@interop/was-conformance-suite 0.1.2 → 0.3.0

package/dist/suites/conditional-requests-api.js

@@ -0,0 +1,444 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * WAS conformance tests -- conditional requests & caching (spec "Caching" and
+ * "Conditional Requests").
+ *
+ * Conditional writes are an OPTIONAL feature: a backend advertises the
+ * `conditional-writes` token in its Backend description, and only then are the
+ * 412 semantics required (MUST). This suite is therefore not marked
+ * suite-level optional. Its `setup` probes the Space's default backend for the
+ * token and stashes the result; the write tests call `ctx.skip(...)` when the
+ * backend does not advertise it, while the two ETag tests reflect the weaker
+ * `SHOULD emit ETag` guidance and are marked `optional: true`.
+ *
+ * The tests work at the Resource level in a plain JSON Collection, driving raw
+ * `ZcapClient.request()` calls so the `If-Match` / `If-None-Match` precondition
+ * headers can be attached directly. Those preconditions describe the request
+ * rather than the capability target, so they need not be covered by the
+ * signature; the server reads them off the request headers after authorization.
+ */
+import { signCapabilityInvocation } from '@interop/http-signature-zcap-invoke';
+import assert from '../harness/assert.js';
+/**
+ * Asserts a rejected conditional write reports a precondition failure: status
+ * 412, an `application/problem+json` body, and the `precondition-failed` type.
+ *
+ * @param expectedError {any}   the error thrown by `ZcapClient.request()`
+ */
+function assertPreconditionFailed(expectedError) {
+    assert.ok(expectedError, 'expected the conditional write to fail with 412');
+    assert.equal(expectedError.response.status, 412);
+    assert.match(expectedError.response.headers.get('content-type'), /application\/problem\+json/);
+    assert.equal(expectedError.data.type, 'https://wallet.storage/spec#precondition-failed');
+}
+/**
+ * Asserts a rejected request carries the privacy-merged `not-found` mask:
+ * status 404, `application/problem+json`, and the merged `not-found` type. An
+ * under-authorized conditional write MUST surface this mask, never a 412 that
+ * would confirm the target exists.
+ *
+ * @param expectedError {any}   the error thrown by `ZcapClient.request()`
+ */
+function assertNotFoundMask(expectedError) {
+    assert.ok(expectedError, 'expected the under-authorized write to fail');
+    assert.equal(expectedError.response.status, 404);
+    assert.match(expectedError.response.headers.get('content-type'), /application\/problem\+json/);
+    assert.equal(expectedError.data.type, 'https://wallet.storage/spec#not-found');
+}
+/**
+ * Signs and sends a bodyless root HEAD invocation via raw `fetch`, returning
+ * the response so headers (the `ETag`) can be read. The low-level primitive is
+ * used because the high-level client parses the response body as JSON, which a
+ * bodyless HEAD 200 has none of.
+ *
+ * @param options {object}
+ * @param options.url {string}   the Resource URL to HEAD
+ * @param options.invocationSigner {ISigner}   the caller's signer
+ * @returns {Promise<Response>}
+ */
+async function headResource({ url, invocationSigner }) {
+    const signatureHeaders = await signCapabilityInvocation({
+        url,
+        method: 'HEAD',
+        headers: { date: new Date().toUTCString() },
+        invocationSigner,
+        capabilityAction: 'HEAD'
+    });
+    return fetch(url, {
+        method: 'HEAD',
+        headers: signatureHeaders
+    });
+}
+export const conditionalRequestsApi = {
+    id: 'conditional-requests-api',
+    name: 'Conditional requests & caching',
+    specRefs: [
+        'https://wallet.storage/spec#caching',
+        'https://wallet.storage/spec#conditional-requests'
+    ],
+    setup: async (ctx) => {
+        const alice = { ...ctx.actors.alice };
+        const bob = { ...ctx.actors.bob };
+        alice.space1 = { id: ctx.generateId() };
+        await ctx.createSpace({
+            spaceDescription: {
+                id: alice.space1.id,
+                name: "Alice's Conditional-Requests Space",
+                controller: alice.did
+            },
+            rootClient: alice.rootClient
+        });
+        // A plain JSON Collection to hold the per-test Resources.
+        await alice.rootClient.request({
+            url: new URL(`/space/${alice.space1.id}/`, ctx.serverUrl).toString(),
+            method: 'POST',
+            action: 'POST',
+            json: { id: 'items', name: 'Items' }
+        });
+        const collectionUrl = new URL(`/space/${alice.space1.id}/items/`, ctx.serverUrl).toString();
+        // Probe the Space's default backend for the `conditional-writes` feature
+        // token. The write tests below skip when it is absent (the feature is
+        // OPTIONAL); the 412 semantics are only required once advertised.
