Reorganize tests into clause-addressable conformance and behavior suites

[kjanat]

Problem

The test suite is organized primarily by historical feature files, not by the behavior being proved or the standard that mandates it. Standards evidence is therefore difficult to discover, audit, run, and maintain.

Today:

• test/ has 37 top-level suites and about 32.9k lines of suite code.
• The five largest suites contain 56% of that code:
  • verify.test.ts: 5,048 lines
  • crl.test.ts: 4,132 lines
  • ocsp.test.ts: 3,735 lines
  • parse.test.ts: 3,648 lines
  • internals.test.ts: 1,956 lines
• RFC 5280 assertions are distributed across builder, parser, internal encoder, verification, revocation, and helper suites.
• Important RFC 5280 behavior in crl.test.ts, policy.test.ts, and name-constraints.test.ts often has no RFC/section in the test title.
• Some citations exist only in comments inside generically named tests.
• test/helpers.ts is a 500-line catch-all spanning DER utilities, mutations, chain issuance, CMS builders, OpenSSL detection, and filesystem paths.
• Domain-surface smoke suites overlap with full feature suites without a clear ownership rule.

Answering “do we assert RFC 5280 §4.2.1.6?” should require opening one canonical file and finding:

describe('RFC 5280', () => {
	describe('§4.2.1.6 Subject Alternative Name', subjectAlternativeNameConformance);
});

It should not require repository-wide archaeology.

Goal

Reorganize tests so their paths and names answer three questions directly:

1. What kind of evidence is this: standards conformance, public behavior, integration/interoperability, or package contract?
2. Which standard and clause owns normative behavior?
3. Which exact normative statement or API contract does the case prove?

This is an ownership and discoverability migration, not a rewrite of working assertions.

Target structure

test/
├── conformance/
│   ├── rfc-5280.test.ts
│   ├── rfc-5280/
│   │   ├── 4.1-certificate-profile.ts
│   │   ├── 4.2-extensions.ts
│   │   ├── 6.1-path-validation.ts
│   │   └── 6.3-crl-validation.ts
│   ├── rfc-6960.test.ts
│   ├── rfc-9618.test.ts
│   ├── x690.test.ts
│   └── pkits/
│       ├── pkits.test.ts
│       ├── manifest.ts
│       └── ...
├── behavior/
│   ├── x509/
│   ├── verify/
│   ├── revocation/
│   ├── keys/
│   ├── pkcs/
│   ├── pem/
│   └── der/
├── integration/
│   ├── lifecycle/
│   ├── differential/
│   └── fuzz/
├── contracts/
│   ├── root-exports.test.ts
│   ├── domain-entrypoints.test.ts
│   └── public-types.ts
├── support/
│   ├── builders/
│   ├── der/
│   ├── mutations/
│   ├── oracles/
│   └── paths.ts
└── fixtures/

Exact subdirectories may change during migration. The ownership categories and canonical standards entrypoints should not.

Standards convention

Each supported standard gets one canonical test/conformance/<standard>.test.ts front door. It must contain the ordered clause map, even when implementations live in smaller imported modules:

import { subjectAlternativeNameConformance } from './rfc-5280/4.2-extensions.ts';

describe('RFC 5280', () => {
	describe('§4.2.1.6 Subject Alternative Name', subjectAlternativeNameConformance);
});

Rules:

• Sort clause describe blocks numerically.
• Include the section title, not only the number.
• Name cases after the normative behavior: MUST, MUST NOT, SHOULD, accepted profile behavior, or deliberate hardening.
• Put positive and negative evidence under the same owning clause.
• State updates/overrides explicitly, e.g. RFC 6818, RFC 9549, or RFC 9618.
• A standards-mandated behavior has one canonical owner. API and integration suites may exercise the workflow, but must not become competing conformance sources.
• Clause-specific malformed input belongs with its clause. Generic DER parser hardening belongs under behavior/der/.
• PKITS remains a separate conformance harness because its section numbers, fixtures, expected outcomes, and fixed validation time are externally defined.

Non-standard test ownership

• behavior/: public or internal behavior not owned by one normative clause.
• integration/: cross-module lifecycle, OpenSSL differential, fuzz, and interoperability evidence.
• contracts/: package exports, domain entrypoints, compile-time surface, and barrel checks.
• support/: reusable test code only; no registered tests.
• fixtures/: static or generated test material; files named *-fixtures.test.ts must become either actual tests or fixture modules, not both.

Trackability

Add focused commands:

{
	"test:conformance": "bun test test/conformance",
	"test:rfc5280": "bun test test/conformance/rfc-5280.test.ts",
	"test:pkits": "bun test test/conformance/pkits/pkits.test.ts",
	"test:differential": "bun test test/integration/differential"
}

Add a lightweight convention test that verifies:

• every canonical conformance entrypoint has a top-level standard describe;
• clause blocks use §<number> <title>;
• no duplicate standard/clause ownership exists across canonical entrypoints;
• support and fixture modules do not register tests;
• obsolete top-level catch-all suites do not reappear.

Do not introduce a separate hand-maintained coverage matrix as the primary source of truth. The canonical entrypoints and executable clause blocks are the index. Authored scope docs may link to them.

Migration plan

1. Freeze the baseline

• Record current discovered suites and runtime case counts.
• Preserve 249 PKITS runs, the two DSA it.failing cases, the default differential fuzz corpus, it.each expansions, and inline malformed-input corpora.
• Record current focused commands and CI artifacts before moving paths.

2. Establish taxonomy and conventions

• Create the target directories and convention test.
• Add canonical entrypoints for RFC 5280 first, then other RFC/ITU standards.
• Add focused package scripts without changing broad bun test discovery.

3. Split support code

• Decompose test/helpers.ts by responsibility.
• Keep DER mutation/building logic single-owned; do not copy helpers into clause files.
• Move OpenSSL wrappers under test/support/oracles/ while preserving availability gates and normalized verdicts.
• Update #test/* imports, package.json, and deno.import_map.json atomically.

