toiljs 0.0.116 → 0.0.118

package/test/global-setup.ts

@@ -1,17 +0,0 @@
-import { execFileSync } from 'node:child_process';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-/**
- * Vitest global setup: generate `src/compiler/toil-docs.generated.ts` before the
- * suite runs. `src/compiler/docs.ts` imports that module, but it is gitignored
- * and only (re)created by the build's `gen:docs` step, so a fresh checkout that
- * runs the tests without a prior build would otherwise fail to resolve it
- * ("Cannot find module './toil-docs.generated.js'"). Running the same generator
- * the npm scripts use keeps the tests self-contained. Runs once per vitest
- * invocation, so it also covers `npx vitest` / watch mode.
- */
-export default function setup(): void {
-    const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-    execFileSync('node', ['scripts/gen-toil-docs.mjs'], { cwd: root, stdio: 'ignore' });
-}

package/test/head.test.ts

@@ -1,42 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { mergeHead } from '../src/client/head/head';
-
-describe('mergeHead', () => {
-    it('takes the last title', () => {
-        expect(mergeHead([{ title: 'Home' }]).title).toBe('Home');
-        expect(mergeHead([{ title: 'A' }, { title: 'B' }]).title).toBe('B');
-    });
-
-    it('leaves title undefined when nothing sets it', () => {
-        expect(mergeHead([{ meta: [{ name: 'x', content: 'y' }] }]).title).toBeUndefined();
-    });
-
-    it('dedupes meta by name/property, last wins', () => {
-        const resolved = mergeHead([
-            { meta: [{ name: 'description', content: 'old' }] },
-            {
-                meta: [
-                    { name: 'description', content: 'new' },
-                    { property: 'og:title', content: 'T' },
-                ],
-            },
-        ]);
-        expect(resolved.meta).toHaveLength(2);
-        expect(resolved.meta.find((m) => m.name === 'description')?.content).toBe('new');
-        expect(resolved.meta.find((m) => m.property === 'og:title')?.content).toBe('T');
-    });
-
-    it('dedupes links by rel+href', () => {
-        const resolved = mergeHead([
-            { link: [{ rel: 'icon', href: '/a.svg' }] },
-            {
-                link: [
-                    { rel: 'icon', href: '/a.svg' },
-                    { rel: 'canonical', href: '/x' },
-                ],
-            },
-        ]);
-        expect(resolved.link).toHaveLength(2);
-    });
-});

package/test/image-blur.test.ts

@@ -1,50 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-
-import sharp from 'sharp';
-import { describe, expect, it } from 'vitest';
-
-import { imageBlurPlugin } from '../src/compiler/image-blur';
-
-/** Call the plugin's `load` hook directly (it uses no Rollup `this` context). */
-function loadHook(): (id: string) => Promise<string | undefined> {
-    const plugin = imageBlurPlugin();
-    return plugin.load as unknown as (id: string) => Promise<string | undefined>;
-}
-
-describe('imageBlurPlugin', () => {
-    it('emits a { src, width, height, blurDataURL } module for a ?toil image import', async () => {
-        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'toil-blur-'));
-        const file = path.join(dir, 'pic.png');
-        await sharp({
-            create: { width: 40, height: 30, channels: 3, background: { r: 200, g: 100, b: 50 } },
-        })
-            .png()
-            .toFile(file);
-        try {
-            const load = loadHook();
-            const out = await load(`${file}?toil`);
-            expect(typeof out).toBe('string');
-            // re-imports the bare asset for src (so Vite/imagetools still optimize + hash it)
-            expect(out).toContain(`import src from ${JSON.stringify(file)}`);
-            // carries the intrinsic size for the aspect-ratio
-            expect(out).toContain('width: 40');
-            expect(out).toContain('height: 30');
-            // a real inlined LQIP, not a placeholder string
-            expect(out).toContain('blurDataURL: "data:image/webp;base64,');
-            const b64 = /base64,([^"]+)"/.exec(out as string)?.[1] ?? '';
-            expect(b64.length).toBeGreaterThan(20);
-        } finally {
-            fs.rmSync(dir, { recursive: true, force: true });
-        }
-    });
-
-    it('ignores imports without the ?toil flag', async () => {
-        const load = loadHook();
-        expect(await load('/some/pic.png')).toBeUndefined();
-        expect(await load('/some/pic.png?w=400')).toBeUndefined();
-        // non-raster ?toil (e.g. svg) is skipped too
-        expect(await load('/some/icon.svg?toil')).toBeUndefined();
-    });
-});