+        const backendsResponse = await alice.rootClient.request({
+            url: new URL(`/space/${alice.space1.id}/backends`, ctx.serverUrl).toString(),
+            method: 'GET'
+        });
+        const backends = backendsResponse.data;
+        const defaultBackend = backends.find(backend => backend.id === 'default');
+        const conditionalWritesSupported = Boolean(defaultBackend?.features?.includes('conditional-writes'));
+        return {
+            alice,
+            bob,
+            collectionUrl,
+            conditionalWritesSupported,
+            defaultBackend
+        };
+    },
+    teardown: async (ctx, state) => {
+        const { alice } = state;
+        try {
+            await alice.rootClient.request({
+                url: new URL(`/space/${alice.space1.id}`, ctx.serverUrl).toString(),
+                method: 'DELETE'
+            });
+        }
+        catch {
+            /* best-effort cleanup */
+        }
+    },
+    tests: [
+        {
+            id: 'conditional.backend-advertises-conditional-writes',
+            name: '[root] the default backend descriptor advertises the ' +
+                '`conditional-writes` feature',
+            specRefs: [
+                'https://wallet.storage/spec#conditional-requests',
+                'https://wallet.storage/spec#backend-data-model'
+            ],
+            run: async (ctx, state) => {
+                const { defaultBackend } = state;
+                assert.ok(defaultBackend, 'expected a `default` backend descriptor');
+                assert.ok(Array.isArray(defaultBackend.features), 'expected the backend descriptor to carry a `features` array');
+                assert.ok(defaultBackend.features.includes('conditional-writes'), 'expected `features` to include the `conditional-writes` token');
+            }
+        },
+        {
+            id: 'conditional.stale-if-match-412',
+            name: '[root] a PUT with a stale `If-Match` performs no write and returns ' +
+                '412 precondition-failed',
+            specRefs: [
+                'https://wallet.storage/spec#conditional-requests',
+                'https://wallet.storage/spec#precondition-failed'
+            ],
+            run: async (ctx, state) => {
+                const { alice, collectionUrl, conditionalWritesSupported } = state;
+                if (!conditionalWritesSupported) {
+                    ctx.skip('backend does not advertise conditional-writes');
+                }
+                const resourceUrl = `${collectionUrl}stale-if-match`;
+                // Create (version 1) then update (version 2): the ETag the client
+                // captured at version 1 is now stale.
+                const created = await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'PUT',
+                    action: 'PUT',
+                    json: { name: 'v1' }
+                });
+                const staleEtag = created.headers.get('etag');
+                assert.equal(staleEtag, '"1"');
+                await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'PUT',
+                    action: 'PUT',
+                    json: { name: 'v2' }
+                });
+                // A PUT carrying the stale validator MUST NOT write and MUST 412.
+                let expectedError;
+                try {
+                    await alice.rootClient.request({
+                        url: resourceUrl,
+                        method: 'PUT',
+                        action: 'PUT',
+                        json: { name: 'v3' },
+                        headers: { 'if-match': staleEtag }
+                    });
+                }
+                catch (err) {
+                    expectedError = err;
+                }
+                assertPreconditionFailed(expectedError);
+                // The stored content is unchanged: still the version-2 write.
+                const check = await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'GET'
+                });
+                assert.equal(check.status, 200);
+                assert.equal(check.data.name, 'v2');
+                assert.equal(check.headers.get('etag'), '"2"');
+            }
+        },
+        {
+            id: 'conditional.if-none-match-existing-412',
+            name: '[root] a PUT with `If-None-Match: *` against an existing Resource ' +
+                'returns 412 and does not overwrite',
+            specRefs: [
+                'https://wallet.storage/spec#conditional-requests',
+                'https://wallet.storage/spec#precondition-failed'
+            ],
+            run: async (ctx, state) => {
+                const { alice, collectionUrl, conditionalWritesSupported } = state;
+                if (!conditionalWritesSupported) {
+                    ctx.skip('backend does not advertise conditional-writes');
+                }
+                const resourceUrl = `${collectionUrl}if-none-match-existing`;
+                await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'PUT',
+                    action: 'PUT',
+                    json: { name: 'original' }
+                });
+                // create-if-absent against an existing Resource MUST 412.
+                let expectedError;
+                try {
+                    await alice.rootClient.request({
+                        url: resourceUrl,
+                        method: 'PUT',
+                        action: 'PUT',
+                        json: { name: 'overwrite' },
+                        headers: { 'if-none-match': '*' }
+                    });
+                }
+                catch (err) {
+                    expectedError = err;
+                }
+                assertPreconditionFailed(expectedError);
+                // The original content survives.
