@udibo/oauth2 0.14.0 → 0.15.0

package/{esm → dist}/testing/contract/mfa-store.js

@@ -23,8 +23,7 @@
  *
  * @module
  */
-import { assertEquals, assertStrictEquals } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { beforeEach, describe, expect, it } from "vitest";
 import { CONCURRENT_CALLERS, race } from "./_race.js";
 const USER = "user-1";
 const OTHER_USER = "user-2";
@@ -51,63 +50,63 @@ export function runMfaStoreContractTests(options) {
         });
         describe("getTotp / setPendingTotp", () => {
             it("returns undefined for a user with no record", async () => {
-                assertStrictEquals(await store.getTotp(USER), undefined);
+                expect(await store.getTotp(USER)).toBe(undefined);
             });
             it("stores a pending secret without activating it", async () => {
                 await store.setPendingTotp(USER, SECRET_A);
                 const record = await store.getTotp(USER);
-                assertEquals(record?.pendingSecretBase32, SECRET_A);
-                assertStrictEquals(record?.secretBase32, undefined);
+                expect(record?.pendingSecretBase32).toStrictEqual(SECRET_A);
+                expect(record?.secretBase32).toBe(undefined);
             });
             it("replaces a previous pending secret", async () => {
                 await store.setPendingTotp(USER, SECRET_A);
                 await store.setPendingTotp(USER, SECRET_B);
                 const record = await store.getTotp(USER);
-                assertEquals(record?.pendingSecretBase32, SECRET_B);
+                expect(record?.pendingSecretBase32).toStrictEqual(SECRET_B);
             });
             it("keeps an active credential when a new enrollment starts", async () => {
                 await store.setPendingTotp(USER, SECRET_A);
                 await store.activateTotp(USER, SECRET_A, 100);
                 await store.setPendingTotp(USER, SECRET_B);
                 const record = await store.getTotp(USER);
-                assertEquals(record?.secretBase32, SECRET_A);
-                assertEquals(record?.lastStep, 100);
-                assertEquals(record?.pendingSecretBase32, SECRET_B);
+                expect(record?.secretBase32).toStrictEqual(SECRET_A);
+                expect(record?.lastStep).toStrictEqual(100);
+                expect(record?.pendingSecretBase32).toStrictEqual(SECRET_B);
             });
             it("keeps each user's record separate", async () => {
                 await store.setPendingTotp(USER, SECRET_A);
-                assertStrictEquals(await store.getTotp(OTHER_USER), undefined);
+                expect(await store.getTotp(OTHER_USER)).toBe(undefined);
             });
         });
         describe("activateTotp", () => {
             it("promotes the matching pending secret and clears it", async () => {
                 await store.setPendingTotp(USER, SECRET_A);
-                assertStrictEquals(await store.activateTotp(USER, SECRET_A, 42), true);
+                expect(await store.activateTotp(USER, SECRET_A, 42)).toBe(true);
                 const record = await store.getTotp(USER);
-                assertEquals(record?.secretBase32, SECRET_A);
-                assertEquals(record?.lastStep, 42);
-                assertStrictEquals(record?.pendingSecretBase32, undefined);
+                expect(record?.secretBase32).toStrictEqual(SECRET_A);
+                expect(record?.lastStep).toStrictEqual(42);
+                expect(record?.pendingSecretBase32).toBe(undefined);
             });
             it("refuses when the user has no pending secret", async () => {
-                assertStrictEquals(await store.activateTotp(USER, SECRET_A, 42), false);
-                assertStrictEquals(await store.getTotp(USER), undefined);
+                expect(await store.activateTotp(USER, SECRET_A, 42)).toBe(false);
+                expect(await store.getTotp(USER)).toBe(undefined);
             });
             it("refuses a secret a newer enrollment replaced, changing nothing", async () => {
                 await store.setPendingTotp(USER, SECRET_A);
                 await store.setPendingTotp(USER, SECRET_B);
-                assertStrictEquals(await store.activateTotp(USER, SECRET_A, 42), false);
+                expect(await store.activateTotp(USER, SECRET_A, 42)).toBe(false);
                 const record = await store.getTotp(USER);
-                assertStrictEquals(record?.secretBase32, undefined);