package/test/io.test.ts

@@ -1,117 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { DataReader, DataWriter } from '../src/io/codec';
-import { FastMap } from '../src/io/FastMap';
-import { FastSet } from '../src/io/FastSet';
-
-describe('DataWriter / DataReader', () => {
-    it('round-trips fixed-width integers', () => {
-        const w = new DataWriter();
-        w.writeU8(255).writeU16(65535).writeU32(4294967295).writeU64(18446744073709551615n);
-        w.writeI8(-128).writeI16(-32768).writeI32(-2147483648).writeI64(-9223372036854775808n);
-
-        const r = new DataReader(w.toBytes());
-        expect(r.readU8()).toBe(255);
-        expect(r.readU16()).toBe(65535);
-        expect(r.readU32()).toBe(4294967295);
-        expect(r.readU64()).toBe(18446744073709551615n);
-        expect(r.readI8()).toBe(-128);
-        expect(r.readI16()).toBe(-32768);
-        expect(r.readI32()).toBe(-2147483648);
-        expect(r.readI64()).toBe(-9223372036854775808n);
-        expect(r.ok).toBe(true);
-        expect(r.remaining()).toBe(0);
-    });
-
-    it('round-trips floats, bool, bytes and strings', () => {
-        const w = new DataWriter();
-        w.writeF32(0.5).writeF64(3.141592653589793).writeBool(true).writeBool(false);
-        w.writeBytes(new Uint8Array([1, 2, 3, 0, 255]));
-        w.writeString('hello toil 🛠');
-
-        const r = new DataReader(w.toBytes());
-        expect(r.readF32()).toBe(0.5);
-        expect(r.readF64()).toBe(3.141592653589793);
-        expect(r.readBool()).toBe(true);
-        expect(r.readBool()).toBe(false);
-        expect([...r.readBytes()]).toEqual([1, 2, 3, 0, 255]);
-        expect(r.readString()).toBe('hello toil 🛠');
-        expect(r.ok).toBe(true);
-    });
-
-    it('round-trips u128 / i128 / u256 / i256', () => {
-        const u = 123456789012345678901234567890n;
-        const big256 = (2n ** 256n) - 1n;
-        const w = new DataWriter();
-        w.writeU128(u).writeI128(-1234567890123456789n).writeU256(big256).writeI256(-(2n ** 200n));
-
-        const r = new DataReader(w.toBytes());
-        expect(r.readU128()).toBe(u);
-        expect(r.readI128()).toBe(-1234567890123456789n);
-        expect(r.readU256()).toBe(big256);
-        expect(r.readI256()).toBe(-(2n ** 200n));
-    });
-
-    it('grows past the initial capacity without corruption (regression)', () => {
-        // The default buffer is 64 bytes; this forces several reallocations.
-        const w = new DataWriter();
-        const text = 'z'.repeat(500);
-        for (let i = 0; i < 40; i++) w.writeU64(BigInt(i)); // 320 bytes
-        w.writeString(text);
-
-        const r = new DataReader(w.toBytes());
-        for (let i = 0; i < 40; i++) expect(r.readU64()).toBe(BigInt(i));
-        expect(r.readString()).toBe(text);
-        expect(r.ok).toBe(true);
-    });
-
-    it('round-trips big-endian when be is set, and be flips byte order', () => {
-        expect([...new DataWriter().writeU32(0x01020304).toBytes()]).toEqual([4, 3, 2, 1]);
-        expect([...new DataWriter().writeU32(0x01020304, true).toBytes()]).toEqual([1, 2, 3, 4]);
-
-        const w = new DataWriter();
-        w.writeU16(0xabcd, true).writeI32(-2, true).writeU64(0xdeadbeefn, true).writeU128(123456789012345n, true);
-        const r = new DataReader(w.toBytes());
-        expect(r.readU16(true)).toBe(0xabcd);
-        expect(r.readI32(true)).toBe(-2);
-        expect(r.readU64(true)).toBe(0xdeadbeefn);
-        expect(r.readU128(true)).toBe(123456789012345n);
-    });
-
-    it('is little-endian and masks instead of throwing', () => {
-        // u32 1 → 01 00 00 00 (LE); writeU8 masks to a byte, no throw.
-        const bytes = new DataWriter().writeU32(1).writeU8(256).toBytes();
-        expect([...bytes]).toEqual([1, 0, 0, 0, 0]);
-    });
-
-    it('reports ok=false when reading past the end (no throw)', () => {
-        const r = new DataReader(new Uint8Array(2));
-        expect(r.readU32()).toBe(0);
-        expect(r.ok).toBe(false);
-    });
-});
-
-describe('FastMap', () => {
-    it('supports bigint keys and basic ops', () => {
-        const m = new FastMap<bigint, string>();
-        m.set(1n, 'one').set(2n, 'two');
-        expect(m.size).toBe(2);
-        expect(m.get(1n)).toBe('one');
-        expect(m.has(2n)).toBe(true);
-        expect(m.delete(1n)).toBe(true);
-        expect(m.has(1n)).toBe(false);
-        expect([...m.entries()]).toEqual([[2n, 'two']]);
-    });
-});
-
-describe('FastSet', () => {
-    it('dedupes and preserves insertion order', () => {
-        const s = new FastSet<bigint>();
-        s.add(2n).add(1n).add(2n);
-        expect(s.size).toBe(2);
-        expect(s.has(1n)).toBe(true);
-        expect([...s.values()]).toEqual([2n, 1n]);
-        expect(s.delete(2n)).toBe(true);
-        expect([...s.values()]).toEqual([1n]);
-    });
-});

