produce JSON literal quads
+// (parity with jsonld@3.1.0 / jsonld@8.3.3 — the libs that sign Nuggets VCs)
+//
+
+test('cross-verify: expand emits JSON literal for term with @type: @json (flat context)', async () => {
+    const doc = {
+        '@context': {
+            '@version': 1.1,
+            inner: { '@id': 'https://example.com/inner', '@type': '@json' }
+        },
+        inner: { hello: 'world' }
+    };
+
+    const proc = new JsonLd();
+    const napiResult = await proc.expand(doc);
+    const jsResult = await jsonld.expand(doc);
+
+    assert.deepStrictEqual(napiResult, jsResult);
+});
+
+test('cross-verify: expand emits JSON literal for term with @type: @json (term-scoped context)', async () => {
+    // Mirrors the KYB v1 shape where `dnbData` is defined inside `result`'s
+    // term-scoped context. See packages/document-loader/context/kybV1.json.
+    const doc = {
+        '@context': {
+            '@version': 1.1,
+            outer: {
+                '@id': 'https://example.com/outer',
+                '@context': {
+                    '@version': 1.1,
+                    inner: { '@id': 'https://example.com/inner', '@type': '@json' }
+                }
+            }
+        },
+        outer: { inner: { organization: { primaryName: 'Acme' } } }
+    };
+
+    const proc = new JsonLd();
+    const napiResult = await proc.expand(doc);
+    const jsResult = await jsonld.expand(doc);
+
+    assert.deepStrictEqual(napiResult, jsResult);
+});
+
+test('cross-verify: canonize emits JSON literal quad for term with @type: @json', async () => {
+    const doc = {
+        '@context': {
+            '@version': 1.1,
+            inner: { '@id': 'https://example.com/inner', '@type': '@json' }
+        },
+        inner: { b: 2, a: 1 }
+    };
+
+    const proc = new JsonLd();
+    const napiResult = await proc.canonize(doc);
+    const jsResult = await jsonld.canonize(doc, {
+        algorithm: 'URDNA2015',
+        format: 'application/n-quads',
+        safe: false,
+    });
+
+    assert.strictEqual(napiResult, jsResult);
+});
+
+//
+// Regression: blank-node objects (no @id) in arrays must each produce a
+// distinct quad. Earlier `add_value` deduped equal serde Values, collapsing
+// `[{}, {}, {}]` to a single blank node and silently shrinking signed
+// message sets — breaking any BBS+ proof over arrays that contain repeats.
+//
+
+test('cross-verify: array of empty objects keeps each blank node distinct', async () => {
+    const doc = {
+        '@context': { items: { '@id': 'https://example.com/items' } },
+        items: [{}, {}, {}]
+    };
+
+    const proc = new JsonLd();
+    const napiResult = await proc.expand(doc);
+    const jsResult = await jsonld.expand(doc);
+
+    assert.deepStrictEqual(napiResult, jsResult);
+});
+
+test('cross-verify: toRDF with array of empty objects emits one quad per element', async () => {
+    const doc = {
+        '@context': { items: { '@id': 'https://example.com/items' } },
+        items: [{}, {}, 'a', {}]
+    };
+
+    const proc = new JsonLd();
+    const napiNquads = await proc.toRDF(doc, { format: 'application/n-quads' });
+    const jsNquads = await jsonld.toRDF(doc, { format: 'application/n-quads' });
+
+    const napiCount = napiNquads.split('\n').filter(Boolean).length;
+    const jsCount = jsNquads.split('\n').filter(Boolean).length;
+
+    assert.strictEqual(napiCount, jsCount,
+        `expected ${jsCount} quads (one per array element), got ${napiCount}`);
+});

package/test_w3c_conformance.mjs

@@ -0,0 +1,346 @@
+// W3C JSON-LD 1.1 API + RDF Dataset Canonicalization (RDFC-1.0) conformance
+// runner for the clientffi NAPI JsonLd binding.
+//
+// Two modes:
+//   node test_w3c_conformance.mjs --check    (CI default)
+//     run all suites, compare against w3c-baseline.json, exit non-zero
+//     if any test that previously passed now fails (a regression).