-                assertEquals(record?.pendingSecretBase32, SECRET_B);
+                expect(record?.secretBase32).toBe(undefined);
+                expect(record?.pendingSecretBase32).toStrictEqual(SECRET_B);
             });
             it(`activates for exactly one of ${CONCURRENT_CALLERS} concurrent confirmations`, async () => {
                 await store.setPendingTotp(USER, SECRET_A);
                 const results = await race((caller) => store.activateTotp(USER, SECRET_A, 10 + caller));
-                assertStrictEquals(countTrue(results), 1, "the pending secret must be claimable once — a second concurrent " +
-                    "confirmation finds it already spent");
+                expect(countTrue(results), "the pending secret must be claimable once — a second concurrent " +
+                    "confirmation finds it already spent").toBe(1);
                 const record = await store.getTotp(USER);
-                assertEquals(record?.secretBase32, SECRET_A);
-                assertStrictEquals(record?.pendingSecretBase32, undefined);
+                expect(record?.secretBase32).toStrictEqual(SECRET_A);
+                expect(record?.pendingSecretBase32).toBe(undefined);
             });
             it("activates for exactly one of two concurrent enrollments", async () => {
                 await store.setPendingTotp(USER, SECRET_B);
@@ -115,9 +114,9 @@ export function runMfaStoreContractTests(options) {
                     store.activateTotp(USER, SECRET_A, 10),
                     store.activateTotp(USER, SECRET_B, 20),
                 ]);
-                assertStrictEquals(countTrue(results), 1);
+                expect(countTrue(results)).toBe(1);
                 const record = await store.getTotp(USER);
-                assertEquals(record?.secretBase32, SECRET_B, "only the secret that was actually pending may become active");
+                expect(record?.secretBase32, "only the secret that was actually pending may become active").toStrictEqual(SECRET_B);
             });
         });
         describe("clearTotp", () => {
@@ -126,11 +125,11 @@ export function runMfaStoreContractTests(options) {
                 await store.activateTotp(USER, SECRET_A, 5);
                 await store.setPendingTotp(USER, SECRET_B);
                 await store.clearTotp(USER);
-                assertStrictEquals(await store.getTotp(USER), undefined);
+                expect(await store.getTotp(USER)).toBe(undefined);
             });
             it("is a no-op for a user with no record", async () => {
                 await store.clearTotp(USER);
-                assertStrictEquals(await store.getTotp(USER), undefined);
+                expect(await store.getTotp(USER)).toBe(undefined);
             });
         });
         describe("advanceLastStep", () => {
@@ -139,71 +138,71 @@ export function runMfaStoreContractTests(options) {
                 await store.activateTotp(USER, SECRET_A, 100);
             });
             it("advances to a higher step", async () => {
-                assertStrictEquals(await store.advanceLastStep(USER, 101), true);
-                assertEquals((await store.getTotp(USER))?.lastStep, 101);
+                expect(await store.advanceLastStep(USER, 101)).toBe(true);
+                expect((await store.getTotp(USER))?.lastStep).toStrictEqual(101);
             });
             it("refuses the step already spent", async () => {
-                assertStrictEquals(await store.advanceLastStep(USER, 100), false);
-                assertEquals((await store.getTotp(USER))?.lastStep, 100);
+                expect(await store.advanceLastStep(USER, 100)).toBe(false);
+                expect((await store.getTotp(USER))?.lastStep).toStrictEqual(100);
             });
             it("refuses an earlier step, leaving the guard where it was", async () => {
-                assertStrictEquals(await store.advanceLastStep(USER, 99), false);
-                assertEquals((await store.getTotp(USER))?.lastStep, 100);
+                expect(await store.advanceLastStep(USER, 99)).toBe(false);
+                expect((await store.getTotp(USER))?.lastStep).toStrictEqual(100);
             });
             it("refuses for a user with no record", async () => {
-                assertStrictEquals(await store.advanceLastStep(OTHER_USER, 1), false);
+                expect(await store.advanceLastStep(OTHER_USER, 1)).toBe(false);
             });
