@grantex/conformance 0.1.0

package/dist/suites/delegation.js

@@ -0,0 +1,120 @@
+import { test, expectStatus, expectKeys, expectString, expectEqual } from '../helpers.js';
+export const delegationSuite = {
+    name: 'delegation',
+    description: 'Grant delegation and scope enforcement',
+    optional: false,
+    run: async (ctx) => {
+        const results = [];
+        const { agentId, agentDid } = ctx.sharedAgent;
+        // Create parent flow using shared agent
+        const parentFlow = await ctx.flow.executeFullFlow({
+            agentId,
+            agentDid,
+            scopes: ['read', 'write'],
+        });
+        // Use the shared agent as both parent and sub-agent (self-delegation is valid)
+        const subAgentId = agentId;
+        results.push(await test('POST /v1/grants/delegate returns 201 with grantToken', '§9', async () => {
+            const res = await ctx.http.post('/v1/grants/delegate', {
+                parentGrantToken: parentFlow.grantToken,
+                subAgentId,
+                scopes: ['read'],
+            });
+            expectStatus(res, 201);
+            expectKeys(res.body, ['grantToken', 'expiresAt', 'scopes', 'grantId']);
+            expectString(res.body.grantToken, 'grantToken');
+            ctx.cleanup.trackGrant(res.body.grantId);
+        }));
+        results.push(await test('Delegated JWT contains parentAgt, parentGrnt, delegationDepth', '§9', async () => {
+            const res = await ctx.http.post('/v1/grants/delegate', {
+                parentGrantToken: parentFlow.grantToken,
+                subAgentId,
+                scopes: ['read'],
+            });
+            expectStatus(res, 201);
+            ctx.cleanup.trackGrant(res.body.grantId);
+            const parts = res.body.grantToken.split('.');
+            const payload = JSON.parse(atob(parts[1]));
+            expectString(payload.parentAgt, 'parentAgt');
+            expectString(payload.parentGrnt, 'parentGrnt');
+            expectEqual(typeof payload.delegationDepth, 'number', 'delegationDepth type');
+            expectEqual(payload.delegationDepth, 1, 'delegationDepth');
+        }));
+        results.push(await test('Delegation rejects scope superset (400)', '§9', async () => {
+            const res = await ctx.http.post('/v1/grants/delegate', {
+                parentGrantToken: parentFlow.grantToken,
+                subAgentId,
+                scopes: ['read', 'write', 'admin'],
+            });
+            expectStatus(res, 400);
+        }));
+        results.push(await test('Delegation depth limit is enforced', '§9', async () => {
+            // Delegate parent → self (depth 1)
+            const del1 = await ctx.http.post('/v1/grants/delegate', {
+                parentGrantToken: parentFlow.grantToken,
+                subAgentId,
+                scopes: ['read'],
+            });
+            expectStatus(del1, 201);
+            ctx.cleanup.trackGrant(del1.body.grantId);
+            // Delegate depth-1 → self (depth 2)
+            const del2 = await ctx.http.post('/v1/grants/delegate', {
+                parentGrantToken: del1.body.grantToken,
+                subAgentId,
+                scopes: ['read'],
+            });
+            if (del2.status === 201) {
+                ctx.cleanup.trackGrant(del2.body.grantId);
+                const parts = del2.body.grantToken.split('.');
+                const payload = JSON.parse(atob(parts[1]));
+                expectEqual(payload.delegationDepth, 2, 'delegationDepth');
+            }
+            else {
+                // Server enforces depth limit — also valid
+                expectStatus(del2, 400);
+            }
+        }));
+        results.push(await test('Revoking parent cascades to delegated grants', '§9', async () => {
+            // New authorize+token flow using shared agent
+            const authRes = await ctx.http.post('/v1/authorize', {
+                agentId,
+                principalId: `principal-cascade-${Date.now()}`,
+                scopes: ['read'],
+            });
+            expectStatus(authRes, 201);
+            let code;
+            if (authRes.body.code) {
+                code = authRes.body.code;
+            }
+            else {
+                const consentRes = await ctx.http.requestPublic('POST', `/v1/consent/${authRes.body.authRequestId}/approve`);
+                if (consentRes.status !== 200) {
+                    throw new Error(`Consent approve failed: ${consentRes.status} ${consentRes.rawText}`);
+                }
+                code = consentRes.body.code;
+            }
+            const tokenRes = await ctx.http.post('/v1/token', { code, agentId });
+            expectStatus(tokenRes, 201);
+            ctx.cleanup.trackGrant(tokenRes.body.grantId);
+            // Delegate to self
+            const delRes = await ctx.http.post('/v1/grants/delegate', {
+                parentGrantToken: tokenRes.body.grantToken,
+                subAgentId,
+                scopes: ['read'],
+            });
+            expectStatus(delRes, 201);
+            ctx.cleanup.trackGrant(delRes.body.grantId);
+            // Revoke parent grant
+            const revokeRes = await ctx.http.delete(`/v1/grants/${tokenRes.body.grantId}`);
+            expectStatus(revokeRes, 204);
+            // Verify child token is now invalid
+            const verifyRes = await ctx.http.post('/v1/tokens/verify', {
+                token: delRes.body.grantToken,
+            });
+            expectStatus(verifyRes, 200);
+            expectEqual(verifyRes.body.valid, false, 'valid');
+        }));
+        return results;
+    },
+};
+//# sourceMappingURL=delegation.js.map

