mppx 0.6.31 → 0.8.0

package/src/tempo/AccessKeyAuthorization.test.ts

@@ -6,16 +6,12 @@ import {
   Secp256k1,
   Transaction,
 } from 'viem/tempo'
-import { beforeAll, describe, expect, test } from 'vp/test'
-import { nodeEnv } from '~test/config.js'
-import { deployEscrow, openChannel } from '~test/tempo/session.js'
+import { describe, expect, test } from 'vp/test'
+import { tempoNetwork } from '~test/config.js'
 import { asset as currency, chain, http } from '~test/tempo/viem.js'
 
-import { createOpenPayload } from './client/ChannelOps.js'
 import { charge } from './client/Charge.js'
 import * as Methods from './Methods.js'
-import { closeOnChain, settleOnChain } from './session/Chain.js'
-import { signVoucher } from './session/Voucher.js'
 
 type ChargeCredentialPayload =
   | { hash: Hex; type: 'hash' }
@@ -25,6 +21,7 @@ const rootAccount = TempoAccount.fromSecp256k1(
   '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80',
 )
 const recipient = '0x2222222222222222222222222222222222222222' as Address
+const isLocalnet = tempoNetwork === 'localnet'
 
 type ChargeRequest = ReturnType<typeof Methods.charge.schema.request.parse>
 
@@ -100,35 +97,7 @@ function expectTransactionKeyAuthorization(
   expect(transaction.keyAuthorization).toEqual(keyAuthorization)
 }
 
-async function createChannelForPayee(payee: Address, escrowContract: Address) {
-  const payer = rootAccount
-  const { channelId } = await openChannel({
-    deposit: 10_000_000n,
-    escrow: escrowContract,
-    payee,
-    payer,
-    salt: Secp256k1.randomPrivateKey(),
-    token: currency,
-  })
-  const cumulativeAmount = 1_000_000n
-  const signature = await signVoucher(
-    createClient({ account: payer, chain, transport: http() }),
-    payer,
-    { channelId, cumulativeAmount },
-    escrowContract,
-    chain.id,
-  )
-
-  return { channelId, cumulativeAmount, escrowContract, signature }
-}
-
-describe.runIf(nodeEnv === 'localnet')('Tempo access-key authorization attachment', () => {
-  let escrowContract: Address
-
-  beforeAll(async () => {
-    escrowContract = await deployEscrow()
-  })
-
+describe.runIf(isLocalnet)('Tempo access-key authorization attachment', () => {
   test('tempo.charge pull signs a prepared transaction with keyAuthorization', async () => {
     const { accessKey, client, keyAuthorization } = await createAccessKeyClient()
     const method = charge({
@@ -169,63 +138,4 @@ describe.runIf(nodeEnv === 'localnet')('Tempo access-key authorization attachmen
     expect(signedTransactions).toHaveLength(1)
     expectTransactionKeyAuthorization(signedTransactions[0]!, keyAuthorization)
   })
-
-  test('tempo.session open signs a prepared transaction with keyAuthorization', async () => {
-    const { accessKey, client, keyAuthorization } = await createAccessKeyClient()
-
-    const { payload } = await createOpenPayload(client, accessKey, {
-      chainId: chain.id,
-      currency,
-      deposit: 5_000_000n,
-      escrowContract,
-      initialAmount: 1_000_000n,
-      payee: recipient,
-    })
-
-    expect(payload.action).toBe('open')
-    if (payload.action !== 'open') throw new Error('unexpected payload action')
-    expectTransactionKeyAuthorization(payload.transaction, keyAuthorization)
-  })
-
-  test('tempo.session settle sends a prepared transaction with keyAuthorization', async () => {
-    const { accessKey, client, keyAuthorization, signedTransactions } =
-      await createAccessKeyClient()
-    const channel = await createChannelForPayee(rootAccount.address, escrowContract)
-
-    const hash = await settleOnChain(
-      client,
-      channel.escrowContract,
-      {
-        channelId: channel.channelId,
-        cumulativeAmount: channel.cumulativeAmount,
-        signature: channel.signature,
-      },
-      { account: accessKey },
-    )
-
-    expect(hash).toMatch(/^0x[0-9a-f]{64}$/)
-    expect(signedTransactions).toHaveLength(1)
-    expectTransactionKeyAuthorization(signedTransactions[0]!, keyAuthorization)
-  })
-
-  test('tempo.session close sends a prepared transaction with keyAuthorization', async () => {
-    const { accessKey, client, keyAuthorization, signedTransactions } =
-      await createAccessKeyClient()
-    const channel = await createChannelForPayee(rootAccount.address, escrowContract)
-
-    const hash = await closeOnChain(
-      client,
-      channel.escrowContract,
-      {
-        channelId: channel.channelId,
-        cumulativeAmount: channel.cumulativeAmount,
-        signature: channel.signature,
-      },
-      { account: accessKey },
-    )
-
-    expect(hash).toMatch(/^0x[0-9a-f]{64}$/)
-    expect(signedTransactions).toHaveLength(1)
-    expectTransactionKeyAuthorization(signedTransactions[0]!, keyAuthorization)
-  })
 })

