@brninpay/core 0.1.0

package/src/utils/crypto.ts

@@ -0,0 +1,182 @@
+import { HmacVerificationError, ValidationError } from '../types/errors.js'
+
+export interface HmacSignatureOptions {
+  secret: string | Uint8Array
+  message: string | Uint8Array
+  encoding?: 'hex' | 'base64'
+}
+
+export interface TimestampValidationOptions {
+  nowMs?: number
+  maxSkewMs?: number
+}
+
+export interface TimestampValidationResult {
+  valid: boolean
+  ageMs: number
+}
+
+const textEncoder = new TextEncoder()
+
+function getCrypto(): Crypto {
+  if (!globalThis.crypto?.subtle) {
+    throw new Error('Web Crypto API is not available in the current runtime')
+  }
+
+  return globalThis.crypto
+}
+
+function toUint8Array(value: string | Uint8Array): Uint8Array {
+  return typeof value === 'string' ? textEncoder.encode(value) : value
+}
+
+function toBufferSource(value: string | Uint8Array): Uint8Array<ArrayBuffer> {
+  return Uint8Array.from(toUint8Array(value))
+}
+
+function bytesToHex(bytes: Uint8Array): string {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('')
+}
+
+function hexToBytes(value: string): Uint8Array {
+  if (!/^[0-9a-f]+$/i.test(value) || value.length % 2 !== 0) {
+    throw new ValidationError('Hex signatures must use an even-length hexadecimal string', {
+      value,
+    })
+  }
+
+  const bytes = new Uint8Array(value.length / 2)
+  for (let index = 0; index < value.length; index += 2) {
+    bytes[index / 2] = Number.parseInt(value.slice(index, index + 2), 16)
+  }
+
+  return bytes
+}
+
+function bytesToBase64(bytes: Uint8Array): string {
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join('')
+  return btoa(binary)
+}
+
+function base64ToBytes(value: string): Uint8Array {
+  const binary = atob(value)
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0))
+}
+
+function decodeSignature(value: string, encoding: 'hex' | 'base64'): Uint8Array {
+  return encoding === 'hex' ? hexToBytes(value) : base64ToBytes(value)
+}
+
+function encodeBytes(value: Uint8Array, encoding: 'hex' | 'base64'): string {
+  return encoding === 'hex' ? bytesToHex(value) : bytesToBase64(value)
+}
+
+function timingSafeEqual(left: Uint8Array, right: Uint8Array): boolean {
+  if (left.length !== right.length) {
+    return false
+  }
+
+  let mismatch = 0
+  for (let index = 0; index < left.length; index += 1) {
+    mismatch |= left[index] ^ right[index]
+  }
+
+  return mismatch === 0
+}
+
+async function importHmacKey(secret: string | Uint8Array): Promise<CryptoKey> {
+  return getCrypto().subtle.importKey(
+    'raw',
+    toBufferSource(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign']
+  )
+}
+
+export async function sha256Hex(value: string | Uint8Array): Promise<`0x${string}`> {
+  const digest = await getCrypto().subtle.digest('SHA-256', toBufferSource(value))
+  return `0x${bytesToHex(new Uint8Array(digest))}`
+}
+
+export async function signHmacSha256({
+  secret,
+  message,
+  encoding = 'hex',
+}: HmacSignatureOptions): Promise<string> {
+  const key = await importHmacKey(secret)
+  const signature = await getCrypto().subtle.sign('HMAC', key, toBufferSource(message))
+  return encodeBytes(new Uint8Array(signature), encoding)
+}
+
+export async function verifyHmacSha256(
+  options: HmacSignatureOptions & { signature: string }
+): Promise<boolean> {
+  const expected = await signHmacSha256(options)
+
+  try {
+    const receivedBuffer = decodeSignature(options.signature, options.encoding ?? 'hex')
+    const expectedBuffer = decodeSignature(expected, options.encoding ?? 'hex')
+    return timingSafeEqual(receivedBuffer, expectedBuffer)
+  } catch {
