/**
 * TASK-0134 security audit suites (OWASP ASVS L2).
 *
 * Two families:
 *  - **Static / engine suites** (deps, gitleaks-config, permission-fuzz,
 *    formula-fuzz, audit-report) run anywhere with the lockfile + source.
 *  - **Live-app suites** (auth-paths, headers, upload-abuse, rate-limits)
 *    need a running API + web — they resolve `SEC_API_URL` /
 *    `SEC_WEB_URL` (defaults http://localhost:4000 / :3000, matching the dev
 *    stack and the CI e2e services) and SKIP (not fail) when the API is
 *    unreachable, so the suite is green in a partial environment but red in
 *    CI where the stack IS up (the CI stage asserts the skip-count is zero).
 *
 * Fuzz budgets: 10k iterations in CI (fixed seed); `SEC_FUZZ_SEED=random`
 * (nightly) re-seeds fast-check.
 */
import { defineConfig } from "vitest/config";

export default defineConfig({
  test: {
    environment: "node",
    include: ["**/*.test.ts"],
    // The live-app suites boot the full stack in CI (cold pulls) — 120 s hook
    // timeout; the fuzz suites are CPU-bound but bounded (10k × <50 ms evals).
    testTimeout: 60_000,
    hookTimeout: 120_000,
    teardownTimeout: 15_000,
  },
});