@udibo/oauth2 0.14.0 → 0.15.0

package/{esm → dist}/testing/contract/identity-session.js

@@ -3,8 +3,7 @@
  * These are distinct from the Hono BFF SessionStore contract.
  * @module
  */
-import { assert, assertEquals, assertExists, assertStrictEquals, } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { afterEach, beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { afterEach, assert, beforeEach, describe, expect, it } from "vitest";
 function summary(id, lastSeenAt = Date.now() - 30_000) {
     return {
         id,
@@ -40,42 +39,42 @@ export function runRevocableSessionServiceContractTests(options) {
             await fixture.addSession(fixture.otherUserId, summary(fixture.sessionId(4)), "live");
         }
         it("reports zero for users without sessions", async () => {
-            assertEquals(await fixture.service.revokeAllByUser(fixture.userId), 0);
-            assertEquals(await fixture.service.revokeOthers(fixture.userId, fixture.sessionId(99)), 0);
+            expect(await fixture.service.revokeAllByUser(fixture.userId)).toStrictEqual(0);
+            expect(await fixture.service.revokeOthers(fixture.userId, fixture.sessionId(99))).toStrictEqual(0);
         });
         it("revokes all of the selected user's sessions immediately and only once", async () => {
             await seed();
-            assertEquals(await fixture.service.revokeAllByUser(fixture.userId), 3);
+            expect(await fixture.service.revokeAllByUser(fixture.userId)).toStrictEqual(3);
             for (const id of [
                 fixture.sessionId(1),
                 fixture.sessionId(2),
                 fixture.sessionId(3),
             ]) {
-                assertStrictEquals(await fixture.isLive(id), false);
+                expect(await fixture.isLive(id)).toBe(false);
             }
-            assertStrictEquals(await fixture.isLive(fixture.sessionId(4)), true);
-            assertEquals(await fixture.service.revokeAllByUser(fixture.userId), 0);
+            expect(await fixture.isLive(fixture.sessionId(4))).toBe(true);
+            expect(await fixture.service.revokeAllByUser(fixture.userId)).toStrictEqual(0);
         });
         it("keeps only the selected current session and preserves another user's sessions", async () => {
             await seed();
-            assertEquals(await fixture.service.revokeOthers(fixture.userId, fixture.sessionId(2)), 2);
-            assertStrictEquals(await fixture.isLive(fixture.sessionId(1)), false);
-            assertStrictEquals(await fixture.isLive(fixture.sessionId(3)), false);
-            assertStrictEquals(await fixture.isLive(fixture.sessionId(2)), true);
-            assertStrictEquals(await fixture.isLive(fixture.sessionId(4)), true);
-            assertEquals(await fixture.service.revokeOthers(fixture.userId, fixture.sessionId(2)), 0);
+            expect(await fixture.service.revokeOthers(fixture.userId, fixture.sessionId(2))).toStrictEqual(2);
+            expect(await fixture.isLive(fixture.sessionId(1))).toBe(false);
+            expect(await fixture.isLive(fixture.sessionId(3))).toBe(false);
+            expect(await fixture.isLive(fixture.sessionId(2))).toBe(true);
+            expect(await fixture.isLive(fixture.sessionId(4))).toBe(true);
+            expect(await fixture.service.revokeOthers(fixture.userId, fixture.sessionId(2))).toStrictEqual(0);
         });
         it("a foreign keepSessionId cannot exempt the selected user's sessions", async () => {
             await seed();
-            assertEquals(await fixture.service.revokeOthers(fixture.userId, fixture.sessionId(4)), 3);
+            expect(await fixture.service.revokeOthers(fixture.userId, fixture.sessionId(4))).toStrictEqual(3);
             for (const id of [
                 fixture.sessionId(1),
                 fixture.sessionId(2),
                 fixture.sessionId(3),
             ]) {
-                assertStrictEquals(await fixture.isLive(id), false);
+                expect(await fixture.isLive(id)).toBe(false);
             }
-            assertStrictEquals(await fixture.isLive(fixture.sessionId(4)), true);
