func (cred Credentials) IsImpliedPolicy() bool {
	if cred.IsServiceAccount() {
		return cred.Claims[iamPolicyClaimNameSA] == "inherited-policy"
	}
	return false
}

// IsValid - returns whether credential is valid or not.
func (cred Credentials) IsValid() bool {
	// Verify credentials if its enabled or not set.
	if cred.Status == AccountOff {
		return false
	}

// []byte -> ([]byte, error) requests.
// subroutes are joined with "/" to a single subroute.
func (m *Manager) RegisterSingleHandler(id HandlerID, h SingleHandlerFn, subroute ...string) error {
	if !id.valid() {
		return ErrUnknownHandler
	}
	s := strings.Join(subroute, "/")
	if debugPrint {
		fmt.Println("RegisterSingleHandler: ", id.String(), "subroute:", s)
	}

	if len(subroute) == 0 {

    class EdgeCasesTests {

        @Test
        @DisplayName("Should handle malformed buffer gracefully")
        void testReadDataWireFormatMalformedBuffer() {
            byte[] buffer = new byte[3]; // Too small for valid DFS referral

            assertThrows(ArrayIndexOutOfBoundsException.class, () -> {
                response.readDataWireFormat(buffer, 0, buffer.length);
            });
        }

        @Test

    private String lastmod;

    /**
     * How frequently the page is likely to change. This value provides general
     * information to search engines and may not correlate exactly to how often
     * they crawl the page. Valid values are:
     * <ul>
     * <li>always</li>
     * <li>hourly</li>
     * <li>daily</li>
     * <li>weekly</li>
     * <li>monthly</li>
     * <li>yearly</li>
     * <li>never</li>
     * </ul>

        // Initially not open (isStale returns false when handle is null, not true)
        assertFalse(target.isOpen());
        assertFalse(target.isStale());

        // After ensureOpen, handle valid -> open
        SmbFileHandleImpl fh = target.ensureOpen();
        assertSame(fileHandle, fh);
        assertTrue(target.isOpen());
        assertFalse(target.isStale());

        verify(tree, atLeastOnce()).send(any(CommonServerMessageBlockRequest.class), any(), any(), any());
    }

    // close() should close underlying handle with 0L when valid
    @Test
    @DisplayName("close() closes underlying handle when valid")
    void close_validHandle_invokesClose() throws Exception {
        when(handle.isValid()).thenReturn(true);
        SmbWatchHandleImpl sut = new SmbWatchHandleImpl(handle, 0, false);

        assertEquals(len, result, "readDataWireFormat should return the length when pipeIn is null.");
    }

    /**
     * Tests the readDataWireFormat method when the pipe has a valid input stream.
     */
    @Test
    void testReadDataWireFormat_withPipeIn() {
        // Setup the mock pipe and its input stream
        mockPipe.pipeIn = mockPipeIn;

            assertNull(nc.dc);
        }
    }

    @Nested
    @DisplayName("toString() Tests")
    class ToStringTests {

        @Test
        @DisplayName("toString with valid data produces expected format")
        void testToStringWithValidData() {
            byte[] challenge = new byte[] { (byte) 0x01, (byte) 0x02, (byte) 0x03, (byte) 0xFF };
            UniAddress dc = mock(UniAddress.class);

            assertEquals(e.getValue(), f.get(null), e.getKey() + " value mismatch");
        }
    }

    @Test
    @DisplayName("OID values have valid dotted numeric format")
    void oidFormat() {
        assertAll(() -> assertTrue(OID_PATTERN.matcher(SpnegoConstants.SPNEGO_MECHANISM).matches(), "Invalid OID: SPNEGO_MECHANISM"),

  },
  {
    "input": "xn--ls8h=",
    "output": null
  },
  {
    "comment": "Invalid Punycode (contains non-ASCII character)",
    "input": "xn--tešla",
    "output": null
  },
  {
    "comment": "Valid Punycode",
    "input": "xn--zca.xn--zca",
    "output": "xn--zca.xn--zca"
  },
  {
    "comment": "Mixed",
    "input": "xn--zca.ß",
    "output": "xn--zca.xn--zca"
  },
  {
    "input": "ab--c.xn--zca",