package/test/metadata.test.ts

@@ -1,40 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { resolveMetadata } from '../src/client/head/metadata';
-
-describe('resolveMetadata', () => {
-    it('expands convenience fields into meta/link tags', () => {
-        const head = resolveMetadata({
-            title: 'About',
-            description: 'desc',
-            keywords: ['a', 'b'],
-            robots: 'noindex',
-            themeColor: '#000',
-            canonical: 'https://x.test/about',
-            openGraph: { title: 'OG', type: 'website', image: 'https://x.test/og.png' },
-        });
-
-        expect(head.title).toBe('About');
-        const byName = (name: string) => head.meta?.find((m) => m.name === name)?.content;
-        const byProp = (property: string) =>
-            head.meta?.find((m) => m.property === property)?.content;
-        expect(byName('description')).toBe('desc');
-        expect(byName('keywords')).toBe('a, b');
-        expect(byName('robots')).toBe('noindex');
-        expect(byName('theme-color')).toBe('#000');
-        expect(byProp('og:title')).toBe('OG');
-        expect(byProp('og:type')).toBe('website');
-        expect(byProp('og:image')).toBe('https://x.test/og.png');
-        expect(head.link?.find((l) => l.rel === 'canonical')?.href).toBe('https://x.test/about');
-    });
-
-    it('passes through raw meta/link and omits unset fields', () => {
-        const head = resolveMetadata({
-            title: 'X',
-            meta: [{ name: 'author', content: 'me' }],
-            link: [{ rel: 'alternate', href: '/rss' }],
-        });
-        expect(head.meta).toEqual([{ name: 'author', content: 'me' }]);
-        expect(head.link).toEqual([{ rel: 'alternate', href: '/rss' }]);
-    });
-});