package/dist/suites/delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../src/suites/delegation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE1F,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,KAAK;IACf,GAAG,EAAE,KAAK,EAAE,GAAiB,EAAyB,EAAE;QACtD,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;QAE9C,wCAAwC;QACxC,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC;YAChD,OAAO;YACP,QAAQ;YACR,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;SAC1B,CAAC,CAAC;QAEH,+EAA+E;QAC/E,MAAM,UAAU,GAAG,OAAO,CAAC;QAE3B,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CACR,sDAAsD,EACtD,IAAI,EACJ,KAAK,IAAI,EAAE;YACT,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAK5B,qBAAqB,EAAE;gBACxB,gBAAgB,EAAE,UAAU,CAAC,UAAU;gBACvC,UAAU;gBACV,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CAAC,CAAC;YACH,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YACvE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAChD,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC,CACF,CACF,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CACR,+DAA+D,EAC/D,IAAI,EACJ,KAAK,IAAI,EAAE;YACT,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAC7B,qBAAqB,EACrB;gBACE,gBAAgB,EAAE,UAAU,CAAC,UAAU;gBACvC,UAAU;gBACV,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEzC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAIzC,CAAC;YACF,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC7C,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAC/C,WAAW,CAAC,OAAO,OAAO,CAAC,eAAe,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;YAC9E,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC7D,CAAC,CACF,CACF,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CACR,yCAAyC,EACzC,IAAI,EACJ,KAAK,IAAI,EAAE;YACT,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBACrD,gBAAgB,EAAE,UAAU,CAAC,UAAU;gBACvC,UAAU;gBACV,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;aACnC,CAAC,CAAC;YACH,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC,CACF,CACF,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CACR,oCAAoC,EACpC,IAAI,EACJ,KAAK,IAAI,EAAE;YACT,mCAAmC;YACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAC9B,qBAAqB,EACrB;gBACE,gBAAgB,EAAE,UAAU,CAAC,UAAU;gBACvC,UAAU;gBACV,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CACF,CAAC;YACF,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACxB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE1C,oCAAoC;YACpC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAC9B,qBAAqB,EACrB;gBACE,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;gBACtC,UAAU;gBACV,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CACF,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAgC,CAAC;gBAC3E,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACN,2CAA2C;gBAC3C,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC,CACF,CACF,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CACR,8CAA8C,EAC9C,IAAI,EACJ,KAAK,IAAI,EAAE;YACT,8CAA8C;YAC9C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAGhC,eAAe,EAAE;gBAClB,OAAO;gBACP,WAAW,EAAE,qBAAqB,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC9C,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CAAC,CAAC;YACH,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAE3B,IAAI,IAAY,CAAC;YACjB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACtB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAC7C,MAAM,EACN,eAAe,OAAO,CAAC,IAAI,CAAC,aAAa,UAAU,CACpD,CAAC;gBACF,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAGjC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACnC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC5B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE9C,mBAAmB;YACnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAChC,qBAAqB,EACrB;gBACE,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;gBAC1C,UAAU;gBACV,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CACF,CAAC;YACF,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE5C,sBAAsB;YACtB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAE7B,oCAAoC;YACpC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAqB,mBAAmB,EAAE;gBAC7E,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;aAC9B,CAAC,CAAC;YACH,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAC7B,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC,CACF,CACF,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC"}

package/dist/suites/grants.d.ts

@@ -0,0 +1,3 @@
+import type { SuiteDefinition } from '../types.js';
+export declare const grantsSuite: SuiteDefinition;
+//# sourceMappingURL=grants.d.ts.map