+//
+//   node test_w3c_conformance.mjs --update
+//     run all suites, overwrite w3c-baseline.json with the current
+//     pass set. Use when intentionally widening conformance.
+//
+// Without flags, runs and prints a summary table without baseline comparison.
+//
+// Other flags:
+//   --only <algo>   limit to one of: expand|compact|flatten|toRdf|fromRdf|canonize
+//   --verbose       print PASS/FAIL/ERR per test
+
+import { readFileSync, writeFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { resolve, dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { JsonLd } from './index.js';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const args = process.argv.slice(2);
+const flag = (n) => args.includes(n);
+const valOf = (n) => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : null; };
+const verbose = flag('--verbose');
+const onlyArg = valOf('--only');
+const checkBaseline = flag('--check');
+const updateBaseline = flag('--update');
+
+const TESTS_ROOT = resolve(__dirname, 'tmp-w3c-tests');
+const JLD_TESTS = join(TESTS_ROOT, 'json-ld-api', 'tests');
+const RDFC_TESTS = join(TESTS_ROOT, 'rdf-canon', 'tests');
+const JLD_BASE = 'https://w3c.github.io/json-ld-api/tests/';
+const BASELINE_PATH = join(__dirname, 'w3c-baseline.json');
+
+// Per-test wall-clock cap. clientffi has known hangs in a few hot paths;
+// without this they freeze the runner.
+const TIMEOUT_MS = 30000;
+const PROGRESS_EVERY = 25; // emit a heartbeat every N tests so CI's
+                            // no_output_timeout doesn't kill the runner
+
+function withTimeout(promiseOrValue, label) {
+    // proc.fromRDF returns synchronously; everything else is async.
+    const p = Promise.resolve(promiseOrValue);
+    let t;
+    const timeoutPromise = new Promise((_, reject) => {
+        t = setTimeout(() => reject(new Error('timeout: ' + label)), TIMEOUT_MS);
+    });
+    // If the main op settles first, the timeout-rejection still fires later;
+    // consume that specific rejection rather than suppressing process-wide.
+    timeoutPromise.catch(() => {});
+    return Promise.race([p.finally(() => clearTimeout(t)), timeoutPromise]);
+}
+
+const loadJson = (p) => JSON.parse(readFileSync(p, 'utf8'));
+const loadText = (p) => readFileSync(p, 'utf8');
+
+function preloadJldContexts() {
+    const ctxs = {};
+    function walk(dir, prefix) {
+        for (const name of readdirSync(dir)) {
+            const full = join(dir, name);
+            if (statSync(full).isDirectory()) walk(full, prefix + name + '/');
+            else if (name.endsWith('.jsonld') || name.endsWith('.json')) {
+                try { ctxs[JLD_BASE + prefix + name] = loadJson(full); } catch {}
+            }
+        }
+    }
+    walk(JLD_TESTS, '');
+    return ctxs;
+}
+
+function canonicalStringify(v) {
+    if (v === null || typeof v !== 'object') return JSON.stringify(v);
+    if (Array.isArray(v)) return '[' + v.map(canonicalStringify).join(',') + ']';
+    const keys = Object.keys(v).sort();
+    return '{' + keys.map(k => JSON.stringify(k) + ':' + canonicalStringify(v[k])).join(',') + '}';
+}
+const jsonEqual = (a, b) => canonicalStringify(a) === canonicalStringify(b);
+const normNQuads = (s) => typeof s === 'string'
+    ? s.split('\n').map(l => l.trim()).filter(Boolean).sort().join('\n')
+    : s;
+
+const DENYLIST_PATH = join(__dirname, 'w3c-denylist.json');
+let DENYLIST = {};
+if (existsSync(DENYLIST_PATH)) {
+    DENYLIST = loadJson(DENYLIST_PATH);
+}
+const isDenied = (algo, id) => (DENYLIST[algo] || []).includes(id);
+
+// In --check mode, restrict the run to baseline-passing tests only — the
+// gate's purpose is regression detection, not full re-evaluation. Cuts
+// CI runtime ~70% (skips ~450 baseline-failing tests).
