Unit tests (65 tests): - PKCE: code verifier/challenge generation and verification - Claims: scope parsing, validation, and userinfo building - Tokens: JWT creation, signing, and verification E2E tests (22 tests): - Discovery endpoints (openid-configuration, JWKS) - Authorization endpoint validation - Token endpoint with PKCE verification - UserInfo endpoint - Token revocation - Logout/end session Test infrastructure: - Vitest test runner with coverage support - Supertest for HTTP assertions - Test database isolation