package/dist/suites/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/suites/grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,aAAa,CAAC;AAG7E,eAAO,MAAM,WAAW,EAAE,eAkDzB,CAAC"}

package/dist/suites/grants.js

@@ -0,0 +1,34 @@
+import { test, expectStatus, expectKeys, expectArray, expectEqual } from '../helpers.js';
+export const grantsSuite = {
+    name: 'grants',
+    description: 'Grant listing, retrieval, and revocation',
+    optional: false,
+    run: async (ctx) => {
+        const results = [];
+        const { agentId, agentDid } = ctx.sharedAgent;
+        const flow = await ctx.flow.executeFullFlow({ agentId, agentDid });
+        results.push(await test('GET /v1/grants lists grants', '§7.1', async () => {
+            const res = await ctx.http.get('/v1/grants');
+            expectStatus(res, 200);
+            expectKeys(res.body, ['grants']);
+            expectArray(res.body.grants, 'grants');
+        }));
+        results.push(await test('GET /v1/grants/:id returns grant details', '§7.1', async () => {
+            const res = await ctx.http.get(`/v1/grants/${flow.grantId}`);
+            expectStatus(res, 200);
+            expectKeys(res.body, ['grantId', 'agentId', 'scopes', 'status']);
+            expectEqual(res.body.grantId, flow.grantId, 'grantId');
+        }));
+        results.push(await test('DELETE /v1/grants/:id returns 204', '§7.1', async () => {
+            const res = await ctx.http.delete(`/v1/grants/${flow.grantId}`);
+            expectStatus(res, 204);
+        }));
+        results.push(await test('Grant status is revoked after DELETE', '§7.1', async () => {
+            const res = await ctx.http.get(`/v1/grants/${flow.grantId}`);
+            expectStatus(res, 200);
+            expectEqual(res.body.status, 'revoked', 'status');
+        }));
+        return results;
+    },
+};
+//# sourceMappingURL=grants.js.map

package/dist/suites/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/suites/grants.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEzF,MAAM,CAAC,MAAM,WAAW,GAAoB;IAC1C,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,KAAK;IACf,GAAG,EAAE,KAAK,EAAE,GAAiB,EAAyB,EAAE;QACtD,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;QAE9C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEnE,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,6BAA6B,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAwB,YAAY,CAAC,CAAC;YACpE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,0CAA0C,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACxE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAK3B,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACjC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,mCAAmC,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,sCAAsC,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAqB,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACjF,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC"}

package/dist/suites/health.d.ts

@@ -0,0 +1,3 @@
+import type { SuiteDefinition } from '../types.js';
+export declare const healthSuite: SuiteDefinition;
+//# sourceMappingURL=health.d.ts.map

package/dist/suites/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/suites/health.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,aAAa,CAAC;AAG7E,eAAO,MAAM,WAAW,EAAE,eAqCzB,CAAC"}

package/dist/suites/health.js

@@ -0,0 +1,30 @@
+import { test, expectStatus, expectKeys, expectString } from '../helpers.js';
+export const healthSuite = {
+    name: 'health',
+    description: 'Health check and JWKS endpoints',
+    optional: false,
+    run: async (ctx) => {
+        const results = [];
+        results.push(await test('GET /health returns 200 with status ok', '§3.3', async () => {
+            const res = await ctx.http.requestPublic('GET', '/health');
+            expectStatus(res, 200);
+            expectKeys(res.body, ['status']);
+            expectString(res.body.status, 'status');
+        }));
+        results.push(await test('JWKS endpoint has RS256 keys', '§10', async () => {
+            const res = await ctx.http.requestPublic('GET', '/.well-known/jwks.json');
+            expectStatus(res, 200);
+            expectKeys(res.body, ['keys']);
+            const keys = res.body.keys;
+            if (!Array.isArray(keys) || keys.length === 0) {
+                throw new Error('JWKS must contain at least one key');
+            }
+            const rsaKeys = keys.filter((k) => k.kty === 'RSA');
+            if (rsaKeys.length === 0) {
+                throw new Error('JWKS must contain at least one RSA key');
+            }
+        }));
+        return results;
+    },
+};
+//# sourceMappingURL=health.js.map

