@udibo/oauth2 0.14.1 → 0.15.1

package/{esm → dist}/testing/contract/auth-request-storage.js

@@ -38,8 +38,7 @@
  *
  * @module
  */
-import { assert, assertEquals, assertStrictEquals } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { assert, beforeEach, describe, expect, it } from "vitest";
 import { CONCURRENT_CALLERS, race } from "./_race.js";
 function record(overrides = {}) {
     return {
@@ -69,33 +68,33 @@ export function runAuthRequestStorageContractTests(options) {
         });
         describe("set / get / delete / clear", () => {
             it("returns null for an unknown state", async () => {
-                assertStrictEquals(await store.get("no-such-state"), null);
+                expect(await store.get("no-such-state")).toBe(null);
             });
             it("round-trips every field of a stored record", async () => {
                 const stored = record();
                 await store.set("state-1", stored);
-                assertEquals(await store.get("state-1"), stored);
+                expect(await store.get("state-1")).toStrictEqual(stored);
             });
             it("keeps records under different states independent", async () => {
                 await store.set("state-1", record({ codeVerifier: "verifier-1" }));
                 await store.set("state-2", record({ codeVerifier: "verifier-2" }));
-                assertStrictEquals((await store.get("state-1"))?.codeVerifier, "verifier-1");
-                assertStrictEquals((await store.get("state-2"))?.codeVerifier, "verifier-2");
+                expect((await store.get("state-1"))?.codeVerifier).toBe("verifier-1");
+                expect((await store.get("state-2"))?.codeVerifier).toBe("verifier-2");
             });
             it("deletes one record and leaves the others", async () => {
                 await store.set("state-1", record());
                 await store.set("state-2", record());
                 await store.delete("state-1");
-                assertStrictEquals(await store.get("state-1"), null);
-                assert(await store.get("state-2") !== null, "delete must remove only the named state");
+                expect(await store.get("state-1")).toBe(null);
+                assert((await store.get("state-2")) !== null, "delete must remove only the named state");
             });
             if (clearScope === "all") {
                 it("clears every record", async () => {
                     await store.set("state-1", record());
                     await store.set("state-2", record());
                     await store.clear();
-                    assertStrictEquals(await store.get("state-1"), null);
-                    assertStrictEquals(await store.get("state-2"), null);
+                    expect(await store.get("state-1")).toBe(null);
+                    expect(await store.get("state-2")).toBe(null);
                 });
             }
             else {
@@ -107,15 +106,15 @@ export function runAuthRequestStorageContractTests(options) {
                     await store.clear();
                     const message = "clear() on a shared store must not cancel another user's sign-in " +
                         "that is still in progress";
-                    assertEquals(await store.get("state-2"), second, message);
-                    assertEquals(expectTake
+                    expect(await store.get("state-2"), message).toStrictEqual(second);
+                    expect(expectTake
                         ? await store.take("state-1")
-                        : await store.get("state-1"), first, message);
+                        : await store.get("state-1"), message).toStrictEqual(first);
                 });
