@byline/db-postgres 1.12.1 → 2.1.0

package/dist/modules/admin/tests/session-provider.test.js

@@ -5,11 +5,10 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-import assert from 'node:assert';
-import { after, afterEach, before, describe, it } from 'node:test';
 import { hashPassword, JwtSessionProvider } from '@byline/admin/auth';
 import { AdminAuth, AuthError, AuthErrorCodes } from '@byline/auth';
 import { eq, inArray } from 'drizzle-orm';
+import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest';
 import { adminUsers } from '../../../database/schema/auth.js';
 import { setupTestDB, teardownTestDB } from '../../../lib/test-helper.js';
 import { createAdminStore } from '../admin-store.js';
@@ -26,6 +25,13 @@ import { createAdminStore } from '../admin-store.js';
 let db;
 let store;
 const trackedUserIds = new Set();
+// Pure-JS argon2id takes ~1 s per hash; most tests here use the same
+// 'pw' password for both the create and the subsequent sign-in. Hash it
+// once and reuse — saves ~10–15 s on every run. Tests that need a
+// different password (alice's 'pw-alice', bob's 'correct') pay the
+// per-hash cost on demand.
+const SHARED_PASSWORD = 'pw';
+let SHARED_HASH = '';
 const SIGNING_SECRET = 'test-signing-secret-at-least-32-bytes-long-here';
 function makeProvider(options) {
     return new JwtSessionProvider({
@@ -36,12 +42,15 @@ function makeProvider(options) {
         now: options?.now,
     });
 }
+async function hashFor(password) {
+    return password === SHARED_PASSWORD ? SHARED_HASH : await hashPassword(password);
+}
 async function createEnabledUser(email, password) {
     // Clear any stale row left by a crashed prior run.
     await db.delete(adminUsers).where(eq(adminUsers.email, email.toLowerCase()));
     const row = await store.adminUsers.create({
         email,
-        password_hash: await hashPassword(password),
+        password_hash: await hashFor(password),
         is_enabled: true,
     });
     trackedUserIds.add(row.id);
@@ -51,7 +60,7 @@ async function createDisabledUser(email, password) {
     await db.delete(adminUsers).where(eq(adminUsers.email, email.toLowerCase()));
     const row = await store.adminUsers.create({
         email,
-        password_hash: await hashPassword(password),
+        password_hash: await hashFor(password),
         is_enabled: false,
     });
     trackedUserIds.add(row.id);
@@ -65,25 +74,26 @@ async function cleanupTrackedRows() {
 }
 // ---------------------------------------------------------------------------
 describe('JwtSessionProvider', () => {
-    before(() => {
+    beforeAll(async () => {
         const testDB = setupTestDB([]);
         db = testDB.db;
         store = createAdminStore(db);
+        SHARED_HASH = await hashPassword(SHARED_PASSWORD);
     });
     afterEach(async () => {
         await cleanupTrackedRows();
     });
-    after(async () => {
+    afterAll(async () => {
         await cleanupTrackedRows();
         await teardownTestDB();
     });
     describe('construction', () => {
         it('rejects a short signing secret', () => {
-            assert.throws(() => new JwtSessionProvider({ store, signingSecret: 'too-short' }), /at least 32 bytes/);
+            expect(() => new JwtSessionProvider({ store, signingSecret: 'too-short' })).toThrow(/at least 32 bytes/);
         });
         it('declares capabilities', () => {
             const provider = makeProvider();
-            assert.deepStrictEqual(provider.capabilities, {
+            expect(provider.capabilities).toEqual({
                 passwordChange: true,
                 magicLink: false,
                 sso: false,
@@ -100,12 +110,12 @@ describe('JwtSessionProvider', () => {
                 ip: '10.0.0.1',
                 userAgent: 'test',
             });
-            assert.ok(result.accessToken);
