@avelonjs/conformance 0.1.0

package/src/suites/realtime.ts

@@ -0,0 +1,123 @@
+import { describe, expect, test } from 'bun:test'
+import {
+  type BroadcastRealtimeSurface,
+  type PresenceRealtimeSurface,
+  type RealtimeCapabilities,
+  type RealtimeDriver,
+  type RealtimeMessage,
+} from '@avelonjs/core'
+import { assertCapabilitySurface, type SuiteContext } from '../harness'
+
+type AssayDriver = RealtimeDriver<RealtimeCapabilities> &
+  Partial<PresenceRealtimeSurface & BroadcastRealtimeSurface>
+
+function assay<TDriver extends AssayDriver>(
+  context: SuiteContext<TDriver>,
+  name: string,
+  assertion: (driver: TDriver) => Promise<void> | void,
+): void {
+  test(name, async () => {
+    const driver = await context.create()
+    try {
+      await assertion(driver)
+    } finally {
+      await context.cleanup?.(driver)
+    }
+  })
+}
+
+function hasBroadcast(driver: AssayDriver): driver is AssayDriver & BroadcastRealtimeSurface {
+  return driver.capabilities.broadcast && typeof driver.broadcast === 'function'
+}
+
+function hasPresence(driver: AssayDriver): driver is AssayDriver & PresenceRealtimeSurface {
+  return driver.capabilities.presence && typeof driver.joinPresence === 'function'
+}
+
+/**
+ * Registers the portable realtime contract conformance suite.
+ *
+ * The contract exposes no deterministic transport failure, so the suite does not invent one for an
+ * error-taxonomy assertion.
+ *
+ * @param context Fresh isolated realtime drivers and optional cleanup.
+ */
+export function realtimeSuite<TDriver extends AssayDriver>(context: SuiteContext<TDriver>): void {
+  describe(`realtime conformance: ${context.name}`, () => {
+    assay(context, 'reports a present and stable resolved realtime instance', (driver) => {
+      const instance = driver.instance
+      expect(instance.length).toBeGreaterThan(0)
+      expect(driver.instance).toBe(instance)
+    })
+
+    assay(context, 'enforces every realtime capability surface in both directions', (driver) => {
+      const surfaces: readonly [string, boolean, readonly string[]][] = [
+        ['presence', driver.capabilities.presence, ['joinPresence', 'leavePresence', 'presence']],
+        ['broadcast', driver.capabilities.broadcast, ['broadcast']],
+      ]
+      for (const [capability, declared, methods] of surfaces) {
+        assertCapabilitySurface(driver, capability, declared, methods)
+        assertCapabilitySurface(
+          { capabilities: { [capability]: false } },
+          capability,
+          false,
+          methods,
+        )
+        expect(() =>
+          assertCapabilitySurface(
+            { capabilities: { [capability]: false }, [methods[0] ?? 'missing']: () => undefined },
+            capability,
+            false,
+            methods,
+          ),
+        ).toThrow()
+        expect(() =>
+          assertCapabilitySurface(
+            { capabilities: { [capability]: true } },
+            capability,
+            true,
+            methods,
+          ),
+        ).toThrow()
+      }
+    })
+
+    assay(context, 'delivers messages only to the subscribed channel', async (driver) => {
+      if (!hasBroadcast(driver)) return
+      const received: RealtimeMessage<{ id: string }>[] = []
+      await driver.subscribe<{ id: string }>('orders', (message) => {
+        received.push(message)
+      })
+      await driver.broadcast('audit', 'created', { id: 'wrong-channel' })
+      await driver.broadcast('orders', 'created', { id: 'order-1' })
+
+      expect(received).toEqual([
+        { channel: 'orders', event: 'created', payload: { id: 'order-1' } },
+      ])
+    })
+
+    assay(context, 'stops delivery after a subscription is unsubscribed', async (driver) => {
+      if (!hasBroadcast(driver)) return
+      const received: string[] = []
+      const subscription = await driver.subscribe<string>('reports', (message) => {
+        received.push(message.payload)
+      })
+      expect(subscription.channel).toBe('reports')
+      await driver.broadcast('reports', 'ready', 'first')
+      await subscription.unsubscribe()
+      await driver.broadcast('reports', 'ready', 'leaked')
+
+      expect(received).toEqual(['first'])
+    })
+
+    assay(context, 'joins, lists, and leaves channel presence when declared', async (driver) => {
