Add 3 integration tests under a new 'Asset Scan Status' describe block
in asset-test.js:

- Single fetch with include_asset_scan_status=true: validates the
  _asset_scan_status field (pending|clean|quarantined|not_scanned) when
  present; skips assertion when feature is not enabled for the stack.
- List query with include_asset_scan_status=true: same opt-in validation
  on the first item returned.
- Fetch without param: asserts _asset_scan_status is absent from response.

Reuses the image asset uploaded by the Asset Upload block via
testData.assets.image.uid to avoid extra uploads. Falls back to creating
a fresh asset only if the upload block did not run.

Related branch: feat/DX-8752-asset-scan

…org)

Add assetScanStatus-test.js (Phase 6.5) covering 12 test cases on the
non-AM org stack and 7 test cases on the AM/DAM org stack:

Non-AM Org (ORGANIZATION, scan enabled):
1. Freshly uploaded asset returns _asset_scan_status (pending/clean)
2. Status value is a valid enum (pending|clean|quarantined|not_scanned)
3. Status ABSENT from single fetch when param is omitted
4. ALL file items in list carry status when param is passed
5. NO list items carry status when param is omitted
6. Status consistent between single-fetch and list-query for same asset
7. Status present when combined with version=1 param
8. Status present when combined with locale=en-us param
9. Status resets to pending after asset file is replaced
10. Folder entries do NOT get _asset_scan_status
11. Status present across multiple pages of paginated list
12. Status absent when include_asset_scan_status=false

AM Org (AM_API_KEY required, DAM + scan enabled):
AM-1..7: same coverage for DAM asset upload pipeline

Also:
- Registers the suite in sanity.js as Phase 6.5 (after asset-test.js)
- Adds AM_API_KEY placeholder to .env with setup instructions
- Updates .talismanrc for false-positive secret scan patterns

Based on 'Asset Scanning Support – SDK Design Document'.

New test sections added to assetScanStatus-test.js:

§ 3.2 Upload with param:
  - Upload response includes _asset_scan_status=pending when param passed
  - Upload response does NOT include status without param

§ 3.3 Download error handling:
  - SDK must surface asset_scan_pending/quarantined error codes (not swallow)
  - Download 422 errors must expose status + message to callers

§ 3.4 Publish is always async:
  - Publish returns success notice regardless of asset scan status
  - SDK must never throw asset_scan_quarantined synchronously on publish

§ 3.6 Legacy asset null handling:
  - null is a valid _asset_scan_status for pre-scan legacy assets
  - SDK must not convert null to undefined or crash on null status
  - Updated all list-query assertions to accept null per spec

§ 4.2 api_version header isolation:
  - After bulkOperation.publish({ api_version: '3.2' }), subsequent
    asset and content-type fetches must NOT carry api_version header
  - Regression guard against global header pollution

…message

chai's have.property(name, val) treats val as expected value, not error message.
This caused test 11 (pagination) to fail because chai checked
_asset_scan_status === 'Page item blt... is missing...' instead of just
verifying the property exists.

All 7 affected assertions fixed:
- 5x .not.have.property(name, msg) → .not.have.property(name)
  (false-pass bug: would pass even if property existed with any value)
- 1x .have.property(name, msg) → expect(obj, msg).to.have.property(name)
  (was the direct failure in pagination test)
- 1x api_version header check in §4.2

Verified locally: 23 passing, 0 failing, 9 pending (publish/AM skips expected)

… AM_API_KEY

The AM Org test suite now follows the same pattern as the main sanity suite:
- Uses the existing authtoken from testSetup.testContext (already logged in)
- Creates a fresh stack inside AM_ORG_UID via POST /v3/stacks at test start
- Runs all 7 AM org asset scan tests against the dynamic stack
- Deletes the AM stack in the after() hook

No static AM_API_KEY needed in .env — removed from environment config.
Fallback: skip the AM suite gracefully if AM_ORG_UID is not set.

Verified locally: 30 passing, 2 pending (publish tests — expected, fresh stack has
no environments; these will run in the full suite)

…ICAR

Ports the pattern from the Python CMA SDK tests (test_06_asset.py,
test_31_am_assets.py) to JavaScript.

New helpers:
  - EICAR_BASE64: standard 68-byte EICAR signature stored base64-encoded
    so source file is never flagged by Talisman / repo antivirus scanners
  - createEicarFile(): decodes to a temp file at runtime, deleted in after()
  - waitForScan(stack, uid, expected, timeout=60s): polls
    fetch({include_asset_scan_status:true}) every 3s until status matches
    or times out; treats not_scanned as terminal (feature disabled on stack)

New describe: 'Asset Scan Status – Scan Lifecycle (clean + quarantined)'
  - clean image → polls until 'clean'
  - EICAR file → polls until 'quarantined'
  - quarantined download → verifies SDK surfaces 403/422 with scan error code
    (§ 3.3 re-tested with a REAL quarantined asset, not a fake URL)

AM org additions (AM-8, AM-9):
  - [AM] clean image transitions pending → clean
  - [AM] EICAR file reaches quarantined status

Also adds: import fs from 'fs' and import os from 'os'

Verified locally: 37 passing, 0 pending, 0 failing

… stability

…t.js

DX | 06-07-2026 | Release

…anrc, comment