-            assert.ok(result.refreshToken);
-            assert.ok(result.actor instanceof AdminAuth);
-            assert.strictEqual(result.actor.isSuperAdmin, false);
-            assert.ok(result.accessTokenExpiresAt.getTime() > Date.now());
-            assert.ok(result.refreshTokenExpiresAt.getTime() > Date.now());
+            expect(result.accessToken).toBeTruthy();
+            expect(result.refreshToken).toBeTruthy();
+            expect(result.actor instanceof AdminAuth).toBeTruthy();
+            expect(result.actor.isSuperAdmin).toBe(false);
+            expect(result.accessTokenExpiresAt.getTime() > Date.now()).toBeTruthy();
+            expect(result.refreshTokenExpiresAt.getTime() > Date.now()).toBeTruthy();
         });
         it('throws ERR_INVALID_CREDENTIALS on unknown email', async () => {
             const provider = makeProvider();
@@ -114,11 +124,11 @@ describe('JwtSessionProvider', () => {
                     email: 'nobody@example.com',
                     password: 'whatever',
                 });
-                assert.fail('expected ERR_INVALID_CREDENTIALS');
+                throw new Error('expected ERR_INVALID_CREDENTIALS');
             }
             catch (err) {
-                assert.ok(err instanceof AuthError);
-                assert.strictEqual(err.code, AuthErrorCodes.INVALID_CREDENTIALS);
+                expect(err instanceof AuthError).toBeTruthy();
+                expect(err.code).toBe(AuthErrorCodes.INVALID_CREDENTIALS);
             }
             // Note: signInWithPassword runs a timing-equaliser argon2 verify on
             // the unknown-email path so the wrong-email and wrong-password
@@ -130,23 +140,23 @@ describe('JwtSessionProvider', () => {
             const provider = makeProvider();
             try {
                 await provider.signInWithPassword({ email: 'bob@example.com', password: 'wrong' });
-                assert.fail('expected ERR_INVALID_CREDENTIALS');
+                throw new Error('expected ERR_INVALID_CREDENTIALS');
             }
             catch (err) {
-                assert.strictEqual(err.code, AuthErrorCodes.INVALID_CREDENTIALS);
+                expect(err.code).toBe(AuthErrorCodes.INVALID_CREDENTIALS);
             }
             const row = await store.adminUsers.getById(user.id);
-            assert.strictEqual(row?.failed_login_attempts, 1);
+            expect(row?.failed_login_attempts).toBe(1);
         });
         it('throws ERR_ACCOUNT_DISABLED for a correct-password but disabled account', async () => {
             await createDisabledUser('disabled@example.com', 'pw');
             const provider = makeProvider();
             try {
                 await provider.signInWithPassword({ email: 'disabled@example.com', password: 'pw' });
-                assert.fail('expected ERR_ACCOUNT_DISABLED');
+                throw new Error('expected ERR_ACCOUNT_DISABLED');
             }
             catch (err) {
-                assert.strictEqual(err.code, AuthErrorCodes.ACCOUNT_DISABLED);
+                expect(err.code).toBe(AuthErrorCodes.ACCOUNT_DISABLED);
             }
         });
         it('persists a refresh-token row with the recorded ip and user agent', async () => {
@@ -159,10 +169,10 @@ describe('JwtSessionProvider', () => {
                 userAgent: 'Mozilla/test',
             });
             const rows = await store.refreshTokens.listAllForUser(user.id);
-            assert.strictEqual(rows.length, 1);
-            assert.strictEqual(rows[0]?.ip, '192.168.1.5');
-            assert.strictEqual(rows[0]?.user_agent, 'Mozilla/test');
-            assert.strictEqual(rows[0]?.revoked_at, null);
+            expect(rows.length).toBe(1);
+            expect(rows[0]?.ip).toBe('192.168.1.5');
+            expect(rows[0]?.user_agent).toBe('Mozilla/test');