package/src/tempo/Methods.test.ts

@@ -248,6 +248,51 @@ describe('session', () => {
     expect(request.amount).toBe('1000000')
     expect(request.methodDetails?.minVoucherDelta).toBe('100000')
   })
+
+  test('schema: preserves precompile session snapshots in method details', () => {
+    const sessionSnapshot = {
+      acceptedCumulative: '2',
+      channelId: `0x${'11'.repeat(32)}` as const,
+      deposit: '5',
+      descriptor: {
+        authorizedSigner: '0x0000000000000000000000000000000000000006',
+        expiringNonceHash: `0x${'22'.repeat(32)}` as const,
+        operator: '0x0000000000000000000000000000000000000000',
+        payee: '0x0000000000000000000000000000000000000002',
+        payer: '0x0000000000000000000000000000000000000001',
+        salt: `0x${'33'.repeat(32)}` as const,
+        token: '0x0000000000000000000000000000000000000003',
+      },
+      requiredCumulative: '3',
+      settled: '0',
+      spent: '2',
+      units: 2,
+    }
+    const request = Methods.session.schema.request.parse({
+      amount: '1',
+      currency: '0x20c0000000000000000000000000000000000001',
+      decimals: 6,
+      recipient: '0x1234567890abcdef1234567890abcdef12345678',
+      sessionSnapshot,
+      unitType: 'token',
+    })
+
+    expect(request.methodDetails?.sessionSnapshot).toEqual(sessionSnapshot)
+  })
+
+  test('schema: advertises precompile session operator in method details', () => {
+    const operator = '0x0000000000000000000000000000000000000006'
+    const request = Methods.session.schema.request.parse({
+      amount: '1',
+      currency: '0x20c0000000000000000000000000000000000001',
+      decimals: 6,
+      operator,
+      recipient: '0x1234567890abcdef1234567890abcdef12345678',
+      unitType: 'token',
+    })
+
+    expect(request.methodDetails?.operator).toBe(operator)
+  })
 })
 
 describe('subscription', () => {
@@ -313,23 +358,6 @@ describe('subscription', () => {
     expect(request.periodCount).toBe(expected)
   })
 
-  test.each(['dev_second'] as const)(
-    'schema: accepts %s subscription periods for development and tests',
-    (periodUnit) => {
-      const request = Methods.subscription.schema.request.parse({
-        amount: '10',
-        currency: '0x20c0000000000000000000000000000000000001',
-        decimals: 6,
-        periodCount: '5',
-        periodUnit,
-        recipient: '0x1234567890abcdef1234567890abcdef12345678',
-        subscriptionExpires: '2026-01-01T00:00:00Z',
-      })
-
-      expect(request.periodUnit).toBe(periodUnit)
-    },
-  )
-
   test('schema: rejects non-numeric periodCount', () => {
     const result = Methods.subscription.schema.request.safeParse({
       amount: '10',

package/src/tempo/Methods.ts

@@ -1,8 +1,11 @@
 import type { Account, Address } from 'viem'
 import { parseUnits } from 'viem'
 
