test: coverage campaign and mutation testing across five packages (#628)

Coverage 83.6 to 87.36% lines, 81.63 to 84.14% branches. Mutation testing across five packages: image-engine 85, media-engine 92, doc-engine 87, shared+enterprise 86, apps/api security and jobs slice. Runs all five lanes weekly. Fixes the silently-broken mutation CI (babel pin), a redact-pdf envelope-shape test bug, an untested enterprise license valid-signature path, and an audit test that only exercised a hand-copied reproduction. Test and config only, no product code changes beyond the babel pin and one test-only oidc export. Full suite: 16,712 pass, 0 fail.

tests/integration/tools/audio/ringtone-maker.test.ts

@@ -1,4 +1,7 @@
-import { ffmpegAvailable } from "@snapotter/media-engine";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { ffmpegAvailable, probeMedia } from "@snapotter/media-engine";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { fixtures, readFixture } from "../../../fixtures/index.js";
 import {
@@ -10,6 +13,10 @@ import {
 
 const MP3 = readFixture(fixtures.audio.tiny("mp3"));
 
+// Default durationS in the ringtone-maker settings schema (also its max), so the
+// happy-path call with `{}` caps the ringtone at this many seconds.
+const MAX_DURATION_S = 30;
+
 let testApp: TestApp;
 let adminToken: string;
 
@@ -45,6 +52,24 @@ describe.skipIf(!ffmpegAvailable())("ringtone-maker (requires ffmpeg)", () => {
     const dl = await testApp.app.inject({ method: "GET", url: envelope.downloadUrl });
     expect(dl.statusCode).toBe(200);
     expect(dl.rawPayload.length).toBeGreaterThan(200);
+
+    // Semantic oracle: the ringtone must be AAC audio and duration-capped. A bad
+    // encode (wrong codec, or no `-t` cap so a long input passes through) still
+    // returns valid magic bytes, so probe the real container instead.
+    const tmpDir = mkdtempSync(join(tmpdir(), "ringtone-test-"));
+    try {
+      const outPath = join(tmpDir, "ringtone.m4r");
+      writeFileSync(outPath, dl.rawPayload);
+      const info = await probeMedia(outPath);
+      const audio = info.streams.find((s) => s.type === "audio");
+      expect(audio).toBeDefined();
+      expect(audio?.codec).toBe("aac");
+      // Ringtones are duration-capped at the configured maximum length.
+      expect(info.durationS).not.toBeNull();
+      expect(info.durationS ?? Number.POSITIVE_INFINITY).toBeLessThanOrEqual(MAX_DURATION_S);
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
   }, 60_000);
 
   it("rejects startS beyond audio duration (422)", async () => {