package/dist/suites/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/suites/health.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7E,MAAM,CAAC,MAAM,WAAW,GAAoB;IAC1C,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,iCAAiC;IAC9C,QAAQ,EAAE,KAAK;IACf,GAAG,EAAE,KAAK,EAAE,GAAiB,EAAyB,EAAE;QACtD,MAAM,OAAO,GAAiB,EAAE,CAAC;QAEjC,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,wCAAwC,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAqB,KAAK,EAAE,SAAS,CAAC,CAAC;YAC/E,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CACtC,KAAK,EACL,wBAAwB,CACzB,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC"}

package/dist/suites/policies.d.ts

@@ -0,0 +1,3 @@
+import type { SuiteDefinition } from '../types.js';
+export declare const policiesSuite: SuiteDefinition;
+//# sourceMappingURL=policies.d.ts.map

package/dist/suites/policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../src/suites/policies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,aAAa,CAAC;AAG7E,eAAO,MAAM,aAAa,EAAE,eAsE3B,CAAC"}

package/dist/suites/policies.js

@@ -0,0 +1,51 @@
+import { test, expectStatus, expectKeys, expectString, expectArray, expectEqual } from '../helpers.js';
+export const policiesSuite = {
+    name: 'policies',
+    description: 'Policy CRUD and enforcement',
+    optional: true,
+    run: async (ctx) => {
+        const results = [];
+        let policyId = '';
+        results.push(await test('POST /v1/policies creates policy (201)', '§12', async () => {
+            const res = await ctx.http.post('/v1/policies', {
+                name: `conformance-policy-${Date.now()}`,
+                effect: 'allow',
+                scopes: ['read'],
+            });
+            expectStatus(res, 201);
+            expectKeys(res.body, ['id', 'name', 'effect']);
+            expectString(res.body.id, 'id');
+            policyId = res.body.id;
+            ctx.cleanup.trackPolicy(policyId);
+        }));
+        results.push(await test('GET /v1/policies lists policies', '§12', async () => {
+            const res = await ctx.http.get('/v1/policies');
+            expectStatus(res, 200);
+            expectKeys(res.body, ['policies']);
+            expectArray(res.body.policies, 'policies');
+        }));
+        results.push(await test('GET /v1/policies/:id returns policy details', '§12', async () => {
+            if (!policyId)
+                throw new Error('No policy created');
+            const res = await ctx.http.get(`/v1/policies/${policyId}`);
+            expectStatus(res, 200);
+            expectKeys(res.body, ['id', 'name', 'effect']);
+            expectEqual(res.body.id, policyId, 'id');
+        }));
+        results.push(await test('PATCH /v1/policies/:id updates policy', '§12', async () => {
+            if (!policyId)
+                throw new Error('No policy created');
+            const res = await ctx.http.patch(`/v1/policies/${policyId}`, { effect: 'deny' });
+            expectStatus(res, 200);
+            expectEqual(res.body.effect, 'deny', 'effect');
+        }));
+        results.push(await test('DELETE /v1/policies/:id returns 204', '§12', async () => {
+            if (!policyId)
+                throw new Error('No policy created');
+            const res = await ctx.http.delete(`/v1/policies/${policyId}`);
+            expectStatus(res, 204);
+        }));
+        return results;
+    },
+};
+//# sourceMappingURL=policies.js.map

package/dist/suites/policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/suites/policies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEvG,MAAM,CAAC,MAAM,aAAa,GAAoB;IAC5C,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,6BAA6B;IAC1C,QAAQ,EAAE,IAAI;IACd,GAAG,EAAE,KAAK,EAAE,GAAiB,EAAyB,EAAE;QACtD,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,IAAI,QAAQ,GAAG,EAAE,CAAC;QAElB,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,wCAAwC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAI5B,cAAc,EAAE;gBACjB,IAAI,EAAE,sBAAsB,IAAI,CAAC,GAAG,EAAE,EAAE;gBACxC,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CAAC,CAAC;YACH,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC/C,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAChC,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAA0B,cAAc,CAAC,CAAC;YACxE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YACnC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,6CAA6C,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAC1E,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAC5B,gBAAgB,QAAQ,EAAE,CAC3B,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC/C,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,uCAAuC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACpE,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAC9B,gBAAgB,QAAQ,EAAE,EAC1B,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,qCAAqC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAClE,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC;YAC9D,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC"}

package/dist/suites/scim.d.ts

@@ -0,0 +1,3 @@
+import type { SuiteDefinition } from '../types.js';
+export declare const scimSuite: SuiteDefinition;
+//# sourceMappingURL=scim.d.ts.map