+import * as Constants from '../Constants.js'
 import * as Method from '../Method.js'
 import * as z from '../zod.js'
+import type { SessionSnapshot } from './session/client/Runtime.js'
+import type * as PrecompileChannel from './session/precompile/Channel.js'
 import type { SubscriptionPeriodUnit } from './subscription/Types.js'
 
 export const chargeModes = ['push', 'pull'] as const
@@ -196,6 +199,7 @@ export const session = Method.from({
           authorizedSigner: z.optional(z.string()),
           channelId: z.hash(),
           cumulativeAmount: z.amount(),
+          descriptor: z.optional(z.custom<PrecompileChannel.ChannelDescriptor>()),
           signature: z.signature(),
           transaction: z.signature(),
           type: z.literal('transaction'),
@@ -204,6 +208,7 @@ export const session = Method.from({
           action: z.literal('topUp'),
           additionalDeposit: z.amount(),
           channelId: z.hash(),
+          descriptor: z.optional(z.custom<PrecompileChannel.ChannelDescriptor>()),
           transaction: z.signature(),
           type: z.literal('transaction'),
         }),
@@ -211,12 +216,14 @@ export const session = Method.from({
           action: z.literal('voucher'),
           channelId: z.hash(),
           cumulativeAmount: z.amount(),
+          descriptor: z.optional(z.custom<PrecompileChannel.ChannelDescriptor>()),
           signature: z.signature(),
         }),
         z.object({
           action: z.literal('close'),
           channelId: z.hash(),
           cumulativeAmount: z.amount(),
+          descriptor: z.optional(z.custom<PrecompileChannel.ChannelDescriptor>()),
           signature: z.signature(),
         }),
       ]),
@@ -237,7 +244,12 @@ export const session = Method.from({
             ),
           ),
           minVoucherDelta: z.optional(z.amount()),
+          operator: z.optional(z.address()),
           recipient: z.optional(z.string()),
+          sessionProtocol: z.optional(
+            z.enum([Constants.SessionProtocols.v2, Constants.SessionProtocols.v1]),
+          ),
+          sessionSnapshot: z.optional(z.custom<SessionSnapshot>()),
           suggestedDeposit: z.optional(z.amount()),
           unitType: z.string(),
         })
@@ -256,6 +268,9 @@ export const session = Method.from({
           escrowContract,
           feePayer,
           minVoucherDelta,
+          operator,
+          sessionProtocol,
+          sessionSnapshot,
           suggestedDeposit,
           ...rest
         }) => ({
@@ -274,6 +289,13 @@ export const session = Method.from({
             }),
             ...(chainId !== undefined && { chainId }),
             ...(feePayer !== undefined && { feePayer }),
+            ...(operator !== undefined && { operator }),
+            ...(sessionProtocol !== undefined && {
+              [Constants.MethodDetailKeys.sessionProtocol]: sessionProtocol,
+            }),
+            ...(sessionSnapshot !== undefined && {
+              [Constants.MethodDetailKeys.sessionSnapshot]: sessionSnapshot,
+            }),
           },
         }),
       ),