+      if (!hasPresence(driver)) return
+      const member = { actorId: 'actor-1', status: 'online', nested: { tab: 2 } }
+      await driver.joinPresence('workspace', member)
+      expect(await driver.presence('workspace')).toEqual([member])
+      expect(await driver.presence('other-workspace')).toEqual([])
+      await driver.leavePresence('workspace')
+      expect(await driver.presence('workspace')).toEqual([])
+    })
+  })
+}

package/src/suites/search.ts

@@ -0,0 +1,115 @@
+import { describe, expect, test } from 'bun:test'
+import {
+  Invalid,
+  type SearchCapabilities,
+  type SearchDocument,
+  type SearchDriver,
+} from '@avelonjs/core'
+import { captureFailure, type SuiteContext } from '../harness'
+
+type AssayDriver = SearchDriver<SearchCapabilities>
+
+function assay<TDriver extends AssayDriver>(
+  context: SuiteContext<TDriver>,
+  name: string,
+  assertion: (driver: TDriver) => Promise<void> | void,
+): void {
+  test(name, async () => {
+    const driver = await context.create()
+    try {
+      await assertion(driver)
+    } finally {
+      await context.cleanup?.(driver)
+    }
+  })
+}
+
+async function expectInvalid(operation: () => Promise<unknown>): Promise<Invalid> {
+  const error = await captureFailure(operation)
+  expect(error).toBeInstanceOf(Invalid)
+  if (!(error instanceof Invalid)) throw new Error('Expected Invalid after taxonomy assertion.')
+  expect(error.code).toBe('INVALID')
+  return error
+}
+
+const documents: readonly SearchDocument[] = [
+  { id: 'guide-1', fields: { title: 'Avelon guide', category: 'docs', locale: 'en' } },
+  { id: 'guide-2', fields: { title: 'Deployment guide', category: 'docs', locale: 'fr' } },
+  { id: 'news-1', fields: { title: 'Avelon release', category: 'news', locale: 'en' } },
+]
+
+/**
+ * Registers the portable search contract conformance suite.
+ *
+ * Facets aggregate the complete filtered match set before pagination, matching the response's
+ * `total`; counting only the current page would make facet navigation change between pages.
+ * Facet support narrows query arguments rather than adding a method, so declared and undeclared
+ * values are tested behaviorally instead of through `assertCapabilitySurface`.
+ *
+ * @param context Fresh isolated search drivers and optional cleanup.
+ */
+export function searchSuite<TDriver extends AssayDriver>(context: SuiteContext<TDriver>): void {
+  describe(`search conformance: ${context.name}`, () => {
+    assay(context, 'reports a present and stable resolved search instance', (driver) => {
+      const instance = driver.instance
+      expect(instance.length).toBeGreaterThan(0)
+      expect(driver.instance).toBe(instance)
+    })
+
+    assay(context, 'honors the declared facet capability in both directions', async (driver) => {
+      await driver.index('articles', documents)
+      if (driver.capabilities.facets) {
+        const result = await driver.query('articles', 'guide', { facets: ['category'] })
+        expect(result.facets).toEqual({ category: { docs: 2 } })
+      } else {
+        const error = await expectInvalid(() =>
+          driver.query('articles', 'guide', { facets: ['category'] }),
+        )
+        expect(error.metadata.fields?.facets).toBeDefined()
+      }
+    })
+
+    assay(context, 'indexes, filters, paginates, and replaces documents', async (driver) => {
+      await driver.index('articles', documents)
+      const firstPage = await driver.query('articles', 'Avelon', {
+        filters: { locale: 'en' },
+        limit: 1,
+        offset: 1,
+      })
+      expect(firstPage.total).toBe(2)
+      expect(firstPage.hits.map((hit) => hit.document.id)).toEqual(['news-1'])
+
+      await driver.index('articles', [
+        { id: 'guide-1', fields: { title: 'Replaced document', category: 'reference' } },
+      ])
+      const replaced = await driver.query('articles', 'replaced')
+      expect(replaced.total).toBe(1)
+      expect(replaced.hits[0]?.document.fields.category).toBe('reference')
+    })
+
+    assay(context, 'removes documents so they stop matching', async (driver) => {
+      await driver.index('articles', documents)
+      expect((await driver.query('articles', 'deployment')).total).toBe(1)