+            expect(await fixture.isLive(fixture.sessionId(4))).toBe(true);
         });
         it("does not double-count concurrent revocations", async () => {
             await seed();
@@ -85,15 +84,15 @@ export function runRevocableSessionServiceContractTests(options) {
                     throw result.reason;
                 return result.value;
             });
-            assertEquals(counts.reduce((sum, count) => sum + count, 0), 3, "concurrent revocation counts must not count a live session twice");
+            expect(counts.reduce((sum, count) => sum + count, 0), "concurrent revocation counts must not count a live session twice").toStrictEqual(3);
             for (const id of [
                 fixture.sessionId(1),
                 fixture.sessionId(2),
                 fixture.sessionId(3),
             ]) {
-                assertStrictEquals(await fixture.isLive(id), false);
+                expect(await fixture.isLive(id)).toBe(false);
             }
-            assertStrictEquals(await fixture.isLive(fixture.sessionId(4)), true);
+            expect(await fixture.isLive(fixture.sessionId(4))).toBe(true);
         });
     });
 }
@@ -114,7 +113,7 @@ export function runListableSessionServiceContractTests(options) {
             await fixture?.dispose?.();
         });
         it("returns an empty list for a user without live sessions", async () => {
-            assertEquals(await fixture.service.listByUser(fixture.userId), []);
+            expect(await fixture.service.listByUser(fixture.userId)).toStrictEqual([]);
         });
         it("lists only the owner's live sessions in most-recently-active order", async () => {
             const oldest = summary(fixture.sessionId(1));
@@ -132,34 +131,43 @@ export function runListableSessionServiceContractTests(options) {
             }
             await fixture.addSession(fixture.otherUserId, summary(fixture.sessionId(4)), "live");
             const rows = await fixture.service.listByUser(fixture.userId);
-            assertEquals(rows.map((row) => row.id), [fixture.sessionId(2), fixture.sessionId(3), fixture.sessionId(1)], "lists must exclude foreign and ended sessions and sort by last activity");
+            expect(rows.map((row) => row.id), "lists must exclude foreign and ended sessions and sort by last activity").toStrictEqual([
+                fixture.sessionId(2),
+                fixture.sessionId(3),
+                fixture.sessionId(1),
+            ]);
             const expectedRows = [newest, middle, oldest];
             for (const [index, expected] of expectedRows.entries()) {
                 const row = rows[index];
-                assertExists(row);
-                assertEquals(row.createdAt, expected.createdAt);
-                assertEquals(row.lastSeenAt, expected.lastSeenAt);
-                assertEquals(Object.keys(row).filter((key) => !["id", "createdAt", "lastSeenAt", "userAgent", "location"]
-                    .includes(key)), [], "session summaries must not expose secret/hash or token material");
+                assert.exists(row);
+                expect(row.createdAt).toStrictEqual(expected.createdAt);
+                expect(row.lastSeenAt).toStrictEqual(expected.lastSeenAt);
+                expect(Object.keys(row).filter((key) => ![
+                    "id",
+                    "createdAt",
+                    "lastSeenAt",
+                    "userAgent",
+                    "location",
+                ].includes(key)), "session summaries must not expose secret/hash or token material").toStrictEqual([]);
                 if (row.userAgent !== undefined) {
-                    assertEquals(row.userAgent, expected.userAgent);
+                    expect(row.userAgent).toStrictEqual(expected.userAgent);
                 }
                 if (row.location !== undefined) {
-                    assertEquals(row.location, expected.location);
+                    expect(row.location).toStrictEqual(expected.location);
                 }
             }
