@openwop/openwop-conformance 1.152.0 → 1.154.0

package/src/lib/capabilities-auth-subject-link.test.ts

@@ -1,103 +0,0 @@
-/**
- * Server-free pin of the RFC 0163 §C schema conditional in
- * `schemas/capabilities.schema.json`:
- *
- *   auth.subjectLinking: true  ⇒  auth.subjectLinkKey required            (RFC 0163)
- *   auth.subjectLinkKey        ∈  { opaque-idp, configured-immutable }   (RFC 0163)
- *   profiles ⊇ {saml, scim}    ⇒  subjectLinking const true + key required (RFC 0164)
- *
- * This checks the SCHEMA ARTIFACT, not any host, which is why it lives under
- * `src/lib/` (no scenario ledger row — see `saml-idp.test.ts` for the G8
- * reasoning). The host-facing assertion is the advertisement leg of
- * `scenarios/auth-subject-link-key-class.test.ts`, gated on the flag.
- *
- * @see RFCS/0163-subject-linking-hardening.md §C
- * @see spec/v1/auth-profiles.md §"Subject linking (SAML ⟷ SCIM)"
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
-import Ajv2020 from 'ajv/dist/2020.js';
-import addFormats from 'ajv-formats';
-import { SCHEMAS_DIR } from './paths.js';
-
-function compileCapabilities() {
-  const ajv = new Ajv2020({ allErrors: true, strict: false });
-  addFormats(ajv);
-  for (const file of readdirSync(SCHEMAS_DIR).filter((f) => f.endsWith('.schema.json'))) {
-    const s = JSON.parse(readFileSync(join(SCHEMAS_DIR, file), 'utf8')) as { $id?: string };
-    ajv.addSchema(s, file);
-    ajv.addSchema(s, `./${file}`);
-  }
-  // Validate the `auth` block in isolation: the conditional lives on that
-  // object, and a full discovery document would drag in every root-level
-  // required family (supportedEnvelopes, schemaVersions, limits, …) that has
-  // nothing to do with what this file pins.
-  return ajv.compile({ $ref: 'capabilities.schema.json#/properties/auth' });
-}
-
-const PROFILES = ['openwop-auth-saml', 'openwop-auth-scim'];
-function doc(auth: Record<string, unknown>) {
-  return auth;
-}
-
-describe('capabilities.schema.json: auth.subjectLinkKey conditional (RFC 0163 §C)', () => {
-  const validate = compileCapabilities();
-
-  it('subjectLinking:true WITHOUT subjectLinkKey fails validation (§A.1 co-requirement is in the schema, not only prose)', () => {
-    const ok = validate(doc({ profiles: PROFILES, subjectLinking: true }));
-    expect(ok, JSON.stringify(validate.errors)).toBe(false);
-    expect(JSON.stringify(validate.errors)).toContain('subjectLinkKey');
-  });
-
-  it('subjectLinking:true with a class member validates', () => {
-    for (const k of ['opaque-idp', 'configured-immutable']) {
-      const ok = validate(doc({ profiles: PROFILES, subjectLinking: true, subjectLinkKey: k }));
-      expect(ok, `${k}: ${JSON.stringify(validate.errors)}`).toBe(true);
-    }
-  });
-
-  it('a mutable/PII key is INEXPRESSIBLE: "email" fails the enum', () => {
-    const ok = validate(doc({ profiles: PROFILES, subjectLinking: true, subjectLinkKey: 'email' }));
-    expect(ok).toBe(false);
-  });
-
-  it('the retired Draft-era attribute names are not members (the enum names classes)', () => {
-    for (const k of ['oid', 'immutable-id']) {
-      expect(validate(doc({ profiles: PROFILES, subjectLinking: true, subjectLinkKey: k })), k).toBe(false);
-    }
-  });
-
-  it('one profile alone does not require the flag or a key (SAML-only / SCIM-only hosts are unaffected)', () => {
-    expect(validate(doc({ profiles: ['openwop-auth-saml'] }))).toBe(true);
-    expect(validate(doc({ profiles: ['openwop-auth-scim'], subjectLinking: false }))).toBe(true);
-  });
-});
-