4. Migrate RFC 5280 evidence

• Move normative cases from certificate.test.ts, csr.test.ts, internals.test.ts, parse.test.ts, verify.test.ts, crl.test.ts, policy.test.ts, name-constraints.test.ts, and revocation suites.
• Organize by clause, not implementation module.
• Start with known scattered areas:
  • §4.1.2.4 issuer DN
  • §4.2.1.6 Subject Alternative Name
  • §4.2.1.9 Basic Constraints
  • §4.2.1.10 Name Constraints
  • §4.2.1.13 CRL Distribution Points
  • §6.1 path validation
  • §6.3 CRL processing
  • Appendix A.1 attribute bounds
• Convert comment-only citations into clause-owned test names.

5. Migrate remaining standards

• RFC 6960 / RFC 5019 OCSP.
• RFC 6125 / RFC 9525 service identity.
• RFC 9618 policy processing.
• PKCS/RFC suites for keys, PKCS#7, PKCS#8, PKCS#12, and PEM.
• ITU-T X.680/X.690 DER/ASN.1 constraints.
• RFC 3454 / RFC 4518 string preparation.

6. Split behavior and integration monoliths

• Eliminate catch-all ownership in verify.test.ts, crl.test.ts, ocsp.test.ts, parse.test.ts, and internals.test.ts.
• Keep lifecycle assertions under feature behavior directories.
• Keep OpenSSL differential and fuzz suites isolated from deterministic behavior suites.
• Consolidate overlapping domain-surface smoke tests under contracts/.

7. Update CI and documentation

• Preserve broad coverage discovery and JUnit output.
• Add a visible conformance CI step or summary.
• Keep the dedicated OpenSSL environment and randomized stress workflow.
• Update hard-coded test links in docs/PKIX-SCOPE.md, README.md, CONTRIBUTING.md, and test/AGENTS.md.

Acceptance criteria

• test/conformance/rfc-5280.test.ts is the canonical RFC 5280 front door.
• Searching that file for describe('§4.2.1.6 finds the Subject Alternative Name conformance owner.
• Every RFC 5280 behavior claimed in docs/PKIX-SCOPE.md maps to an executable clause block.
• bun test test/conformance/rfc-5280.test.ts runs all RFC 5280 conformance assertions.
• Other supported standards have equivalent canonical entrypoints.
• No normative assertion is discoverable only through a comment in an unrelated suite.
• Each assertion has one canonical owner; migration does not inflate coverage through duplication.
• The 249 PKITS runs, fixed time, expected-valid/invalid outcomes, and DSA expected failures are preserved.
• Differential OpenSSL gates and fuzz behavior are preserved.
• test/helpers.ts is removed or reduced to a narrow compatibility barrel during migration.
• Catch-all internals.test.ts is removed.
• Broad test discovery, focused scripts, coverage, JUnit, typecheck, docs lint, and randomized stress all pass.
• Test-path links and agent guidance are updated in the same change that moves their targets.

Non-goals

• Rewriting stable tests solely for stylistic consistency.
• Replacing real cryptographic material with mocks.
• Changing implementation behavior while moving tests.
• Claiming unimplemented RFC coverage merely because a clause heading exists.
• Moving or regenerating the PKITS corpus beyond path updates required by this reorganization.

Migration safety

Land this in reviewable slices, but each slice must leave one unambiguous owner for moved behavior. Temporary compatibility barrels are acceptable for imports; duplicate test registration and parallel old/new conformance ownership are not.

[coderabbitai]

Coding Plan

Summary

• Migrate by ownership in reviewable slices — each slice leaves one unambiguous owner, using temporary compatibility barrels for imports but never duplicate test registration or parallel old/new conformance ownership.
• Establish canonical conformance/<standard>.test.ts front doors with ordered §<number> <title> clause maps, an executable convention test enforcing the rules, and RFC 5280 migrated first.
• Decompose helpers.ts and the oracles/fuzz support into single-owned support/ modules, re-pointing package.json imports and all #test/* aliases atomically (the gitignored Deno import map self-regenerates).
• Preserve every load-bearing invariant verbatim — PKITS fixed time, full case count, DSA it.failing, fuzz corpus, it.each, coverage/JUnit/typecheck/stress — and move all doc/CI path references in the same change as their targets.

Design Choices

Design Choice 1: The ticket says "249 PKITS runs" but the manifest actually registers 250 cases

Options Considered:

1. Preserve the literal "249" from the ticket text.
2. Preserve whatever count the vendored manifest yields (currently 250) and correct the documentation.

Chosen Option: 2

Rationale: The harness is data-driven from a "do not edit by hand" vendored manifest, so the count must track the corpus; note the correction in the PR and docs rather than forcing a number.

Design Choice 2: How to handle the deno.import_map.json update the ticket calls for

Options Considered:

1. Hand-create/maintain deno.import_map.json.
2. Update only package.json imports (the real source of truth) and let the generated map self-update.

Chosen Option: 2

Rationale: Editing the generated artefact would be redundant and drift-prone; updating imports satisfies the "update the import map atomically" intent.

Design Choice 3: How to treat mixed-concern and *-fixtures.test.ts files

Options Considered:

1. Move each whole file to a single destination.
2. Split each file so clause-anchored cases go to conformance/ and behavioural cases go to behavior/, and convert *-fixtures.test.ts into either a fixtures/support/ data module or a properly named test.

Chosen Option: 2

Rationale: The ticket explicitly requires one canonical clause owner and forbids *-fixtures.test.ts from being both fixture and test.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Freeze the baseline and stand up the taxonomy

Before shifting a single plank, pin down exactly what we have so nothing goes missing in the storm, then scaffold the new harbour and the harbour-master (convention test) that keeps future ships in their lanes. No assertions move yet; broad bun test discovery stays untouched.

Task 1: Record the migration baseline

Capture the invariants that acceptance criteria depend on, so drift is detectable later.

• Record the current runtime case counts (notably the actual PKITS registration count, the two DSA it.failing cases in pkits.test.ts, the it.each name-constraint expansions in verify.test.ts, and the inline malformed-DER corpora in malformed-der.test.ts/parse.test.ts).
• Record the existing focused commands (test:differential, test:pkits) and CI artefacts (coverage upload, JUnit test-results.xml) as the reference contract to preserve.

Task 2: Create the target directory skeleton

Establish the ownership categories as empty-but-real directories so migration slices have destinations.