+    return false
+  }
+}
+
+export async function assertValidHmac(
+  options: HmacSignatureOptions & { signature: string }
+): Promise<void> {
+  if (!(await verifyHmacSha256(options))) {
+    throw new HmacVerificationError('HMAC signature verification failed')
+  }
+}
+
+export function generateNonce(byteLength = 16): string {
+  if (!Number.isInteger(byteLength) || byteLength < 16) {
+    throw new ValidationError('Nonce byte length must be an integer greater than or equal to 16', {
+      byteLength,
+    })
+  }
+
+  const bytes = new Uint8Array(byteLength)
+  getCrypto().getRandomValues(bytes)
+  return bytesToHex(bytes)
+}
+
+export function validateTimestamp(
+  value: string | number | Date,
+  options: TimestampValidationOptions = {}
+): TimestampValidationResult {
+  const nowMs = options.nowMs ?? Date.now()
+  const maxSkewMs = options.maxSkewMs ?? 5 * 60 * 1000
+  const timestampMs = value instanceof Date ? value.getTime() : new Date(value).getTime()
+
+  if (Number.isNaN(timestampMs)) {
+    throw new ValidationError('Timestamp must be a valid date value', { value })
+  }
+
+  if (!Number.isInteger(maxSkewMs) || maxSkewMs < 0) {
+    throw new ValidationError('maxSkewMs must be a non-negative integer', {
+      maxSkewMs,
+    })
+  }
+
+  const ageMs = nowMs - timestampMs
+  return {
+    valid: Math.abs(ageMs) <= maxSkewMs,
+    ageMs,
+  }
+}
+
+export function assertValidTimestamp(
+  value: string | number | Date,
+  options: TimestampValidationOptions = {}
+): void {
+  const result = validateTimestamp(value, options)
+  if (!result.valid) {
+    throw new ValidationError('Timestamp is outside the allowed clock skew window', {
+      ageMs: result.ageMs,
+      maxSkewMs: options.maxSkewMs ?? 5 * 60 * 1000,
+    })
+  }
+}

package/src/validation/schemas.ts

@@ -0,0 +1,208 @@
+import { z } from 'zod'
+import { PAYMENT_INTENT_STATUSES } from '../types/payment.js'
+
+export const AddressSchema = z
+  .string({ required_error: 'Address is required' })
+  .regex(/^0x[a-fA-F0-9]{40}$/, 'Address must be a valid 20-byte hex string')
+
+export const HexSchema = z
+  .string({ required_error: 'Hex value is required' })
+  .regex(/^0x(?:[a-fA-F0-9]{2})*$/, 'Value must be a valid even-length hex string')
+
+export const TimestampSchema = z
+  .string({ required_error: 'Timestamp is required' })
+  .datetime({ offset: true, message: 'Timestamp must be a valid ISO-8601 string' })
+
+export const NonNegativeBigIntSchema = z
+  .union([
+    z.bigint(),
+    z.number().int().nonnegative(),
+    z
+      .string()
+      .regex(/^\d+$/, 'Amount must contain only digits'),
+  ])
+  .transform((value) => BigInt(value))
+
+export const PositiveBigIntSchema = NonNegativeBigIntSchema.refine(
+  (value) => value > 0n,
+  'Amount must be greater than zero'
+)
+
+export const PaymentAmountSchema = z.object({
+  currency: z.literal('USDC'),
+  value: PositiveBigIntSchema,
+  decimals: z
+    .number({ required_error: 'Amount decimals are required' })
+    .int('Amount decimals must be an integer')
+    .min(0, 'Amount decimals cannot be negative')
+    .max(18, 'Amount decimals cannot exceed 18'),
+})
+
+export const PaymentRecipientSchema = z.object({
+  address: AddressSchema,
+  chainId: z
+    .number({ required_error: 'Recipient chainId is required' })
+    .int('Recipient chainId must be an integer')
+    .positive('Recipient chainId must be positive'),
+  ensName: z.string().trim().min(1).nullable().optional(),
+})
+
+export const PaymentIntentFailureSchema = z.object({
+  code: z.string().trim().min(1, 'Failure code is required'),
+  message: z.string().trim().min(1, 'Failure message is required'),
