mppx 0.8.17 → 0.8.18

package/src/viem/Client.test.ts

@@ -1,366 +0,0 @@
-import { createClient, custom, defineChain, type Hex } from 'viem'
-import { privateKeyToAccount } from 'viem/accounts'
-import { signTransaction } from 'viem/actions'
-import { Account as TempoAccount, Transaction } from 'viem/tempo'
-import { tempo as tempoMainnetChain, tempoLocalnet, tempoModerato } from 'viem/tempo/chains'
-import { afterEach, describe, expect, test, vi } from 'vp/test'
-
-import * as Client from './Client.js'
-
-const rpcUrl = { 42: 'https://rpc.example.com', 99: 'https://rpc2.example.com' } as const
-
-afterEach(() => {
-  vi.unstubAllGlobals()
-})
-
-describe('getResolver', () => {
-  test('behavior: creates client from rpcUrl for given chainId', async () => {
-    const getClient = Client.getResolver({
-      rpcUrl,
-    })
-
-    const client = await getClient({ chainId: 42 })
-
-    expect(client).toBeDefined()
-    expect(client.chain?.id).toBe(42)
-  })
-
-  test('behavior: falls back to first rpcUrl key when chainId is 0', async () => {
-    const getClient = Client.getResolver({
-      rpcUrl,
-    })
-
-    const client = await getClient({})
-
-    expect(client.chain?.id).toBe(42)
-  })
-
-  test('behavior: spreads chain into created client', async () => {
-    const chain = { id: 1, name: 'test' }
-    const getClient = Client.getResolver({
-      chain: chain as never,
-      rpcUrl,
-    })
-
-    const client = await getClient({ chainId: 99 })
-
-    expect(client.chain?.id).toBe(99)
-    expect(client.chain?.name).toBe('test')
-  })
-
-  test('behavior: resolves the correct named Tempo chain even when the default chain differs', async () => {
-    const getClient = Client.getResolver({
-      // Default chain is mainnet, but the resolved chain ID below is testnet.
-      chain: tempoMainnetChain as never,
-      rpcUrl: {
-        [tempoMainnetChain.id]: 'https://rpc.example.com',
-        [tempoModerato.id]: 'https://rpc2.example.com',
-      },
-    })
-
-    const client = await getClient({ chainId: tempoModerato.id })
-
-    expect(client.chain?.id).toBe(tempoModerato.id)
-    expect(client.chain?.name).toBe(tempoModerato.name)
-    expect(client.chain?.name).not.toBe(tempoMainnetChain.name)
-  })
-
-  test('error: throws when no rpcUrl provided', () => {
-    const getClient = Client.getResolver({})
-
-    expect(() => getClient({ chainId: 1 })).toThrowErrorMatchingInlineSnapshot(
-      `[Error: No \`rpcUrl\` provided.]`,
-    )
-  })
-
-  test('error: throws when chainId not found in rpcUrl', () => {
-    const getClient = Client.getResolver({
-      rpcUrl: { 42: 'https://example.com' },
-    })
-
-    expect(() => getClient({ chainId: 99 })).toThrowErrorMatchingInlineSnapshot(
-      `[Error: No \`rpcUrl\` configured for \`chainId\` (99).]`,
-    )
-  })
-
-  test('behavior: wraps custom client transports with a hosted fee payer', async () => {
-    const defaultRequests: string[] = []
-    const client = createClient({
-      chain: tempoLocalnet,
-      transport: custom({
-        async request({ method }) {
-          defaultRequests.push(method)
-          return { source: 'default' }
-        },
-      }),
-    })
-    const fetchMock = vi.fn(async (_input: RequestInfo | URL, init?: RequestInit) => {
-      const request = JSON.parse(String(init?.body)) as { id: number; jsonrpc: string }
-      return Response.json({
-        id: request.id,
-        jsonrpc: request.jsonrpc,
-        result: { source: 'relay' },
-      })
-    })
-    vi.stubGlobal('fetch', fetchMock)
-
-    const getClient = Client.getResolver({
-      chain: tempoLocalnet,
-      feePayerUrl: 'https://sponsor.example',
-      getClient: () => client,
-      rpcUrl: { [tempoLocalnet.id]: 'https://rpc.example.com' },
-    })
-    const resolved = await getClient({ chainId: tempoLocalnet.id })
-    const result = await resolved.request({
-      method: 'eth_fillTransaction',
-      params: [{ feePayer: true }],
-    } as never)
-
-    expect(result).toEqual({ source: 'relay' })
-    expect(fetchMock).toHaveBeenCalledOnce()
-    expect(String(fetchMock.mock.calls[0]?.[0])).toBe('https://sponsor.example/')
-    expect(defaultRequests).toEqual([])
-  })
-})
-
-// ---------------------------------------------------------------------------
-// Serializer injection – ensures user-provided clients without Tempo chain
-// config get Tempo serializers merged in by getResolver.