+            expect(rows[0]?.revoked_at).toBe(null);
         });
     });
     describe('verifyAccessToken', () => {
@@ -174,16 +184,16 @@ describe('JwtSessionProvider', () => {
                 password: 'pw',
             });
             const { actor } = await provider.verifyAccessToken(accessToken);
-            assert.strictEqual(actor.id, user.id);
+            expect(actor.id).toBe(user.id);
         });
         it('throws ERR_INVALID_TOKEN for gibberish', async () => {
             const provider = makeProvider();
             try {
                 await provider.verifyAccessToken('not-a-jwt');
-                assert.fail('expected ERR_INVALID_TOKEN');
+                throw new Error('expected ERR_INVALID_TOKEN');
             }
             catch (err) {
-                assert.strictEqual(err.code, AuthErrorCodes.INVALID_TOKEN);
+                expect(err.code).toBe(AuthErrorCodes.INVALID_TOKEN);
             }
         });
         it('throws ERR_INVALID_TOKEN for an expired token', async () => {
@@ -198,10 +208,10 @@ describe('JwtSessionProvider', () => {
             const freshProvider = makeProvider();
             try {
                 await freshProvider.verifyAccessToken(accessToken);
-                assert.fail('expected ERR_INVALID_TOKEN');
+                throw new Error('expected ERR_INVALID_TOKEN');
             }
             catch (err) {
-                assert.strictEqual(err.code, AuthErrorCodes.INVALID_TOKEN);
+                expect(err.code).toBe(AuthErrorCodes.INVALID_TOKEN);
             }
         });
         it('throws ERR_ACCOUNT_DISABLED when the subject has been disabled since issuance', async () => {
@@ -214,10 +224,10 @@ describe('JwtSessionProvider', () => {
             await store.adminUsers.setEnabled(user.id, false);
             try {
                 await provider.verifyAccessToken(accessToken);
-                assert.fail('expected ERR_ACCOUNT_DISABLED');
+                throw new Error('expected ERR_ACCOUNT_DISABLED');
             }
             catch (err) {
-                assert.strictEqual(err.code, AuthErrorCodes.ACCOUNT_DISABLED);
+                expect(err.code).toBe(AuthErrorCodes.ACCOUNT_DISABLED);
             }
         });
         it('throws ERR_INVALID_TOKEN when the signature is tampered', async () => {
@@ -228,17 +238,24 @@ describe('JwtSessionProvider', () => {
                 password: 'pw',
             });
             const parts = accessToken.split('.');
-            // Flip the last char of the signature
-            const last = parts[2] ?? '';
-            const flipped = `${last.slice(0, -1)}${last.at(-1) === 'a' ? 'b' : 'a'}`;
+            // Flip a char in the middle of the signature, not at either end.
+            // HS256 sigs are 32 bytes → 43 base64url chars → 258 bits of capacity,
+            // so the *last* char carries 2 padding zero bits. A naive last-char
+            // flip can land on a different encoded char whose top 4 bits map to
+            // the same signature byte (e.g. `Y` ↔ `a` both decode to top-4=`0110`),
+            // leaving the signature unchanged and the test flaky. Middle chars
+            // span byte boundaries cleanly, so any flip guarantees a byte change.
+            const sig = parts[2] ?? '';
+            const mid = Math.floor(sig.length / 2);
+            const flipped = `${sig.slice(0, mid)}${sig[mid] === 'a' ? 'b' : 'a'}${sig.slice(mid + 1)}`;
             parts[2] = flipped;
             const tampered = parts.join('.');
             try {
                 await provider.verifyAccessToken(tampered);
-                assert.fail('expected ERR_INVALID_TOKEN');
+                throw new Error('expected ERR_INVALID_TOKEN');
             }
             catch (err) {