package/src/tempo/Proof.conformance.test.ts

@@ -0,0 +1,146 @@
+import { recoverTypedDataAddress } from 'viem'
+import { privateKeyToAccount } from 'viem/accounts'
+import { describe, expect, test } from 'vp/test'
+
+import * as Proof from './Proof.js'
+
+/**
+ * Deterministic conformance vector for the wallet-bound Tempo proof contract
+ * (EIP-712 domain `MPP` version `3`). These values pin the on-the-wire
+ * signing payload so any change to the proof ABI is caught here.
+ */
+const vector = {
+  account: '0x1a642f0E3c3aF545E7AcBD38b07251B3990914F1',
+  chainId: 42431,
+  challengeId: 'kM9xPqWvT2nJrHsY4aDfEb',
+  digest: '0x3860a700a55e02ad3c2dc047e92489feceecbdb0a801d948e1d9f0b61ea9bc3f',
+  privateKey: `0x${'01'.repeat(32)}`,
+  realm: 'api.example.com',
+  signature:
+    '0x53f5d64d9f995e841b4212639b2e17e508e96752e10316df3814a16443dcbdb626c082190a4c3ecc3148101eb443d15bd83b579380b1be735a9c99f0df36c9fe1b',
+} as const
+
+const params = {
+  account: vector.account,
+  chainId: vector.chainId,
+  challengeId: vector.challengeId,
+  realm: vector.realm,
+} as const
+
+describe('tempo.Proof conformance (wallet binding)', () => {
+  test('typedData is the canonical wallet-bound MPP v3 proof contract', () => {
+    expect(Proof.typedData(params)).toEqual({
+      domain: { name: 'MPP', version: '3', chainId: vector.chainId },
+      types: {
+        Proof: [
+          { name: 'account', type: 'address' },
+          { name: 'challengeId', type: 'string' },
+          { name: 'realm', type: 'string' },
+        ],
+      },
+      primaryType: 'Proof',
+      message: {
+        account: vector.account,
+        challengeId: vector.challengeId,
+        realm: vector.realm,
+      },
+    })
+  })
+
+  test('hash matches the deterministic EIP-712 digest vector', () => {
+    expect(Proof.hash(params)).toBe(vector.digest)
+  })
+
+  test('the wallet produces the deterministic signature vector', async () => {
+    const account = privateKeyToAccount(vector.privateKey)
+    expect(account.address).toBe(vector.account)
+    const signature = await account.signTypedData(Proof.typedData(params))
+    expect(signature).toBe(vector.signature)
+  })
+
+  test('the signature vector recovers to the bound wallet', async () => {
+    const recovered = await recoverTypedDataAddress({
+      ...Proof.typedData(params),
+      signature: vector.signature,
+    })
+    expect(recovered).toBe(vector.account)
+  })
+
+  test('the digest is bound to the wallet: a different account changes the digest', () => {
+    const other = '0x000000000000000000000000000000000000dEaD'
+    expect(Proof.hash({ ...params, account: other })).not.toBe(vector.digest)
+  })
+
+  test('a proof cannot be replayed against a different wallet for the same challenge', async () => {
+    const account = privateKeyToAccount(vector.privateKey)
+    const signature = await account.signTypedData(Proof.typedData(params))
+
+    // An attacker swaps the bound `account` to a wallet they want to impersonate
+    // while keeping the same challenge. Because `account` is a signed field, the
+    // recovered signer no longer matches the swapped wallet, so verification
+    // (and the access-key delegation check, which rebuilds the message from the
+    // claimed source) fails.
+    const swapped = '0x000000000000000000000000000000000000dEaD'
+    const recovered = await recoverTypedDataAddress({
+      ...Proof.typedData({ ...params, account: swapped }),
+      signature,
+    })
+    expect(recovered).not.toBe(swapped)
+    expect(recovered).not.toBe(vector.account)
+  })
+
+  test('models the access-key delegation path: swapping the source breaks signer recovery', async () => {
+    // An access key K signs a proof bound to root account A. The server's
+    // delegation check recovers the signer from the message it rebuilds using
+    // the *claimed* source, then requires `isActiveAccessKey(signer, source)`.
+    // Distinct access key (signer) and root account (the bound payer / source).
+    const accessKey = privateKeyToAccount(`0x${'02'.repeat(32)}`)
+    const rootA = vector.account // proof is signed bound to account = A
+    const signature = await accessKey.signTypedData(Proof.typedData({ ...params, account: rootA }))
+    expect(accessKey.address).not.toBe(rootA)
+
+    // Honest submission (source = A): server recovers exactly K, so
+    // isActiveAccessKey(K, A) — the key actually authorized for A — is checked.
+    const recoveredForA = await recoverTypedDataAddress({
+      ...Proof.typedData({ ...params, account: rootA }),
+      signature,
+    })
+    expect(recoveredForA).toBe(accessKey.address)
+
+    // Replay against a different root B (attacker swaps source to B): server
+    // rebuilds the message with account = B, recovering some K' != K. Even if K
+    // is an active access key of B, the server checks isActiveAccessKey(K', B),
+    // which cannot match the authorized key. Replay is rejected.
+    const rootB = '0x000000000000000000000000000000000000bEEF'
+    const recoveredForB = await recoverTypedDataAddress({
+      ...Proof.typedData({ ...params, account: rootB }),
+      signature,
+    })
+    expect(recoveredForB).not.toBe(accessKey.address)
+  })
+
+  test('a legacy v2 proof (no account field) does not verify under the v3 contract', async () => {
+    // The pre-binding contract: domain version "2", message without `account`.
+    const account = privateKeyToAccount(vector.privateKey)
+    const legacyTypedData = {
+      domain: { name: 'MPP', version: '2', chainId: vector.chainId },
+      types: {
+        Proof: [
+          { name: 'challengeId', type: 'string' },
+          { name: 'realm', type: 'string' },
+        ],
+      },
+      primaryType: 'Proof',
+      message: { challengeId: vector.challengeId, realm: vector.realm },
+    } as const
+    const legacySignature = await account.signTypedData(legacyTypedData)
+
+    // Verified against the current wallet-bound v3 contract, recovery yields a
+    // different address, so the server rejects stale v2 proofs.
+    const recovered = await recoverTypedDataAddress({
+      ...Proof.typedData(params),
+      signature: legacySignature,
+    })
+    expect(recovered).not.toBe(account.address)
+  })
+})