• Create test/conformance/ (with rfc-5280/ clause-module subdir and pkits/), test/behavior/{x509,verify,revocation,keys,pkcs,pem,der}/, test/integration/{lifecycle,differential,fuzz}/, test/contracts/, and test/support/{builders,der,mutations,oracles}/.
• Keep test/fixtures/ where it is; the PKITS corpus is only re-pathed, never regenerated.

Task 3: Add the canonical RFC 5280 front door and its clause modules

Create the pattern all standards will follow, starting with RFC 5280.

• Add test/conformance/rfc-5280.test.ts as the single front door: a top-level describe('RFC 5280', …) importing clause suites from rfc-5280/*.ts and registering them as describe('§<number> <title>', suite), sorted numerically.
• Add the clause-module files (4.1-certificate-profile.ts, 4.2-extensions.ts, 6.1-path-validation.ts, 6.3-crl-validation.ts, plus an appendix module for A.1 bounds) exporting suite callbacks; these register no tests themselves until Phase 4 fills them.
• Note update/override standards (RFC 6818, RFC 9549, RFC 9618) explicitly in the relevant clause titles/comments as cases arrive.

Task 4: Add the convention test and focused scripts

Give the reorg an executable rulebook and discoverable entrypoints without altering broad discovery.

• Add a convention suite under test/contracts/ (or extend conventions.test.ts re-homed there) verifying: every test/conformance/*.test.ts front door has a top-level standard describe; clause blocks match a §<number> <title> shape; no standard/clause is owned by two canonical entrypoints; modules under support/ and fixtures/ register zero bun:test cases; and the removed catch-all suite names do not reappear.
• Add test:conformance, test:rfc5280, and updated test:pkits/test:differential scripts to package.json pointing at the new paths; leave the default test script's glob-based discovery unchanged.

🤖 Prompt for AI agents

Implement the baseline freeze and taxonomy scaffolding for the test-suite
reorganisation. No assertions move in this phase; broad `bun test` discovery
must remain untouched.

- Record the current runtime case counts as the migration baseline: the actual
PKITS registration count, the two DSA `it.failing` cases in `pkits.test.ts`, the
`it.each` name-constraint expansions in `verify.test.ts`, and the inline
malformed-DER corpora in `malformed-der.test.ts`/`parse.test.ts`. Also record
the existing focused commands (`test:differential`, `test:pkits`) and CI
artefacts (coverage upload, JUnit `test-results.xml`) as the reference contract
to preserve.

- Create the target directory skeleton: `test/conformance/` (with a `rfc-5280/`
clause-module subdirectory and `pkits/`),
`test/behavior/{x509,verify,revocation,keys,pkcs,pem,der}/`,
`test/integration/{lifecycle,differential,fuzz}/`, `test/contracts/`, and
`test/support/{builders,der,mutations,oracles}/`. Leave `test/fixtures/` in
place — the PKITS corpus is only re-pathed later, never regenerated here.

- Add `test/conformance/rfc-5280.test.ts` as the single canonical front door: a
top-level `describe('RFC 5280', …)` that imports clause suites from
`rfc-5280/*.ts` and registers each as `describe('§<number> <title>', suite)`,
sorted numerically. Add the clause-module files: `4.1-certificate-profile.ts`,
`4.2-extensions.ts`, `6.1-path-validation.ts`, `6.3-crl-validation.ts`, plus an
appendix module for A.1 bounds, each exporting suite callbacks that register no
tests yet (they are filled in Phase 4/3). Note the relevant update/override
standards (RFC 6818, RFC 9549, RFC 9618) in clause titles/comments as cases
arrive later.

- Add a convention/contract test under `test/contracts/` (either new or by
re-homing `conventions.test.ts`) that verifies: every
`test/conformance/*.test.ts` front door has a top-level standard `describe`;
clause blocks match a `§<number> <title>` shape; no standard/clause is owned by
two canonical entrypoints; modules under `support/` and `fixtures/` register
zero `bun:test` cases; and removed catch-all suite names do not reappear.

- Add `test:conformance`, `test:rfc5280` scripts and update
`test:pkits`/`test:differential` scripts in `package.json` to point at the new
paths, while leaving the default `test` script's glob-based discovery unchanged.

Phase 2: Decompose the support code

The 500-line helpers.ts grab-bag is the source of half our misery — split it by responsibility so DER mutation, chain building, CMS synthesis, paths, and env-gates each have one owner, then re-point every alias in the same breath so nothing dangles.

Task 1: Split test/helpers.ts by responsibility

Break the catch-all into single-purpose support modules; keep DER mutation/building single-owned (no copying into clause files).

• Move raw DER/ASN.1 utilities (childrenOf, decodeObjectIdentifier, hexToBytes, sliceElement, hasExtensionOid) into test/support/der/.
• Move mutation/rewrite builders (rewriteCertificateSignatureAsRsaPss, replaceCsrSignatureAlgorithm, addRevokedEntryCertificateIssuers, etc., with their private encoders) into test/support/mutations/.
• Move chain issuance (issueChain/IssueChainOptions), CMS/PKCS#7 synthetic builders, and importRsaPrivateKeyWithScheme into test/support/builders/.
• Move filesystem constants (projectRoot, srcRoot, testRoot, fixturesDir) into test/support/paths.ts, and env/CI gates (isCi, openSslAvailable, differentialEnabled) into a small support module.
• Reduce test/helpers.ts to a narrow compatibility barrel (or remove it) once all consumers are re-pointed.

Task 2: Relocate OpenSSL oracles and fuzz support

Consolidate all differential/interop machinery under the support tree while preserving gates and normalised verdicts.

• Move test/oracles/openssl.ts and openssl-gen.ts under test/support/oracles/, preserving openSslAvailable/differentialEnabled gating and normalised-semantics comparisons.
• Move test/fuzz/{spec,prng,compare,failure}.ts under test/support/ (or integration/fuzz/ support alongside its harness), keeping the deterministic seeded generator and the gitignored failure-fixture dumping behaviour intact.

Task 3: Re-point all `#test/`* imports and alias maps atomically

Ensure the split leaves no broken import in the same change.

• Update package.json imports (#test/helpers, #test/fuzz/*, #test/oracles/*, #test/pkits/*) to the new support paths; the generated, gitignored deno.import_map.json self-updates from this field.
• Update every consumer's #test/* import to the new module boundaries in the same slice.
• Confirm tsconfig.other.json's recursive test/**/*.ts glob still covers the nested support tree (no change expected).

