@udibo/oauth2 0.14.0 → 0.15.0

package/{esm → dist}/testing/contract/token-flow-store.d.ts

@@ -21,7 +21,7 @@
  *
  * @module
  */
-import type { TokenFlowStore } from "../../identity/token-flow.js";
+import type { TokenFlowStore } from "../../identity/token-flow.ts";
 /** Options for {@link runTokenFlowStoreContractTests}. */
 export interface TokenFlowStoreContractOptions {
     /**

package/{esm → dist}/testing/contract/token-flow-store.js

@@ -21,8 +21,7 @@
  *
  * @module
  */
-import { assert, assertEquals, assertStrictEquals } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { assert, beforeEach, describe, expect, it } from "vitest";
 import { CONCURRENT_CALLERS, race } from "./_race.js";
 const PURPOSE = "password-reset";
 const OTHER_PURPOSE = "email-verification";
@@ -59,7 +58,7 @@ export function runTokenFlowStoreContractTests(options) {
         });
         describe("save / get", () => {
             it("returns null for an unknown token hash", async () => {
-                assertStrictEquals(await store.get("no-such-hash"), null);
+                expect(await store.get("no-such-hash")).toBe(null);
             });
             it("round-trips every field of a saved record", async () => {
                 const saved = record({
@@ -69,12 +68,12 @@ export function runTokenFlowStoreContractTests(options) {
                 await store.save(saved);
                 const fetched = await store.get("hash-1");
                 assert(fetched !== null, "a saved record must be readable back");
-                assertEquals(fetched.purpose, saved.purpose);
-                assertEquals(fetched.subject, saved.subject);
-                assertEquals(fetched.data, saved.data);
-                assertStrictEquals(fetched.expiresAt, saved.expiresAt);
-                assertStrictEquals(fetched.createdAt, saved.createdAt);
-                assertStrictEquals(fetched.consumedAt, undefined);
+                expect(fetched.purpose).toStrictEqual(saved.purpose);
+                expect(fetched.subject).toStrictEqual(saved.subject);
+                expect(fetched.data).toStrictEqual(saved.data);
+                expect(fetched.expiresAt).toBe(saved.expiresAt);
+                expect(fetched.createdAt).toBe(saved.createdAt);
+                expect(fetched.consumedAt).toBe(undefined);
             });
             it("returns an expired record rather than hiding it", async () => {
                 await store.save(record({ tokenHash: "hash-expired", expiresAt: Date.now() - 1000 }));
@@ -85,33 +84,33 @@ export function runTokenFlowStoreContractTests(options) {
             it("keeps records with different hashes independent", async () => {
                 await store.save(record({ tokenHash: "hash-1" }));
                 await store.save(record({ tokenHash: "hash-2" }));
-                assertStrictEquals((await store.get("hash-1"))?.tokenHash, "hash-1");
-                assertStrictEquals((await store.get("hash-2"))?.tokenHash, "hash-2");
+                expect((await store.get("hash-1"))?.tokenHash).toBe("hash-1");
+                expect((await store.get("hash-2"))?.tokenHash).toBe("hash-2");
             });
         });
         describe("markConsumed", () => {
             it("claims a live record and stamps it", async () => {
                 await store.save(record({ tokenHash: "hash-1" }));
                 const consumedAt = Date.now();
-                assertStrictEquals(await store.markConsumed("hash-1", consumedAt), true);
-                assertStrictEquals((await store.get("hash-1"))?.consumedAt, consumedAt);
+                expect(await store.markConsumed("hash-1", consumedAt)).toBe(true);
+                expect((await store.get("hash-1"))?.consumedAt).toBe(consumedAt);
             });
             it("refuses a record already consumed, keeping the first stamp", async () => {
                 await store.save(record({ tokenHash: "hash-1" }));
                 const first = Date.now();
                 await store.markConsumed("hash-1", first);
-                assertStrictEquals(await store.markConsumed("hash-1", first + 5_000), false);
-                assertStrictEquals((await store.get("hash-1"))?.consumedAt, first, "a losing claim must not overwrite the winner's record");
+                expect(await store.markConsumed("hash-1", first + 5_000)).toBe(false);
+                expect((await store.get("hash-1"))?.consumedAt, "a losing claim must not overwrite the winner's record").toBe(first);
             });
             it("refuses an unknown token hash", async () => {
-                assertStrictEquals(await store.markConsumed("no-such-hash", Date.now()), false);
+                expect(await store.markConsumed("no-such-hash", Date.now())).toBe(false);
             });
             it(`claims a token for exactly one of ${CONCURRENT_CALLERS} concurrent redemptions`, async () => {