package/test/navlink.test.ts

@@ -1,28 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { matchActive } from '../src/client/navigation/NavLink';
-
-describe('matchActive', () => {
-    it('matches exact paths', () => {
-        expect(matchActive('/about', '/about', false)).toBe(true);
-        expect(matchActive('/about', '/about/', false)).toBe(true);
-        expect(matchActive('/about', '/contact', false)).toBe(false);
-    });
-
-    it('matches sub-paths when not exact (end=false)', () => {
-        expect(matchActive('/blog', '/blog/42', false)).toBe(true);
-        expect(matchActive('/blog', '/blog', false)).toBe(true);
-        expect(matchActive('/blog', '/blogger', false)).toBe(false);
-    });
-
-    it('honors end for exact-only matching', () => {
-        expect(matchActive('/blog', '/blog/42', true)).toBe(false);
-        expect(matchActive('/blog', '/blog', true)).toBe(true);
-    });
-
-    it('treats "/" as active everywhere unless end', () => {
-        expect(matchActive('/', '/anything/deep', false)).toBe(true);
-        expect(matchActive('/', '/anything', true)).toBe(false);
-        expect(matchActive('/', '/', true)).toBe(true);
-    });
-});

package/test/pages.test.ts

@@ -1,105 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-
-import { afterEach, describe, expect, it } from 'vitest';
-
-import { buildPageIndex, pagesModuleSource } from '../src/compiler/pages';
-import type { ScannedRoute } from '../src/compiler/routes';
-
-const dirs: string[] = [];
-/** Writes a throwaway routes dir with the given `{ relPath: source }` files, returns its path. */
-function tmpRoutes(files: Record<string, string>): string {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'toil-pages-'));
-    dirs.push(dir);
-    for (const [rel, src] of Object.entries(files)) {
-        const full = path.join(dir, rel);
-        fs.mkdirSync(path.dirname(full), { recursive: true });
-        fs.writeFileSync(full, src);
-    }
-    return dir;
-}
-function route(
-    dir: string,
-    file: string,
-    pattern: string,
-    extra: Partial<ScannedRoute> = {},
-): ScannedRoute {
-    return { file: path.join(dir, file), pattern, ...extra };
-}
-
-afterEach(() => {
-    for (const d of dirs.splice(0)) fs.rmSync(d, { recursive: true, force: true });
-});
-
-describe('buildPageIndex', () => {
-    it('extracts each page metadata and flags dynamic routes', () => {
-        const dir = tmpRoutes({
-            'index.tsx': `export const metadata = { title: 'Home' };\nexport default () => null;\n`,
-            'blog/[id].tsx': `export const metadata = { title: 'Post' };\nexport default () => null;\n`,
-        });
-        const pages = buildPageIndex(process.cwd(), [
-            route(dir, 'index.tsx', '/'),
-            route(dir, 'blog/[id].tsx', '/blog/:id'),