+      await driver.remove('articles', ['guide-2'])
+      expect((await driver.query('articles', 'deployment')).total).toBe(0)
+    })
+
+    assay(context, 'counts facets from the actual filtered result set', async (driver) => {
+      if (!driver.capabilities.facets) return
+      await driver.index('articles', documents)
+      const result = await driver.query('articles', 'Avelon', {
+        filters: { locale: 'en' },
+        facets: ['category', 'locale'],
+        limit: 1,
+      })
+      expect(result.hits).toHaveLength(1)
+      expect(result.total).toBe(2)
+      expect(result.facets).toEqual({ category: { docs: 1, news: 1 }, locale: { en: 2 } })
+    })
+
+    assay(context, 'normalizes invalid pagination options to Invalid', async (driver) => {
+      const error = await expectInvalid(() => driver.query('articles', '', { limit: -1 }))
+      expect(Object.keys(error.metadata.fields ?? {})).toContain('limit')
+    })
+  })
+}

package/src/suites/social.ts

@@ -0,0 +1,129 @@
+import { describe, expect, test } from 'bun:test'
+import { Invalid, Unauthenticated, type SocialCapabilities, type SocialDriver } from '@avelonjs/core'
+import { captureFailure, type SuiteContext } from '../harness'
+
+type AssayDriver = SocialDriver<SocialCapabilities<string>, unknown, unknown>
+
+function assay<TDriver extends AssayDriver>(
+  context: SuiteContext<TDriver>,
+  name: string,
+  assertion: (driver: TDriver) => Promise<void> | void,
+): void {
+  test(name, async () => {
+    const driver = await context.create()
+    try {
+      await assertion(driver)
+    } finally {
+      await context.cleanup?.(driver)
+    }
+  })
+}
+
+async function expectUnauthenticated(operation: () => Promise<unknown>): Promise<Unauthenticated> {
+  const error = await captureFailure(operation)
+  expect(error).toBeInstanceOf(Unauthenticated)
+  if (!(error instanceof Unauthenticated)) {
+    throw new Error('Expected Unauthenticated after taxonomy assertion.')
+  }
+  expect(error.code).toBe('UNAUTHENTICATED')
+  return error
+}
+
+async function expectInvalid(operation: () => Promise<unknown>): Promise<Invalid> {
+  const error = await captureFailure(operation)
+  expect(error).toBeInstanceOf(Invalid)
+  if (!(error instanceof Invalid)) throw new Error('Expected Invalid after taxonomy assertion.')
+  expect(error.code).toBe('INVALID')
+  return error
+}
+
+function firstProvider(driver: AssayDriver): string | undefined {
+  return driver.capabilities.providers[0]
+}
+
+/**
+ * Registers the portable social authorization contract conformance suite.
+ *
+ * State failures and provider-declined callbacks are pinned to `Unauthenticated` because no trusted
+ * identity was established. An undeclared provider or missing authorization code is pinned to
+ * `Invalid` because the framework supplied malformed input.
+ *
+ * @param context Fresh driver instances and optional live-service cleanup.
+ */
+export function socialSuite<TDriver extends AssayDriver>(context: SuiteContext<TDriver>): void {
+  describe(`social conformance: ${context.name}`, () => {
+    assay(context, 'completes the redirect and callback round trip', async (driver) => {
+      const provider = firstProvider(driver)
+      if (!provider) return
+      const callbackUrl = 'https://app.example.test/social/callback'
+      const state = 'expected-state'
+      const redirect = await driver.redirect(provider, callbackUrl, state)
+      expect(redirect).toContain(encodeURIComponent(callbackUrl))
+      expect(redirect).toContain(state)
+
+      const identity = await driver.callback(provider, { code: 'valid-code', state }, callbackUrl)
+      expect(identity.provider).toBe(provider)
+      expect(identity.subject.length).toBeGreaterThan(0)
+      expect(identity.profile).toBeDefined()
+    })
+
+    assay(context, 'generates and verifies state when the caller omits it', async (driver) => {
+      const provider = firstProvider(driver)
+      if (!provider) return
+      const callbackUrl = 'https://app.example.test/social/callback'
+      const redirect = new URL(await driver.redirect(provider, callbackUrl))
+      const state = redirect.searchParams.get('state')
+      expect(state).not.toBeNull()
+      if (!state) throw new Error('Expected generated state after assertion.')