                 it('removes a record past any lifetime (clear: "scoped")', async () => {
                     await store.set("expired", record({ createdAt: 0 }));
                     await store.clear();
-                    assertStrictEquals(await store.get("expired"), null, "a scoped clear() must still remove expired records");
+                    expect(await store.get("expired"), "a scoped clear() must still remove expired records").toBe(null);
                 });
             }
         });
@@ -130,22 +129,22 @@ export function runAuthRequestStorageContractTests(options) {
                 it("returns the record and removes it", async () => {
                     const stored = record();
                     await store.set("state-1", stored);
-                    assertEquals(await store.take("state-1"), stored);
-                    assertStrictEquals(await store.get("state-1"), null, "a taken record must not be readable again");
-                    assertStrictEquals(await store.take("state-1"), null);
+                    expect(await store.take("state-1")).toStrictEqual(stored);
+                    expect(await store.get("state-1"), "a taken record must not be readable again").toBe(null);
+                    expect(await store.take("state-1")).toBe(null);
                 });
                 it("returns null for an unknown state", async () => {
-                    assertStrictEquals(await store.take("no-such-state"), null);
+                    expect(await store.take("no-such-state")).toBe(null);
                 });
                 it(`hands one record to exactly one of ${CONCURRENT_CALLERS} concurrent takes`, async () => {
                     const stored = record();
                     await store.set("state-1", stored);
                     const results = await race(() => store.take("state-1"));
                     const winners = results.filter((result) => result !== null);
-                    assertStrictEquals(winners.length, 1, "a state is single-use — callbacks racing on it must not each " +
-                        "receive the PKCE verifier");
-                    assertEquals(winners[0], stored);
-                    assertStrictEquals(await store.get("state-1"), null);
+                    expect(winners.length, "a state is single-use — callbacks racing on it must not each " +
+                        "receive the PKCE verifier").toBe(1);
+                    expect(winners[0]).toStrictEqual(stored);
+                    expect(await store.get("state-1")).toBe(null);
                 });
                 it("hands each record to its own taker when two states are taken concurrently", async () => {
                     await store.set("state-1", record({ codeVerifier: "verifier-1" }));
@@ -154,17 +153,13 @@ export function runAuthRequestStorageContractTests(options) {
                         store.take("state-1"),
                         store.take("state-2"),
                     ]);
-                    assertStrictEquals(first?.codeVerifier, "verifier-1");
-                    assertStrictEquals(second?.codeVerifier, "verifier-2");
+                    expect(first?.codeVerifier).toBe("verifier-1");
+                    expect(second?.codeVerifier).toBe("verifier-2");
                 });
             });
         }
         else {
-            it({
-                name: "take is not implemented — two callbacks racing on one state can both redeem it (take: false)",
-                ignore: true,
-                fn: () => { },
-            });
+            it.skip("take is not implemented — two callbacks racing on one state can both redeem it (take: false)", () => { });
         }
     });
 }