-describe('capabilities.schema.json: the profile pair implies the contract (RFC 0164 §B)', () => {
-  const validate = compileCapabilities();
-
-  it('BOTH profiles with subjectLinking absent fails validation (the vulnerable pre-0164 shape)', () => {
-    const ok = validate(doc({ profiles: PROFILES }));
-    expect(ok, JSON.stringify(validate.errors)).toBe(false);
-    expect(JSON.stringify(validate.errors)).toContain('subjectLinking');
-  });
-
-  it('BOTH profiles with subjectLinking:false fails validation (the flag is derived, not a choice)', () => {
-    expect(validate(doc({ profiles: PROFILES, subjectLinking: false, subjectLinkKey: 'opaque-idp' }))).toBe(false);
-  });
-
-  it('BOTH profiles with subjectLinking:true but no subjectLinkKey fails validation', () => {
-    expect(validate(doc({ profiles: PROFILES, subjectLinking: true }))).toBe(false);
-  });
-
-  it('BOTH profiles with subjectLinking:true + a class member validates (the derived advertisement)', () => {
-    expect(validate(doc({ profiles: PROFILES, subjectLinking: true, subjectLinkKey: 'opaque-idp' }))).toBe(true);
-  });
-
-  it('profile order does not matter', () => {
-    expect(validate(doc({ profiles: ['openwop-auth-scim', 'openwop-auth-api-key-rotation', 'openwop-auth-saml'], subjectLinking: true, subjectLinkKey: 'configured-immutable' }))).toBe(true);
-    expect(validate(doc({ profiles: ['openwop-auth-scim', 'openwop-auth-api-key-rotation', 'openwop-auth-saml'] }))).toBe(false);
-  });
-});

package/src/lib/fork-availability.test.ts

@@ -1,69 +0,0 @@
-/**
- * Pins `forkDeclined` (RFC 0148 §A).
- *
- * The risk in a helper like this is not that it misses a status — that shows up
- * as a red test somebody investigates. It is that it swallows one: every status
- * it accepts turns an assertion into a skip, silently, and a suite that skips
- * is indistinguishable from a suite that passes unless something records why.
- * So the load-bearing cases here are the NEGATIVE ones.
- */
-
-import { describe, expect, it, beforeEach } from 'vitest';
-import { forkDeclined } from './fork-availability.js';
-import { resetSoftSkips, softSkipDisposition } from './soft-skip.js';
-
-describe('forkDeclined', () => {
-  beforeEach(() => resetSoftSkips());
-
-  it('treats 404 and 403 the same as 501 — route absent is not weaker than route-declines', () => {
-    // The asymmetry this fixes: every replay scenario handled 501 and none
-    // handled 404. `501` means "I know this route and decline"; `404` means
-    // "there is no such route" — strictly less implemented. The suite treated
-    // the weaker signal as a skip and the stronger one as a defect, so a host
-    // had to implement the route in order to say it had not implemented it.
-    for (const status of [404, 403, 501]) {
-      expect(forkDeclined(status, 'leg'), `status ${status} means the fork did not happen`).toBe(true);
-    }
-  });
-
-  it('does NOT swallow any other status — a 500 is still a defect, not a skip', () => {
-    // If this ever goes green for one of these, a real failure has become a
-    // silent skip and no assertion downstream will ever run again.
-    for (const status of [200, 201, 202, 400, 409, 422, 500, 502, 503]) {
-      expect(forkDeclined(status, 'leg'), `status ${status} must reach the assertion`).toBe(false);
-    }
-  });
-
-  it('records WHY, so the ledger row is not an unclassified return', () => {
-    // Two of the eleven original call sites were a bare `return`. A bare return
-    // in a file whose OTHER tests assert is invisible: the file records
-    // `executed-pass` and the leg that never ran leaves no trace.