+      await expect(
+        driver.callback(provider, { code: 'valid-code', state }, callbackUrl),
+      ).resolves.toMatchObject({ provider })
+    })
+
+    assay(context, 'rejects a mismatched OAuth state as Unauthenticated', async (driver) => {
+      const provider = firstProvider(driver)
+      if (!provider) return
+      const callbackUrl = 'https://app.example.test/social/callback'
+      await driver.redirect(provider, callbackUrl, 'expected-state')
+      await expectUnauthenticated(() =>
+        driver.callback(provider, { code: 'valid-code', state: 'attacker-state' }, callbackUrl),
+      )
+    })
+
+    assay(context, 'rejects a missing OAuth state as Unauthenticated', async (driver) => {
+      const provider = firstProvider(driver)
+      if (!provider) return
+      const callbackUrl = 'https://app.example.test/social/callback'
+      await driver.redirect(provider, callbackUrl, 'expected-state')
+      await expectUnauthenticated(() =>
+        driver.callback(provider, { code: 'valid-code' }, callbackUrl),
+      )
+    })
+
+    assay(context, 'rejects undeclared providers as Invalid', async (driver) => {
+      const callbackUrl = 'https://app.example.test/social/callback'
+      await expectInvalid(() => driver.redirect('undeclared-provider', callbackUrl, 'state'))
+      await expectInvalid(() =>
+        driver.callback('undeclared-provider', { code: 'valid-code', state: 'state' }, callbackUrl),
+      )
+    })
+
+    assay(context, 'normalizes a provider error callback to Unauthenticated', async (driver) => {
+      const provider = firstProvider(driver)
+      if (!provider) return
+      const callbackUrl = 'https://app.example.test/social/callback'
+      await driver.redirect(provider, callbackUrl, 'expected-state')
+      await expectUnauthenticated(() =>
+        driver.callback(provider, { error: 'access_denied', state: 'expected-state' }, callbackUrl),
+      )
+    })
+
+    assay(context, 'rejects a callback without a code as Invalid', async (driver) => {
+      const provider = firstProvider(driver)
+      if (!provider) return
+      const callbackUrl = 'https://app.example.test/social/callback'
+      await driver.redirect(provider, callbackUrl, 'expected-state')
+      await expectInvalid(() => driver.callback(provider, { state: 'expected-state' }, callbackUrl))
+    })
+  })
+}

package/src/suites/storage.ts

@@ -0,0 +1,158 @@
+import { describe, expect, test } from 'bun:test'
+import {
+  NotFound,
+  type SignedUrlStorageSurface,
+  type StorageCapabilities,
+  type StorageDriver,
+  type StorageTransform,
+  type TransformStorageSurface,
+} from '@avelonjs/core'
+import { assertCapabilitySurface, captureFailure, type SuiteContext } from '../harness'
+
+type AssayDriver = StorageDriver<StorageCapabilities> &
+  Partial<SignedUrlStorageSurface & TransformStorageSurface<StorageTransform>>
+
+function assay<TDriver extends AssayDriver>(
+  context: SuiteContext<TDriver>,
+  name: string,
+  assertion: (driver: TDriver) => Promise<void> | void,
+): void {
+  test(name, async () => {
+    const driver = await context.create()
+    try {
+      await assertion(driver)
+    } finally {
+      await context.cleanup?.(driver)
+    }
+  })
+}
+
+function hasSignedUrls(driver: AssayDriver): driver is AssayDriver & SignedUrlStorageSurface {
+  return driver.capabilities.signedUrls && typeof driver.signedUrl === 'function'
+}
+
+async function expectNotFound(operation: () => Promise<unknown>): Promise<NotFound> {
+  const error = await captureFailure(operation)
+  expect(error).toBeInstanceOf(NotFound)
+  if (!(error instanceof NotFound)) throw new Error('Expected NotFound after taxonomy assertion.')
+  expect(error.code).toBe('NOT_FOUND')
+  return error
+}
+
+/**
+ * Registers the portable storage contract conformance suite.
+ *
+ * The context supplies one already-resolved disk. Named-disk resolution and unknown-name rejection
+ * belong to configuration and the storage facade; this suite verifies only the driver's stable
+ * instance identity. Signed upload URLs and object listing are deliberately outside the v1 contract
+ * under D28 and are not tested here.
+ *
+ * @param context Fresh isolated storage drivers and optional cleanup.