+                const check = await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'GET'
+                });
+                assert.equal(check.status, 200);
+                assert.equal(check.data.name, 'original');
+            }
+        },
+        {
+            id: 'conditional.current-if-match-succeeds',
+            name: '[root] a PUT with the current `If-Match` succeeds and advances the ' +
+                'ETag',
+            specRefs: ['https://wallet.storage/spec#conditional-requests'],
+            run: async (ctx, state) => {
+                const { alice, collectionUrl, conditionalWritesSupported } = state;
+                if (!conditionalWritesSupported) {
+                    ctx.skip('backend does not advertise conditional-writes');
+                }
+                const resourceUrl = `${collectionUrl}current-if-match`;
+                const created = await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'PUT',
+                    action: 'PUT',
+                    json: { name: 'v1' }
+                });
+                const currentEtag = created.headers.get('etag');
+                assert.equal(currentEtag, '"1"');
+                // The matching precondition is satisfied: the write proceeds and the
+                // strong validator advances.
+                const updated = await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'PUT',
+                    action: 'PUT',
+                    json: { name: 'v2' },
+                    headers: { 'if-match': currentEtag }
+                });
+                assert.equal(updated.status, 204);
+                assert.equal(updated.headers.get('etag'), '"2"');
+                const check = await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'GET'
+                });
+                assert.equal(check.data.name, 'v2');
+            }
+        },
+        {
+            id: 'conditional.if-none-match-create-succeeds',
+            name: '[root] a PUT with `If-None-Match: *` on a fresh id creates the ' +
+                'Resource',
+            specRefs: ['https://wallet.storage/spec#conditional-requests'],
+            run: async (ctx, state) => {
+                const { alice, collectionUrl, conditionalWritesSupported } = state;
+                if (!conditionalWritesSupported) {
+                    ctx.skip('backend does not advertise conditional-writes');
+                }
+                const resourceUrl = `${collectionUrl}if-none-match-create`;
+                // create-if-absent on an absent id proceeds.
+                const created = await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'PUT',
+                    action: 'PUT',
+                    json: { name: 'fresh' },
+                    headers: { 'if-none-match': '*' }
+                });
+                assert.equal(created.status, 204);
+                assert.equal(created.headers.get('etag'), '"1"');
+                const check = await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'GET'
+                });
+                assert.equal(check.status, 200);
+                assert.equal(check.data.name, 'fresh');
+            }
+        },
+        {
+            id: 'conditional.authz-before-precondition-404',
+            name: '[root] an under-authorized conditional PUT yields the 404 mask, ' +
+                'never 412',
+            specRefs: [
+                'https://wallet.storage/spec#conditional-requests',
+                'https://wallet.storage/spec#error-handling',
+                'https://wallet.storage/spec#not-found'
+            ],
+            run: async (ctx, state) => {
+                const { alice, bob, collectionUrl, conditionalWritesSupported } = state;
+                if (!conditionalWritesSupported) {
+                    ctx.skip('backend does not advertise conditional-writes');
+                }
+                const resourceUrl = `${collectionUrl}authz-before-precondition`;
+                // Alice owns an existing Resource.
+                await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'PUT',
+                    action: 'PUT',
+                    json: { name: 'alice-owned' }
+                });
+                // Bob -- who has no privilege over Alice's Space -- sends a conditional
+                // PUT with a stale validator. Authorization MUST run before the
+                // precondition, so Bob gets the 404 mask, never the existence-revealing
+                // 412.
+                let expectedError;
+                try {
+                    await bob.rootClient.request({
+                        url: resourceUrl,
+                        method: 'PUT',
+                        action: 'PUT',
+                        json: { name: 'bob-overwrite' },
+                        headers: { 'if-match': '"1"' }
+                    });
+                }
+                catch (err) {
+                    expectedError = err;
+                }
+                assertNotFoundMask(expectedError);
+                // The write was not performed: Alice still sees her content.
+                const check = await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'GET'
+                });
+                assert.equal(check.status, 200);
+                assert.equal(check.data.name, 'alice-owned');
+            }
+        },
+        {
+            id: 'conditional.get-carries-etag',
+            name: '[root] GET of a Resource carries an ETag that changes after the ' +
+                'content changes',
+            optional: true,
+            specRefs: [
+                'https://wallet.storage/spec#caching',
+                'https://wallet.storage/spec#conditional-requests'
+            ],
+            run: async (ctx, state) => {
+                const { alice, collectionUrl } = state;
+                const resourceUrl = `${collectionUrl}get-etag`;
+                await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'PUT',
+                    action: 'PUT',
+                    json: { name: 'v1' }
+                });
+                const first = await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'GET'
+                });
+                const firstEtag = first.headers.get('etag');
+                assert.ok(firstEtag, 'expected GET to carry an ETag');
+                await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'PUT',
+                    action: 'PUT',
+                    json: { name: 'v2' }
+                });
+                const second = await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'GET'
+                });
+                const secondEtag = second.headers.get('etag');
+                assert.ok(secondEtag, 'expected GET to carry an ETag');
+                // A strong validator changes whenever the stored content changes.