-        ]);
-        expect(pages).toEqual([
-            { path: '/', dynamic: false, metadata: { title: 'Home' } },
-            { path: '/blog/:id', dynamic: true, metadata: { title: 'Post' } },
-        ]);
-    });
-
-    it('merges searchHints over static metadata (hints win) for dynamic discoverability', () => {
-        const dir = tmpRoutes({
-            'blog/[id].tsx':
-                `export const searchHints = { title: 'Blog', keywords: ['posts', 'articles'] };\n` +
-                `export const generateMetadata = ({ params }) => ({ title: params.id });\n` +
-                `export default () => null;\n`,
-        });
-        const [page] = buildPageIndex(process.cwd(), [route(dir, 'blog/[id].tsx', '/blog/:id')]);
-        expect(page).toEqual({
-            path: '/blog/:id',
-            dynamic: true,
-            metadata: { title: 'Blog', keywords: ['posts', 'articles'] },
-        });
-    });
-
-    it('uses an empty metadata object when a route declares none', () => {
-        const dir = tmpRoutes({ 'about.tsx': `export default () => null;\n` });
-        const pages = buildPageIndex(process.cwd(), [route(dir, 'about.tsx', '/about')]);
-        expect(pages).toEqual([{ path: '/about', dynamic: false, metadata: {} }]);
-    });
-
-    it('excludes slots and intercepting routes, and dedupes patterns', () => {
-        const dir = tmpRoutes({
-            'index.tsx': `export const metadata = { title: 'Home' };\nexport default () => null;\n`,
-            '@modal/photo.tsx': `export default () => null;\n`,
-            '(.)photo.tsx': `export default () => null;\n`,
-        });
-        const pages = buildPageIndex(process.cwd(), [
-            route(dir, 'index.tsx', '/'),
-            route(dir, '@modal/photo.tsx', '/photo', { slot: 'modal' }),
-            route(dir, '(.)photo.tsx', '/photo', { intercept: true }),
-        ]);
-        expect(pages.map((p) => p.path)).toEqual(['/']);
-    });
-
-    it('sorts the index by path for deterministic output', () => {
-        const dir = tmpRoutes({
-            'zed.tsx': `export default () => null;\n`,
-            'about.tsx': `export default () => null;\n`,
-        });
-        const pages = buildPageIndex(process.cwd(), [
-            route(dir, 'zed.tsx', '/zed'),
-            route(dir, 'about.tsx', '/about'),
-        ]);
-        expect(pages.map((p) => p.path)).toEqual(['/about', '/zed']);
-    });
-});
-
-describe('pagesModuleSource', () => {
-    it('emits a typed pages export with JSON-serialized entries', () => {
-        const src = pagesModuleSource([{ path: '/', dynamic: false, metadata: { title: 'Home' } }]);
-        expect(src).toContain('export const pages: PageMeta[] = [');
-        expect(src).toContain('{"path":"/","dynamic":false,"metadata":{"title":"Home"}}');
-    });
-});