+ */
+export function storageSuite<TDriver extends AssayDriver>(context: SuiteContext<TDriver>): void {
+  describe(`storage conformance: ${context.name}`, () => {
+    assay(context, 'reports a present and stable resolved disk instance', (driver) => {
+      const instance = driver.instance
+      expect(instance.length).toBeGreaterThan(0)
+      expect(driver.instance).toBe(instance)
+    })
+
+    assay(context, 'enforces every storage capability surface in both directions', (driver) => {
+      const surfaces: readonly [string, boolean, readonly string[]][] = [
+        ['signedUrls', driver.capabilities.signedUrls, ['signedUrl']],
+        ['transforms', driver.capabilities.transforms.length > 0, ['transform']],
+      ]
+      for (const [capability, declared, methods] of surfaces) {
+        assertCapabilitySurface(driver, capability, declared, methods)
+        const unavailable = { capabilities: { [capability]: false } }
+        assertCapabilitySurface(unavailable, capability, false, methods)
+        expect(() =>
+          assertCapabilitySurface(
+            { ...unavailable, [methods[0] ?? 'missing']: () => undefined },
+            capability,
+            false,
+            methods,
+          ),
+        ).toThrow()
+        expect(() =>
+          assertCapabilitySurface(
+            { capabilities: { [capability]: true } },
+            capability,
+            true,
+            methods,
+          ),
+        ).toThrow()
+      }
+    })
+
+    assay(context, 'round-trips arbitrary bytes without text coercion', async (driver) => {
+      const contents = new Uint8Array([0, 255, 1, 0, 128, 13, 10])
+      const stored = await driver.put('binary/nulls.bin', contents, {
+        contentType: 'application/octet-stream',
+      })
+      expect(stored).toEqual({
+        path: 'binary/nulls.bin',
+        size: contents.byteLength,
+        contentType: 'application/octet-stream',
+      })
+      expect(await driver.get('binary/nulls.bin')).toEqual(contents)
+
+      contents.fill(42)
+      expect(await driver.get('binary/nulls.bin')).toEqual(
+        new Uint8Array([0, 255, 1, 0, 128, 13, 10]),
+      )
+    })
+
+    assay(
+      context,
+      'stores async byte streams without changing chunk boundaries or bytes',
+      async (driver) => {
+        async function* chunks(): AsyncIterable<Uint8Array> {
+          yield new Uint8Array([0, 1])
+          yield new Uint8Array([255, 0, 2])
+        }
+
+        await driver.put('binary/stream.bin', chunks())
+        expect(await driver.get('binary/stream.bin')).toEqual(new Uint8Array([0, 1, 255, 0, 2]))
+      },
+    )
+
+    assay(context, 'reports existence and deletes idempotently', async (driver) => {
+      expect(await driver.exists('documents/report.bin')).toBe(false)
+      await driver.put('documents/report.bin', new Uint8Array([1, 2, 3]))
+      expect(await driver.exists('documents/report.bin')).toBe(true)
+      await driver.delete('documents/report.bin')
+      expect(await driver.exists('documents/report.bin')).toBe(false)
+      await expect(driver.delete('documents/report.bin')).resolves.toBeUndefined()
+    })
+
+    assay(context, 'normalizes missing-object reads to NotFound', async (driver) => {
+      const error = await expectNotFound(() => driver.get('missing/object.bin'))
+      expect(error.metadata).toEqual({
+        resource: 'storage-object',
+        identifier: 'missing/object.bin',
+      })
+    })
+
+    assay(context, 'serves signed read URLs only until their declared expiry', async (driver) => {
+      if (!hasSignedUrls(driver)) return
+      const contents = new Uint8Array([0, 9, 255, 0])
+      await driver.put('signed/read.bin', contents, { contentType: 'application/octet-stream' })
+      const url = await driver.signedUrl('signed/read.bin', 1)
+
+      const beforeExpiry = await fetch(url)
+      expect(beforeExpiry.ok).toBe(true)
+      expect(new Uint8Array(await beforeExpiry.arrayBuffer())).toEqual(contents)
+
+      await new Promise((resolve) => setTimeout(resolve, 1_200))
+      let expired = false
+      try {
+        const afterExpiry = await fetch(url)
+        expired = !afterExpiry.ok
+      } catch (_error: unknown) {
+        expired = true
+      }
+      expect(expired).toBe(true)
+    })
+  })
+}

package/src/suites/tokens.ts

@@ -0,0 +1,105 @@
+import { describe, expect, test } from 'bun:test'
+import { Unauthenticated, type TokenCapabilities, type TokenDriver } from '@avelonjs/core'
+import { captureFailure, type SuiteContext } from '../harness'
+
+type AssayDriver = TokenDriver<TokenCapabilities, unknown>
+
+function assay<TDriver extends AssayDriver>(
+  context: SuiteContext<TDriver>,
+  name: string,
+  assertion: (driver: TDriver) => Promise<void> | void,
+): void {
+  test(name, async () => {
+    const driver = await context.create()
+    try {
+      await assertion(driver)
+    } finally {
+      await context.cleanup?.(driver)
+    }
+  })
+}
+
+async function expectUnauthenticated(operation: () => Promise<unknown>): Promise<Unauthenticated> {
+  const error = await captureFailure(operation)
+  expect(error).toBeInstanceOf(Unauthenticated)
+  if (!(error instanceof Unauthenticated)) {
+    throw new Error('Expected Unauthenticated after taxonomy assertion.')