+  retryable: z.boolean(),
+  detail: z.record(z.unknown()).optional(),
+})
+
+export const PaymentIntentSchema = z.object({
+  id: z.string().trim().min(1, 'Payment intent id is required'),
+  workspaceId: z.string().trim().min(1, 'workspaceId is required'),
+  actorId: z.string().trim().min(1, 'actorId is required'),
+  status: z.enum(PAYMENT_INTENT_STATUSES),
+  amount: PaymentAmountSchema,
+  recipient: PaymentRecipientSchema,
+  createdAt: TimestampSchema,
+  updatedAt: TimestampSchema,
+  expiresAt: TimestampSchema.nullable().optional(),
+  idempotencyKey: z.string().trim().min(1).nullable().optional(),
+  description: z.string().trim().min(1).nullable().optional(),
+  reference: z.string().trim().min(1).nullable().optional(),
+  transactionHash: HexSchema.nullable().optional(),
+  failure: PaymentIntentFailureSchema.nullable().optional(),
+  metadata: z.record(z.unknown()).optional(),
+})
+
+export const BudgetPolicySchema = z.object({
+  id: z.string().trim().min(1, 'Policy id is required'),
+  name: z.string().trim().min(1, 'Policy name is required'),
+  enabled: z.boolean(),
+  kind: z.literal('budget'),
+  currency: z.literal('USDC'),
+  limit: PositiveBigIntSchema,
+  softLimit: PositiveBigIntSchema.optional(),
+})
+
+export const AllowlistPolicySchema = z.object({
+  id: z.string().trim().min(1, 'Policy id is required'),
+  name: z.string().trim().min(1, 'Policy name is required'),
+  enabled: z.boolean(),
+  kind: z.literal('allowlist'),
+  addresses: z.array(AddressSchema).min(1, 'Allowlist must contain at least one address'),
+  chains: z.array(z.number().int().positive()).optional(),
+})
+
+export const RateLimitPolicySchema = z.object({
+  id: z.string().trim().min(1, 'Policy id is required'),
+  name: z.string().trim().min(1, 'Policy name is required'),
+  enabled: z.boolean(),
+  kind: z.literal('rate_limit'),
+  maxRequests: z.number().int().positive('maxRequests must be positive'),
+  intervalMs: z.number().int().positive('intervalMs must be positive'),
+  burst: z.number().int().positive('burst must be positive').optional(),
+  scope: z.enum(['actor', 'workspace', 'ip']),
+})
+
+export const PolicyDefinitionSchema = z.discriminatedUnion('kind', [
+  BudgetPolicySchema,
+  AllowlistPolicySchema,
+  RateLimitPolicySchema,
+])
+
+export const PolicyEvaluationContextSchema = z.object({
+  actorId: z.string().trim().min(1, 'actorId is required'),
+  workspaceId: z.string().trim().min(1, 'workspaceId is required'),
+  recipient: AddressSchema,
+  chainId: z.number().int().positive('chainId must be positive'),
+  amount: PositiveBigIntSchema,
+  currency: z.literal('USDC'),
+  timestampMs: z.number().int().nonnegative('timestampMs must be non-negative'),
+  spentAmount: NonNegativeBigIntSchema,
+  requestCount: z.number().int().nonnegative('requestCount must be non-negative'),
+  sourceIp: z.string().trim().min(1).optional(),
+})
+
+export const SmartWalletSchema = z.object({
+  address: AddressSchema,
+  ownerAddress: AddressSchema,
+  chainId: z.number().int().positive('chainId must be positive'),
+  provider: z.enum(['safe', 'kernel', 'circle']),
+  entryPointAddress: AddressSchema,
+  entryPointVersion: z.enum(['v0.6', 'v0.7']),
+  factoryAddress: AddressSchema.optional(),
+  deployed: z.boolean(),
+})
+
+export const UserOperationCallSchema = z.object({
+  to: AddressSchema,
+  value: NonNegativeBigIntSchema,
+  data: HexSchema,
+})
+
+export const GasEstimateSchema = z.object({
+  callGasLimit: NonNegativeBigIntSchema,
+  verificationGasLimit: NonNegativeBigIntSchema,
+  preVerificationGas: NonNegativeBigIntSchema,