             it(`admits exactly one of ${CONCURRENT_CALLERS} concurrent claims on the same step`, async () => {
                 const results = await race(() => store.advanceLastStep(USER, 101));
-                assertStrictEquals(countTrue(results), 1, "a time step is spendable once — the loser must read as a replay");
-                assertEquals((await store.getTotp(USER))?.lastStep, 101);
+                expect(countTrue(results), "a time step is spendable once — the loser must read as a replay").toBe(1);
+                expect((await store.getTotp(USER))?.lastStep).toStrictEqual(101);
             });
             it("never regresses under concurrent claims on different steps", async () => {
                 await Promise.all([
                     store.advanceLastStep(USER, 105),
                     store.advanceLastStep(USER, 101),
                 ]);
-                assertEquals((await store.getTotp(USER))?.lastStep, 105, "the highest accepted step must survive a concurrent lower one");
+                expect((await store.getTotp(USER))?.lastStep, "the highest accepted step must survive a concurrent lower one").toStrictEqual(105);
             });
         });
         describe("recovery hashes", () => {
             it("returns an empty list for a user with none", async () => {
-                assertEquals(await store.getRecoveryHashes(USER), []);
+                expect(await store.getRecoveryHashes(USER)).toStrictEqual([]);
             });
             it("replaces the stored set exactly", async () => {
                 await store.setRecoveryHashes(USER, ["h1", "h2", "h3"]);
-                assertEquals([...await store.getRecoveryHashes(USER)].sort(), ["h1", "h2", "h3"]);
+                expect([...(await store.getRecoveryHashes(USER))].sort()).toStrictEqual(["h1", "h2", "h3"]);
                 await store.setRecoveryHashes(USER, ["h4"]);
-                assertEquals(await store.getRecoveryHashes(USER), ["h4"]);
+                expect(await store.getRecoveryHashes(USER)).toStrictEqual(["h4"]);
             });
             it("clears the set when given an empty list", async () => {
                 await store.setRecoveryHashes(USER, ["h1"]);
                 await store.setRecoveryHashes(USER, []);
-                assertEquals(await store.getRecoveryHashes(USER), []);
+                expect(await store.getRecoveryHashes(USER)).toStrictEqual([]);
             });
             it("keeps each user's codes separate", async () => {
                 await store.setRecoveryHashes(USER, ["h1"]);
-                assertEquals(await store.getRecoveryHashes(OTHER_USER), []);
-                assertStrictEquals(await store.consumeRecoveryHash(OTHER_USER, "h1"), false);
-                assertEquals(await store.getRecoveryHashes(USER), ["h1"]);
+                expect(await store.getRecoveryHashes(OTHER_USER)).toStrictEqual([]);
+                expect(await store.consumeRecoveryHash(OTHER_USER, "h1")).toBe(false);
+                expect(await store.getRecoveryHashes(USER)).toStrictEqual(["h1"]);
             });
             it("burns a consumed hash and refuses it afterwards", async () => {
                 await store.setRecoveryHashes(USER, ["h1", "h2"]);
-                assertStrictEquals(await store.consumeRecoveryHash(USER, "h1"), true);
-                assertStrictEquals(await store.consumeRecoveryHash(USER, "h1"), false);
-                assertEquals(await store.getRecoveryHashes(USER), ["h2"]);
+                expect(await store.consumeRecoveryHash(USER, "h1")).toBe(true);
+                expect(await store.consumeRecoveryHash(USER, "h1")).toBe(false);
+                expect(await store.getRecoveryHashes(USER)).toStrictEqual(["h2"]);
             });
             it("refuses a hash that was never stored", async () => {
                 await store.setRecoveryHashes(USER, ["h1"]);
-                assertStrictEquals(await store.consumeRecoveryHash(USER, "nope"), false);
-                assertEquals(await store.getRecoveryHashes(USER), ["h1"]);
+                expect(await store.consumeRecoveryHash(USER, "nope")).toBe(false);
+                expect(await store.getRecoveryHashes(USER)).toStrictEqual(["h1"]);
             });
             it(`burns a code for exactly one of ${CONCURRENT_CALLERS} concurrent redemptions`, async () => {
                 await store.setRecoveryHashes(USER, ["h1", "h2"]);
                 const results = await race(() => store.consumeRecoveryHash(USER, "h1"));
