@carecard/auth-util 3.18.0 → 3.20.0

package/lib/jwtUtilAuth.js

@@ -1,22 +1,25 @@
 const crypto = require('crypto');
 
+const supportedVerificationHashes = new Set(crypto.getHashes().map(hash => hash.toLowerCase()));
+
+// Pattern: Normalizer - preserves explicit registered times while supplying omitted defaults.
 const _normalizePayload = payloadObject => {
   const payload = { ...payloadObject };
   const now = Math.floor(Date.now() / 1000);
   const fieldsToNormalize = ['iat', 'exp', 'nbf', 'auth_time'];
   const msThreshold = 1000000000000;
 
-  if (!payload.iat) {
+  if (!Number.isFinite(payload.iat)) {
     payload.iat = now;
   }
 
   fieldsToNormalize.forEach(field => {
-    if (payload[field] && payload[field] > msThreshold) {
+    if (Number.isFinite(payload[field]) && payload[field] > msThreshold) {
       payload[field] = Math.floor(payload[field] / 1000);
     }
   });
 
-  if (!payload.exp) {
+  if (!Number.isFinite(payload.exp)) {
     payload.exp = payload.iat + 3600;
   }
   return payload;
@@ -52,12 +55,29 @@ const _verify = (token, signature, alg, publicKey) => {
   return verify.verify(publicKey, signature, 'base64url');
 };
 
+// Pattern: Allow List - rejects algorithms that the runtime cannot safely verify.
+const isSupportedVerificationAlgorithm = algorithm => {
+  if (algorithm === 'EdDSA' || algorithm === 'Ed25519') {
+    return true;
+  }
+  return typeof algorithm === 'string' && supportedVerificationHashes.has(algorithm.toLowerCase());
+};
+
+// Pattern: Type Guard - decoded JWT parts must honor their documented object contract.
+const isDecodedJwtObject = value => {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+};
+
 const isNonEmptyString = value => {
   return typeof value === 'string' && value.trim().length > 0;
 };
 
 const audienceIsNonEmptyStringArray = audience => {
-  return Array.isArray(audience) && audience.length > 0 && audience.every(audienceValue => isNonEmptyString(audienceValue));
+  return (
+    Array.isArray(audience) &&
+    audience.length > 0 &&
+    audience.every(audienceValue => isNonEmptyString(audienceValue))
+  );
 };
 
 const isNonEmptyAudience = audience => {
@@ -65,7 +85,9 @@ const isNonEmptyAudience = audience => {
 };
 
 const normalizeSeconds = value => {
-  if (!Number.isFinite(value)) return null;
+  if (!Number.isFinite(value)) {
+    return null;
+  }
   return value > 1000000000000 ? Math.floor(value / 1000) : Math.floor(value);
 };
 
@@ -77,7 +99,9 @@ const normalizeSeconds = value => {
  * @return {string|null}
  */
 const createSignedJwtFromObject = (headerObject, payloadObject, privateKey) => {
-  if (!privateKey) return null;
+  if (!privateKey) {
+    return null;
+  }
 
   const header = { ...headerObject };
   header.alg = header.alg || 'EdDSA';
@@ -116,7 +140,9 @@ function createServiceJwt({
   }
 
   const iat = normalizeSeconds(issuedAt);
-  if (!Number.isInteger(iat)) return null;
+  if (!Number.isInteger(iat)) {
+    return null;
+  }
 
