}

    @Test
    @DisplayName("toByteArray returns empty when no mechanismToken")
    void toByteArrayWhenNull() {
        TestSpnegoToken t = new TestSpnegoToken();
        assertArrayEquals(new byte[0], t.toByteArray(), "empty array expected when mechanismToken is null");
    }

    @Test
    @DisplayName("toByteArray returns mechanismToken reference when present")

        byte[] checksum = new byte[16];
        for (int i = 0; i < checksum.length; i++) {
            checksum[i] = (byte) i;
        }
        baos.write(checksum);
        byte[] data = baos.toByteArray();

        // Create PacSignature
        PacSignature pacSignature = new PacSignature(data);

        // Verify
        assertEquals(PacSignature.KERB_CHECKSUM_HMAC_MD5, pacSignature.getType());

        innerContent.write(wrongTag.getEncoded());

        byte[] content = innerContent.toByteArray();

        // Create GSS-API wrapper
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        baos.write(0x60); // APPLICATION 0
        baos.write(content.length);
        baos.write(content);

        byte[] token = baos.toByteArray();
        assertThrows(PACDecodingException.class, () -> new KerberosToken(token));
    }

        writeLittleEndianInt(baos, 0); // buffer count = 0
        writeLittleEndianInt(baos, 99); // invalid version
        baos.write(new byte[1]); // Make it > 8 bytes
        byte[] pacData = baos.toByteArray();

        PACDecodingException e = assertThrows(PACDecodingException.class, () -> new Pac(pacData, keys));
        // The error could be about version or missing buffers
        assertNotNull(e.getMessage());
    }

        byte[] mic = new byte[] { 9, 9, 9 };
        NegTokenTarg original = new NegTokenTarg(NegTokenTarg.ACCEPT_COMPLETED, mech, tokenArray, mic);

        // Act – serialise and parse back
        byte[] bytes = original.toByteArray();
        NegTokenTarg roundTrip = new NegTokenTarg(bytes);

        // Assert – all getters match the original values
        assertEquals(NegTokenTarg.ACCEPT_COMPLETED, roundTrip.getResult(), "result should roundtrip");

        if (buf.isEol()) {
            String line = new String(buf.toByteArray(), 0, buf.size() - LINE_SEP.length);
            ProjectBuildLogAppender.updateMdc();
            consumer.accept(line);
            buf.reset();
        }
    }

    public void forceFlush() {
        if (buf.size() > 0) {
            String line = new String(buf.toByteArray(), 0, buf.size());
            ProjectBuildLogAppender.updateMdc();

        dos.writeInt(Integer.reverseBytes(PacConstants.LOGON_INFO));
        dos.writeInt(Integer.reverseBytes(10));
        dos.writeLong(Long.reverseBytes(100));

        byte[] invalidVersionPac = baos.toByteArray();

        PACDecodingException e = assertThrows(PACDecodingException.class, () -> {
            new KerberosPacAuthData(invalidVersionPac, keys);
        });
        assertTrue(e.getMessage().contains("PAC"));

                | NtlmFlags.NTLMSSP_NEGOTIATE_SIGN;
        Type2Message type2Message = new Type2Message(type2Flags, serverChallenge, domain);
        byte[] type2Token = type2Message.toByteArray();

        // State 2: Process Type 2 and generate Type 3
        byte[] type3Token = context.initSecContext(type2Token, 0, type2Token.length);

        assertNotNull(type3Token);

        final Type1Message type1Message = new Type1Message(cifsContext, TYPE_1_FLAGS, domain, workstation);
        return Base64.getEncoder().encodeToString(type1Message.toByteArray());
    }

    /**
     * Generates a Type 3 NTLM message.
     *
     * @param username the username
     * @param password the password
     * @param domain the domain

    return Signature.getInstance(tbsCertificate.signatureAlgorithmName).run {
      initVerify(issuer)
      update(signedData.toByteArray())
      verify(signatureValue.byteString.toByteArray())
    }
  }

  fun toX509Certificate(): X509Certificate {
    val data = CertificateAdapters.certificate.toDer(this)
    try {