+  maxFeePerGas: NonNegativeBigIntSchema,
+  maxPriorityFeePerGas: NonNegativeBigIntSchema,
+  paymasterVerificationGasLimit: NonNegativeBigIntSchema.optional(),
+  paymasterPostOpGasLimit: NonNegativeBigIntSchema.optional(),
+})
+
+export const UserOperationV06Schema = z.object({
+  version: z.literal('v0.6'),
+  sender: AddressSchema,
+  nonce: NonNegativeBigIntSchema,
+  initCode: HexSchema,
+  callData: HexSchema,
+  callGasLimit: NonNegativeBigIntSchema,
+  verificationGasLimit: NonNegativeBigIntSchema,
+  preVerificationGas: NonNegativeBigIntSchema,
+  maxFeePerGas: NonNegativeBigIntSchema,
+  maxPriorityFeePerGas: NonNegativeBigIntSchema,
+  paymasterAndData: HexSchema,
+  signature: HexSchema,
+})
+
+export const UserOperationV07Schema = z.object({
+  version: z.literal('v0.7'),
+  sender: AddressSchema,
+  nonce: NonNegativeBigIntSchema,
+  factory: z.union([AddressSchema, HexSchema]),
+  factoryData: HexSchema,
+  callData: HexSchema,
+  callGasLimit: NonNegativeBigIntSchema,
+  verificationGasLimit: NonNegativeBigIntSchema,
+  preVerificationGas: NonNegativeBigIntSchema,
+  maxFeePerGas: NonNegativeBigIntSchema,
+  maxPriorityFeePerGas: NonNegativeBigIntSchema,
+  paymaster: z.union([AddressSchema, HexSchema]),
+  paymasterVerificationGasLimit: NonNegativeBigIntSchema,
+  paymasterPostOpGasLimit: NonNegativeBigIntSchema,
+  paymasterData: HexSchema,
+  signature: HexSchema,
+})
+
+export const UserOperationSchema = z.discriminatedUnion('version', [
+  UserOperationV06Schema,
+  UserOperationV07Schema,
+])
+
+export function parseAddress(value: unknown): z.infer<typeof AddressSchema> {
+  return AddressSchema.parse(value)
+}
+
+export function parsePaymentIntent(value: unknown): z.infer<typeof PaymentIntentSchema> {
+  return PaymentIntentSchema.parse(value)
+}
+
+export function parsePolicyDefinition(
+  value: unknown
+): z.infer<typeof PolicyDefinitionSchema> {
+  return PolicyDefinitionSchema.parse(value)
+}
+
+export function parseUserOperation(
+  value: unknown
+): z.infer<typeof UserOperationSchema> {
+  return UserOperationSchema.parse(value)
+}

package/test/architecture/architecture-invariants.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, it } from 'vitest'
+import { readFileSync, readdirSync, statSync } from 'fs'
+import { join, relative } from 'path'
+
+const SRC = join(import.meta.dirname, '../../src')
+
+const blockchains = [
+  'viem', '@viem', 'ethers', '@ethersproject', 'web3', 'wagmi',
+  '@wagmi', '@solana', '@cosmjs', '@polkadot', 'near-api-js',
+  '@near-js', '@injectivelabs', 'alchemy-sdk', 'moralis', 'thirdweb',
+]
+
+const nodeBuiltins = [
+  'fs', 'path', 'crypto', 'http', 'https', 'os', 'child_process',
+  'stream', 'net', 'dns', 'buffer', 'events', 'assert', 'tls',
+  'cluster', 'dgram', 'readline', 'repl', 'vm', 'worker_threads',
+  'perf_hooks', 'async_hooks', 'v8', 'inspector', 'wasi',
+  'diagnostics_channel',
+]
+
+function walk(dir: string): string[] {
+  const files: string[] = []
+  try {
+    for (const entry of readdirSync(dir)) {
+      const full = join(dir, entry)
+      if (statSync(full).isDirectory()) {
+        files.push(...walk(full))
+      } else if (entry.endsWith('.ts') && !entry.endsWith('.d.ts')) {
+        files.push(full)
+      }
+    }
+  } catch { /* skip */ }
+  return files
+}
+
+function parseImports(source: string): string[] {
+  const imports: string[] = []
+  const re = /import(?: type)?\s+(?:\{[^}]*\}|[^'"]+)\s+from\s+['"]([^'"]+)['"]/g
+  let m
+  while ((m = re.exec(source)) !== null) imports.push(m[1])
+  return imports
+}
+
+function getModuleName(p: string): string {
+  if (p.startsWith('@')) {