-                assertStrictEquals(countTrue(results), 1, "a recovery code is single-use — requests racing one code must " +
-                    "not each be told they redeemed it");
-                assertEquals(await store.getRecoveryHashes(USER), ["h2"]);
+                expect(countTrue(results), "a recovery code is single-use — requests racing one code must " +
+                    "not each be told they redeemed it").toBe(1);
+                expect(await store.getRecoveryHashes(USER)).toStrictEqual(["h2"]);
             });
             it("burns both codes when two different ones are redeemed concurrently", async () => {
                 await store.setRecoveryHashes(USER, ["h1", "h2", "h3"]);
@@ -211,8 +210,8 @@ export function runMfaStoreContractTests(options) {
                     store.consumeRecoveryHash(USER, "h1"),
                     store.consumeRecoveryHash(USER, "h2"),
                 ]);
-                assertStrictEquals(countTrue(results), 2);
-                assertEquals(await store.getRecoveryHashes(USER), ["h3"], "neither deletion may be lost to the other's stale read");
+                expect(countTrue(results)).toBe(2);
+                expect(await store.getRecoveryHashes(USER), "neither deletion may be lost to the other's stale read").toStrictEqual(["h3"]);
             });
         });
     });

package/{esm → dist}/testing/contract/mod.d.ts

@@ -30,19 +30,18 @@
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
-export { runUserServiceContractTests, type UserServiceContractOptions, } from "./user.js";
-export { type ClientServiceContractOptions, runClientServiceContractTests, } from "./client.js";
-export { runTokenServiceContractTests, type TokenServiceContractOptions, } from "./token.js";
-export { runTokenReaderContractTests, type TokenReaderContractFixture, type TokenReaderContractOptions, } from "./token-reader.js";
-export { type AuthorizationCodeServiceContractOptions, runAuthorizationCodeServiceContractTests, } from "./authorization-code.js";
-export { type DeviceAuthorizationServiceContractOptions, runDeviceAuthorizationServiceContractTests, } from "./device-authorization.js";
-export { type MfaStoreContractOptions, runMfaStoreContractTests, } from "./mfa-store.js";
-export { runTokenFlowStoreContractTests, type TokenFlowStoreContractOptions, } from "./token-flow-store.js";
-export { type OtpStoreContractOptions, runOtpStoreContractTests, } from "./otp-store.js";
-export { type RateLimitStoreContractOptions, runRateLimitStoreContractTests, } from "./rate-limit-store.js";
-export { type LockoutStoreContractOptions, runLockoutStoreContractTests, } from "./lockout-store.js";
-export { type AuthRequestStorageContractOptions, runAuthRequestStorageContractTests, } from "./auth-request-storage.js";
-export { runTenantContractTests, type TenantContractClient, type TenantContractFixture, type TenantContractMachineClientOptions, type TenantContractMachinePermission, type TenantContractOptions, type TenantContractProfile, type TenantContractSignInOptions, type TenantContractTokens, } from "./tenant.js";
-export { type IdentityUserContractProfile, type IdentityUserStoreContractFixture, type IdentityUserStoreContractOptions, runIdentityUserStoreContractTests, } from "./identity-user-store.js";
-export { type IdentitySessionContractState, type ListableSessionServiceContractFixture, type ListableSessionServiceContractOptions, type RevocableSessionServiceContractFixture, type RevocableSessionServiceContractOptions, runListableSessionServiceContractTests, runRevocableSessionServiceContractTests, } from "./identity-session.js";
+export { runUserServiceContractTests, type UserServiceContractOptions, } from "./user.ts";
+export { type ClientServiceContractOptions, runClientServiceContractTests, } from "./client.ts";
+export { runTokenServiceContractTests, type TokenServiceContractOptions, } from "./token.ts";
+export { runTokenReaderContractTests, type TokenReaderContractFixture, type TokenReaderContractOptions, } from "./token-reader.ts";
+export { type AuthorizationCodeServiceContractOptions, runAuthorizationCodeServiceContractTests, } from "./authorization-code.ts";
+export { type DeviceAuthorizationServiceContractOptions, runDeviceAuthorizationServiceContractTests, } from "./device-authorization.ts";
+export { type MfaStoreContractOptions, runMfaStoreContractTests, } from "./mfa-store.ts";