-            assertEquals((await fixture.service.listByUser(fixture.otherUserId)).map((row) => row.id), [fixture.sessionId(4)]);
+            expect((await fixture.service.listByUser(fixture.otherUserId)).map((row) => row.id)).toStrictEqual([fixture.sessionId(4)]);
         });
         it("removes revoked sessions from the authoritative list immediately", async () => {
             await fixture.addSession(fixture.userId, summary(fixture.sessionId(1)), "live");
             await fixture.addSession(fixture.userId, summary(fixture.sessionId(2)), "live");
             await fixture.addSession(fixture.otherUserId, summary(fixture.sessionId(4)), "live");
-            assertEquals(await fixture.service.revokeOthers(fixture.userId, fixture.sessionId(1)), 1);
-            assertEquals((await fixture.service.listByUser(fixture.userId)).map((row) => row.id), [fixture.sessionId(1)]);
-            assertStrictEquals(await fixture.isLive(fixture.sessionId(2)), false);
-            assertEquals(await fixture.service.revokeAllByUser(fixture.userId), 1);
-            assertEquals(await fixture.service.listByUser(fixture.userId), []);
-            assertEquals((await fixture.service.listByUser(fixture.otherUserId)).map((row) => row.id), [fixture.sessionId(4)]);
+            expect(await fixture.service.revokeOthers(fixture.userId, fixture.sessionId(1))).toStrictEqual(1);
+            expect((await fixture.service.listByUser(fixture.userId)).map((row) => row.id)).toStrictEqual([fixture.sessionId(1)]);
+            expect(await fixture.isLive(fixture.sessionId(2))).toBe(false);
+            expect(await fixture.service.revokeAllByUser(fixture.userId)).toStrictEqual(1);
+            expect(await fixture.service.listByUser(fixture.userId)).toStrictEqual([]);
+            expect((await fixture.service.listByUser(fixture.otherUserId)).map((row) => row.id)).toStrictEqual([fixture.sessionId(4)]);
         });
     });
 }

package/{esm → dist}/testing/contract/identity-user-store.d.ts

@@ -1,4 +1,10 @@
-import type { IdentityUser, IdentityUserStore } from "../../identity/service.js";
+/**
+ * Reusable checks for app-owned identity users and password credentials.
+ * Optional capabilities are selected explicitly so an omitted implementation
+ * cannot silently pass a capability the application intends to provide.
+ * @module
+ */
+import type { IdentityUser, IdentityUserStore } from "../../identity/service.ts";
 /** App-specific profile and lookup keys for one fresh test user. */
 export interface IdentityUserContractProfile {
     /** Valid sign-up fields for your application. */
@@ -41,7 +47,7 @@ export interface IdentityUserStoreContractOptions<User extends IdentityUser> {
     legacyCredentials?: boolean;
 }
 /**
- * Register the IdentityUserStore suite in a Deno test file. Credential fixtures
+ * Register the IdentityUserStore suite in a Vitest test file. Credential fixtures
  * are serialized values, not real passwords: these checks verify persistence,
  * lookup, and conditional writes, rather than password hashing. Concurrent
  * checks can expose read-then-write races but cannot prove every interleaving.

package/{esm → dist}/testing/contract/identity-user-store.js

@@ -4,8 +4,7 @@
  * cannot silently pass a capability the application intends to provide.
  * @module
  */
-import { assert, assertEquals, assertExists, assertStrictEquals, } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { afterEach, beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { afterEach, assert, beforeEach, describe, expect, it } from "vitest";
 const ORIGINAL = {
     hash: "11".repeat(32),
     salt: "22".repeat(16),
@@ -25,7 +24,7 @@ async function drain(calls) {
     });
 }
 /**
- * Register the IdentityUserStore suite in a Deno test file. Credential fixtures
+ * Register the IdentityUserStore suite in a Vitest test file. Credential fixtures
  * are serialized values, not real passwords: these checks verify persistence,
  * lookup, and conditional writes, rather than password hashing. Concurrent
  * checks can expose read-then-write races but cannot prove every interleaving.