-                assert.strictEqual(err.code, AuthErrorCodes.INVALID_TOKEN);
+                expect(err.code).toBe(AuthErrorCodes.INVALID_TOKEN);
             }
         });
     });
@@ -251,27 +268,27 @@ describe('JwtSessionProvider', () => {
                 password: 'pw',
             });
             const refreshed = await provider.refreshSession({ refreshToken: signIn.refreshToken });
-            assert.notStrictEqual(refreshed.refreshToken, signIn.refreshToken);
-            assert.notStrictEqual(refreshed.accessToken, signIn.accessToken);
+            expect(refreshed.refreshToken).not.toBe(signIn.refreshToken);
+            expect(refreshed.accessToken).not.toBe(signIn.accessToken);
             // Old token is now revoked and points at the new one
             const rows = await store.refreshTokens.listAllForUser(user.id);
-            assert.strictEqual(rows.length, 2);
+            expect(rows.length).toBe(2);
             const [oldRow, newRow] = rows;
-            assert.ok(oldRow?.revoked_at);
-            assert.strictEqual(oldRow?.rotated_to_id, newRow?.id);
-            assert.strictEqual(newRow?.revoked_at, null);
+            expect(oldRow?.revoked_at).toBeTruthy();
+            expect(oldRow?.rotated_to_id).toBe(newRow?.id);
+            expect(newRow?.revoked_at).toBe(null);
             // The new token verifies
             const { actor } = await provider.verifyAccessToken(refreshed.accessToken);
-            assert.strictEqual(actor.id, user.id);
+            expect(actor.id).toBe(user.id);
         });
         it('throws ERR_INVALID_TOKEN for an unknown refresh token', async () => {
             const provider = makeProvider();
             try {
                 await provider.refreshSession({ refreshToken: 'totally-bogus' });
-                assert.fail('expected ERR_INVALID_TOKEN');
+                throw new Error('expected ERR_INVALID_TOKEN');
             }
             catch (err) {
-                assert.strictEqual(err.code, AuthErrorCodes.INVALID_TOKEN);
+                expect(err.code).toBe(AuthErrorCodes.INVALID_TOKEN);
             }
         });
         it('throws ERR_INVALID_TOKEN for an expired refresh token', async () => {
@@ -285,10 +302,10 @@ describe('JwtSessionProvider', () => {
             const freshProvider = makeProvider();
             try {
                 await freshProvider.refreshSession({ refreshToken });
-                assert.fail('expected ERR_INVALID_TOKEN');
+                throw new Error('expected ERR_INVALID_TOKEN');
             }
             catch (err) {
-                assert.strictEqual(err.code, AuthErrorCodes.INVALID_TOKEN);
+                expect(err.code).toBe(AuthErrorCodes.INVALID_TOKEN);
             }
         });
         it('throws ERR_REVOKED_TOKEN when replaying a rotated token — and revokes the chain', async () => {
@@ -301,19 +318,19 @@ describe('JwtSessionProvider', () => {
             // Legitimate rotation: sign-in → refresh-1 → refresh-2
             const r1 = await provider.refreshSession({ refreshToken: signIn.refreshToken });
             const r2 = await provider.refreshSession({ refreshToken: r1.refreshToken });
-            assert.ok(r2.refreshToken);
+            expect(r2.refreshToken).toBeTruthy();
             // An attacker replays the original (already-rotated) refreshToken.
             try {
                 await provider.refreshSession({ refreshToken: signIn.refreshToken });
-                assert.fail('expected ERR_REVOKED_TOKEN');
+                throw new Error('expected ERR_REVOKED_TOKEN');
             }
             catch (err) {
-                assert.strictEqual(err.code, AuthErrorCodes.REVOKED_TOKEN);
+                expect(err.code).toBe(AuthErrorCodes.REVOKED_TOKEN);
             }
             // The entire chain descended from the replayed token is now revoked.