-// ---------------------------------------------------------------------------
-
-const testAccount = privateKeyToAccount(
-  '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80',
-)
-
-const chainIdHex = `0x${tempoLocalnet.id.toString(16)}`
-const mockTransport = custom({
-  async request({ method }: { method: string }) {
-    if (method === 'eth_chainId') return chainIdHex
-    throw new Error(`Unexpected RPC call: ${method}`)
-  },
-})
-
-const tempoClient = createClient({
-  account: testAccount,
-  chain: tempoLocalnet,
-  transport: mockTransport,
-})
-
-function createPlainClient() {
-  const plainChain = defineChain({
-    id: tempoLocalnet.id,
-    name: 'Tempo (no serializer)',
-    nativeCurrency: { name: 'ETH', symbol: 'ETH', decimals: 18 },
-    rpcUrls: { default: { http: ['http://127.0.0.1:1'] } },
-  })
-  return createClient({
-    account: testAccount,
-    chain: plainChain,
-    transport: mockTransport,
-  })
-}
-
-const feePayer_prepared = {
-  chainId: tempoLocalnet.id,
-  calls: [
-    {
-      to: '0x20c0000000000000000000000000000000000001' as const,
-      data: '0x1234' as Hex,
-    },
-  ],
-  feePayer: true as const,
-  feeToken: '0x20c0000000000000000000000000000000000001' as const,
-  gas: 100_000n,
-  maxFeePerGas: 1_000_000_000n,
-  maxPriorityFeePerGas: 1_000_000n,
-  nonce: 0,
-  nonceKey: 115792089237316195423570985008687907853269984665640564039457584007913129639935n,
-  validBefore: Math.floor(Date.now() / 1000) + 25,
-}
-
-describe('feePayer transaction serialization', () => {
-  test('behavior: signTransaction with Tempo chain and feePayer: true', async () => {
-    const serialized = await signTransaction(tempoClient, {
-      account: testAccount,
-      ...feePayer_prepared,
-    } as never)
-    expect(serialized).toMatch(/^0x7[68]/)
-  })
-
-  test('behavior: signTransaction with gasPrice + type legacy', async () => {
-    const serialized = await signTransaction(tempoClient, {
-      account: testAccount,
-      ...feePayer_prepared,
-      gasPrice: 1_000_000_000n,
-      type: 'legacy' as const,
-    } as never)
-    expect(serialized).toMatch(/^0x7[68]/)
-  })
-
-  test('behavior: fee-payer co-sign with Account object', async () => {
-    const feePayerAccount = privateKeyToAccount(
-      '0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d',
-    )
-    const serialized = await signTransaction(tempoClient, {
-      account: feePayerAccount,
-      ...feePayer_prepared,
-      feePayer: feePayerAccount,
-    } as never)
-    expect(serialized).toMatch(/^0x7[68]/)
-  })
-
-  test('behavior: deserialized + re-signed tx (server charge flow)', async () => {
-    const feePayerAccount = privateKeyToAccount(
-      '0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d',
-    )
-    const clientSigned = await signTransaction(tempoClient, {
-      account: testAccount,
-      ...feePayer_prepared,
-    } as never)
-    const deserialized = Transaction.deserialize(
-      clientSigned as Transaction.TransactionSerializedTempo,
-    )
-    const serverSigned = await signTransaction(tempoClient, {
-      ...deserialized,
-      account: feePayerAccount,
-      feePayer: feePayerAccount,