+export { runTokenFlowStoreContractTests, type TokenFlowStoreContractOptions, } from "./token-flow-store.ts";
+export { type OtpStoreContractOptions, runOtpStoreContractTests, } from "./otp-store.ts";
+export { type RateLimitStoreContractOptions, runRateLimitStoreContractTests, } from "./rate-limit-store.ts";
+export { type LockoutStoreContractOptions, runLockoutStoreContractTests, } from "./lockout-store.ts";
+export { type AuthRequestStorageContractOptions, runAuthRequestStorageContractTests, } from "./auth-request-storage.ts";
+export { runTenantContractTests, type TenantContractClient, type TenantContractFixture, type TenantContractMachineClientOptions, type TenantContractMachinePermission, type TenantContractOptions, type TenantContractProfile, type TenantContractSignInOptions, type TenantContractTokens, } from "./tenant.ts";
+export { type IdentityUserContractProfile, type IdentityUserStoreContractFixture, type IdentityUserStoreContractOptions, runIdentityUserStoreContractTests, } from "./identity-user-store.ts";
+export { type IdentitySessionContractState, type ListableSessionServiceContractFixture, type ListableSessionServiceContractOptions, type RevocableSessionServiceContractFixture, type RevocableSessionServiceContractOptions, runListableSessionServiceContractTests, runRevocableSessionServiceContractTests, } from "./identity-session.ts";

package/{esm → dist}/testing/contract/mod.js

@@ -30,7 +30,6 @@
  *
  * @module
  */
-import "../../_dnt.polyfills.js";
 export { runUserServiceContractTests, } from "./user.js";
 export { runClientServiceContractTests, } from "./client.js";
 export { runTokenServiceContractTests, } from "./token.js";

package/{esm → dist}/testing/contract/otp-store.d.ts

@@ -22,7 +22,7 @@
  *
  * @module
  */
-import type { OtpStore } from "../../identity/otp.js";
+import type { OtpStore } from "../../identity/otp.ts";
 /** Options for {@link runOtpStoreContractTests}. */
 export interface OtpStoreContractOptions {
     /**

package/{esm → dist}/testing/contract/otp-store.js

@@ -22,8 +22,7 @@
  *
  * @module
  */
-import { assert, assertEquals, assertStrictEquals } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { assert, beforeEach, describe, expect, it } from "vitest";
 import { CONCURRENT_CALLERS, race } from "./_race.js";
 const EMAIL = "user@example.com";
 const OTHER_EMAIL = "other@example.com";
@@ -60,20 +59,20 @@ export function runOtpStoreContractTests(options) {
         });
         describe("create / findActive", () => {
             it("returns null when the pair has no code", async () => {
-                assertStrictEquals(await store.findActive(EMAIL, PURPOSE), null);
+                expect(await store.findActive(EMAIL, PURPOSE)).toBe(null);
             });
             it("round-trips every field of a created record", async () => {
                 const created = record({ codeHash: "hash-1", maxAttempts: 3 });
                 await store.create(created);
                 const found = await store.findActive(EMAIL, PURPOSE);
                 assert(found !== null, "a created record must be findable");
-                assertStrictEquals(found.id, created.id);
-                assertStrictEquals(found.email, created.email);
-                assertStrictEquals(found.purpose, created.purpose);
-                assertStrictEquals(found.codeHash, created.codeHash);
-                assertStrictEquals(found.expiresAt, created.expiresAt);
-                assertStrictEquals(found.attempts, 0);
-                assertStrictEquals(found.maxAttempts, 3);
+                expect(found.id).toBe(created.id);
+                expect(found.email).toBe(created.email);
+                expect(found.purpose).toBe(created.purpose);
+                expect(found.codeHash).toBe(created.codeHash);
+                expect(found.expiresAt).toBe(created.expiresAt);
+                expect(found.attempts).toBe(0);
+                expect(found.maxAttempts).toBe(3);
             });
             it("returns the most recently created active record", async () => {
                 const now = Date.now();
@@ -81,17 +80,17 @@ export function runOtpStoreContractTests(options) {
                 const newer = record({ createdAt: now, codeHash: "new" });
                 await store.create(older);
                 await store.create(newer);
-                assertStrictEquals((await store.findActive(EMAIL, PURPOSE))?.id, newer.id, "a re-send supersedes the code before it");