package/src/tempo/Proof.test-d.ts

@@ -1,7 +1,22 @@
+import type { Address, Hex } from 'viem'
 import { expectTypeOf, test } from 'vp/test'
 
 import { Proof } from './index.js'
 
+test('Proof exports the wallet-bound typed-data contract helpers', () => {
+  expectTypeOf(Proof.message).toEqualTypeOf<
+    (parameters: { account: Address; challengeId: string; realm: string }) => {
+      readonly account: Address
+      readonly challengeId: string
+      readonly realm: string
+    }
+  >()
+
+  expectTypeOf(Proof.hash).toEqualTypeOf<
+    (parameters: { account: Address; chainId: number; challengeId: string; realm: string }) => Hex
+  >()
+})
+
 test('Proof exports public proof source helpers', () => {
   expectTypeOf(Proof.proofSource).toEqualTypeOf<
     (parameters: { address: string; chainId: number }) => string

package/src/tempo/Proof.ts

@@ -1,7 +1,58 @@
-import type { Address } from 'viem'
+import type { Address, Hex } from 'viem'
 
 import * as Proof_internal from './internal/proof.js'
 
+/** EIP-712 primary type for Tempo proof credentials. */
+export const primaryType = Proof_internal.primaryType
+
+/**
+ * EIP-712 typed-data field definitions for Tempo zero-amount proof credentials.
+ *
+ * The `account` field cryptographically binds the signature to the payer
+ * wallet, so a proof signed for one account cannot be replayed against another.
+ */
+export const types = Proof_internal.types
+
+/** Constructs the EIP-712 domain for a Tempo proof credential. */
+export function domain(chainId: number) {
+  return Proof_internal.domain(chainId)
+}
+
+/**
+ * Constructs the EIP-712 message for a Tempo proof credential.
+ *
+ * @param parameters - Proof message parameters.
+ * @param parameters.account - Payer wallet address the proof is bound to.
+ * @param parameters.challengeId - Challenge `id` being proven.
+ * @param parameters.realm - Challenge `realm` being proven.
+ */
+export function message(parameters: { account: Address; challengeId: string; realm: string }) {
+  return Proof_internal.message(parameters)
+}
+
+/**
+ * Constructs the complete EIP-712 typed-data payload for a Tempo proof
+ * credential — the canonical, wallet-bound proof contract.
+ */
+export function typedData(parameters: {
+  account: Address
+  chainId: number
+  challengeId: string
+  realm: string
+}) {
+  return Proof_internal.typedData(parameters)
+}
+
+/** Computes the EIP-712 digest (signing payload) for a Tempo proof credential. */
+export function hash(parameters: {
+  account: Address
+  chainId: number
+  challengeId: string
+  realm: string
+}): Hex {
+  return Proof_internal.hash(parameters)
+}
+
 /** Constructs the canonical `did:pkh:eip155` source DID for Tempo proof credentials. */
 export function proofSource(parameters: { address: string; chainId: number }): string {
   return Proof_internal.proofSource(parameters)