package/test/placeholder.test.ts

@@ -1,9 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { FRAMEWORK_NAME } from '../src/shared/index';
-
-describe('toiljs scaffold', () => {
-    it('exposes the framework name', () => {
-        expect(FRAMEWORK_NAME).toBe('toiljs');
-    });
-});

package/test/pqauth-e2e.test.ts

@@ -1,216 +0,0 @@
-/**
- * End-to-end post-quantum auth: drives the REAL browser client (`src/client/auth.ts`
- * — OPRF blind/finalize, Argon2id, ML-DSA keygen/sign, ML-KEM encapsulate,
- * mutual-auth confirm) against the toilscript-compiled example server wasm
- * (`examples/basic` Auth route + the AuthService global), through the dev-server
- * host imports (OPRF + ML-KEM mocks + the ToilDB emulator). A `fetch` shim routes
- * the client's requests into `WasmServerModule.dispatch`, and the in-process
- * ToilDB store persists across dispatches so register -> login spans "requests".
- *
- * This is the full chain interop gate: if the noble client and the
- * voprf/fips203-equivalent dev mocks + the AS AuthService disagree on a single
- * byte, register or login fails here.
- */
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-import { describe, expect, it, beforeEach, afterEach } from 'vitest';
-
-import { ristretto255_oprf } from '@noble/curves/ed25519.js';
-
-import { WasmServerModule } from '../src/devserver/index.js';
-import { __resetDbForTests } from '../src/devserver/db/index.js';
-import { __resetRatelimitForTests } from '../src/devserver/config/ratelimit.js';
-import { Auth } from '../src/client/auth.js';
-import { DataReader, DataWriter } from '../src/io/codec.js';
-
-const EXAMPLE_WASM = path.resolve(
-    path.dirname(fileURLToPath(import.meta.url)),
-    '../examples/basic/build/server/release.wasm',
-);
-
-const haveWasm = fs.existsSync(EXAMPLE_WASM);
-
-function loadModule(): WasmServerModule {
-    const m = new WasmServerModule(EXAMPLE_WASM);
-    m.refresh();
-    return m;
-}
-
-/** Route the client's `fetch(path, {body})` into the dev wasm dispatcher. */
-function installFetchShim(m: WasmServerModule): () => void {
-    const original = globalThis.fetch;
-    const jar = new Map<string, string>();
-    globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
-        const url = typeof input === 'string' ? input : input.toString();
-        const pathname = new URL(url, 'http://localhost').pathname;
-        const bodyBytes =
-            init?.body == null ? new Uint8Array(0) : new Uint8Array(init.body as ArrayBuffer);
-        const headers: [string, string][] = [
-            ['host', 'localhost:3000'],
-            ['content-type', 'application/octet-stream'],
-        ];
-        if (jar.size > 0)
-            headers.push(['cookie', [...jar.entries()].map(([k, v]) => `${k}=${v}`).join('; ')]);
-        const r = m.dispatch({
-            method: (init?.method ?? 'GET') as 'GET' | 'POST',
-            path: pathname,
-            headers,
-            body: bodyBytes,
-        });
-        // Fold any Set-Cookie (`name=value; Path=/; ...`) into the jar so the next
-        // request replays it, exactly like a browser.
-        for (const [name, value] of r.headers) {
-            if (name.toLowerCase() !== 'set-cookie') continue;
-            const pair = value.split(';', 1)[0];
-            const eq = pair.indexOf('=');
-            if (eq > 0) jar.set(pair.slice(0, eq).trim(), pair.slice(eq + 1).trim());
-        }
-        const ab = r.body.buffer.slice(r.body.byteOffset, r.body.byteOffset + r.body.byteLength);
-        return {
-            ok: r.status >= 200 && r.status < 300,
-            status: r.status,
-            arrayBuffer: async () => ab,
-            text: async () => Buffer.from(r.body).toString('utf8'),
-        } as Response;
-    }) as typeof fetch;
-    return () => {
-        globalThis.fetch = original;
-    };
-}
-
-describe.skipIf(!haveWasm)('post-quantum auth end-to-end (client <-> example wasm)', () => {
-    let restoreFetch: () => void;
-    let mod: WasmServerModule;
-
-    beforeEach(() => {
-        __resetDbForTests();
-        // The built-in controller decorates every route with `@ratelimit`; the dev limiter is a
-        // module-level singleton, so reset it per case to keep the many dispatches in this file isolated.
-        __resetRatelimitForTests();
-        mod = loadModule();
-        restoreFetch = installFetchShim(mod);
-    });
-    afterEach(() => restoreFetch());
-
-    it(
-        'registers then logs in (full OPRF + ML-DSA + ML-KEM mutual-auth chain)',
-        async () => {
-            await Auth.register('ada', 'correct horse battery stapleA1', 'ada@example.com');
-            // login resolves ONLY if the server's mutual-auth confirmation tag
-            // verified against the client's own shared secret.
-            const session = await Auth.login('ada', 'correct horse battery stapleA1');