+                expect((await store.findActive(EMAIL, PURPOSE))?.id, "a re-send supersedes the code before it").toBe(newer.id);
             });
             it("returns an expired record rather than hiding it", async () => {
                 await store.create(record({ expiresAt: Date.now() - 1000 }));
-                assert(await store.findActive(EMAIL, PURPOSE) !== null, "expiry is the service's call — it reports `expired` distinctly " +
+                assert((await store.findActive(EMAIL, PURPOSE)) !== null, "expiry is the service's call — it reports `expired` distinctly " +
                     "from `invalid`, which it cannot do if the store swallows the row");
             });
             it("scopes lookups by email and by purpose", async () => {
                 await store.create(record());
-                assertStrictEquals(await store.findActive(OTHER_EMAIL, PURPOSE), null);
-                assertStrictEquals(await store.findActive(EMAIL, OTHER_PURPOSE), null);
+                expect(await store.findActive(OTHER_EMAIL, PURPOSE)).toBe(null);
+                expect(await store.findActive(EMAIL, OTHER_PURPOSE)).toBe(null);
             });
         });
         describe("consume", () => {
@@ -99,15 +98,15 @@ export function runOtpStoreContractTests(options) {
                 const created = record();
                 await store.create(created);
                 const results = await race(() => store.consume(created.id));
-                assertStrictEquals(results.filter((claimed) => claimed).length, 1, "a code is single-use — consumers racing one code must not each " +
-                    "be told they claimed it");
-                assertStrictEquals(await store.consume("missing-code"), false);
+                expect(results.filter((claimed) => claimed).length, "a code is single-use — consumers racing one code must not each " +
+                    "be told they claimed it").toBe(1);
+                expect(await store.consume("missing-code")).toBe(false);
             });
             it("takes the record out of the active set", async () => {
                 const created = record();
                 await store.create(created);
                 await store.consume(created.id);
-                assertStrictEquals(await store.findActive(EMAIL, PURPOSE), null);
+                expect(await store.findActive(EMAIL, PURPOSE)).toBe(null);
             });
             it("leaves an older active code findable", async () => {
                 const now = Date.now();
@@ -116,13 +115,13 @@ export function runOtpStoreContractTests(options) {
                 await store.create(older);
                 await store.create(newer);
                 await store.consume(newer.id);
-                assertStrictEquals((await store.findActive(EMAIL, PURPOSE))?.id, older.id);
+                expect((await store.findActive(EMAIL, PURPOSE))?.id).toBe(older.id);
             });
             it("is a no-op for an unknown id", async () => {
                 const created = record();
                 await store.create(created);
                 await store.consume("no-such-id");
-                assertStrictEquals((await store.findActive(EMAIL, PURPOSE))?.id, created.id);
+                expect((await store.findActive(EMAIL, PURPOSE))?.id).toBe(created.id);
             });
         });
         describe("invalidateById", () => {
@@ -133,14 +132,14 @@ export function runOtpStoreContractTests(options) {
                 await store.create(previous);
                 await store.create(undelivered);
                 await store.invalidateById(undelivered.id);
-                assertStrictEquals((await store.findActive(EMAIL, PURPOSE))?.id, previous.id, "discarding an undeliverable code must not take a concurrent " +
-                    "request's code with it");
+                expect((await store.findActive(EMAIL, PURPOSE))?.id, "discarding an undeliverable code must not take a concurrent " +
+                    "request's code with it").toBe(previous.id);
             });
             it("is a no-op for an unknown id", async () => {
                 const created = record();
                 await store.create(created);
                 await store.invalidateById("no-such-id");
-                assertStrictEquals((await store.findActive(EMAIL, PURPOSE))?.id, created.id);
+                expect((await store.findActive(EMAIL, PURPOSE))?.id).toBe(created.id);
             });
         });
         describe("invalidate", () => {