package/src/tempo/PublicExports.test-d.ts

@@ -0,0 +1,105 @@
+import { expectTypeOf, test } from 'vp/test'
+
+import type {
+  PaymentResponse as ClientPaymentResponse,
+  SessionManager as ClientSessionManager,
+  SessionManagerSseOptions as ClientSessionManagerSseOptions,
+  SessionManagerWebSocketOptions as ClientSessionManagerWebSocketOptions,
+} from './client/index.js'
+import * as Tempo from './index.js'
+import type { SettlementSchedule as ServerSettlementSchedule } from './server/index.js'
+import type {
+  ActiveSessionState,
+  ClosedSessionState,
+  PaymentResponse as SessionPaymentResponse,
+  SessionManager,
+  SessionManagerSseOptions,
+  SessionManagerWebSocketOptions,
+  SessionTransition,
+  VoucherNeededSessionState,
+} from './session/client/index.js'
+import type { SessionTransition as MachineSessionTransition } from './session/client/index.js'
+import type { ChannelTransactionOptions } from './session/precompile/Chain.js'
+import type { RawAmountString } from './session/precompile/index.js'
+import type { SettlementSchedule as SessionSettlementSchedule } from './session/server/index.js'
+
+test('tempo session public barrels expose manager and schedule interfaces', () => {
+  expectTypeOf(Tempo.Session).toBeObject()
+  expectTypeOf(Tempo.Session.Client).toBeObject()
+  expectTypeOf(Tempo.Session.Precompile).toBeObject()
+  expectTypeOf(Tempo.Session.Server).toBeObject()
+  expectTypeOf<typeof Tempo>().not.toHaveProperty('Precompile')
+
+  expectTypeOf<ClientPaymentResponse>().toEqualTypeOf<SessionPaymentResponse>()
+  expectTypeOf<ClientSessionManager>().toEqualTypeOf<SessionManager>()
+  expectTypeOf<ClientSessionManagerSseOptions>().toEqualTypeOf<SessionManagerSseOptions>()
+  expectTypeOf<ClientSessionManagerWebSocketOptions>().toEqualTypeOf<SessionManagerWebSocketOptions>()
+
+  expectTypeOf<ServerSettlementSchedule>().toEqualTypeOf<SessionSettlementSchedule>()
+  expectTypeOf<MachineSessionTransition>().toEqualTypeOf<SessionTransition>()
+  expectTypeOf<ServerSettlementSchedule>().toEqualTypeOf<{
+    amount?: string | bigint | undefined
+    intervalMs?: number | undefined
+    units?: number | undefined
+  }>()
+  expectTypeOf<RawAmountString>().toEqualTypeOf<string>()
+  expectTypeOf<ActiveSessionState['status']>().toEqualTypeOf<'active'>()
+  expectTypeOf<VoucherNeededSessionState['status']>().toEqualTypeOf<'voucherNeeded'>()
+  expectTypeOf<ClosedSessionState['status']>().toEqualTypeOf<'closed'>()
+})
+
+test('tempo session chain exports canonical transaction options', () => {
+  expectTypeOf<ChannelTransactionOptions>().toEqualTypeOf<{
+    account?: import('viem').Account | undefined
+    candidateFeeTokens?: readonly import('viem').Address[] | undefined
+    feePayer?: import('viem').Account | undefined
+    feePayerPolicy?: Partial<import('./internal/fee-payer.js').Policy> | undefined
+    feeToken?: import('viem').Address | undefined
+  }>()
+})
+
+test('tempo session public barrel hides internal session drivers', () => {
+  type SessionNamespacePublic = typeof import('./session/index.js')