package/{esm → dist}/testing/contract/authorization-code.d.ts

@@ -4,12 +4,12 @@
  *
  * @module
  */
-import type { ClientInterface } from "../../models/client.js";
-import type { AbstractScope, BasicScope } from "../../models/scope.js";
-import type { AuthorizationCodeServiceInterface } from "../../server/services/authorization-code.js";
-import type { ClientServiceInterface } from "../../server/services/client.js";
-import type { UserServiceInterface } from "../../server/services/user.js";
-import type { MemoryUserShape } from "../services.js";
+import type { ClientInterface } from "../../models/client.ts";
+import type { AbstractScope, BasicScope } from "../../models/scope.ts";
+import type { AuthorizationCodeServiceInterface } from "../../server/services/authorization-code.ts";
+import type { ClientServiceInterface } from "../../server/services/client.ts";
+import type { UserServiceInterface } from "../../server/services/user.ts";
+import type { MemoryUserShape } from "../services.ts";
 /** Options for {@link runAuthorizationCodeServiceContractTests}. */
 export interface AuthorizationCodeServiceContractOptions<C extends ClientInterface, U extends MemoryUserShape, S extends AbstractScope = BasicScope> {
     /** Returns fresh services for each test. */

package/{esm → dist}/testing/contract/authorization-code.js

@@ -4,14 +4,13 @@
  *
  * @module
  */
-import { assertEquals, assertStrictEquals } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { beforeEach, describe, expect, it } from "vitest";
 const defaultMakeUser = (seq) => ({ id: `u${seq}`, username: `user${seq}` });
 const defaultMakeClient = (seq) => ({ id: `client-${seq}`, grants: ["authorization_code"] });
 /** Runs the {@link AuthorizationCodeServiceInterface} contract suite. */
 export function runAuthorizationCodeServiceContractTests(options) {
-    const makeUser = options.makeUser ?? (defaultMakeUser);
-    const makeClient = options.makeClient ?? (defaultMakeClient);
+    const makeUser = options.makeUser ?? defaultMakeUser;
+    const makeClient = options.makeClient ?? defaultMakeClient;
     describe(options.describeName ?? "AuthorizationCodeServiceInterface contract", () => {
         let userService;
         let clientService;
@@ -31,11 +30,11 @@ export function runAuthorizationCodeServiceContractTests(options) {
         it("generateCode returns unique strings", async () => {
             const a = await codeService.generateCode(client, user);
             const b = await codeService.generateCode(client, user);
-            assertEquals(a !== b, true);
+            expect(a !== b).toStrictEqual(true);
         });
         it("expiresAt returns a future date", async () => {
             const expires = await codeService.expiresAt(client, user);
-            assertEquals(expires.getTime() > Date.now(), true);
+            expect(expires.getTime() > Date.now()).toStrictEqual(true);
         });
         it("save + get round-trips an authorization code", async () => {
             const code = await codeService.generateCode(client, user);
@@ -52,14 +51,14 @@ export function runAuthorizationCodeServiceContractTests(options) {
             };
             await codeService.save(ac);
             const fetched = await codeService.get(code);
-            assertEquals(fetched?.code, code);
-            assertEquals(fetched?.client.id, client.id);
-            assertEquals(fetched?.redirectUri, "http://app/cb");
-            assertEquals(fetched?.challenge, "abc");
-            assertEquals(fetched?.nonce, "nonce-1");
+            expect(fetched?.code).toStrictEqual(code);
+            expect(fetched?.client.id).toStrictEqual(client.id);
+            expect(fetched?.redirectUri).toStrictEqual("http://app/cb");
+            expect(fetched?.challenge).toStrictEqual("abc");
+            expect(fetched?.nonce).toStrictEqual("nonce-1");
         });
         it("get returns undefined for an unknown code", async () => {
-            assertStrictEquals(await codeService.get("missing"), undefined);
+            expect(await codeService.get("missing")).toBe(undefined);
         });
         it("revoke deletes the code by string", async () => {
             const code = await codeService.generateCode(client, user);
@@ -70,8 +69,8 @@ export function runAuthorizationCodeServiceContractTests(options) {
                 user,
             });
             const ok = await codeService.revoke(code);
-            assertStrictEquals(ok, true);
-            assertStrictEquals(await codeService.get(code), undefined);
+            expect(ok).toBe(true);
+            expect(await codeService.get(code)).toBe(undefined);
         });
         it("revoke deletes the code by object", async () => {
             const code = await codeService.generateCode(client, user);
@@ -83,11 +82,11 @@ export function runAuthorizationCodeServiceContractTests(options) {
             };
             await codeService.save(ac);
             const ok = await codeService.revoke(ac);
-            assertStrictEquals(ok, true);
-            assertStrictEquals(await codeService.get(code), undefined);
+            expect(ok).toBe(true);
+            expect(await codeService.get(code)).toBe(undefined);
         });
         it("revoke returns false for an unknown code", async () => {
-            assertStrictEquals(await codeService.revoke("missing"), false);
+            expect(await codeService.revoke("missing")).toBe(false);
         });
     });
 }

package/{esm → dist}/testing/contract/client.d.ts

@@ -48,10 +48,10 @@
  *
  * @module
  */
-import type { ClientInterface } from "../../models/client.js";
-import type { ClientServiceInterface } from "../../server/services/client.js";
-import type { UserServiceInterface } from "../../server/services/user.js";
-import type { MemoryUserShape } from "../services.js";
+import type { ClientInterface } from "../../models/client.ts";
+import type { ClientServiceInterface } from "../../server/services/client.ts";
+import type { UserServiceInterface } from "../../server/services/user.ts";
+import type { MemoryUserShape } from "../services.ts";
 /** Options for {@link runClientServiceContractTests}. */
 export interface ClientServiceContractOptions<C extends ClientInterface, U extends MemoryUserShape> {
     /**

