@interop/was-conformance-suite 0.9.0 → 0.11.0

package/dist/suites/governed-log-api.js

@@ -0,0 +1,692 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * WAS conformance tests -- a Collection's governing history log (the
+ * `governed-history-logs` feature).
+ *
+ * The log is the sub-resource `/space/{space}/{collection}/meta/log`: a JSON
+ * Lines body whose last line is the head entry, and whose head `state` the
+ * server serves as the Collection's `encryption` descriptor with a
+ * `history: { method, resource }` member stamped on. A Collection becomes
+ * governed by the guarded create of its log (`PUT` with `If-None-Match: *`);
+ * later writes are compare-and-swap appends (`If-Match` carrying the prior
+ * bytes plus one new line), 412 on a lost race. The server verifies neither
+ * entry proofs nor the hash chain; it checks the line contract and runs the
+ * encryption descriptor's transition checks between the prior head and the
+ * new one.
+ *
+ * The feature is OPTIONAL, gated on a backend advertising the
+ * `governed-history-logs` token in its Backend description. Rather than mark
+ * the whole suite optional, setup() probes the Space's backend list for the
+ * token and each test skips when it is absent; once advertised, the behaviors
+ * below are MUST-level and run at the required tier.
+ *
+ * The log is written and read through raw `fetch` over the low-level signing
+ * primitive: the body is `text/jsonl` (not JSON, which the high-level clients
+ * would parse), and a 304 or a problem response is read like any other.
+ */
+import { signCapabilityInvocation } from '@interop/http-signature-zcap-invoke';
+import assert from '../harness/assert.js';
+/**
+ * A minimal conforming EDV Encrypted Document envelope, the stored
+ * representation an `edv` (encrypted) Collection requires for a Resource.
+ */
+const edvDocument = {
+    id: 'z1',
+    sequence: 0,
+    indexed: [],
+    jwe: { protected: 'eyJhbGciOiJkaXI', ciphertext: 'c1phertext' }
+};
+/**
+ * A descriptor recipient entry (the JWE recipients-entry shape).
+ *
+ * @param kid {string}
+ * @returns {object}
+ */
+function recipient(kid) {
+    return {
+        header: { kid, alg: 'ECDH-ES+A256KW' },
+        encrypted_key: `wrapped-${kid}`
+    };
+}
+/** A one-epoch `edv` key-epoch descriptor, the genesis head state. */
+const oneEpoch = {
+    type: 'WasEpochConfiguration',
+    scheme: 'edv',
+    currentEpoch: 'urn:epoch:1',
+    epochs: [{ id: 'urn:epoch:1', recipients: [recipient('did:key:zApp1#ka')] }]
+};
+/** The same descriptor after one rotation: a second, newer epoch. */
+const twoEpochs = {
+    ...oneEpoch,
+    currentEpoch: 'urn:epoch:2',
+    epochs: [
+        { id: 'urn:epoch:2', recipients: [recipient('did:key:zApp2#ka')] },
+        ...oneEpoch.epochs
+    ]
+};
+/**
+ * One log entry line: the resource-log entry members with `state` as given.
+ * The server reads only `state` (and the genesis `parameters.method`); the
+ * rest is the profile's business and is not verified here.
+ *
+ * @param options {object}
+ * @param options.ordinal {number}
+ * @param options.state {object}
+ * @param [options.parameters] {object}
+ * @returns {string}
+ */
+function entryLine({ ordinal, state, parameters = {} }) {
+    return JSON.stringify({
+        versionId: `${ordinal}-hash${ordinal}`,
+        versionTime: '2026-09-07T00:00:00Z',
+        parameters,
+        state,
+        proof: []
+    });
+}
+/**
+ * The genesis line, carrying the format identifier and the SCID.
+ *
+ * @param state {object}
+ * @returns {string}
+ */
+function genesisLine(state) {
+    return entryLine({
+        ordinal: 1,
+        state,
+        parameters: { method: 'resource-log:0.1', scid: 'zScid' }
+    });
+}
+/**
+ * Asserts a response is a problem document of the given status whose `type`
+ * ends in the given registry anchor.
