源码对照：4.2.7.2.1
ES8+ 加载 Profile 元素 / TC_eUICC_ES8+.LoadProfileElements
左侧为人工切片入口（-man，来自 原料/切片 的最小可执行脚本），右侧为 Cas 盲生成入口（-cas，仅依据规范生成）。文件按原始编码（多为 GBK）解码为 UTF-8 显示，行号自 1 起；字节级原文与 sha256 见两侧脚本包。完整 unified diff 见本页底部折叠区，以及 报告原文 §4。
-man 入口
Import/TestCase_SGP_23.js
766 行 / 34818 字符 / gb18030
-cas 入口
TC_eUICC_ES8_LoadProfileElements/Import/TC_eUICC_ES8_LoadProfileElements.js
1145 行 / 90821 字符 / gb18030
默认折行显示长行；取消勾选可横向滚动查看原始行宽
-man 人工切片Import/TestCase_SGP_23.js766 行 / 34818 字符 / gb18030入口函数 @L3
1// slice of Import\TestCase_SGP_23.js - cases: TC_eUICC_ES8_LoadProfileElements_01_Error_EFICCID_different_from_the_ICCID_provided_in_the_Profile_Metadata_Initial_Conditions + TC_eUICC_ES8_LoadProfileElements_02_Error_MCCMNC_of_EFIMSI_different_from_MCCMNC_of_Profile_Owner_present_in_Metadata + TC_eUICC_ES8_LoadProfileElements_03_Error_Session_MAC_chaining_used_instead_of_new_Initial_MAC_chaining + TC_eUICC_ES8_LoadProfileElements_04_Error_SMAC_used_instead_of_PPKMAC + TC_eUICC_ES8_LoadProfileElements_05_Error_SENC_used_instead_of_PPKENC + TC_eUICC_ES8_LoadProfileElements_06_Error_Profile_Downloading_stopped_by_a_Reset + TC_eUICC_ES8_LoadProfileElements_07_Nominal_ICCID_in_the_ProfileHeader_PE_is_ignored_by_the_eUICC + TC_eUICC_ES8_LoadProfileElements_08_Nominal_With_gid1_and_gid2_set + TC_eUICC_ES8_LoadProfileElements_09_Error_gid1_and_gid2_provided_in_the_Profile_Metadata_but_not_in_the_Profile_Package + TC_eUICC_ES8_LoadProfileElements_10_Error_gid1_and_gid2_not_provided_in_the_Profile_Metadata_but_present_in_the_Profile_Package (extracted verbatim)
2
3function TC_eUICC_ES8_LoadProfileElements_01_Error_EFICCID_different_from_the_ICCID_provided_in_the_Profile_Metadata_Initial_Conditions()
4{
5 tracenamestr = "测试目的：执行LoadProfileElements，EFICCID与Profile元数据中提供的ICCID不同";
6 curDis.TraceStart(sno++,tracenamestr);
7
8 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
9 Ini_powerOn_eUICC_LPAe_not_activate();
10
11 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
12 TS_MANAGE_CHANNEL_OPEN();
13
14 curLogicChannel = 1;
15
16 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
17 TS_SELECT("Select ISD",ISD_R_AID,"9000");
18
19 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
20 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
21 Profile_load_procedure.ICCID = ICCID_OP_PROF2;//
22 Profile_load_procedure.ES10b_GetEUICCInfo1();
23
24
25 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
26 Profile_load_procedure.ES10b_GetEUICCChallenge();
27
28 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
29 Profile_load_procedure.ES10b_AuthenticateServer();
30
31 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
32 Profile_load_procedure.ES10b_PrepareDownload();
33
34 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
35 Profile_load_procedure.ES10b_GetEID();
36
37 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，EFICCID与配置文件元数据中提供的ICCID不一致；");
38 Profile_load_procedure.serviceProviderName = SP_NAME1;
39 Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
40 Profile_load_procedure.iconType = "01";
41 Profile_load_procedure.icon = ICON_OP_PROF1;
42 Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
43 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
44 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
45 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
46 Profile_load_procedure.profileClass = "02";
47 Profile_load_procedure.profilePolicyRules = "0640";
48 Profile_load_procedure.mccMnc = MCC_MNC1;
49
50 Profile_load_procedure.simaResponse = "";
51 Profile_load_procedure.isErrorTest = true;
52 Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
53 Profile_load_procedure.errorReason = ErrorReason.installFailedDueToDataMismatch;
54
55 Profile_load_procedure.ES10b_LoadBoundProfilePackage();
56
57
58 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile1状态；");
59 var proInfoListRequest = new ProfileInfoListRequest();
60 proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
61 proInfoListRequest.tagList = "5A4F9F70";
62 proInfoListRequest.GenHexData();
63 var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
64
65 var proInfoListResponse = new ProfileInfoListResponse();
66 proInfoListResponse.checkCardResDataFormat(respData);
67
68 try
69 {
70 curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
71 }catch(e){
72 obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
73 }
74
75 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile2状态；");
76 var proInfoListRequest = new ProfileInfoListRequest();
77 proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF2);
78 proInfoListRequest.tagList = "5A4F9F70";
79 proInfoListRequest.GenHexData();
80 var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
81
82 var proInfoListResponse = new ProfileInfoListResponse();
83 proInfoListResponse.checkCardResDataFormat(respData);
84
85 try
86 {
87 curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
88 }catch(e){
89 obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
90 }
91
92 RecoverCard();
93}
94
95function TC_eUICC_ES8_LoadProfileElements_02_Error_MCCMNC_of_EFIMSI_different_from_MCCMNC_of_Profile_Owner_present_in_Metadata ()
96{
97 tracenamestr = "测试目的：执行LoadProfileElements，EFIMSI中的MCC/MNC与元数据中存在的Profile Owner的MCC/MNC不同";
98 curDis.TraceStart(sno++,tracenamestr);
99
100 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
101 Ini_powerOn_eUICC_LPAe_not_activate();
102
103 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
104 TS_MANAGE_CHANNEL_OPEN();
105
106 curLogicChannel = 1;
107
108 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
109 TS_SELECT("Select ISD",ISD_R_AID,"9000");
110
111 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
112 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
113 Profile_load_procedure.ICCID = ICCID_OP_PROF1;//
114 Profile_load_procedure.ES10b_GetEUICCInfo1();
115
116
117 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
118 Profile_load_procedure.ES10b_GetEUICCChallenge();
119
120 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
121 Profile_load_procedure.ES10b_AuthenticateServer();
122
123 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
124 Profile_load_procedure.ES10b_PrepareDownload();
125
126 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
127 Profile_load_procedure.ES10b_GetEID();
128
129 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，EFIMSI里的MCC/MNC与元数据中Profile Owner的MCC/MNC不一致；");
130 Profile_load_procedure.serviceProviderName = SP_NAME1;
131 Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
132 Profile_load_procedure.iconType = "01";
133 Profile_load_procedure.icon = ICON_OP_PROF1;
134 Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
135 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
136 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
137 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
138 Profile_load_procedure.profileClass = "02";
139 Profile_load_procedure.profilePolicyRules = "0640";
140 Profile_load_procedure.mccMnc = MCC_MNC2;
141
142 Profile_load_procedure.simaResponse = "";
143 Profile_load_procedure.isErrorTest = true;
144 Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
145 Profile_load_procedure.errorReason = ErrorReason.installFailedDueToDataMismatch;
146
147 Profile_load_procedure.ES10b_LoadBoundProfilePackage();
148
149
150 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile1状态；");
151 var proInfoListRequest = new ProfileInfoListRequest();
152 proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
153 proInfoListRequest.tagList = "5A4F9F70";
154 proInfoListRequest.GenHexData();
155 var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
156
157 var proInfoListResponse = new ProfileInfoListResponse();
158 proInfoListResponse.checkCardResDataFormat(respData);
159
160 try
161 {
162 curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
163 }catch(e){
164 obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
165 }
166
167 RecoverCard();
168}
169
170function TC_eUICC_ES8_LoadProfileElements_03_Error_Session_MAC_chaining_used_instead_of_new_Initial_MAC_chaining()
171{
172 tracenamestr = "测试目的：执行LoadProfileElements，使用会话MAC链代替新的初始MAC链";
173 curDis.TraceStart(sno++,tracenamestr);
174
175 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
176 Ini_powerOn_eUICC_LPAe_not_activate();
177
178 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
179 TS_MANAGE_CHANNEL_OPEN();
180
181 curLogicChannel = 1;
182
183 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
184 TS_SELECT("Select ISD",ISD_R_AID,"9000");
185
186 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
187 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
188 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
189 Profile_load_procedure.ES10b_GetEUICCInfo1();
190
191
192 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
193 Profile_load_procedure.ES10b_GetEUICCChallenge();
194
195 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
196 Profile_load_procedure.ES10b_AuthenticateServer();
197
198 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
199 Profile_load_procedure.ES10b_PrepareDownload();
200
201 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
202 Profile_load_procedure.ES10b_GetEID();
203
204 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，ReplaceSessionKeysRequest用会话MAC值替换新的初始化MAC值；");
205 Profile_load_procedure.serviceProviderName = SP_NAME1;
206 Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
207 Profile_load_procedure.iconType = "01";
208 Profile_load_procedure.icon = ICON_OP_PROF1;
209 Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
210 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
211 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
212 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
213 Profile_load_procedure.profileClass = "02";
214 Profile_load_procedure.profilePolicyRules = "0640";
215 Profile_load_procedure.mccMnc = MCC_MNC1;
216
217 Profile_load_procedure.UsePPK = true;
218 Profile_load_procedure.ErrorDataMac = true;
219
220 Profile_load_procedure.simaResponse = "";
221 Profile_load_procedure.isErrorTest = true;
222 Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
223 Profile_load_procedure.errorReason = ErrorReason.scp03tSecurityError + "/" + ErrorReason.incorrectInputValues + "/" + ErrorReason.scp03tStructureError;
224 Profile_load_procedure.ES10b_LoadBoundProfilePackage();
225
226
227
228 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile状态；");
229 var proInfoListRequest = new ProfileInfoListRequest();
230 proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
231 proInfoListRequest.tagList = "5A4F9F70";
232 proInfoListRequest.GenHexData();
233 var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
234
235 var proInfoListResponse = new ProfileInfoListResponse();
236 proInfoListResponse.checkCardResDataFormat(respData);
237
238 try
239 {
240 curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
241 }catch(e){
242 obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
243 }
244
245 RecoverCard();
246}
247
248function TC_eUICC_ES8_LoadProfileElements_04_Error_SMAC_used_instead_of_PPKMAC()
249{
250 tracenamestr = "测试目的：执行LoadProfileElements，使用S-MAC代替PPK-MAC";
251 curDis.TraceStart(sno++,tracenamestr);
252
253 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
254 Ini_powerOn_eUICC_LPAe_not_activate();
255
256 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
257 TS_MANAGE_CHANNEL_OPEN();
258
259 curLogicChannel = 1;
260
261 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
262 TS_SELECT("Select ISD",ISD_R_AID,"9000");
263
264 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
265 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
266 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
267 Profile_load_procedure.ES10b_GetEUICCInfo1();
268
269
270 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
271 Profile_load_procedure.ES10b_GetEUICCChallenge();
272
273 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
274 Profile_load_procedure.ES10b_AuthenticateServer();
275
276 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
277 Profile_load_procedure.ES10b_PrepareDownload();
278
279 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
280 Profile_load_procedure.ES10b_GetEID();
281
282 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，ReplaceSessionKeysRequest用S-MAC替换值PPK-MAC; ");
283 Profile_load_procedure.serviceProviderName = SP_NAME1;
284 Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
285 Profile_load_procedure.iconType = "01";
286 Profile_load_procedure.icon = ICON_OP_PROF1;
287 Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
288 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
289 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
290 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
291 Profile_load_procedure.profileClass = "02";
292 Profile_load_procedure.profilePolicyRules = "0640";
293 Profile_load_procedure.mccMnc = MCC_MNC1;
294
295 Profile_load_procedure.UsePPK = true;
296 Profile_load_procedure.ErrorSessionMAC = true;
297
298 Profile_load_procedure.simaResponse = "";
299 Profile_load_procedure.isErrorTest = true;
300 Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
301 Profile_load_procedure.errorReason = ErrorReason.scp03tSecurityError + "/" + ErrorReason.incorrectInputValues + "/" + ErrorReason.scp03tStructureError;
302 Profile_load_procedure.ES10b_LoadBoundProfilePackage();
303
304
305
306 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile状态；");
307 var proInfoListRequest = new ProfileInfoListRequest();
308 proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
309 proInfoListRequest.tagList = "5A4F9F70";
310 proInfoListRequest.GenHexData();
311 var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
312
313 var proInfoListResponse = new ProfileInfoListResponse();
314 proInfoListResponse.checkCardResDataFormat(respData);
315
316 try
317 {
318 curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
319 }catch(e){
320 obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
321 }
322
323 RecoverCard();
324}
325
326function TC_eUICC_ES8_LoadProfileElements_05_Error_SENC_used_instead_of_PPKENC()
327{
328 tracenamestr = "测试目的：执行LoadProfileElements，使用S-ENC代替PPK-ENC";
329 curDis.TraceStart(sno++,tracenamestr);
330
331 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
332 Ini_powerOn_eUICC_LPAe_not_activate();
333
334 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
335 TS_MANAGE_CHANNEL_OPEN();
336
337 curLogicChannel = 1;
338
339 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
340 TS_SELECT("Select ISD",ISD_R_AID,"9000");
341
342 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
343 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
344 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
345 Profile_load_procedure.ES10b_GetEUICCInfo1();
346
347
348 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
349 Profile_load_procedure.ES10b_GetEUICCChallenge();
350
351 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
352 Profile_load_procedure.ES10b_AuthenticateServer();
353
354 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
355 Profile_load_procedure.ES10b_PrepareDownload();
356
357 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
358 Profile_load_procedure.ES10b_GetEID();
359
360 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，ReplaceSessionKeysRequest用S-ENC替换PPK-ENC值; ; ");
361 Profile_load_procedure.serviceProviderName = SP_NAME1;
362 Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
363 Profile_load_procedure.iconType = "01";
364 Profile_load_procedure.icon = ICON_OP_PROF1;
365 Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
366 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
367 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
368 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
369 Profile_load_procedure.profileClass = "02";
370 Profile_load_procedure.profilePolicyRules = "0640";
371 Profile_load_procedure.mccMnc = MCC_MNC1;
372
373 Profile_load_procedure.UsePPK = true;
374 Profile_load_procedure.ErrorSessionENC = true;
375
376 Profile_load_procedure.simaResponse = "";
377 Profile_load_procedure.isErrorTest = true;
378 Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
379 Profile_load_procedure.errorReason = ErrorReason.scp03tSecurityError + "/" + ErrorReason.incorrectInputValues + "/" + ErrorReason.scp03tStructureError;
380 Profile_load_procedure.ES10b_LoadBoundProfilePackage();
381
382
383
384 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile状态；");
385 var proInfoListRequest = new ProfileInfoListRequest();
386 proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
387 proInfoListRequest.tagList = "5A4F9F70";
388 proInfoListRequest.GenHexData();
389 var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
390
391 var proInfoListResponse = new ProfileInfoListResponse();
392 proInfoListResponse.checkCardResDataFormat(respData);
393
394 try
395 {
396 curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
397 }catch(e){
398 obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
399 }
400
401 RecoverCard();
402}
403
404function TC_eUICC_ES8_LoadProfileElements_06_Error_Profile_Downloading_stopped_by_a_Reset()
405{
406 tracenamestr = "测试目的：执行LoadProfileElements，Profile下载因复位而停止";
407 curDis.TraceStart(sno++,tracenamestr);
408
409 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
410 Ini_powerOn_eUICC_LPAe_not_activate();
411
412 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
413 TS_MANAGE_CHANNEL_OPEN();
414
415 curLogicChannel = 1;
416
417 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
418 TS_SELECT("Select ISD",ISD_R_AID,"9000");
419
420 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
421 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
422 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
423 Profile_load_procedure.ES10b_GetEUICCInfo1();
424
425
426 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
427 Profile_load_procedure.ES10b_GetEUICCChallenge();
428
429 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
430 Profile_load_procedure.ES10b_AuthenticateServer();
431
432 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
433 Profile_load_procedure.ES10b_PrepareDownload();
434
435 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
436 Profile_load_procedure.ES10b_GetEID();
437
438 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，Profile下载过程中被卡复位中断/终止; ");
439 Profile_load_procedure.serviceProviderName = SP_NAME1;
440 Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
441 Profile_load_procedure.iconType = "01";
442 Profile_load_procedure.icon = ICON_OP_PROF1;
443 Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
444 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
445 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
446 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
447 Profile_load_procedure.profileClass = "02";
448 Profile_load_procedure.profilePolicyRules = "0640";
449 Profile_load_procedure.mccMnc = MCC_MNC1;
450 Profile_load_procedure.LoadRemainder=1;
451 Profile_load_procedure.ES10b_LoadBoundProfilePackage();
452
453
454 curLogicChannel = 0;
455 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
456 Ini_powerOn_eUICC_LPAe_not_activate();
457
458 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
459 TS_MANAGE_CHANNEL_OPEN();
460
461 curLogicChannel = 1;
462
463 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
464 TS_SELECT("Select ISD",ISD_R_AID,"9000");
465
466
467 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile状态；");
468 var proInfoListRequest = new ProfileInfoListRequest();
469 proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
470 proInfoListRequest.tagList = "5A4F9F70";
471 proInfoListRequest.GenHexData();
472 var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
473
474 var proInfoListResponse = new ProfileInfoListResponse();
475 proInfoListResponse.checkCardResDataFormat(respData);
476
477 try
478 {
479 curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
480 }catch(e){
481 obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
482 }
483
484 RecoverCard();
485}
486
487function TC_eUICC_ES8_LoadProfileElements_07_Nominal_ICCID_in_the_ProfileHeader_PE_is_ignored_by_the_eUICC()
488{
489 tracenamestr = "测试目的：eUICC忽略‘ProfileHeader’ PE中的ICCID";
490 curDis.TraceStart(sno++,tracenamestr);
491
492 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
493 Ini_powerOn_eUICC_LPAe_not_activate();
494
495 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
496 TS_MANAGE_CHANNEL_OPEN();
497
498 curLogicChannel = 1;
499
500 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
501 TS_SELECT("Select ISD",ISD_R_AID,"9000");
502
503 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
504 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL_DATA_TEST_ProfileHeader_PE_ICCID);
505 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
506 Profile_load_procedure.ES10b_GetEUICCInfo1();
507
508 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