@@ -148,31 +147,31 @@ export function runOtpStoreContractTests(options) {
                 await store.create(record({ createdAt: Date.now() - 1000 }));
                 await store.create(record());
                 await store.invalidate(EMAIL, PURPOSE);
-                assertStrictEquals(await store.findActive(EMAIL, PURPOSE), null);
+                expect(await store.findActive(EMAIL, PURPOSE)).toBe(null);
             });
             it("leaves other emails and other purposes alone", async () => {
                 await store.create(record());
                 await store.create(record({ email: OTHER_EMAIL }));
                 await store.create(record({ purpose: OTHER_PURPOSE }));
                 await store.invalidate(EMAIL, PURPOSE);
-                assert(await store.findActive(OTHER_EMAIL, PURPOSE) !== null);
-                assert(await store.findActive(EMAIL, OTHER_PURPOSE) !== null);
+                assert((await store.findActive(OTHER_EMAIL, PURPOSE)) !== null);
+                assert((await store.findActive(EMAIL, OTHER_PURPOSE)) !== null);
             });
             it("is a no-op when the pair has no active code", async () => {
                 await store.invalidate(EMAIL, PURPOSE);
-                assertStrictEquals(await store.findActive(EMAIL, PURPOSE), null);
+                expect(await store.findActive(EMAIL, PURPOSE)).toBe(null);
             });
         });
         describe("recordAttempt", () => {
             it("returns the count after the increment", async () => {
                 const created = record();
                 await store.create(created);
-                assertStrictEquals(await store.recordAttempt(created.id), 1);
-                assertStrictEquals(await store.recordAttempt(created.id), 2);
-                assertStrictEquals(await store.recordAttempt(created.id), 3);
+                expect(await store.recordAttempt(created.id)).toBe(1);
+                expect(await store.recordAttempt(created.id)).toBe(2);
+                expect(await store.recordAttempt(created.id)).toBe(3);
             });
             it("returns 0 for an unknown id", async () => {
-                assertStrictEquals(await store.recordAttempt("no-such-id"), 0);
+                expect(await store.recordAttempt("no-such-id")).toBe(0);
             });
             it("counts each record separately", async () => {
                 const mine = record();
@@ -181,15 +180,15 @@ export function runOtpStoreContractTests(options) {
                 await store.create(theirs);
                 await store.recordAttempt(mine.id);
                 await store.recordAttempt(mine.id);
-                assertStrictEquals(await store.recordAttempt(theirs.id), 1);
+                expect(await store.recordAttempt(theirs.id)).toBe(1);
             });
             it("gives every concurrent guess its own count", async () => {
                 const created = record({ maxAttempts: 5 });
                 await store.create(created);
                 const counts = await Promise.all(Array.from({ length: 5 }, () => store.recordAttempt(created.id)));
-                assertEquals([...counts].sort((a, b) => a - b), [1, 2, 3, 4, 5], "the guess budget is spent by the returned count — concurrent " +
+                expect([...counts].sort((a, b) => a - b), "the guess budget is spent by the returned count — concurrent " +
                     "guesses sharing one count spend the budget once and let the " +
-                    "rest through");
+                    "rest through").toStrictEqual([1, 2, 3, 4, 5]);
             });
         });
     });

package/{esm → dist}/testing/contract/rate-limit-store.d.ts

@@ -22,7 +22,7 @@
  *
  * @module
  */
-import type { RateLimitStore } from "../../identity/rate-limit.js";
+import type { RateLimitStore } from "../../identity/rate-limit.ts";
 /** Options for {@link runRateLimitStoreContractTests}. */
 export interface RateLimitStoreContractOptions {
     /**

package/{esm → dist}/testing/contract/rate-limit-store.js

@@ -22,8 +22,7 @@
  *
  * @module
  */
-import { assert, assertAlmostEquals, assertEquals } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { assert, beforeEach, describe, expect, it } from "vitest";
 const KEY = "signin:1.2.3.4";
 const OTHER_KEY = "signin:5.6.7.8";
 const WINDOW_MS = 60_000;
@@ -46,37 +45,37 @@ export function runRateLimitStoreContractTests(options) {
         describe("increment", () => {