+  type SessionPublic = typeof import('./session/precompile/index.js')
+  type SessionClientPublic = typeof import('./session/client/index.js')
+  type SessionServerPublic = typeof import('./session/server/index.js')
+
+  expectTypeOf<SessionNamespacePublic>().toHaveProperty('Precompile')
+  expectTypeOf<SessionNamespacePublic>().toHaveProperty('Client')
+  expectTypeOf<SessionNamespacePublic>().toHaveProperty('Server')
+  expectTypeOf<SessionNamespacePublic>().not.toHaveProperty('ChannelStore')
+  expectTypeOf<SessionNamespacePublic>().not.toHaveProperty('Receipt')
+  expectTypeOf<SessionNamespacePublic>().not.toHaveProperty('Sse')
+  expectTypeOf<SessionNamespacePublic>().not.toHaveProperty('Types')
+  expectTypeOf<SessionNamespacePublic>().not.toHaveProperty('Ws')
+  expectTypeOf<SessionNamespacePublic>().not.toHaveProperty('session')
+  expectTypeOf<SessionNamespacePublic>().not.toHaveProperty('sessionManager')
+  expectTypeOf<SessionPublic>().not.toHaveProperty('openSseSession')
+  expectTypeOf<SessionPublic>().not.toHaveProperty('openWebSocketSession')
+  expectTypeOf<SessionPublic>().not.toHaveProperty('Client')
+  expectTypeOf<SessionPublic>().not.toHaveProperty('Server')
+  expectTypeOf<SessionPublic>().not.toHaveProperty('session')
+  expectTypeOf<SessionPublic>().not.toHaveProperty('sessionManager')
+  expectTypeOf<SessionPublic>().not.toHaveProperty('settle')
+  expectTypeOf<SessionClientPublic>().not.toHaveProperty('ChannelOps')
+  expectTypeOf<SessionClientPublic>().not.toHaveProperty('Chain')
+  expectTypeOf<SessionServerPublic>().not.toHaveProperty('ChannelOps')
+  expectTypeOf<SessionServerPublic>().not.toHaveProperty('Chain')
+})
+
+test('tempo legacy namespace keeps client, server, and channel primitives isolated', () => {
+  type LegacySessionPublic = typeof import('./legacy/session/index.js')
+
+  expectTypeOf(Tempo.SessionLegacy.Client.session).toBeFunction()
+  expectTypeOf(Tempo.SessionLegacy.Client.sessionManager).toBeFunction()
+  expectTypeOf(Tempo.SessionLegacy.Server.session).toBeFunction()
+  expectTypeOf(Tempo.SessionLegacy.Server.settle).toBeFunction()
+  expectTypeOf(Tempo.SessionLegacy.Session.Chain).toBeObject()
+  expectTypeOf(Tempo.SessionLegacy.Session.Channel).toBeObject()
+  expectTypeOf(Tempo.SessionLegacy.Session.Voucher).toBeObject()
+
+  expectTypeOf<LegacySessionPublic>().not.toHaveProperty('ChannelStore')
+  expectTypeOf<LegacySessionPublic>().not.toHaveProperty('Receipt')
+  expectTypeOf<LegacySessionPublic>().not.toHaveProperty('Sse')
+  expectTypeOf<LegacySessionPublic>().not.toHaveProperty('Ws')
+})

package/src/tempo/Subscription.integration.test.ts

@@ -10,7 +10,7 @@ import * as SubscriptionStore from './subscription/Store.js'
 import type { SubscriptionAccessKey, SubscriptionRecord } from './subscription/Types.js'
 
 const realm = 'news.example.com'
-const secretKey = 'subscription-lifecycle-secret'
+const secretKey = 'subscription-lifecycle-secret-key-32'
 const currency = '0x20c0000000000000000000000000000000000001'
 const recipient = '0x1234567890abcdef1234567890abcdef12345678'
 const periodCount = '30'