+let CHECK_ALLOW = null;
+if (checkBaseline && existsSync(BASELINE_PATH)) {
+    const b = loadJson(BASELINE_PATH);
+    CHECK_ALLOW = {};
+    for (const [algo, r] of Object.entries(b)) {
+        CHECK_ALLOW[algo] = new Set(r.passing || []);
+    }
+}
+const isInCheckScope = (algo, id) =>
+    !CHECK_ALLOW || (CHECK_ALLOW[algo] && CHECK_ALLOW[algo].has(id));
+
+const RESULTS = {}; // { algo: { passing: Set, failing: Set, erroring: Set } }
+function record(algo, id, status) {
+    const r = RESULTS[algo] ||= { passing: new Set(), failing: new Set(), erroring: new Set() };
+    if (status === 'pass') r.passing.add(id);
+    else if (status === 'fail') r.failing.add(id);
+    else r.erroring.add(id);
+    if (verbose) {
+        const tag = { pass: 'PASS', fail: 'FAIL', err: 'ERR ' }[status];
+        process.stderr.write(`[${tag}] ${algo} ${id}\n`);
+    }
+}
+
+async function runJld(algo, methodName) {
+    const manifestPath = join(JLD_TESTS, `${algo}-manifest.jsonld`);
+    if (!existsSync(manifestPath)) return;
+    const manifest = loadJson(manifestPath);
+    const contexts = preloadJldContexts();
+    const proc = new JsonLd({ contexts });
+    let seen = 0;
+
+    for (const entry of manifest.sequence) {
+        const types = Array.isArray(entry['@type']) ? entry['@type'] : [entry['@type']];
+        const isPositive = types.includes('jld:PositiveEvaluationTest');
+        const isNegative = types.includes('jld:NegativeEvaluationTest');
+        const id = entry['@id'];
+        if (!isPositive && !isNegative) continue;
+        if (isDenied(algo, id)) continue;
+        if (!isInCheckScope(algo, id)) continue;
+        seen += 1;
+        if (seen % PROGRESS_EVERY === 0) {
+            process.stderr.write(`  ${algo}: ${seen} tests processed\n`);
+        }
+        const inputUrl = JLD_BASE + entry.input;
+        const inputPath = join(JLD_TESTS, entry.input);
+        if (!existsSync(inputPath)) { record(algo, id, 'err'); continue; }
+
+        const opt = entry.option || {};
+        const callOpts = { base: opt.base || inputUrl };
+        if (opt.processingMode) callOpts.processingMode = opt.processingMode;
+        if (opt.expandContext) {
+            const ctxUrl = JLD_BASE + opt.expandContext;
+            callOpts.expandContext = contexts[ctxUrl] || ctxUrl;
+        }
+
+        try {
+            const input = methodName === 'fromRDF' ? loadText(inputPath) : loadJson(inputPath);
+            let napiResult;
+            if (methodName === 'expand') napiResult = await withTimeout(proc.expand(input, callOpts), id);
+            else if (methodName === 'compact') {
+                const ctxUrl = JLD_BASE + entry.context;
+                const ctx = contexts[ctxUrl] || ctxUrl;
+                napiResult = await withTimeout(proc.compact(input, ctx, callOpts), id);
+            } else if (methodName === 'flatten') {
+                const ctxUrl = entry.context ? (JLD_BASE + entry.context) : null;
+                const ctx = ctxUrl ? (contexts[ctxUrl] || ctxUrl) : null;
+                napiResult = await withTimeout(proc.flatten(input, ctx, callOpts), id);
+            } else if (methodName === 'toRDF') {
+                napiResult = await withTimeout(proc.toRDF(input, { ...callOpts, format: 'application/n-quads' }), id);
+            } else if (methodName === 'fromRDF') napiResult = await withTimeout(proc.fromRDF(input, callOpts), id);
+
+            if (isNegative) { record(algo, id, 'fail'); continue; }
+
+            const expectPath = join(JLD_TESTS, entry.expect);
+            if (!existsSync(expectPath)) { record(algo, id, 'err'); continue; }
+            const expected = methodName === 'toRDF' ? loadText(expectPath) : loadJson(expectPath);
+
+            const ok = methodName === 'toRDF'
+                ? normNQuads(napiResult) === normNQuads(expected)
+                : jsonEqual(napiResult, expected);
+            record(algo, id, ok ? 'pass' : 'fail');
+        } catch (e) {
+            // Negative tests expect a processor error; only count as pass if it
+            // genuinely came from the processor, not from a timeout or harness bug.