+                assert.notEqual(secondEtag, firstEtag);
+            }
+        },
+        {
+            id: 'conditional.head-carries-etag',
+            name: '[root] HEAD of a Resource carries an ETag that changes after the ' +
+                'content changes',
+            optional: true,
+            specRefs: [
+                'https://wallet.storage/spec#caching',
+                'https://wallet.storage/spec#conditional-requests'
+            ],
+            run: async (ctx, state) => {
+                const { alice, collectionUrl } = state;
+                const resourceUrl = `${collectionUrl}head-etag`;
+                await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'PUT',
+                    action: 'PUT',
+                    json: { name: 'v1' }
+                });
+                const first = await headResource({
+                    url: resourceUrl,
+                    invocationSigner: alice.rootClient.invocationSigner
+                });
+                assert.equal(first.status, 200);
+                const firstEtag = first.headers.get('etag');
+                assert.ok(firstEtag, 'expected HEAD to carry an ETag');
+                await alice.rootClient.request({
+                    url: resourceUrl,
+                    method: 'PUT',
+                    action: 'PUT',
+                    json: { name: 'v2' }
+                });
+                const second = await headResource({
+                    url: resourceUrl,
+                    invocationSigner: alice.rootClient.invocationSigner
+                });
+                assert.equal(second.status, 200);
+                const secondEtag = second.headers.get('etag');
+                assert.ok(secondEtag, 'expected HEAD to carry an ETag');
+                assert.notEqual(secondEtag, firstEtag);
+            }
+        }
+    ]
+};
+//# sourceMappingURL=conditional-requests-api.js.map

package/dist/suites/conditional-requests-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditional-requests-api.js","sourceRoot":"","sources":["../../src/suites/conditional-requests-api.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAA;AAE9E,OAAO,MAAM,MAAM,sBAAsB,CAAA;AAWzC;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,aAAkB;IAClD,MAAM,CAAC,EAAE,CAAC,aAAa,EAAE,iDAAiD,CAAC,CAAA;IAC3E,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAChD,MAAM,CAAC,KAAK,CACV,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAClD,4BAA4B,CAC7B,CAAA;IACD,MAAM,CAAC,KAAK,CACV,aAAa,CAAC,IAAI,CAAC,IAAI,EACvB,iDAAiD,CAClD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,aAAkB;IAC5C,MAAM,CAAC,EAAE,CAAC,aAAa,EAAE,6CAA6C,CAAC,CAAA;IACvE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAChD,MAAM,CAAC,KAAK,CACV,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAClD,4BAA4B,CAC7B,CAAA;IACD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAA;AAChF,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,YAAY,CAAC,EAC1B,GAAG,EACH,gBAAgB,EAIjB;IACC,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC;QACtD,GAAG;QACH,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;QAC3C,gBAAgB;QAChB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,GAAG,EAAE;QAChB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,gBAA0C;KACpD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAiB;IAClD,EAAE,EAAE,0BAA0B;IAC9B,IAAI,EAAE,gCAAgC;IACtC,QAAQ,EAAE;QACR,qCAAqC;QACrC,kDAAkD;KACnD;IAED,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;QACjB,MAAM,KAAK,GAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAC1C,MAAM,GAAG,GAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAA;QACtC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,CAAA;QACvC,MAAM,GAAG,CAAC,WAAW,CAAC;YACpB,gBAAgB,EAAE;gBAChB,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;gBACnB,IAAI,EAAE,oCAAoC;gBAC1C,UAAU,EAAE,KAAK,CAAC,GAAG;aACtB;YACD,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAA;QACF,0DAA0D;QAC1D,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;YAC7B,GAAG,EAAE,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;SACrC,CAAC,CAAA;QACF,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,EAClC,GAAG,CAAC,SAAS,CACd,CAAC,QAAQ,EAAE,CAAA;QAEZ,yEAAyE;QACzE,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;YACtD,GAAG,EAAE,IAAI,GAAG,CACV,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EACpC,GAAG,CAAC,SAAS,CACd,CAAC,QAAQ,EAAE;YACZ,MAAM,EAAE,KAAK;SACd,CAAC,CAAA;QACF,MAAM,QAAQ,GAAU,gBAAgB,CAAC,IAAI,CAAA;QAC7C,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAA;QACzE,MAAM,0BAA0B,GAAG,OAAO,CACxC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CACzD,CAAA;QAED,OAAO;YACL,KAAK;YACL,GAAG;YACH,aAAa;YACb,0BAA0B;YAC1B,cAAc;SACf,CAAA;IACH,CAAC;IAED,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;QACvB,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC7B,GAAG,EAAE,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;gBACnE,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,EAAE;QACL;YACE,EAAE,EAAE,mDAAmD;YACvD,IAAI,EACF,uDAAuD;gBACvD,8BAA8B;YAChC,QAAQ,EAAE;gBACR,kDAAkD;gBAClD,gDAAgD;aACjD;YACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBACxB,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAA;gBAChC,MAAM,CAAC,EAAE,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAA;gBACpE,MAAM,CAAC,EAAE,CACP,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