@@ -48,9 +47,9 @@ export function runIdentityUserStoreContractTests(options) {
             return await store.create(fixture.makeProfile(sequence).profile, structuredClone(ORIGINAL));
         }
         it("returns undefined for unknown lookup keys and credentials", async () => {
-            assertStrictEquals(await store.findByIdentifier("missing-identity-contract@example.invalid"), undefined);
-            assertStrictEquals(await store.findByEmail("missing-identity-contract@example.invalid"), undefined);
-            assertStrictEquals(await store.getCredential(fixture.unknownUserId), undefined);
+            expect(await store.findByIdentifier("missing-identity-contract@example.invalid")).toBe(undefined);
+            expect(await store.findByEmail("missing-identity-contract@example.invalid")).toBe(undefined);
+            expect(await store.getCredential(fixture.unknownUserId)).toBe(undefined);
         });
         it("creates distinct users and resolves each profile's lookup keys", async () => {
             const first = await create();
@@ -58,24 +57,27 @@ export function runIdentityUserStoreContractTests(options) {
             assert(first.id.length > 0);
             assert(second.id.length > 0);
             assert(first.id !== second.id, "distinct users must have distinct ids");
-            for (const [sequence, user] of [[1, first], [2, second]]) {
+            for (const [sequence, user] of [
+                [1, first],
+                [2, second],
+            ]) {
                 const profile = fixture.makeProfile(sequence);
-                assertEquals((await store.findByIdentifier(profile.identifier))?.id, user.id);
-                assertEquals((await store.findByEmail(profile.email))?.id, user.id);
-                assertEquals(await store.getCredential(user.id), ORIGINAL);
+                expect((await store.findByIdentifier(profile.identifier))?.id).toStrictEqual(user.id);
+                expect((await store.findByEmail(profile.email))?.id).toStrictEqual(user.id);
+                expect(await store.getCredential(user.id)).toStrictEqual(ORIGINAL);
             }
         });
         it("replaces every credential field without changing another user", async () => {
             const first = await create();
             const second = await create(2);
             await store.setCredential(first.id, structuredClone(REPLACEMENT));
-            assertEquals(await store.getCredential(first.id), REPLACEMENT);
-            assertEquals(await store.getCredential(second.id), ORIGINAL);
+            expect(await store.getCredential(first.id)).toStrictEqual(REPLACEMENT);
+            expect(await store.getCredential(second.id)).toStrictEqual(ORIGINAL);
             await store.setCredential(first.id, {
                 hash: ORIGINAL.hash,
                 salt: ORIGINAL.salt,
             });
-            assertEquals(await store.getCredential(first.id), {
+            expect(await store.getCredential(first.id)).toStrictEqual({
                 hash: ORIGINAL.hash,
                 salt: ORIGINAL.salt,
             });
@@ -83,7 +85,7 @@ export function runIdentityUserStoreContractTests(options) {
         if (options.replaceCredential) {
             it("compares credential values, including every parameter and absent params", async () => {
                 const user = await create();
-                assertExists(store.replaceCredential, "replaceCredential capability is required");
+                assert.exists(store.replaceCredential, "replaceCredential capability is required");
                 const mismatches = [
                     { ...ORIGINAL, hash: REPLACEMENT.hash },
                     { ...ORIGINAL, salt: REPLACEMENT.salt },
@@ -95,81 +97,81 @@ export function runIdentityUserStoreContractTests(options) {
                     { hash: ORIGINAL.hash, salt: ORIGINAL.salt },
                 ];
                 for (const expected of mismatches) {
-                    assertStrictEquals(await store.replaceCredential(user.id, expected, REPLACEMENT), false);
-                    assertEquals(await store.getCredential(user.id), ORIGINAL, "a failed compare-and-set must preserve the winner");
+                    expect(await store.replaceCredential(user.id, expected, REPLACEMENT)).toBe(false);
+                    expect(await store.getCredential(user.id), "a failed compare-and-set must preserve the winner").toStrictEqual(ORIGINAL);
                 }
-                assertStrictEquals(await store.replaceCredential(user.id, structuredClone(ORIGINAL), REPLACEMENT), true);
-                assertEquals(await store.getCredential(user.id), REPLACEMENT);
-                assertStrictEquals(await store.replaceCredential(user.id, ORIGINAL, ORIGINAL), false);
-                assertEquals(await store.getCredential(user.id), REPLACEMENT, "read after a lost compare-and-set must see the committed credential");