+    return p.split('/').slice(0, 2).join('/')
+  }
+  if (p.startsWith('.') || p.startsWith('/')) return ''
+  return p.split('/')[0]
+}
+
+describe('@brninpay/core — architecture invariants', () => {
+  const files = walk(SRC)
+  const blockViolations: { file: string; imp: string }[] = []
+  const nodeViolations: { file: string; imp: string }[] = []
+  const wsViolations: { file: string; imp: string }[] = []
+
+  for (const file of files) {
+    const source = readFileSync(file, 'utf8')
+    const imports = parseImports(source)
+    const rel = relative(SRC, file)
+
+    for (const imp of imports) {
+      const mod = getModuleName(imp)
+
+      if (blockchains.some((b) => mod.startsWith(b))) {
+        blockViolations.push({ file: rel, imp })
+      }
+
+      if (nodeBuiltins.includes(mod)) {
+        nodeViolations.push({ file: rel, imp })
+      }
+
+      if (imp.startsWith('@brninpay/')) {
+        wsViolations.push({ file: rel, imp })
+      }
+    }
+  }
+
+  it('must not import blockchain libraries (viem, ethers, web3, etc.)', () => {
+    expect(blockViolations, fmt('blockchain imports', blockViolations)).toHaveLength(0)
+  })
+
+  it('must not import Node.js builtins (fs, crypto, http, path, etc.)', () => {
+    expect(nodeViolations, fmt('Node builtins', nodeViolations)).toHaveLength(0)
+  })
+
+  it('must not import from other @brninpay packages', () => {
+    expect(wsViolations, fmt('forbidden workspace imports', wsViolations)).toHaveLength(0)
+  })
+})
+
+function fmt(label: string, v: { file: string; imp: string }[]): string {
+  return v.length ? `\n\n${label}:\n${v.map((x) => `  ${x.file} → ${x.imp}`).join('\n')}` : ''
+}

package/test/authorization-pipeline.test.ts

@@ -0,0 +1,117 @@
+import { describe, expect, it } from 'vitest'
+import { PolicyEngine } from '../src/policy-engine.js'
+import { createBudgetCheckPolicy } from '../src/policies/budget-check.js'
+import { createAllowlistPolicy } from '../src/policies/allowlist.js'
+import { createMaxPerCallPolicy } from '../src/policies/max-per-call.js'
+import type { Actor, Intent, BudgetState } from '../src/types.js'
+
+const actor: Actor = {
+  id: 'actor_test_1',
+  name: 'test-agent',
+  status: 'active',
+  createdAt: new Date().toISOString(),
+}
+
+const budget: BudgetState = {
+  total: 100_000_000n,
+  used: 10_000_000n,
+  remaining: 90_000_000n,
+  period: 'monthly',
+  currency: 'USDC',
+}
+
+describe('Authorization Pipeline', () => {
+  it('approves payment within all limits', async () => {
+    const engine = new PolicyEngine([
+      createBudgetCheckPolicy('pol_budget', '1'),
+      createAllowlistPolicy('pol_allow', '1', ['openai:gpt-4']),
+      createMaxPerCallPolicy('pol_max', '1', 50_000_000n),
+    ])
+
+    const intent: Intent = {
+      target: 'openai:gpt-4',
+      amount: 5_000_000n,
+      purpose: { type: 'llm-inference', id: 'test-1' },
+    }
+
+    const auth = await engine.evaluate(actor, intent, budget)
+    expect(auth.decision).toBe('approved')
+    expect(auth.policyResults).toHaveLength(3)
+  })
+
+  it('denies payment exceeding budget', async () => {
+    const engine = new PolicyEngine([
+      createBudgetCheckPolicy('pol_budget', '1'),
+      createAllowlistPolicy('pol_allow', '1', ['openai:gpt-4']),
+    ])
+
+    const intent: Intent = {
+      target: 'openai:gpt-4',
+      amount: 95_000_000n,
+      purpose: { type: 'llm-inference', id: 'test-2' },
+    }
+
+    const auth = await engine.evaluate(actor, intent, budget)
+    expect(auth.decision).toBe('denied')
+    const budgetResult = auth.policyResults.find((r) => r.policyType === 'budget-check')