package/dist/suites/scim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.d.ts","sourceRoot":"","sources":["../../src/suites/scim.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,aAAa,CAAC;AAG7E,eAAO,MAAM,SAAS,EAAE,eAiGvB,CAAC"}

package/dist/suites/scim.js

@@ -0,0 +1,64 @@
+import { test, expectStatus, expectKeys, expectString, expectArray } from '../helpers.js';
+export const scimSuite = {
+    name: 'scim',
+    description: 'SCIM 2.0 provisioning endpoints',
+    optional: true,
+    run: async (ctx) => {
+        const results = [];
+        let scimToken = '';
+        let scimTokenId = '';
+        let userId = '';
+        results.push(await test('POST /v1/scim/tokens creates SCIM token (201)', '§13', async () => {
+            const res = await ctx.http.post('/v1/scim/tokens', {
+                label: `conformance-scim-${Date.now()}`,
+            });
+            expectStatus(res, 201);
+            expectKeys(res.body, ['id', 'label', 'token']);
+            expectString(res.body.token, 'token');
+            scimToken = res.body.token;
+            scimTokenId = res.body.id;
+        }));
+        results.push(await test('GET /v1/scim/tokens lists SCIM tokens', '§13', async () => {
+            const res = await ctx.http.get('/v1/scim/tokens');
+            expectStatus(res, 200);
+            expectKeys(res.body, ['tokens']);
+            expectArray(res.body.tokens, 'tokens');
+        }));
+        results.push(await test('GET /scim/v2/ServiceProviderConfig returns config', '§13', async () => {
+            const res = await ctx.http.requestPublic('GET', '/scim/v2/ServiceProviderConfig');
+            expectStatus(res, 200);
+            expectKeys(res.body, ['schemas']);
+        }));
+        results.push(await test('POST /scim/v2/Users creates user (201)', '§13', async () => {
+            if (!scimToken)
+                throw new Error('No SCIM token created');
+            const res = await ctx.http.doRequestWithToken('POST', '/scim/v2/Users', scimToken, {
+                userName: `conformance-user-${Date.now()}@example.com`,
+                displayName: 'Conformance Test User',
+            });
+            expectStatus(res, 201);
+            expectKeys(res.body, ['id', 'userName', 'schemas']);
+            expectString(res.body.id, 'id');
+            userId = res.body.id;
+        }));
+        results.push(await test('GET /scim/v2/Users lists users', '§13', async () => {
+            if (!scimToken)
+                throw new Error('No SCIM token created');
+            const res = await ctx.http.doRequestWithToken('GET', '/scim/v2/Users', scimToken);
+            expectStatus(res, 200);
+            expectKeys(res.body, ['Resources', 'totalResults']);
+        }));
+        results.push(await test('DELETE /scim/v2/Users/:id returns 204', '§13', async () => {
+            if (!scimToken || !userId)
+                throw new Error('No SCIM user created');
+            const res = await ctx.http.doRequestWithToken('DELETE', `/scim/v2/Users/${userId}`, scimToken);
+            expectStatus(res, 204);
+            // Clean up SCIM token
+            if (scimTokenId) {
+                await ctx.http.delete(`/v1/scim/tokens/${scimTokenId}`);
+            }
+        }));
+        return results;
+    },
+};
+//# sourceMappingURL=scim.js.map

package/dist/suites/scim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.js","sourceRoot":"","sources":["../../src/suites/scim.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE1F,MAAM,CAAC,MAAM,SAAS,GAAoB;IACxC,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,iCAAiC;IAC9C,QAAQ,EAAE,IAAI;IACd,GAAG,EAAE,KAAK,EAAE,GAAiB,EAAyB,EAAE;QACtD,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,+CAA+C,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAI5B,iBAAiB,EAAE;gBACpB,KAAK,EAAE,oBAAoB,IAAI,CAAC,GAAG,EAAE,EAAE;aACxC,CAAC,CAAC;YACH,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/C,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAC3B,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,uCAAuC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAwB,iBAAiB,CAAC,CAAC;YACzE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,mDAAmD,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAChF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CACtC,KAAK,EACL,gCAAgC,CACjC,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,wCAAwC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACrE,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAI1C,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE;gBACtC,QAAQ,EAAE,oBAAoB,IAAI,CAAC,GAAG,EAAE,cAAc;gBACtD,WAAW,EAAE,uBAAuB;aACrC,CAAC,CAAC;YACH,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;YACpD,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAC7D,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAC3C,KAAK,EACL,gBAAgB,EAChB,SAAS,CACV,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,uCAAuC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACpE,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACnE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAC3C,QAAQ,EACR,kBAAkB,MAAM,EAAE,EAC1B,SAAS,CACV,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAEvB,sBAAsB;YACtB,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,WAAW,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC"}