package/{esm → dist}/testing/contract/client.js

@@ -48,14 +48,13 @@
  *
  * @module
  */
-import { assertEquals, assertStrictEquals } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { beforeEach, describe, expect, it } from "vitest";
 const defaultMakeUser = (seq) => ({ id: `u${seq}`, username: `user${seq}` });
 const defaultMakeClient = (seq) => ({ id: `client-${seq}`, grants: ["client_credentials"] });
 /** Runs the {@link ClientServiceInterface} contract suite. */
 export function runClientServiceContractTests(options) {
-    const makeUser = options.makeUser ?? (defaultMakeUser);
-    const makeClient = options.makeClient ?? (defaultMakeClient);
+    const makeUser = options.makeUser ?? defaultMakeUser;
+    const makeClient = options.makeClient ?? defaultMakeClient;
     describe(options.describeName ?? "ClientServiceInterface contract", () => {
         let userService;
         let clientService;
@@ -66,13 +65,13 @@ export function runClientServiceContractTests(options) {
         });
         describe("get", () => {
             it("returns undefined for an unknown id", async () => {
-                assertStrictEquals(await clientService.get("missing"), undefined);
+                expect(await clientService.get("missing")).toBe(undefined);
             });
             it("returns the registered client", async () => {
                 const client = makeClient(1);
                 await options.addClient(clientService, client);
                 const fetched = await clientService.get(client.id);
-                assertEquals(fetched?.id, client.id);
+                expect(fetched?.id).toStrictEqual(client.id);
             });
         });
         describe("getAuthenticated", () => {
@@ -80,41 +79,41 @@ export function runClientServiceContractTests(options) {
                 const client = makeClient(2);
                 await options.addClient(clientService, client);
                 const auth = await clientService.getAuthenticated(client.id);
-                assertEquals(auth?.id, client.id);
+                expect(auth?.id).toStrictEqual(client.id);
             });
             it("returns undefined for a public client that presents a secret", async () => {
                 const client = makeClient(9);
                 await options.addClient(clientService, client);
-                assertStrictEquals(await clientService.getAuthenticated(client.id, "unissued"), undefined);
+                expect(await clientService.getAuthenticated(client.id, "unissued")).toBe(undefined);
             });
             it("returns the public client when the presented secret is empty", async () => {
                 const client = makeClient(10);
                 await options.addClient(clientService, client);
                 const auth = await clientService.getAuthenticated(client.id, "");
-                assertEquals(auth?.id, client.id);
+                expect(auth?.id).toStrictEqual(client.id);
             });
             it("returns undefined for a confidential client when no secret is supplied", async () => {
                 const client = makeClient(3);
                 await options.addClient(clientService, client, "secret");
-                assertStrictEquals(await clientService.getAuthenticated(client.id), undefined);
+                expect(await clientService.getAuthenticated(client.id)).toBe(undefined);
             });
             it("returns undefined for a confidential client with a wrong secret", async () => {
                 const client = makeClient(4);
                 await options.addClient(clientService, client, "correct");
-                assertStrictEquals(await clientService.getAuthenticated(client.id, "wrong"), undefined);
+                expect(await clientService.getAuthenticated(client.id, "wrong")).toBe(undefined);
             });
             it("returns the confidential client with a matching secret", async () => {
                 const client = makeClient(5);
                 await options.addClient(clientService, client, "matching");
                 const auth = await clientService.getAuthenticated(client.id, "matching");
-                assertEquals(auth?.id, client.id);
+                expect(auth?.id).toStrictEqual(client.id);
             });
         });
         describe("getUser", () => {
             it("resolves nothing for a client registered without a user, rather than failing", async () => {
                 const client = makeClient(6);
                 await options.addClient(clientService, client);
-                assertStrictEquals(await clientService.getUser(client), undefined);
+                expect(await clientService.getUser(client)).toBe(undefined);
             });
             it("returns the associated user when one was registered", async () => {
                 const user = makeUser(7);
@@ -122,7 +121,7 @@ export function runClientServiceContractTests(options) {
                 await options.addUser(userService, user, "pw");
                 await options.addClient(clientService, client, undefined, user.id);
                 const owner = await clientService.getUser(client);
-                assertEquals(owner?.id, user.id);
+                expect(owner?.id).toStrictEqual(user.id);
             });
             it("accepts a client id (not just a client object)", async () => {
                 const user = makeUser(8);
@@ -130,7 +129,7 @@ export function runClientServiceContractTests(options) {
                 await options.addUser(userService, user, "pw");
                 await options.addClient(clientService, client, undefined, user.id);
                 const owner = await clientService.getUser(client.id);
-                assertEquals(owner?.id, user.id);
+                expect(owner?.id).toStrictEqual(user.id);
             });
         });
     });