-    forkDeclined(404, 'fanout-suppression replay fork');
-    const noted = softSkipDisposition('fork-availability.test.ts');
-    expect(noted?.kind).toBe('blocked');
-    expect(noted?.reason).toContain('404');
-    expect(noted?.reason).toContain('fanout-suppression replay fork');
-    expect(noted?.reason).toContain('not mounted');
-  });
-
-  it('records nothing when the status is not a decline', () => {
-    forkDeclined(201, 'leg');
-    expect(softSkipDisposition('fork-availability.test.ts')).toBeNull();
-  });
-
-  it('names the leg, so one file with several forks stays attributable', () => {
-    forkDeclined(501, 'branch fork');
-    expect(softSkipDisposition('fork-availability.test.ts')?.reason).toContain('branch fork');
-  });
-
-  it('distinguishes the three declines in its reason text', () => {
-    forkDeclined(404, 'a');
-    const a = softSkipDisposition('fork-availability.test.ts')?.reason ?? '';
-    resetSoftSkips();
-    forkDeclined(501, 'a');
-    const b = softSkipDisposition('fork-availability.test.ts')?.reason ?? '';
-    // `blocked` alone does not tell a bundle reader whether the host lacks the
-    // route or declines the range; the reason must.
-    expect(a).not.toBe(b);
-  });
-});

package/src/lib/global-setup.test.ts

@@ -1,76 +0,0 @@
-/**
- * Pins the run-end disposition summary (`src/global-setup.ts`, RFC 0148 §A).
- *
- * The defect this guards is not "the summary is ugly" — it is that the suite
- * computed an honest disposition on every run and PUBLISHED it on one. Two
- * host implementers read vitest's `1 passed` as coverage for a requirement the
- * suite had internally classified `blocked`, because the classification had no
- * reader outside `--certify`.
- *
- * Server-free and pure: `summarise` takes the raw JSONL and returns the text.
- */
-
-import { describe, expect, it } from 'vitest';
-import { summarise } from '../global-setup.js';
-
-const line = (o: Record<string, unknown>): string => JSON.stringify(o);
-
-describe('global-setup: RFC 0148 §A disposition summary', () => {
-  it('reads the ledger key the ledger actually writes (`requirementId`, not `id`)', () => {
-    // Regression: the first draft of this reader keyed on `entry.id`, a field
-    // `recordRequirement` has never written, and fell back to `(unnamed)`.
-    // The fallback made a WRONG READER look like MISSING DATA — the same
-    // failure shape the summary exists to expose, reproduced in the exposer.
-    const out = summarise(
-      line({ requirementId: 'openwop.scenario.webhook-signed-delivery', disposition: 'blocked', detail: 'guard rejected loopback' }),
-    );
-    expect(out).toContain('openwop.scenario.webhook-signed-delivery');
-    expect(out).not.toContain('(unnamed)');
-  });
-
-  it('lists blocked / skipped / inapplicable as NOT witnessed, with the reason', () => {
-    const out = summarise(
-      [
-        line({ requirementId: 'a', disposition: 'blocked', detail: 'seam absent' }),
-        line({ requirementId: 'b', disposition: 'skipped', detail: 'operator opted out' }),
-        line({ requirementId: 'c', disposition: 'inapplicable', detail: 'profile not advertised' }),
-      ].join('\n'),
-    );
-    expect(out).toContain('did NOT witness');
-    for (const s of ['seam absent', 'operator opted out', 'profile not advertised']) {
-      expect(out).toContain(s);
-    }
-  });
-
-  it('flags an executed-pass that asserted nothing — the other RFC 0148 §A vacuity shape', () => {
-    const out = summarise(line({ requirementId: 'vacuous', disposition: 'executed-pass', assertionCount: 0 }));
-    expect(out).toContain('executed-pass (0 assertions)');
-    expect(out).toContain('vacuous');
-  });
-
-  it('does NOT flag a real executed-pass', () => {
-    const out = summarise(line({ requirementId: 'real', disposition: 'executed-pass', assertionCount: 12 }));
-    expect(out).toContain('executed-pass 1');
-    expect(out).not.toContain('did NOT witness');
-  });
-
-  it('announces truncation rather than capping silently', () => {
-    // A capped list that does not say it was capped reads as a complete one.
