test: coverage campaign and mutation testing across five packages (#628)

Coverage 83.6 to 87.36% lines, 81.63 to 84.14% branches. Mutation testing across five packages: image-engine 85, media-engine 92, doc-engine 87, shared+enterprise 86, apps/api security and jobs slice. Runs all five lanes weekly. Fixes the silently-broken mutation CI (babel pin), a redact-pdf envelope-shape test bug, an untested enterprise license valid-signature path, and an audit test that only exercised a hand-copied reproduction. Test and config only, no product code changes beyond the babel pin and one test-only oidc export. Full suite: 16,712 pass, 0 fail.

tests/integration/tools/document/crop-pdf.test.ts

@@ -1,6 +1,11 @@
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { pdfcpuAvailable } from "@snapotter/doc-engine";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { fixtures, readFixture } from "../../../fixtures/index.js";
+
 import {
   buildTestApp,
   createMultipartPayload,
@@ -8,6 +13,42 @@ import {
   type TestApp,
 } from "../../test-server.js";
 
+// Read every page /MediaBox and /CropBox from a PDF buffer via qpdf --json.
+// pdfcpu crop sets a shrunk /CropBox (the visible region) and leaves /MediaBox
+// at the full page size, so the crop oracle compares output CropBox to input
+// MediaBox.
+function pageBoxes(pdfBytes: Buffer): { media: number[][]; crop: number[][] } {
+  const dir = mkdtempSync(join(tmpdir(), "crop-pdf-box-"));
+  try {
+    const p = join(dir, "x.pdf");
+    writeFileSync(p, pdfBytes);
+    const json = execFileSync("qpdf", ["--json", p], { encoding: "utf8", maxBuffer: 1 << 24 });
+    const media: number[][] = [];
+    const crop: number[][] = [];
+    const walk = (node: unknown): void => {
+      if (Array.isArray(node)) {
+        for (const child of node) walk(child);
+        return;
+      }
+      if (node && typeof node === "object") {
+        for (const [k, v] of Object.entries(node)) {
+          if (k === "/MediaBox" && Array.isArray(v) && v.length === 4) {
+            media.push(v.map(Number));
+          } else if (k === "/CropBox" && Array.isArray(v) && v.length === 4) {
+            crop.push(v.map(Number));
+          } else {
+            walk(v);
+          }
+        }
+      }
+    };
+    walk(JSON.parse(json));
+    return { media, crop };
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
 const PDF = readFixture(fixtures.document.pdf3);
 
 let testApp: TestApp;
@@ -48,6 +89,20 @@ describe.skipIf(!pdfcpuAvailable())("crop-pdf (requires pdfcpu)", () => {
     });
     expect(dl.statusCode).toBe(200);
     expect(dl.rawPayload.subarray(0, 5).toString()).toBe("%PDF-");
+
+    // Semantic oracle: cropping with margin 20 must shrink each page's MediaBox.
+    // A no-op passthrough would leave the box unchanged and still pass %PDF-.
+    const input = pageBoxes(PDF);
+    const output = pageBoxes(Buffer.from(dl.rawPayload));
+    expect(input.media.length).toBeGreaterThan(0);
+    // pdfcpu crop adds a shrunk /CropBox to every page.
+    expect(output.crop.length).toBe(input.media.length);
+    const inW = input.media[0][2] - input.media[0][0];
+    const inH = input.media[0][3] - input.media[0][1];
+    for (const b of output.crop) {
+      expect(b[2] - b[0]).toBeLessThan(inW);
+      expect(b[3] - b[1]).toBeLessThan(inH);
+    }
   }, 60_000);
 });