package/{esm → dist}/testing/contract/device-authorization.d.ts

@@ -4,12 +4,12 @@
  *
  * @module
  */
-import type { ClientInterface } from "../../models/client.js";
-import type { AbstractScope, BasicScope } from "../../models/scope.js";
-import type { ClientServiceInterface } from "../../server/services/client.js";
-import type { DeviceAuthorizationServiceInterface } from "../../server/services/device-authorization.js";
-import type { UserServiceInterface } from "../../server/services/user.js";
-import type { MemoryUserShape } from "../services.js";
+import type { ClientInterface } from "../../models/client.ts";
+import type { AbstractScope, BasicScope } from "../../models/scope.ts";
+import type { ClientServiceInterface } from "../../server/services/client.ts";
+import type { DeviceAuthorizationServiceInterface } from "../../server/services/device-authorization.ts";
+import type { UserServiceInterface } from "../../server/services/user.ts";
+import type { MemoryUserShape } from "../services.ts";
 /** Options for {@link runDeviceAuthorizationServiceContractTests}. */
 export interface DeviceAuthorizationServiceContractOptions<C extends ClientInterface, U extends MemoryUserShape, S extends AbstractScope = BasicScope> {
     /** Returns fresh services for each test. */

package/{esm → dist}/testing/contract/device-authorization.js

@@ -4,8 +4,7 @@
  *
  * @module
  */
-import { assert, assertEquals, assertStrictEquals } from "../../deps/jsr.io/@std/assert/1.0.19/mod.js";
-import { beforeEach, describe, it } from "../../deps/jsr.io/@std/testing/1.0.20/bdd.js";
+import { assert, beforeEach, describe, expect, it } from "vitest";
 const defaultMakeUser = (seq) => ({ id: `u${seq}`, username: `user${seq}` });
 const defaultMakeClient = (seq) => ({
     id: `client-${seq}`,
@@ -13,10 +12,9 @@ const defaultMakeClient = (seq) => ({
 });
 /** Runs the {@link DeviceAuthorizationServiceInterface} contract suite. */
 export function runDeviceAuthorizationServiceContractTests(options) {
-    const makeUser = options.makeUser ?? (defaultMakeUser);
-    const makeClient = options.makeClient ?? (defaultMakeClient);
-    describe(options.describeName ??
-        "DeviceAuthorizationServiceInterface contract", () => {
+    const makeUser = options.makeUser ?? defaultMakeUser;
+    const makeClient = options.makeClient ?? defaultMakeClient;
+    describe(options.describeName ?? "DeviceAuthorizationServiceInterface contract", () => {
         let userService;
         let clientService;
         let deviceService;
@@ -53,35 +51,35 @@ export function runDeviceAuthorizationServiceContractTests(options) {
             const auth = await makeDeviceAuth();
             await deviceService.save(auth);
             const fetched = await deviceService.getByDeviceCode(auth.deviceCode);
-            assertEquals(fetched?.deviceCode, auth.deviceCode);
-            assertEquals(fetched?.client.id, client.id);
+            expect(fetched?.deviceCode).toStrictEqual(auth.deviceCode);
+            expect(fetched?.client.id).toStrictEqual(client.id);
         });
         it("save + lookup by user code", async () => {
             const auth = await makeDeviceAuth();
             await deviceService.save(auth);
             const fetched = await deviceService.getByUserCode(auth.userCode);
-            assertEquals(fetched?.userCode, auth.userCode);
+            expect(fetched?.userCode).toStrictEqual(auth.userCode);
         });
         it("getByDeviceCode / getByUserCode return undefined for unknown codes", async () => {
-            assertStrictEquals(await deviceService.getByDeviceCode("missing"), undefined);
-            assertStrictEquals(await deviceService.getByUserCode("missing"), undefined);
+            expect(await deviceService.getByDeviceCode("missing")).toBe(undefined);
+            expect(await deviceService.getByUserCode("missing")).toBe(undefined);
         });
         it("approve marks the authorization with the approving user", async () => {
             const auth = await makeDeviceAuth();
             await deviceService.save(auth);
             const approved = await deviceService.approve(auth, user);
-            assertStrictEquals(approved.authorized, true);
-            assertEquals(approved.user.id, user.id);
+            expect(approved.authorized).toBe(true);
+            expect(approved.user.id).toStrictEqual(user.id);
             const refetched = await deviceService.getByDeviceCode(auth.deviceCode);
-            assertStrictEquals(refetched?.authorized, true);
+            expect(refetched?.authorized).toBe(true);
