mppx 0.8.17 → 0.8.18

package/src/tempo/server/internal/transport.ts

@@ -1,322 +0,0 @@
-/**
- * Tempo-specific SSE transport that wraps the base HTTP transport
- * with metering logic (context capture from verified credentials, per-token
- * charging via Sse.serve).
- *
- * @internal
- */
-import * as Challenge from '../../../Challenge.js'
-import * as Constants from '../../../Constants.js'
-import * as Errors from '../../../Errors.js'
-import * as Transport from '../../../server/Transport.js'
-import type { SessionReceipt } from '../../session/precompile/Protocol.js'
-import { requireSessionCredentialContext } from '../../session/precompile/Protocol.js'
-import * as ChannelStore from '../../session/server/ChannelStore.js'
-import type { SettleChargedSessionChannel } from '../../session/server/Settlement.js'
-import * as Sse_core from '../../session/server/Sse.js'
-import { captureRequestBodyProbe, shouldChargePlainResponse } from './request-body.js'
-
-const prepaidSessionTick = Symbol('mppx.prepaidSessionTick')
-
-/** SSE transport with Tempo session controller. */
-export type Sse = Transport.Sse<Sse_core.SessionController>
-
-/** Receipt marker used to avoid double-charging a request already charged during verification. */
-export type PrepaidSessionReceipt = SessionReceipt & {
-  [prepaidSessionTick]?: true | undefined
-}
-
-/** Marks a session receipt as already charged for the current request. */
-export function markPrepaidSessionTick(receipt: SessionReceipt): SessionReceipt {
-  Object.defineProperty(receipt, prepaidSessionTick, {
-    configurable: false,
-    enumerable: false,
-    value: true,
-  })
-  return receipt
-}
-
-function hasPrepaidSessionTick(receipt: SessionReceipt): boolean {
-  return (receipt as PrepaidSessionReceipt)[prepaidSessionTick] === true
-}
-
-/**
- * Creates a Tempo-metered SSE transport.
- *
- * Wraps an HTTP transport with:
- * - Context capture from credentials (channelId, tickCost)
- * - Per-token charging via Sse.serve for generator/iterable responses
- * - Auto-detection of upstream SSE responses
- * - Fallback to standard HTTP receipt handling for plain Response
- */
-export function sse(
-  options: sse.Options & {
-    settleCharged?: SettleChargedSessionChannel | undefined
-    store: ChannelStore.ChannelStore
-  },
-): Sse {
-  const { pollingInterval, poll } = options
-
-  // When `poll` is true, strip `waitForUpdate` so the SSE charge loop
-  // falls back to polling. This is needed for runtimes like Cloudflare Workers
-  // where resolving promises across request contexts is not supported.
-  const store = (() => {
-    if (!poll) return options.store
-    const { waitForUpdate: _, ...store } = options.store
-    return store
-  })()
-
-  const base = Transport.http()
-  return Transport.from<Request, Response, Transport.ReceiptResponseOf<Sse>, Response>({
-    name: 'sse',
-
-    captureRequest(request) {
-      return (
-        base.captureRequest?.(request) ?? {
-          headers: new Headers(request.headers),
-          hasBody: request.body !== null,
-          method: request.method,
-          url: new URL(request.url),
-        }
-      )
-    },
-
-    getCredential(request) {
-      return base.getCredential(request)
-    },
-
-    respondChallenge(options) {
-      return base.respondChallenge(options) as Response
-    },
-
-    respondReceipt({ credential, envelope, receipt, response, challengeId, input }) {
-      const verifiedCredential = envelope?.credential ?? credential
-      const verifiedChallengeId = envelope?.challenge.id ?? challengeId
-      const verifiedRequest = envelope?.request ?? verifiedCredential.challenge.request
-      const payload = requireSessionCredentialContext(
-        verifiedCredential.payload,
-        'No SSE context available',
-      )
-      const channelId = payload.channelId
-      const tickCost = BigInt(verifiedCredential.challenge.request.amount as string)
-      const unitType =
-        typeof verifiedRequest.unitType === 'string' ? verifiedRequest.unitType : undefined
-
-      // Auto-detect upstream SSE responses and parse them into an
-      // AsyncIterable so they flow through the metered pipeline.
-      // This lets proxy consumers simply pass `result.withReceipt(upstreamRes)`
-      // and get per-event charging automatically.