                 await store.save(record({ tokenHash: "hash-1" }));
                 const now = Date.now();
                 const results = await race((caller) => store.markConsumed("hash-1", now + caller));
-                assertStrictEquals(countTrue(results), 1, "a link is single-use — requests racing one link must not each be " +
-                    "told they claimed it");
+                expect(countTrue(results), "a link is single-use — requests racing one link must not each be " +
+                    "told they claimed it").toBe(1);
             });
             it("claims both tokens when two different ones are redeemed concurrently", async () => {
                 await store.save(record({ tokenHash: "hash-1" }));
@@ -121,7 +120,7 @@ export function runTokenFlowStoreContractTests(options) {
                     store.markConsumed("hash-1", now),
                     store.markConsumed("hash-2", now),
                 ]);
-                assertStrictEquals(countTrue(results), 2);
+                expect(countTrue(results)).toBe(2);
                 assert((await store.get("hash-1"))?.consumedAt !== undefined &&
                     (await store.get("hash-2"))?.consumedAt !== undefined, "neither stamp may be lost to the other's stale read");
             });
@@ -138,29 +137,29 @@ export function runTokenFlowStoreContractTests(options) {
                     await store.save(record({ tokenHash: "hash-1" }));
                     await store.save(record({ tokenHash: "hash-2" }));
                     await store.deleteBySubject(PURPOSE, SUBJECT);
-                    assertStrictEquals(await store.get("hash-1"), null);
-                    assertStrictEquals(await store.get("hash-2"), null);
+                    expect(await store.get("hash-1")).toBe(null);
+                    expect(await store.get("hash-2")).toBe(null);
                 });
                 it("leaves other subjects and other purposes alone", async () => {
                     await store.save(record({ tokenHash: "hash-mine" }));
                     await store.save(record({ tokenHash: "hash-other-subject", subject: OTHER_SUBJECT }));
                     await store.save(record({ tokenHash: "hash-other-purpose", purpose: OTHER_PURPOSE }));
                     await store.deleteBySubject(PURPOSE, SUBJECT);
-                    assertStrictEquals(await store.get("hash-mine"), null);
-                    assert(await store.get("hash-other-subject") !== null, "another subject's token must survive");
-                    assert(await store.get("hash-other-purpose") !== null, "the same subject's token for another purpose must survive");
+                    expect(await store.get("hash-mine")).toBe(null);
+                    assert((await store.get("hash-other-subject")) !== null, "another subject's token must survive");
+                    assert((await store.get("hash-other-purpose")) !== null, "the same subject's token for another purpose must survive");
                 });
                 it("is a no-op when the pair has no tokens", async () => {
                     await store.save(record({ tokenHash: "hash-1" }));
                     await store.deleteBySubject(PURPOSE, OTHER_SUBJECT);
-                    assert(await store.get("hash-1") !== null);
+                    assert((await store.get("hash-1")) !== null);
                 });
                 it("keeps an already-consumed record so it still reads as consumed", async () => {
                     await store.save(record({ tokenHash: "hash-used" }));
                     await store.save(record({ tokenHash: "hash-pending" }));
-                    assertStrictEquals(await store.markConsumed("hash-used", Date.now()), true);
+                    expect(await store.markConsumed("hash-used", Date.now())).toBe(true);
                     await store.deleteBySubject(PURPOSE, SUBJECT);
-                    assertStrictEquals(await store.get("hash-pending"), null, "the pending token must be dropped");
+                    expect(await store.get("hash-pending"), "the pending token must be dropped").toBe(null);
                     const used = await store.get("hash-used");
                     assert(used !== null, "a consumed record must survive so inspect() can answer " +
                         "`consumed` rather than the generic `invalid`");
@@ -169,11 +168,7 @@ export function runTokenFlowStoreContractTests(options) {
             });
         }
         else {
-            it({
-                name: "deleteBySubject is not implemented — outstanding links stay redeemable until they expire (deleteBySubject: false)",
-                ignore: true,
-                fn: () => { },
-            });
+            it.skip("deleteBySubject is not implemented — outstanding links stay redeemable until they expire (deleteBySubject: false)", () => { });
         }
     });
 }