+ *
+ * @param options {object}
+ * @param options.response {Response}
+ * @param options.status {number}
+ * @param options.type {string}   the problem-type anchor, e.g. `not-found`
+ * @returns {Promise<any>}   the parsed problem document
+ */
+async function assertProblem({ response, status, type }) {
+    assert.equal(response.status, status);
+    assert.match(response.headers.get('content-type') ?? '', /application\/problem\+json/);
+    const problem = await response.json();
+    assert.equal(problem.type, `https://wallet.storage/spec#${type}`);
+    return problem;
+}
+export const governedLogApi = {
+    id: 'governed-log-api',
+    name: 'Governing history log API',
+    specRefs: ['https://wallet.storage/spec#collection-data-model'],
+    setup: async (ctx) => {
+        const alice = { ...ctx.actors.alice };
+        const bob = { ...ctx.actors.bob };
+        alice.space1 = { id: ctx.generateId() };
+        await ctx.createSpace({
+            spaceDescription: {
+                id: alice.space1.id,
+                name: "Alice's Governed Log Space",
+                controller: alice.did
+            },
+            rootClient: alice.rootClient
+        });
+        function collectionUrl(collectionId) {
+            return new URL(`/space/${alice.space1.id}/${collectionId}`, ctx.serverUrl).toString();
+        }
+        function logUrl(collectionId) {
+            return `${collectionUrl(collectionId)}/meta/log`;
+        }
+        async function freshCollection(body = {}) {
+            const collectionId = `col-${ctx.generateId()}`;
+            await alice.rootClient.request({
+                url: new URL(`/space/${alice.space1.id}/`, ctx.serverUrl).toString(),
+                method: 'POST',
+                action: 'POST',
+                json: { id: collectionId, name: collectionId, ...body }
+            });
+            return collectionId;
+        }
+        async function putLog({ collectionId, body, headers = {} }) {
+            const url = logUrl(collectionId);
+            const bytes = new TextEncoder().encode(body);
+            const signatureHeaders = await signCapabilityInvocation({
+                url,
+                method: 'PUT',
+                headers: {
+                    date: new Date().toUTCString(),
+                    'content-type': 'text/jsonl'
+                },
+                invocationSigner: alice.signer,
+                capabilityAction: 'PUT',
+                body: bytes
+            });
+            // The precondition headers describe the request, not the capability
+            // target, so they ride outside the signature. The cast is fetch's
+            // `BodyInit` typing rejecting a bare `Uint8Array` (a lib variance quirk).
+            return fetch(url, {
+                method: 'PUT',
+                headers: {
+                    ...signatureHeaders,
+                    ...headers
+                },
+                body: bytes
+            });
+        }
+        async function getLog({ collectionId, headers = {}, invocationSigner = alice.signer, capability }) {
+            const url = logUrl(collectionId);
+            const signatureHeaders = await signCapabilityInvocation({
+                url,
+                method: 'GET',
+                headers: { date: new Date().toUTCString() },
+                invocationSigner,
+                capabilityAction: 'GET',
+                ...(capability !== undefined && { capability })
+            });
+            return fetch(url, {
+                method: 'GET',
+                headers: { ...signatureHeaders, ...headers }
+            });
+        }
+        async function governedCollection() {
+            const collectionId = await freshCollection();
+            const body = genesisLine(oneEpoch) + '\n';
+            const created = await putLog({
+                collectionId,
+                body,
+                headers: { 'if-none-match': '*' }
+            });
+            assert.equal(created.status, 204, await created.text());
+            const etag = created.headers.get('etag');
+            assert.ok(etag, 'expected the guarded create to return an ETag');
+            return { collectionId, body, etag };
+        }
+        // Discover whether any of the Space's backends advertises
+        // `governed-history-logs` (spec "Backends"). Absent the token the
+        // sub-resource is OPTIONAL and each test skips.