-      const resolved =
-        response instanceof Response && Sse_core.isEventStream(response) && response.body
-          ? Sse_core.iterateData(response, { skip: (d) => d === '[DONE]' })
-          : response
-
-      if (isAsyncGeneratorFunction(resolved) || isAsyncIterable(resolved)) {
-        // Pass async generator functions directly so Sse.serve gives them
-        // a SessionController for manual charge(). Pass raw AsyncIterables
-        // as-is so Sse.serve auto-charges per yielded value.
-        const generate = resolveMeteredGenerate(resolved, unitType)
-        const stream = Sse_core.serve({
-          store,
-          channelId,
-          challengeId: verifiedChallengeId,
-          tickCost,
-          pollIntervalMs: pollingInterval,
-          generate,
-          onChargeCommitted: options.settleCharged,
-          prepaidUnits: hasPrepaidSessionTick(receipt as SessionReceipt) ? 1 : 0,
-          signal: input.signal,
-        })
-        return Sse_core.toResponse(stream)
-      }
-
-      const baseResponse = base.respondReceipt({
-        credential: verifiedCredential,
-        envelope,
-        input,
-        receipt,
-        response: response as Response,
-        challengeId: verifiedChallengeId,
-      })
-
-      const request = envelope?.capturedRequest ?? captureRequestBodyProbe(input)
-      if (!shouldChargePlainResponse(request, payload)) {
-        return baseResponse
-      }
-
-      const currentReceipt = receipt as SessionReceipt
-      if (hasPrepaidSessionTick(currentReceipt)) {
-        return baseResponse
-      }
-      const available = BigInt(currentReceipt.acceptedCumulative) - BigInt(currentReceipt.spent)
-      if (available < tickCost) {
-        const error = new Errors.InsufficientBalanceError({
-          reason: `requested ${tickCost}, available ${available}`,
-        })
-        return new Response(
-          JSON.stringify(error.toProblemDetails(verifiedCredential.challenge.id)),
-          {
-            status: error.status,
-            headers: {
-              [Constants.Headers.wwwAuthenticate]: Challenge.serialize(
-                verifiedCredential.challenge,
-              ),
-              'Cache-Control': 'no-store',
-              'Content-Type': 'application/problem+json',
-            },
-          },
-        )
-      }
-
-      const chargedReceipt: SessionReceipt = {
-        ...currentReceipt,
-        spent: (BigInt(currentReceipt.spent) + tickCost).toString(),
-        units: (currentReceipt.units ?? 0) + 1,
-      }
-      const chargedResponse = base.respondReceipt({
-        credential: verifiedCredential,
-        envelope,
-        input,
-        receipt: chargedReceipt,
-        response: response as Response,
-        challengeId: verifiedChallengeId,
-      })
-      const chargePlainResponse = async () => {
-        const result = await ChannelStore.deductFromChannel(store, channelId, tickCost)
-        if (result.ok) await options.settleCharged?.(result.channel)
-        return result
-      }
-
-      // Non-SSE response (e.g. upstream returned JSON instead of event-stream).
-      // Need to deduct tickCost so request isn't free.
-      // For null-body statuses, the request shape determines whether the
-      // response is management (no charge) or plain content (charge one tick).
-      if (isNullBodyStatus(chargedResponse.status)) {
-        void chargePlainResponse()
-        return chargedResponse
-      }
-
-      const stream = new ReadableStream<Uint8Array>({
-        async start(controller) {
-          // deduction completes before consumer reads
-          const result = await chargePlainResponse()
-          if (!result.ok) {
-            controller.error(
-              new Errors.InsufficientBalanceError({
-                reason: `requested ${tickCost}, available ${
-                  result.channel.highestVoucherAmount - result.channel.spent
-                }`,
-              }),
-            )
-            return
-          }
-          if (!chargedResponse.body) {
-            controller.close()
-            return
-          }
-          const reader = chargedResponse.body.getReader()
-          try {
-            while (true) {
-              const { done, value } = await reader.read()
-              if (done) break
-              controller.enqueue(value)
-            }
-          } finally {
-            reader.releaseLock()
-            controller.close()
-          }
-        },
-      })
-      return new Response(stream, {
-        status: chargedResponse.status,
-        statusText: chargedResponse.statusText,
-        headers: chargedResponse.headers,
-      })
-    },
-  })
-}
-
-/** Type helpers for the Tempo SSE transport adapter. */
-export declare namespace sse {
-  type Options = {
-    /**
-     * When true, the charge loop uses polling instead of `waitForUpdate()`.