🤖 Prompt for AI agents

Decompose the flat, catch-all support code (`test/helpers.ts`, `oracles/`,
`fuzz/`) into single-responsibility `test/support/` modules, and re-point every
alias/import in the same slice so nothing dangles.

- Split `test/helpers.ts` by responsibility: move raw DER/ASN.1 utilities
(`childrenOf`, `decodeObjectIdentifier`, `hexToBytes`, `sliceElement`,
`hasExtensionOid`) into `test/support/der/`; move mutation/rewrite builders
(`rewriteCertificateSignatureAsRsaPss`, `replaceCsrSignatureAlgorithm`,
`addRevokedEntryCertificateIssuers`, etc., with their private encoders) into
`test/support/mutations/`; move chain issuance
(`issueChain`/`IssueChainOptions`), CMS/PKCS#7 synthetic builders, and
`importRsaPrivateKeyWithScheme` into `test/support/builders/`; move filesystem
constants (`projectRoot`, `srcRoot`, `testRoot`, `fixturesDir`) into
`test/support/paths.ts`; move env/CI gates (`isCi`, `openSslAvailable`,
`differentialEnabled`) into a small dedicated support module. Reduce
`test/helpers.ts` to a narrow compatibility barrel (or remove it entirely) once
all consumers are re-pointed.

- Relocate OpenSSL oracle and fuzz support: move `test/oracles/openssl.ts` and
`openssl-gen.ts` under `test/support/oracles/`, preserving the
`openSslAvailable`/`differentialEnabled` gating and normalised-semantics
comparisons exactly. Move `test/fuzz/{spec,prng,compare,failure}.ts` under
`test/support/` (or alongside its harness under `integration/fuzz/`), keeping
the deterministic seeded generator and the gitignored failure-fixture dumping
behaviour intact.

- Re-point all `#test/*` imports and alias maps atomically: update
`package.json`'s `imports` field (`#test/helpers`, `#test/fuzz/*`,
`#test/oracles/*`, `#test/pkits/*`) to the new support paths — the gitignored,
generated `deno.import_map.json` will self-update from this field and must not
be hand-edited. Update every consumer's `#test/*` import to the new module
boundaries within the same change. Confirm `tsconfig.other.json`'s recursive
`test/**/*.ts` glob still covers the nested support tree without modification.

Phase 3: Migrate RFC 5280 evidence into clause ownership

This is the meat of the voyage. We haul every normative RFC 5280 assertion out of the builder/parser/internal/verify/revocation suites and re-home it under its owning clause — organised by clause, never by implementation module — and turn comment-only citations into clause-owned test names. Positive and negative evidence sit under the same clause.

Task 1: Populate the high-value scattered clauses first

Fill the RFC 5280 clause modules from the known scattered areas.

• Move cases into 4.1-certificate-profile.ts (§4.1.2.4 issuer DN), 4.2-extensions.ts (§4.2.1.6 SAN, §4.2.1.9 Basic Constraints, §4.2.1.10 Name Constraints, §4.2.1.13 CRL Distribution Points), 6.1-path-validation.ts (§6.1), 6.3-crl-validation.ts (§6.3), and the appendix module (A.1 attribute bounds).
• Source these from certificate.test.ts, csr.test.ts, parse.test.ts, internals.test.ts, verify.test.ts (incl. the RFC 5280 §4.2.1.10 describe and its it.each), crl.test.ts, policy.test.ts, name-constraints.test.ts, and the revocation suites.
• Name each case after the normative statement (MUST / MUST NOT / SHOULD / accepted profile / deliberate hardening); keep clause-specific malformed inputs with their clause.

Task 2: Convert comment-only citations into clause-owned names

Eliminate the "citation hidden in a comment" failure mode for RFC 5280.

• Sweep the inline // RFC 5280 §… comments in verify.test.ts, parse.test.ts, internals.test.ts, and certificate.test.ts and re-home each as a named case under the owning clause module.
• Ensure no RFC 5280 normative assertion remains discoverable only via a comment in an unrelated suite.

Task 3: Relocate the PKITS harness under conformance

Keep PKITS a separate conformance harness with its externally-defined semantics intact.

• Move pkits.test.ts to test/conformance/pkits/pkits.test.ts and relocate/re-alias manifest.ts, generate-manifest.ts, download.ts under test/conformance/pkits/, updating the #test/pkits/* alias accordingly.
• Preserve verbatim: the hardcoded PKITS_VALIDATION_TIME = 2011-04-15T00:00:00Z, the auto-generated "do not edit by hand" manifest banner, the exact vendored cert/CRL filenames, the full case count, the two DSA it.failing cases, and multi-entry policy sub-variants.
• Do not regenerate or move the corpus beyond the path/alias updates required here.

🤖 Prompt for AI agents

Migrate every normative RFC 5280 assertion out of the scattered
builder/parser/internal/verify/revocation suites and re-home them under their
owning clause modules, organised strictly by clause rather than by
implementation module. Positive and negative evidence for a clause must sit
together.

- Populate the high-value scattered clauses first: move cases into
`4.1-certificate-profile.ts` (§4.1.2.4 issuer DN), `4.2-extensions.ts` (§4.2.1.6
SAN, §4.2.1.9 Basic Constraints, §4.2.1.10 Name Constraints, §4.2.1.13 CRL
Distribution Points), `6.1-path-validation.ts` (§6.1), `6.3-crl-validation.ts`
(§6.3), and the appendix module (A.1 attribute bounds). Source these cases from
`certificate.test.ts`, `csr.test.ts`, `parse.test.ts`, `internals.test.ts`,
`verify.test.ts` (including the `RFC 5280 §4.2.1.10` describe block and its
`it.each`), `crl.test.ts`, `policy.test.ts`, `name-constraints.test.ts`, and the
revocation suites. Name each migrated case after the normative statement it
evidences (MUST / MUST NOT / SHOULD / accepted profile / deliberate hardening),
and keep clause-specific malformed inputs together with their owning clause.

- Convert comment-only citations into clause-owned names: sweep the inline `//
RFC 5280 §…` comments in `verify.test.ts`, `parse.test.ts`, `internals.test.ts`,
and `certificate.test.ts`, and re-home each as a properly named case under its
owning clause module, so that no RFC 5280 normative assertion remains
discoverable only via a comment buried in an unrelated suite.