package/{esm → dist}/testing/contract/token-reader.d.ts

@@ -36,9 +36,9 @@
  *
  * @module
  */
-import type { ClientInterface } from "../../models/client.js";
-import type { AbstractScope, BasicScope } from "../../models/scope.js";
-import type { TokenReaderInterface } from "../../server/services/token.js";
+import type { ClientInterface } from "../../models/client.ts";
+import type { AbstractScope, BasicScope } from "../../models/scope.ts";
+import type { TokenReaderInterface } from "../../server/services/token.ts";
 /** The reader under test plus the tokens the suite exercises it with. */
 export interface TokenReaderContractFixture<C extends ClientInterface, U, S extends AbstractScope = BasicScope> {
     /** The reader under test. */

package/{esm → dist}/testing/contract/token-reader.js

@@ -36,8 +36,7 @@
  *
  * @module
  */
-import { assert, assertStrictEquals } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { afterEach, beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { afterEach, assert, beforeEach, describe, expect, it } from "vitest";
 /** Runs the {@link TokenReaderInterface} contract suite. */
 export function runTokenReaderContractTests(options) {
     describe(options.describeName ?? "TokenReaderInterface contract", () => {
@@ -50,19 +49,19 @@ export function runTokenReaderContractTests(options) {
         });
         it("echoes back the access token it was given", async () => {
             const token = await fixture.reader.getToken(fixture.validAccessToken);
-            assertStrictEquals(token?.accessToken, fixture.validAccessToken);
+            expect(token?.accessToken).toBe(fixture.validAccessToken);
         });
         it("projects the client the token was issued to", async () => {
             const token = await fixture.reader.getToken(fixture.validAccessToken);
-            assertStrictEquals(token?.client.id, fixture.expected.clientId);
+            expect(token?.client.id).toBe(fixture.expected.clientId);
         });
         it("projects the user the token was issued for", async () => {
             const token = await fixture.reader.getToken(fixture.validAccessToken);
-            assertStrictEquals(token?.user?.id, fixture.expected.userId);
+            expect(token?.user?.id).toBe(fixture.expected.userId);
         });
         it("exposes the granted scope", async () => {
             const token = await fixture.reader.getToken(fixture.validAccessToken);
-            assertStrictEquals(token?.scope?.toString(), fixture.expected.scope);
+            expect(token?.scope?.toString()).toBe(fixture.expected.scope);
         });
         it("exposes an expiry as a Date when the token carries one", async () => {
             const token = await fixture.reader.getToken(fixture.validAccessToken);
@@ -71,7 +70,7 @@ export function runTokenReaderContractTests(options) {
         });
         it("resolves undefined for tokens it cannot validate", async () => {
             for (const accessToken of fixture.invalidAccessTokens) {
-                assertStrictEquals(await fixture.reader.getToken(accessToken), undefined, `expected ${accessToken} to be rejected with undefined`);
+                expect(await fixture.reader.getToken(accessToken), `expected ${accessToken} to be rejected with undefined`).toBe(undefined);
             }
         });
     });

package/{esm → dist}/testing/contract/token.d.ts

@@ -14,13 +14,13 @@
  *
  * @module
  */
-import type { ClientInterface } from "../../models/client.js";
-import { BasicScope } from "../../models/scope.js";
-import type { AbstractScope } from "../../models/scope.js";
-import type { ClientServiceInterface } from "../../server/services/client.js";
-import type { TokenServiceInterface } from "../../server/services/token.js";
-import type { UserServiceInterface } from "../../server/services/user.js";
-import type { MemoryUserShape } from "../services.js";
+import type { ClientInterface } from "../../models/client.ts";
+import { BasicScope } from "../../models/scope.ts";
+import type { AbstractScope } from "../../models/scope.ts";
+import type { ClientServiceInterface } from "../../server/services/client.ts";
+import type { TokenServiceInterface } from "../../server/services/token.ts";
+import type { UserServiceInterface } from "../../server/services/user.ts";
+import type { MemoryUserShape } from "../services.ts";
 /** Options for {@link runTokenServiceContractTests}. */
 export interface TokenServiceContractOptions<C extends ClientInterface, U extends MemoryUserShape, S extends AbstractScope = BasicScope> {
     /** Returns fresh services for each test. */