509 Profile_load_procedure.ES10b_GetEUICCChallenge();
510
511 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
512 Profile_load_procedure.ES10b_AuthenticateServer();
513
514 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
515 Profile_load_procedure.ES10b_PrepareDownload();
516
517 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
518 Profile_load_procedure.ES10b_GetEID();
519
520 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage");
521 Profile_load_procedure.serviceProviderName = SP_NAME1;
522 Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
523 Profile_load_procedure.iconType = "01";
524 Profile_load_procedure.icon = ICON_OP_PROF1;
525 Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
526 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
527 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
528 Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
529 Profile_load_procedure.profileOwner = OWNER_OP_PROF1;
530 Profile_load_procedure.profileClass = "02";
531 Profile_load_procedure.mccMnc = MCC_MNC1;
532 Profile_load_procedure.ES10b_LoadBoundProfilePackage();
533
534
535 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile信息；");
536 var proInfoListRequest = new ProfileInfoListRequest();
537 proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
538 proInfoListRequest.tagList = "5A4F9F70";
539 proInfoListRequest.GenHexData();
540 var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
541
542 var proInfoListResponse = new ProfileInfoListResponse();
543 proInfoListResponse.checkCardResDataFormat(respData);
544
545 try
546 {
547 curStrHandle.CheckData(ICCID_OP_PROF1, proInfoListResponse.profileInfoListOk.arrOfElement[0].iccid, "ICCID");
548 curStrHandle.CheckData(curProfile_ISD_P_AID, proInfoListResponse.profileInfoListOk.arrOfElement[0].isdpAid, "ISD-P AID");
549 curStrHandle.CheckData(Profile_DISABLED, proInfoListResponse.profileInfoListOk.arrOfElement[0].profileState, "profile State");
550 }catch(e){
551 obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
552 }
553
554
555 RecoverCard();
556}
557
558function TC_eUICC_ES8_LoadProfileElements_08_Nominal_With_gid1_and_gid2_set()
559{
560 tracenamestr = "测试目的：验证设置了gid1和gid2的Operational Profile可以下载到eUICC";
561 curDis.TraceStart(sno++,tracenamestr);
562
563 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
564 Ini_powerOn_eUICC_LPAe_not_activate();
565
566 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
567 TS_MANAGE_CHANNEL_OPEN();
568
569 curLogicChannel = 1;
570
571 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
572 TS_SELECT("Select ISD",ISD_R_AID,"9000");
573
574 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
575 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL9_DATA);
576 Profile_load_procedure.ICCID = ICCID_OP_PROF9;
577 Profile_load_procedure.ES10b_GetEUICCInfo1();
578
579 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
580 Profile_load_procedure.ES10b_GetEUICCChallenge();
581
582 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
583 Profile_load_procedure.ES10b_AuthenticateServer();
584
585 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
586 Profile_load_procedure.ES10b_PrepareDownload();
587
588 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
589 Profile_load_procedure.ES10b_GetEID();
590
591 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，配置了gid1 和 gid2；");
592 Profile_load_procedure.serviceProviderName = SP_NAME9;
593 Profile_load_procedure.profileName = NAME_OP_PROF9;
594 Profile_load_procedure.profilePolicyRules = "0520";
595 Profile_load_procedure.mccMnc = MCC_MNC9;
596 Profile_load_procedure.UseGid = true;
597 Profile_load_procedure.gid1 = GID1;
598 Profile_load_procedure.gid2 = GID2;
599 Profile_load_procedure.ES10b_LoadBoundProfilePackage();
600
601
602 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile信息；");
603 var proInfoListRequest = new ProfileInfoListRequest();
604 proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF9);
605 proInfoListRequest.tagList = "B7";
606 proInfoListRequest.GenHexData();
607 var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
608
609 var proInfoListResponse = new ProfileInfoListResponse();
610 proInfoListResponse.checkCardResDataFormat(respData);
611
612 try
613 {
614 curStrHandle.CheckData(MCC_MNC9, proInfoListResponse.profileInfoListOk.arrOfElement[0].profileOwner.mccMnc, "mccMnc");
615 curStrHandle.CheckData(GID1, proInfoListResponse.profileInfoListOk.arrOfElement[0].profileOwner.gid1, "gid1");
616 curStrHandle.CheckData(GID2, proInfoListResponse.profileInfoListOk.arrOfElement[0].profileOwner.gid2, "gid2");
617 }catch(e){
618 obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
619 }
620
621
622 RecoverCard();
623}
624
625function TC_eUICC_ES8_LoadProfileElements_09_Error_gid1_and_gid2_provided_in_the_Profile_Metadata_but_not_in_the_Profile_Package ()
626{
627 tracenamestr = "测试目的：验证如果Profile元数据中提供了gid1和gid2，但ef-gid1和ef-gid2不存在，ef-ust中的相关服务（17和18）不可用，eUICC会在LoadProfileElements过程中返回错误";
628 curDis.TraceStart(sno++,tracenamestr);
629
630 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
631 Ini_powerOn_eUICC_LPAe_not_activate();
632
633 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
634 TS_MANAGE_CHANNEL_OPEN();
635
636 curLogicChannel = 1;
637
638 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
639 TS_SELECT("Select ISD",ISD_R_AID,"9000");
640
641 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
642 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
643 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
644 Profile_load_procedure.ES10b_GetEUICCInfo1();
645
646 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
647 Profile_load_procedure.ES10b_GetEUICCChallenge();
648
649 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
650 Profile_load_procedure.ES10b_AuthenticateServer();
651
652 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
653 Profile_load_procedure.ES10b_PrepareDownload();
654
655 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
656 Profile_load_procedure.ES10b_GetEID();
657
658 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，GID1和GID2出现在Profile Metadata（元数据）里，但在Profile Package（BPP）里却没有;");
659 Profile_load_procedure.serviceProviderName = SP_NAME1;
660 Profile_load_procedure.profileName = NAME_OP_PROF1;
661 Profile_load_procedure.profilePolicyRules = "0520";
662 Profile_load_procedure.mccMnc = MCC_MNC1;
663 Profile_load_procedure.UseGid = true;
664 Profile_load_procedure.gid1 = GID1;
665 Profile_load_procedure.gid2 = GID2;
666
667 Profile_load_procedure.isErrorTest = true;
668 Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
669 Profile_load_procedure.simaResponse="";
670 Profile_load_procedure.errorReason = ErrorReason.installFailedDueToDataMismatch;
671
672 Profile_load_procedure.ES10b_LoadBoundProfilePackage();
673
674
675 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile状态；");
676 var proInfoListRequest = new ProfileInfoListRequest();
677 proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
678 proInfoListRequest.tagList = "5A4F9F70";
679 proInfoListRequest.GenHexData();
680 var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
681
682 var proInfoListResponse = new ProfileInfoListResponse();
683 proInfoListResponse.checkCardResDataFormat(respData);
684
685 try
686 {
687 curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
688 }catch(e){
689 obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
690 }
691
692 RecoverCard();
693
694
695}
696
697function TC_eUICC_ES8_LoadProfileElements_10_Error_gid1_and_gid2_not_provided_in_the_Profile_Metadata_but_present_in_the_Profile_Package ()
698{
699 tracenamestr = "测试目的：验证如果Profile元数据中未提供gid1和gid2，但ef-gid1和ef-gid2中存在，ef-ust中的相关服务（17和18）可用，eUICC会在LoadProfileElements过程中返回错误";
700 curDis.TraceStart(sno++,tracenamestr);
701
702 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
703 Ini_powerOn_eUICC_LPAe_not_activate();
704
705 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
706 TS_MANAGE_CHANNEL_OPEN();
707
708 curLogicChannel = 1;
709
710 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
711 TS_SELECT("Select ISD",ISD_R_AID,"9000");
712
713 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
714 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL9_DATA);
715 Profile_load_procedure.ICCID = ICCID_OP_PROF9;
716 Profile_load_procedure.ES10b_GetEUICCInfo1();
717
718 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
719 Profile_load_procedure.ES10b_GetEUICCChallenge();
720
721 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
722 Profile_load_procedure.ES10b_AuthenticateServer();
723
724 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
725 Profile_load_procedure.ES10b_PrepareDownload();
726
727 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
728 Profile_load_procedure.ES10b_GetEID();
729
730 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，GID1和GID2出现在Profile Package（BPP）里,,但在Profile Metadata（元数据）里却没有;");
731 Profile_load_procedure.serviceProviderName = SP_NAME9;
732 Profile_load_procedure.profileName = NAME_OP_PROF9;
733 Profile_load_procedure.profilePolicyRules = "0520";
734 Profile_load_procedure.mccMnc = MCC_MNC9;
735
736
737 Profile_load_procedure.isErrorTest = true;
738 Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
739 Profile_load_procedure.simaResponse="";
740 Profile_load_procedure.errorReason = ErrorReason.installFailedDueToDataMismatch;
741
742 Profile_load_procedure.ES10b_LoadBoundProfilePackage();
743
744
745 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile状态；");
746 var proInfoListRequest = new ProfileInfoListRequest();
747 proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF9);
748 proInfoListRequest.tagList = "5A4F9F70";
749 proInfoListRequest.GenHexData();
750 var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
751
752 var proInfoListResponse = new ProfileInfoListResponse();
753 proInfoListResponse.checkCardResDataFormat(respData);
754
755 try
756 {
757 curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
758 }catch(e){
759 obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
760 }
761
762 RecoverCard();
763
764
765}
766
-cas 盲生成TC_eUICC_ES8_LoadProfileElements/Import/TC_eUICC_ES8_LoadProfileElements.js1145 行 / 90821 字符 / gb18030入口函数 @L24
1// Author: 卡思Cas智能体
2// Date: 20261005-152741
3// Function: （purpose 原文未由 SGP.23 该 TC 提供，corpus vacuum 登记）TC_eUICC_ES8+.LoadProfileElements，Test Sequence #01–#12（#01-#06/#09/#10/#12 Error、#07/#08/#11 Nominal）；B 表两行：#11/#12 仅 V2.5+ C064 行 + 全版本 M 行，适用性 M。
4// Test points: S4-C1 SW；S5-C1 SW；S6-C1 SW；S7-C1 SW；S7-C1 resp present；S8-C1 SW
5// S8-C2 profileInfoListOk empty；S9-C1 SW；S9-C2 profileInfoListOk empty；S13-C1 SW；S14-C1 SW
6// S15-C1 SW；S16-C1 SW；S16-C1 resp present；S17-C1 SW；S17-C2 profileInfoListOk empty；S21-C1 SW
7// S22-C1 SW；S23-C1 SW；S24-C1 SW；S25-C1 SW；S25-C1 resp present；S26-C1 SW
8// S26-C2 profileInfoListOk empty；S30-C1 SW；S31-C1 SW；S32-C1 SW；S33-C1 SW；S34-C1 SW
9// S34-C1 resp present；S35-C1 SW；S35-C2 profileInfoListOk empty；S39-C1 SW；S40-C1 SW；S41-C1 SW
10// S42-C1 SW；S43-C1 SW；S43-C1 resp present；S44-C1 SW；S44-C2 profileInfoListOk empty；S48-C1 SW
11// S49-C1 SW；S50-C1 SW；S51-C1 SW；S52-C1 ATR_present；S53-C2 FCP_Template；S53-C1 SW；S54-C1 SW
12// S55-C1 final SW；S56-C1 SW；S56-C2 CHANNEL_NUMBER extracted；S57-C1 SW；S58-C1 SW
13// S58-C2 profileInfoListOk empty；S62-C1 SW；S63-C1 SW；S64-C1 SW；S65-C1 SW；S65-C2 SW
14// S65-C2 resp present；S66-C1 SW；S66-C2 contains ICCID_OP_PROF1；S70-C1 SW；S71-C1 SW；S72-C1 SW
15// S73-C1 SW；S73-C2 SW；S73-C2 resp present；S74-C1 SW；S74-C2 profileOwner mccMnc/gid1/gid2 present
16// S78-C1 SW；S79-C1 SW；S80-C1 SW；S81-C1 SW；S81-C1 resp present；S82-C1 SW
17// S82-C2 profileInfoListOk empty；S86-C1 SW；S87-C1 SW；S88-C1 SW；S89-C1 SW；S89-C1 resp present
18// S90-C1 SW；S90-C2 profileInfoListOk empty；S94-C1 SW；S95-C1 SW；S96-C1 SW；S97-C1 SW；S97-C2 SW
19// S97-C2 resp present；S98-C1 SW；S98-C2 contains ICCID_OP_PROF10；S102-C1 SW；S103-C1 SW；S104-C1 SW
20// S105-C1 SW；S105-C1 resp present；S106-C1 SW；S106-C2 profileInfoListOk empty
21// 本函数由 CaseIR 4.2.7.2.1 编译生成（fullwave-blindgen-live-70，SGP.23 v1.16 × SGP.22 v2.7）：字节权威=CaseIR，非誊录黄金脚本。
22// Value-free template: every data byte is injected from CaseIR fields; no scaffold globals (see docs/speconly/compile-symbol-migration.md).
23// 适用性 M：编译期门，运行时由 harness 环境前置承担。
24function TC_eUICC_ES8_LoadProfileElements_01_12_01_06_09_10_12_07_08_11_11_12_merged() {
25 var bind = curBind;
26 // GIC 通信初始化+ISD-R 选择+相互认证+End User Confirmation+PrepareDownload（#PREP_DOWNLOAD_NO_CC）: declared unexpanded (non-PROC row or K corpus vacuum; see CaseIR open_items).
27
28 // 步骤 1：Seq#01 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
29 // test-tool internal preparation (no APDU face): runtime-domain
30 // values per CaseIR unresolved (G Annex B generation rules);
31 // no fabricated bytes emitted here.
32
33 // 步骤 2：Seq#01 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
34 // BPP synthesized (4.2.7.2.1 seq#1, structural layer, SCP03t-unprotected): 1067 bytes; segments: INIT=191B, A0=22B, A1=58B, A3=796B.
35 // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
36 // [SPEC] TC — SGP.23 4.2.7.2.1 seq#1 接线（段选择/注入面）
37 // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
38 // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
39 // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
40 // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
41 // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
42 // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
43 // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
44 // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
45 // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
46 // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
47 // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
48 // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
49 // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
50 // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
51 // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
52 // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
53 // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
54 // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
55 // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
56 // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
57 // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
58 // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
59 // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
60 // [SPEC] PE header/version — PITS asn:67-68 2/3
61 // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
62 // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
63 // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
64 // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
65 // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
66 // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
67 // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
68 // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
69 // [SPEC] TC/mismatch — SGP.23 4.2.7.2.1 seq#1 METADATA_ICCID_MISMATCH：故意错配注入（metadata vs UPP EF；值 HYPOTHESIS——首字节翻转参数化）
70
71 // 步骤 3：Seq#01 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
72 // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
73 // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
74 // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
75 // S3-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
76
77 // 步骤 4：Seq#01 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
78 // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
79 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
80 var s4 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
81 bind.checkData("S4-C1 SW", "9000", s4.sw);
82
83 // 步骤 5：Seq#01 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
84 // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
85 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
86 var s5 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
87 bind.checkData("S5-C1 SW", "9000", s5.sw);
88
89 // 步骤 6：Seq#01 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
90 // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
91 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
92 var s6 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
93 bind.checkData("S6-C1 SW", "9000", s6.sw);
94
95 // 步骤 7：Seq#01 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_045, RQ55_048, RQ25_025, RQ25_026, RQ31_173）
96 // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
97 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
98 var s7 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
99 bind.checkData("S7-C1 SW", "9000", s7.sw);
100 bind.checkData("S7-C1 resp present", "1", s7.resp.length > 0 ? "1" : "0");
101 // S7-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
102 // S7-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
103
104 // 步骤 8：Seq#01 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
105 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
106 var s8 = bind.sendApdu(null, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
107 bind.checkData("S8-C1 SW", "9000", s8.sw);
108 var r2p8 = BindEs10xProcProfile.walkChoiceList(s8.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
109 bind.checkData("S8-C2 profileInfoListOk empty", "1", (r2p8.branch_tag === "A0" && r2p8.elements.length === 0) ? "1" : "0");
110
111 // 步骤 9：Seq#01 3: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
112 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
113 var s9 = bind.sendApdu(null, "E2", "91", "00", "BF2D0EA00C5A0A989209013254769810F9", "00", "9000");
114 bind.checkData("S9-C1 SW", "9000", s9.sw);
115 var r2p9 = BindEs10xProcProfile.walkChoiceList(s9.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
116 bind.checkData("S9-C2 profileInfoListOk empty", "1", (r2p9.branch_tag === "A0" && r2p9.elements.length === 0) ? "1" : "0");
117
118 // 步骤 10：Seq#02 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
119 // test-tool internal preparation (no APDU face): runtime-domain
120 // values per CaseIR unresolved (G Annex B generation rules);
121 // no fabricated bytes emitted here.
122
123 // 步骤 11：Seq#02 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
124 // BPP synthesized (4.2.7.2.1 seq#2, structural layer, SCP03t-unprotected): 1076 bytes; segments: INIT=191B, A0=22B, A1=67B, A3=796B.
125 // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
126 // [SPEC] TC — SGP.23 4.2.7.2.1 seq#2 接线（段选择/注入面）
127 // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
128 // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
129 // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
130 // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
131 // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
132 // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
133 // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
134 // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
135 // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
136 // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
137 // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
138 // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
139 // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
140 // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
141 // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
142 // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
143 // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
144 // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
145 // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
146 // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
147 // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
148 // [HYPOTHESIS] BF25/B7 profileOwner — OperatorId mccMnc 值（3GPP 24.008 编码面 SPEC，值 HYPOTHESIS）
149 // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
150 // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
151 // [SPEC] PE header/version — PITS asn:67-68 2/3
152 // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
153 // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
154 // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
155 // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
156 // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
157 // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
158 // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
159 // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
160 // [SPEC] TC/mismatch — SGP.23 4.2.7.2.1 seq#2 METADATA_MCCMNC_MISMATCH：故意错配注入（metadata vs UPP EF；值 HYPOTHESIS——首字节翻转参数化）
161
162 // 步骤 12：Seq#02 IC3: Execute the step IC3 of the Test Sequence #01 defined in this section（切分）（tc_step）
163 // cross-sequence IC execution reference (R2 materialized form): referenced IC declaration emitted in its source sequence; no re-expansion, no fabricated bytes here.