+                expect(await store.replaceCredential(user.id, structuredClone(ORIGINAL), REPLACEMENT)).toBe(true);
+                expect(await store.getCredential(user.id)).toStrictEqual(REPLACEMENT);
+                expect(await store.replaceCredential(user.id, ORIGINAL, ORIGINAL)).toBe(false);
+                expect(await store.getCredential(user.id), "read after a lost compare-and-set must see the committed credential").toStrictEqual(REPLACEMENT);
                 await store.setCredential(user.id, {
                     hash: ORIGINAL.hash,
                     salt: ORIGINAL.salt,
                 });
-                assertStrictEquals(await store.replaceCredential(user.id, {
+                expect(await store.replaceCredential(user.id, {
                     hash: ORIGINAL.hash,
                     salt: ORIGINAL.salt,
-                }, REPLACEMENT), true);
+                }, REPLACEMENT)).toBe(true);
             });
             it("upgrades an absent credential only once", async () => {
                 const user = await create();
-                assertExists(store.replaceCredential);
-                assertExists(fixture.removeCredential, "removeCredential setup helper is required");
+                assert.exists(store.replaceCredential);
+                assert.exists(fixture.removeCredential, "removeCredential setup helper is required");
                 await fixture.removeCredential(user.id);
-                assertStrictEquals(await store.getCredential(user.id), undefined);
+                expect(await store.getCredential(user.id)).toBe(undefined);
                 const results = await drain(Array.from({ length: 8 }, () => store.replaceCredential(user.id, undefined, structuredClone(REPLACEMENT))));
-                assertEquals(results.filter(Boolean).length, 1, "exactly one concurrent imported upgrade may win");
-                assertEquals(await store.getCredential(user.id), REPLACEMENT);
+                expect(results.filter(Boolean).length, "exactly one concurrent imported upgrade may win").toStrictEqual(1);
+                expect(await store.getCredential(user.id)).toStrictEqual(REPLACEMENT);
             });
             it("allows exactly one concurrent replacement of the same credential", async () => {
                 const user = await create();
                 const other = await create(2);
-                assertExists(store.replaceCredential);
+                assert.exists(store.replaceCredential);
                 const candidates = Array.from({ length: 8 }, (_, index) => ({
                     ...REPLACEMENT,
                     hash: (index + 5).toString(16).padStart(2, "0").repeat(32),
                 }));
                 const results = await drain(candidates.map((credential) => store.replaceCredential(user.id, structuredClone(ORIGINAL), credential)));
-                assertEquals(results.filter(Boolean).length, 1, "exactly one concurrent replacement may win");
-                assertEquals(await store.getCredential(user.id), candidates[results.indexOf(true)]);
-                assertEquals(await store.getCredential(other.id), ORIGINAL);
+                expect(results.filter(Boolean).length, "exactly one concurrent replacement may win").toStrictEqual(1);
+                expect(await store.getCredential(user.id)).toStrictEqual(candidates[results.indexOf(true)]);
+                expect(await store.getCredential(other.id)).toStrictEqual(ORIGINAL);
             });
         }
         if (options.emailVerification) {
             it("verifies only the issued-for email and is idempotent", async () => {
                 const user = await create();
                 const other = await create(2);
-                assertExists(store.markEmailVerified, "email verification capability is required");
-                assertExists(fixture.setEmail);
-                assertExists(fixture.isEmailVerified);
+                assert.exists(store.markEmailVerified, "email verification capability is required");
+                assert.exists(fixture.setEmail);
+                assert.exists(fixture.isEmailVerified);
                 const originalEmail = fixture.makeProfile(1).email;
                 const changedEmail = "changed-identity-contract@example.invalid";
-                assertStrictEquals(await fixture.isEmailVerified(user.id), false);
+                expect(await fixture.isEmailVerified(user.id)).toBe(false);
                 await fixture.setEmail(user.id, changedEmail);
                 await store.markEmailVerified(user.id, originalEmail);
-                assertStrictEquals(await fixture.isEmailVerified(user.id), false, "a token for an old email must not verify the new email");
+                expect(await fixture.isEmailVerified(user.id), "a token for an old email must not verify the new email").toBe(false);