+            const isTimeout = e && /^timeout:/.test(e.message || '');
+            record(algo, id, isNegative && !isTimeout ? 'pass' : 'err');
+        }
+    }
+}
+
+async function runRdfc() {
+    const manifestPath = join(RDFC_TESTS, 'manifest.jsonld');
+    if (!existsSync(manifestPath)) return;
+    const manifest = loadJson(manifestPath);
+    const algo = 'canonize';
+    const proc = new JsonLd();
+    let seen = 0;
+
+    for (const entry of manifest.entries) {
+        if (entry.type !== 'rdfc:RDFC10EvalTest') continue;
+        const id = entry.id;
+        if (isDenied('canonize', id)) continue;
+        if (!isInCheckScope('canonize', id)) continue;
+        seen += 1;
+        if (seen % PROGRESS_EVERY === 0) {
+            process.stderr.write(`  canonize: ${seen} tests processed\n`);
+        }
+        const inputPath = join(RDFC_TESTS, entry.action);
+        const expectedPath = join(RDFC_TESTS, entry.result);
+        if (!existsSync(inputPath) || !existsSync(expectedPath)) { record(algo, id, 'err'); continue; }
+        try {
+            const input = loadText(inputPath);
+            const expected = loadText(expectedPath);
+            const opts = {
+                inputFormat: 'application/n-quads',
+                format: 'application/n-quads',
+                algorithm: 'RDFC-1.0',
+            };
+            if (entry.hashAlgorithm) opts.hashAlgorithm = entry.hashAlgorithm;
+            const got = await withTimeout(proc.canonize(input, opts), id);
+            record(algo, id, got === expected ? 'pass' : 'fail');
+        } catch (e) {
+            record(algo, id, 'err');
+        }
+    }
+}
+
+async function runOnce(algo) {
+    process.stderr.write(`Running ${algo}...\n`);
+    if (algo === 'canonize') await runRdfc();
+    else if (algo === 'expand') await runJld('expand', 'expand');
+    else if (algo === 'compact') await runJld('compact', 'compact');
+    else if (algo === 'flatten') await runJld('flatten', 'flatten');
+    else if (algo === 'toRdf') await runJld('toRdf', 'toRDF');
+    else if (algo === 'fromRdf') await runJld('fromRdf', 'fromRDF');
+}
+
+async function main() {
+    if (!existsSync(JLD_TESTS) || !existsSync(RDFC_TESTS)) {
+        console.error('W3C test suites not found at ' + TESTS_ROOT);
+        console.error('Run: vc/js/scripts/fetch-w3c-tests.sh');
+        process.exit(2);
+    }
+    // flatten and toRdf are not in the default run because clientffi has
+    // Rust-level deadlocks in those algos. Pass --only flatten or --only toRdf
+    // to opt in when investigating. They'll move into the default list once
+    // their hangs are fixed.
+    const algos = ['canonize', 'fromRdf', 'expand', 'compact'];
+    const allAlgos = ['expand', 'compact', 'flatten', 'toRdf', 'fromRdf', 'canonize'];
+    if (onlyArg && !allAlgos.includes(onlyArg)) {
+        console.error(`Invalid --only value: ${onlyArg}. Expected one of: ${allAlgos.join(', ')}`);
+        process.exit(2);
+    }
+    const filtered = onlyArg ? [onlyArg] : algos;
+
+    // --runs N: run each algo N times and intersect the passing sets so
+    // flaky tests don't end up in the baseline. Default 1.
+    // Note: slow algos (expand, compact) hang on N>1 because clientffi's
+    // NAPI worker pool fills with hung threads from earlier passes. Use
+    // --runs 3 only for fast algos like canonize/fromRdf.
