implicitTransforms and idAttribute have no tests #573

Summary

Found while chasing a codecov/patch failure on #571. Three separate things in src/signed-xml.ts, worst first. They could reasonably be split into two issues — (1) is a behaviour question, (2) and (3) are test hygiene — but they surfaced together and share a cause, so they are written up together.

1. Two documented constructor options have no test at all

grep -o implicitTransforms test/*.spec.ts returns nothing. idAttribute returns two hits, but both are a local variable of that name in an unrelated assertion, not the option being passed.

So the package documents two options, one of them with its own README section, and has no evidence either of them works. This is the part worth acting on.

2. A test passes on the wrong error

signer appends signature to a non-existing reference node in test/signature-unit-tests.spec.ts reads as coverage for the the following xpath cannot be used because it was not found path. It is not:

• it never sets canonicalizationAlgorithm, so computeSignature throws out of createSignedInfo with Missing canonicalizationAlgorithm when trying to create signed info for XML before the location.reference lookup is reached;
• the only assertion is expect(err).not.to.be.an.instanceof(TypeError), which every Error satisfies.

Coverage confirms the path it names never runs: src/signed-xml.ts:1026-1033 is uncovered on master.

Fix is to set canonicalizationAlgorithm and assert on the message, at which point it covers what it claims.

3. Error contracts are broadly unverified

src/signed-xml.ts has 529 statements, 70 uncovered (13.2%). Of the uncovered, 32 are throw sites:

Two of these are the errors AGENTS.md singles out as deliberate API design — signatureAlgorithm is required and digestAlgorithm is required exist specifically so nobody silently inherits SHA-1 — and neither has a test.

Also uncovered, and not an error path: the string branch of validateElementAgainstReferences (src/signed-xml.ts:500-502). The method is public and accepts Element | string; only the Element form is exercised.

One caveat on the number

17 of the 70 uncovered statements are callback-form branches that #571 removes, so the count drops on its own when that lands. Worth re-measuring after it rather than chasing 13.2% today.

Why this matters here

AGENTS.md already states the standard: "Uncovered code indicates either inadequately tested public behavior or code that may be unnecessary; determine which." For (1) the answer is inadequately tested public behaviour. For (3) these are the messages that tell a caller their configuration is unsafe, in a library where failing closed is the whole point — an error that stops being thrown, or starts saying something else, is a silent change to the contract.

Suggested scope

• (1) is the one with real risk and deserves its own change.
• (2) is a two-line fix.
• (3) is best done after feat!: give asynchronous work its own entry points #571 lands, and probably incrementally rather than as one sweep.

🤖 Generated with Claude Code