-    const many = Array.from({ length: 45 }, (_, i) =>
-      line({ requirementId: `r${i}`, disposition: 'blocked', detail: 'why' }),
-    ).join('\n');
-    const out = summarise(many);
-    expect(out).toContain('5 more not listed');
-  });
-
-  it('returns null on an empty ledger so teardown prints nothing', () => {
-    expect(summarise('')).toBeNull();
-    expect(summarise('\n\n')).toBeNull();
-  });
-
-  it('skips unparseable lines without discarding the rest of the run', () => {
-    const out = summarise(['{ not json', line({ requirementId: 'ok', disposition: 'blocked', detail: 'r' })].join('\n'));
-    expect(out).toContain('ok');
-    expect(out).toContain('blocked 1');
-  });
-});

package/src/lib/grpc-framing.test.ts

@@ -1,96 +0,0 @@
-/**
- * Unit tests for `grpc-framing.ts` — gRPC HTTP/2 message framing.
- *
- * @see grpc-framing.ts
- */
-
-import { describe, it, expect } from 'vitest';
-import { frameMessage, unframeMessages } from './grpc-framing.js';
-
-describe('grpc-framing: frameMessage', () => {
-  it('prepends a 5-byte header to a single payload', () => {
-    const payload = new Uint8Array([0xab, 0xcd, 0xef]);
-    const framed = frameMessage(payload);
-    expect(framed.byteLength).toBe(8);
-    expect(framed[0]).toBe(0); // identity compression
-    expect(framed[1]).toBe(0);
-    expect(framed[2]).toBe(0);
-    expect(framed[3]).toBe(0);
-    expect(framed[4]).toBe(3); // length = 3
-    expect(framed[5]).toBe(0xab);
-    expect(framed[6]).toBe(0xcd);
-    expect(framed[7]).toBe(0xef);
-  });
-
-  it('frames a zero-length payload as a 5-byte header alone', () => {
-    const framed = frameMessage(new Uint8Array(0));
-    expect(framed.byteLength).toBe(5);
-    expect(framed[0]).toBe(0);
-    expect(framed[4]).toBe(0);
-  });
-
-  it('encodes lengths > 256 in big-endian order', () => {
-    const payload = new Uint8Array(300);
-    const framed = frameMessage(payload);
-    // length = 300 = 0x0000012C, big-endian: 00 00 01 2C
-    expect(framed[1]).toBe(0);
-    expect(framed[2]).toBe(0);
-    expect(framed[3]).toBe(1);
-    expect(framed[4]).toBe(0x2c);
-  });
-});
-
-describe('grpc-framing: unframeMessages', () => {
-  it('parses a single frame', () => {
-    const payload = new Uint8Array([0x01, 0x02, 0x03, 0x04]);
-    const framed = frameMessage(payload);
-    const messages = unframeMessages(framed);
-    expect(messages.length).toBe(1);
-    expect(Array.from(messages[0]!)).toEqual([0x01, 0x02, 0x03, 0x04]);
-  });
-
-  it('parses multiple concatenated frames', () => {
-    const a = frameMessage(new Uint8Array([0xaa, 0xab]));
-    const b = frameMessage(new Uint8Array([0xbb]));
-    const c = frameMessage(new Uint8Array([0xcc, 0xcd, 0xce, 0xcf]));
-    const combined = new Uint8Array(a.byteLength + b.byteLength + c.byteLength);
-    combined.set(a, 0);
-    combined.set(b, a.byteLength);
-    combined.set(c, a.byteLength + b.byteLength);
-    const messages = unframeMessages(combined);
-    expect(messages.length).toBe(3);
-    expect(Array.from(messages[0]!)).toEqual([0xaa, 0xab]);
-    expect(Array.from(messages[1]!)).toEqual([0xbb]);
-    expect(Array.from(messages[2]!)).toEqual([0xcc, 0xcd, 0xce, 0xcf]);
-  });
-
-  it('parses an empty buffer as zero frames', () => {
-    expect(unframeMessages(new Uint8Array(0))).toEqual([]);
-  });
-
-  it('throws on truncated header', () => {
-    // Only 3 bytes of a 5-byte header.
-    const buf = new Uint8Array([0, 0, 0]);
-    expect(() => unframeMessages(buf)).toThrow(/frame truncated/i);
-  });
-
-  it('throws on truncated payload', () => {
-    // 5-byte header declares 10 bytes of payload but only 4 follow.