   // Service-to-service tokens use registered JWT claims so receivers can
   // validate sender, intended audience, subject, and lifetime consistently.
@@ -145,19 +171,29 @@ function createServiceAuthorizationHeader(options = {}) {
  * @param publicKey
  * @return {boolean}
  */
+// Pattern: Fail-Closed Verification - malformed token metadata returns false before crypto use.
 const verifyJwtSignature = (jwt, publicKey) => {
   try {
-    if (!jwt || !publicKey) return false;
+    if (!jwt || !publicKey) {
+      return false;
+    }
     const splitJWT = jwt.split('.');
-    if (splitJWT.length !== 3) return false;
+    if (splitJWT.length !== 3) {
+      return false;
+    }
 
     const [header, payload, signature] = splitJWT;
     const token = header + '.' + payload;
     const headerObject = _decode(header);
+    if (!isDecodedJwtObject(headerObject) || !isSupportedVerificationAlgorithm(headerObject.alg)) {
+      return false;
+    }
 
     return _verify(token, signature, headerObject.alg, publicKey);
   } catch (error) {
-    if (!(error instanceof SyntaxError)) throw error;
+    if (!(error instanceof SyntaxError)) {
+      throw error;
+    }
     return false;
   }
 };
@@ -167,18 +203,28 @@ const verifyJwtSignature = (jwt, publicKey) => {
  * @param jwt
  * @return {{payload: *, header: *}|null}
  */
+// Pattern: Boundary Validation - returns only decoded header and payload objects.
 const getHeaderPayloadFromJwt = jwt => {
   try {
-    if (typeof jwt !== 'string') return null;
+    if (typeof jwt !== 'string') {
+      return null;
+    }
     const splitJWT = jwt.split('.');
-    if (splitJWT.length !== 3) return null;
+    if (splitJWT.length !== 3) {
+      return null;
+    }
 
     const headerObject = _decode(splitJWT[0]);
     const payloadObject = _decode(splitJWT[1]);
+    if (!isDecodedJwtObject(headerObject) || !isDecodedJwtObject(payloadObject)) {
+      return null;
+    }
 
     return { header: headerObject, payload: payloadObject };
   } catch (error) {
-    if (!(error instanceof SyntaxError)) throw error;
+    if (!(error instanceof SyntaxError)) {
+      throw error;
+    }
     return null;
   }
 };

package/lib/pwdUtilAuth.js

@@ -1,38 +1,67 @@
 const crypto = require('crypto');
 
-/**
- * Automatically adds random salt.
- * @param password
- * @param secret
- * @param algorithm
- * @return {string}
- */
+const PASSWORD_HASH_VERSION = '1';
+
+// Pattern: Pure Function - creates a digest in which both the pepper and random salt participate.
+function createSaltedPasswordDigest(password, secret, algorithm, salt) {
+  return crypto
+    .createHmac(algorithm, secret)
+    .update(Buffer.from(salt, 'base64'))
+    .update(password)
+    .digest('base64');
+}
+
+// Pattern: Pure Function - recreates the historical digest for existing stored credentials.
+function createLegacyPasswordDigest(password, secret, algorithm) {
+  return crypto.createHmac(algorithm, secret).update(password).digest('base64');
+}
+
+// Pattern: Serializer - preserves the published password-hash storage contract.
+function serializePasswordHash(algorithmBase64, hashBase64, salt) {
+  return `$${PASSWORD_HASH_VERSION}$${algorithmBase64}$${hashBase64}$${salt}$`;
+}
+
+// Pattern: Constant-Time Comparison - avoids credential-dependent string comparison timing.
+function passwordHashesMatch(candidateHash, savedPasswordHash) {
+  const candidateBuffer = Buffer.from(candidateHash);
+  const savedBuffer = Buffer.from(savedPasswordHash);
+  return (
+    candidateBuffer.length === savedBuffer.length &&
+    crypto.timingSafeEqual(candidateBuffer, savedBuffer)
+  );
+}
+
+// Pattern: Factory - creates a password hash whose random salt changes the credential digest.
 const createPasswordHashWithRandomSalt = (password, secret, algorithm) => {
   const salt = crypto.randomBytes(32).toString('base64');
   const algorithmBase64 = Buffer.from(algorithm).toString('base64');
-  const hashBase64 = crypto.createHmac(algorithm, secret).update(password).digest('base64');
-  return '$1$' + algorithmBase64 + '$' + hashBase64 + '$' + salt + '$';
+  const hashBase64 = createSaltedPasswordDigest(password, secret, algorithm, salt);
+  return serializePasswordHash(algorithmBase64, hashBase64, salt);
 };
 