-      feeToken: '0x20c0000000000000000000000000000000000001' as const,
-    } as never)
-    expect(serverSigned).toMatch(/^0x7[68]/)
-  })
-
-  test('behavior: deserialized + re-signed tx preserves keyAuthorization', async () => {
-    const rootAccount = TempoAccount.fromSecp256k1(
-      '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80',
-    )
-    const accessKey = TempoAccount.fromSecp256k1(
-      '0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d',
-      { access: rootAccount },
-    )
-    const feePayerAccount = privateKeyToAccount(
-      '0x5de4111afa1a4b94908f83103f52c5de640f0e4f465f975fa6d6640d3c5e3b48',
-    )
-    const accessKeyClient = createClient({
-      account: accessKey,
-      chain: tempoLocalnet,
-      transport: mockTransport,
-    })
-
-    const keyAuthorization = await rootAccount.signKeyAuthorization(
-      {
-        accessKeyAddress: accessKey.accessKeyAddress,
-        keyType: accessKey.keyType,
-      },
-      {
-        chainId: BigInt(tempoLocalnet.id),
-      },
-    )
-
-    const clientSigned = await signTransaction(accessKeyClient, {
-      account: accessKey,
-      ...feePayer_prepared,
-      keyAuthorization,
-    } as never)
-    const deserialized = Transaction.deserialize(
-      clientSigned as Transaction.TransactionSerializedTempo,
-    )
-
-    expect(deserialized.keyAuthorization).toEqual(keyAuthorization)
-
-    const serverSigned = await signTransaction(tempoClient, {
-      ...deserialized,
-      account: feePayerAccount,
-      feePayer: feePayerAccount,
-      feeToken: '0x20c0000000000000000000000000000000000001' as const,
-    } as never)
-    const serverDeserialized = Transaction.deserialize(
-      serverSigned as Transaction.TransactionSerializedTempo,
-    )
-
-    expect(serverDeserialized.keyAuthorization).toEqual(keyAuthorization)
-  })
-})
-
-describe('getResolver serializer injection', () => {
-  test('behavior: injects Tempo serializer onto plain clients', async () => {
-    const plainClient = createPlainClient()
-    expect(plainClient.chain?.serializers?.transaction).toBeUndefined()
-
-    const resolver = Client.getResolver({
-      chain: tempoLocalnet,
-      getClient: () => plainClient,
-    })
-    const resolvedClient = await resolver({})
-
-    expect(resolvedClient.chain?.serializers?.transaction).toBeDefined()
-    const serialized = await signTransaction(resolvedClient, {
-      account: testAccount,
-      ...feePayer_prepared,
-    } as never)
-    expect(serialized).toMatch(/^0x7[68]/)
-  })
-
-  test('behavior: fixes legacy type + feePayer + maxFeePerGas', async () => {
-    const resolver = Client.getResolver({
-      chain: tempoLocalnet,
-      getClient: () => createPlainClient(),
-    })
-    const resolvedClient = await resolver({})
-
-    const serialized = await signTransaction(resolvedClient, {
-      account: testAccount,
-      ...feePayer_prepared,
-      type: 'legacy' as const,
-    } as never)
-    expect(serialized).toMatch(/^0x7[68]/)
-  })
-
-  test('behavior: preserves existing serializers', async () => {
-    const resolver = Client.getResolver({
-      chain: tempoLocalnet,
-      getClient: () => tempoClient,
-    })
