test: tighten secure token and system mark coverage

src/infra/secure-random.test.ts

@@ -40,4 +40,13 @@ describe("secure-random", () => {
     expect(cryptoMocks.randomBytes).toHaveBeenCalledWith(18);
     expect(token18).toBe(Buffer.alloc(18, 0xab).toString("base64url"));
   });
+
+  it("supports zero-byte tokens without rewriting the requested size", () => {
+    cryptoMocks.randomBytes.mockClear();
+
+    const token = generateSecureToken(0);
+
+    expect(cryptoMocks.randomBytes).toHaveBeenCalledWith(0);
+    expect(token).toBe("");
+  });
 });

src/infra/system-message.test.ts

@@ -13,6 +13,7 @@ describe("system-message", () => {
   it.each([
     { input: `${SYSTEM_MARK} already prefixed`, expected: true },
     { input: `  ${SYSTEM_MARK} hello`, expected: true },
+    { input: SYSTEM_MARK, expected: true },
     { input: "", expected: false },
     { input: "hello", expected: false },
   ])("detects marks for %j", ({ input, expected }) => {
@@ -24,4 +25,8 @@ describe("system-message", () => {
       `${SYSTEM_MARK} already prefixed`,
     );
   });
+
+  it("preserves mark-only messages after trimming", () => {
+    expect(prefixSystemMessage(`  ${SYSTEM_MARK}  `)).toBe(SYSTEM_MARK);
+  });
 });