-/**
- * Creates hash based on saved hash in database.
- * @param password
- * @param savedPasswordHash
- * @param secret
- * @return {string}
- */
+// Pattern: Compatibility Verification - verifies salted hashes while retaining existing credentials.
 const createPasswordHashBasedOnSavedAlgorithmSalt = (password, savedPasswordHash, secret) => {
-  if (typeof savedPasswordHash !== 'string') return null;
+  if (typeof savedPasswordHash !== 'string') {
+    return null;
+  }
 
   const splitStringArray = savedPasswordHash.split('$');
-  if (splitStringArray.length !== 6) return null;
+  if (splitStringArray.length !== 6) {
+    return null;
+  }
 
+  const version = splitStringArray[1];
   const algBase64 = splitStringArray[2];
   const salt = splitStringArray[4];
+  if (version !== PASSWORD_HASH_VERSION || !algBase64 || !salt) {
+    return null;
+  }
   const algorithm = Buffer.from(algBase64, 'base64').toString('utf8');
-
-  const hashBase64 = crypto.createHmac(algorithm, secret).update(password).digest('base64');
-  return '$1$' + algBase64 + '$' + hashBase64 + '$' + salt + '$';
+  const saltedDigest = createSaltedPasswordDigest(password, secret, algorithm, salt);
+  const saltedHash = serializePasswordHash(algBase64, saltedDigest, salt);
+  const legacyDigest = createLegacyPasswordDigest(password, secret, algorithm);
+  const legacyHash = serializePasswordHash(algBase64, legacyDigest, salt);
+  return passwordHashesMatch(legacyHash, savedPasswordHash) ? legacyHash : saltedHash;
 };
 
 module.exports = {

package/lib/stringUtilAuth.js

@@ -60,7 +60,9 @@ const base64ToAscii = codedString => {
  */
 const dollarSignConnectedStringToAlgorithmHashSalt = passwordHash => {
   const splitStringArray = passwordHash.split('$');
-  if (splitStringArray.length !== 6) return null;
+  if (splitStringArray.length !== 6) {
+    return null;
+  }
   return {
     version: splitStringArray[1],
     alg: splitStringArray[2],
@@ -76,9 +78,13 @@ const dollarSignConnectedStringToAlgorithmHashSalt = passwordHash => {
  * @deprecated Use native Buffer methods or other modern alternatives.
  */
 const dotConnectedStringToHeaderPayloadSignature = jwt => {
-  if (typeof jwt !== 'string') return null;
+  if (typeof jwt !== 'string') {
+    return null;
+  }
   const splitJWT = jwt.split('.');
-  if (splitJWT.length !== 3) return null;
+  if (splitJWT.length !== 3) {
+    return null;
+  }
   return {
     header: splitJWT[0],
     payload: splitJWT[1],

package/lint-staged.config.mjs

@@ -0,0 +1,36 @@
+import { ESLint } from 'eslint';
+
+const eslint = new ESLint();
+
+// Pattern: Pure Function - builds one deterministic command without shell interpolation.
+const createCommand = (command, filePaths) =>
+  `${command} ${filePaths.map(filePath => JSON.stringify(filePath)).join(' ')}`;
+
+// Pattern: Adapter - derives lint-staged input from ESLint's authoritative ignore rules.
+const removeEslintIgnoredFiles = async filePaths => {
+  const ignoredFileStates = await Promise.all(
+    filePaths.map(filePath => eslint.isPathIgnored(filePath)),
+  );
+
+  return filePaths.flatMap((filePath, index) => (ignoredFileStates[index] ? [] : [filePath]));
+};
+
+// Pattern: Pipeline - preserves ESLint-before-Prettier ordering for staged code.
+const createJavaScriptTasks = async filePaths => {
+  const lintableFilePaths = await removeEslintIgnoredFiles(filePaths);
+  const tasks = [];
+
+  if (lintableFilePaths.length > 0) {
+    tasks.push(createCommand('eslint --fix --max-warnings 0', lintableFilePaths));
+  }
+
+  tasks.push(createCommand('prettier --write', filePaths));
+  return tasks;
+};
+
+const lintStagedConfig = {
+  '*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}': createJavaScriptTasks,
+  '*.{json,jsonc,md,mdx,css,scss,yaml,yml}': ['prettier --write'],
+};
+
+export default lintStagedConfig;