164 // BPP segment partitioning follows bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 segment table; single source of segmentation knowledge).
165 // S12-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
166
167 // 步骤 13：Seq#02 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
168 // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
169 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
170 var s13 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
171 bind.checkData("S13-C1 SW", "9000", s13.sw);
172
173 // 步骤 14：Seq#02 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
174 // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
175 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
176 var s14 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
177 bind.checkData("S14-C1 SW", "9000", s14.sw);
178
179 // 步骤 15：Seq#02 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
180 // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
181 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
182 var s15 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
183 bind.checkData("S15-C1 SW", "9000", s15.sw);
184
185 // 步骤 16：Seq#02 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_043, RQ55_047, RQ55_048, RQ25_025, RQ25_026, RQ31_173）
186 // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
187 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
188 var s16 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
189 bind.checkData("S16-C1 SW", "9000", s16.sw);
190 bind.checkData("S16-C1 resp present", "1", s16.resp.length > 0 ? "1" : "0");
191 // S16-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
192 // S16-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
193
194 // 步骤 17：Seq#02 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_043, RQ55_048）
195 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
196 var s17 = bind.sendApdu(null, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
197 bind.checkData("S17-C1 SW", "9000", s17.sw);
198 var r2p17 = BindEs10xProcProfile.walkChoiceList(s17.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
199 bind.checkData("S17-C2 profileInfoListOk empty", "1", (r2p17.branch_tag === "A0" && r2p17.elements.length === 0) ? "1" : "0");
200
201 // 步骤 18：Seq#03 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
202 // test-tool internal preparation (no APDU face): runtime-domain
203 // values per CaseIR unresolved (G Annex B generation rules);
204 // no fabricated bytes emitted here.
205
206 // 步骤 19：Seq#03 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
207 // BPP synthesized (4.2.7.2.1 seq#3, structural layer, SCP03t-unprotected): 1128 bytes; segments: INIT=191B, A0=22B, A1=58B, A2=61B, A3=796B.
208 // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
209 // [SPEC] TC — SGP.23 4.2.7.2.1 seq#3 接线（段选择/注入面）
210 // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
211 // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
212 // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
213 // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
214 // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
215 // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
216 // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
217 // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
218 // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
219 // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
220 // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
221 // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
222 // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
223 // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
224 // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
225 // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
226 // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
227 // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
228 // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
229 // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
230 // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
231 // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
232 // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
233 // [SPEC] PE header/version — PITS asn:67-68 2/3
234 // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
235 // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
236 // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
237 // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
238 // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
239 // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
240 // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
241 // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
242 // [SPEC] BF36/A2 — Table 4 :1593 secondSequenceOf87
243 // [SPEC] BF26 — SGP.22 §5.5.4 :7481 ReplaceSessionKeysRequest [38]
244 // [HYPOTHESIS] BF26/04 initialMacChainingValue — 自定随机值
245 // [HYPOTHESIS] BF26/04 ppkEnc — 自定随机值
246 // [HYPOTHESIS] BF26/04 ppkCmac — 自定随机值
247 // [SPEC] TC/override — SGP.23 4.2.7.2.1 seq#3：MTD_GENERATE_BPP override —— <S_MAC_CHAIN> SHALL be used instead of <PPK_INIT_MAC> for UPP SCP03t protection（E 表 :78）。结构层仅发 A2 ReplaceSessionKeys（BF26）段，PPK 值为 HYPOTHESIS（Annex E 缺席）；SCP03t MAC/ENC 链属会话层（后续 lane）
248 // [SPEC] TC/ppk — SGP.23 表4211 seq#02：PPK-ENC/PPK-MAC 面（A2 ReplaceSessionKeys 在场，DEFAULT_PPK 值 HYPOTHESIS——Annex E 缺席）
249 // S19-C1: binding:bpp_override_rule_carried_by_synthesis_contract(bpp_injection-provenance) (check_attestation)
250
251 // 步骤 20：Seq#03 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A2>, <BPP_SEG_A3>（tc_step）
252 // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A2>, <BPP_SEG_A3>.
253 // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
254 // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
255 // S20-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
256
257 // 步骤 21：Seq#03 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
258 // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
259 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
260 var s21 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
261 bind.checkData("S21-C1 SW", "9000", s21.sw);
262
263 // 步骤 22：Seq#03 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
264 // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
265 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
266 var s22 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
267 bind.checkData("S22-C1 SW", "9000", s22.sw);
268
269 // 步骤 23：Seq#03 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
270 // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
271 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
272 var s23 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
273 bind.checkData("S23-C1 SW", "9000", s23.sw);
274
275 // 步骤 24：Seq#03 IC7: MTD_STORE_DATA_SCRIPT（tc_step）
276 // BPP segment load (data=null contract): <BPP_SEG_A2> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
277 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
278 var s24 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
279 bind.checkData("S24-C1 SW", "9000", s24.sw);
280
281 // 步骤 25：Seq#03 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ25_025, RQ25_026, RQ55_048, RQ31_173）
282 // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
283 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
284 var s25 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
285 bind.checkData("S25-C1 SW", "9000", s25.sw);
286 bind.checkData("S25-C1 resp present", "1", s25.resp.length > 0 ? "1" : "0");
287 // S25-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
288
289 // 步骤 26：Seq#03 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
290 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
291 var s26 = bind.sendApdu(null, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
292 bind.checkData("S26-C1 SW", "9000", s26.sw);
293 var r2p26 = BindEs10xProcProfile.walkChoiceList(s26.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
294 bind.checkData("S26-C2 profileInfoListOk empty", "1", (r2p26.branch_tag === "A0" && r2p26.elements.length === 0) ? "1" : "0");
295
296 // 步骤 27：Seq#04 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
297 // test-tool internal preparation (no APDU face): runtime-domain
298 // values per CaseIR unresolved (G Annex B generation rules);
299 // no fabricated bytes emitted here.
300
301 // 步骤 28：Seq#04 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
302 // BPP synthesized (4.2.7.2.1 seq#4, structural layer, SCP03t-unprotected): 1128 bytes; segments: INIT=191B, A0=22B, A1=58B, A2=61B, A3=796B.
303 // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
304 // [SPEC] TC — SGP.23 4.2.7.2.1 seq#4 接线（段选择/注入面）
305 // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
306 // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
307 // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
308 // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
309 // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
310 // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
311 // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
312 // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
313 // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
314 // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
315 // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
316 // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
317 // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
318 // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
319 // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
320 // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
321 // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
322 // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
323 // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
324 // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
325 // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
326 // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
327 // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
328 // [SPEC] PE header/version — PITS asn:67-68 2/3
329 // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
330 // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
331 // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
332 // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
333 // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
334 // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
335 // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
336 // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
337 // [SPEC] BF36/A2 — Table 4 :1593 secondSequenceOf87
338 // [SPEC] BF26 — SGP.22 §5.5.4 :7481 ReplaceSessionKeysRequest [38]
339 // [HYPOTHESIS] BF26/04 initialMacChainingValue — 自定随机值
340 // [HYPOTHESIS] BF26/04 ppkEnc — 自定随机值
341 // [HYPOTHESIS] BF26/04 ppkCmac — 自定随机值
342 // [SPEC] TC/override — SGP.23 4.2.7.2.1 seq#4：MTD_GENERATE_BPP override —— <S_MAC> SHALL be used instead of <PPK_MAC> for UPP SCP03t protection（E 表 :94）。结构层与 seq#3 同构（名义 metadata + A2 ReplaceSessionKeys BF26 段）；S-MAC 属 SCP03t 会话层（后续 lane）
343 // [SPEC] TC/ppk — SGP.23 表4211 seq#02：PPK-ENC/PPK-MAC 面（A2 ReplaceSessionKeys 在场，DEFAULT_PPK 值 HYPOTHESIS——Annex E 缺席）
344 // S28-C1: binding:bpp_override_rule_carried_by_synthesis_contract(bpp_injection-provenance) (check_attestation)
345
346 // 步骤 29：Seq#04 IC3: Execute the step IC3 of the Test Sequence #03 defined in this section（切分）（tc_step）
347 // cross-sequence IC execution reference (R2 materialized form): referenced IC declaration emitted in its source sequence; no re-expansion, no fabricated bytes here.
348 // BPP segment partitioning follows bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 segment table; single source of segmentation knowledge).
349 // S29-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
350
351 // 步骤 30：Seq#04 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
352 // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
353 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
354 var s30 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
355 bind.checkData("S30-C1 SW", "9000", s30.sw);
356
357 // 步骤 31：Seq#04 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
358 // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
359 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
360 var s31 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
361 bind.checkData("S31-C1 SW", "9000", s31.sw);
362
363 // 步骤 32：Seq#04 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
364 // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
365 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
366 var s32 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
367 bind.checkData("S32-C1 SW", "9000", s32.sw);
368
369 // 步骤 33：Seq#04 IC7: MTD_STORE_DATA_SCRIPT（tc_step）
370 // BPP segment load (data=null contract): <BPP_SEG_A2> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
371 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
372 var s33 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
373 bind.checkData("S33-C1 SW", "9000", s33.sw);
374
375 // 步骤 34：Seq#04 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ25_025, RQ25_026, RQ55_048, RQ31_173）
376 // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
377 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
378 var s34 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
379 bind.checkData("S34-C1 SW", "9000", s34.sw);
380 bind.checkData("S34-C1 resp present", "1", s34.resp.length > 0 ? "1" : "0");
381 // S34-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
382
383 // 步骤 35：Seq#04 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
384 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
385 var s35 = bind.sendApdu(null, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
386 bind.checkData("S35-C1 SW", "9000", s35.sw);
387 var r2p35 = BindEs10xProcProfile.walkChoiceList(s35.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
388 bind.checkData("S35-C2 profileInfoListOk empty", "1", (r2p35.branch_tag === "A0" && r2p35.elements.length === 0) ? "1" : "0");
389
390 // 步骤 36：Seq#05 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
391 // test-tool internal preparation (no APDU face): runtime-domain
392 // values per CaseIR unresolved (G Annex B generation rules);
393 // no fabricated bytes emitted here.
394
395 // 步骤 37：Seq#05 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
396 // BPP synthesized (4.2.7.2.1 seq#5, structural layer, SCP03t-unprotected): 1128 bytes; segments: INIT=191B, A0=22B, A1=58B, A2=61B, A3=796B.
397 // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
398 // [SPEC] TC — SGP.23 4.2.7.2.1 seq#5 接线（段选择/注入面）
399 // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
400 // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
401 // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
402 // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
403 // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
404 // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
405 // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
406 // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
407 // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
408 // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
409 // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
410 // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
411 // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
412 // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
413 // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
414 // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
415 // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
416 // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
417 // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
418 // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
419 // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
420 // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
421 // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
422 // [SPEC] PE header/version — PITS asn:67-68 2/3
423 // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
424 // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
425 // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
426 // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
427 // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
428 // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
429 // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
430 // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
431 // [SPEC] BF36/A2 — Table 4 :1593 secondSequenceOf87
432 // [SPEC] BF26 — SGP.22 §5.5.4 :7481 ReplaceSessionKeysRequest [38]
433 // [HYPOTHESIS] BF26/04 initialMacChainingValue — 自定随机值
434 // [HYPOTHESIS] BF26/04 ppkEnc — 自定随机值
435 // [HYPOTHESIS] BF26/04 ppkCmac — 自定随机值
436 // [SPEC] TC/override — SGP.23 4.2.7.2.1 seq#5：MTD_GENERATE_BPP override —— <S_ENC> SHALL be used instead of <PPK_ENC> for UPP SCP03t protection（E 表 :110）。结构层与 seq#3 同构（名义 metadata + A2 ReplaceSessionKeys BF26 段）；S-ENC 属 SCP03t 会话层（后续 lane）
437 // [SPEC] TC/ppk — SGP.23 表4211 seq#02：PPK-ENC/PPK-MAC 面（A2 ReplaceSessionKeys 在场，DEFAULT_PPK 值 HYPOTHESIS——Annex E 缺席）
438 // S37-C1: binding:bpp_override_rule_carried_by_synthesis_contract(bpp_injection-provenance) (check_attestation)
439
440 // 步骤 38：Seq#05 IC3: Execute the step IC3 of the Test Sequence #03 defined in this section（切分）（tc_step）
441 // cross-sequence IC execution reference (R2 materialized form): referenced IC declaration emitted in its source sequence; no re-expansion, no fabricated bytes here.
442 // BPP segment partitioning follows bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 segment table; single source of segmentation knowledge).
443 // S38-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
444
445 // 步骤 39：Seq#05 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
446 // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
447 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
448 var s39 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
449 bind.checkData("S39-C1 SW", "9000", s39.sw);
450
451 // 步骤 40：Seq#05 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
452 // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
453 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
454 var s40 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
455 bind.checkData("S40-C1 SW", "9000", s40.sw);
456
457 // 步骤 41：Seq#05 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
458 // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
459 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
460 var s41 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
461 bind.checkData("S41-C1 SW", "9000", s41.sw);
462
463 // 步骤 42：Seq#05 IC7: MTD_STORE_DATA_SCRIPT（tc_step）
464 // BPP segment load (data=null contract): <BPP_SEG_A2> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
465 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
466 var s42 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
467 bind.checkData("S42-C1 SW", "9000", s42.sw);
468
469 // 步骤 43：Seq#05 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ25_025, RQ25_026, RQ55_048, RQ31_173）
470 // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
471 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
472 var s43 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
473 bind.checkData("S43-C1 SW", "9000", s43.sw);
474 bind.checkData("S43-C1 resp present", "1", s43.resp.length > 0 ? "1" : "0");
475 // S43-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
476
477 // 步骤 44：Seq#05 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
478 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
479 var s44 = bind.sendApdu(null, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
480 bind.checkData("S44-C1 SW", "9000", s44.sw);
481 var r2p44 = BindEs10xProcProfile.walkChoiceList(s44.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
482 bind.checkData("S44-C2 profileInfoListOk empty", "1", (r2p44.branch_tag === "A0" && r2p44.elements.length === 0) ? "1" : "0");
483
484 // 步骤 45：Seq#06 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
485 // test-tool internal preparation (no APDU face): runtime-domain
486 // values per CaseIR unresolved (G Annex B generation rules);
487 // no fabricated bytes emitted here.
488
489 // 步骤 46：Seq#06 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
490 // BPP synthesized (4.2.7.2.1 seq#6, structural layer, SCP03t-unprotected): 1067 bytes; segments: INIT=191B, A0=22B, A1=58B, A3=796B.
491 // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
492 // [SPEC] TC — SGP.23 4.2.7.2.1 seq#6 接线（段选择/注入面）
493 // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
494 // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
495 // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
496 // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
497 // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
498 // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
499 // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
500 // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
501 // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
502 // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
503 // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
504 // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
505 // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
506 // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
507 // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
508 // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
509 // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
510 // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
511 // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
512 // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
513 // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
514 // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
515 // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
516 // [SPEC] PE header/version — PITS asn:67-68 2/3
517 // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
518 // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
519 // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
520 // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
521 // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
522 // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
523 // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
524 // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
525 // [SPEC] TC/flow — SGP.23 4.2.7.2.1 seq#6：名义 BPP（METADATA_OP_PROF1 + UPP_OP_PROF1，NO_PARAM）；下载中途被 Reset 打断（Reset／重初始化过程为后续独立步），结构层零注入
526
527 // 步骤 47：Seq#06 IC3: Execute the step IC3 of the Test Sequence #01 defined in this section（切分）（tc_step）
528 // cross-sequence IC execution reference (R2 materialized form): referenced IC declaration emitted in its source sequence; no re-expansion, no fabricated bytes here.
529 // BPP segment partitioning follows bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 segment table; single source of segmentation knowledge).
530 // S47-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
531
532 // 步骤 48：Seq#06 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
533 // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
534 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
535 var s48 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
536 bind.checkData("S48-C1 SW", "9000", s48.sw);
537
538 // 步骤 49：Seq#06 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
539 // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
540 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
541 var s49 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
542 bind.checkData("S49-C1 SW", "9000", s49.sw);
543
544 // 步骤 50：Seq#06 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
545 // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
546 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
547 var s50 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
548 bind.checkData("S50-C1 SW", "9000", s50.sw);
549
550 // 步骤 51：Seq#06 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023）
551 // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
552 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
553 var s51 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
554 bind.checkData("S51-C1 SW", "9000", s51.sw);
555
556 // 步骤 52：Seq#06 2/1: RESET（PROC_EUICC_INITIALIZATION_SEQUENCE 展开1/4，K_annexC2_procs 表1256）（procedure_expansion）
557 var s52 = bind.resetAndAtr();
558 bind.checkData("S52-C1 ATR_present", "1", s52.atr_hex !== "" ? "1" : "0");
559
560 // 步骤 53：Seq#06 2/2: [SELECT_MF]（展开2/4）（procedure_expansion）
561 // FCP outer tag not materialized from clause: tag-face asserted only when corpus fixes the tag byte (e.g. TS 102 221 FCP '62').
562 var s53 = bind.sendApdu("00", "A4", "00", "04", "3F00", "00", "9000");
563 bind.checkData("S53-C2 FCP_Template", "1", s53.resp.length > 0 ? "1" : "0");
564 bind.checkData("S53-C1 SW", "9000", s53.sw);
565
566 // 步骤 54：Seq#06 2/3: [TERMINAL_CAPABILITY_LPAd]（展开3/4）（procedure_expansion）
567 var s54 = bind.sendApdu("80", "AA", "00", "00", "A9058100830107", null, "9000");
568 bind.checkData("S54-C1 SW", "9000", s54.sw);
569
570 // 步骤 55：Seq#06 2/4: [TERMINAL_PROFILE]（展开4/4）（procedure_expansion）
571 var steady55 = bind.runToSteadyState(function () {
572 return bind.sendTerminalProfile("FFFFFFFF7F9D00DFBF00001FE2000000C7EB0000000168005000000000000200", "9000");
573 });
574 bind.checkData("S55-C1 final SW", "9000", steady55.final.sw);
575
576 // 步骤 56：Seq#06 3/1: [MANAGE_CHANNEL_OPEN]（PROC_OPEN_LOGICAL_CHANNEL_AND_SELECT_ISDR 展开1/2，K_annexC2_procs 表1258）（procedure_expansion）
577 // CHANNEL_NUMBER extraction and dynamic CLA rebinding are CasBind internal state (chaining rule; no generated-code re-implementation).