+        const backendsResponse = await alice.rootClient.request({
+            url: new URL(`/space/${alice.space1.id}/backends`, ctx.serverUrl).toString(),
+            method: 'GET'
+        });
+        const backends = Array.isArray(backendsResponse.data)
+            ? backendsResponse.data
+            : (backendsResponse.data?.backends ?? []);
+        const governedSupported = backends.some(backend => backend.features?.includes('governed-history-logs'));
+        return {
+            alice,
+            bob,
+            governedSupported,
+            collectionUrl,
+            logUrl,
+            freshCollection,
+            governedCollection,
+            putLog,
+            getLog
+        };
+    },
+    teardown: async (ctx, state) => {
+        const { alice } = state;
+        try {
+            await alice.rootClient.request({
+                url: new URL(`/space/${alice.space1.id}`, ctx.serverUrl).toString(),
+                method: 'DELETE'
+            });
+        }
+        catch {
+            /* best-effort cleanup */
+        }
+    },
+    tests: [
+        {
+            id: 'governed-log.guarded-create-derives-encryption',
+            name: '[root] a guarded create governs the Collection: encryption is the head state plus history',
+            run: async (ctx, state) => {
+                const { alice, collectionUrl, logUrl, governedCollection } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const { collectionId } = await governedCollection();
+                const expected = {
+                    ...oneEpoch,
+                    history: {
+                        method: 'resource-log:0.1',
+                        resource: logUrl(collectionId)
+                    }
+                };
+                const described = await alice.rootClient.request({
+                    url: collectionUrl(collectionId),
+                    method: 'GET'
+                });
+                assert.deepStrictEqual(described.data.encryption, expected);
+            }
+        },
+        {
+            id: 'governed-log.read-verbatim-with-etag',
+            name: '[root] the log reads back verbatim as text/jsonl with the ETag the create returned',
+            run: async (ctx, state) => {
+                const { getLog, governedCollection } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const { collectionId, body, etag } = await governedCollection();
+                const read = await getLog({ collectionId });
+                assert.equal(read.status, 200);
+                assert.match(read.headers.get('content-type') ?? '', /^text\/jsonl/);
+                assert.equal(read.headers.get('etag'), etag);
+                assert.equal(await read.text(), body);
+            }
+        },
+        {
+            id: 'governed-log.conditional-read-304',
+            name: '[root] a log GET with a matching If-None-Match is 304 with the ETag and no body',
+            optional: true,
+            specRefs: ['https://wallet.storage/spec#caching'],
+            run: async (ctx, state) => {
+                const { getLog, governedCollection } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const { collectionId, etag } = await governedCollection();
+                const conditional = await getLog({
+                    collectionId,
+                    headers: { 'if-none-match': etag }
+                });
+                assert.equal(conditional.status, 304);
+                assert.equal(conditional.headers.get('etag'), etag);
+                assert.equal(await conditional.text(), '');
+            }
+        },
+        {
+            id: 'governed-log.missing-log-404',
+            name: '[root] a Collection with no log is 404 on the log read, and a nonexistent Collection is 404 on the log write',
+            run: async (ctx, state) => {
+                const { freshCollection, getLog, putLog } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const collectionId = await freshCollection();
+                await assertProblem({
+                    response: await getLog({ collectionId }),
+                    status: 404,
+                    type: 'not-found'
+                });
+                // A log write never creates the Collection it would govern.
+                await assertProblem({
+                    response: await putLog({
+                        collectionId: `absent-${ctx.generateId()}`,
+                        body: genesisLine(oneEpoch) + '\n',
+                        headers: { 'if-none-match': '*' }
+                    }),
+                    status: 404,
+                    type: 'not-found'
+                });
+            }
+        },
+        {
+            id: 'governed-log.append-compare-and-swap',
+            name: '[root] an If-Match append lands, bumps the log ETag, and moves the derived member to the new head',
+            run: async (ctx, state) => {
+                const { alice, collectionUrl, putLog, governedCollection } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const { collectionId, body, etag } = await governedCollection();
+                const before = await alice.rootClient.request({
+                    url: collectionUrl(collectionId),
+                    method: 'GET'
+                });
+                const extended = body + entryLine({ ordinal: 2, state: twoEpochs }) + '\n';
+                const appended = await putLog({
+                    collectionId,
+                    body: extended,
+                    headers: { 'if-match': etag }
+                });
+                assert.equal(appended.status, 204, await appended.text());
+                const newEtag = appended.headers.get('etag');
+                assert.ok(newEtag, 'expected the append to return an ETag');
+                assert.notEqual(newEtag, etag);
+                const after = await alice.rootClient.request({
+                    url: collectionUrl(collectionId),
+                    method: 'GET'
+                });
+                assert.equal(after.data.encryption.currentEpoch, 'urn:epoch:2');
+                assert.equal(after.data.encryption.epochs.length, 2);
+                // The Description's own ETag moves too: its served content changed.