package/{esm → dist}/testing/contract/token.js

@@ -14,8 +14,7 @@
  *
  * @module
  */
-import { assert, assertEquals, assertStrictEquals } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { assert, beforeEach, describe, expect, it } from "vitest";
 import { BasicScope } from "../../models/scope.js";
 const defaultMakeUser = (seq) => ({ id: `u${seq}`, username: `user${seq}` });
 const defaultMakeClient = (seq) => ({
@@ -25,9 +24,9 @@ const defaultMakeClient = (seq) => ({
 const defaultMakeScope = (value) => new BasicScope(value);
 /** Runs the {@link TokenServiceInterface} contract suite. */
 export function runTokenServiceContractTests(options) {
-    const makeUser = options.makeUser ?? (defaultMakeUser);
-    const makeClient = options.makeClient ?? (defaultMakeClient);
-    const makeScope = options.makeScope ?? (defaultMakeScope);
+    const makeUser = options.makeUser ?? defaultMakeUser;
+    const makeClient = options.makeClient ?? defaultMakeClient;
+    const makeScope = options.makeScope ?? defaultMakeScope;
     const expectReuseDetection = options.refreshTokenReuseDetection ?? true;
     describe(options.describeName ?? "TokenServiceInterface contract", () => {
         let userService;
@@ -49,8 +48,8 @@ export function runTokenServiceContractTests(options) {
             it("produces unique access tokens", async () => {
                 const a = await tokenService.generateAccessToken(client, user);
                 const b = await tokenService.generateAccessToken(client, user);
-                assertEquals(typeof a, "string");
-                assertEquals(typeof b, "string");
+                expect(typeof a).toStrictEqual("string");
+                expect(typeof b).toStrictEqual("string");
                 assert(a !== b, "access tokens should not collide");
             });
             it("produces unique refresh tokens (or undefined to opt out)", async () => {
@@ -65,7 +64,7 @@ export function runTokenServiceContractTests(options) {
             it("returns the requested scope unchanged for the simple case", async () => {
                 const requested = makeScope("read");
                 const result = await tokenService.acceptedScope(client, user, requested);
-                assertEquals(result?.toString(), "read");
+                expect(result?.toString()).toStrictEqual("read");
             });
         });
         describe("save + getToken", () => {
@@ -80,18 +79,18 @@ export function runTokenServiceContractTests(options) {
                 };
                 await tokenService.save(token);
                 const fetched = await tokenService.getToken(accessToken);
-                assertEquals(fetched?.client.id, client.id);
-                assertEquals(fetched?.user?.id, user.id);
-                assertStrictEquals(fetched?.accessTokenExpiresAt?.getTime(), expiresAt.getTime());
+                expect(fetched?.client.id).toStrictEqual(client.id);
+                expect(fetched?.user?.id).toStrictEqual(user.id);
+                expect(fetched?.accessTokenExpiresAt?.getTime()).toBe(expiresAt.getTime());
             });
             it("returns undefined for an unknown access token", async () => {
-                assertStrictEquals(await tokenService.getToken("nope"), undefined);
+                expect(await tokenService.getToken("nope")).toBe(undefined);
             });
         });
         describe("tokens with no user", () => {
             it("generates an access token for a client with no user", async () => {
                 const accessToken = await tokenService.generateAccessToken(client, undefined);
-                assertEquals(typeof accessToken, "string");
+                expect(typeof accessToken).toStrictEqual("string");
             });
             it("accepts scope for a client with no user", async () => {
                 const result = await tokenService.acceptedScope(client, undefined, makeScope("read"));
@@ -106,14 +105,14 @@ export function runTokenServiceContractTests(options) {
                 const accessToken = await tokenService.generateAccessToken(client, undefined);
                 await tokenService.save({ accessToken, client });
                 const fetched = await tokenService.getToken(accessToken);
-                assertEquals(fetched?.client.id, client.id);
-                assertStrictEquals(fetched?.user, undefined);
+                expect(fetched?.client.id).toStrictEqual(client.id);
+                expect(fetched?.user).toBe(undefined);
             });
             it("revokes a token with no user", async () => {
                 const accessToken = await tokenService.generateAccessToken(client, undefined);
                 await tokenService.save({ accessToken, client });
-                assertStrictEquals(await tokenService.revoke(accessToken), true);
-                assertStrictEquals(await tokenService.getToken(accessToken), undefined);
+                expect(await tokenService.revoke(accessToken)).toBe(true);