             const rows = await store.refreshTokens.listAllForUser(user.id);
             for (const row of rows) {
-                assert.ok(row.revoked_at, `row ${row.id} expected revoked, got null`);
+                expect(row.revoked_at, `row ${row.id} expected revoked, got null`).toBeTruthy();
             }
         });
         it('throws ERR_REVOKED_TOKEN for an explicitly revoked token', async () => {
@@ -326,10 +343,10 @@ describe('JwtSessionProvider', () => {
             await provider.revokeSession(signIn.refreshToken);
             try {
                 await provider.refreshSession({ refreshToken: signIn.refreshToken });
-                assert.fail('expected ERR_REVOKED_TOKEN');
+                throw new Error('expected ERR_REVOKED_TOKEN');
             }
             catch (err) {
-                assert.strictEqual(err.code, AuthErrorCodes.REVOKED_TOKEN);
+                expect(err.code).toBe(AuthErrorCodes.REVOKED_TOKEN);
             }
         });
     });
@@ -344,8 +361,8 @@ describe('JwtSessionProvider', () => {
             await provider.revokeSession(signIn.refreshToken);
             await provider.revokeSession(signIn.refreshToken); // idempotent
             const rows = await store.refreshTokens.listAllForUser(user.id);
-            assert.strictEqual(rows.length, 1);
-            assert.ok(rows[0]?.revoked_at);
+            expect(rows.length).toBe(1);
+            expect(rows[0]?.revoked_at).toBeTruthy();
         });
         it('is a no-op for unknown tokens', async () => {
             const provider = makeProvider();
@@ -357,13 +374,13 @@ describe('JwtSessionProvider', () => {
             const user = await createEnabledUser('m@example.com', 'pw');
             const provider = makeProvider();
             const actor = await provider.resolveActor(user.id);
-            assert.ok(actor instanceof AdminAuth);
-            assert.strictEqual(actor.id, user.id);
+            expect(actor instanceof AdminAuth).toBeTruthy();
+            expect(actor?.id).toBe(user.id);
         });
         it('returns null for a disabled user', async () => {
             const user = await createDisabledUser('n@example.com', 'pw');
             const provider = makeProvider();
-            assert.strictEqual(await provider.resolveActor(user.id), null);
+            expect(await provider.resolveActor(user.id)).toBe(null);
         });
     });
 });

package/dist/modules/storage/tests/storage-document-paths.test.js

@@ -5,25 +5,7 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-/**
- * Integration tests for the byline_document_paths layer.
- *
- * Exercises the storage adapter directly (not the lifecycle) so each test
- * isolates one storage-level invariant:
- *
- *   - per-(collection, locale) path uniqueness — the second insert with
- *     the same `(collection_id, locale, path)` triggers Postgres SQLSTATE
- *     23505 on `idx_document_paths_collection_locale_path`.
- *   - locale fallback in reads — `getDocumentByPath` with a non-default
- *     `locale` resolves through the priority chain `[requested, default]`
- *     and finds the default-locale row when no row exists for the
- *     requested locale.
- *   - upsert-on-self — re-issuing `createDocumentVersion` with the same
- *     `path` for the same `documentId` succeeds (the conflict target is
- *     `(document_id, locale)`, so the existing row is updated in place).
- */
-import assert from 'node:assert';
-import { after, before, describe, it } from 'node:test';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import { setupTestDB, teardownTestDB } from '../../../lib/test-helper.js';
 let commandBuilders;
 let queryBuilders;
@@ -35,7 +17,7 @@ const PathsCollectionConfig = {
 };
 let testCollection = {};
 describe('byline_document_paths integration', () => {
-    before(async () => {
+    beforeAll(async () => {
         const testDB = setupTestDB([PathsCollectionConfig]);
         commandBuilders = testDB.commandBuilders;
         queryBuilders = testDB.queryBuilders;
@@ -46,7 +28,7 @@ describe('byline_document_paths integration', () => {
         }
         testCollection = { id: collection.id, name: collection.path };
     });
-    after(async () => {
+    afterAll(async () => {
         try {
             await commandBuilders.collections.delete(testCollection.id);
         }
@@ -86,14 +68,14 @@ describe('byline_document_paths integration', () => {
         catch (err) {
             caught = err;
         }
-        assert.ok(caught, 'expected unique-constraint violation on duplicate path');
+        expect(caught, 'expected unique-constraint violation on duplicate path').toBeTruthy();
         // Drizzle wraps pg errors in DrizzleQueryError with the original error
         // attached as `cause`. The lifecycle layer's rethrowPathConflict reads
         // both the wrapper and the cause to detect 23505 + the path constraint
         // name; mirror that here.