-     *
-     * Required for runtimes like Cloudflare Workers where resolving promises
-     * across request contexts is not supported. Without this flag, a mid-stream
-     * voucher POST (Request B) would resolve a waiter created in the streaming
-     * request context (Request A), causing a Workers error.
-     *
-     * @default false
-     */
-    poll?: boolean | undefined
-    /** Polling interval (in milliseconds). @default 10 */
-    pollingInterval?: number | undefined
-  }
-}
-
-type DefaultServeGenerate = AsyncIterable<string> | (() => AsyncIterable<string>)
-
-/** Default SSE serve: iterates values and emits `event: message` per value. */
-export function defaultServe(options: {
-  generate: DefaultServeGenerate
-  challengeId: string
-}): Response {
-  const iterable = typeof options.generate === 'function' ? options.generate() : options.generate
-  const encoder = new TextEncoder()
-  const stream = new ReadableStream<Uint8Array>({
-    async start(controller) {
-      try {
-        for await (const value of iterable) {
-          controller.enqueue(encoder.encode(Sse_core.formatMessageEvent(value)))
-        }
-      } catch (e) {
-        controller.error(e)
-      } finally {
-        controller.close()
-      }
-    },
-  })
-  return new Response(stream, {
-    headers: {
-      'Content-Type': 'text/event-stream; charset=utf-8',
-      'Cache-Control': 'no-cache, no-transform',
-      Connection: 'keep-alive',
-    },
-  })
-}
-
-function isAsyncGeneratorFunction(
-  value: unknown,
-): value is (...args: unknown[]) => AsyncIterable<string> {
-  if (typeof value !== 'function') return false
-  return value.constructor?.name === 'AsyncGeneratorFunction'
-}
-
-function isAsyncIterable(value: unknown): value is AsyncIterable<string> {
-  return value !== null && typeof value === 'object' && Symbol.asyncIterator in (value as object)
-}
-
-function resolveMeteredGenerate(
-  value: AsyncIterable<string> | ((...args: unknown[]) => AsyncIterable<string>),
-  unitType: string | undefined,
-): Sse_core.serve.Options['generate'] {
-  if (isAsyncGeneratorFunction(value)) return value as Sse_core.serve.Options['generate']
-  if (unitType !== 'request') return value as AsyncIterable<string>
-
-  const iterable = value as AsyncIterable<string>
-  return async function* chargeOnce(stream) {
-    let charged = false
-    for await (const chunk of iterable) {
-      if (!charged) {
-        await stream.charge()
-        charged = true
-      }
-      yield chunk
-    }
-  }
-}
-
-function isNullBodyStatus(status: number): boolean {
-  return [101, 204, 205, 304].includes(status)
-}

package/src/tempo/session/README.md

@@ -1,320 +0,0 @@
-# Tempo Sessions design
-
-Tempo Sessions implements TIP-1034 payment channels for repeated HTTP and
-streaming payments. A session is a channel, not an application login session.
-
-A payer authorizes a cumulative amount with a signed voucher. The server
-accepts that authorization, records delivered spend, and settles on-chain under
-server-owned policy.
-
-## Design principles
-
-1. A channel has distinct on-chain, server, and client state. No copy replaces
-   another authority.
-2. Vouchers authorize value; server accounting records delivered value; chain
-   settlement captures value. These are separate operations.
-3. The server atomically accepts vouchers and records charges. Multiple server
-   instances share one linearizable channel store.
-4. Client persistence and server snapshots accelerate recovery. Neither is
-   proof of a reusable channel until cryptographic and chain validation pass.
-5. Management credentials never invoke application content handlers.
-6. Settlement policy belongs to the server. A client authorizes value but does
-   not choose when it is settled.