         });
         it("deny marks the authorization as denied", async () => {
             const auth = await makeDeviceAuth();
             await deviceService.save(auth);
             const denied = await deviceService.deny(auth);
-            assertStrictEquals(denied.denied, true);
+            expect(denied.denied).toBe(true);
             const refetched = await deviceService.getByDeviceCode(auth.deviceCode);
-            assertStrictEquals(refetched?.denied, true);
+            expect(refetched?.denied).toBe(true);
         });
         it("updateLastPolled records a poll time", async () => {
             const auth = await makeDeviceAuth();
@@ -94,19 +92,19 @@ export function runDeviceAuthorizationServiceContractTests(options) {
         it("revoke deletes by object and by string", async () => {
             const auth1 = await makeDeviceAuth();
             await deviceService.save(auth1);
-            assertStrictEquals(await deviceService.revoke(auth1), true);
-            assertStrictEquals(await deviceService.getByDeviceCode(auth1.deviceCode), undefined);
+            expect(await deviceService.revoke(auth1)).toBe(true);
+            expect(await deviceService.getByDeviceCode(auth1.deviceCode)).toBe(undefined);
             const auth2 = await makeDeviceAuth();
             await deviceService.save(auth2);
-            assertStrictEquals(await deviceService.revoke(auth2.deviceCode), true);
-            assertStrictEquals(await deviceService.getByDeviceCode(auth2.deviceCode), undefined);
+            expect(await deviceService.revoke(auth2.deviceCode)).toBe(true);
+            expect(await deviceService.getByDeviceCode(auth2.deviceCode)).toBe(undefined);
         });
         it("revoke answers true only for the call that removed a live authorization", async () => {
             const auth = await makeDeviceAuth();
             await deviceService.save(auth);
-            assertStrictEquals(await deviceService.revoke(auth), true);
-            assertStrictEquals(await deviceService.revoke(auth), false);
-            assertStrictEquals(await deviceService.revoke(auth.deviceCode), false);
+            expect(await deviceService.revoke(auth)).toBe(true);
+            expect(await deviceService.revoke(auth)).toBe(false);
+            expect(await deviceService.revoke(auth.deviceCode)).toBe(false);
         });
         async function saveDeviceAuth() {
             const auth = await makeDeviceAuth();
@@ -118,33 +116,33 @@ export function runDeviceAuthorizationServiceContractTests(options) {
             return { auth, byDeviceCode, byUserCode };
         }
         async function assertUnreachableByEitherCode(auth) {
-            assertStrictEquals(await deviceService.getByDeviceCode(auth.deviceCode), undefined, "a revoked authorization must not resolve by its device code");
-            assertStrictEquals(await deviceService.getByUserCode(auth.userCode), undefined, "a revoked authorization must not resolve by its user code");
+            expect(await deviceService.getByDeviceCode(auth.deviceCode), "a revoked authorization must not resolve by its device code").toBe(undefined);
+            expect(await deviceService.getByUserCode(auth.userCode), "a revoked authorization must not resolve by its user code").toBe(undefined);
         }
         it("revoke by full record clears both the device-code and user-code lookups", async () => {
             const { auth } = await saveDeviceAuth();
-            assertStrictEquals(await deviceService.revoke(auth), true);
+            expect(await deviceService.revoke(auth)).toBe(true);
             await assertUnreachableByEitherCode(auth);
         });
         it("revoke by raw device code clears both the device-code and user-code lookups", async () => {
             const { auth } = await saveDeviceAuth();
-            assertStrictEquals(await deviceService.revoke(auth.deviceCode), true);
+            expect(await deviceService.revoke(auth.deviceCode)).toBe(true);
             await assertUnreachableByEitherCode(auth);
         });
         it("revoke accepts the record getByDeviceCode returns and clears both lookups", async () => {
             const { auth, byDeviceCode } = await saveDeviceAuth();
-            assertStrictEquals(await deviceService.revoke(byDeviceCode), true);
+            expect(await deviceService.revoke(byDeviceCode)).toBe(true);
             await assertUnreachableByEitherCode(auth);
         });
         it("revoke accepts the record getByUserCode returns and clears both lookups", async () => {