+                assert.notEqual(after.headers.get('etag'), before.headers.get('etag'), 'expected a log append to bump the Collection Description ETag');
+            }
+        },
+        {
+            id: 'governed-log.stale-if-match-412',
+            name: '[root] a stale If-Match append is 412 precondition-failed and the log is unchanged',
+            specRefs: ['https://wallet.storage/spec#precondition-failed'],
+            run: async (ctx, state) => {
+                const { getLog, putLog, governedCollection } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const { collectionId, body, etag } = await governedCollection();
+                const extended = body + entryLine({ ordinal: 2, state: twoEpochs }) + '\n';
+                const won = await putLog({
+                    collectionId,
+                    body: extended,
+                    headers: { 'if-match': etag }
+                });
+                assert.equal(won.status, 204);
+                const winnerEtag = won.headers.get('etag');
+                const lost = await putLog({
+                    collectionId,
+                    body: extended,
+                    headers: { 'if-match': etag }
+                });
+                await assertProblem({
+                    response: lost,
+                    status: 412,
+                    type: 'precondition-failed'
+                });
+                const read = await getLog({ collectionId });
+                assert.equal(read.headers.get('etag'), winnerEtag);
+                assert.equal(await read.text(), extended);
+            }
+        },
+        {
+            id: 'governed-log.guarded-create-existing-412',
+            name: '[root] a guarded create on an existing log is 412 precondition-failed',
+            specRefs: ['https://wallet.storage/spec#precondition-failed'],
+            run: async (ctx, state) => {
+                const { putLog, governedCollection } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const { collectionId, body } = await governedCollection();
+                await assertProblem({
+                    response: await putLog({
+                        collectionId,
+                        body,
+                        headers: { 'if-none-match': '*' }
+                    }),
+                    status: 412,
+                    type: 'precondition-failed'
+                });
+            }
+        },
+        {
+            id: 'governed-log.direct-encryption-write-refused',
+            name: '[root] a direct encryption write on a governed Collection is 409 encryption-history-log-governed',
+            specRefs: ['https://wallet.storage/spec#encryption-history-log-governed'],
+            run: async (ctx, state) => {
+                const { alice, collectionUrl, governedCollection } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const { collectionId } = await governedCollection();
+                let expectedError;
+                try {
+                    await alice.rootClient.request({
+                        url: collectionUrl(collectionId),
+                        method: 'PUT',
+                        action: 'PUT',
+                        json: { id: collectionId, encryption: twoEpochs }
+                    });
+                }
+                catch (err) {
+                    expectedError = err;
+                }
+                assert.ok(expectedError, 'expected the direct write to be refused');
+                assert.equal(expectedError.response.status, 409);
+                assert.equal(expectedError.data.type, 'https://wallet.storage/spec#encryption-history-log-governed');
+                // The descriptor is untouched, and a Description update that leaves
+                // `encryption` alone still lands.
+                const described = await alice.rootClient.request({
+                    url: collectionUrl(collectionId),
+                    method: 'GET'
+                });
+                assert.equal(described.data.encryption.currentEpoch, 'urn:epoch:1');
+                const renamed = await alice.rootClient.request({
+                    url: collectionUrl(collectionId),
+                    method: 'PUT',
+                    action: 'PUT',
+                    json: { id: collectionId, name: 'Renamed' }
+                });
+                assert.equal(renamed.status, 204);
+                const reread = await alice.rootClient.request({
+                    url: collectionUrl(collectionId),
+                    method: 'GET'
+                });
+                assert.equal(reread.data.name, 'Renamed');
+                assert.equal(reread.data.encryption.currentEpoch, 'urn:epoch:1');
+            }
+        },
+        {
+            id: 'governed-log.epoch-violation-refused',
+            name: '[root] an append that drops an epoch or moves currentEpoch back is refused and the log is unchanged',
+            specRefs: ['https://wallet.storage/spec#collection-data-model'],
+            run: async (ctx, state) => {
+                const { freshCollection, getLog, putLog } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const collectionId = await freshCollection();
+                const body = genesisLine(twoEpochs) + '\n';
+                const created = await putLog({
+                    collectionId,
+                    body,
+                    headers: { 'if-none-match': '*' }
+                });
+                assert.equal(created.status, 204, await created.text());
+                const etag = created.headers.get('etag');
+                // Rolling back to the one-epoch state both drops an epoch and moves
+                // `currentEpoch` to an older one; either alone is enough to refuse.