,EACtC,6DAA6D,CAC9D,CAAA;gBACD,MAAM,CAAC,EAAE,CACP,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EACtD,+DAA+D,CAChE,CAAA;YACH,CAAC;SACF;QACD;YACE,EAAE,EAAE,gCAAgC;YACpC,IAAI,EACF,qEAAqE;gBACrE,yBAAyB;YAC3B,QAAQ,EAAE;gBACR,kDAAkD;gBAClD,iDAAiD;aAClD;YACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBACxB,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,GAAG,KAAK,CAAA;gBAClE,IAAI,CAAC,0BAA0B,EAAE,CAAC;oBAChC,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;gBAC3D,CAAC;gBACD,MAAM,WAAW,GAAG,GAAG,aAAa,gBAAgB,CAAA;gBAEpD,kEAAkE;gBAClE,sCAAsC;gBACtC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC7C,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;iBACrB,CAAC,CAAA;gBACF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBAC7C,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;gBAC9B,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC7B,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;iBACrB,CAAC,CAAA;gBAEF,kEAAkE;gBAClE,IAAI,aAAkB,CAAA;gBACtB,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;wBAC7B,GAAG,EAAE,WAAW;wBAChB,MAAM,EAAE,KAAK;wBACb,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;wBACpB,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;qBACnC,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,aAAa,GAAG,GAAG,CAAA;gBACrB,CAAC;gBACD,wBAAwB,CAAC,aAAa,CAAC,CAAA;gBAEvC,8DAA8D;gBAC9D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC3C,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;iBACd,CAAC,CAAA;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;gBAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBACnC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAA;YAChD,CAAC;SACF;QACD;YACE,EAAE,EAAE,wCAAwC;YAC5C,IAAI,EACF,oEAAoE;gBACpE,oCAAoC;YACtC,QAAQ,EAAE;gBACR,kDAAkD;gBAClD,iDAAiD;aAClD;YACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBACxB,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,GAAG,KAAK,CAAA;gBAClE,IAAI,CAAC,0BAA0B,EAAE,CAAC;oBAChC,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;gBAC3D,CAAC;gBACD,MAAM,WAAW,GAAG,GAAG,aAAa,wBAAwB,CAAA;gBAE5D,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC7B,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;iBAC3B,CAAC,CAAA;gBAEF,0DAA0D;gBAC1D,IAAI,aAAkB,CAAA;gBACtB,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;wBAC7B,GAAG,EAAE,WAAW;wBAChB,MAAM,EAAE,KAAK;wBACb,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;wBAC3B,OAAO,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE;qBAClC,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,aAAa,GAAG,GAAG,CAAA;gBACrB,CAAC;gBACD,wBAAwB,CAAC,aAAa,CAAC,CAAA;gBAEvC,iCAAiC;gBACjC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC3C,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;iBACd,CAAC,CAAA;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;gBAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;YAC3C,CAAC;SACF;QACD;YACE,EAAE,EAAE,uCAAuC;YAC3C,IAAI,EACF,qEAAqE;gBACrE,MAAM;YACR,QAAQ,EAAE,CAAC,kDAAkD,CAAC;YAC9D,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBACxB,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,GAAG,KAAK,CAAA;gBAClE,IAAI,CAAC,0BAA0B,EAAE,CAAC;oBAChC,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;gBAC3D,CAAC;gBACD,MAAM,WAAW,GAAG,GAAG,aAAa,kBAAkB,CAAA;gBAEtD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC7C,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;iBACrB,CAAC,CAAA;gBACF,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBAC/C,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;gBAEhC,qEAAqE;gBACrE,6BAA6B;gBAC7B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC7C,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;oBACpB,OAAO,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;iBACrC,CAAC,CAAA;gBACF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;gBACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAA;gBAEhD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC3C,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;iBACd,CAAC,CAAA;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACrC,CAAC;SACF;QACD;YACE,EAAE,EAAE,2CAA2C;YAC/C,IAAI,EACF,iEAAiE;gBACjE,UAAU;YACZ,QAAQ,EAAE,CAAC,kDAAkD,CAAC;YAC9D,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBACxB,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,GAAG,KAAK,CAAA;gBAClE,IAAI,CAAC,0BAA0B,EAAE,CAAC;oBAChC,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;gBAC3D,CAAC;gBACD,MAAM,WAAW,GAAG,GAAG,aAAa,sBAAsB,CAAA;gBAE1D,6CAA6C;gBAC7C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC7C,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;oBACvB,OAAO,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE;iBAClC,CAAC,CAAA;gBACF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;gBACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAA;gBAEhD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC3C,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;iBACd,CAAC,CAAA;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;gBAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACxC,CAAC;SACF;QACD;YACE,EAAE,EAAE,2CAA2C;YAC/C,IAAI,EACF,kEAAkE;gBAClE,WAAW;YACb,QAAQ,EAAE;gBACR,kDAAkD;gBAClD,4CAA4C;gBAC5C,uCAAuC;aACxC;YACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBACxB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,0BAA0B,EAAE,GAAG,KAAK,CAAA;gBACvE,IAAI,CAAC,0BAA0B,EAAE,CAAC;oBAChC,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;gBAC3D,CAAC;gBACD,MAAM,WAAW,GAAG,GAAG,aAAa,2BAA2B,CAAA;gBAE/D,mCAAmC;gBACnC,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC7B,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;iBAC9B,CAAC,CAAA;gBAEF,wEAAwE;gBACxE,gEAAgE;gBAChE,wEAAwE;gBACxE,OAAO;gBACP,IAAI,aAAkB,CAAA;gBACtB,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;wBAC3B,GAAG,EAAE,WAAW;wBAChB,MAAM,EAAE,KAAK;wBACb,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;wBAC/B,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;qBAC/B,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,aAAa,GAAG,GAAG,CAAA;gBACrB,CAAC;gBACD,kBAAkB,CAAC,aAAa,CAAC,CAAA;gBAEjC,6DAA6D;gBAC7D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC3C,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;iBACd,CAAC,CAAA;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;gBAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;YAC9C,CAAC;SACF;QACD;YACE,EAAE,EAAE,8BAA8B;YAClC,IAAI,EACF,kEAAkE;gBAClE,iBAAiB;YACnB,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE;gBACR,qCAAqC;gBACrC,kDAAkD;aACnD;YACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBACxB,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,KAAK,CAAA;gBACtC,MAAM,WAAW,GAAG,GAAG,aAAa,UAAU,CAAA;gBAE9C,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC7B,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;iBACrB,CAAC,CAAA;gBACF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC3C,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;iBACd,CAAC,CAAA;gBACF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBAC3C,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAA;gBAErD,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC7B,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;iBACrB,CAAC,CAAA;gBACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC5C,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;iBACd,CAAC,CAAA;gBACF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBAC7C,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAA;gBAEtD,kEAAkE;gBAClE,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;YACxC,CAAC;SACF;QACD;YACE,EAAE,EAAE,+BAA+B;YACnC,IAAI,EACF,mEAAmE;gBACnE,iBAAiB;YACnB,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE;gBACR,qCAAqC;gBACrC,kDAAkD;aACnD;YACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBACxB,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,KAAK,CAAA;gBACtC,MAAM,WAAW,GAAG,GAAG,aAAa,WAAW,CAAA;gBAE/C,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC7B,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;iBACrB,CAAC,CAAA;gBACF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC;oBAC/B,GAAG,EAAE,WAAW;oBAChB,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;iBACpD,CAAC,CAAA;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;gBAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBAC3C,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAA;gBAEtD,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC7B,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;iBACrB,CAAC,CAAA;gBACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;oBAChC,GAAG,EAAE,WAAW;oBAChB,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;iBACpD,CAAC,CAAA;gBACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;gBAChC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBAC7C,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,gCAAgC,CAAC,CAAA;gBAEvD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;YACxC,CAAC;SACF;KACF;CACF,CAAA"}

package/dist/suites/digest-api.d.ts

@@ -0,0 +1,7 @@
+import type { Suite } from '../harness/types.js';
+interface State {
+    alice: any;
+}
+export declare const digestApi: Suite<State>;
+export {};
+//# sourceMappingURL=digest-api.d.ts.map

package/dist/suites/digest-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest-api.d.ts","sourceRoot":"","sources":["../../src/suites/digest-api.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAEhD,UAAU,KAAK;IACb,KAAK,EAAE,GAAG,CAAA;CACX;AAwBD,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,KAAK,CAsIlC,CAAA"}

package/dist/suites/digest-api.js

@@ -0,0 +1,157 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * WAS conformance tests -- request-body integrity (Digest) negatives.
+ *
+ * The spec's "Request Body Integrity (Digest Header)" profile binds a request
+ * body to its HTTP Signature: for any request carrying a `Content-Type`, the
+ * server MUST require `digest` among the signature's covered headers, and
+ * SHOULD independently recompute the digest of the received body and compare
+ * it. Both failures are rejected with `invalid-authorization-header` (400).
+ * A well-behaved client never produces such requests, so these tests sign
+ * with the low-level `signCapabilityInvocation` primitive and send the
+ * malformed request with a raw `fetch`.
+ */
+import { createHeaderValue } from '@interop/http-digest-header';
+import { signCapabilityInvocation } from '@interop/http-signature-zcap-invoke';
+import assert from '../harness/assert.js';
+/**
+ * Asserts a rejected request reports the digest-binding failure: status 400,
+ * `application/problem+json`, and the `invalid-authorization-header` type
+ * (the registry's single type for all authorization-header failures).
