validation-and-qa

Create the file at lib/__tests__/<module>.test.js so it matches the vitest include glob, import describe/expect/it from vitest, and assert on pure function return values. Verify collection with npx vitest list, then run npx vitest run on the single file before the full suite.

Evidence requires four things: a written prediction of exact output before running, a fresh run of the real command in the current checkout, a match between prediction and actual output, and pasteable command output. Reading code or recalling earlier runs counts as assertion, not evidence.

Not with the current setup. Modules importing lib/redis.js, lib/bunny.js, lib/auth0.js, lib/guard.js, lib/audit.js, lib/ratelimit.js, or lib/store.js are not unit-testable because the repo has no mocking harness. A vi.mock-based fake Redis client is sketched as an unproven starting point.

The vitest config only collects files matching lib/__tests__/**/*.test.js. Tests placed in a root __tests__ folder, a test/ directory, or colocated next to source files are silently never collected, and npm test still reports success without running them.

Any production bug in pure lib/*.js logic gets a regression test in the same fix PR asserting the exact input that broke. Bugs in Redis, bunny.net, or Auth0-touching code rely on the manual verification checklist instead, and that limitation must be stated explicitly.