578 var s56 = bind.manageChannelOpen("9000");
579 bind.checkData("S56-C1 SW", "9000", s56.sw);
580 bind.checkData("S56-C2 CHANNEL_NUMBER extracted", "1", s56.chan !== null ? "1" : "0");
581
582 // 步骤 57：Seq#06 3/2: MTD_SELECT（procedure_expansion）
583 // CLA = bound channel (cla_rule) and <L> length binding are CasBind internal state (chaining rule; no generated-code re-implementation).
584 var s57 = bind.sendApdu(null, "A4", "04", "00", "A0000005591010FFFFFFFF8900000100", "00", "9000");
585 // MTD_SELECT expected face is SW-only (K Annex C.2 open-channel procedure step 2: no FCI content assertion in corpus); no fabricated template parse.
586 bind.checkData("S57-C1 SW", "9000", s57.sw);
587
588 // 步骤 58：Seq#06 4: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
589 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
590 var sdCla58 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
591 var s58 = bind.sendApdu(sdCla58, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
592 bind.checkData("S58-C1 SW", "9000", s58.sw);
593 var r2p58 = BindEs10xProcProfile.walkChoiceList(s58.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
594 bind.checkData("S58-C2 profileInfoListOk empty", "1", (r2p58.branch_tag === "A0" && r2p58.elements.length === 0) ? "1" : "0");
595
596 // 步骤 59：Seq#07 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
597 // test-tool internal preparation (no APDU face): runtime-domain
598 // values per CaseIR unresolved (G Annex B generation rules);
599 // no fabricated bytes emitted here.
600
601 // 步骤 60：Seq#07 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
602 // BPP synthesized (4.2.7.2.1 seq#7, structural layer, SCP03t-unprotected): 1067 bytes; segments: INIT=191B, A0=22B, A1=58B, A3=796B.
603 // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
604 // [SPEC] TC — SGP.23 4.2.7.2.1 seq#7 接线（段选择/注入面）
605 // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
606 // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
607 // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
608 // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
609 // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
610 // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
611 // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
612 // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
613 // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
614 // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
615 // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
616 // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
617 // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
618 // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
619 // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
620 // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
621 // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
622 // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
623 // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
624 // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
625 // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
626 // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
627 // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
628 // [SPEC] PE header/version — PITS asn:67-68 2/3
629 // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
630 // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
631 // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
632 // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
633 // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
634 // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
635 // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
636 // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
637 // [SPEC] TC/override — SGP.23 4.2.7.2.1 seq#7：#UPP_OP_PROF1 覆写 —— ProfileHeader 元素的 iccid 字段置 #ICCID_OP_PROF2（PITS asn:69 ProfileHeader.iccid，tag '83'；值 HYPOTHESIS）；EF-ICCID 与 metadata 维持 OP_PROF1。eUICC 忽略 ProfileHeader iccid（Nominal → R_PIR_OK）
638 // S60-C1: binding:bpp_override_rule_carried_by_synthesis_contract(bpp_injection-provenance) (check_attestation)
639
640 // 步骤 61：Seq#07 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
641 // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
642 // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
643 // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
644 // S61-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
645
646 // 步骤 62：Seq#07 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
647 // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
648 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
649 var sdCla62 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
650 var s62 = bind.sendApdu(sdCla62, "E2", "00", "00", null, "00", "9000");
651 bind.checkData("S62-C1 SW", "9000", s62.sw);
652
653 // 步骤 63：Seq#07 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
654 // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
655 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
656 var sdCla63 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
657 var s63 = bind.sendApdu(sdCla63, "E2", "00", "00", null, "00", "9000");
658 bind.checkData("S63-C1 SW", "9000", s63.sw);
659
660 // 步骤 64：Seq#07 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
661 // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
662 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
663 var sdCla64 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
664 var s64 = bind.sendApdu(sdCla64, "E2", "00", "00", null, "00", "9000");
665 bind.checkData("S64-C1 SW", "9000", s64.sw);
666
667 // 步骤 65：Seq#07 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_045, RQ55_048, RQ25_025, RQ25_026, RQ55_044）
668 // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
669 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
670 var sdCla65 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
671 var s65 = bind.sendApdu(sdCla65, "E2", "00", "00", null, "00", "9000");
672 bind.checkData("S65-C1 SW", "9000", s65.sw);
673 bind.checkData("S65-C2 SW", "9000", s65.sw);
674 bind.checkData("S65-C2 resp present", "1", s65.resp.length > 0 ? "1" : "0");
675 // S65-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
676
677 // 步骤 66：Seq#07 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
678 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
679 var sdCla66 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
680 var s66 = bind.sendApdu(sdCla66, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
681 bind.checkData("S66-C1 SW", "9000", s66.sw);
682 var r2p66 = BindEs10xProcProfile.walkChoiceList(s66.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
683 var r2has66_0 = false;
684 for (var r2i66_0 = 0; r2i66_0 < r2p66.elements.length; r2i66_0++) {
685 var f = r2p66.elements[r2i66_0].fields;
686 if (f["5A"] === "989209012143658709F5" && f["9F70"] === "00") { r2has66_0 = true; break; }
687 }
688 bind.checkData("S66-C2 contains ICCID_OP_PROF1", "1", (r2p66.branch_tag === "A0" && r2has66_0) ? "1" : "0");
689 // S66-C3: kind 'requirement' pattern 'ProfileHeader ICCID ignored' has no static generation face (corpus vacuum; see CaseIR unresolved).
690 // S66-C3: binding:bf2d_query_structure_satisfies_requirement(S22-prof_info) (check_attestation)
691
692 // 步骤 67：Seq#08 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
693 // test-tool internal preparation (no APDU face): runtime-domain
694 // values per CaseIR unresolved (G Annex B generation rules);
695 // no fabricated bytes emitted here.
696
697 // 步骤 68：Seq#08 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
698 // BPP synthesized (4.2.7.2.1 seq#8, structural layer, SCP03t-unprotected): 1084 bytes; segments: INIT=191B, A0=22B, A1=75B, A3=796B.
699 // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
700 // [SPEC] TC — SGP.23 4.2.7.2.1 seq#8 接线（段选择/注入面）
701 // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
702 // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
703 // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
704 // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
705 // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
706 // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
707 // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
708 // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
709 // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
710 // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
711 // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
712 // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
713 // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
714 // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
715 // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
716 // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
717 // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
718 // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
719 // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
720 // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
721 // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
722 // [HYPOTHESIS] BF25/B7 profileOwner — OperatorId mccMnc 值（3GPP 24.008 编码面 SPEC，值 HYPOTHESIS）；gid1/gid2 在场（SGP.22 §2.4a.1.2 OperatorId ASN.1 结构 SPEC，值 HYPOTHESIS）
723 // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
724 // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
725 // [SPEC] PE header/version — PITS asn:67-68 2/3
726 // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
727 // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
728 // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
729 // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
730 // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
731 // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
732 // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
733 // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
734 // [SPEC] TC/metadata-gid — SGP.23 4.2.7.2.1 seq#8 METADATA_OP_PROF9：Operational Profile 9 metadata profileOwner 带 mccMnc+gid1+gid2（SGP.22 §2.4a.1.2 OperatorId ASN.1 结构 SPEC；值 HYPOTHESIS）。Profile Package 对应含 EF-GID1/GID2 且 UST 服务 17/18 available（包侧 gid 无 PITS opt-usim 模板，未结构建模，仅断言面）；Nominal → R_PIR_OK_PROF9
735
736 // 步骤 69：Seq#08 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
737 // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
738 // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
739 // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
740 // S69-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
741
742 // 步骤 70：Seq#08 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
743 // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
744 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
745 var sdCla70 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
746 var s70 = bind.sendApdu(sdCla70, "E2", "00", "00", null, "00", "9000");
747 bind.checkData("S70-C1 SW", "9000", s70.sw);
748
749 // 步骤 71：Seq#08 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
750 // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
751 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
752 var sdCla71 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
753 var s71 = bind.sendApdu(sdCla71, "E2", "00", "00", null, "00", "9000");
754 bind.checkData("S71-C1 SW", "9000", s71.sw);
755
756 // 步骤 72：Seq#08 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
757 // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
758 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
759 var sdCla72 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
760 var s72 = bind.sendApdu(sdCla72, "E2", "00", "00", null, "00", "9000");
761 bind.checkData("S72-C1 SW", "9000", s72.sw);
762
763 // 步骤 73：Seq#08 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_045_2）
764 // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
765 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
766 var sdCla73 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
767 var s73 = bind.sendApdu(sdCla73, "E2", "00", "00", null, "00", "9000");
768 bind.checkData("S73-C1 SW", "9000", s73.sw);
769 bind.checkData("S73-C2 SW", "9000", s73.sw);
770 bind.checkData("S73-C2 resp present", "1", s73.resp.length > 0 ? "1" : "0");
771 // S73-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
772
773 // 步骤 74：Seq#08 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071）
774 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
775 var sdCla74 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
776 var s74 = bind.sendApdu(sdCla74, "E2", "91", "00", "BF2D035C01B7", "00", "9000");
777 bind.checkData("S74-C1 SW", "9000", s74.sw);
778 var r2p74 = BindEs10xProcProfile.walkChoiceList(s74.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
779 var r2po74S74_C2 = "";
780 for (var r2oi74S74_C2 = 0; r2oi74S74_C2 < r2p74.elements.length; r2oi74S74_C2++) {
781 var f = r2p74.elements[r2oi74S74_C2].fields;
782 if (f["B7"] !== undefined && f["B7"] !== "") { r2po74S74_C2 = f["B7"]; break; }
783 }
784 var r2poc74S74_C2 = r2po74S74_C2 === "" ? [] : BindEs10xProcProfile.parseBerTlv(r2po74S74_C2);
785 bind.checkData("S74-C2 profileOwner mccMnc/gid1/gid2 present", "1", (r2poc74S74_C2.length >= 3) ? "1" : "0");
786
787 // 步骤 75：Seq#09 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
788 // test-tool internal preparation (no APDU face): runtime-domain
789 // values per CaseIR unresolved (G Annex B generation rules);
790 // no fabricated bytes emitted here.
791
792 // 步骤 76：Seq#09 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
793 // BPP synthesized (4.2.7.2.1 seq#9, structural layer, SCP03t-unprotected): 1084 bytes; segments: INIT=191B, A0=22B, A1=75B, A3=796B.
794 // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
795 // [SPEC] TC — SGP.23 4.2.7.2.1 seq#9 接线（段选择/注入面）
796 // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
797 // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
798 // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
799 // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
800 // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
801 // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
802 // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
803 // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
804 // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
805 // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
806 // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
807 // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
808 // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
809 // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
810 // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
811 // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
812 // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
813 // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
814 // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
815 // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
816 // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
817 // [HYPOTHESIS] BF25/B7 profileOwner — OperatorId mccMnc 值（3GPP 24.008 编码面 SPEC，值 HYPOTHESIS）；gid1/gid2 在场（SGP.22 §2.4a.1.2 OperatorId ASN.1 结构 SPEC，值 HYPOTHESIS）
818 // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
819 // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
820 // [SPEC] PE header/version — PITS asn:67-68 2/3
821 // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
822 // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
823 // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
824 // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
825 // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
826 // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
827 // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
828 // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
829 // [SPEC] TC/metadata-gid — SGP.23 4.2.7.2.1 seq#9 METADATA_OP1_GID1GID2_PRESENT（Error）：metadata profileOwner 含 gid1/gid2，而 Profile Package（UPP_OP_PROF1）不含 EF-GID1/GID2 且 UST 服务 17/18 not available → R_PIR_DATA_MISMATCH
830
831 // 步骤 77：Seq#09 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
832 // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
833 // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
834 // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
835 // S77-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
836
837 // 步骤 78：Seq#09 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
838 // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
839 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
840 var sdCla78 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
841 var s78 = bind.sendApdu(sdCla78, "E2", "00", "00", null, "00", "9000");
842 bind.checkData("S78-C1 SW", "9000", s78.sw);
843
844 // 步骤 79：Seq#09 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
845 // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
846 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
847 var sdCla79 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
848 var s79 = bind.sendApdu(sdCla79, "E2", "00", "00", null, "00", "9000");
849 bind.checkData("S79-C1 SW", "9000", s79.sw);
850
851 // 步骤 80：Seq#09 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
852 // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
853 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
854 var sdCla80 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
855 var s80 = bind.sendApdu(sdCla80, "E2", "00", "00", null, "00", "9000");
856 bind.checkData("S80-C1 SW", "9000", s80.sw);
857
858 // 步骤 81：Seq#09 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_045, RQ55_048, RQ25_025, RQ25_026, RQ55_045_2）
859 // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
860 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
861 var sdCla81 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
862 var s81 = bind.sendApdu(sdCla81, "E2", "00", "00", null, "00", "9000");
863 bind.checkData("S81-C1 SW", "9000", s81.sw);
864 bind.checkData("S81-C1 resp present", "1", s81.resp.length > 0 ? "1" : "0");
865 // S81-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
866 // S81-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
867
868 // 步骤 82：Seq#09 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
869 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
870 var sdCla82 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
871 var s82 = bind.sendApdu(sdCla82, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
872 bind.checkData("S82-C1 SW", "9000", s82.sw);
873 var r2p82 = BindEs10xProcProfile.walkChoiceList(s82.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
874 bind.checkData("S82-C2 profileInfoListOk empty", "1", (r2p82.branch_tag === "A0" && r2p82.elements.length === 0) ? "1" : "0");
875
876 // 步骤 83：Seq#10 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
877 // test-tool internal preparation (no APDU face): runtime-domain
878 // values per CaseIR unresolved (G Annex B generation rules);
879 // no fabricated bytes emitted here.
880
881 // 步骤 84：Seq#10 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
882 // BPP synthesized (4.2.7.2.1 seq#10, structural layer, SCP03t-unprotected): 1076 bytes; segments: INIT=191B, A0=22B, A1=67B, A3=796B.
883 // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
884 // [SPEC] TC — SGP.23 4.2.7.2.1 seq#10 接线（段选择/注入面）
885 // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
886 // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
887 // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
888 // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
889 // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
890 // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
891 // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
892 // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
893 // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
894 // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
895 // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
896 // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
897 // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
898 // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
899 // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
900 // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
901 // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
902 // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
903 // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
904 // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
905 // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
906 // [HYPOTHESIS] BF25/B7 profileOwner — OperatorId mccMnc 值（3GPP 24.008 编码面 SPEC，值 HYPOTHESIS）
907 // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
908 // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
909 // [SPEC] PE header/version — PITS asn:67-68 2/3
910 // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
911 // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
912 // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
913 // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
914 // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
915 // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
916 // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
917 // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
918 // [SPEC] TC/metadata-gid — SGP.23 4.2.7.2.1 seq#10 METADATA_OP9_GID1GID2_MISSING（Error）：metadata profileOwner 仅 mccMnc（无 gid1/gid2），而 Profile Package（UPP_OP_PROF9）含 EF-GID1/GID2 且 UST 服务 17/18 available → R_PIR_DATA_MISMATCH
919
920 // 步骤 85：Seq#10 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
921 // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
922 // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
923 // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
924 // S85-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
925
926 // 步骤 86：Seq#10 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
927 // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
928 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
929 var sdCla86 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
930 var s86 = bind.sendApdu(sdCla86, "E2", "00", "00", null, "00", "9000");
931 bind.checkData("S86-C1 SW", "9000", s86.sw);
932
933 // 步骤 87：Seq#10 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
934 // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
935 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
936 var sdCla87 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
937 var s87 = bind.sendApdu(sdCla87, "E2", "00", "00", null, "00", "9000");
938 bind.checkData("S87-C1 SW", "9000", s87.sw);
939
940 // 步骤 88：Seq#10 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
941 // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
942 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
943 var sdCla88 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
944 var s88 = bind.sendApdu(sdCla88, "E2", "00", "00", null, "00", "9000");
945 bind.checkData("S88-C1 SW", "9000", s88.sw);
946
947 // 步骤 89：Seq#10 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_045, RQ55_048, RQ25_025, RQ25_026, RQ55_045_3）
948 // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
949 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
950 var sdCla89 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
951 var s89 = bind.sendApdu(sdCla89, "E2", "00", "00", null, "00", "9000");
952 bind.checkData("S89-C1 SW", "9000", s89.sw);
953 bind.checkData("S89-C1 resp present", "1", s89.resp.length > 0 ? "1" : "0");
954 // S89-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
955 // S89-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
956
957 // 步骤 90：Seq#10 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
958 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
959 var sdCla90 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
960 var s90 = bind.sendApdu(sdCla90, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658776F5", "00", "9000");
961 bind.checkData("S90-C1 SW", "9000", s90.sw);
962 var r2p90 = BindEs10xProcProfile.walkChoiceList(s90.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
963 bind.checkData("S90-C2 profileInfoListOk empty", "1", (r2p90.branch_tag === "A0" && r2p90.elements.length === 0) ? "1" : "0");
964
965 // 步骤 91：Seq#11 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
966 // test-tool internal preparation (no APDU face): runtime-domain
967 // values per CaseIR unresolved (G Annex B generation rules);
968 // no fabricated bytes emitted here.
969
970 // 步骤 92：Seq#11 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
971 // BPP synthesized (4.2.7.2.1 seq#11, structural layer, SCP03t-unprotected): 907 bytes; segments: INIT=191B, A0=22B, A1=58B, A3=636B.
