AgentPKI bootstrap . v1.0  (3-scenario trust demo)
----------------------------------------------------

  Email? [email protected]

  Scenario 1 of 3 . happy path
  --------------------------------------------------
  Claiming subdomain + minting + verifying + storing ... ok in 864ms
    issuer    bs-a4f8d2e.agents.agentpki.dev
    passport  v4.public.eyJ2IjoxLCJpc3... (397 chars)
    verdict   allow   (verifier elapsed 486ms)
    share     https://agentpki.dev/check/result/27c7f86c8563

  Scenario 2 of 3 . tampered signature
  --------------------------------------------------
  Minting a fresh token, flipping 4 chars of its Ed25519 signature, verifying ... done
    verdict   deny in 5ms
    reason    bad_signature
    why       The payload JSON was still valid -- but the Ed25519
              signature no longer matched. No network needed: this
              fails on pure crypto math, locally.

  Scenario 3 of 3 . revoked-key signing
  --------------------------------------------------
  Minting via /mint?revoked=1 (signs with rotated kid), verifying ... done
    verdict   deny in 4ms
    reason    revoked_key
    detail    kid="demo-2026-q1-rotated" revoked at 1748390400 (planned_rotation)
    why       Signature was mathematically valid -- the rotated
              kid really did sign this token. The verifier consulted
              the issuer's CRL and saw the kid is now revoked.

  ----------------------------------------------------
  All 3 scenarios behaved as expected:
    [scenario 1]  real signed token        -> allow
    [scenario 2]  tampered signature       -> deny (bad_signature)
    [scenario 3]  revoked-key signing      -> deny (revoked_key)

  AgentPKI distinguishes a forged token from a revoked one --
  and the verifier tells you, accurately, which one happened.

// agentpki.test.ts — drop this into your existing test suite
import { describe, it, expect } from 'vitest';

const VERIFY = 'https://verify.agentpki.dev/v1/verify';
const MINT   = 'https://demo.agentpki.dev/mint';

async function verify(token: string) {
  const r = await fetch(VERIFY, {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ token }),
  });
  return r.json();
}

describe('AgentPKI trust contract', () => {
  it('allow on a real signed token', async () => {
    const { token } = await fetch(MINT).then(r => r.json());
    const v = await verify(token);
    expect(v.verdict).toBe('allow');
  });

  it('deny + bad_signature on tampered token', async () => {
    const { token } = await fetch(MINT).then(r => r.json());
    const [v, p, p2, f] = token.split('.');
    const tampered = `${v}.${p}.${p2.slice(0, -4)}AAAA.${f}`;
    const result = await verify(tampered);
    expect(result.verdict).toBe('deny');
    expect(result.failure_reason).toBe('bad_signature');
  });

  it('deny + revoked_key when issuer rotated the kid', async () => {
    const { token } = await fetch(`${MINT}?revoked=1`).then(r => r.json());
    const result = await verify(token);
    expect(result.verdict).toBe('deny');
    expect(result.failure_reason).toBe('revoked_key');
    expect(result.failure_detail).toContain('demo-2026-q1-rotated');
  });
});