         const original = caught.cause ?? caught;
-        assert.strictEqual(original.code, '23505', `expected SQLSTATE 23505, got ${original?.code}`);
-        assert.match(String(original.constraint ?? ''), /document_paths_collection_locale_path/, `constraint name should reference the path index, got ${original?.constraint}`);
+        expect(original.code, `expected SQLSTATE 23505, got ${original?.code}`).toBe('23505');
+        expect(String(original.constraint ?? ''), `constraint name should reference the path index, got ${original?.constraint}`).toMatch(/document_paths_collection_locale_path/);
     });
     it('upserts in place when the same document re-saves the same path', async () => {
         const sharedPath = `same-doc-${Date.now()}`;
@@ -122,7 +104,7 @@ describe('byline_document_paths integration', () => {
             status: 'draft',
             previousVersionId: first.document.id,
         });
-        assert.strictEqual(second.document.document_id, documentId, 'same logical document');
+        expect(second.document.document_id, 'same logical document').toBe(documentId);
     });
     it('updates the path row in place when a document changes its path', async () => {
         const originalPath = `original-${Date.now()}`;
@@ -156,14 +138,14 @@ describe('byline_document_paths integration', () => {
             path: updatedPath,
             reconstruct: false,
         });
-        assert.ok(found, 'updated path should resolve');
-        assert.strictEqual(found.document_id, documentId);
+        expect(found, 'updated path should resolve').toBeTruthy();
+        expect(found?.document_id).toBe(documentId);
         const oldNotFound = await queryBuilders.documents.getDocumentByPath({
             collection_id: testCollection.id,
             path: originalPath,
             reconstruct: false,
         });
-        assert.strictEqual(oldNotFound, null, 'original path no longer resolves');
+        expect(oldNotFound, 'original path no longer resolves').toBe(null);
     });
     it('falls back to the default-locale path row when the requested locale has no row', async () => {
         const onlyDefaultPath = `default-only-${Date.now()}`;
@@ -186,9 +168,9 @@ describe('byline_document_paths integration', () => {
             locale: 'fr',
             reconstruct: false,
         });
-        assert.ok(found, 'fallback chain should resolve via the en row');
-        assert.strictEqual(found.document_id, documentId);
-        assert.strictEqual(found.path, onlyDefaultPath);
+        expect(found, 'fallback chain should resolve via the en row').toBeTruthy();
+        expect(found?.document_id).toBe(documentId);
+        expect(found?.path).toBe(onlyDefaultPath);
     });
     it('returns null on getDocumentByPath when no row matches in any locale', async () => {
         const result = await queryBuilders.documents.getDocumentByPath({
@@ -197,6 +179,6 @@ describe('byline_document_paths integration', () => {
             locale: 'fr',
             reconstruct: false,
         });
-        assert.strictEqual(result, null);
+        expect(result).toBe(null);
     });
 });

package/dist/modules/storage/tests/storage-field-types.test.js

@@ -5,9 +5,8 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-import assert from 'node:assert';
-import { after, before, describe, it } from 'node:test';
 import { v7 as uuidv7 } from 'uuid';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import { setupTestDB, teardownTestDB } from '../../../lib/test-helper.js';
 // Test database setup
 let commandBuilders;
@@ -63,7 +62,7 @@ const sampleDocument = {
 // Global test variables
 let testCollection = {};
 describe('02 Field Types', () => {
-    before(async () => {
+    beforeAll(async () => {
         // Connect to test database
         const testDB = setupTestDB([FieldTypesCollectionConfig]);
         commandBuilders = testDB.commandBuilders;
@@ -77,7 +76,7 @@ describe('02 Field Types', () => {
         testCollection = { id: collection.id, name: collection.path };
         console.log('Test collection created:', testCollection);
     });
-    after(async () => {
+    afterAll(async () => {
         // Clean up test collection (cascades to documents and fields)
         try {
             await commandBuilders.collections.delete(testCollection.id);
@@ -122,24 +121,24 @@ describe('02 Field Types', () => {
             locale: 'en',
             fields: ['title', 'views'],
         });
-        assert.ok(result.documents.length > 0, 'should return at least one document');
+        expect(result.documents.length > 0, 'should return at least one document').toBeTruthy();