972 // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
973 // [SPEC] TC — SGP.23 4.2.7.2.1 seq#11 接线（段选择/注入面）
974 // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
975 // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
976 // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
977 // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
978 // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
979 // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
980 // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
981 // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
982 // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
983 // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
984 // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
985 // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
986 // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
987 // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
988 // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
989 // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
990 // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
991 // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
992 // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
993 // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
994 // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
995 // [SPEC] UPP — PITS ProfileElement 序列 header+mf+end（最小集）
996 // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
997 // [SPEC] PE header/version — PITS asn:67-68 2/3
998 // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
999 // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
1000 // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
1001 // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
1002 // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
1003 // [HYPOTHESIS] UPP — 省略 PE-USIM：EFIMSI file is not present（4.2.7.2.1 seq#11/#12）
1004 // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
1005 // [SPEC] TC/flow — SGP.23 4.2.7.2.1 seq#11 METADATA_OP_PROF10_NO_PROFILE_OWNER（Nominal）：metadata 无 profileOwner（SGP.22 :7441 profileOwner SHALL NOT be present if no EFIMSI），Profile Package（UPP_OP_PROF10）无 EF-IMSI（结构表示＝省略 PE-USIM）→ R_PIR_OK_PROF10
1006
1007 // 步骤 93：Seq#11 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
1008 // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
1009 // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
1010 // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
1011 // S93-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
1012
1013 // 步骤 94：Seq#11 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
1014 // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
1015 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
1016 var sdCla94 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
1017 var s94 = bind.sendApdu(sdCla94, "E2", "00", "00", null, "00", "9000");
1018 bind.checkData("S94-C1 SW", "9000", s94.sw);
1019
1020 // 步骤 95：Seq#11 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
1021 // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
1022 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
1023 var sdCla95 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
1024 var s95 = bind.sendApdu(sdCla95, "E2", "00", "00", null, "00", "9000");
1025 bind.checkData("S95-C1 SW", "9000", s95.sw);
1026
1027 // 步骤 96：Seq#11 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
1028 // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
1029 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
1030 var sdCla96 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
1031 var s96 = bind.sendApdu(sdCla96, "E2", "00", "00", null, "00", "9000");
1032 bind.checkData("S96-C1 SW", "9000", s96.sw);
1033
1034 // 步骤 97：Seq#11 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_045, RQ55_048, RQ25_025, RQ25_026, RQ55_044）
1035 // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
1036 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
1037 var sdCla97 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
1038 var s97 = bind.sendApdu(sdCla97, "E2", "00", "00", null, "00", "9000");
1039 bind.checkData("S97-C1 SW", "9000", s97.sw);
1040 bind.checkData("S97-C2 SW", "9000", s97.sw);
1041 bind.checkData("S97-C2 resp present", "1", s97.resp.length > 0 ? "1" : "0");
1042 // S97-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
1043
1044 // 步骤 98：Seq#11 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
1045 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
1046 var sdCla98 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
1047 var s98 = bind.sendApdu(sdCla98, "E2", "91", "00", "BF2D0EA00C5A0A98109909002143658779", "00", "9000");
1048 bind.checkData("S98-C1 SW", "9000", s98.sw);
1049 var r2p98 = BindEs10xProcProfile.walkChoiceList(s98.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
1050 var r2has98_0 = false;
1051 for (var r2i98_0 = 0; r2i98_0 < r2p98.elements.length; r2i98_0++) {
1052 var f = r2p98.elements[r2i98_0].fields;
1053 if (f["5A"] === "98109909002143658779" && f["9F70"] === "00") { r2has98_0 = true; break; }
1054 }
1055 bind.checkData("S98-C2 contains ICCID_OP_PROF10", "1", (r2p98.branch_tag === "A0" && r2has98_0) ? "1" : "0");
1056
1057 // 步骤 99：Seq#12 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
1058 // test-tool internal preparation (no APDU face): runtime-domain
1059 // values per CaseIR unresolved (G Annex B generation rules);
1060 // no fabricated bytes emitted here.
1061
1062 // 步骤 100：Seq#12 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
1063 // BPP synthesized (4.2.7.2.1 seq#12, structural layer, SCP03t-unprotected): 916 bytes; segments: INIT=191B, A0=22B, A1=67B, A3=636B.
1064 // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
1065 // [SPEC] TC — SGP.23 4.2.7.2.1 seq#12 接线（段选择/注入面）
1066 // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
1067 // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
1068 // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
1069 // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
1070 // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
1071 // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
1072 // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
1073 // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
1074 // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
1075 // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
1076 // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
1077 // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
1078 // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
1079 // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
1080 // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
1081 // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
1082 // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
1083 // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
1084 // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
1085 // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
1086 // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
1087 // [HYPOTHESIS] BF25/B7 profileOwner — OperatorId mccMnc 值（3GPP 24.008 编码面 SPEC，值 HYPOTHESIS）
1088 // [SPEC] UPP — PITS ProfileElement 序列 header+mf+end（最小集）
1089 // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
1090 // [SPEC] PE header/version — PITS asn:67-68 2/3
1091 // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
1092 // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
1093 // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
1094 // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
1095 // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
1096 // [HYPOTHESIS] UPP — 省略 PE-USIM：EFIMSI file is not present（4.2.7.2.1 seq#11/#12）
1097 // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
1098 // [SPEC] TC/metadata-owner — SGP.23 4.2.7.2.1 seq#12 METADATA_OP_PROF10（Error）：metadata profileOwner 在场而 Profile Package（UPP_OP_PROF10）无 EF-IMSI（违反 SGP.22 :7441 profileOwner SHALL NOT be present if no EFIMSI）→ R_PIR_DATA_MISMATCH
1099
1100 // 步骤 101：Seq#12 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
1101 // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
1102 // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
1103 // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
1104 // S101-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
1105
1106 // 步骤 102：Seq#12 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
1107 // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
1108 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
1109 var sdCla102 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
1110 var s102 = bind.sendApdu(sdCla102, "E2", "00", "00", null, "00", "9000");
1111 bind.checkData("S102-C1 SW", "9000", s102.sw);
1112
1113 // 步骤 103：Seq#12 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
1114 // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
1115 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
1116 var sdCla103 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
1117 var s103 = bind.sendApdu(sdCla103, "E2", "00", "00", null, "00", "9000");
1118 bind.checkData("S103-C1 SW", "9000", s103.sw);
1119
1120 // 步骤 104：Seq#12 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
1121 // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
1122 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
1123 var sdCla104 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
1124 var s104 = bind.sendApdu(sdCla104, "E2", "00", "00", null, "00", "9000");
1125 bind.checkData("S104-C1 SW", "9000", s104.sw);
1126
1127 // 步骤 105：Seq#12 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_043, RQ55_047, RQ55_048, RQ25_025, RQ25_026, RQ31_173）
1128 // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
1129 // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
1130 var sdCla105 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
1131 var s105 = bind.sendApdu(sdCla105, "E2", "00", "00", null, "00", "9000");
1132 bind.checkData("S105-C1 SW", "9000", s105.sw);
1133 bind.checkData("S105-C1 resp present", "1", s105.resp.length > 0 ? "1" : "0");
1134 // S105-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
1135 // S105-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
1136
1137 // 步骤 106：Seq#12 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_043, RQ55_048）
1138 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
1139 var sdCla106 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
1140 var s106 = bind.sendApdu(sdCla106, "E2", "91", "00", "BF2D0EA00C5A0A98109909002143658779", "00", "9000");
1141 bind.checkData("S106-C1 SW", "9000", s106.sw);
1142 var r2p106 = BindEs10xProcProfile.walkChoiceList(s106.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
1143 bind.checkData("S106-C2 profileInfoListOk empty", "1", (r2p106.branch_tag === "A0" && r2p106.elements.length === 0) ? "1" : "0");
1144}
1145
完整 unified diff
行级差异：新增 1143 行 / 删除 764 行（以 -man 为基准，unified 上下文 3 行）。
展开 diff（1912 行）
--- -man
+++ -cas
@@ -1,766 +1,1145 @@
-// slice of Import\TestCase_SGP_23.js - cases: TC_eUICC_ES8_LoadProfileElements_01_Error_EFICCID_different_from_the_ICCID_provided_in_the_Profile_Metadata_Initial_Conditions + TC_eUICC_ES8_LoadProfileElements_02_Error_MCCMNC_of_EFIMSI_different_from_MCCMNC_of_Profile_Owner_present_in_Metadata + TC_eUICC_ES8_LoadProfileElements_03_Error_Session_MAC_chaining_used_instead_of_new_Initial_MAC_chaining + TC_eUICC_ES8_LoadProfileElements_04_Error_SMAC_used_instead_of_PPKMAC + TC_eUICC_ES8_LoadProfileElements_05_Error_SENC_used_instead_of_PPKENC + TC_eUICC_ES8_LoadProfileElements_06_Error_Profile_Downloading_stopped_by_a_Reset + TC_eUICC_ES8_LoadProfileElements_07_Nominal_ICCID_in_the_ProfileHeader_PE_is_ignored_by_the_eUICC + TC_eUICC_ES8_LoadProfileElements_08_Nominal_With_gid1_and_gid2_set + TC_eUICC_ES8_LoadProfileElements_09_Error_gid1_and_gid2_provided_in_the_Profile_Metadata_but_not_in_the_Profile_Package + TC_eUICC_ES8_LoadProfileElements_10_Error_gid1_and_gid2_not_provided_in_the_Profile_Metadata_but_present_in_the_Profile_Package (extracted verbatim)
-
-function TC_eUICC_ES8_LoadProfileElements_01_Error_EFICCID_different_from_the_ICCID_provided_in_the_Profile_Metadata_Initial_Conditions()
-{
- tracenamestr = "测试目的：执行LoadProfileElements，EFICCID与Profile元数据中提供的ICCID不同";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF2;//
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
- Profile_load_procedure.ES10b_PrepareDownload();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
- Profile_load_procedure.ES10b_GetEID();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，EFICCID与配置文件元数据中提供的ICCID不一致；");
- Profile_load_procedure.serviceProviderName = SP_NAME1;
- Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
- Profile_load_procedure.iconType = "01";
- Profile_load_procedure.icon = ICON_OP_PROF1;
- Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
- Profile_load_procedure.profileClass = "02";
- Profile_load_procedure.profilePolicyRules = "0640";
- Profile_load_procedure.mccMnc = MCC_MNC1;
-
- Profile_load_procedure.simaResponse = "";
- Profile_load_procedure.isErrorTest = true;
- Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
- Profile_load_procedure.errorReason = ErrorReason.installFailedDueToDataMismatch;
-
- Profile_load_procedure.ES10b_LoadBoundProfilePackage();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile1状态；");
- var proInfoListRequest = new ProfileInfoListRequest();
- proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
- proInfoListRequest.tagList = "5A4F9F70";
- proInfoListRequest.GenHexData();
- var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
-
- var proInfoListResponse = new ProfileInfoListResponse();
- proInfoListResponse.checkCardResDataFormat(respData);
-
- try
- {
- curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
- }catch(e){
- obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
- }
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile2状态；");
- var proInfoListRequest = new ProfileInfoListRequest();
- proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF2);
- proInfoListRequest.tagList = "5A4F9F70";
- proInfoListRequest.GenHexData();
- var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
-
- var proInfoListResponse = new ProfileInfoListResponse();
- proInfoListResponse.checkCardResDataFormat(respData);
-
- try
- {
- curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
- }catch(e){
- obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
- }
-
- RecoverCard();
-}
-
-function TC_eUICC_ES8_LoadProfileElements_02_Error_MCCMNC_of_EFIMSI_different_from_MCCMNC_of_Profile_Owner_present_in_Metadata ()
-{
- tracenamestr = "测试目的：执行LoadProfileElements，EFIMSI中的MCC/MNC与元数据中存在的Profile Owner的MCC/MNC不同";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;//
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
- Profile_load_procedure.ES10b_PrepareDownload();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
- Profile_load_procedure.ES10b_GetEID();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，EFIMSI里的MCC/MNC与元数据中Profile Owner的MCC/MNC不一致；");
- Profile_load_procedure.serviceProviderName = SP_NAME1;
- Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
- Profile_load_procedure.iconType = "01";
- Profile_load_procedure.icon = ICON_OP_PROF1;
- Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
- Profile_load_procedure.profileClass = "02";
- Profile_load_procedure.profilePolicyRules = "0640";
- Profile_load_procedure.mccMnc = MCC_MNC2;
-
- Profile_load_procedure.simaResponse = "";
- Profile_load_procedure.isErrorTest = true;
- Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
- Profile_load_procedure.errorReason = ErrorReason.installFailedDueToDataMismatch;
-
- Profile_load_procedure.ES10b_LoadBoundProfilePackage();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile1状态；");
- var proInfoListRequest = new ProfileInfoListRequest();
- proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
- proInfoListRequest.tagList = "5A4F9F70";
- proInfoListRequest.GenHexData();
- var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
-
- var proInfoListResponse = new ProfileInfoListResponse();
- proInfoListResponse.checkCardResDataFormat(respData);
-
- try
- {
- curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
- }catch(e){
- obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
- }
-
- RecoverCard();
-}
-
-function TC_eUICC_ES8_LoadProfileElements_03_Error_Session_MAC_chaining_used_instead_of_new_Initial_MAC_chaining()
-{
- tracenamestr = "测试目的：执行LoadProfileElements，使用会话MAC链代替新的初始MAC链";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
- Profile_load_procedure.ES10b_PrepareDownload();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
- Profile_load_procedure.ES10b_GetEID();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，ReplaceSessionKeysRequest用会话MAC值替换新的初始化MAC值；");
- Profile_load_procedure.serviceProviderName = SP_NAME1;
- Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
- Profile_load_procedure.iconType = "01";
- Profile_load_procedure.icon = ICON_OP_PROF1;
- Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
- Profile_load_procedure.profileClass = "02";
- Profile_load_procedure.profilePolicyRules = "0640";
- Profile_load_procedure.mccMnc = MCC_MNC1;
-
- Profile_load_procedure.UsePPK = true;
- Profile_load_procedure.ErrorDataMac = true;
-
- Profile_load_procedure.simaResponse = "";
- Profile_load_procedure.isErrorTest = true;
- Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
- Profile_load_procedure.errorReason = ErrorReason.scp03tSecurityError + "/" + ErrorReason.incorrectInputValues + "/" + ErrorReason.scp03tStructureError;
- Profile_load_procedure.ES10b_LoadBoundProfilePackage();
-
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile状态；");
- var proInfoListRequest = new ProfileInfoListRequest();
- proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
- proInfoListRequest.tagList = "5A4F9F70";
- proInfoListRequest.GenHexData();
- var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
-
- var proInfoListResponse = new ProfileInfoListResponse();
- proInfoListResponse.checkCardResDataFormat(respData);
-
- try
- {
- curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
- }catch(e){
- obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
- }
-
- RecoverCard();
-}
-
-function TC_eUICC_ES8_LoadProfileElements_04_Error_SMAC_used_instead_of_PPKMAC()
-{
- tracenamestr = "测试目的：执行LoadProfileElements，使用S-MAC代替PPK-MAC";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
- Profile_load_procedure.ES10b_PrepareDownload();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
- Profile_load_procedure.ES10b_GetEID();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，ReplaceSessionKeysRequest用S-MAC替换值PPK-MAC; ");
- Profile_load_procedure.serviceProviderName = SP_NAME1;
- Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
- Profile_load_procedure.iconType = "01";
- Profile_load_procedure.icon = ICON_OP_PROF1;
- Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
- Profile_load_procedure.profileClass = "02";
- Profile_load_procedure.profilePolicyRules = "0640";
- Profile_load_procedure.mccMnc = MCC_MNC1;
-
- Profile_load_procedure.UsePPK = true;
- Profile_load_procedure.ErrorSessionMAC = true;
-
- Profile_load_procedure.simaResponse = "";
- Profile_load_procedure.isErrorTest = true;
- Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
- Profile_load_procedure.errorReason = ErrorReason.scp03tSecurityError + "/" + ErrorReason.incorrectInputValues + "/" + ErrorReason.scp03tStructureError;
- Profile_load_procedure.ES10b_LoadBoundProfilePackage();
-
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile状态；");
- var proInfoListRequest = new ProfileInfoListRequest();
- proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
- proInfoListRequest.tagList = "5A4F9F70";
- proInfoListRequest.GenHexData();
- var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
-
- var proInfoListResponse = new ProfileInfoListResponse();
- proInfoListResponse.checkCardResDataFormat(respData);
-
- try
- {
- curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
- }catch(e){
- obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
- }
-
- RecoverCard();
-}
-
-function TC_eUICC_ES8_LoadProfileElements_05_Error_SENC_used_instead_of_PPKENC()
-{
- tracenamestr = "测试目的：执行LoadProfileElements，使用S-ENC代替PPK-ENC";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
- Profile_load_procedure.ES10b_PrepareDownload();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
- Profile_load_procedure.ES10b_GetEID();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，ReplaceSessionKeysRequest用S-ENC替换PPK-ENC值; ; ");
- Profile_load_procedure.serviceProviderName = SP_NAME1;
- Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
- Profile_load_procedure.iconType = "01";
- Profile_load_procedure.icon = ICON_OP_PROF1;
- Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
- Profile_load_procedure.profileClass = "02";
- Profile_load_procedure.profilePolicyRules = "0640";
- Profile_load_procedure.mccMnc = MCC_MNC1;
-
- Profile_load_procedure.UsePPK = true;
- Profile_load_procedure.ErrorSessionENC = true;
-
- Profile_load_procedure.simaResponse = "";
- Profile_load_procedure.isErrorTest = true;
- Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
- Profile_load_procedure.errorReason = ErrorReason.scp03tSecurityError + "/" + ErrorReason.incorrectInputValues + "/" + ErrorReason.scp03tStructureError;
- Profile_load_procedure.ES10b_LoadBoundProfilePackage();
-
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile状态；");
- var proInfoListRequest = new ProfileInfoListRequest();
- proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