package/dist/suites/security.d.ts

@@ -0,0 +1,3 @@
+import type { SuiteDefinition } from '../types.js';
+export declare const securitySuite: SuiteDefinition;
+//# sourceMappingURL=security.d.ts.map

package/dist/suites/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/suites/security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,aAAa,CAAC;AAI7E,eAAO,MAAM,aAAa,EAAE,eA0F3B,CAAC"}

package/dist/suites/security.js

@@ -0,0 +1,69 @@
+import { test, expectStatus } from '../helpers.js';
+import { ConformanceHttpClient } from '../http-client.js';
+export const securitySuite = {
+    name: 'security',
+    description: 'Authentication, authorization, and security enforcement',
+    optional: false,
+    run: async (ctx) => {
+        const results = [];
+        const { agentId, agentDid } = ctx.sharedAgent;
+        results.push(await test('Request without auth returns 401', '§14', async () => {
+            const res = await ctx.http.requestPublic('GET', '/v1/agents');
+            expectStatus(res, 401);
+        }));
+        results.push(await test('Request with bad auth returns 401', '§14', async () => {
+            const client = new ConformanceHttpClient(ctx.baseUrl, 'invalid-api-key-12345');
+            const res = await client.get('/v1/agents');
+            expectStatus(res, 401);
+        }));
+        results.push(await test('JWKS only contains RS256 keys', '§14', async () => {
+            const res = await ctx.http.requestPublic('GET', '/.well-known/jwks.json');
+            expectStatus(res, 200);
+            for (const key of res.body.keys) {
+                if (key.alg && key.alg !== 'RS256') {
+                    throw new Error(`Expected RS256 algorithm, found: ${key.alg}`);
+                }
+                if (key.kty !== 'RSA') {
+                    throw new Error(`Expected RSA key type, found: ${key.kty}`);
+                }
+            }
+        }));
+        // Use shared agent — get a grant with limited scopes
+        const flow = await ctx.flow.executeFullFlow({
+            agentId,
+            agentDid,
+            scopes: ['read'],
+        });
+        results.push(await test('Delegation scope enforcement prevents escalation', '§14', async () => {
+            // Try to delegate with scopes the parent doesn't have
+            const delRes = await ctx.http.post('/v1/grants/delegate', {
+                parentGrantToken: flow.grantToken,
+                subAgentId: agentId,
+                scopes: ['read', 'write'],
+            });
+            expectStatus(delRes, 400);
+        }));
+        results.push(await test('Audit log is append-only (PUT/DELETE return 404 or 405)', '§14', async () => {
+            const logRes = await ctx.http.post('/v1/audit/log', {
+                agentId: flow.agentId,
+                agentDid: flow.agentDid,
+                grantId: flow.grantId,
+                principalId: flow.principalId,
+                action: 'conformance.security.test',
+            });
+            expectStatus(logRes, 201);
+            const putRes = await ctx.http.request('PUT', `/v1/audit/${logRes.body.entryId}`, {
+                action: 'modified',
+            });
+            if (putRes.status !== 404 && putRes.status !== 405) {
+                throw new Error(`Expected 404 or 405 for PUT /v1/audit/:id, got ${putRes.status}`);
+            }
+            const deleteRes = await ctx.http.delete(`/v1/audit/${logRes.body.entryId}`);
+            if (deleteRes.status !== 404 && deleteRes.status !== 405) {
+                throw new Error(`Expected 404 or 405 for DELETE /v1/audit/:id, got ${deleteRes.status}`);
+            }
+        }));
+        return results;
+    },
+};
+//# sourceMappingURL=security.js.map