-    const resolvedClient = await resolver({})
-
-    expect(resolvedClient.chain?.serializers?.transaction).toBe(
-      tempoClient.chain?.serializers?.transaction,
-    )
-  })
-
-  test('behavior: passes through getClient when chain has no serializers', async () => {
-    const getClient = () => createPlainClient()
-    const resolver = Client.getResolver({
-      chain: undefined,
-      getClient,
-    })
-
-    expect(resolver).toBe(getClient)
-  })
-
-  test('behavior: does not mutate the original client', async () => {
-    const plainClient = createPlainClient()
-    const originalChain = plainClient.chain
-
-    const resolver = Client.getResolver({
-      chain: tempoLocalnet,
-      getClient: () => plainClient,
-    })
-    const resolvedClient = await resolver({})
-
-    expect(plainClient.chain).toBe(originalChain)
-    expect(resolvedClient).not.toBe(plainClient)
-    expect(resolvedClient.chain?.serializers?.transaction).toBeDefined()
-  })
-
-  test('error: plain client without resolver throws on feePayer tx', async () => {
-    const plainClient = createPlainClient()
-
-    await expect(
-      signTransaction(plainClient, {
-        account: testAccount,
-        ...feePayer_prepared,
-        type: 'legacy' as const,
-      } as never),
-    ).rejects.toThrow()
-  })
-})

package/src/viem/Client.ts

@@ -1,93 +0,0 @@
-import { type Chain, type Client, createClient, createTransport, custom, http } from 'viem'
-import { withFeePayer } from 'viem/tempo'
-import { tempo as tempoMainnetChain, tempoModerato } from 'viem/tempo/chains'
-
-import type { MaybePromise } from '../internal/types.js'
-
-const knownTempoChains: Record<number, Chain> = {
-  [tempoMainnetChain.id]: tempoMainnetChain,
-  [tempoModerato.id]: tempoModerato,
-}
-
-export function getResolver(
-  parameters: getResolver.Parameters & {
-    /** Default chain to use if not provided. */
-    chain?: Chain | undefined
-    /** Fee payer relay URL. When set, the transport is wrapped with `withFeePayer`. */
-    feePayerUrl?: string | undefined
-    /** RPC URLs keyed by chain ID. */
-    rpcUrl?: ({ [chainId: number]: string } & object) | undefined
-  },
-): (parameters: { chainId?: number | undefined }) => MaybePromise<Client> {
-  const { chain, feePayerUrl, getClient, rpcUrl } = parameters
-
-  if (getClient) {
-    // When a default chain with serializers is provided (e.g. Tempo chain config),
-    // ensure user-provided clients inherit those serializers. Without this, clients
-    // created without the Tempo chain config will use the default viem serializer,
-    // causing errors like "maxFeePerGas is not a valid Legacy Transaction attribute".
-    if (!chain?.serializers && !feePayerUrl) return getClient
-    return async (params) => {
-      const client = await getClient(params)
-      let resolvedClient = client
-
-      // Wrap the client's transport with `withFeePayer` when a fee payer URL is provided.
-      if (feePayerUrl && client.transport.key !== 'feePayer') {
-        const request = client.request.bind(client)
-        // The supplied client already owns retries. Keep the relay middleware retry-free so
-        // failures are not retried once per nested transport layer.