-
-```mermaid
-flowchart LR
-  client["Client"]
-  cache["Client ChannelStore\nrecovery cache"]
-  server["Server session method\nverification and accounting"]
-  ledger["Server AtomicStore\naccepted vouchers and spend"]
-  chain["Tempo escrow precompile\ndeposit, settlement, close state"]
-
-  client <--> cache
-  client -->|"transactions and vouchers"| server
-  client -->|"channel state reads"| chain
-  server <--> ledger
-  server -->|"validates, funds, settles"| chain
-```
-
-## Authority model
-
-| State                              | Meaning                                                                               | Authority                                                                           |
-| ---------------------------------- | ------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
-| Channel descriptor and `channelId` | Immutable payer, payee, token, signer, operator, nonce, and salt identity.            | Derived from descriptor, chain ID, and escrow address. Every boundary validates it. |
-| On-chain channel state             | Deposit, settled amount, and close state.                                             | Tempo escrow precompile.                                                            |
-| Signed voucher                     | Payer authorization of a cumulative amount for one channel.                           | Client signer; server verifies before accepting.                                    |
-| Server channel record              | Highest accepted signed voucher, delivered `spent`, `units`, and settlement progress. | Server `AtomicStore`.                                                               |
-| Client channel entry               | Latest locally usable channel descriptor, deposit, and cumulative authorization.      | Client `ChannelStore`; a cache.                                                     |
-| `SessionSnapshot`                  | Server-provided recovery hint.                                                        | Untrusted until client validation.                                                  |
-
-The amounts below have intentionally different meanings.
-
-| Amount                                        | Meaning                                      | Rule                                                     |
-| --------------------------------------------- | -------------------------------------------- | -------------------------------------------------------- |
-| `acceptedCumulative` / `highestVoucherAmount` | Highest voucher the server accepted.         | Never decreases.                                         |
-| `spent`                                       | Value charged for content.                   | Never decreases; does not exceed accepted authorization. |
-| `settled` / `settledOnChain`                  | Value captured by escrow.                    | Never decreases; chain-authoritative.                    |
-| `requiredCumulative`                          | Authorization required for the next request. | It is a boundary, not a signed voucher.                  |
-
-## Request lifecycle
-
-The session method owns payment control flow. The route handler owns content.
-
-```mermaid
-sequenceDiagram
-  participant C as Client
-  participant S as Server session
-  participant L as AtomicStore
-  participant T as Tempo chain
-  participant H as Route handler
-
-  C->>S: protected request
-  S-->>C: 402 session challenge
-  C->>S: open or voucher credential
-  S->>T: validate channel state; broadcast management transaction when needed
-  S->>L: atomically accept voucher and record channel state
-  S->>L: charge billable HTTP content
-  S->>H: invoke only for a content credential
-  H-->>C: response with Payment-Receipt
-```
-
-`open` and `voucher` credentials may pay for a billable request. `topUp` and
-`close` are management credentials: they return `204` and never invoke the
-route handler. `open` and `voucher` used on non-billable requests are also
-management updates.
-
-When `Fetch.from` creates an automatic `open`, it keeps the channel entry
-provisional until the server accepts the response or acknowledges the open with
-a matching receipt or session snapshot. Rejected or unacknowledged opens are
-discarded so the next request retries `open`; concurrent automatic opens for the
-same payment scope are serialized. Direct credential creation and
-`SessionManager` retain their existing lifecycle ownership.
-
-The current HTTP contract is deliberately pre-handler: voucher acceptance and
-default request charging occur before the handler runs. A handler failure can
-therefore follow an accepted voucher and recorded `spent`. Sessions does not
-promise an atomic “charge only after a successful handler” transaction.
-
-Applications with irreversible work define their own idempotency and failure
-behavior. SDK changes must preserve this boundary or introduce an explicit
-prepare/commit contract rather than changing it implicitly.
-
-## Recovery lifecycle
-
-The application owns durable mapping from its authenticated request identity to
-a channel ID. The SDK owns channel lookup, snapshot construction, and recovery
-validation.
-
-`resolveChannelId` is the only application-defined recovery boundary. It maps a
-verified request identity to an existing channel ID. It does not authorize a
-channel, recreate accounting, or trust a client-provided channel ID.
-
-### Bootstrap configuration
-
-Enable `bootstrap` when a client should recover an existing channel before its
-first paid request:
-
-```ts
-tempo.session({
-  bootstrap: true,
-  resolveChannelId({ source, paymentRequest }) {
-    return db.findChannelId({
-      payer: parseSource(source),
-      payee: paymentRequest.recipient,
-      token: paymentRequest.currency,
-      // Include chain and escrow when the application supports more than one.
-    })
-  },
-})
-```
-
-The hook resolves application identity and payment scope. The channel store
-loads the returned primary key only; MPPx does not scan the store or define a
-secondary-index format. If the request supplies a channel ID, MPPx uses it and
-does not call the hook.