+  }
+  expect(error.code).toBe('UNAUTHENTICATED')
+  return error
+}
+
+/**
+ * Registers the portable API-token contract conformance suite.
+ *
+ * Ability enforcement is pinned as exact scope preservation on `verify()`: the contract has no
+ * ability-check operation, so authorization layers enforce the returned set. Expiration assertions
+ * run only when the driver declares expiration support.
+ *
+ * @param context Fresh driver instances and optional live-service cleanup.
+ */
+export function tokensSuite<TDriver extends AssayDriver>(context: SuiteContext<TDriver>): void {
+  describe(`tokens conformance: ${context.name}`, () => {
+    assay(
+      context,
+      'issues and lists token metadata without recovering plaintext',
+      async (driver) => {
+        const issued = await driver.issue('deployment')
+        expect(issued.id.length).toBeGreaterThan(0)
+        expect(issued.subject.length).toBeGreaterThan(0)
+        expect(issued.name).toBe('deployment')
+        expect(issued.plainText.length).toBeGreaterThan(0)
+        expect(issued.createdAt).toBeInstanceOf(Date)
+
+        const listed = await driver.list()
+        expect(listed).toHaveLength(1)
+        expect(listed[0]).toEqual({
+          id: issued.id,
+          subject: issued.subject,
+          name: issued.name,
+          abilities: issued.abilities,
+          createdAt: issued.createdAt,
+          expiresAt: issued.expiresAt,
+        })
+        const record = listed[0]
+        expect(record).toBeDefined()
+        if (!record) throw new Error('Expected listed token after assertion.')
+        expect(Reflect.has(record, 'plainText')).toBe(false)
+        expect(JSON.stringify(listed)).not.toContain(issued.plainText)
+      },
+    )
+
+    assay(
+      context,
+      'verifies the token subject and exact declared ability scope',
+      async (driver) => {
+        if (!driver.capabilities.abilities) return
+        const issued = await driver.issue('scoped', { abilities: ['records:read'] })
+        const verified = await driver.verify(issued.plainText)
+        expect(verified.subject).toBe(issued.subject)
+        // Exact preservation prevents a driver from silently broadening a restricted credential.
+        expect(verified.abilities).toEqual(['records:read'])
+        expect(verified.abilities).not.toContain('records:write')
+      },
+    )
+
+    assay(context, 'rejects an unknown token as Unauthenticated', async (driver) => {
+      await expectUnauthenticated(() => driver.verify('unknown-token'))
+    })
+
+    assay(context, 'revokes an issued token and rejects it as Unauthenticated', async (driver) => {
+      const issued = await driver.issue('revoked')
+      expect(await driver.verify(issued.plainText)).toMatchObject({ id: issued.id })
+      await driver.revoke(issued.id)
+      await expectUnauthenticated(() => driver.verify(issued.plainText))
+    })
+
+    assay(context, 'rejects an expired token as Unauthenticated when declared', async (driver) => {
+      if (!driver.capabilities.expiration) return
+      const expiresAt = new Date(Date.now() - 1000)
+      const issued = await driver.issue('expired', { expiresAt })
+      expect(issued.expiresAt).toEqual(expiresAt)
+      await expectUnauthenticated(() => driver.verify(issued.plainText))
+    })
+  })
+}