         const doc = result.documents[0];
-        assert.ok(doc.fields, 'document should have fields');
-        assert.ok(doc.fields.title, 'should include title field');
-        assert.strictEqual(doc.fields.views, 100, 'should include views field');
+        expect(doc.fields, 'document should have fields').toBeTruthy();
+        expect(doc.fields.title, 'should include title field').toBeTruthy();
+        expect(doc.fields.views, 'should include views field').toBe(100);
         // Fields not requested should be absent or empty
-        assert.strictEqual(doc.fields.price, undefined, 'should not include unrequested decimal field');
-        assert.strictEqual(doc.fields.attachment, undefined, 'should not include unrequested file field');
+        expect(doc.fields.price, 'should not include unrequested decimal field').toBe(undefined);
+        expect(doc.fields.attachment, 'should not include unrequested file field').toBe(undefined);
     });
     it('should return all fields when no fields parameter is provided', async () => {
         const result = await queryBuilders.documents.findDocuments({
             collection_id: testCollection.id,
             locale: 'en',
         });
-        assert.ok(result.documents.length > 0, 'should return at least one document');
+        expect(result.documents.length > 0, 'should return at least one document').toBeTruthy();
         const doc = result.documents[0];
-        assert.ok(doc.fields, 'document should have fields');
-        assert.ok(doc.fields.title, 'should include title');
-        assert.ok(doc.path, 'should include the system path on the document envelope');
+        expect(doc.fields, 'document should have fields').toBeTruthy();
+        expect(doc.fields.title, 'should include title').toBeTruthy();
+        expect(doc.path, 'should include the system path on the document envelope').toBeTruthy();
     });
 });

package/dist/modules/storage/tests/storage-flatten-reconstruct.test.js

@@ -5,10 +5,9 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-import assert from 'node:assert';
-import { describe, it } from 'node:test';
 import { defineCollection } from '@byline/core';
 import { v7 as uuidv7 } from 'uuid';
+import { describe, expect, it } from 'vitest';
 import { flattenFieldSetData } from '../storage-flatten.js';
 import { restoreFieldSetData } from '../storage-restore.js';
 import { resolveStoreTypes } from '../storage-utils.js';
@@ -227,26 +226,26 @@ const expectedRestored = {
 describe('01 Document Flattening and Reconstruction', () => {
     it('should flatten and reconstruct a document via schema-aware round-trip', () => {
         const flattened = flattenFieldSetData(DocsCollectionConfig.fields, sampleDocument, 'all');
-        assert(flattened, 'Flattened document should not be null or undefined');
-        assert(flattened.length > 0, 'Flattened document should contain field values');
+        expect(flattened, 'Flattened document should not be null or undefined').toBeTruthy();
+        expect(flattened.length > 0, 'Flattened document should contain field values').toBe(true);
         const { data: restored, warnings } = restoreFieldSetData(DocsCollectionConfig.fields, flattened);
-        assert(restored, 'Restored document should not be null or undefined');
-        assert.deepStrictEqual(warnings, [], 'Round-trip restore should produce no warnings');
+        expect(restored, 'Restored document should not be null or undefined').toBeTruthy();
+        expect(warnings, 'Round-trip restore should produce no warnings').toEqual([]);
         const restoredJson = JSON.stringify(restored, null, 2);
         const expectedJson = JSON.stringify(expectedRestored, null, 2);
-        assert.deepStrictEqual(JSON.parse(restoredJson), JSON.parse(expectedJson), 'Restored document should match the expected flat block shape');
+        expect(JSON.parse(restoredJson), 'Restored document should match the expected flat block shape').toEqual(JSON.parse(expectedJson));
     });
     it('should resolve localized fields when a specific locale is requested', () => {
         const flattened = flattenFieldSetData(DocsCollectionConfig.fields, sampleDocument, 'all');
         const { data: restored } = restoreFieldSetData(DocsCollectionConfig.fields, flattened, 'en');
-        assert.strictEqual(restored.title, 'My First Document');
-        assert.strictEqual(restored.summary, 'This is a sample document for testing purposes.');
+        expect(restored.title).toBe('My First Document');
+        expect(restored.summary).toBe('This is a sample document for testing purposes.');