             const { auth, byUserCode } = await saveDeviceAuth();
-            assertStrictEquals(await deviceService.revoke(byUserCode), true);
+            expect(await deviceService.revoke(byUserCode)).toBe(true);
             await assertUnreachableByEitherCode(auth);
         });
         it("revoke answers true once across the hydrated shapes of one authorization", async () => {
             const { byDeviceCode, byUserCode } = await saveDeviceAuth();
-            assertStrictEquals(await deviceService.revoke(byDeviceCode), true);
-            assertStrictEquals(await deviceService.revoke(byUserCode), false);
+            expect(await deviceService.revoke(byDeviceCode)).toBe(true);
+            expect(await deviceService.revoke(byUserCode)).toBe(false);
         });
         it("revoke answers true to exactly one of two concurrent claims", async () => {
             const { auth, byDeviceCode } = await saveDeviceAuth();
@@ -152,35 +150,35 @@ export function runDeviceAuthorizationServiceContractTests(options) {
                 deviceService.revoke(byDeviceCode),
                 deviceService.revoke(byDeviceCode),
             ]);
-            assertEquals(claims.filter(Boolean).length, 1, "concurrent polls of one device code must not both be told they claimed it");
+            expect(claims.filter(Boolean).length, "concurrent polls of one device code must not both be told they claimed it").toStrictEqual(1);
             await assertUnreachableByEitherCode(auth);
         });
         it("revoke of a user-code-hydrated record consumes the device code", async () => {
             const { auth, byUserCode } = await saveDeviceAuth();
             await deviceService.approve(byUserCode, user);
             await deviceService.revoke(byUserCode);
-            assertStrictEquals(await deviceService.getByDeviceCode(auth.deviceCode), undefined, "a cancelled authorization must not stay redeemable by its device code");
+            expect(await deviceService.getByDeviceCode(auth.deviceCode), "a cancelled authorization must not stay redeemable by its device code").toBe(undefined);
         });
         it("approve accepts the record getByUserCode returns", async () => {
             const { auth, byUserCode } = await saveDeviceAuth();
             const approved = await deviceService.approve(byUserCode, user);
-            assertStrictEquals(approved.authorized, true);
+            expect(approved.authorized).toBe(true);
             const refetched = await deviceService.getByDeviceCode(auth.deviceCode);
-            assertStrictEquals(refetched?.authorized, true);
-            assertEquals(refetched?.user?.id, user.id);
+            expect(refetched?.authorized).toBe(true);
+            expect(refetched?.user?.id).toStrictEqual(user.id);
         });
         it("approve accepts the record getByDeviceCode returns", async () => {
             const { auth, byDeviceCode } = await saveDeviceAuth();
             await deviceService.approve(byDeviceCode, user);
             const refetched = await deviceService.getByUserCode(auth.userCode);
-            assertStrictEquals(refetched?.authorized, true);
+            expect(refetched?.authorized).toBe(true);
         });
         it("deny accepts the record getByUserCode returns", async () => {
             const { auth, byUserCode } = await saveDeviceAuth();
             const denied = await deviceService.deny(byUserCode);
-            assertStrictEquals(denied.denied, true);
+            expect(denied.denied).toBe(true);
             const refetched = await deviceService.getByDeviceCode(auth.deviceCode);
-            assertStrictEquals(refetched?.denied, true);
+            expect(refetched?.denied).toBe(true);
         });
         it("updateLastPolled accepts the record getByDeviceCode returns", async () => {
             const { auth, byDeviceCode } = await saveDeviceAuth();

package/{esm → dist}/testing/contract/identity-session.d.ts

@@ -1,4 +1,9 @@
-import type { ListableSessionService, RevocableSessionService, SessionSummary } from "../../identity/session.js";
+/**
+ * Contract checks for app-owned identity-session revocation and display lists.
+ * These are distinct from the Hono BFF SessionStore contract.
+ * @module
+ */
+import type { ListableSessionService, RevocableSessionService, SessionSummary } from "../../identity/session.ts";
 /** Session states the application translates into its own storage fields. */
 export type IdentitySessionContractState = "live" | "revoked" | "expired" | "idle-timed-out";
 /** Isolated revocation implementation and app-owned session setup helpers. */