                 await store.markEmailVerified(user.id, changedEmail);
                 await store.markEmailVerified(user.id, changedEmail);
-                assertStrictEquals(await fixture.isEmailVerified(user.id), true);
-                assertStrictEquals(await fixture.isEmailVerified(other.id), false);
+                expect(await fixture.isEmailVerified(user.id)).toBe(true);
+                expect(await fixture.isEmailVerified(other.id)).toBe(false);
             });
         }
         if (options.legacyCredentials) {
             it("clears the selected imported credential and is idempotent", async () => {
                 const user = await create();
                 const other = await create(2);
-                assertExists(store.getLegacyCredential, "legacy credential lookup capability is required");
-                assertExists(store.clearLegacyCredential, "legacy credential clearing capability is required");
-                assertExists(fixture.setLegacyCredential);
-                assertStrictEquals(await store.getLegacyCredential(user.id), null);
+                assert.exists(store.getLegacyCredential, "legacy credential lookup capability is required");
+                assert.exists(store.clearLegacyCredential, "legacy credential clearing capability is required");
+                assert.exists(fixture.setLegacyCredential);
+                expect(await store.getLegacyCredential(user.id)).toBe(null);
                 await fixture.setLegacyCredential(user.id, "imported-hash-one");
                 await fixture.setLegacyCredential(other.id, "imported-hash-two");
-                assertEquals(await store.getLegacyCredential(user.id), "imported-hash-one");
+                expect(await store.getLegacyCredential(user.id)).toStrictEqual("imported-hash-one");
                 await store.clearLegacyCredential(user.id);
                 await store.clearLegacyCredential(user.id);
-                assertStrictEquals(await store.getLegacyCredential(user.id), null);
-                assertEquals(await store.getLegacyCredential(other.id), "imported-hash-two");
-                assertEquals(await store.getCredential(user.id), ORIGINAL);
+                expect(await store.getLegacyCredential(user.id)).toBe(null);
+                expect(await store.getLegacyCredential(other.id)).toStrictEqual("imported-hash-two");
+                expect(await store.getCredential(user.id)).toStrictEqual(ORIGINAL);
             });
         }
     });

package/{esm → dist}/testing/contract/lockout-store.d.ts

@@ -22,7 +22,7 @@
  *
  * @module
  */
-import type { LockoutStore } from "../../identity/lockout.js";
+import type { LockoutStore } from "../../identity/lockout.ts";
 /** Options for {@link runLockoutStoreContractTests}. */
 export interface LockoutStoreContractOptions {
     /**

package/{esm → dist}/testing/contract/lockout-store.js

@@ -22,8 +22,7 @@
  *
  * @module
  */
-import { assertEquals, assertStrictEquals } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { beforeEach, describe, expect, it } from "vitest";
 const USER = "user-1";
 const OTHER_USER = "user-2";
 /**
@@ -43,45 +42,45 @@ export function runLockoutStoreContractTests(options) {
         });
         describe("get", () => {
             it("returns undefined for an account with no record", async () => {
-                assertStrictEquals(await store.get(USER), undefined);
+                expect(await store.get(USER)).toBe(undefined);
             });
         });
         describe("increment", () => {
             it("records the first failure as one", async () => {
                 const result = await store.increment(USER, now);
-                assertEquals(result.failures, 1);
-                assertStrictEquals(result.lockedUntil, undefined);
-                assertEquals((await store.get(USER))?.failures, 1);
+                expect(result.failures).toStrictEqual(1);
+                expect(result.lockedUntil).toBe(undefined);
+                expect((await store.get(USER))?.failures).toStrictEqual(1);
             });
             it("adds one failure per call", async () => {
                 await store.increment(USER, now);
                 await store.increment(USER, now);
-                assertEquals((await store.increment(USER, now)).failures, 3);
+                expect((await store.increment(USER, now)).failures).toStrictEqual(3);
             });
             it("counts each account on its own", async () => {
                 await store.increment(USER, now);
                 await store.increment(USER, now);
-                assertEquals((await store.increment(OTHER_USER, now)).failures, 1);
+                expect((await store.increment(OTHER_USER, now)).failures).toStrictEqual(1);
             });
