feat(ql3): establish 3.0 incubation baseline

packages/ql3-worker-runtime/test/enrollment.test.cjs

@@ -0,0 +1,55 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const { createPublicKey } = require('node:crypto');
+const test = require('node:test');
+
+require('reflect-metadata');
+const { Pkcs10CertificateRequest } = require('@peculiar/x509');
+const {
+  generateWorkerCertificateEnrollment,
+} = require('../dist/credential/workerCertificateEnrollment');
+
+test('generates a verifiable P-256 CSR and disposable PKCS#8 key', async () => {
+  const enrollment = await generateWorkerCertificateEnrollment({
+    workerId: 'worker.edge-01',
+  });
+
+  try {
+    assert.equal(enrollment.algorithm, 'ECDSA_P256_SHA256');
+    assert.equal(enrollment.workerId, 'worker.edge-01');
+    assert.match(
+      enrollment.certificateSigningRequestPem,
+      /BEGIN CERTIFICATE REQUEST/,
+    );
+    assert.equal(enrollment.publicKeySpkiSha256.length, 64);
+    assert.equal(
+      createPublicKey(enrollment.privateKeyPem).asymmetricKeyType,
+      'ec',
+    );
+
+    const request = new Pkcs10CertificateRequest(
+      enrollment.certificateSigningRequestPem,
+    );
+    assert.equal(await request.verify(), true);
+    assert.equal(request.subject, 'CN=worker.edge-01');
+  } finally {
+    enrollment.dispose();
+  }
+
+  assert.equal(
+    enrollment.privateKeyPem.every((byte) => byte === 0),
+    true,
+  );
+});
+
+test('rejects unbounded or unsafe worker identifiers', async () => {
+  await assert.rejects(
+    generateWorkerCertificateEnrollment({ workerId: '../worker' }),
+    /workerId is invalid/,
+  );
+  await assert.rejects(
+    generateWorkerCertificateEnrollment({ workerId: 'x'.repeat(129) }),
+    /workerId is invalid/,
+  );
+});