+                expect(await tokenService.getToken(accessToken)).toBe(undefined);
             });
         });
         describe("save + getRefreshToken", () => {
@@ -130,10 +129,10 @@ export function runTokenServiceContractTests(options) {
                 };
                 await tokenService.save(token);
                 const fetched = await tokenService.getRefreshToken(refreshToken);
-                assertEquals(fetched?.client.id, client.id);
+                expect(fetched?.client.id).toStrictEqual(client.id);
             });
             it("returns undefined for an unknown refresh token", async () => {
-                assertStrictEquals(await tokenService.getRefreshToken("nope"), undefined);
+                expect(await tokenService.getRefreshToken("nope")).toBe(undefined);
             });
         });
         describe("revoke", () => {
@@ -146,15 +145,15 @@ export function runTokenServiceContractTests(options) {
                 };
                 await tokenService.save(token);
                 const ok = await tokenService.revoke(token);
-                assertStrictEquals(ok, true);
-                assertStrictEquals(await tokenService.getToken(accessToken), undefined);
+                expect(ok).toBe(true);
+                expect(await tokenService.getToken(accessToken)).toBe(undefined);
             });
             it("revokes by access token string", async () => {
                 const accessToken = await tokenService.generateAccessToken(client, user);
                 await tokenService.save({ accessToken, client, user });
                 const ok = await tokenService.revoke(accessToken);
-                assertStrictEquals(ok, true);
-                assertStrictEquals(await tokenService.getToken(accessToken), undefined);
+                expect(ok).toBe(true);
+                expect(await tokenService.getToken(accessToken)).toBe(undefined);
             });
             it("revokes by refresh token string when hint='refresh_token'", async () => {
                 const accessToken = await tokenService.generateAccessToken(client, user);
@@ -166,21 +165,21 @@ export function runTokenServiceContractTests(options) {
                     user,
                 });
                 const ok = await tokenService.revoke(refreshToken, "refresh_token");
-                assertStrictEquals(ok, true);
-                assertStrictEquals(await tokenService.getRefreshToken(refreshToken), undefined);
-                assertStrictEquals(await tokenService.getToken(accessToken), undefined);
+                expect(ok).toBe(true);
+                expect(await tokenService.getRefreshToken(refreshToken)).toBe(undefined);
+                expect(await tokenService.getToken(accessToken)).toBe(undefined);
             });
             it("returns false for an unknown token string", async () => {
-                assertStrictEquals(await tokenService.revoke("missing"), false);
+                expect(await tokenService.revoke("missing")).toBe(false);
             });
             it("answers true only for the call that removed a live token", async () => {
                 const accessToken = await tokenService.generateAccessToken(client, user);
                 const token = { accessToken, client, user };
-                assertStrictEquals(await tokenService.revoke(token), false, "a token that was never saved was not revoked by this call — " +
-                    "answering true makes a single-use check built on the result inert");
+                expect(await tokenService.revoke(token), "a token that was never saved was not revoked by this call — " +
+                    "answering true makes a single-use check built on the result inert").toBe(false);
                 await tokenService.save(token);
-                assertStrictEquals(await tokenService.revoke(token), true);
-                assertStrictEquals(await tokenService.revoke(token), false);
+                expect(await tokenService.revoke(token)).toBe(true);
+                expect(await tokenService.revoke(token)).toBe(false);
             });
         });
         describe("revokeCode", () => {
@@ -201,12 +200,12 @@ export function runTokenServiceContractTests(options) {
                     user,
                 });
                 const ok = await tokenService.revokeCode(code);
-                assertStrictEquals(ok, true);
-                assertStrictEquals(await tokenService.getToken(accessToken1), undefined);
-                assertStrictEquals(await tokenService.getToken(accessToken2), undefined);
+                expect(ok).toBe(true);
+                expect(await tokenService.getToken(accessToken1)).toBe(undefined);
+                expect(await tokenService.getToken(accessToken2)).toBe(undefined);
             });
             it("returns false when no tokens were issued for the code", async () => {
-                assertStrictEquals(await tokenService.revokeCode("never-used"), false);
+                expect(await tokenService.revokeCode("never-used")).toBe(false);