+    expect(budgetResult?.decision).toBe('deny')
+  })
+
+  it('denies payment to unauthorized target', async () => {
+    const engine = new PolicyEngine([
+      createBudgetCheckPolicy('pol_budget', '1'),
+      createAllowlistPolicy('pol_allow', '1', ['openai:gpt-4']),
+    ])
+
+    const intent: Intent = {
+      target: 'evil:service',
+      amount: 5_000_000n,
+      purpose: { type: 'test', id: 'test-3' },
+    }
+
+    const auth = await engine.evaluate(actor, intent, budget)
+    expect(auth.decision).toBe('denied')
+    const allowResult = auth.policyResults.find((r) => r.policyType === 'allowlist')
+    expect(allowResult?.decision).toBe('deny')
+  })
+
+  it('deny overrides pass across all policy types', async () => {
+    const engine = new PolicyEngine([
+      createBudgetCheckPolicy('pol_budget', '1'),
+      createMaxPerCallPolicy('pol_max', '1', 1_000_000n),
+      createAllowlistPolicy('pol_allow', '1', ['openai:gpt-4']),
+    ])
+
+    const intent: Intent = {
+      target: 'openai:gpt-4',
+      amount: 10_000_000n,
+      purpose: { type: 'test', id: 'test-4' },
+    }
+
+    const auth = await engine.evaluate(actor, intent, budget)
+    expect(auth.decision).toBe('denied')
+    expect(auth.policyResults.find((r) => r.policyType === 'budget-check')?.decision).toBe('pass')
+    expect(auth.policyResults.find((r) => r.policyType === 'allowlist')?.decision).toBe('pass')
+    expect(auth.policyResults.find((r) => r.policyType === 'max-per-call')?.decision).toBe('deny')
+  })
+
+  it('previewPay returns same result as pay without execution', async () => {
+    const engine = new PolicyEngine([
+      createBudgetCheckPolicy('pol_budget', '1'),
+      createAllowlistPolicy('pol_allow', '1', ['openai:gpt-4']),
+    ])
+
+    const intent: Intent = {
+      target: 'openai:gpt-4',
+      amount: 5_000_000n,
+      purpose: { type: 'test', id: 'preview-test' },
+    }
+
+    const auth1 = await engine.evaluate(actor, intent, budget)
+    const auth2 = await engine.evaluate(actor, intent, budget)
+
+    expect(auth1.decision).toBe(auth2.decision)
+    expect(auth1.policyResults.map((r) => r.decision))
+      .toEqual(auth2.policyResults.map((r) => r.decision))
+  })
+})

package/test/crypto.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest'
+import {
+  assertValidHmac,
+  generateNonce,
+  sha256Hex,
+  signHmacSha256,
+  validateTimestamp,
+  verifyHmacSha256,
+} from '../src/utils/crypto.js'
+
+describe('crypto utils', () => {
+  it('hashes payloads with sha256', async () => {
+    await expect(sha256Hex('hello')).resolves.toBe(
+      '0x2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824'
+    )
+  })
+
+  it('signs and verifies HMAC payloads', async () => {
+    const signature = await signHmacSha256({
+      secret: 'top-secret',
+      message: 'payload',
+    })
+
+    await expect(
+      verifyHmacSha256({
+        secret: 'top-secret',
+        message: 'payload',
+        signature,
+      })
+    ).resolves.toBe(true)
+
+    await expect(
+      assertValidHmac({
+        secret: 'top-secret',
+        message: 'payload',
+        signature,
+      })
+    ).resolves.toBeUndefined()
+  })
+
+  it('creates nonces with enough entropy', () => {
+    const nonce = generateNonce()
+    expect(nonce).toMatch(/^[0-9a-f]{32}$/)
+  })
+
+  it('validates timestamp skew windows', () => {
+    const now = Date.now()
+
+    expect(validateTimestamp(new Date(now - 1000), { nowMs: now, maxSkewMs: 5000 }).valid).toBe(
+      true
+    )
+    expect(validateTimestamp(new Date(now - 10000), { nowMs: now, maxSkewMs: 5000 }).valid).toBe(
+      false
+    )
+  })
+})