+    const runsArg = valOf('--runs');
+    const repeats = runsArg == null ? 1 : Number.parseInt(runsArg, 10);
+    if (!Number.isInteger(repeats) || repeats <= 0 || String(repeats) !== runsArg) {
+        if (runsArg != null) {
+            console.error(`Invalid value for --runs: ${runsArg}. Expected a positive integer.`);
+            process.exit(2);
+        }
+    }
+    const passingPerRun = []; // array of { algo: Set<id> }, length = repeats
+
+    for (let r = 0; r < repeats; r++) {
+        if (repeats > 1) process.stderr.write(`-- pass ${r + 1}/${repeats} --\n`);
+        // Fresh RESULTS for this pass
+        for (const k of Object.keys(RESULTS)) delete RESULTS[k];
+        for (const algo of filtered) await runOnce(algo);
+        const snapshot = {};
+        for (const [algo, r2] of Object.entries(RESULTS)) snapshot[algo] = new Set(r2.passing);
+        passingPerRun.push(snapshot);
+    }
+
+    // Build current state. For --update with repeats=3, "passing" is the
+    // intersection across all runs. For --check (single run), use the last run.
+    const current = {};
+    for (const [algo, r] of Object.entries(RESULTS)) {
+        let passing;
+        if (repeats > 1) {
+            passing = [...passingPerRun[0][algo] || []].filter(id =>
+                passingPerRun.every(snap => snap[algo]?.has(id))
+            );
+        } else {
+            passing = [...r.passing];
+        }
+        current[algo] = {
+            passing: passing.sort(),
+            failing: [...r.failing].sort(),
+            erroring: [...r.erroring].sort(),
+        };
+    }
+
+    // Print summary
+    console.log('\n========== W3C CONFORMANCE ==========');
+    console.log(['Algo'.padEnd(10), 'Total'.padEnd(8), 'Pass'.padEnd(8), 'Fail'.padEnd(8), 'Error'.padEnd(8), 'Pass%'].join(''));
+    for (const [algo, r] of Object.entries(current)) {
+        const total = r.passing.length + r.failing.length + r.erroring.length;
+        const pct = total ? ((r.passing.length / total) * 100).toFixed(1) + '%' : '-';
+        console.log([algo.padEnd(10), String(total).padEnd(8), String(r.passing.length).padEnd(8), String(r.failing.length).padEnd(8), String(r.erroring.length).padEnd(8), pct].join(''));
+    }
+
+    if (updateBaseline) {
+        // Merge with existing baseline so single-algo runs accumulate.
+        const merged = existsSync(BASELINE_PATH) ? loadJson(BASELINE_PATH) : {};
+        for (const [algo, r] of Object.entries(current)) merged[algo] = r;
+        writeFileSync(BASELINE_PATH, JSON.stringify(merged, null, 2) + '\n');
+        console.log(`\nBaseline ${onlyArg ? 'updated for ' + onlyArg : 'written'} at ${BASELINE_PATH}`);
+        return;
+    }
+
+    if (checkBaseline) {
+        if (!existsSync(BASELINE_PATH)) {
+            console.error(`\nNo baseline at ${BASELINE_PATH}. Run with --update to create one.`);
+            process.exit(2);
+        }
+        const baseline = loadJson(BASELINE_PATH);
+        const regressions = [];
+        const improvements = [];
+        const algosToCheck = onlyArg ? [onlyArg] : Object.keys(baseline);
+        for (const algo of algosToCheck) {
+            if (!baseline[algo]) continue;
+            const wasPassing = new Set(baseline[algo].passing);
+            const nowPassing = new Set(current[algo]?.passing || []);
+            for (const id of wasPassing) if (!nowPassing.has(id)) regressions.push({ algo, id });
+            for (const id of nowPassing) if (!wasPassing.has(id)) improvements.push({ algo, id });
+        }
+
+        if (improvements.length) {
+            console.log(`\n${improvements.length} test(s) newly passing — please run --update to ratchet the baseline:`);
+            for (const { algo, id } of improvements.slice(0, 20)) console.log(`  + ${algo} ${id}`);
+            if (improvements.length > 20) console.log(`  ... ${improvements.length - 20} more`);
+        }
+
+        if (regressions.length) {
+            console.log(`\n${regressions.length} REGRESSION(S) — these tests passed in baseline but now fail:`);
+            for (const { algo, id } of regressions) console.log(`  - ${algo} ${id}`);
+            process.exit(1);
+        }
+        console.log('\nNo regressions vs baseline.');
+    }
+}
+
+main().catch(e => { console.error(e); process.exit(1); });