             });
         });
         if (expectReuseDetection) {
@@ -240,48 +239,44 @@ export function runTokenServiceContractTests(options) {
                 it("keeps a rotated-out refresh token findable, with its family", async () => {
                     const token = await saveFamilyMember(FAMILY);
                     await tokenService.revoke(token.refreshToken, "refresh_token");
-                    assertStrictEquals(await tokenService.getRefreshToken(token.refreshToken), undefined, "a rotated-out token must no longer refresh");
+                    expect(await tokenService.getRefreshToken(token.refreshToken), "a rotated-out token must no longer refresh").toBe(undefined);
                     const revoked = await tokenService.getRevokedRefreshToken(token.refreshToken);
                     assert(revoked !== undefined, "a revoked refresh token must stay findable — deleting the row " +
                         "is what turns a replay into an ordinary unknown token");
-                    assertStrictEquals(revoked.familyId, FAMILY);
+                    expect(revoked.familyId).toBe(FAMILY);
                 });
                 it("does not report a live refresh token as revoked", async () => {
                     const token = await saveFamilyMember(FAMILY);
-                    assertStrictEquals(await tokenService.getRevokedRefreshToken(token.refreshToken), undefined, "reporting a live token as revoked turns every legitimate " +
-                        "refresh into a detected replay");
+                    expect(await tokenService.getRevokedRefreshToken(token.refreshToken), "reporting a live token as revoked turns every legitimate " +
+                        "refresh into a detected replay").toBe(undefined);
                 });
                 it("returns undefined for a refresh token that was never issued", async () => {
-                    assertStrictEquals(await tokenService.getRevokedRefreshToken("never-issued"), undefined);
+                    expect(await tokenService.getRevokedRefreshToken("never-issued")).toBe(undefined);
                 });
                 it("revokes every live member of a replayed token's family", async () => {
                     const first = await saveFamilyMember(FAMILY);
                     const second = await saveFamilyMember(FAMILY);
-                    assertStrictEquals(await tokenService.revokeFamily(FAMILY), true);
-                    assertStrictEquals(await tokenService.getRefreshToken(first.refreshToken), undefined);
-                    assertStrictEquals(await tokenService.getRefreshToken(second.refreshToken), undefined);
-                    assertStrictEquals(await tokenService.getToken(second.accessToken), undefined, "the family's access tokens die with it — leaving them live " +
-                        "keeps the thief's session alive for their remaining lifetime");
+                    expect(await tokenService.revokeFamily(FAMILY)).toBe(true);
+                    expect(await tokenService.getRefreshToken(first.refreshToken)).toBe(undefined);
+                    expect(await tokenService.getRefreshToken(second.refreshToken)).toBe(undefined);
+                    expect(await tokenService.getToken(second.accessToken), "the family's access tokens die with it — leaving them live " +
+                        "keeps the thief's session alive for their remaining lifetime").toBe(undefined);
                 });
                 it("leaves other families untouched", async () => {
                     const mine = await saveFamilyMember(FAMILY);
                     const theirs = await saveFamilyMember(OTHER_FAMILY);
                     await tokenService.revokeFamily(FAMILY);
-                    assertStrictEquals(await tokenService.getRefreshToken(mine.refreshToken), undefined);
-                    assert(await tokenService.getRefreshToken(theirs.refreshToken) !==
+                    expect(await tokenService.getRefreshToken(mine.refreshToken)).toBe(undefined);
+                    assert((await tokenService.getRefreshToken(theirs.refreshToken)) !==
                         undefined, "one compromised family must not sign every other session out");
                 });
                 it("returns false when the family has no live tokens", async () => {
-                    assertStrictEquals(await tokenService.revokeFamily("never-issued"), false);
+                    expect(await tokenService.revokeFamily("never-issued")).toBe(false);
                 });
             });
         }
         else {
-            it({
-                name: "refresh-token reuse detection is not implemented — a replayed rotated-out token cannot be detected (refreshTokenReuseDetection: false)",
-                ignore: true,
-                fn: () => { },
-            });
+            it.skip("refresh-token reuse detection is not implemented — a replayed rotated-out token cannot be detected (refreshTokenReuseDetection: false)", () => { });
         }
     });
 }