-        const feePayerTransport = withFeePayer(
-          custom({ request: (args) => request(args as never) }, { retryCount: 0 }),
-          http(feePayerUrl, { retryCount: client.transport.retryCount }),
-        )({
-          account: client.account,
-          chain: client.chain,
-          pollingInterval: client.pollingInterval,
-          retryCount: 0,
-        })
-        const wrapped = createTransport(
-          { ...feePayerTransport.config, retryCount: 0 },
-          feePayerTransport.value,
-        )
-        resolvedClient = Object.assign({}, client, {
-          request: wrapped.request,
-          transport: { ...wrapped.config, ...wrapped.value },
-        })
-      }
-
-      if (!chain?.serializers || resolvedClient.chain?.serializers?.transaction)
-        return resolvedClient
-      return Object.assign({}, resolvedClient, {
-        chain: {
-          ...chain,
-          ...resolvedClient.chain,
-          formatters: resolvedClient.chain?.formatters ?? chain.formatters,
-          prepareTransactionRequest:
-            resolvedClient.chain?.prepareTransactionRequest ?? chain.prepareTransactionRequest,
-          serializers: resolvedClient.chain?.serializers?.transaction
-            ? resolvedClient.chain.serializers
-            : chain.serializers,
-        } as typeof resolvedClient.chain,
-      })
-    }
-  }
-
-  return ({ chainId }: { chainId?: number | undefined }) => {
-    if (!rpcUrl) throw new Error('No `rpcUrl` provided.')
-    const resolvedChainId = chainId || Number(Object.keys(rpcUrl)[0])!
-    const url = rpcUrl[resolvedChainId as keyof typeof rpcUrl]
-    if (!url) throw new Error(`No \`rpcUrl\` configured for \`chainId\` (${resolvedChainId}).`)
-    const transport = feePayerUrl ? withFeePayer(http(url), http(feePayerUrl)) : http(url)
-    return createClient({
-      chain: (knownTempoChains[resolvedChainId] ?? { ...chain, id: resolvedChainId }) as never,
-      transport,
-    })
-  }
-}
-
-export declare namespace getResolver {
-  type Parameters = {
-    /** Function that returns a client for the given chain ID. */
-    getClient?: ((parameters: { chainId?: number | undefined }) => MaybePromise<Client>) | undefined
-  }
-}

package/src/web-bot-auth/Constants.ts

@@ -1,24 +0,0 @@
-import { Constants as HttpMessageSignature } from '../attestation/internal/HttpMessageSignature.js'
-
-/** Web Bot Auth values for the supported HTTPS-directory signature profile. */
-export const Constants = {
-  /** Stable identifier for Web Bot Auth signers and replay storage. */
-  protocol: 'web-bot-auth',
-  /** Web Bot Auth discovery type supported by this adapter. */
-  discoveryType: 'directory',
-  /** RFC 9421 signature label used when no label is configured. */
-  label: 'webbot',
-  /** Tag identifying a Web Bot Auth request signature. */
-  tag: 'web-bot-auth',
-  /** Structured HTTP header linking a bot signature to its HTTPS directory origin. */
-  signatureAgentHeader: 'Signature-Agent',
-  /** Default lifetime, in seconds, for a bot request signature. */
-  defaultSignatureLifetime: 60,
-  /** Default verifier limit, following the draft's recommended 24-hour maximum. */
-  defaultMaximumSignatureLifetime: 24 * 60 * 60,
-  /** HTTP components required by this directory profile. */
-  requiredComponents: [
-    HttpMessageSignature.components.authority,
-    HttpMessageSignature.components.signatureAgent,
-  ],
-} as const

package/src/web-bot-auth/Types.ts

@@ -1,9 +0,0 @@
-/** Verified Web Bot Auth HTTPS-directory profile request signature. */
-export type VerifiedRequest = {