             it("keeps an active lock while counting the failure", async () => {
                 const lockedUntil = now + 60_000;
                 await store.set(USER, { failures: 10, lockedUntil });
                 const result = await store.increment(USER, now);
-                assertEquals(result.failures, 11);
-                assertStrictEquals(result.lockedUntil, lockedUntil, "a failed attempt against a locked account must not extend or drop " +
-                    "the lock the store is holding");
+                expect(result.failures).toStrictEqual(11);
+                expect(result.lockedUntil, "a failed attempt against a locked account must not extend or drop " +
+                    "the lock the store is holding").toBe(lockedUntil);
             });
             it("starts a fresh count once the lock has expired", async () => {
                 await store.set(USER, { failures: 10, lockedUntil: now - 1 });
                 const result = await store.increment(USER, now);
-                assertEquals(result.failures, 1);
-                assertStrictEquals(result.lockedUntil, undefined, "an expired lock must be dropped, not carried into the next window");
+                expect(result.failures).toStrictEqual(1);
+                expect(result.lockedUntil, "an expired lock must be dropped, not carried into the next window").toBe(undefined);
             });
             it("gives every concurrent failure its own count", async () => {
                 const results = await Promise.all(Array.from({ length: 5 }, () => store.increment(USER, now)));
-                assertEquals(results.map((result) => result.failures).sort((a, b) => a - b), [1, 2, 3, 4, 5], "the lockout triggers on the returned count — concurrent failures " +
-                    "sharing a count undershoot the threshold");
-                assertEquals((await store.get(USER))?.failures, 5);
+                expect(results.map((result) => result.failures).sort((a, b) => a - b), "the lockout triggers on the returned count — concurrent failures " +
+                    "sharing a count undershoot the threshold").toStrictEqual([1, 2, 3, 4, 5]);
+                expect((await store.get(USER))?.failures).toStrictEqual(5);
             });
         });
         describe("set", () => {
@@ -89,33 +88,33 @@ export function runLockoutStoreContractTests(options) {
                 const lockedUntil = now + 60_000;
                 await store.set(USER, { failures: 10, lockedUntil });
                 const record = await store.get(USER);
-                assertEquals(record?.failures, 10);
-                assertStrictEquals(record?.lockedUntil, lockedUntil);
+                expect(record?.failures).toStrictEqual(10);
+                expect(record?.lockedUntil).toBe(lockedUntil);
             });
             it("replaces a record that was already there", async () => {
                 await store.increment(USER, now);
                 await store.set(USER, { failures: 4 });
                 const record = await store.get(USER);
-                assertEquals(record?.failures, 4);
-                assertStrictEquals(record?.lockedUntil, undefined);
+                expect(record?.failures).toStrictEqual(4);
+                expect(record?.lockedUntil).toBe(undefined);
             });
         });
         describe("clear", () => {
             it("drops the account's failures and lock", async () => {
                 await store.set(USER, { failures: 10, lockedUntil: now + 60_000 });
                 await store.clear(USER);
-                assertStrictEquals(await store.get(USER), undefined);
-                assertEquals((await store.increment(USER, now)).failures, 1);
+                expect(await store.get(USER)).toBe(undefined);
+                expect((await store.increment(USER, now)).failures).toStrictEqual(1);
             });
             it("clears only the account it is given", async () => {
                 await store.increment(USER, now);
                 await store.increment(OTHER_USER, now);
                 await store.clear(USER);
-                assertEquals((await store.get(OTHER_USER))?.failures, 1);
+                expect((await store.get(OTHER_USER))?.failures).toStrictEqual(1);
             });
             it("is a no-op for an account with no record", async () => {
                 await store.clear(USER);
-                assertStrictEquals(await store.get(USER), undefined);
+                expect(await store.get(USER)).toBe(undefined);
             });
         });
     });

package/{esm → dist}/testing/contract/mfa-store.d.ts

@@ -23,7 +23,7 @@
  *
  * @module
  */
-import type { MfaStore } from "../../identity/mfa/service.js";
+import type { MfaStore } from "../../identity/mfa/service.ts";
 /** Options for {@link runMfaStoreContractTests}. */
 export interface MfaStoreContractOptions {
     /**