+ *
+ * @param response {Response}   the raw fetch response
+ */
+async function assertInvalidAuthorizationHeader(response) {
+    assert.equal(response.status, 400);
+    assert.match(response.headers.get('content-type') ?? '', /application\/problem\+json/);
+    const problem = await response.json();
+    assert.equal(problem.type, 'https://wallet.storage/spec#invalid-authorization-header');
+}
+export const digestApi = {
+    id: 'digest-api',
+    name: 'Request body integrity (Digest) negatives',
+    specRefs: [
+        'https://wallet.storage/spec#request-body-integrity-digest-header'
+    ],
+    setup: async (ctx) => {
+        const alice = { ...ctx.actors.alice };
+        alice.space1 = { id: ctx.generateId() };
+        await ctx.createSpace({
+            spaceDescription: {
+                id: alice.space1.id,
+                name: "Alice's Digest Space",
+                controller: alice.did
+            },
+            rootClient: alice.rootClient
+        });
+        await alice.rootClient.request({
+            url: new URL(`/space/${alice.space1.id}/`, ctx.serverUrl).toString(),
+            method: 'POST',
+            action: 'POST',
+            json: { id: 'docs', name: 'Documents' }
+        });
+        return { alice };
+    },
+    teardown: async (ctx, state) => {
+        const { alice } = state;
+        try {
+            await alice.rootClient.request({
+                url: new URL(`/space/${alice.space1.id}`, ctx.serverUrl).toString(),
+                method: 'DELETE'
+            });
+        }
+        catch {
+            /* best-effort cleanup */
+        }
+    },
+    tests: [
+        {
+            id: 'digest.signature-not-covering-digest',
+            name: '[root] a signed body request whose signature does not cover the ' +
+                '`digest` header is rejected with 400 invalid-authorization-header',
+            specRefs: [
+                'https://wallet.storage/spec#request-body-integrity-digest-header',
+                'https://wallet.storage/spec#invalid-authorization-header'
+            ],
+            run: async (ctx, state) => {
+                const { serverUrl } = ctx;
+                const { alice } = state;
+                const url = new URL(`/space/${alice.space1.id}/docs/${ctx.generateId()}`, serverUrl).toString();
+                const body = JSON.stringify({ name: 'Uncovered Digest Probe' });
+                // Sign as if the request were bodyless: a valid signature whose
+                // covered headers omit `content-type` and `digest`.
+                const signatureHeaders = await signCapabilityInvocation({
+                    url,
+                    method: 'PUT',
+                    headers: { date: new Date().toUTCString() },
+                    invocationSigner: alice.rootClient.invocationSigner,
+                    capabilityAction: 'PUT'
+                });
+                // The `Digest` header itself is present and correct for the body sent
+                // -- only its signature coverage is missing, which the server MUST
+                // require for any request carrying a `Content-Type`.
+                const digest = await createHeaderValue({
+                    data: body,
+                    algorithm: 'sha256',
+                    useMultihash: true
+                });
+                const response = await fetch(url, {
+                    method: 'PUT',
+                    headers: {
+                        ...signatureHeaders,
+                        'content-type': 'application/json',
+                        digest
+                    },
+                    body
+                });
+                await assertInvalidAuthorizationHeader(response);
+            }
+        },
+        {
+            id: 'digest.body-tampered-after-signing',
+            name: '[root] a request whose body does not match its signed `digest` ' +
+                '(tampered after signing) is rejected with 400',
+            // Independent recomputation of the received body's digest is a SHOULD.
+            optional: true,
+            specRefs: [
+                'https://wallet.storage/spec#request-body-integrity-digest-header',
+                'https://wallet.storage/spec#invalid-authorization-header'
+            ],
+            run: async (ctx, state) => {
+                const { serverUrl } = ctx;
+                const { alice } = state;
+                const url = new URL(`/space/${alice.space1.id}/docs/${ctx.generateId()}`, serverUrl).toString();
+                // A fully well-formed signing of the original body: the signature
+                // covers `digest`, and the `Digest` header matches the original.
+                const signatureHeaders = await signCapabilityInvocation({
+                    url,
+                    method: 'PUT',
+                    headers: { date: new Date().toUTCString() },
+                    json: { name: 'Original Body' },
+                    invocationSigner: alice.rootClient.invocationSigner,
+                    capabilityAction: 'PUT'
+                });
+                // ...but the body actually sent was swapped after signing.
+                const response = await fetch(url, {
+                    method: 'PUT',
+                    headers: signatureHeaders,
+                    body: JSON.stringify({ name: 'Tampered Body' })
+                });
+                await assertInvalidAuthorizationHeader(response);
+                // The tampered write must not have been performed.