- proInfoListRequest.tagList = "5A4F9F70";
- proInfoListRequest.GenHexData();
- var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
-
- var proInfoListResponse = new ProfileInfoListResponse();
- proInfoListResponse.checkCardResDataFormat(respData);
-
- try
- {
- curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
- }catch(e){
- obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
- }
-
- RecoverCard();
-}
-
-function TC_eUICC_ES8_LoadProfileElements_06_Error_Profile_Downloading_stopped_by_a_Reset()
-{
- tracenamestr = "测试目的：执行LoadProfileElements，Profile下载因复位而停止";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
- Profile_load_procedure.ES10b_PrepareDownload();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
- Profile_load_procedure.ES10b_GetEID();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，Profile下载过程中被卡复位中断/终止; ");
- Profile_load_procedure.serviceProviderName = SP_NAME1;
- Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
- Profile_load_procedure.iconType = "01";
- Profile_load_procedure.icon = ICON_OP_PROF1;
- Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
- Profile_load_procedure.profileClass = "02";
- Profile_load_procedure.profilePolicyRules = "0640";
- Profile_load_procedure.mccMnc = MCC_MNC1;
- Profile_load_procedure.LoadRemainder=1;
- Profile_load_procedure.ES10b_LoadBoundProfilePackage();
-
-
- curLogicChannel = 0;
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile状态；");
- var proInfoListRequest = new ProfileInfoListRequest();
- proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
- proInfoListRequest.tagList = "5A4F9F70";
- proInfoListRequest.GenHexData();
- var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
-
- var proInfoListResponse = new ProfileInfoListResponse();
- proInfoListResponse.checkCardResDataFormat(respData);
-
- try
- {
- curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
- }catch(e){
- obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
- }
-
- RecoverCard();
-}
-
-function TC_eUICC_ES8_LoadProfileElements_07_Nominal_ICCID_in_the_ProfileHeader_PE_is_ignored_by_the_eUICC()
-{
- tracenamestr = "测试目的：eUICC忽略‘ProfileHeader’ PE中的ICCID";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL_DATA_TEST_ProfileHeader_PE_ICCID);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
- Profile_load_procedure.ES10b_PrepareDownload();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
- Profile_load_procedure.ES10b_GetEID();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage");
- Profile_load_procedure.serviceProviderName = SP_NAME1;
- Profile_load_procedure.profileName = PROFILE_OPERATIONAL1_NAME1;
- Profile_load_procedure.iconType = "01";
- Profile_load_procedure.icon = ICON_OP_PROF1;
- Profile_load_procedure.notificationConfigurationInfo = new SequenceOfElement("30");
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0] = new NotificationConfigurationInformation();
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].profileManagementOperation = "04F0";
- Profile_load_procedure.notificationConfigurationInfo.arrOfElement[0].notificationAddress = TEST_DP_ADDRESS1;
- Profile_load_procedure.profileOwner = OWNER_OP_PROF1;
- Profile_load_procedure.profileClass = "02";
- Profile_load_procedure.mccMnc = MCC_MNC1;
- Profile_load_procedure.ES10b_LoadBoundProfilePackage();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile信息；");
- var proInfoListRequest = new ProfileInfoListRequest();
- proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
- proInfoListRequest.tagList = "5A4F9F70";
- proInfoListRequest.GenHexData();
- var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
-
- var proInfoListResponse = new ProfileInfoListResponse();
- proInfoListResponse.checkCardResDataFormat(respData);
-
- try
- {
- curStrHandle.CheckData(ICCID_OP_PROF1, proInfoListResponse.profileInfoListOk.arrOfElement[0].iccid, "ICCID");
- curStrHandle.CheckData(curProfile_ISD_P_AID, proInfoListResponse.profileInfoListOk.arrOfElement[0].isdpAid, "ISD-P AID");
- curStrHandle.CheckData(Profile_DISABLED, proInfoListResponse.profileInfoListOk.arrOfElement[0].profileState, "profile State");
- }catch(e){
- obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
- }
-
-
- RecoverCard();
-}
-
-function TC_eUICC_ES8_LoadProfileElements_08_Nominal_With_gid1_and_gid2_set()
-{
- tracenamestr = "测试目的：验证设置了gid1和gid2的Operational Profile可以下载到eUICC";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL9_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF9;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
- Profile_load_procedure.ES10b_PrepareDownload();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
- Profile_load_procedure.ES10b_GetEID();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，配置了gid1 和 gid2；");
- Profile_load_procedure.serviceProviderName = SP_NAME9;
- Profile_load_procedure.profileName = NAME_OP_PROF9;
- Profile_load_procedure.profilePolicyRules = "0520";
- Profile_load_procedure.mccMnc = MCC_MNC9;
- Profile_load_procedure.UseGid = true;
- Profile_load_procedure.gid1 = GID1;
- Profile_load_procedure.gid2 = GID2;
- Profile_load_procedure.ES10b_LoadBoundProfilePackage();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile信息；");
- var proInfoListRequest = new ProfileInfoListRequest();
- proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF9);
- proInfoListRequest.tagList = "B7";
- proInfoListRequest.GenHexData();
- var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
-
- var proInfoListResponse = new ProfileInfoListResponse();
- proInfoListResponse.checkCardResDataFormat(respData);
-
- try
- {
- curStrHandle.CheckData(MCC_MNC9, proInfoListResponse.profileInfoListOk.arrOfElement[0].profileOwner.mccMnc, "mccMnc");
- curStrHandle.CheckData(GID1, proInfoListResponse.profileInfoListOk.arrOfElement[0].profileOwner.gid1, "gid1");
- curStrHandle.CheckData(GID2, proInfoListResponse.profileInfoListOk.arrOfElement[0].profileOwner.gid2, "gid2");
- }catch(e){
- obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
- }
-
-
- RecoverCard();
-}
-
-function TC_eUICC_ES8_LoadProfileElements_09_Error_gid1_and_gid2_provided_in_the_Profile_Metadata_but_not_in_the_Profile_Package ()
-{
- tracenamestr = "测试目的：验证如果Profile元数据中提供了gid1和gid2，但ef-gid1和ef-gid2不存在，ef-ust中的相关服务（17和18）不可用，eUICC会在LoadProfileElements过程中返回错误";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
- Profile_load_procedure.ES10b_PrepareDownload();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
- Profile_load_procedure.ES10b_GetEID();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，GID1和GID2出现在Profile Metadata（元数据）里，但在Profile Package（BPP）里却没有;");
- Profile_load_procedure.serviceProviderName = SP_NAME1;
- Profile_load_procedure.profileName = NAME_OP_PROF1;
- Profile_load_procedure.profilePolicyRules = "0520";
- Profile_load_procedure.mccMnc = MCC_MNC1;
- Profile_load_procedure.UseGid = true;
- Profile_load_procedure.gid1 = GID1;
- Profile_load_procedure.gid2 = GID2;
-
- Profile_load_procedure.isErrorTest = true;
- Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
- Profile_load_procedure.simaResponse="";
- Profile_load_procedure.errorReason = ErrorReason.installFailedDueToDataMismatch;
-
- Profile_load_procedure.ES10b_LoadBoundProfilePackage();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile状态；");
- var proInfoListRequest = new ProfileInfoListRequest();
- proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF1);
- proInfoListRequest.tagList = "5A4F9F70";
- proInfoListRequest.GenHexData();
- var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
-
- var proInfoListResponse = new ProfileInfoListResponse();
- proInfoListResponse.checkCardResDataFormat(respData);
-
- try
- {
- curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
- }catch(e){
- obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
- }
-
- RecoverCard();
-
-
-}
-
-function TC_eUICC_ES8_LoadProfileElements_10_Error_gid1_and_gid2_not_provided_in_the_Profile_Metadata_but_present_in_the_Profile_Package ()
-{
- tracenamestr = "测试目的：验证如果Profile元数据中未提供gid1和gid2，但ef-gid1和ef-gid2中存在，ef-ust中的相关服务（17和18）可用，eUICC会在LoadProfileElements过程中返回错误";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL9_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF9;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
- Profile_load_procedure.ES10b_PrepareDownload();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
- Profile_load_procedure.ES10b_GetEID();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，GID1和GID2出现在Profile Package（BPP）里,,但在Profile Metadata（元数据）里却没有;");
- Profile_load_procedure.serviceProviderName = SP_NAME9;
- Profile_load_procedure.profileName = NAME_OP_PROF9;
- Profile_load_procedure.profilePolicyRules = "0520";
- Profile_load_procedure.mccMnc = MCC_MNC9;
-
-
- Profile_load_procedure.isErrorTest = true;
- Profile_load_procedure.bppCommandId = BppCommandId.loadProfileElements;
- Profile_load_procedure.simaResponse="";
- Profile_load_procedure.errorReason = ErrorReason.installFailedDueToDataMismatch;
-
- Profile_load_procedure.ES10b_LoadBoundProfilePackage();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行ProfileInfoListRequest，获取profile状态；");
- var proInfoListRequest = new ProfileInfoListRequest();
- proInfoListRequest.searchCriteria = new ChoiceObj(tagOfsearchCriteria_ProfileInfo.iccid,ICCID_OP_PROF9);
- proInfoListRequest.tagList = "5A4F9F70";
- proInfoListRequest.GenHexData();
- var respData = LPAd_Transport_data_to_eUICC(proInfoListRequest.hexData);
-
- var proInfoListResponse = new ProfileInfoListResponse();
- proInfoListResponse.checkCardResDataFormat(respData);
-
- try
- {
- curStrHandle.CheckData("00", obj.ToHex(proInfoListResponse.profileInfoListOk.arrOfElement.length),"Profile Info number");
- }catch(e){
- obj.SubLevel(ProfileInfoListResponse_Data_Error, level_of_SubLevel.error);
- }
-
- RecoverCard();
-
-
+// Author: 卡思Cas智能体
+// Date: 20261005-152741
+// Function: （purpose 原文未由 SGP.23 该 TC 提供，corpus vacuum 登记）TC_eUICC_ES8+.LoadProfileElements，Test Sequence #01–#12（#01-#06/#09/#10/#12 Error、#07/#08/#11 Nominal）；B 表两行：#11/#12 仅 V2.5+ C064 行 + 全版本 M 行，适用性 M。
+// Test points: S4-C1 SW；S5-C1 SW；S6-C1 SW；S7-C1 SW；S7-C1 resp present；S8-C1 SW
+// S8-C2 profileInfoListOk empty；S9-C1 SW；S9-C2 profileInfoListOk empty；S13-C1 SW；S14-C1 SW
+// S15-C1 SW；S16-C1 SW；S16-C1 resp present；S17-C1 SW；S17-C2 profileInfoListOk empty；S21-C1 SW
+// S22-C1 SW；S23-C1 SW；S24-C1 SW；S25-C1 SW；S25-C1 resp present；S26-C1 SW
+// S26-C2 profileInfoListOk empty；S30-C1 SW；S31-C1 SW；S32-C1 SW；S33-C1 SW；S34-C1 SW
+// S34-C1 resp present；S35-C1 SW；S35-C2 profileInfoListOk empty；S39-C1 SW；S40-C1 SW；S41-C1 SW
+// S42-C1 SW；S43-C1 SW；S43-C1 resp present；S44-C1 SW；S44-C2 profileInfoListOk empty；S48-C1 SW
+// S49-C1 SW；S50-C1 SW；S51-C1 SW；S52-C1 ATR_present；S53-C2 FCP_Template；S53-C1 SW；S54-C1 SW
+// S55-C1 final SW；S56-C1 SW；S56-C2 CHANNEL_NUMBER extracted；S57-C1 SW；S58-C1 SW
+// S58-C2 profileInfoListOk empty；S62-C1 SW；S63-C1 SW；S64-C1 SW；S65-C1 SW；S65-C2 SW
+// S65-C2 resp present；S66-C1 SW；S66-C2 contains ICCID_OP_PROF1；S70-C1 SW；S71-C1 SW；S72-C1 SW
+// S73-C1 SW；S73-C2 SW；S73-C2 resp present；S74-C1 SW；S74-C2 profileOwner mccMnc/gid1/gid2 present
+// S78-C1 SW；S79-C1 SW；S80-C1 SW；S81-C1 SW；S81-C1 resp present；S82-C1 SW
+// S82-C2 profileInfoListOk empty；S86-C1 SW；S87-C1 SW；S88-C1 SW；S89-C1 SW；S89-C1 resp present
+// S90-C1 SW；S90-C2 profileInfoListOk empty；S94-C1 SW；S95-C1 SW；S96-C1 SW；S97-C1 SW；S97-C2 SW
+// S97-C2 resp present；S98-C1 SW；S98-C2 contains ICCID_OP_PROF10；S102-C1 SW；S103-C1 SW；S104-C1 SW
+// S105-C1 SW；S105-C1 resp present；S106-C1 SW；S106-C2 profileInfoListOk empty
+// 本函数由 CaseIR 4.2.7.2.1 编译生成（fullwave-blindgen-live-70，SGP.23 v1.16 × SGP.22 v2.7）：字节权威=CaseIR，非誊录黄金脚本。
+// Value-free template: every data byte is injected from CaseIR fields; no scaffold globals (see docs/speconly/compile-symbol-migration.md).
+// 适用性 M：编译期门，运行时由 harness 环境前置承担。
+function TC_eUICC_ES8_LoadProfileElements_01_12_01_06_09_10_12_07_08_11_11_12_merged() {
+ var bind = curBind;
+ // GIC 通信初始化+ISD-R 选择+相互认证+End User Confirmation+PrepareDownload（#PREP_DOWNLOAD_NO_CC）: declared unexpanded (non-PROC row or K corpus vacuum; see CaseIR open_items).
+
+ // 步骤 1：Seq#01 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+ // test-tool internal preparation (no APDU face): runtime-domain
+ // values per CaseIR unresolved (G Annex B generation rules);
+ // no fabricated bytes emitted here.
+
+ // 步骤 2：Seq#01 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+ // BPP synthesized (4.2.7.2.1 seq#1, structural layer, SCP03t-unprotected): 1067 bytes; segments: INIT=191B, A0=22B, A1=58B, A3=796B.
+ // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+ // [SPEC] TC — SGP.23 4.2.7.2.1 seq#1 接线（段选择/注入面）
+ // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+ // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+ // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+ // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+ // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+ // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+ // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+ // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+ // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+ // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+ // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+ // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+ // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+ // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+ // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+ // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+ // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+ // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+ // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+ // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+ // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+ // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
+ // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+ // [SPEC] PE header/version — PITS asn:67-68 2/3
+ // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+ // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+ // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+ // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+ // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+ // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
+ // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
+ // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+ // [SPEC] TC/mismatch — SGP.23 4.2.7.2.1 seq#1 METADATA_ICCID_MISMATCH：故意错配注入（metadata vs UPP EF；值 HYPOTHESIS——首字节翻转参数化）
+
+ // 步骤 3：Seq#01 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
+ // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
+ // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
+ // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
+ // S3-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
+
+ // 步骤 4：Seq#01 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s4 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S4-C1 SW", "9000", s4.sw);
+
+ // 步骤 5：Seq#01 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s5 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S5-C1 SW", "9000", s5.sw);
+
+ // 步骤 6：Seq#01 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s6 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S6-C1 SW", "9000", s6.sw);
+
+ // 步骤 7：Seq#01 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_045, RQ55_048, RQ25_025, RQ25_026, RQ31_173）
+ // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s7 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S7-C1 SW", "9000", s7.sw);
+ bind.checkData("S7-C1 resp present", "1", s7.resp.length > 0 ? "1" : "0");
+ // S7-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+ // S7-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+
+ // 步骤 8：Seq#01 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var s8 = bind.sendApdu(null, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
+ bind.checkData("S8-C1 SW", "9000", s8.sw);
+ var r2p8 = BindEs10xProcProfile.walkChoiceList(s8.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+ bind.checkData("S8-C2 profileInfoListOk empty", "1", (r2p8.branch_tag === "A0" && r2p8.elements.length === 0) ? "1" : "0");
+
+ // 步骤 9：Seq#01 3: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var s9 = bind.sendApdu(null, "E2", "91", "00", "BF2D0EA00C5A0A989209013254769810F9", "00", "9000");
+ bind.checkData("S9-C1 SW", "9000", s9.sw);
+ var r2p9 = BindEs10xProcProfile.walkChoiceList(s9.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+ bind.checkData("S9-C2 profileInfoListOk empty", "1", (r2p9.branch_tag === "A0" && r2p9.elements.length === 0) ? "1" : "0");
+
+ // 步骤 10：Seq#02 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+ // test-tool internal preparation (no APDU face): runtime-domain
+ // values per CaseIR unresolved (G Annex B generation rules);
+ // no fabricated bytes emitted here.
+
+ // 步骤 11：Seq#02 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+ // BPP synthesized (4.2.7.2.1 seq#2, structural layer, SCP03t-unprotected): 1076 bytes; segments: INIT=191B, A0=22B, A1=67B, A3=796B.
+ // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+ // [SPEC] TC — SGP.23 4.2.7.2.1 seq#2 接线（段选择/注入面）
+ // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+ // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+ // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+ // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+ // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+ // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+ // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+ // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+ // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+ // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+ // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+ // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+ // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+ // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+ // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+ // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+ // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+ // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+ // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+ // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+ // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+ // [HYPOTHESIS] BF25/B7 profileOwner — OperatorId mccMnc 值（3GPP 24.008 编码面 SPEC，值 HYPOTHESIS）
+ // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
+ // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+ // [SPEC] PE header/version — PITS asn:67-68 2/3
+ // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+ // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+ // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+ // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+ // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+ // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
+ // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
+ // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+ // [SPEC] TC/mismatch — SGP.23 4.2.7.2.1 seq#2 METADATA_MCCMNC_MISMATCH：故意错配注入（metadata vs UPP EF；值 HYPOTHESIS——首字节翻转参数化）
+
+ // 步骤 12：Seq#02 IC3: Execute the step IC3 of the Test Sequence #01 defined in this section（切分）（tc_step）
+ // cross-sequence IC execution reference (R2 materialized form): referenced IC declaration emitted in its source sequence; no re-expansion, no fabricated bytes here.
+ // BPP segment partitioning follows bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 segment table; single source of segmentation knowledge).
+ // S12-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
+
+ // 步骤 13：Seq#02 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s13 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S13-C1 SW", "9000", s13.sw);
+
+ // 步骤 14：Seq#02 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s14 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S14-C1 SW", "9000", s14.sw);
+
+ // 步骤 15：Seq#02 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s15 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S15-C1 SW", "9000", s15.sw);
+
+ // 步骤 16：Seq#02 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_043, RQ55_047, RQ55_048, RQ25_025, RQ25_026, RQ31_173）
+ // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s16 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S16-C1 SW", "9000", s16.sw);
+ bind.checkData("S16-C1 resp present", "1", s16.resp.length > 0 ? "1" : "0");
+ // S16-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+ // S16-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+
+ // 步骤 17：Seq#02 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_043, RQ55_048）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var s17 = bind.sendApdu(null, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
+ bind.checkData("S17-C1 SW", "9000", s17.sw);
+ var r2p17 = BindEs10xProcProfile.walkChoiceList(s17.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+ bind.checkData("S17-C2 profileInfoListOk empty", "1", (r2p17.branch_tag === "A0" && r2p17.elements.length === 0) ? "1" : "0");
+
+ // 步骤 18：Seq#03 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+ // test-tool internal preparation (no APDU face): runtime-domain
+ // values per CaseIR unresolved (G Annex B generation rules);
+ // no fabricated bytes emitted here.
+
+ // 步骤 19：Seq#03 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+ // BPP synthesized (4.2.7.2.1 seq#3, structural layer, SCP03t-unprotected): 1128 bytes; segments: INIT=191B, A0=22B, A1=58B, A2=61B, A3=796B.
+ // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+ // [SPEC] TC — SGP.23 4.2.7.2.1 seq#3 接线（段选择/注入面）
+ // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+ // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+ // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+ // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+ // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+ // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+ // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+ // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+ // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+ // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+ // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+ // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+ // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+ // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+ // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+ // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+ // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+ // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+ // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+ // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+ // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+ // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
+ // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+ // [SPEC] PE header/version — PITS asn:67-68 2/3
+ // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+ // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+ // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+ // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+ // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+ // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
+ // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
+ // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+ // [SPEC] BF36/A2 — Table 4 :1593 secondSequenceOf87
+ // [SPEC] BF26 — SGP.22 §5.5.4 :7481 ReplaceSessionKeysRequest [38]
+ // [HYPOTHESIS] BF26/04 initialMacChainingValue — 自定随机值
+ // [HYPOTHESIS] BF26/04 ppkEnc — 自定随机值
+ // [HYPOTHESIS] BF26/04 ppkCmac — 自定随机值
+ // [SPEC] TC/override — SGP.23 4.2.7.2.1 seq#3：MTD_GENERATE_BPP override —— <S_MAC_CHAIN> SHALL be used instead of <PPK_INIT_MAC> for UPP SCP03t protection（E 表 :78）。结构层仅发 A2 ReplaceSessionKeys（BF26）段，PPK 值为 HYPOTHESIS（Annex E 缺席）；SCP03t MAC/ENC 链属会话层（后续 lane）
+ // [SPEC] TC/ppk — SGP.23 表4211 seq#02：PPK-ENC/PPK-MAC 面（A2 ReplaceSessionKeys 在场，DEFAULT_PPK 值 HYPOTHESIS——Annex E 缺席）
+ // S19-C1: binding:bpp_override_rule_carried_by_synthesis_contract(bpp_injection-provenance) (check_attestation)
+
+ // 步骤 20：Seq#03 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A2>, <BPP_SEG_A3>（tc_step）
+ // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A2>, <BPP_SEG_A3>.
+ // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
+ // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
+ // S20-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
+
+ // 步骤 21：Seq#03 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s21 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S21-C1 SW", "9000", s21.sw);
+
+ // 步骤 22：Seq#03 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s22 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S22-C1 SW", "9000", s22.sw);
+
+ // 步骤 23：Seq#03 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s23 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S23-C1 SW", "9000", s23.sw);
+
+ // 步骤 24：Seq#03 IC7: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A2> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s24 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S24-C1 SW", "9000", s24.sw);
+
+ // 步骤 25：Seq#03 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ25_025, RQ25_026, RQ55_048, RQ31_173）
+ // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s25 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S25-C1 SW", "9000", s25.sw);
+ bind.checkData("S25-C1 resp present", "1", s25.resp.length > 0 ? "1" : "0");
+ // S25-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+
+ // 步骤 26：Seq#03 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var s26 = bind.sendApdu(null, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
+ bind.checkData("S26-C1 SW", "9000", s26.sw);
+ var r2p26 = BindEs10xProcProfile.walkChoiceList(s26.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+ bind.checkData("S26-C2 profileInfoListOk empty", "1", (r2p26.branch_tag === "A0" && r2p26.elements.length === 0) ? "1" : "0");
+
+ // 步骤 27：Seq#04 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+ // test-tool internal preparation (no APDU face): runtime-domain
+ // values per CaseIR unresolved (G Annex B generation rules);
+ // no fabricated bytes emitted here.
+
+ // 步骤 28：Seq#04 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+ // BPP synthesized (4.2.7.2.1 seq#4, structural layer, SCP03t-unprotected): 1128 bytes; segments: INIT=191B, A0=22B, A1=58B, A2=61B, A3=796B.
+ // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+ // [SPEC] TC — SGP.23 4.2.7.2.1 seq#4 接线（段选择/注入面）
+ // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+ // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+ // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+ // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+ // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+ // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+ // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+ // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+ // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+ // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+ // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+ // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+ // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+ // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+ // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+ // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+ // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+ // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+ // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+ // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+ // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+ // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
+ // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+ // [SPEC] PE header/version — PITS asn:67-68 2/3
+ // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+ // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+ // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+ // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+ // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+ // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
+ // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
+ // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+ // [SPEC] BF36/A2 — Table 4 :1593 secondSequenceOf87
+ // [SPEC] BF26 — SGP.22 §5.5.4 :7481 ReplaceSessionKeysRequest [38]
+ // [HYPOTHESIS] BF26/04 initialMacChainingValue — 自定随机值
+ // [HYPOTHESIS] BF26/04 ppkEnc — 自定随机值
+ // [HYPOTHESIS] BF26/04 ppkCmac — 自定随机值
+ // [SPEC] TC/override — SGP.23 4.2.7.2.1 seq#4：MTD_GENERATE_BPP override —— <S_MAC> SHALL be used instead of <PPK_MAC> for UPP SCP03t protection（E 表 :94）。结构层与 seq#3 同构（名义 metadata + A2 ReplaceSessionKeys BF26 段）；S-MAC 属 SCP03t 会话层（后续 lane）
+ // [SPEC] TC/ppk — SGP.23 表4211 seq#02：PPK-ENC/PPK-MAC 面（A2 ReplaceSessionKeys 在场，DEFAULT_PPK 值 HYPOTHESIS——Annex E 缺席）
+ // S28-C1: binding:bpp_override_rule_carried_by_synthesis_contract(bpp_injection-provenance) (check_attestation)
+
+ // 步骤 29：Seq#04 IC3: Execute the step IC3 of the Test Sequence #03 defined in this section（切分）（tc_step）
+ // cross-sequence IC execution reference (R2 materialized form): referenced IC declaration emitted in its source sequence; no re-expansion, no fabricated bytes here.
+ // BPP segment partitioning follows bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 segment table; single source of segmentation knowledge).
+ // S29-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
+
+ // 步骤 30：Seq#04 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s30 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S30-C1 SW", "9000", s30.sw);
+
+ // 步骤 31：Seq#04 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s31 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S31-C1 SW", "9000", s31.sw);
+
+ // 步骤 32：Seq#04 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s32 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S32-C1 SW", "9000", s32.sw);
+
+ // 步骤 33：Seq#04 IC7: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A2> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s33 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S33-C1 SW", "9000", s33.sw);
+
+ // 步骤 34：Seq#04 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ25_025, RQ25_026, RQ55_048, RQ31_173）
+ // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s34 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S34-C1 SW", "9000", s34.sw);
+ bind.checkData("S34-C1 resp present", "1", s34.resp.length > 0 ? "1" : "0");
+ // S34-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+
+ // 步骤 35：Seq#04 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var s35 = bind.sendApdu(null, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
+ bind.checkData("S35-C1 SW", "9000", s35.sw);
+ var r2p35 = BindEs10xProcProfile.walkChoiceList(s35.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+ bind.checkData("S35-C2 profileInfoListOk empty", "1", (r2p35.branch_tag === "A0" && r2p35.elements.length === 0) ? "1" : "0");
+
+ // 步骤 36：Seq#05 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+ // test-tool internal preparation (no APDU face): runtime-domain
+ // values per CaseIR unresolved (G Annex B generation rules);
+ // no fabricated bytes emitted here.
+
+ // 步骤 37：Seq#05 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+ // BPP synthesized (4.2.7.2.1 seq#5, structural layer, SCP03t-unprotected): 1128 bytes; segments: INIT=191B, A0=22B, A1=58B, A2=61B, A3=796B.
+ // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+ // [SPEC] TC — SGP.23 4.2.7.2.1 seq#5 接线（段选择/注入面）
+ // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+ // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+ // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+ // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+ // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+ // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+ // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+ // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+ // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+ // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+ // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+ // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+ // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+ // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+ // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+ // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+ // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+ // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+ // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+ // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+ // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+ // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
+ // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+ // [SPEC] PE header/version — PITS asn:67-68 2/3
+ // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+ // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+ // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+ // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+ // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+ // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
+ // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
+ // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+ // [SPEC] BF36/A2 — Table 4 :1593 secondSequenceOf87
+ // [SPEC] BF26 — SGP.22 §5.5.4 :7481 ReplaceSessionKeysRequest [38]
+ // [HYPOTHESIS] BF26/04 initialMacChainingValue — 自定随机值
+ // [HYPOTHESIS] BF26/04 ppkEnc — 自定随机值
+ // [HYPOTHESIS] BF26/04 ppkCmac — 自定随机值
+ // [SPEC] TC/override — SGP.23 4.2.7.2.1 seq#5：MTD_GENERATE_BPP override —— <S_ENC> SHALL be used instead of <PPK_ENC> for UPP SCP03t protection（E 表 :110）。结构层与 seq#3 同构（名义 metadata + A2 ReplaceSessionKeys BF26 段）；S-ENC 属 SCP03t 会话层（后续 lane）
+ // [SPEC] TC/ppk — SGP.23 表4211 seq#02：PPK-ENC/PPK-MAC 面（A2 ReplaceSessionKeys 在场，DEFAULT_PPK 值 HYPOTHESIS——Annex E 缺席）
+ // S37-C1: binding:bpp_override_rule_carried_by_synthesis_contract(bpp_injection-provenance) (check_attestation)
+
+ // 步骤 38：Seq#05 IC3: Execute the step IC3 of the Test Sequence #03 defined in this section（切分）（tc_step）
+ // cross-sequence IC execution reference (R2 materialized form): referenced IC declaration emitted in its source sequence; no re-expansion, no fabricated bytes here.
+ // BPP segment partitioning follows bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 segment table; single source of segmentation knowledge).
+ // S38-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
+
+ // 步骤 39：Seq#05 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s39 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S39-C1 SW", "9000", s39.sw);
+
+ // 步骤 40：Seq#05 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s40 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S40-C1 SW", "9000", s40.sw);
+
+ // 步骤 41：Seq#05 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s41 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S41-C1 SW", "9000", s41.sw);
+
+ // 步骤 42：Seq#05 IC7: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A2> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s42 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S42-C1 SW", "9000", s42.sw);
+
+ // 步骤 43：Seq#05 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ25_025, RQ25_026, RQ55_048, RQ31_173）
+ // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s43 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S43-C1 SW", "9000", s43.sw);
+ bind.checkData("S43-C1 resp present", "1", s43.resp.length > 0 ? "1" : "0");
+ // S43-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+
+ // 步骤 44：Seq#05 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var s44 = bind.sendApdu(null, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
+ bind.checkData("S44-C1 SW", "9000", s44.sw);
+ var r2p44 = BindEs10xProcProfile.walkChoiceList(s44.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+ bind.checkData("S44-C2 profileInfoListOk empty", "1", (r2p44.branch_tag === "A0" && r2p44.elements.length === 0) ? "1" : "0");
+
+ // 步骤 45：Seq#06 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+ // test-tool internal preparation (no APDU face): runtime-domain
+ // values per CaseIR unresolved (G Annex B generation rules);
+ // no fabricated bytes emitted here.
+
+ // 步骤 46：Seq#06 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+ // BPP synthesized (4.2.7.2.1 seq#6, structural layer, SCP03t-unprotected): 1067 bytes; segments: INIT=191B, A0=22B, A1=58B, A3=796B.
+ // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+ // [SPEC] TC — SGP.23 4.2.7.2.1 seq#6 接线（段选择/注入面）
+ // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+ // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+ // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+ // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+ // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+ // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+ // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+ // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+ // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+ // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+ // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+ // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+ // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+ // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+ // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+ // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+ // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+ // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+ // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+ // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+ // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+ // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
+ // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+ // [SPEC] PE header/version — PITS asn:67-68 2/3
+ // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+ // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+ // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+ // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+ // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+ // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
+ // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
+ // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+ // [SPEC] TC/flow — SGP.23 4.2.7.2.1 seq#6：名义 BPP（METADATA_OP_PROF1 + UPP_OP_PROF1，NO_PARAM）；下载中途被 Reset 打断（Reset／重初始化过程为后续独立步），结构层零注入
+
+ // 步骤 47：Seq#06 IC3: Execute the step IC3 of the Test Sequence #01 defined in this section（切分）（tc_step）
+ // cross-sequence IC execution reference (R2 materialized form): referenced IC declaration emitted in its source sequence; no re-expansion, no fabricated bytes here.
+ // BPP segment partitioning follows bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 segment table; single source of segmentation knowledge).
+ // S47-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
+
+ // 步骤 48：Seq#06 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s48 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S48-C1 SW", "9000", s48.sw);
+
+ // 步骤 49：Seq#06 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s49 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S49-C1 SW", "9000", s49.sw);
+
+ // 步骤 50：Seq#06 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s50 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S50-C1 SW", "9000", s50.sw);
+
+ // 步骤 51：Seq#06 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023）
+ // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var s51 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S51-C1 SW", "9000", s51.sw);
+
+ // 步骤 52：Seq#06 2/1: RESET（PROC_EUICC_INITIALIZATION_SEQUENCE 展开1/4，K_annexC2_procs 表1256）（procedure_expansion）
+ var s52 = bind.resetAndAtr();
+ bind.checkData("S52-C1 ATR_present", "1", s52.atr_hex !== "" ? "1" : "0");
+
+ // 步骤 53：Seq#06 2/2: [SELECT_MF]（展开2/4）（procedure_expansion）
+ // FCP outer tag not materialized from clause: tag-face asserted only when corpus fixes the tag byte (e.g. TS 102 221 FCP '62').
+ var s53 = bind.sendApdu("00", "A4", "00", "04", "3F00", "00", "9000");
+ bind.checkData("S53-C2 FCP_Template", "1", s53.resp.length > 0 ? "1" : "0");
+ bind.checkData("S53-C1 SW", "9000", s53.sw);
+
+ // 步骤 54：Seq#06 2/3: [TERMINAL_CAPABILITY_LPAd]（展开3/4）（procedure_expansion）
+ var s54 = bind.sendApdu("80", "AA", "00", "00", "A9058100830107", null, "9000");
+ bind.checkData("S54-C1 SW", "9000", s54.sw);
+
+ // 步骤 55：Seq#06 2/4: [TERMINAL_PROFILE]（展开4/4）（procedure_expansion）
+ var steady55 = bind.runToSteadyState(function () {
+ return bind.sendTerminalProfile("FFFFFFFF7F9D00DFBF00001FE2000000C7EB0000000168005000000000000200", "9000");
+ });
+ bind.checkData("S55-C1 final SW", "9000", steady55.final.sw);
+
+ // 步骤 56：Seq#06 3/1: [MANAGE_CHANNEL_OPEN]（PROC_OPEN_LOGICAL_CHANNEL_AND_SELECT_ISDR 展开1/2，K_annexC2_procs 表1258）（procedure_expansion）
+ // CHANNEL_NUMBER extraction and dynamic CLA rebinding are CasBind internal state (chaining rule; no generated-code re-implementation).
+ var s56 = bind.manageChannelOpen("9000");
+ bind.checkData("S56-C1 SW", "9000", s56.sw);
+ bind.checkData("S56-C2 CHANNEL_NUMBER extracted", "1", s56.chan !== null ? "1" : "0");
+
+ // 步骤 57：Seq#06 3/2: MTD_SELECT（procedure_expansion）
+ // CLA = bound channel (cla_rule) and <L> length binding are CasBind internal state (chaining rule; no generated-code re-implementation).
+ var s57 = bind.sendApdu(null, "A4", "04", "00", "A0000005591010FFFFFFFF8900000100", "00", "9000");
+ // MTD_SELECT expected face is SW-only (K Annex C.2 open-channel procedure step 2: no FCI content assertion in corpus); no fabricated template parse.
+ bind.checkData("S57-C1 SW", "9000", s57.sw);
+
+ // 步骤 58：Seq#06 4: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var sdCla58 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s58 = bind.sendApdu(sdCla58, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
+ bind.checkData("S58-C1 SW", "9000", s58.sw);
+ var r2p58 = BindEs10xProcProfile.walkChoiceList(s58.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+ bind.checkData("S58-C2 profileInfoListOk empty", "1", (r2p58.branch_tag === "A0" && r2p58.elements.length === 0) ? "1" : "0");
+
+ // 步骤 59：Seq#07 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+ // test-tool internal preparation (no APDU face): runtime-domain
+ // values per CaseIR unresolved (G Annex B generation rules);
+ // no fabricated bytes emitted here.
+
+ // 步骤 60：Seq#07 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+ // BPP synthesized (4.2.7.2.1 seq#7, structural layer, SCP03t-unprotected): 1067 bytes; segments: INIT=191B, A0=22B, A1=58B, A3=796B.
+ // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+ // [SPEC] TC — SGP.23 4.2.7.2.1 seq#7 接线（段选择/注入面）
+ // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+ // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+ // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+ // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+ // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+ // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+ // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+ // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+ // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+ // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+ // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+ // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+ // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+ // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+ // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+ // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+ // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+ // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+ // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+ // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+ // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+ // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
+ // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+ // [SPEC] PE header/version — PITS asn:67-68 2/3
+ // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+ // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+ // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+ // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+ // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+ // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
+ // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
+ // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+ // [SPEC] TC/override — SGP.23 4.2.7.2.1 seq#7：#UPP_OP_PROF1 覆写 —— ProfileHeader 元素的 iccid 字段置 #ICCID_OP_PROF2（PITS asn:69 ProfileHeader.iccid，tag '83'；值 HYPOTHESIS）；EF-ICCID 与 metadata 维持 OP_PROF1。eUICC 忽略 ProfileHeader iccid（Nominal → R_PIR_OK）
+ // S60-C1: binding:bpp_override_rule_carried_by_synthesis_contract(bpp_injection-provenance) (check_attestation)
+
+ // 步骤 61：Seq#07 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
+ // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
+ // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
+ // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
+ // S61-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
+
+ // 步骤 62：Seq#07 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla62 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s62 = bind.sendApdu(sdCla62, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S62-C1 SW", "9000", s62.sw);
+
+ // 步骤 63：Seq#07 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla63 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s63 = bind.sendApdu(sdCla63, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S63-C1 SW", "9000", s63.sw);
+
+ // 步骤 64：Seq#07 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla64 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s64 = bind.sendApdu(sdCla64, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S64-C1 SW", "9000", s64.sw);
+
+ // 步骤 65：Seq#07 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_045, RQ55_048, RQ25_025, RQ25_026, RQ55_044）
+ // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla65 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s65 = bind.sendApdu(sdCla65, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S65-C1 SW", "9000", s65.sw);
+ bind.checkData("S65-C2 SW", "9000", s65.sw);
+ bind.checkData("S65-C2 resp present", "1", s65.resp.length > 0 ? "1" : "0");
+ // S65-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+
+ // 步骤 66：Seq#07 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var sdCla66 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s66 = bind.sendApdu(sdCla66, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
+ bind.checkData("S66-C1 SW", "9000", s66.sw);
+ var r2p66 = BindEs10xProcProfile.walkChoiceList(s66.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+ var r2has66_0 = false;
+ for (var r2i66_0 = 0; r2i66_0 < r2p66.elements.length; r2i66_0++) {
+ var f = r2p66.elements[r2i66_0].fields;
+ if (f["5A"] === "989209012143658709F5" && f["9F70"] === "00") { r2has66_0 = true; break; }
+ }
+ bind.checkData("S66-C2 contains ICCID_OP_PROF1", "1", (r2p66.branch_tag === "A0" && r2has66_0) ? "1" : "0");
+ // S66-C3: kind 'requirement' pattern 'ProfileHeader ICCID ignored' has no static generation face (corpus vacuum; see CaseIR unresolved).