- Relocate the PKITS harness under conformance: move `pkits.test.ts` to
`test/conformance/pkits/pkits.test.ts`, and relocate/re-alias `manifest.ts`,
`generate-manifest.ts`, and `download.ts` under `test/conformance/pkits/`,
updating the `#test/pkits/*` alias accordingly. Preserve verbatim: the hardcoded
`PKITS_VALIDATION_TIME = 2011-04-15T00:00:00Z`, the auto-generated "do not edit
by hand" manifest banner, the exact vendored cert/CRL filenames, the full case
count, the two DSA `it.failing` cases, and the multi-entry policy sub-variants.
Do not regenerate or otherwise alter the corpus beyond the path/alias updates
required here.

Phase 4: Migrate the remaining standards

Now the other flags fly. Each supported standard earns one canonical conformance/<standard>.test.ts front door with its ordered clause map, and mixed-concern files get split cleanly between conformance and behaviour.

Task 1: Add OCSP, identity, and policy conformance entrypoints

Give the revocation/identity/policy standards their canonical owners.

• Create test/conformance/rfc-6960.test.ts (RFC 6960 / RFC 5019 OCSP), pulling the RFC 6960 §4.2.2.2 responder-authorization block from ocsp-fixtures.test.ts and the RFC 6960 §3.1/ResponderID clause cases from ocsp.test.ts/revocation.test.ts.
• Create an RFC 6125 / RFC 9525 service-identity entrypoint, migrating the clause-anchored cases from identity.test.ts/identity-fixtures.test.ts.
• Create test/conformance/rfc-9618.test.ts for policy processing, migrating the normative policy cases from policy.test.ts.

Task 2: Add PKCS, PEM, X.690, and string-prep entrypoints

Cover the remaining standards with canonical front doors.

• Add canonical entrypoints for the key/PKCS families (PKCS#7/RFC 5652 from pkcs7-signeddata.test.ts's §5.2 block; RFC 5915/5958/8410 key-encoding cases from keys.test.ts; PKCS#8/PKCS#12 from pfx.test.ts/internals.test.ts) and RFC 7468 PEM from pem.test.ts's existing conformance block.
• Add test/conformance/x690.test.ts for ITU-T X.680/X.690 DER/ASN.1 encoding constraints, and RFC 3454 / RFC 4518 string-prep entrypoints from rfc3454-tables.test.ts, dn-string-prep.test.ts, and the RFC 4514 cases in name-text.test.ts.

Task 3: Resolve *-fixtures.test.ts dual-role files

Enforce the fixtures-or-tests rule.

• For identity-fixtures.test.ts and ocsp-fixtures.test.ts, split their reusable fixture data into support//fixtures/ modules and re-home their it cases into the relevant conformance or behaviour suites, so no file is simultaneously fixture and registered test.

🤖 Prompt for AI agents

Give every remaining supported standard its own canonical
`conformance/<standard>.test.ts` front door with an ordered clause map, and
cleanly split mixed-concern and `*-fixtures.test.ts` files between conformance
and behaviour ownership.

- Add OCSP, identity, and policy conformance entrypoints: create
`test/conformance/rfc-6960.test.ts` for RFC 6960 / RFC 5019 OCSP, pulling the
`RFC 6960 §4.2.2.2` responder-authorization block from `ocsp-fixtures.test.ts`
and the `RFC 6960 §3.1`/ResponderID clause cases from
`ocsp.test.ts`/`revocation.test.ts`. Create an RFC 6125 / RFC 9525
service-identity entrypoint, migrating the clause-anchored cases from
`identity.test.ts`/`identity-fixtures.test.ts`. Create
`test/conformance/rfc-9618.test.ts` for policy processing, migrating the
normative policy cases from `policy.test.ts`.

- Add PKCS, PEM, X.690, and string-prep entrypoints: add canonical entrypoints
for the key/PKCS families — PKCS#7/RFC 5652 from `pkcs7-signeddata.test.ts`'s
`§5.2` block, RFC 5915/5958/8410 key-encoding cases from `keys.test.ts`, and
PKCS#8/PKCS#12 from `pfx.test.ts`/`internals.test.ts` — plus RFC 7468 PEM from
`pem.test.ts`'s existing conformance block. Add `test/conformance/x690.test.ts`
for ITU-T X.680/X.690 DER/ASN.1 encoding constraints, and RFC 3454 / RFC 4518
string-prep entrypoints sourced from `rfc3454-tables.test.ts`,
`dn-string-prep.test.ts`, and the RFC 4514 cases in `name-text.test.ts`.

- Resolve `*-fixtures.test.ts` dual-role files: for `identity-fixtures.test.ts`
and `ocsp-fixtures.test.ts`, split their reusable fixture data out into
`support/`/`fixtures/` modules, and re-home their actual `it` cases into the
relevant conformance or behaviour suites, ensuring no single file is
simultaneously a fixture module and a registered test file.

Phase 5: Break the behaviour/integration monoliths and consolidate contracts

Time to gut the leviathans. Whatever's left in the five catch-alls after conformance extraction is non-normative behaviour or lifecycle/interop — those get re-homed by domain, internals.test.ts is scuttled entirely, and the overlapping barrel smoke suites are folded into one contracts/ owner.

Task 1: Re-home residual behaviour by domain

Eliminate catch-all ownership in the monoliths.

• Move remaining non-normative cases from verify.test.ts → behavior/verify/, crl.test.ts/ocsp.test.ts/revocation.test.ts/chain-revocation.test.ts → behavior/revocation/, parse.test.ts/certificate.test.ts/csr.test.ts/extensions.test.ts → behavior/x509/, keys.test.ts → behavior/keys/, pkcs7.test.ts/pfx.test.ts → behavior/pkcs/, pem.test.ts → behavior/pem/, and generic DER parser hardening (from malformed-der.test.ts and internals.test.ts DER cases) → behavior/der/.
• Fully remove internals.test.ts, distributing its internal-invariant probes into the matching behavior/<domain>/ suites (keeping #micro509/internal/* imports where needed).

Task 2: Isolate integration, lifecycle, differential, and fuzz suites

Keep interop/randomised evidence separate from deterministic behaviour.