-    const buf = new Uint8Array([0, 0, 0, 0, 10, 1, 2, 3, 4]);
-    expect(() => unframeMessages(buf)).toThrow(/payload truncated/i);
-  });
-
-  it('throws on unsupported compression flag', () => {
-    // Flag = 1 → compression negotiated, which we don't implement.
-    const buf = new Uint8Array([1, 0, 0, 0, 0]);
-    expect(() => unframeMessages(buf)).toThrow(/compression flag/i);
-  });
-
-  it('round-trips: frame → unframe yields original payload', () => {
-    const original = new Uint8Array([0x0a, 0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f]); // protobuf "hello"
-    const framed = frameMessage(original);
-    const unframed = unframeMessages(framed);
-    expect(unframed.length).toBe(1);
-    expect(Array.from(unframed[0]!)).toEqual(Array.from(original));
-  });
-});

package/src/lib/oidc-issuer.test.ts

@@ -1,328 +0,0 @@
-/**
- * Server-free unit tests for the synthetic OIDC issuer harness.
- *
- * The harness is real cryptographic code (RS256 + ES256 JWS signing,
- * JWKS export, JWT compact serialization). If the signing or encoding
- * is wrong, every scenario that uses the harness silently misreports —
- * the OIDC validation scenarios soft-skip behavior portions when the
- * host doesn't trust the harness, so a malformed token would simply
- * cause the host to reject and the test to "pass" via soft-skip path.
- *
- * These unit tests round-trip every token through `node:crypto.createVerify`
- * to confirm the harness output is parseable by an independent verifier.
- * Run server-free; doesn't depend on OPENWOP_BASE_URL.
- *
- * @see conformance/src/lib/oidc-issuer.ts
- * @see RFCS/0010-auth-profile-conformance.md §E
- */
-
-import { describe, it, expect } from 'vitest';
-import { createPublicKey, createVerify, type JsonWebKey } from 'node:crypto';
-import { createSyntheticOIDCIssuer } from './oidc-issuer.js';
-
-function base64UrlDecode(input: string): Buffer {
-  const pad = input.length % 4 === 0 ? 0 : 4 - (input.length % 4);
-  const padded = input + '='.repeat(pad);
-  const std = padded.replace(/-/g, '+').replace(/_/g, '/');
-  return Buffer.from(std, 'base64');
-}
-
-function decodeJwt(token: string): {
-  header: Record<string, unknown>;
-  payload: Record<string, unknown>;
-  signature: Buffer;
-  signingInput: string;
-} {
-  const parts = token.split('.');
-  if (parts.length !== 3) throw new Error(`malformed JWT: ${parts.length} segments`);
-  const [h, p, s] = parts;
-  return {
-    header: JSON.parse(base64UrlDecode(h).toString('utf8')) as Record<string, unknown>,
-    payload: JSON.parse(base64UrlDecode(p).toString('utf8')) as Record<string, unknown>,
-    signature: base64UrlDecode(s),
-    signingInput: `${h}.${p}`,
-  };
-}
-
-function verifyToken(
-  token: string,
-  jwksJson: string,
-  algorithm: 'RS256' | 'ES256',
-): boolean {
-  const decoded = decodeJwt(token);
-  const jwks = JSON.parse(jwksJson) as { keys: JsonWebKey[] };
-  const kid = decoded.header.kid;
-  const key = jwks.keys.find((k) => k.kid === kid);
-  if (!key) throw new Error(`no JWKS key matches kid=${String(kid)}`);
-
-  const publicKey = createPublicKey({ key, format: 'jwk' });
-  const digest = algorithm === 'RS256' ? 'RSA-SHA256' : 'SHA256';
-  const verifier = createVerify(digest);
-  verifier.update(decoded.signingInput);
-  verifier.end();
-  return verifier.verify(
-    algorithm === 'RS256'
-      ? publicKey
-      : { key: publicKey, dsaEncoding: 'ieee-p1363' },
-    decoded.signature,
-  );
-}
-
-describe('oidc-issuer: harness construction', () => {
-  it('requires issuer and audience', () => {
-    expect(() =>