package/dist/suites/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/suites/security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,CAAC,MAAM,aAAa,GAAoB;IAC5C,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,yDAAyD;IACtE,QAAQ,EAAE,KAAK;IACf,GAAG,EAAE,KAAK,EAAE,GAAiB,EAAyB,EAAE;QACtD,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;QAE9C,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,kCAAkC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAC9D,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,MAAM,GAAG,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3C,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAErC,KAAK,EAAE,wBAAwB,CAAC,CAAC;YACpC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAChC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;oBACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;gBACjE,CAAC;gBACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,qDAAqD;QACrD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC;YAC1C,OAAO;YACP,QAAQ;YACR,MAAM,EAAE,CAAC,MAAM,CAAC;SACjB,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,kDAAkD,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAC/E,sDAAsD;YACtD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBACxD,gBAAgB,EAAE,IAAI,CAAC,UAAU;gBACjC,UAAU,EAAE,OAAO;gBACnB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;aAC1B,CAAC,CAAC;YACH,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,yDAAyD,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACtF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAsB,eAAe,EAAE;gBACvE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,2BAA2B;aACpC,CAAC,CAAC;YACH,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAE1B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE;gBAC/E,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CACb,kDAAkD,MAAM,CAAC,MAAM,EAAE,CAClE,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CACb,qDAAqD,SAAS,CAAC,MAAM,EAAE,CACxE,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC"}

package/dist/suites/sso.d.ts

@@ -0,0 +1,3 @@
+import type { SuiteDefinition } from '../types.js';
+export declare const ssoSuite: SuiteDefinition;
+//# sourceMappingURL=sso.d.ts.map

package/dist/suites/sso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.d.ts","sourceRoot":"","sources":["../../src/suites/sso.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,aAAa,CAAC;AAG7E,eAAO,MAAM,QAAQ,EAAE,eAoDtB,CAAC"}

package/dist/suites/sso.js

@@ -0,0 +1,35 @@
+import { test, expectStatus, expectKeys, expectString } from '../helpers.js';
+export const ssoSuite = {
+    name: 'sso',
+    description: 'SSO configuration and flow',
+    optional: true,
+    run: async (ctx) => {
+        const results = [];
+        results.push(await test('POST /v1/sso/config creates SSO config (201)', '§13', async () => {
+            const res = await ctx.http.post('/v1/sso/config', {
+                issuerUrl: 'https://accounts.google.com',
+                clientId: 'conformance-test-client',
+                clientSecret: 'conformance-test-secret',
+                redirectUri: 'https://example.com/sso/callback',
+            });
+            expectStatus(res, 201);
+            expectKeys(res.body, ['issuerUrl', 'clientId', 'redirectUri']);
+        }));
+        results.push(await test('GET /v1/sso/config returns SSO config', '§13', async () => {
+            const res = await ctx.http.get('/v1/sso/config');
+            expectStatus(res, 200);
+            expectKeys(res.body, ['issuerUrl', 'clientId', 'redirectUri']);
+            expectString(res.body.issuerUrl, 'issuerUrl');
+        }));
+        results.push(await test('GET /sso/login requires org parameter', '§13', async () => {
+            const res = await ctx.http.requestPublic('GET', '/sso/login');
+            expectStatus(res, 400);
+        }));
+        results.push(await test('DELETE /v1/sso/config returns 204', '§13', async () => {
+            const res = await ctx.http.delete('/v1/sso/config');
+            expectStatus(res, 204);
+        }));
+        return results;
+    },
+};
+//# sourceMappingURL=sso.js.map

package/dist/suites/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../src/suites/sso.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7E,MAAM,CAAC,MAAM,QAAQ,GAAoB;IACvC,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,4BAA4B;IACzC,QAAQ,EAAE,IAAI;IACd,GAAG,EAAE,KAAK,EAAE,GAAiB,EAAyB,EAAE;QACtD,MAAM,OAAO,GAAiB,EAAE,CAAC;QAEjC,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,8CAA8C,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAC3E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAI5B,gBAAgB,EAAE;gBACnB,SAAS,EAAE,6BAA6B;gBACxC,QAAQ,EAAE,yBAAyB;gBACnC,YAAY,EAAE,yBAAyB;gBACvC,WAAW,EAAE,kCAAkC;aAChD,CAAC,CAAC;YACH,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,uCAAuC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAG3B,gBAAgB,CAAC,CAAC;YACrB,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;YAC/D,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAChD,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,uCAAuC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAC9D,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACpD,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC"}

package/dist/suites/token.d.ts

@@ -0,0 +1,3 @@
+import type { SuiteDefinition } from '../types.js';
+export declare const tokenSuite: SuiteDefinition;
+//# sourceMappingURL=token.d.ts.map

package/dist/suites/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/suites/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,aAAa,CAAC;AAG7E,eAAO,MAAM,UAAU,EAAE,eAgFxB,CAAC"}