package/{esm → dist}/testing/contract/user.d.ts

@@ -28,8 +28,8 @@
  *
  * @module
  */
-import type { UserServiceInterface } from "../../server/services/user.js";
-import type { MemoryUserShape } from "../services.js";
+import type { UserServiceInterface } from "../../server/services/user.ts";
+import type { MemoryUserShape } from "../services.ts";
 /** Options for {@link runUserServiceContractTests}. */
 export interface UserServiceContractOptions<U extends MemoryUserShape> {
     /**

package/{esm → dist}/testing/contract/user.js

@@ -28,8 +28,7 @@
  *
  * @module
  */
-import { assertEquals, assertStrictEquals } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { beforeEach, describe, expect, it } from "vitest";
 const defaultMakeUser = (seq) => ({ id: `u${seq}`, username: `user${seq}` });
 /**
  * Runs the {@link UserServiceInterface} contract suite. Call from your
@@ -37,7 +36,7 @@ const defaultMakeUser = (seq) => ({ id: `u${seq}`, username: `user${seq}` });
  * runner picks up.
  */
 export function runUserServiceContractTests(options) {
-    const makeUser = options.makeUser ?? (defaultMakeUser);
+    const makeUser = options.makeUser ?? defaultMakeUser;
     describe(options.describeName ?? "UserServiceInterface contract", () => {
         let service;
         beforeEach(async () => {
@@ -45,30 +44,30 @@ export function runUserServiceContractTests(options) {
         });
         describe("get", () => {
             it("returns undefined for an unknown id", async () => {
-                assertStrictEquals(await service.get("does-not-exist"), undefined);
+                expect(await service.get("does-not-exist")).toBe(undefined);
             });
             it("returns the user for a known id", async () => {
                 const user = makeUser(1);
                 await options.addUser(service, user, "pw");
                 const fetched = await service.get(user.id);
-                assertEquals(fetched?.id, user.id);
-                assertEquals(fetched?.username, user.username);
+                expect(fetched?.id).toStrictEqual(user.id);
+                expect(fetched?.username).toStrictEqual(user.username);
             });
         });
         describe("getAuthenticated", () => {
             it("returns undefined for an unknown username", async () => {
-                assertStrictEquals(await service.getAuthenticated("nobody", "pw"), undefined);
+                expect(await service.getAuthenticated("nobody", "pw")).toBe(undefined);
             });
             it("returns undefined for a wrong password", async () => {
                 const user = makeUser(2);
                 await options.addUser(service, user, "correct");
-                assertStrictEquals(await service.getAuthenticated(user.username, "wrong"), undefined);
+                expect(await service.getAuthenticated(user.username, "wrong")).toBe(undefined);
             });
             it("returns the user when username + password match", async () => {
                 const user = makeUser(3);
                 await options.addUser(service, user, "secret");
                 const auth = await service.getAuthenticated(user.username, "secret");
-                assertEquals(auth?.id, user.id);
+                expect(auth?.id).toStrictEqual(user.id);
             });
         });
     });

package/{esm → dist}/testing/mod.d.ts

@@ -6,8 +6,8 @@
  * - **Testing surface for the OAuth2 protocol.** The recommended pattern
  *   for testing apps that use the resource server is to expose your
  *   `IntrospectionTokenReader` instance from your app's OAuth2 wiring module
- *   and stub `tokenReader.getToken` directly with `@std/testing/mock`'s
- *   `stub` —
+ *   and stub `tokenReader.getToken` directly with Vitest's
+ *   `vi.spyOn` —
  *   one method on one object, no `fetch` indirection, no wire format to
  *   fake. For tests that need the OAuth2 protocol end-to-end (BFF flows,
  *   SPA integration), build a real in-process authorization server with
@@ -40,7 +40,6 @@
  *
  * @module
  */
-import "../_dnt.polyfills.js";
-export { MemoryAuthorizationCodeService, type MemoryAuthorizationCodeServiceOptions, MemoryClientService, MemoryDeviceAuthorizationService, type MemoryDeviceAuthorizationServiceOptions, MemoryTokenService, type MemoryTokenServiceOptions, MemoryUserService, type MemoryUserServiceOptions, type MemoryUserShape, } from "./services.js";
-export { createMemoryAuthorizationServer, type CreateMemoryAuthorizationServerOptions, type MemoryAuthorizationServerClientSeed, type MemoryAuthorizationServerGrants, type MemoryAuthorizationServerHarness, type MemoryAuthorizationServerUserSeed, } from "./server.js";
-export { createFakeTenant, type FakeTenant, type FakeTenantClient, type FakeTenantGrant, type FakeTenantLinkedAccount, type FakeTenantMachinePermission, type FakeTenantMembership, type FakeTenantOptions, type FakeTenantOrganization, type FakeTenantOrganizationRole, type FakeTenantSignIn, type FakeTenantSubject, type FakeTenantTokenRequest, type FakeTenantUser, } from "./tenant.js";
+export { MemoryAuthorizationCodeService, type MemoryAuthorizationCodeServiceOptions, MemoryClientService, MemoryDeviceAuthorizationService, type MemoryDeviceAuthorizationServiceOptions, MemoryTokenService, type MemoryTokenServiceOptions, MemoryUserService, type MemoryUserServiceOptions, type MemoryUserShape, } from "./services.ts";
+export { createMemoryAuthorizationServer, type CreateMemoryAuthorizationServerOptions, type MemoryAuthorizationServerClientSeed, type MemoryAuthorizationServerGrants, type MemoryAuthorizationServerHarness, type MemoryAuthorizationServerUserSeed, } from "./server.ts";
+export { createFakeTenant, type FakeTenant, type FakeTenantClient, type FakeTenantGrant, type FakeTenantLinkedAccount, type FakeTenantMachinePermission, type FakeTenantMembership, type FakeTenantOptions, type FakeTenantOrganization, type FakeTenantOrganizationRole, type FakeTenantSignIn, type FakeTenantSubject, type FakeTenantTokenRequest, type FakeTenantUser, } from "./tenant.ts";