+                const rolledBack = body + entryLine({ ordinal: 2, state: oneEpoch }) + '\n';
+                const response = await putLog({
+                    collectionId,
+                    body: rolledBack,
+                    headers: { 'if-match': etag }
+                });
+                assert.equal(response.status, 400);
+                assert.match(response.headers.get('content-type') ?? '', /application\/problem\+json/);
+                const read = await getLog({ collectionId });
+                assert.equal(read.headers.get('etag'), etag);
+                assert.equal(await read.text(), body);
+            }
+        },
+        {
+            id: 'governed-log.line-contract-break-400',
+            name: '[root] a body that breaks the line contract is 400 invalid-request-body and governs nothing',
+            specRefs: ['https://wallet.storage/spec#invalid-request-body'],
+            run: async (ctx, state) => {
+                const { freshCollection, getLog, putLog } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const collectionId = await freshCollection();
+                const bodies = [
+                    // Empty: no head entry.
+                    '',
+                    // Not JSON.
+                    'not json\n',
+                    // An object with no `state` member.
+                    JSON.stringify({ versionId: '1-x', parameters: {} }) + '\n',
+                    // A blank line between entries.
+                    genesisLine(oneEpoch) +
+                        '\n\n' +
+                        entryLine({ ordinal: 2, state: oneEpoch })
+                ];
+                for (const body of bodies) {
+                    const response = await putLog({
+                        collectionId,
+                        body,
+                        headers: { 'if-none-match': '*' }
+                    });
+                    assert.equal(response.status, 400, `body ${JSON.stringify(body)}`);
+                    const problem = await response.json();
+                    assert.equal(problem.type, 'https://wallet.storage/spec#invalid-request-body');
+                }
+                // None of them declared the Collection governed.
+                assert.equal((await getLog({ collectionId })).status, 404);
+            }
+        },
+        {
+            id: 'governed-log.already-described-refused',
+            name: '[root] governing a Collection that already carries a client-written descriptor is 409 encryption-immutable',
+            specRefs: ['https://wallet.storage/spec#encryption-immutable'],
+            run: async (ctx, state) => {
+                const { freshCollection, getLog, putLog } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const collectionId = await freshCollection({
+                    encryption: { scheme: 'edv' }
+                });
+                await assertProblem({
+                    response: await putLog({
+                        collectionId,
+                        body: genesisLine(oneEpoch) + '\n',
+                        headers: { 'if-none-match': '*' }
+                    }),
+                    status: 409,
+                    type: 'encryption-immutable'
+                });
+                assert.equal((await getLog({ collectionId })).status, 404);
+            }
+        },
+        {
+            id: 'governed-log.not-a-resource',
+            name: '[root] the log is absent from the listing, exempt from the envelope rule, and untouched by a PUT /meta',
+            specRefs: [
+                'https://wallet.storage/spec#list-collection-operation',
+                'https://wallet.storage/spec#update-collection-metadata-operation'
+            ],
+            run: async (ctx, state) => {
+                const { alice, collectionUrl, getLog, governedCollection } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const { collectionId, etag } = await governedCollection();
+                const itemsUrl = `${collectionUrl(collectionId)}/`;
+                // The governed Collection is encrypted: a plaintext Resource is
+                // refused by the envelope rule while a conforming envelope lands. The
+                // log itself (JSON Lines, no envelope) was accepted above regardless.