-  /** Public-key thumbprint advertised by the bot. */
-  keyId: string
-  /** HTTPS directory origin carried in the signed `Signature-Agent` header. */
-  signatureAgent: string
-  /** Signature nonce supplied by the bot. */
-  nonce: string
-}

package/src/web-bot-auth/WebBotAuth.test.ts

@@ -1,182 +0,0 @@
-import * as Attestation from 'mppx/attestation'
-import * as WebBotAuth from 'mppx/attestation/web-bot-auth'
-import { expect, test } from 'vp/test'
-import { jwkThumbprint, keyPair, rsaKeyPair } from '~test/Attestation.js'
-
-import * as HttpMessageSignature from '../attestation/internal/HttpMessageSignature.js'
-
-test('emits and verifies a signed Signature-Agent member', async () => {
-  const keys = await keyPair()
-  const keyId = await jwkThumbprint(keys.publicKey)
-  const signatureAgent = 'https://agent.example'
-  const signed = await WebBotAuth.Client.signer({
-    expiresIn: WebBotAuth.Constants.defaultSignatureLifetime + 1,
-    key: keys.privateKey,
-    keyId,
-    signatureAgent: `${signatureAgent}/`,
-  }).sign(new Request('https://merchant.example/resource'))
-
-  expect(signed.headers.get(WebBotAuth.Constants.signatureAgentHeader)).toBe(
-    `${WebBotAuth.Constants.label}="${signatureAgent}"`,
-  )
-  expect(signed.headers.get(Attestation.Headers.signatureInput)).toContain(
-    `"signature-agent";key="${WebBotAuth.Constants.label}"`,
-  )
-  expect(
-    await WebBotAuth.Server.verifier({
-      keyResolver: () => keys.publicKey,
-      maxAge: WebBotAuth.Constants.defaultSignatureLifetime,
-      nonceStore: Attestation.Store.memory(),
-    }).verify(signed),
-  ).toMatchObject({ status: 'invalid' })
-  expect(
-    await WebBotAuth.Server.verifier({
-      keyResolver: () => keys.publicKey,
-      nonceStore: Attestation.Store.memory(),
-    }).verify(signed),
-  ).toMatchObject({
-    status: 'verified',
-    value: { keyId, signatureAgent },
-  })
-})
-
-test('signs and verifies RSA-PSS SHA-512', async () => {
-  const keys = await rsaKeyPair()
-  const keyId = await jwkThumbprint(keys.publicKey)
-  const algorithms: Attestation.SignatureAlgorithm[] = []
-  const signed = await WebBotAuth.Client.signer({
-    key: keys.privateKey,
-    keyId,
-    signatureAgent: 'https://agent.example',
-  }).sign(new Request('https://merchant.example/resource'))
-  const result = await WebBotAuth.Server.verifier({
-    keyResolver({ algorithm, keyId: candidate }) {
-      algorithms.push(algorithm)
-      return candidate === keyId ? keys.publicKey : undefined
-    },
-    nonceStore: Attestation.Store.memory(),
-  }).verify(signed)
-
-  expect(signed.headers.get(Attestation.Headers.signatureInput)).toContain(
-    `alg="${Attestation.Algorithms.rsaPssSha512}"`,
-  )
-  expect(algorithms).toEqual([Attestation.Algorithms.rsaPssSha512])
-  expect(result).toMatchObject({ status: 'verified' })
-})
-
-test('preserves directory lookup failures as unverified outcomes', async () => {
-  const keys = await keyPair()
-  const keyId = await jwkThumbprint(keys.publicKey)
-  const signed = await WebBotAuth.Client.signer({
-    key: keys.privateKey,
-    keyId,
-    signatureAgent: 'https://agent.example',
-  }).sign(new Request('https://merchant.example/resource'))
-
-  expect(
-    await WebBotAuth.Server.verifier({
-      keyResolver: () => undefined,
-      nonceStore: Attestation.Store.memory(),
-    }).verify(signed),
-  ).toEqual({
-    reason: 'No public key is available for the signature key ID.',
-    status: 'unverified',
-  })
-  expect(
-    await WebBotAuth.Server.verifier({
-      keyResolver() {