-            expect(session.length).toBeGreaterThan(0);
-
-            // Regression guard: the freshly minted session cookie (captured by the
-            // shim jar) must be ACCEPTED by the `@auth`-gated `/session/me`, which
-            // runs in a separate fresh wasm instance from `login/finish`. The bug
-            // was that login configured a different HMAC secret than the verify
-            // path used, so the MAC failed and `/session/me` returned 401.
-            const meRes = await fetch('/session/me');
-            expect(meRes.status).toBe(200);
-            const me = new DataReader(new Uint8Array(await meRes.arrayBuffer()));
-            expect(me.readString()).toBe('ada');
-            expect(me.readBool()).toBe(false); // 'ada' is not 'root' -> not admin
-        },
-        60_000,
-    );
-
-    it(
-        'rejects /session/me with no session cookie (the @auth gate holds)',
-        async () => {
-            const meRes = await fetch('/session/me');
-            expect(meRes.status).toBe(401);
-        },
-        60_000,
-    );
-
-    it(
-        'rejects a wrong password at login',
-        async () => {
-            await Auth.register('bob', 'hunter2-correctA1', 'bob@example.com');
-            await expect(Auth.login('bob', 'hunter2-WRONG')).rejects.toThrow(/login failed|request failed/);
-        },
-        60_000,
-    );
-
-    it(
-        'rejects login for a never-registered user',
-        async () => {
-            await expect(Auth.login('ghost', 'whatever')).rejects.toThrow(/login failed|request failed/);
-        },
-        60_000,
-    );
-
-    it(
-        'rejects a duplicate registration with a clear (not generic) message',
-        async () => {
-            await Auth.register('dupe', 'correct horse battery stapleA1', 'dupe@example.com');
-            // Second registration of the same username must say so explicitly,
-            // not return the generic "request failed". (The username-taken check fires
-            // before the email check, so it stays `already registered` even with the same email.)
-            await expect(
-                Auth.register('dupe', 'correct horse battery stapleA1', 'dupe@example.com'),
-            ).rejects.toThrow(/already registered/);
-        },
-        60_000,
-    );
-});
-
-// Lower-level wire checks that don't need the heavy Argon2id derivation.
-describe.skipIf(!haveWasm)('post-quantum auth wire-level (anti-enumeration, replay)', () => {
-    beforeEach(() => {
-        __resetDbForTests();
-        __resetRatelimitForTests();
-    });
-
-    const oprf = ristretto255_oprf.oprf;
-    const loginStart = (m: WasmServerModule, username: string) => {
-        const { blinded } = oprf.blind(new TextEncoder().encode('pw'));
-        const body = new DataWriter().writeString(username).writeBytes(blinded).toBytes();
-        const r = m.dispatch({
-            method: 'POST',
-            path: '/auth/login/start',
-            headers: [['host', 'localhost:3000'], ['content-type', 'application/octet-stream']],
-            body,
-        });
-        expect(r.status).toBe(200);
-        const rd = new DataReader(r.body);
-        const cid = rd.readBytes();
-        const aud = rd.readString();
-        const mem = rd.readU32();
-        const iters = rd.readU32();
-        const par = rd.readU32();
-        const salt = rd.readBytes();
-        const nonce = rd.readBytes();
-        const iat = rd.readU64();
-        const exp = rd.readU64();
-        const evaluated = rd.readBytes();
-        return { cid, aud, mem, iters, par, salt, nonce, iat, exp, evaluated };
-    };
-    const hex = (u: Uint8Array) => Buffer.from(u).toString('hex');
-
-    it('returns a STABLE per-user salt for an unknown user across calls (no enumeration)', () => {
-        const m = loadModule();
-        const a = loginStart(m, 'no-such-user');
-        const b = loginStart(m, 'no-such-user');
-        // The original bug returned fresh random salt each call for unknown users.
-        expect(hex(a.salt)).toBe(hex(b.salt));
-        // Shape is fully formed and identical-looking to a real user's response.
-        expect(a.salt.length).toBe(16);
-        expect(a.nonce.length).toBe(32);
-        expect(a.evaluated.length).toBe(32);
-        // The built-in controller returns `TOIL_AUTH_AUDIENCE` or the literal `'toil'` (dev has no secret set).
-        expect(a.aud).toBe('toil');
-        // The randomized fields DO differ (fresh challenge each call).
-        expect(hex(a.cid)).not.toBe(hex(b.cid));
-    });
-
-    it('two unknown users get different (per-user) salts', () => {
-        const m = loadModule();
-        const a = loginStart(m, 'alpha-unknown');
-        const b = loginStart(m, 'beta-unknown');
-        expect(hex(a.salt)).not.toBe(hex(b.salt));
-    });
-});