-
-```mermaid
-sequenceDiagram
-  participant C as Cold client
-  participant S as Server session
-  participant R as resolveChannelId
-  participant L as AtomicStore
-  participant T as Tempo chain
-
-  C->>S: HEAD protected resource
-  S-->>C: 402 zero-amount identity challenge
-  C->>S: HEAD with signed proof
-  S->>S: verify proof and recover source
-  S->>R: resolve source and payment scope to channelId
-  R-->>S: channelId or no result
-  S->>L: load compatible channel record
-  S->>S: validate chain, token, escrow, payee, and signed voucher
-  S-->>C: 204 with session snapshot when available
-  C->>T: read live channel state
-  C->>C: validate descriptor, signer, voucher, and state
-  C->>C: hydrate Client ChannelStore
-```
-
-A snapshot is never authorization. Before caching it, the client validates the
-descriptor-derived ID, payer, authorized signer, signed voucher when present,
-and live on-chain state. A snapshot that lacks a usable signed voucher cannot
-create higher client authorization; the client reuses persisted state or opens
-a channel instead.
-
-## Streaming lifecycle
-
-SSE and WebSocket are stream-metered. They do not reuse normal HTTP response
-accounting. The server emits a voucher boundary as content is consumed; the
-client submits the next signed cumulative voucher; the server accepts it and
-emits a receipt before content continues.
-
-```mermaid
-sequenceDiagram
-  participant S as Metered server stream
-  participant C as Client transport driver
-  participant L as AtomicStore
-
-  S->>C: content
-  S->>C: need-voucher(requiredCumulative)
-  C->>C: enforce max deposit; top up when required
-  C->>S: signed voucher
-  S->>L: atomically accept voucher
-  S->>C: receipt
-  S->>C: continue content
-```
-
-The initial SSE POST is excluded from default HTTP charging to prevent double
-counting. Stream accounting remains owned by the transport driver.
-
-## Server transport configuration
-
-A session method owns the account, channel store, verification policy, and
-settlement schedule. Routes add prices and application content. HTTP and SSE
-run through configured route handlers; WebSocket uses a session-bound helper
-because its application messages no longer pass through HTTP.
-
-| Server shape           | Session option | Content API                         | Charging                            |
-| ---------------------- | -------------- | ----------------------------------- | ----------------------------------- |
-| HTTP only              | Omit `sse`     | `result.withReceipt(Response)`      | Once per billable request           |
-| SSE only               | `sse: true`    | `result.withReceipt(AsyncIterable)` | Each `stream.charge()`              |
-| WebSocket only         | Omit `sse`     | `mppx.session.serveWebSocket(...)`  | Each `stream.charge()`              |
-| HTTP + SSE + WebSocket | `sse: true`    | All three APIs                      | Selected by route and response type |
-
-All transports for one session service must share the same configured session
-method and store. `serveWebSocket` is bound to both the store and settlement
-policy, so callers pass neither dependency again. `tempo.Ws.serve` remains the
-low-level adapter for custom integrations.
-
-### Shared method configuration
-
-```ts
-const session = tempo.session({
-  account,
-  currency,
-  getClient: () => client,
-  settlementSchedule: { units: 100 },
-  store,
-  // Include when this instance serves any SSE route.
-  sse: true,
-})
-
-const mppx = Mppx.create({ methods: [session], secretKey })
-```
-
-`sse: true` enables async-iterable responses without changing ordinary
-`Response` handling, so a mixed server uses one session method.
-
-### HTTP
-
-```ts
-const httpRoute = mppx.session({ amount: '0.01', unitType: 'request' })
-const result = await httpRoute(request)
-
-if (result.status === 402) return result.challenge
-return result.withReceipt(Response.json({ ok: true }))
-```
-
-HTTP accounting charges the configured route amount before application content
-runs. A plain `Response` selects normal HTTP handling even when `sse: true`.
-
-### SSE
-
-```ts
-const sseRoute = mppx.session({ amount: '0.001', unitType: 'token' })
-const result = await sseRoute(request)
-
-if (result.status === 402) return result.challenge
-return result.withReceipt(async function* (stream) {
-  for await (const token of generateTokens()) {
-    await stream.charge()
-    yield token
-  }
-})
-```
-
-SSE requires `sse: true` on the shared session method. The async iterable
-selects SSE framing and transport-owned metering.
-
-### WebSocket
-
-```ts
-const wsRoute = mppx.session({ amount: '0.001', unitType: 'token' })
-
-webSocketServer.on('connection', (socket, request) => {
-  void mppx.session.serveWebSocket({
-    generate: async function* (stream) {
-      for await (const token of generateTokens()) {
-        await stream.charge()
-        yield token
-      }
-    },
-    route: wsRoute,
-    socket,
-    url: new URL(request.url!, `ws://${request.headers.host}`),
-  })
-})
-```
-
-The application still exposes `wsRoute` over HTTP for the initial challenge
-probe. The bound helper reuses the session store and automatic settlement
-schedule for in-band WebSocket vouchers and charges.