package/package.json

@@ -1,21 +1,23 @@
 {
   "name": "@carecard/auth-util",
-  "version": "3.18.0",
+  "version": "3.20.0",
   "repository": "https://github.com/CareCard-ca/pkg-auth-util.git",
   "description": "Auth utility functions",
   "main": "index.js",
   "types": "index.d.ts",
   "scripts": {
     "test": "node scripts/runPackageTask.mjs test",
-    "test:order": "node --test scripts/testOrder/randomizeTestOrder.test.mjs scripts/testOrder/testOrderPolicy.test.mjs scripts/testParallel/runIndexedMochaTests.test.mjs scripts/testParallel/parallelTestPolicy.test.mjs scripts/packageTaskRunner.test.mjs",
+    "test:order": "node --test scripts/testOrder/randomizeTestOrder.test.mjs scripts/testParallel/runIndexedMochaTests.test.mjs scripts/packageTaskRunner.test.mjs scripts/canonicalTestCommand.test.mjs",
     "test:types": "node scripts/runPackageTask.mjs test:types",
     "test:coverage": "node scripts/runPackageTask.mjs test:coverage",
     "test:All": "node scripts/runPackageTask.mjs test:All",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
+    "validate:audits": "node scripts/runPackageTask.mjs validate:audits",
+    "format": "prettier --write \"**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}\"",
+    "format:check": "prettier --check \"**/*.{js,jsx,mjs,cjs,ts,tsx,mts,cts}\"",
+    "lint-staged": "lint-staged",
     "prepare": "husky",
-    "lint:fix": "eslint --fix",
-    "lint": "eslint"
+    "lint:fix": "eslint . --fix --max-warnings 0",
+    "lint": "eslint . --max-warnings 0"
   },
   "keywords": [
     "auth",
@@ -26,31 +28,35 @@
   "author": "CareCard team",
   "license": "ISC",
   "devDependencies": {
+    "@eslint/js": "9.39.5",
     "@istanbuljs/nyc-config-typescript": "1.0.2",
     "@types/mocha": "10.0.10",
     "@types/node": "25.9.3",
-    "eslint": "9.39.4",
+    "@typescript-eslint/parser": "8.67.0",
+    "eslint": "9.39.5",
     "express": "5.2.1",
+    "globals": "17.7.0",
     "husky": "9.1.7",
-    "lint-staged": "17.0.7",
+    "lint-staged": "17.2.0",
     "mocha": "11.7.6",
     "nyc": "18.0.0",
-    "prettier": "3.8.4",
+    "prettier": "3.9.6",
     "source-map-support": "0.5.21",
     "supertest": "7.2.2",
     "ts-node": "10.9.2",
     "typescript": "6.0.3"
   },
   "dependencies": {
-    "@carecard/common-util": "3.18.0",
-    "@carecard/validate": "3.18.0",
+    "@carecard/common-util": "3.20.0",
+    "@carecard/validate": "3.20.0",
     "@types/express": "5.0.6"
   },
   "overrides": {
     "diff": "8.0.4",
     "glob": "13.0.6",
-    "minimatch": "10.2.5",
+    "brace-expansion": "5.0.9",
+    "minimatch": "10.2.6",
     "serialize-javascript": "7.0.5",
-    "js-yaml": "4.3.0"
+    "js-yaml": "4.3.1"
   }
 }

package/readme.md

@@ -11,7 +11,9 @@ Utility package for authentication and authorization in the CareCard ecosystem.
 
