npm warn Unknown env config "http-proxy". This will stop working in the next major version of npm.

> aftercurve-vault@1.0.0 test
> node --test tests/*.test.mjs

✔ background authenticates senders, serializes writes, reports quota errors and binds one-time fill to exact origin (1259.950928ms)
✔ autofill exact-origin login works without submitting (0.783978ms)
✔ autofill rejects iframe, wrong origin, hidden/read-only/ambiguous/new-password fields without mutation (0.492888ms)
✔ autofill rejects resolved cross-origin base actions and submitter overrides (0.32516ms)
✔ Argon2id matches RFC 9106 section 5.3 known-answer vector (26.897098ms)
✔ ML-KEM-768 matches NIST final FIPS 203 keygen, encapsulation, decapsulation and rejection vectors (40.544778ms)
ℹ keygen: 2; encapsulation: 2; decapsulation: 10; decapsulationKeyCheck: 10; encapsulationKeyCheck: 10
▶ vault encryption, backup and authenticated metadata
  ✔ round trip preserves all fields and persists no readable secrets (1154.173156ms)
  ✔ wrong master password fails (1175.902387ms)
  ✔ ciphertext mutation fails (1153.73322ms)
  ✔ revision and vault-ID substitutions fail authentication (2273.977255ms)
  ✔ new saves use new nonces, increment revision and retain key wrap (1.111842ms)
  ✔ backup excludes live transfer private keys and leaves live context unchanged (1041.271739ms)
✔ vault encryption, backup and authenticated metadata (8033.903692ms)
✔ input validation rejects hostile profiles, lengths, origins and unknown fields before KDF (1102.625992ms)
✔ base64 validator handles supported multi-megabyte files without regex stack overflow (726.397947ms)
▶ offline transfer authenticates both fingerprints and rejects mutations, expiry, replay and another recipient
  ✔ ML-KEM / HKDF / AES-GCM transfer round trip (2.21367ms)
  ✔ recipient fingerprint mismatch stops encryption (0.523013ms)
  ✔ package fingerprint mismatch stops import (0.47336ms)
  ✔ tampered ciphertext fails even with recomputed public fingerprint (2.163767ms)
  ✔ tampered header and KEM ciphertext fail (4.31923ms)
  ✔ expired, consumed and unrelated receive requests fail (1.922119ms)
✔ offline transfer authenticates both fingerprints and rejects mutations, expiry, replay and another recipient (21.536578ms)
✔ password generator validates options and health checks operate locally (8.807024ms)
✔ manifest restricts permissions, code, connections and frames (4.756607ms)
✔ UI bindings resolve to unique HTML IDs and avoid HTML injection sinks (3.908004ms)
✔ UI lock invalidates pending file reads and replies before presentation (1.114036ms)
✔ build includes packaged scripts, icons, fonts, disclosures and dependency licenses (7.520786ms)
✔ worker lifecycle, import confirmation, backup and key rotation (10143.861693ms)
✔ worker device transfer previews, adds once, and cannot replay after import (3094.695866ms)
✔ restoration preserves records, clears transfer state, and cancelled imports cannot commit (3207.120683ms)
ℹ tests 30
ℹ suites 0
ℹ pass 30
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 16564.20734