• Move differential.test.ts → integration/differential/, differential-fuzz.test.ts → integration/fuzz/, and cross-module lifecycle round-trips → integration/lifecycle/, preserving OpenSSL availability gates and the seeded fuzz corpus behaviour.

Task 3: Consolidate barrel/contract suites under contracts/

Establish one ownership rule for export-surface checks.

• Fold root-barrel.test.ts into contracts/root-exports.test.ts, the *-domain.test.ts/utility-domains.test.ts suites into contracts/domain-entrypoints.test.ts (keeping only the unique barrel-shape/"internal not re-exported" assertions, dropping happy-path duplication already owned by behaviour/conformance suites), and relocate root-barrel.types.ts to contracts/public-types.ts (remaining a compile-only, non-.test.ts file).

🤖 Prompt for AI agents

Break apart the five catch-all monolith suites into domain-owned behaviour, keep
interop/randomised evidence isolated under integration, fully remove
`internals.test.ts`, and consolidate the overlapping barrel smoke suites into
one `contracts/` owner.

- Re-home residual behaviour by domain: after conformance extraction, move
remaining non-normative cases from `verify.test.ts` into `behavior/verify/`;
from `crl.test.ts`, `ocsp.test.ts`, `revocation.test.ts`, and
`chain-revocation.test.ts` into `behavior/revocation/`; from `parse.test.ts`,
`certificate.test.ts`, `csr.test.ts`, and `extensions.test.ts` into
`behavior/x509/`; from `keys.test.ts` into `behavior/keys/`; from
`pkcs7.test.ts` and `pfx.test.ts` into `behavior/pkcs/`; from `pem.test.ts` into
`behavior/pem/`; and generic DER parser hardening (from `malformed-der.test.ts`
and the DER cases in `internals.test.ts`) into `behavior/der/`. Fully remove
`internals.test.ts`, distributing its internal-invariant probes into the
matching `behavior/<domain>/` suites, keeping `#micro509/internal/*` imports
where still needed.

- Isolate integration, lifecycle, differential, and fuzz suites: move
`differential.test.ts` into `integration/differential/`,
`differential-fuzz.test.ts` into `integration/fuzz/`, and cross-module lifecycle
round-trip suites into `integration/lifecycle/`, preserving the OpenSSL
availability gates and the seeded fuzz corpus behaviour exactly as before.

- Consolidate barrel/contract suites under `contracts/`: fold
`root-barrel.test.ts` into `contracts/root-exports.test.ts`; fold the
`*-domain.test.ts`/`utility-domains.test.ts` suites into
`contracts/domain-entrypoints.test.ts`, keeping only the unique barrel-shape and
"internal not re-exported" assertions while dropping happy-path duplication
already owned by behaviour/conformance suites; and relocate
`root-barrel.types.ts` to `contracts/public-types.ts`, keeping it a
compile-only, non-`.test.ts` file.

Phase 6: Update CI, scripts, and documentation

Last leg — make the crew's charts match the new coastline. Broad discovery, coverage, and JUnit keep working; the hardcoded paths and every doc link move in the same change as their targets.

Task 1: Update CI and focused commands

Preserve artefacts while pointing at new paths and surfacing conformance.

• Update .github/workflows/test.yml's differential job (via the re-pathed test:differential script) and any PKITS reference; confirm the main test/test:coverage job's broad glob discovery and JUnit test-results.xml upload still function unchanged.
• Add a visible conformance CI step or summary (e.g. running test:conformance), and confirm the stress.yml randomised workflow still resolves the relocated root-barrel/contracts suites.

Task 2: Update documentation and agent guidance

Keep path links and guidance in lockstep with the moves.

• Update the hardcoded test-path links in docs/PKIX-SCOPE.md, README.md, and CONTRIBUTING.md to the new conformance//integration/ locations, and ensure every RFC 5280 behaviour claimed in docs/PKIX-SCOPE.md maps to an executable clause block.
• Rewrite test/AGENTS.md's structure tree, "where to look" table, and local conventions to describe the new ownership taxonomy (conformance/behavior/integration/contracts/support/fixtures), the canonical-front-door rule, and the split support modules.

🤖 Prompt for AI agents

Update CI workflows, focused npm/bun scripts, and documentation so they match
the new directory taxonomy, in the same change as the files they reference.

- Update CI and focused commands: update `.github/workflows/test.yml`'s
`differential` job (via the re-pathed `test:differential` script) and any PKITS
reference to the new paths; confirm the main `test`/`test:coverage` job's broad
glob discovery and JUnit `test-results.xml` upload continue to function
unchanged. Add a visible conformance CI step or summary (for example, running
`test:conformance`), and confirm the `stress.yml` randomised workflow still
resolves the relocated root-barrel/contracts suites correctly.

- Update documentation and agent guidance: update the hardcoded test-path links
in `docs/PKIX-SCOPE.md`, `README.md`, and `CONTRIBUTING.md` to point at the new
`conformance/`/`integration/` locations, and ensure every RFC 5280 behaviour
claimed in `docs/PKIX-SCOPE.md` maps to an executable clause block. Rewrite
`test/AGENTS.md`'s structure tree, "where to look" table, and local conventions
to fully describe the new ownership taxonomy
(conformance/behavior/integration/contracts/support/fixtures), the
canonical-front-door rule, and the split support modules.

Research

The project is a WebCrypto-native X.509 library with a domain-first src/ layout (x509, verify, revocation, keys, pkcs, pem, der, result, plus internal/*), wired through #micro509/* subpath imports in package.json.

Tests currently live flat under test/ as ~37 feature suites (five monoliths hold 56% of the lines), a 467-line catch-all helpers.ts, pure-support oracles/ and fuzz/ modules, barrel smoke suites (*-domain.test.ts, root-barrel.test.ts), a static repo linter (conventions.test.ts), and a vendored PKITS harness (pkits.test.ts + auto-generated fixtures/pkits/manifest.ts).

RFC citations are scattered inconsistently across it/describe titles and inline comments, with several major suites citing nothing at all.

#test/* aliases in package.json imports and hardcoded paths in test:differential/test:pkits, docs, and test/AGENTS.md are the contract-relevant references that must move in lockstep.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Implement the baseline freeze and taxonomy scaffolding for the test-suite
reorganisation. No assertions move in this phase; broad `bun test` discovery
must remain untouched.