 ## Development Rule
 
-Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
+Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, run the relevant focused non-test
+validation before changing the prose; do not add automated tests that inspect
+prose, files, or repository structure.
 
 Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
 
@@ -172,3 +174,22 @@ immediately when no helper remains, allow only a bounded 250 ms settlement
 window for already-stopping helpers, fail persistent descendants, preserve
 failures and output, use exit code `124` only for a real outer deadline, and
 remain a final guard rather than a substitute for explicit cleanup.
+
+## TDD And Validation
+
+Test Driven Development is a non-negotiable requirement.
+
+The sole purpose of automated tests is to verify observable functionality and externally visible behavior.
+Tests must validate what the system does through its public interfaces and expected outcomes.
+
+Tests must not assert, inspect, or depend on implementation details, including but not limited to:
+
+- The existence of specific lines of code, statements, functions, classes, files, or modules.
+- Specific algorithms, control flow, variable names, method calls, code snippets, or internal implementation choices.
+- Any internal structure that can change without changing externally observable behavior.
+
+A correct implementation may be completely rewritten or refactored without requiring changes to functional tests, provided its externally observable behavior remains unchanged.
+
+Any test that fails solely because the implementation changed while the externally observable behavior remained correct is incorrectly designed and must be rewritten or removed.
+
+This requirement is mandatory for all new tests and must be applied whenever existing tests are modified.

package/scripts/canonicalTestCommand.test.mjs

@@ -0,0 +1,33 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { runPackageTask } from './runPackageTask.mjs';
+
+test('the complete test command runs each validation category exactly once', () => {
+  const executedSteps = [];
+
+  const exitCode = runPackageTask('test', taskStep => {
+    executedSteps.push([taskStep.command, ...(taskStep.arguments ?? [])].join(' '));
+    return 0;
+  });
+
+  assert.equal(exitCode, 0);
+  assert.deepEqual(executedSteps, [
+    'npm run validate:audits',
+    'npm run test:order',
+    'tsc --noEmit',
+    'mocha --require ./scripts/testOrder/randomizeTestOrder.cjs -r ts-node/register test/types.test.ts',
+    'nyc node test/index.test.js',
+  ]);
+});
+
+test('the legacy aggregate command delegates to the complete test command once', () => {
+  const executedSteps = [];
+
+  runPackageTask('test:All', taskStep => {
+    executedSteps.push([taskStep.command, ...(taskStep.arguments ?? [])].join(' '));
+    return 0;
+  });
+
+  assert.deepEqual(executedSteps, ['npm test']);
+});

package/scripts/packageTaskRunner.audit.mjs

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+const composedCommandPattern = /&&|\|\||\bsh -c\b|\bnode -e\b/u;
+const runnerCommandPattern = /^node scripts\/runPackageTask\.mjs ([A-Za-z0-9:_-]+)$/u;
+
+async function loadPackageTaskRunner() {
+  return import(new URL('./runPackageTask.mjs', import.meta.url));
+}
+
+test('delegates composed package tasks to the repository runner', async () => {
+  const runnerCommands = Object.entries(packageJson.scripts ?? {}).filter(([, command]) =>
+    runnerCommandPattern.test(command),
+  );
+
+  for (const [scriptName, command] of Object.entries(packageJson.scripts ?? {})) {
+    assert.doesNotMatch(
+      command,
+      composedCommandPattern,
+      `${scriptName} must delegate composition to runPackageTask.mjs`,
+    );
+  }
+
+  assert.ok(runnerCommands.length > 0, 'at least one package task must use the runner');
+  const { packageTasks } = await loadPackageTaskRunner();
+  for (const [scriptName] of runnerCommands) {
+    assert.ok(packageTasks[scriptName], `${scriptName} must have a runner task`);
+  }
+});
+
+test('does not suppress command execution errors at the CLI boundary', () => {
+  const runnerSource = readFileSync(new URL('./runPackageTask.mjs', import.meta.url), 'utf8');
+
+  assert.doesNotMatch(runnerSource, /catch\s*\{/u);
+});

package/scripts/packageTaskRunner.test.mjs

@@ -1,29 +1,10 @@
 import assert from 'node:assert/strict';
-import { readFileSync } from 'node:fs';
 import test from 'node:test';
 