-
-### Mixed server
-
-```ts
-const httpRoute = mppx.session({ amount: '0.01', unitType: 'request' })
-const sseRoute = mppx.session({ amount: '0.001', unitType: 'token' })
-const wsRoute = mppx.session({ amount: '0.001', unitType: 'token' })
-
-async function handler(request: Request) {
-  const pathname = new URL(request.url).pathname
-  if (pathname === '/api/data') return serveHttp(httpRoute, request)
-  if (pathname === '/api/events') return serveSse(sseRoute, request)
-  if (pathname === '/ws') return serveWebSocketProbe(wsRoute, request)
-  return new Response('Not found', { status: 404 })
-}
-```
-
-Each route can choose its own price and unit type. Verification, channel state,
-and settlement policy remain shared through the single session method.
-
-## Extension boundaries
-
-| Change                         | Preserve                                                                                        |
-| ------------------------------ | ----------------------------------------------------------------------------------------------- |
-| Credential action or payload   | Descriptor validation, source binding, action gate, receipt semantics, and atomic store update. |
-| Voucher or accounting rule     | Monotonic accepted/spent/settled values and linearizable updates.                               |
-| Client planning or persistence | Channel scope key, recovery validation, max-deposit enforcement, and manual context behavior.   |
-| Bootstrap or snapshot          | `resolveChannelId` ownership and client-side validation before cache hydration.                 |
-| SSE or WebSocket transport     | Transport-owned metering and receipt coordination; no HTTP double charge.                       |
-
-The module boundaries implement these contracts:
-
-| Module                                                          | Responsibility                                                                |
-| --------------------------------------------------------------- | ----------------------------------------------------------------------------- |
-| `precompile/`                                                   | Channel identity, chain calls, vouchers, and wire primitives.                 |
-| `client/CredentialState.ts` and `client/ChannelOps.ts`          | Credential planning, recovery validation, and client cache updates.           |
-| `server/CredentialVerification.ts` and `server/ChannelStore.ts` | Credential verification and authoritative atomic channel state.               |
-| `server/Settlement.ts`                                          | Content accounting and server-owned settlement cadence.                       |
-| `server/RequestState.ts`                                        | Challenge context, bootstrap identity lookup, snapshots, and response gating. |
-| `client/Transports.ts` and `server/Transports.ts`               | SSE and WebSocket payment control messages.                                   |

package/src/tempo/session/Snapshot.test.ts

@@ -1,41 +0,0 @@
-import { Base64 } from 'ox'
-import { describe, expect, test } from 'vp/test'
-
-import { deserializeSnapshot, serializeSnapshot, type SessionSnapshot } from './Snapshot.js'
-
-const descriptor = {
-  authorizedSigner: '0x0000000000000000000000000000000000000001',
-  expiringNonceHash: `0x${'11'.repeat(32)}`,
-  operator: '0x0000000000000000000000000000000000000000',
-  payee: '0x0000000000000000000000000000000000000002',
-  payer: '0x0000000000000000000000000000000000000003',
-  salt: `0x${'22'.repeat(32)}`,
-  token: '0x20c0000000000000000000000000000000000001',
-} as const
-
-const snapshot = {
-  acceptedCumulative: '100',
-  chainId: 4217,
-  channelId: `0x${'aa'.repeat(32)}`,
-  deposit: '1000',
-  descriptor,
-  escrow: '0x4d50500000000000000000000000000000000000',
-  requiredCumulative: '100',
-  settled: '0',
-  spent: '50',
-  units: 5,
-} satisfies SessionSnapshot
-
-describe('SessionSnapshot', () => {
-  test('round-trips a valid snapshot header', () => {
-    expect(deserializeSnapshot(serializeSnapshot(snapshot))).toEqual(snapshot)
-  })
-
-  test('rejects malformed channel descriptors', () => {
-    const value = serializeSnapshot(snapshot)
-    const encoded = JSON.parse(Base64.toString(value)) as SessionSnapshot
-    encoded.descriptor = { ...descriptor, payee: 'not-an-address' as never }
-
-    expect(() => deserializeSnapshot(Base64.fromString(JSON.stringify(encoded)))).toThrow()
-  })
-})