     });
 });
 describe('resolveStoreTypes', () => {
     it('should resolve text fields to text store', () => {
         const stores = resolveStoreTypes(DocsCollectionConfig.fields, ['path', 'title', 'summary']);
-        assert.deepStrictEqual([...stores].sort(), ['text']);
+        expect([...stores].sort()).toEqual(['text']);
     });
     it('should resolve mixed field types to their respective stores', () => {
         const stores = resolveStoreTypes(DocsCollectionConfig.fields, [
@@ -256,21 +255,21 @@ describe('resolveStoreTypes', () => {
             'views',
             'price',
         ]);
-        assert.deepStrictEqual([...stores].sort(), ['boolean', 'datetime', 'numeric', 'text']);
+        expect([...stores].sort()).toEqual(['boolean', 'datetime', 'numeric', 'text']);
     });
     it('should resolve blocks field to all child store types', () => {
         const stores = resolveStoreTypes(DocsCollectionConfig.fields, ['content']);
         // content blocks contain: richText (json), boolean, text, image (file)
-        assert.ok(stores.has('json'), 'should include json for richText');
-        assert.ok(stores.has('boolean'), 'should include boolean for constrainedWidth');
-        assert.ok(stores.has('text'), 'should include text for display/alt');
-        assert.ok(stores.has('file'), 'should include file for photo/image');
+        expect(stores.has('json'), 'should include json for richText').toBeTruthy();
+        expect(stores.has('boolean'), 'should include boolean for constrainedWidth').toBeTruthy();
+        expect(stores.has('text'), 'should include text for display/alt').toBeTruthy();
+        expect(stores.has('file'), 'should include file for photo/image').toBeTruthy();
     });
     it('should resolve array field to child store types', () => {
         const stores = resolveStoreTypes(DocsCollectionConfig.fields, ['reviews']);
         // reviews array contains group with: integer (numeric), richText (json)
-        assert.ok(stores.has('numeric'), 'should include numeric for rating');
-        assert.ok(stores.has('json'), 'should include json for comment richText');
+        expect(stores.has('numeric'), 'should include numeric for rating').toBeTruthy();
+        expect(stores.has('json'), 'should include json for comment richText').toBeTruthy();
     });
     it('should ignore field names that do not exist in the collection', () => {
         const stores = resolveStoreTypes(DocsCollectionConfig.fields, [
@@ -278,11 +277,11 @@ describe('resolveStoreTypes', () => {
             'updated_at',
             'nonexistent',
         ]);
-        assert.strictEqual(stores.size, 0, 'metadata fields should not resolve to any store');
+        expect(stores.size, 'metadata fields should not resolve to any store').toBe(0);
     });
     it('should return empty set for empty field list', () => {
         const stores = resolveStoreTypes(DocsCollectionConfig.fields, []);
-        assert.strictEqual(stores.size, 0);
+        expect(stores.size).toBe(0);
     });
 });
 describe('reserved field-name tolerance on restore', () => {
@@ -310,9 +309,9 @@ describe('reserved field-name tolerance on restore', () => {
             value: 'Hello',
         };
         const { data: restored, warnings } = restoreFieldSetData(DocsCollectionConfig.fields, [orphanPathRow, titleRow], 'en');
-        assert.strictEqual(restored.path, undefined, 'reserved-name row must not land on the reconstructed document');
-        assert.strictEqual(restored.title, 'Hello', 'non-reserved rows must still be restored');
-        assert.deepStrictEqual(warnings, [], 'reserved-name orphan must not surface as a restore warning');
+        expect(restored.path, 'reserved-name row must not land on the reconstructed document').toBe(undefined);
+        expect(restored.title, 'non-reserved rows must still be restored').toBe('Hello');
+        expect(warnings, 'reserved-name orphan must not surface as a restore warning').toEqual([]);
     });
     it('does not raise warnings when the only row present is a reserved-name orphan', () => {
         const orphanPathRow = {
@@ -322,6 +321,6 @@ describe('reserved field-name tolerance on restore', () => {
             value: 'whatever',
         };
         const { warnings } = restoreFieldSetData(DocsCollectionConfig.fields, [orphanPathRow]);
-        assert.deepStrictEqual(warnings, [], 'a reserved-name orphan must not be treated as an unknown field');
+        expect(warnings, 'a reserved-name orphan must not be treated as an unknown field').toEqual([]);
     });
 });