-const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
-const composedCommandPattern = /&&|\|\||\bsh -c\b|\bnode -e\b/u;
-const runnerCommandPattern = /^node scripts\/runPackageTask\.mjs ([A-Za-z0-9:_-]+)$/u;
-
 async function loadPackageTaskRunner() {
   return import(new URL('./runPackageTask.mjs', import.meta.url));
 }
 
-test('delegates composed package tasks to the repository runner', async () => {
-  const runnerCommands = Object.entries(packageJson.scripts ?? {}).filter(([, command]) => runnerCommandPattern.test(command));
-
-  for (const [scriptName, command] of Object.entries(packageJson.scripts ?? {})) {
-    assert.doesNotMatch(command, composedCommandPattern, `${scriptName} must delegate composition to runPackageTask.mjs`);
-  }
-
-  assert.ok(runnerCommands.length > 0, 'at least one package task must use the runner');
-  const { packageTasks } = await loadPackageTaskRunner();
-  for (const [scriptName] of runnerCommands) {
-    assert.ok(packageTasks[scriptName], `${scriptName} must have a runner task`);
-  }
-});
-
 test('runs task steps in order and stops at the first failure', async () => {
   const { runPackageTask } = await loadPackageTaskRunner();
   const executedCommands = [];
@@ -65,17 +46,14 @@ test('runs conditional steps only when their required output is missing', async
   assert.deepEqual(executedCommands, ['execute']);
 });
 
-test('does not suppress command execution errors at the CLI boundary', () => {
-  const runnerSource = readFileSync(new URL('./runPackageTask.mjs', import.meta.url), 'utf8');
-
-  assert.doesNotMatch(runnerSource, /catch\s*\{/u);
-});
-
 test('merges task environment overrides without mutating inherited values', async () => {
   const { createTaskEnvironment } = await loadPackageTaskRunner();
   const inheritedEnvironment = { NODE_ENV: 'test', PATH: '/bin' };
 
-  const environment = createTaskEnvironment({ NODE_ENV: 'production', DB_ENV: 'privileged' }, inheritedEnvironment);
+  const environment = createTaskEnvironment(
+    { NODE_ENV: 'production', DB_ENV: 'privileged' },
+    inheritedEnvironment,
+  );
 