+                let expectedError;
+                try {
+                    await alice.rootClient.request({
+                        url: itemsUrl,
+                        method: 'POST',
+                        action: 'POST',
+                        json: { hello: 'world' }
+                    });
+                }
+                catch (err) {
+                    expectedError = err;
+                }
+                assert.ok(expectedError, 'expected the plaintext write to be refused');
+                assert.equal(expectedError.response.status, 422);
+                const created = await alice.rootClient.request({
+                    url: itemsUrl,
+                    method: 'POST',
+                    action: 'POST',
+                    json: edvDocument
+                });
+                assert.equal(created.status, 201);
+                // One Resource in the listing, and it is not the log.
+                const listing = await alice.rootClient.request({
+                    url: itemsUrl,
+                    method: 'GET'
+                });
+                const ids = listing.data.items.map((item) => item.id);
+                assert.equal(ids.length, 1);
+                assert.ok(!ids.some(id => /log|meta/.test(id)));
+                // A `/meta` write leaves the log (and its ETag) alone.
+                const meta = await alice.rootClient.request({
+                    url: `${collectionUrl(collectionId)}/meta`,
+                    method: 'PUT',
+                    action: 'PUT',
+                    json: { custom: edvDocument }
+                });
+                assert.equal(meta.status, 204);
+                assert.equal((await getLog({ collectionId })).headers.get('etag'), etag);
+            }
+        },
+        {
+            id: 'governed-log.delegated-read',
+            name: '[delegated] a GET capability on the Collection URL covers the log read',
+            run: async (ctx, state) => {
+                const { alice, collectionUrl, getLog, governedCollection } = state;
+                const { aliceDelegatedApp } = ctx.actors;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const { collectionId, body } = await governedCollection();
+                // A Space-rooted grant: the chain descends from the Space's root
+                // capability to the Collection's items subtree, which the log URL
+                // sits under.
+                const capability = await alice.was.grant({
+                    to: aliceDelegatedApp.did,
+                    actions: ['GET'],
+                    target: `${collectionUrl(collectionId)}/`
+                });
+                const read = await getLog({
+                    collectionId,
+                    invocationSigner: aliceDelegatedApp.signer,
+                    capability
+                });
+                assert.equal(read.status, 200);
+                assert.equal(await read.text(), body);
+            }
+        },
+        {
+            id: 'governed-log.other-controller-404-mask',
+            name: "[root] another controller's log read is the 404 mask, not a 403",
+            specRefs: ['https://wallet.storage/spec#not-found'],
+            run: async (ctx, state) => {
+                const { bob, getLog, governedCollection } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const { collectionId } = await governedCollection();
+                await assertProblem({
+                    response: await getLog({
+                        collectionId,
+                        invocationSigner: bob.signer
+                    }),
+                    status: 404,
+                    type: 'not-found'
+                });
+            }
+        },
+        {
+            id: 'governed-log.delete-collection-removes-log',
+            name: '[root] deleting the Collection takes the log with it: a re-created Collection is ungoverned',
+            specRefs: ['https://wallet.storage/spec#delete-collection-operation'],
+            run: async (ctx, state) => {
+                const { alice, collectionUrl, putLog, governedCollection } = state;
+                if (!state.governedSupported) {
+                    ctx.skip('backend does not advertise governed-history-logs');
+                }
+                const { collectionId, body } = await governedCollection();
+                await alice.rootClient.request({
+                    url: collectionUrl(collectionId),
+                    method: 'DELETE'
+                });
+                await alice.rootClient.request({
+                    url: new URL(`/space/${alice.space1.id}/`, ctx.serverUrl).toString(),
+                    method: 'POST',
+                    action: 'POST',
+                    json: { id: collectionId, name: collectionId }
+                });
+                const described = await alice.rootClient.request({
+                    url: collectionUrl(collectionId),
+                    method: 'GET'
+                });
+                assert.equal(described.data.encryption, undefined);
+                const recreated = await putLog({
+                    collectionId,
+                    body,
+                    headers: { 'if-none-match': '*' }
+                });
+                assert.equal(recreated.status, 204, await recreated.text());
+            }
+        }
+    ]
+};
+//# sourceMappingURL=governed-log-api.js.map