-      createSyntheticOIDCIssuer({ issuer: '', audience: 'openwop' }),
-    ).toThrow(/issuer and audience/);
-    expect(() =>
-      createSyntheticOIDCIssuer({ issuer: 'https://x', audience: '' }),
-    ).toThrow(/issuer and audience/);
-  });
-
-  it('defaults to RS256 + canonical keyId', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    expect(issuer.algorithm).toBe('RS256');
-    expect(issuer.keyId).toBe('openwop-conformance-key-1');
-    expect(issuer.issuer).toBe('https://harness.example');
-    expect(issuer.audience).toBe('openwop');
-  });
-
-  it('rejects unsupported algorithm at runtime (defensive)', () => {
-    expect(() =>
-      createSyntheticOIDCIssuer({
-        issuer: 'https://x',
-        audience: 'y',
-        algorithm: 'HS256',
-      }),
-    ).toThrow(/unsupported algorithm/);
-  });
-});
-
-describe('oidc-issuer: JWKS + discovery shape', () => {
-  it('publishes a well-formed JWKS for RS256', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const jwks = JSON.parse(issuer.jwksJson) as { keys: JsonWebKey[] };
-    expect(Array.isArray(jwks.keys)).toBe(true);
-    expect(jwks.keys.length).toBe(1);
-    const key = jwks.keys[0];
-    expect(key.kty).toBe('RSA');
-    expect(key.alg).toBe('RS256');
-    expect(key.use).toBe('sig');
-    expect(key.kid).toBe(issuer.keyId);
-    // RSA JWK MUST have n (modulus) and e (exponent).
-    expect(typeof key.n).toBe('string');
-    expect(typeof key.e).toBe('string');
-  });
-
-  it('publishes a well-formed JWKS for ES256', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-      algorithm: 'ES256',
-    });
-    const jwks = JSON.parse(issuer.jwksJson) as { keys: JsonWebKey[] };
-    const key = jwks.keys[0];
-    expect(key.kty).toBe('EC');
-    expect(key.alg).toBe('ES256');
-    expect(key.crv).toBe('P-256');
-    expect(typeof key.x).toBe('string');
-    expect(typeof key.y).toBe('string');
-  });
-
-  it('publishes OIDC discovery doc with correct shape', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example/oauth',
-      audience: 'openwop',
-    });
-    const disco = JSON.parse(issuer.discoveryJson) as {
-      issuer: string;
-      jwks_uri: string;
-      response_types_supported: string[];
-      subject_types_supported: string[];
-      id_token_signing_alg_values_supported: string[];
-    };
-    expect(disco.issuer).toBe('https://harness.example/oauth');
-    expect(disco.jwks_uri).toBe('https://harness.example/oauth/.well-known/jwks.json');
-    expect(disco.id_token_signing_alg_values_supported).toContain('RS256');
-  });
-
-  it('discovery doc strips trailing slash before appending jwks path', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example/',
-      audience: 'openwop',
-    });
-    const disco = JSON.parse(issuer.discoveryJson) as { jwks_uri: string };
-    expect(disco.jwks_uri).toBe('https://harness.example/.well-known/jwks.json');
-  });
-});
-
-describe('oidc-issuer: mint defaults', () => {
-  it('fills iss / aud / iat / exp when not supplied', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const before = Math.floor(Date.now() / 1000);
-    const { claims } = issuer.mint({ sub: 'test-sub' });
-    const after = Math.floor(Date.now() / 1000);
-
-    expect(claims.iss).toBe('https://harness.example');
-    expect(claims.aud).toBe('openwop');
-    expect(claims.sub).toBe('test-sub');
-    expect(typeof claims.iat).toBe('number');
-    expect(typeof claims.exp).toBe('number');
-    expect(claims.iat).toBeGreaterThanOrEqual(before);
-    expect(claims.iat).toBeLessThanOrEqual(after);
-    // Default lifetime is 300s.