             it("opens a window at count 1 that ends one window from now", async () => {
                 const result = await store.increment(KEY, WINDOW_MS, now);
-                assertEquals(result.count, 1);
-                assertAlmostEquals(result.resetAt, now + WINDOW_MS, tolerance);
+                expect(result.count).toStrictEqual(1);
+                expect(Math.abs(result.resetAt - (now + WINDOW_MS))).toBeLessThanOrEqual(tolerance);
             });
             it("counts up within the window without moving its end", async () => {
                 const first = await store.increment(KEY, WINDOW_MS, now);
                 const second = await store.increment(KEY, WINDOW_MS, now + 10);
                 const third = await store.increment(KEY, WINDOW_MS, now + 20);
-                assertEquals([second.count, third.count], [2, 3]);
-                assertEquals([second.resetAt, third.resetAt], [first.resetAt, first.resetAt], "a fixed window ends when it ends — hits inside it must not push " +
-                    "the reset out");
+                expect([second.count, third.count]).toStrictEqual([2, 3]);
+                expect([second.resetAt, third.resetAt], "a fixed window ends when it ends — hits inside it must not push " +
+                    "the reset out").toStrictEqual([first.resetAt, first.resetAt]);
             });
             it("opens a fresh window once the previous one has lapsed", async () => {
                 const first = await store.increment(KEY, WINDOW_MS, now);
                 const after = first.resetAt + 1;
                 const result = await store.increment(KEY, WINDOW_MS, after);
-                assertEquals(result.count, 1);
-                assertAlmostEquals(result.resetAt, after + WINDOW_MS, tolerance);
+                expect(result.count).toStrictEqual(1);
+                expect(Math.abs(result.resetAt - (after + WINDOW_MS))).toBeLessThanOrEqual(tolerance);
             });
             it("counts each key on its own", async () => {
                 await store.increment(KEY, WINDOW_MS, now);
                 await store.increment(KEY, WINDOW_MS, now);
                 const other = await store.increment(OTHER_KEY, WINDOW_MS, now);
-                assertEquals(other.count, 1);
+                expect(other.count).toStrictEqual(1);
             });
             it("gives every concurrent hit its own count", async () => {
                 const results = await Promise.all(Array.from({ length: 5 }, () => store.increment(KEY, WINDOW_MS, now)));
-                assertEquals(results.map((result) => result.count).sort((a, b) => a - b), [1, 2, 3, 4, 5], "the limiter decides on the returned count — concurrent hits " +
+                expect(results.map((result) => result.count).sort((a, b) => a - b), "the limiter decides on the returned count — concurrent hits " +
                     "sharing a count are exactly the burst that slips past the " +
-                    "threshold");
+                    "threshold").toStrictEqual([1, 2, 3, 4, 5]);
                 const next = await store.increment(KEY, WINDOW_MS, now);
-                assertEquals(next.count, 6, "no hit may be lost to a stale read");
+                expect(next.count, "no hit may be lost to a stale read").toStrictEqual(6);
             });
         });
         describe("reset", () => {
@@ -85,15 +84,15 @@ export function runRateLimitStoreContractTests(options) {
                 await store.increment(KEY, WINDOW_MS, now);
                 await store.reset(KEY);
                 const result = await store.increment(KEY, WINDOW_MS, now);
-                assertEquals(result.count, 1);
-                assertAlmostEquals(result.resetAt, now + WINDOW_MS, tolerance);
+                expect(result.count).toStrictEqual(1);
+                expect(Math.abs(result.resetAt - (now + WINDOW_MS))).toBeLessThanOrEqual(tolerance);
             });
             it("clears only the key it is given", async () => {
                 await store.increment(KEY, WINDOW_MS, now);
                 await store.increment(OTHER_KEY, WINDOW_MS, now);
                 await store.reset(KEY);
                 const other = await store.increment(OTHER_KEY, WINDOW_MS, now);
-                assertEquals(other.count, 2);
+                expect(other.count).toStrictEqual(2);
             });
             it("is a no-op for a key with no counter", async () => {
                 await store.reset("never-seen");