- Record the current runtime case counts as the migration baseline: the actual
PKITS registration count, the two DSA `it.failing` cases in `pkits.test.ts`, the
`it.each` name-constraint expansions in `verify.test.ts`, and the inline
malformed-DER corpora in `malformed-der.test.ts`/`parse.test.ts`. Also record
the existing focused commands (`test:differential`, `test:pkits`) and CI
artefacts (coverage upload, JUnit `test-results.xml`) as the reference contract
to preserve.

- Create the target directory skeleton: `test/conformance/` (with a `rfc-5280/`
clause-module subdirectory and `pkits/`),
`test/behavior/{x509,verify,revocation,keys,pkcs,pem,der}/`,
`test/integration/{lifecycle,differential,fuzz}/`, `test/contracts/`, and
`test/support/{builders,der,mutations,oracles}/`. Leave `test/fixtures/` in
place — the PKITS corpus is only re-pathed later, never regenerated here.

- Add `test/conformance/rfc-5280.test.ts` as the single canonical front door: a
top-level `describe('RFC 5280', …)` that imports clause suites from
`rfc-5280/*.ts` and registers each as `describe('§<number> <title>', suite)`,
sorted numerically. Add the clause-module files: `4.1-certificate-profile.ts`,
`4.2-extensions.ts`, `6.1-path-validation.ts`, `6.3-crl-validation.ts`, plus an
appendix module for A.1 bounds, each exporting suite callbacks that register no
tests yet (they are filled in Phase 4/3). Note the relevant update/override
standards (RFC 6818, RFC 9549, RFC 9618) in clause titles/comments as cases
arrive later.

- Add a convention/contract test under `test/contracts/` (either new or by
re-homing `conventions.test.ts`) that verifies: every
`test/conformance/*.test.ts` front door has a top-level standard `describe`;
clause blocks match a `§<number> <title>` shape; no standard/clause is owned by
two canonical entrypoints; modules under `support/` and `fixtures/` register
zero `bun:test` cases; and removed catch-all suite names do not reappear.

- Add `test:conformance`, `test:rfc5280` scripts and update
`test:pkits`/`test:differential` scripts in `package.json` to point at the new
paths, while leaving the default `test` script's glob-based discovery unchanged.
===============================================================================

Task: 2

Decompose the flat, catch-all support code (`test/helpers.ts`, `oracles/`,
`fuzz/`) into single-responsibility `test/support/` modules, and re-point every
alias/import in the same slice so nothing dangles.

- Split `test/helpers.ts` by responsibility: move raw DER/ASN.1 utilities
(`childrenOf`, `decodeObjectIdentifier`, `hexToBytes`, `sliceElement`,
`hasExtensionOid`) into `test/support/der/`; move mutation/rewrite builders
(`rewriteCertificateSignatureAsRsaPss`, `replaceCsrSignatureAlgorithm`,
`addRevokedEntryCertificateIssuers`, etc., with their private encoders) into
`test/support/mutations/`; move chain issuance
(`issueChain`/`IssueChainOptions`), CMS/PKCS#7 synthetic builders, and
`importRsaPrivateKeyWithScheme` into `test/support/builders/`; move filesystem
constants (`projectRoot`, `srcRoot`, `testRoot`, `fixturesDir`) into
`test/support/paths.ts`; move env/CI gates (`isCi`, `openSslAvailable`,
`differentialEnabled`) into a small dedicated support module. Reduce
`test/helpers.ts` to a narrow compatibility barrel (or remove it entirely) once
all consumers are re-pointed.

- Relocate OpenSSL oracle and fuzz support: move `test/oracles/openssl.ts` and
`openssl-gen.ts` under `test/support/oracles/`, preserving the
`openSslAvailable`/`differentialEnabled` gating and normalised-semantics
comparisons exactly. Move `test/fuzz/{spec,prng,compare,failure}.ts` under
`test/support/` (or alongside its harness under `integration/fuzz/`), keeping
the deterministic seeded generator and the gitignored failure-fixture dumping
behaviour intact.

- Re-point all `#test/*` imports and alias maps atomically: update
`package.json`'s `imports` field (`#test/helpers`, `#test/fuzz/*`,
`#test/oracles/*`, `#test/pkits/*`) to the new support paths — the gitignored,
generated `deno.import_map.json` will self-update from this field and must not
be hand-edited. Update every consumer's `#test/*` import to the new module
boundaries within the same change. Confirm `tsconfig.other.json`'s recursive
`test/**/*.ts` glob still covers the nested support tree without modification.
===============================================================================

Task: 3

Migrate every normative RFC 5280 assertion out of the scattered
builder/parser/internal/verify/revocation suites and re-home them under their
owning clause modules, organised strictly by clause rather than by
implementation module. Positive and negative evidence for a clause must sit
together.

- Populate the high-value scattered clauses first: move cases into
`4.1-certificate-profile.ts` (§4.1.2.4 issuer DN), `4.2-extensions.ts` (§4.2.1.6
SAN, §4.2.1.9 Basic Constraints, §4.2.1.10 Name Constraints, §4.2.1.13 CRL
Distribution Points), `6.1-path-validation.ts` (§6.1), `6.3-crl-validation.ts`
(§6.3), and the appendix module (A.1 attribute bounds). Source these cases from
`certificate.test.ts`, `csr.test.ts`, `parse.test.ts`, `internals.test.ts`,
`verify.test.ts` (including the `RFC 5280 §4.2.1.10` describe block and its
`it.each`), `crl.test.ts`, `policy.test.ts`, `name-constraints.test.ts`, and the
revocation suites. Name each migrated case after the normative statement it
evidences (MUST / MUST NOT / SHOULD / accepted profile / deliberate hardening),
and keep clause-specific malformed inputs together with their owning clause.

- Convert comment-only citations into clause-owned names: sweep the inline `//
RFC 5280 §…` comments in `verify.test.ts`, `parse.test.ts`, `internals.test.ts`,
and `certificate.test.ts`, and re-home each as a properly named case under its
owning clause module, so that no RFC 5280 normative assertion remains
discoverable only via a comment buried in an unrelated suite.