package/dist/suites/token.js

@@ -0,0 +1,61 @@
+import { test, expectStatus, expectString, expectArray, expectIsoDate } from '../helpers.js';
+export const tokenSuite = {
+    name: 'token',
+    description: 'Token exchange (code → grant token)',
+    optional: false,
+    run: async (ctx) => {
+        const results = [];
+        const { agentId, agentDid } = ctx.sharedAgent;
+        results.push(await test('POST /v1/token exchanges code for grantToken, refreshToken, grantId, scopes, expiresAt', '§5.3', async () => {
+            const flow = await ctx.flow.executeFullFlow({
+                agentId,
+                agentDid,
+                scopes: ['read', 'write'],
+            });
+            expectString(flow.grantToken, 'grantToken');
+            expectString(flow.refreshToken, 'refreshToken');
+            expectString(flow.grantId, 'grantId');
+            expectArray(flow.scopes, 'scopes');
+            expectIsoDate(flow.expiresAt, 'expiresAt');
+        }));
+        results.push(await test('POST /v1/token rejects invalid code (400)', '§5.3', async () => {
+            const res = await ctx.http.post('/v1/token', {
+                code: 'invalid-code-12345',
+                agentId,
+            });
+            expectStatus(res, 400);
+        }));
+        results.push(await test('POST /v1/token rejects reused code (400)', '§5.3', async () => {
+            // Authorize to get a code
+            const authRes = await ctx.http.post('/v1/authorize', {
+                agentId,
+                principalId: `principal-reuse-${Date.now()}`,
+                scopes: ['read'],
+            });
+            expectStatus(authRes, 201);
+            let code;
+            if (authRes.body.code) {
+                code = authRes.body.code;
+            }
+            else {
+                const consentRes = await ctx.http.requestPublic('POST', `/v1/consent/${authRes.body.authRequestId}/approve`);
+                code = consentRes.body.code;
+            }
+            // First exchange — should succeed
+            const first = await ctx.http.post('/v1/token', {
+                code,
+                agentId,
+            });
+            expectStatus(first, 201);
+            ctx.cleanup.trackGrant(first.body.grantId);
+            // Second exchange with same code — should fail
+            const second = await ctx.http.post('/v1/token', {
+                code,
+                agentId,
+            });
+            expectStatus(second, 400);
+        }));
+        return results;
+    },
+};
+//# sourceMappingURL=token.js.map

package/dist/suites/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/suites/token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE7F,MAAM,CAAC,MAAM,UAAU,GAAoB;IACzC,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,qCAAqC;IAClD,QAAQ,EAAE,KAAK;IACf,GAAG,EAAE,KAAK,EAAE,GAAiB,EAAyB,EAAE;QACtD,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;QAE9C,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CACR,wFAAwF,EACxF,MAAM,EACN,KAAK,IAAI,EAAE;YACT,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC1C,OAAO;gBACP,QAAQ;gBACR,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;aAC1B,CAAC,CAAC;YACH,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAC5C,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;YAChD,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACtC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC,CACF,CACF,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,2CAA2C,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAC3C,IAAI,EAAE,oBAAoB;gBAC1B,OAAO;aACR,CAAC,CAAC;YACH,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,IAAI,CACV,MAAM,IAAI,CAAC,0CAA0C,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACxE,0BAA0B;YAC1B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAGhC,eAAe,EAAE;gBAClB,OAAO;gBACP,WAAW,EAAE,mBAAmB,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC5C,MAAM,EAAE,CAAC,MAAM,CAAC;aACjB,CAAC,CAAC;YACH,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAE3B,IAAI,IAAY,CAAC;YACjB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACtB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAC7C,MAAM,EACN,eAAe,OAAO,CAAC,IAAI,CAAC,aAAa,UAAU,CACpD,CAAC;gBACF,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9B,CAAC;YAED,kCAAkC;YAClC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAsB,WAAW,EAAE;gBAClE,IAAI;gBACJ,OAAO;aACR,CAAC,CAAC;YACH,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE3C,+CAA+C;YAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAC9C,IAAI;gBACJ,OAAO;aACR,CAAC,CAAC;YACH,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC"}

package/dist/suites/tokens.d.ts

@@ -0,0 +1,3 @@
+import type { SuiteDefinition } from '../types.js';
+export declare const tokensSuite: SuiteDefinition;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/suites/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/suites/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,aAAa,CAAC;AAG7E,eAAO,MAAM,WAAW,EAAE,eAiEzB,CAAC"}