+                let expectedError;
+                try {
+                    await alice.rootClient.request({ url, method: 'GET' });
+                }
+                catch (err) {
+                    expectedError = err;
+                }
+                assert.ok(expectedError, 'expected the tampered resource to not exist');
+                assert.equal(expectedError.response.status, 404);
+            }
+        }
+    ]
+};
+//# sourceMappingURL=digest-api.js.map

package/dist/suites/digest-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest-api.js","sourceRoot":"","sources":["../../src/suites/digest-api.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAA;AAC9E,OAAO,MAAM,MAAM,sBAAsB,CAAA;AAOzC;;;;;;GAMG;AACH,KAAK,UAAU,gCAAgC,CAC7C,QAAkB;IAElB,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClC,MAAM,CAAC,KAAK,CACV,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAC1C,4BAA4B,CAC7B,CAAA;IACD,MAAM,OAAO,GAAQ,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC1C,MAAM,CAAC,KAAK,CACV,OAAO,CAAC,IAAI,EACZ,0DAA0D,CAC3D,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAiB;IACrC,EAAE,EAAE,YAAY;IAChB,IAAI,EAAE,2CAA2C;IACjD,QAAQ,EAAE;QACR,kEAAkE;KACnE;IAED,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;QACjB,MAAM,KAAK,GAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QAC1C,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,CAAA;QACvC,MAAM,GAAG,CAAC,WAAW,CAAC;YACpB,gBAAgB,EAAE;gBAChB,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;gBACnB,IAAI,EAAE,sBAAsB;gBAC5B,UAAU,EAAE,KAAK,CAAC,GAAG;aACtB;YACD,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAA;QACF,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;YAC7B,GAAG,EAAE,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;SACxC,CAAC,CAAA;QACF,OAAO,EAAE,KAAK,EAAE,CAAA;IAClB,CAAC;IAED,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;QACvB,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC7B,GAAG,EAAE,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;gBACnE,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,EAAE;QACL;YACE,EAAE,EAAE,sCAAsC;YAC1C,IAAI,EACF,kEAAkE;gBAClE,mEAAmE;YACrE,QAAQ,EAAE;gBACR,kEAAkE;gBAClE,0DAA0D;aAC3D;YACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBACxB,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAA;gBACzB,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;gBACvB,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EAAE,EACpD,SAAS,CACV,CAAC,QAAQ,EAAE,CAAA;gBACZ,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAA;gBAC/D,gEAAgE;gBAChE,oDAAoD;gBACpD,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC;oBACtD,GAAG;oBACH,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;oBAC3C,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;oBACnD,gBAAgB,EAAE,KAAK;iBACxB,CAAC,CAAA;gBACF,sEAAsE;gBACtE,mEAAmE;gBACnE,qDAAqD;gBACrD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;oBACrC,IAAI,EAAE,IAAI;oBACV,SAAS,EAAE,QAAQ;oBACnB,YAAY,EAAE,IAAI;iBACnB,CAAC,CAAA;gBACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAChC,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE;wBACP,GAAI,gBAA2C;wBAC/C,cAAc,EAAE,kBAAkB;wBAClC,MAAM;qBACP;oBACD,IAAI;iBACL,CAAC,CAAA;gBACF,MAAM,gCAAgC,CAAC,QAAQ,CAAC,CAAA;YAClD,CAAC;SACF;QACD;YACE,EAAE,EAAE,oCAAoC;YACxC,IAAI,EACF,iEAAiE;gBACjE,+CAA+C;YACjD,uEAAuE;YACvE,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE;gBACR,kEAAkE;gBAClE,0DAA0D;aAC3D;YACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBACxB,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAA;gBACzB,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;gBACvB,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EAAE,EACpD,SAAS,CACV,CAAC,QAAQ,EAAE,CAAA;gBACZ,kEAAkE;gBAClE,iEAAiE;gBACjE,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC;oBACtD,GAAG;oBACH,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;oBAC3C,IAAI,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;oBAC/B,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;oBACnD,gBAAgB,EAAE,KAAK;iBACxB,CAAC,CAAA;gBACF,2DAA2D;gBAC3D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAChC,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,gBAA0C;oBACnD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;iBAChD,CAAC,CAAA;gBACF,MAAM,gCAAgC,CAAC,QAAQ,CAAC,CAAA;gBAEhD,mDAAmD;gBACnD,IAAI,aAAkB,CAAA;gBACtB,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;gBACxD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,aAAa,GAAG,GAAG,CAAA;gBACrB,CAAC;gBACD,MAAM,CAAC,EAAE,CAAC,aAAa,EAAE,6CAA6C,CAAC,CAAA;gBACvE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAClD,CAAC;SACF;KACF;CACF,CAAA"}

package/dist/suites/encryption-marker-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption-marker-api.d.ts","sourceRoot":"","sources":["../../src/suites/encryption-marker-api.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAgBhD,UAAU,KAAK;IACb,KAAK,EAAE,GAAG,CAAA;IACV,GAAG,EAAE,GAAG,CAAA;IACR,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;CACjD;AAED,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAoS5C,CAAA"}
+{"version":3,"file":"encryption-marker-api.d.ts","sourceRoot":"","sources":["../../src/suites/encryption-marker-api.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAgBhD,UAAU,KAAK;IACb,KAAK,EAAE,GAAG,CAAA;IACV,GAAG,EAAE,GAAG,CAAA;IACR,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;CACjD;AAED,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAqb5C,CAAA"}