package/{esm → dist}/testing/mod.js

@@ -6,8 +6,8 @@
  * - **Testing surface for the OAuth2 protocol.** The recommended pattern
  *   for testing apps that use the resource server is to expose your
  *   `IntrospectionTokenReader` instance from your app's OAuth2 wiring module
- *   and stub `tokenReader.getToken` directly with `@std/testing/mock`'s
- *   `stub` —
+ *   and stub `tokenReader.getToken` directly with Vitest's
+ *   `vi.spyOn` —
  *   one method on one object, no `fetch` indirection, no wire format to
  *   fake. For tests that need the OAuth2 protocol end-to-end (BFF flows,
  *   SPA integration), build a real in-process authorization server with
@@ -40,7 +40,6 @@
  *
  * @module
  */
-import "../_dnt.polyfills.js";
 export { MemoryAuthorizationCodeService, MemoryClientService, MemoryDeviceAuthorizationService, MemoryTokenService, MemoryUserService, } from "./services.js";
 export { createMemoryAuthorizationServer, } from "./server.js";
 export { createFakeTenant, } from "./tenant.js";

package/{esm → dist}/testing/server.d.ts

@@ -23,10 +23,11 @@
  *
  * @example
  * ```ts
+ * import { it } from "vitest";
  * import { DirectClient } from "@udibo/oauth2/client";
  * import { createMemoryAuthorizationServer } from "@udibo/oauth2/testing";
  *
- * Deno.test("client credentials grant", async () => {
+ * it("client credentials grant", async () => {
  *   const oauth = await createMemoryAuthorizationServer({
  *     issuer: "http://localhost",
  *     clients: [{
@@ -47,11 +48,11 @@
  *
  * @module
  */
-import type { ClientInterface } from "../models/client.js";
-import type { AbstractScope, BasicScope, ScopeConstructor } from "../models/scope.js";
-import { AuthorizationServer } from "../server/authorization-server.js";
-import type { AuthenticateUserFn, HandleConsentFn } from "../server/authorization-server.js";
-import { MemoryAuthorizationCodeService, MemoryClientService, MemoryDeviceAuthorizationService, MemoryTokenService, MemoryUserService, type MemoryUserShape } from "./services.js";
+import type { ClientInterface } from "../models/client.ts";
+import type { AbstractScope, BasicScope, ScopeConstructor } from "../models/scope.ts";
+import { AuthorizationServer } from "../server/authorization-server.ts";
+import type { AuthenticateUserFn, HandleConsentFn } from "../server/authorization-server.ts";
+import { MemoryAuthorizationCodeService, MemoryClientService, MemoryDeviceAuthorizationService, MemoryTokenService, MemoryUserService, type MemoryUserShape } from "./services.ts";
 /** Which OAuth2 grants the memory authorization server enables. */
 export interface MemoryAuthorizationServerGrants {
     /**

package/{esm → dist}/testing/server.js

@@ -23,10 +23,11 @@
  *
  * @example
  * ```ts
+ * import { it } from "vitest";
  * import { DirectClient } from "@udibo/oauth2/client";
  * import { createMemoryAuthorizationServer } from "@udibo/oauth2/testing";
  *
- * Deno.test("client credentials grant", async () => {
+ * it("client credentials grant", async () => {
  *   const oauth = await createMemoryAuthorizationServer({
  *     issuer: "http://localhost",
  *     clients: [{