-    expect((claims.exp as number) - (claims.iat as number)).toBe(300);
-  });
-
-  it('caller claims override defaults', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const { claims } = issuer.mint({
-      iss: 'override-issuer',
-      aud: 'override-audience',
-      sub: 'test-sub',
-    });
-    expect(claims.iss).toBe('override-issuer');
-    expect(claims.aud).toBe('override-audience');
-  });
-
-  it('negative expiresInSeconds mints already-expired token', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const now = Math.floor(Date.now() / 1000);
-    const { claims } = issuer.mint(
-      { sub: 'test-sub' },
-      { expiresInSeconds: -3600 },
-    );
-    expect((claims.exp as number) < now).toBe(true);
-  });
-});
-
-describe('oidc-issuer: signature round-trip', () => {
-  it('RS256 token verifies against published JWKS', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-      algorithm: 'RS256',
-    });
-    const { token } = issuer.mint({ sub: 'test-sub' });
-    const verified = verifyToken(token, issuer.jwksJson, 'RS256');
-    expect(verified).toBe(true);
-  });
-
-  it('ES256 token verifies against published JWKS', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-      algorithm: 'ES256',
-    });
-    const { token } = issuer.mint({ sub: 'test-sub' });
-    const verified = verifyToken(token, issuer.jwksJson, 'ES256');
-    expect(verified).toBe(true);
-  });
-
-  it('header alg matches issuer algorithm by default', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-      algorithm: 'ES256',
-    });
-    const { token } = issuer.mint({ sub: 'test-sub' });
-    const decoded = decodeJwt(token);
-    expect(decoded.header.alg).toBe('ES256');
-  });
-
-  it('mint opts.algorithm override appears in header (alg-spoof scenario)', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-      algorithm: 'RS256',
-    });
-    const { token } = issuer.mint(
-      { sub: 'test-sub' },
-      { algorithm: 'HS256' },
-    );
-    const decoded = decodeJwt(token);
-    expect(decoded.header.alg).toBe('HS256');
-    // The signature is still RS256-bytes (the harness doesn't actually
-    // honor the alg override for the signature itself — that's the spoof:
-    // the header lies, the bytes don't match). Verification with RS256
-    // succeeds, which is the test scenario's correct behavior: it lets
-    // the OAuth2-CC negative-case scenario assert the host rejects
-    // because the header claims HS256 outside supportedAlgorithms.
-    const verified = verifyToken(
-      // Pull alg from header for verification — but the verify path
-      // is RS256 because that's the actual key. Re-decode and verify
-      // by extracting the alg-from-issuer rather than alg-from-header.
-      token,
-      issuer.jwksJson,
-      'RS256',
-    );
-    expect(verified).toBe(true);
-  });
-
-  it('keyId override sets header.kid without changing signing key (unknown-kid scenario)', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const { token } = issuer.mint(
-      { sub: 'test-sub' },
-      { keyId: 'never-published-kid' },
-    );
-    const decoded = decodeJwt(token);
-    expect(decoded.header.kid).toBe('never-published-kid');
-    // The JWKS doesn't publish this kid; verifyToken throws.
-    expect(() => verifyToken(token, issuer.jwksJson, 'RS256')).toThrow(/no JWKS key/);
-  });
-});
-
-describe('oidc-issuer: key rotation', () => {
-  it('rotateKey() changes the published keyId', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const firstKid = issuer.keyId;
-    issuer.rotateKey();
-    expect(issuer.keyId).not.toBe(firstKid);
-    expect(issuer.keyId).toBe('openwop-conformance-key-2');
-  });
-
-  it('tokens minted before rotation no longer verify against new JWKS', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    const beforeRotation = issuer.mint({ sub: 'test-sub' });
-    issuer.rotateKey();
-    // The JWKS now publishes a different key. The old token's header
-    // kid still references the pre-rotation kid, which isn't published.
-    expect(() =>
-      verifyToken(beforeRotation.token, issuer.jwksJson, 'RS256'),
-    ).toThrow(/no JWKS key/);
-  });
-
-  it('tokens minted after rotation verify against new JWKS', () => {
-    const issuer = createSyntheticOIDCIssuer({
-      issuer: 'https://harness.example',
-      audience: 'openwop',
-    });
-    issuer.rotateKey();
-    const afterRotation = issuer.mint({ sub: 'test-sub' });
-    const verified = verifyToken(afterRotation.token, issuer.jwksJson, 'RS256');
-    expect(verified).toBe(true);
-  });
-});