- Relocate the PKITS harness under conformance: move `pkits.test.ts` to
`test/conformance/pkits/pkits.test.ts`, and relocate/re-alias `manifest.ts`,
`generate-manifest.ts`, and `download.ts` under `test/conformance/pkits/`,
updating the `#test/pkits/*` alias accordingly. Preserve verbatim: the hardcoded
`PKITS_VALIDATION_TIME = 2011-04-15T00:00:00Z`, the auto-generated "do not edit
by hand" manifest banner, the exact vendored cert/CRL filenames, the full case
count, the two DSA `it.failing` cases, and the multi-entry policy sub-variants.
Do not regenerate or otherwise alter the corpus beyond the path/alias updates
required here.
===============================================================================

Task: 4

Give every remaining supported standard its own canonical
`conformance/<standard>.test.ts` front door with an ordered clause map, and
cleanly split mixed-concern and `*-fixtures.test.ts` files between conformance
and behaviour ownership.

- Add OCSP, identity, and policy conformance entrypoints: create
`test/conformance/rfc-6960.test.ts` for RFC 6960 / RFC 5019 OCSP, pulling the
`RFC 6960 §4.2.2.2` responder-authorization block from `ocsp-fixtures.test.ts`
and the `RFC 6960 §3.1`/ResponderID clause cases from
`ocsp.test.ts`/`revocation.test.ts`. Create an RFC 6125 / RFC 9525
service-identity entrypoint, migrating the clause-anchored cases from
`identity.test.ts`/`identity-fixtures.test.ts`. Create
`test/conformance/rfc-9618.test.ts` for policy processing, migrating the
normative policy cases from `policy.test.ts`.

- Add PKCS, PEM, X.690, and string-prep entrypoints: add canonical entrypoints
for the key/PKCS families — PKCS#7/RFC 5652 from `pkcs7-signeddata.test.ts`'s
`§5.2` block, RFC 5915/5958/8410 key-encoding cases from `keys.test.ts`, and
PKCS#8/PKCS#12 from `pfx.test.ts`/`internals.test.ts` — plus RFC 7468 PEM from
`pem.test.ts`'s existing conformance block. Add `test/conformance/x690.test.ts`
for ITU-T X.680/X.690 DER/ASN.1 encoding constraints, and RFC 3454 / RFC 4518
string-prep entrypoints sourced from `rfc3454-tables.test.ts`,
`dn-string-prep.test.ts`, and the RFC 4514 cases in `name-text.test.ts`.

- Resolve `*-fixtures.test.ts` dual-role files: for `identity-fixtures.test.ts`
and `ocsp-fixtures.test.ts`, split their reusable fixture data out into
`support/`/`fixtures/` modules, and re-home their actual `it` cases into the
relevant conformance or behaviour suites, ensuring no single file is
simultaneously a fixture module and a registered test file.
===============================================================================

Task: 5

Break apart the five catch-all monolith suites into domain-owned behaviour, keep
interop/randomised evidence isolated under integration, fully remove
`internals.test.ts`, and consolidate the overlapping barrel smoke suites into
one `contracts/` owner.

- Re-home residual behaviour by domain: after conformance extraction, move
remaining non-normative cases from `verify.test.ts` into `behavior/verify/`;
from `crl.test.ts`, `ocsp.test.ts`, `revocation.test.ts`, and
`chain-revocation.test.ts` into `behavior/revocation/`; from `parse.test.ts`,
`certificate.test.ts`, `csr.test.ts`, and `extensions.test.ts` into
`behavior/x509/`; from `keys.test.ts` into `behavior/keys/`; from
`pkcs7.test.ts` and `pfx.test.ts` into `behavior/pkcs/`; from `pem.test.ts` into
`behavior/pem/`; and generic DER parser hardening (from `malformed-der.test.ts`
and the DER cases in `internals.test.ts`) into `behavior/der/`. Fully remove
`internals.test.ts`, distributing its internal-invariant probes into the
matching `behavior/<domain>/` suites, keeping `#micro509/internal/*` imports
where still needed.

- Isolate integration, lifecycle, differential, and fuzz suites: move
`differential.test.ts` into `integration/differential/`,
`differential-fuzz.test.ts` into `integration/fuzz/`, and cross-module lifecycle
round-trip suites into `integration/lifecycle/`, preserving the OpenSSL
availability gates and the seeded fuzz corpus behaviour exactly as before.

- Consolidate barrel/contract suites under `contracts/`: fold
`root-barrel.test.ts` into `contracts/root-exports.test.ts`; fold the
`*-domain.test.ts`/`utility-domains.test.ts` suites into
`contracts/domain-entrypoints.test.ts`, keeping only the unique barrel-shape and
"internal not re-exported" assertions while dropping happy-path duplication
already owned by behaviour/conformance suites; and relocate
`root-barrel.types.ts` to `contracts/public-types.ts`, keeping it a
compile-only, non-`.test.ts` file.
===============================================================================

Task: 6

Update CI workflows, focused npm/bun scripts, and documentation so they match
the new directory taxonomy, in the same change as the files they reference.

- Update CI and focused commands: update `.github/workflows/test.yml`'s
`differential` job (via the re-pathed `test:differential` script) and any PKITS
reference to the new paths; confirm the main `test`/`test:coverage` job's broad
glob discovery and JUnit `test-results.xml` upload continue to function
unchanged. Add a visible conformance CI step or summary (for example, running
`test:conformance`), and confirm the `stress.yml` randomised workflow still
resolves the relocated root-barrel/contracts suites correctly.

- Update documentation and agent guidance: update the hardcoded test-path links
in `docs/PKIX-SCOPE.md`, `README.md`, and `CONTRIBUTING.md` to point at the new
`conformance/`/`integration/` locations, and ensure every RFC 5280 behaviour
claimed in `docs/PKIX-SCOPE.md` maps to an executable clause block. Rewrite
`test/AGENTS.md`'s structure tree, "where to look" table, and local conventions
to fully describe the new ownership taxonomy
(conformance/behavior/integration/contracts/support/fixtures), the
canonical-front-door rule, and the split support modules.

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!

[coderabbitai]

🔗 Related PRs

#1 - Exports harmonization, standards compliance, docs site [merged]
#2 - docs: trim fat from docs/, delete redundant ARCHITECTURE.md [merged]
#18 - chore: dist-only exports and CI cleanup [merged]
#38 - chore: normalize imports and OID registry [merged]
#39 - refactor: lower cognitive complexity ceiling [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!