   assert.deepEqual(environment, {
     NODE_ENV: 'production',

package/scripts/runPackageTask.mjs

@@ -4,27 +4,51 @@ import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 export const packageTasks = Object.freeze({
+  'validate:audits': [
+    { command: 'node', arguments: ['scripts/packageTaskRunner.audit.mjs'] },
+    { command: 'node', arguments: ['scripts/testOrder/testOrderPolicy.audit.mjs'] },
+    { command: 'node', arguments: ['scripts/testParallel/parallelTestPolicy.audit.mjs'] },
+    { command: 'mocha', arguments: ['test/config/repositoryIsolation.audit.js'] },
+    { command: 'mocha', arguments: ['test/config/tddGuidanceDocs.audit.js'] },
+    { command: 'mocha', arguments: ['test/dependencyOverrides.audit.js'] },
+  ],
   test: [
+    { command: 'npm', arguments: ['run', 'validate:audits'] },
     { command: 'npm', arguments: ['run', 'test:order'] },
-    { command: 'node', arguments: ['test/index.test.js'] },
+    { command: 'tsc', arguments: ['--noEmit'] },
+    {
+      command: 'mocha',
+      arguments: [
+        '--require',
+        './scripts/testOrder/randomizeTestOrder.cjs',
+        '-r',
+        'ts-node/register',
+        'test/types.test.ts',
+      ],
+    },
+    { command: 'nyc', arguments: ['node', 'test/index.test.js'] },
   ],
   'test:types': [
     { command: 'npm', arguments: ['run', 'test:order'] },
     { command: 'tsc', arguments: ['--noEmit'] },
     {
       command: 'mocha',
-      arguments: ['--require', './scripts/testOrder/randomizeTestOrder.cjs', '-r', 'ts-node/register', 'test/types.test.ts'],
+      arguments: [
+        '--require',
+        './scripts/testOrder/randomizeTestOrder.cjs',
+        '-r',
+        'ts-node/register',
+        'test/types.test.ts',
+      ],
     },
   ],
   'test:coverage': [
+    { command: 'npm', arguments: ['run', 'validate:audits'] },
     { command: 'npm', arguments: ['run', 'test:order'] },
     { command: 'tsc', arguments: ['--noEmit'] },
     { command: 'nyc', arguments: ['node', 'test/index.test.js'] },
   ],
-  'test:All': [
-    { command: 'npm', arguments: ['run', 'test'] },
-    { command: 'npm', arguments: ['run', 'test:types'] },
-  ],
+  'test:All': [{ command: 'npm', arguments: ['test'] }],
 });
 
 export function createTaskEnvironment(overrides = {}, inheritedEnvironment = process.env) {
@@ -32,10 +56,18 @@ export function createTaskEnvironment(overrides = {}, inheritedEnvironment = pro
 }
 
 function getTaskExitCode(result) {
-  if (result.error) throw result.error;
-  if (typeof result.status === 'number') return result.status;
-  if (result.signal === 'SIGINT') return 130;
-  if (result.signal === 'SIGTERM') return 143;
+  if (result.error) {
+    throw result.error;
+  }
+  if (typeof result.status === 'number') {
+    return result.status;
+  }
+  if (result.signal === 'SIGINT') {
+    return 130;
+  }
+  if (result.signal === 'SIGTERM') {
+    return 143;
+  }
   return 1;
 }
 
@@ -57,20 +89,33 @@ function shouldRunTaskStep(taskStep, pathExists) {
   return !taskStep.whenMissing || !pathExists(taskStep.whenMissing);
 }
 
-export function runPackageTask(taskName, executeTask = executeTaskStep, taskDefinitions = packageTasks, pathExists = existsSync) {
+export function runPackageTask(
+  taskName,
+  executeTask = executeTaskStep,
+  taskDefinitions = packageTasks,
+  pathExists = existsSync,
+) {
   const taskSteps = taskDefinitions[taskName];
-  if (!Array.isArray(taskSteps)) throw new Error('Unknown package task.');
+  if (!Array.isArray(taskSteps)) {
+    throw new Error('Unknown package task.');
+  }
 
   for (const taskStep of taskSteps) {
-    if (!shouldRunTaskStep(taskStep, pathExists)) continue;
+    if (!shouldRunTaskStep(taskStep, pathExists)) {
+      continue;
+    }
     const exitCode = executeTask(taskStep);
-    if (exitCode !== 0) return exitCode;
+    if (exitCode !== 0) {
+      return exitCode;
+    }
   }
   return 0;
 }
 
 function isDirectExecution() {
-  if (!process.argv[1]) return false;
+  if (!process.argv[1]) {
+    return false;
+  }
   return resolve(process.argv[1]) === fileURLToPath(import.meta.url);
 }
 
@@ -85,4 +130,6 @@ function runCommandLineTask() {
   process.exitCode = runPackageTask(taskName);
 }
 
-if (isDirectExecution()) runCommandLineTask();
+if (isDirectExecution()) {
+  runCommandLineTask();
+}