-        throw new Error('directory unavailable')
-      },
-      nonceStore: Attestation.Store.memory(),
-    }).verify(signed),
-  ).toEqual({
-    reason: 'The public key could not be resolved.',
-    status: 'unverified',
-  })
-})
-
-test('rejects mismatched keys, non-directory discovery, and header tampering', async () => {
-  const advertisedKeys = await keyPair()
-  const signingKeys = await keyPair()
-  const advertisedKeyId = await jwkThumbprint(advertisedKeys.publicKey)
-  const signatureAgent = 'https://agent.example'
-  const signed = await WebBotAuth.Client.signer({
-    key: signingKeys.privateKey,
-    keyId: advertisedKeyId,
-    signatureAgent,
-  }).sign(new Request('https://merchant.example/resource'))
-  const verifier = WebBotAuth.Server.verifier({
-    keyResolver: () => signingKeys.publicKey,
-    nonceStore: Attestation.Store.memory(),
-  })
-
-  expect(await verifier.verify(signed)).toMatchObject({ status: 'invalid' })
-
-  const alteredHeaders = new Headers(signed.headers)
-  alteredHeaders.set(
-    WebBotAuth.Constants.signatureAgentHeader,
-    `${WebBotAuth.Constants.label}="https://attacker.example"`,
-  )
-  expect(
-    await WebBotAuth.Server.verifier({
-      keyResolver: () => signingKeys.publicKey,
-      nonceStore: Attestation.Store.memory(),
-    }).verify(new Request(signed, { headers: alteredHeaders })),
-  ).toMatchObject({ status: 'invalid' })
-
-  const discoveryHeaders = new Headers({
-    [WebBotAuth.Constants.signatureAgentHeader]:
-      'webbot="https://agent.example/keys";type=jwks_uri',
-  })
-  const unsupportedDiscovery = await HttpMessageSignature.sign(
-    new Request('https://merchant.example/resource', { headers: discoveryHeaders }),
-    {
-      components: [
-        HttpMessageSignature.Constants.components.authority,
-        {
-          id: HttpMessageSignature.Constants.components.signatureAgent,
-          parameters: new Map([['key', WebBotAuth.Constants.label]]),
-        },
-      ],
-      key: advertisedKeys.privateKey,
-      keyId: advertisedKeyId,
-      label: WebBotAuth.Constants.label,
-      tag: WebBotAuth.Constants.tag,
-    },
-  )
-  expect(
-    await WebBotAuth.Server.verifier({
-      keyResolver: () => advertisedKeys.publicKey,
-      nonceStore: Attestation.Store.memory(),
-    }).verify(unsupportedDiscovery),
-  ).toMatchObject({
-    reason: 'The Signature-Agent discovery type is not supported by this directory profile.',
-    status: 'invalid',
-  })
-})
-
-test('validates signer and verifier configuration', async () => {
-  const keys = await keyPair()
-  const keyId = await jwkThumbprint(keys.publicKey)
-  const config = { key: keys.privateKey, keyId, signatureAgent: 'https://agent.example' }
-
-  expect(() => WebBotAuth.Client.signer({ ...config, keyId: 'not-a-thumbprint' })).toThrow(
-    'Web Bot Auth keyId must be an RFC 7638 SHA-256 JWK thumbprint.',
-  )
-  expect(() => WebBotAuth.Client.signer({ ...config, signatureAgent: 'https://' })).toThrow(
-    'Signature-Agent must identify a valid HTTPS origin.',
-  )
-  expect(() =>
-    WebBotAuth.Client.signer({ ...config, signatureAgent: 'https://agent.example/keys' }),
-  ).toThrow('Signature-Agent must identify a valid HTTPS origin.')
-  expect(() => WebBotAuth.Client.signer({ ...config, expiresIn: 0 })).toThrow(
-    'Web Bot Auth expiresIn must be a positive integer.',
-  )
-  expect(() =>
-    WebBotAuth.Server.verifier({
-      keyResolver: () => keys.publicKey,
-      maxAge: 0,
-      nonceStore: Attestation.Store.memory(),
-    }),
-  ).toThrow('Web Bot Auth maxAge must be a positive integer.')
-})