+ // S66-C3: binding:bf2d_query_structure_satisfies_requirement(S22-prof_info) (check_attestation)
+
+ // 步骤 67：Seq#08 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+ // test-tool internal preparation (no APDU face): runtime-domain
+ // values per CaseIR unresolved (G Annex B generation rules);
+ // no fabricated bytes emitted here.
+
+ // 步骤 68：Seq#08 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+ // BPP synthesized (4.2.7.2.1 seq#8, structural layer, SCP03t-unprotected): 1084 bytes; segments: INIT=191B, A0=22B, A1=75B, A3=796B.
+ // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+ // [SPEC] TC — SGP.23 4.2.7.2.1 seq#8 接线（段选择/注入面）
+ // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+ // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+ // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+ // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+ // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+ // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+ // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+ // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+ // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+ // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+ // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+ // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+ // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+ // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+ // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+ // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+ // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+ // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+ // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+ // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+ // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+ // [HYPOTHESIS] BF25/B7 profileOwner — OperatorId mccMnc 值（3GPP 24.008 编码面 SPEC，值 HYPOTHESIS）；gid1/gid2 在场（SGP.22 §2.4a.1.2 OperatorId ASN.1 结构 SPEC，值 HYPOTHESIS）
+ // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
+ // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+ // [SPEC] PE header/version — PITS asn:67-68 2/3
+ // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+ // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+ // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+ // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+ // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+ // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
+ // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
+ // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+ // [SPEC] TC/metadata-gid — SGP.23 4.2.7.2.1 seq#8 METADATA_OP_PROF9：Operational Profile 9 metadata profileOwner 带 mccMnc+gid1+gid2（SGP.22 §2.4a.1.2 OperatorId ASN.1 结构 SPEC；值 HYPOTHESIS）。Profile Package 对应含 EF-GID1/GID2 且 UST 服务 17/18 available（包侧 gid 无 PITS opt-usim 模板，未结构建模，仅断言面）；Nominal → R_PIR_OK_PROF9
+
+ // 步骤 69：Seq#08 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
+ // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
+ // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
+ // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
+ // S69-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
+
+ // 步骤 70：Seq#08 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla70 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s70 = bind.sendApdu(sdCla70, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S70-C1 SW", "9000", s70.sw);
+
+ // 步骤 71：Seq#08 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla71 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s71 = bind.sendApdu(sdCla71, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S71-C1 SW", "9000", s71.sw);
+
+ // 步骤 72：Seq#08 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla72 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s72 = bind.sendApdu(sdCla72, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S72-C1 SW", "9000", s72.sw);
+
+ // 步骤 73：Seq#08 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_045_2）
+ // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla73 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s73 = bind.sendApdu(sdCla73, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S73-C1 SW", "9000", s73.sw);
+ bind.checkData("S73-C2 SW", "9000", s73.sw);
+ bind.checkData("S73-C2 resp present", "1", s73.resp.length > 0 ? "1" : "0");
+ // S73-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+
+ // 步骤 74：Seq#08 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var sdCla74 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s74 = bind.sendApdu(sdCla74, "E2", "91", "00", "BF2D035C01B7", "00", "9000");
+ bind.checkData("S74-C1 SW", "9000", s74.sw);
+ var r2p74 = BindEs10xProcProfile.walkChoiceList(s74.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+ var r2po74S74_C2 = "";
+ for (var r2oi74S74_C2 = 0; r2oi74S74_C2 < r2p74.elements.length; r2oi74S74_C2++) {
+ var f = r2p74.elements[r2oi74S74_C2].fields;
+ if (f["B7"] !== undefined && f["B7"] !== "") { r2po74S74_C2 = f["B7"]; break; }
+ }
+ var r2poc74S74_C2 = r2po74S74_C2 === "" ? [] : BindEs10xProcProfile.parseBerTlv(r2po74S74_C2);
+ bind.checkData("S74-C2 profileOwner mccMnc/gid1/gid2 present", "1", (r2poc74S74_C2.length >= 3) ? "1" : "0");
+
+ // 步骤 75：Seq#09 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+ // test-tool internal preparation (no APDU face): runtime-domain
+ // values per CaseIR unresolved (G Annex B generation rules);
+ // no fabricated bytes emitted here.
+
+ // 步骤 76：Seq#09 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+ // BPP synthesized (4.2.7.2.1 seq#9, structural layer, SCP03t-unprotected): 1084 bytes; segments: INIT=191B, A0=22B, A1=75B, A3=796B.
+ // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+ // [SPEC] TC — SGP.23 4.2.7.2.1 seq#9 接线（段选择/注入面）
+ // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+ // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+ // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+ // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+ // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+ // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+ // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+ // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+ // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+ // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+ // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+ // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+ // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+ // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+ // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+ // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+ // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+ // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+ // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+ // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+ // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+ // [HYPOTHESIS] BF25/B7 profileOwner — OperatorId mccMnc 值（3GPP 24.008 编码面 SPEC，值 HYPOTHESIS）；gid1/gid2 在场（SGP.22 §2.4a.1.2 OperatorId ASN.1 结构 SPEC，值 HYPOTHESIS）
+ // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
+ // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+ // [SPEC] PE header/version — PITS asn:67-68 2/3
+ // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+ // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+ // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+ // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+ // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+ // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
+ // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
+ // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+ // [SPEC] TC/metadata-gid — SGP.23 4.2.7.2.1 seq#9 METADATA_OP1_GID1GID2_PRESENT（Error）：metadata profileOwner 含 gid1/gid2，而 Profile Package（UPP_OP_PROF1）不含 EF-GID1/GID2 且 UST 服务 17/18 not available → R_PIR_DATA_MISMATCH
+
+ // 步骤 77：Seq#09 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
+ // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
+ // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
+ // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
+ // S77-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
+
+ // 步骤 78：Seq#09 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla78 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s78 = bind.sendApdu(sdCla78, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S78-C1 SW", "9000", s78.sw);
+
+ // 步骤 79：Seq#09 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla79 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s79 = bind.sendApdu(sdCla79, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S79-C1 SW", "9000", s79.sw);
+
+ // 步骤 80：Seq#09 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla80 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s80 = bind.sendApdu(sdCla80, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S80-C1 SW", "9000", s80.sw);
+
+ // 步骤 81：Seq#09 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_045, RQ55_048, RQ25_025, RQ25_026, RQ55_045_2）
+ // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla81 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s81 = bind.sendApdu(sdCla81, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S81-C1 SW", "9000", s81.sw);
+ bind.checkData("S81-C1 resp present", "1", s81.resp.length > 0 ? "1" : "0");
+ // S81-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+ // S81-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+
+ // 步骤 82：Seq#09 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var sdCla82 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s82 = bind.sendApdu(sdCla82, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658709F5", "00", "9000");
+ bind.checkData("S82-C1 SW", "9000", s82.sw);
+ var r2p82 = BindEs10xProcProfile.walkChoiceList(s82.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+ bind.checkData("S82-C2 profileInfoListOk empty", "1", (r2p82.branch_tag === "A0" && r2p82.elements.length === 0) ? "1" : "0");
+
+ // 步骤 83：Seq#10 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+ // test-tool internal preparation (no APDU face): runtime-domain
+ // values per CaseIR unresolved (G Annex B generation rules);
+ // no fabricated bytes emitted here.
+
+ // 步骤 84：Seq#10 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+ // BPP synthesized (4.2.7.2.1 seq#10, structural layer, SCP03t-unprotected): 1076 bytes; segments: INIT=191B, A0=22B, A1=67B, A3=796B.
+ // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+ // [SPEC] TC — SGP.23 4.2.7.2.1 seq#10 接线（段选择/注入面）
+ // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+ // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+ // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+ // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+ // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+ // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+ // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+ // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+ // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+ // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+ // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+ // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+ // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+ // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+ // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+ // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+ // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+ // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+ // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+ // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+ // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+ // [HYPOTHESIS] BF25/B7 profileOwner — OperatorId mccMnc 值（3GPP 24.008 编码面 SPEC，值 HYPOTHESIS）
+ // [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
+ // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+ // [SPEC] PE header/version — PITS asn:67-68 2/3
+ // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+ // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+ // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+ // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+ // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+ // [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
+ // [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
+ // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+ // [SPEC] TC/metadata-gid — SGP.23 4.2.7.2.1 seq#10 METADATA_OP9_GID1GID2_MISSING（Error）：metadata profileOwner 仅 mccMnc（无 gid1/gid2），而 Profile Package（UPP_OP_PROF9）含 EF-GID1/GID2 且 UST 服务 17/18 available → R_PIR_DATA_MISMATCH
+
+ // 步骤 85：Seq#10 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
+ // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
+ // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
+ // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
+ // S85-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
+
+ // 步骤 86：Seq#10 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla86 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s86 = bind.sendApdu(sdCla86, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S86-C1 SW", "9000", s86.sw);
+
+ // 步骤 87：Seq#10 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla87 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s87 = bind.sendApdu(sdCla87, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S87-C1 SW", "9000", s87.sw);
+
+ // 步骤 88：Seq#10 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla88 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s88 = bind.sendApdu(sdCla88, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S88-C1 SW", "9000", s88.sw);
+
+ // 步骤 89：Seq#10 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_045, RQ55_048, RQ25_025, RQ25_026, RQ55_045_3）
+ // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla89 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s89 = bind.sendApdu(sdCla89, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S89-C1 SW", "9000", s89.sw);
+ bind.checkData("S89-C1 resp present", "1", s89.resp.length > 0 ? "1" : "0");
+ // S89-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+ // S89-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+
+ // 步骤 90：Seq#10 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var sdCla90 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s90 = bind.sendApdu(sdCla90, "E2", "91", "00", "BF2D0EA00C5A0A989209012143658776F5", "00", "9000");
+ bind.checkData("S90-C1 SW", "9000", s90.sw);
+ var r2p90 = BindEs10xProcProfile.walkChoiceList(s90.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+ bind.checkData("S90-C2 profileInfoListOk empty", "1", (r2p90.branch_tag === "A0" && r2p90.elements.length === 0) ? "1" : "0");
+
+ // 步骤 91：Seq#11 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+ // test-tool internal preparation (no APDU face): runtime-domain
+ // values per CaseIR unresolved (G Annex B generation rules);
+ // no fabricated bytes emitted here.
+
+ // 步骤 92：Seq#11 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+ // BPP synthesized (4.2.7.2.1 seq#11, structural layer, SCP03t-unprotected): 907 bytes; segments: INIT=191B, A0=22B, A1=58B, A3=636B.
+ // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+ // [SPEC] TC — SGP.23 4.2.7.2.1 seq#11 接线（段选择/注入面）
+ // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+ // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+ // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+ // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+ // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+ // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+ // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+ // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+ // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+ // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+ // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+ // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+ // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+ // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+ // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+ // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+ // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+ // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+ // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+ // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+ // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+ // [SPEC] UPP — PITS ProfileElement 序列 header+mf+end（最小集）
+ // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+ // [SPEC] PE header/version — PITS asn:67-68 2/3
+ // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+ // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+ // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+ // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+ // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+ // [HYPOTHESIS] UPP — 省略 PE-USIM：EFIMSI file is not present（4.2.7.2.1 seq#11/#12）
+ // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+ // [SPEC] TC/flow — SGP.23 4.2.7.2.1 seq#11 METADATA_OP_PROF10_NO_PROFILE_OWNER（Nominal）：metadata 无 profileOwner（SGP.22 :7441 profileOwner SHALL NOT be present if no EFIMSI），Profile Package（UPP_OP_PROF10）无 EF-IMSI（结构表示＝省略 PE-USIM）→ R_PIR_OK_PROF10
+
+ // 步骤 93：Seq#11 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
+ // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
+ // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
+ // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
+ // S93-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
+
+ // 步骤 94：Seq#11 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla94 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s94 = bind.sendApdu(sdCla94, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S94-C1 SW", "9000", s94.sw);
+
+ // 步骤 95：Seq#11 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla95 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s95 = bind.sendApdu(sdCla95, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S95-C1 SW", "9000", s95.sw);
+
+ // 步骤 96：Seq#11 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla96 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s96 = bind.sendApdu(sdCla96, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S96-C1 SW", "9000", s96.sw);
+
+ // 步骤 97：Seq#11 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_045, RQ55_048, RQ25_025, RQ25_026, RQ55_044）
+ // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla97 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s97 = bind.sendApdu(sdCla97, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S97-C1 SW", "9000", s97.sw);
+ bind.checkData("S97-C2 SW", "9000", s97.sw);
+ bind.checkData("S97-C2 resp present", "1", s97.resp.length > 0 ? "1" : "0");
+ // S97-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+
+ // 步骤 98：Seq#11 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_048）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var sdCla98 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s98 = bind.sendApdu(sdCla98, "E2", "91", "00", "BF2D0EA00C5A0A98109909002143658779", "00", "9000");
+ bind.checkData("S98-C1 SW", "9000", s98.sw);
+ var r2p98 = BindEs10xProcProfile.walkChoiceList(s98.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+ var r2has98_0 = false;
+ for (var r2i98_0 = 0; r2i98_0 < r2p98.elements.length; r2i98_0++) {
+ var f = r2p98.elements[r2i98_0].fields;
+ if (f["5A"] === "98109909002143658779" && f["9F70"] === "00") { r2has98_0 = true; break; }
+ }
+ bind.checkData("S98-C2 contains ICCID_OP_PROF10", "1", (r2p98.branch_tag === "A0" && r2has98_0) ? "1" : "0");
+
+ // 步骤 99：Seq#12 IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+ // test-tool internal preparation (no APDU face): runtime-domain
+ // values per CaseIR unresolved (G Annex B generation rules);
+ // no fabricated bytes emitted here.
+
+ // 步骤 100：Seq#12 IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+ // BPP synthesized (4.2.7.2.1 seq#12, structural layer, SCP03t-unprotected): 916 bytes; segments: INIT=191B, A0=22B, A1=67B, A3=636B.
+ // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+ // [SPEC] TC — SGP.23 4.2.7.2.1 seq#12 接线（段选择/注入面）
+ // [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+ // [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+ // [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+ // [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+ // [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+ // [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+ // [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+ // [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+ // [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+ // [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+ // [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+ // [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+ // [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+ // [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+ // [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+ // [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+ // [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+ // [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+ // [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+ // [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+ // [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+ // [HYPOTHESIS] BF25/B7 profileOwner — OperatorId mccMnc 值（3GPP 24.008 编码面 SPEC，值 HYPOTHESIS）
+ // [SPEC] UPP — PITS ProfileElement 序列 header+mf+end（最小集）
+ // [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+ // [SPEC] PE header/version — PITS asn:67-68 2/3
+ // [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+ // [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+ // [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+ // [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+ // [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+ // [HYPOTHESIS] UPP — 省略 PE-USIM：EFIMSI file is not present（4.2.7.2.1 seq#11/#12）
+ // [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+ // [SPEC] TC/metadata-owner — SGP.23 4.2.7.2.1 seq#12 METADATA_OP_PROF10（Error）：metadata profileOwner 在场而 Profile Package（UPP_OP_PROF10）无 EF-IMSI（违反 SGP.22 :7441 profileOwner SHALL NOT be present if no EFIMSI）→ R_PIR_DATA_MISMATCH
+
+ // 步骤 101：Seq#12 IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>（tc_step）
+ // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A3>.
+ // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
+ // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
+ // S101-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
+
+ // 步骤 102：Seq#12 IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla102 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s102 = bind.sendApdu(sdCla102, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S102-C1 SW", "9000", s102.sw);
+
+ // 步骤 103：Seq#12 IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla103 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s103 = bind.sendApdu(sdCla103, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S103-C1 SW", "9000", s103.sw);
+
+ // 步骤 104：Seq#12 IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+ // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla104 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s104 = bind.sendApdu(sdCla104, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S104-C1 SW", "9000", s104.sw);
+
+ // 步骤 105：Seq#12 1: MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ25_023, RQ25_024, RQ55_043, RQ55_047, RQ55_048, RQ25_025, RQ25_026, RQ31_173）
+ // BPP segment load (data=null contract): <BPP_SEG_A3> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+ // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+ var sdCla105 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s105 = bind.sendApdu(sdCla105, "E2", "00", "00", null, "00", "9000");
+ bind.checkData("S105-C1 SW", "9000", s105.sw);
+ bind.checkData("S105-C1 resp present", "1", s105.resp.length > 0 ? "1" : "0");
+ // S105-C2: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+ // S105-C3: binding:bpp_seg_load_pir_runtime_semantics(S22-2.5.6;PIR-runtime-domain) (check_attestation)
+
+ // 步骤 106：Seq#12 2: MTD_STORE_DATA（tc_step；REQ: RQ32_071, RQ55_043, RQ55_048）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var sdCla106 = s56.chan !== null ? (s56.chan <= 3 ? 128 + s56.chan : 188 + s56.chan).toString(16).toUpperCase() : null;
+ var s106 = bind.sendApdu(sdCla106, "E2", "91", "00", "BF2D0EA00C5A0A98109909002143658779", "00", "9000");
+ bind.checkData("S106-C1 SW", "9000", s106.sw);
+ var r2p106 = BindEs10xProcProfile.walkChoiceList(s106.resp, {respTag: "BF2D", okTag: "A0", errTag: "81"});
+ bind.checkData("S106-C2 profileInfoListOk empty", "1", (r2p106.branch_tag === "A0" && r2p106.elements.length === 0) ? "1" : "0");
}