@kanonak-protocol/sdk 5.37.0 → 6.0.0

package/vectors/credential-helper-vectors.json

@@ -0,0 +1,1039 @@
+{
+  "protocolVersion": 1,
+  "description": "Conformance vectors for the exec credential helper protocol (kanonak-protocol/typescript#126). The CLI runs `<helper command line> get` or `... erase`, writes one JSON request to stdin and reads one JSON answer from stdout; a non-zero exit is an error and never falls back to anonymous. requests: the exact JSON the CLI sends. answers/eraseAnswers: a helper's answer to `request` at Unix time `now`, and whether the CLI accepts it (with the answer it keeps) or refuses it (with the problem code). scopes: whether a credential's scope contains a URL, which is where the CLI attaches it; invalidScopes are refused. challenges: how a WWW-Authenticate value is parsed into the request's challenges; malformedChallenges are errors. Cases are only added, never changed.",
+  "requests": [
+    {
+      "id": "get-pre-emptive",
+      "description": "The transport knows the origin is gated (RFC 9728 metadata, or an earlier challenge) and asks before sending: no challenges.",
+      "operation": "get",
+      "request": {
+        "version": 1,
+        "operation": "get",
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET",
+        "interactive": false
+      }
+    },
+    {
+      "id": "get-after-challenge",
+      "description": "A 401's challenges, parsed, in the server's order.",
+      "operation": "get",
+      "request": {
+        "version": 1,
+        "operation": "get",
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET",
+        "challenges": [
+          {
+            "scheme": "Bearer",
+            "params": {
+              "resource_metadata": "https://registry.example.net/.well-known/oauth-protected-resource/example.com",
+              "error": "invalid_token"
+            }
+          }
+        ],
+        "interactive": false
+      }
+    },
+    {
+      "id": "erase-rejected",
+      "description": "After a 401 to a request that carried a credential: the rejected credential's scope and the server's challenges. get follows once.",
+      "operation": "erase",
+      "request": {
+        "version": 1,
+        "operation": "erase",
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET",
+        "challenges": [
+          {
+            "scheme": "Bearer",
+            "params": {
+              "resource_metadata": "https://registry.example.net/.well-known/oauth-protected-resource/example.com",
+              "error": "invalid_token"
+            }
+          }
+        ],
+        "interactive": false,
+        "scope": "https://registry.example.net/example.com"
+      }
+    }
+  ],
+  "answers": [
+    {
+      "id": "credential",
+      "description": "Headers, a scope containing the resource, and an expiry in Unix seconds.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "https://registry.example.net/example.com",
+        "expiresAt": 1791400000
+      },
+      "expected": {
+        "ok": true,
+        "answer": {
+          "status": "credential",
+          "headers": {
+            "Authorization": "Bearer example-token"
+          },
+          "scope": "https://registry.example.net/example.com",
+          "expiresAt": 1791400000
+        }
+      }
+    },
+    {
+      "id": "credential-without-expiry",
+      "description": "No expiresAt: valid for as long as the process runs.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "https://registry.example.net/example.com"
+      },
+      "expected": {
+        "ok": true,
+        "answer": {
+          "status": "credential",
+          "headers": {
+            "Authorization": "Bearer example-token"
+          },
+          "scope": "https://registry.example.net/example.com"
+        }
+      }
+    },
+    {
+      "id": "credential-origin-scope",
+      "description": "The helper decides how wide the scope is, so long as it contains the resource.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "https://registry.example.net/"
+      },
+      "expected": {
+        "ok": true,
+        "answer": {
+          "status": "credential",
+          "headers": {
+            "Authorization": "Bearer example-token"
+          },
+          "scope": "https://registry.example.net/"
+        }
+      }
+    },
+    {
+      "id": "several-headers",
+      "description": "Any header-based scheme: the transport attaches the headers verbatim.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "DPoP abc",
+          "DPoP": "eyJ0eXAiOiJkcG9wK2p3dCJ9.e30.sig"
+        },
+        "scope": "https://registry.example.net/example.com"
+      },
+      "expected": {
+        "ok": true,
+        "answer": {
+          "status": "credential",
+          "headers": {
+            "Authorization": "DPoP abc",
+            "DPoP": "eyJ0eXAiOiJkcG9wK2p3dCJ9.e30.sig"
+          },
+          "scope": "https://registry.example.net/example.com"
+        }
+      }
+    },
+    {
+      "id": "declined",
+      "description": "Declining is not an error: it means no credential for this resource.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "declined",
+        "reason": "not enrolled for example.com"
+      },
+      "expected": {
+        "ok": true,
+        "answer": {
+          "status": "declined",
+          "reason": "not enrolled for example.com"
+        }
+      }
+    },
+    {
+      "id": "declined-without-reason",
+      "description": "The reason is optional.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "declined"
+      },
+      "expected": {
+        "ok": true,
+        "answer": {
+          "status": "declined"
+        }
+      }
+    },
+    {
+      "id": "unknown-fields-are-ignored",
+      "description": "Fields the protocol does not define are ignored, so a newer helper can add some.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "https://registry.example.net/example.com",
+        "tokenType": "Bearer",
+        "issuedAt": 1791000000
+      },
+      "expected": {
+        "ok": true,
+        "answer": {
+          "status": "credential",
+          "headers": {
+            "Authorization": "Bearer example-token"
+          },
+          "scope": "https://registry.example.net/example.com"
+        }
+      }
+    },
+    {
+      "id": "not-an-object",
+      "description": "The answer is one JSON object.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": [
+        {
+          "version": 1,
+          "status": "credential",
+          "headers": {
+            "Authorization": "Bearer example-token"
+          },
+          "scope": "https://registry.example.net/example.com"
+        }
+      ],
+      "expected": {
+        "ok": false,
+        "problem": "malformed"
+      }
+    },
+    {
+      "id": "version-missing",
+      "description": "Every answer carries the protocol version.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "https://registry.example.net/example.com"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "version"
+      }
+    },
+    {
+      "id": "version-2",
+      "description": "Only version 1 is spoken.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 2,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "https://registry.example.net/example.com"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "version"
+      }
+    },
+    {
+      "id": "status-unknown",
+      "description": "status is credential or declined.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "granted",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "https://registry.example.net/example.com"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "status"
+      }
+    },
+    {
+      "id": "headers-missing",
+      "description": "A credential carries headers.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "scope": "https://registry.example.net/example.com"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "headers"
+      }
+    },
+    {
+      "id": "headers-empty",
+      "description": "At least one header.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {},
+        "scope": "https://registry.example.net/example.com"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "headers"
+      }
+    },
+    {
+      "id": "header-value-not-a-string",
+      "description": "Header values are strings.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": 42
+        },
+        "scope": "https://registry.example.net/example.com"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "headers"
+      }
+    },
+    {
+      "id": "header-value-with-newline",
+      "description": "A header value never carries CR or LF.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer a\r\nX-Injected: 1"
+        },
+        "scope": "https://registry.example.net/example.com"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "headers"
+      }
+    },
+    {
+      "id": "header-name-invalid",
+      "description": "Header names are RFC 9110 tokens.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Bad Header": "x"
+        },
+        "scope": "https://registry.example.net/example.com"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "headers"
+      }
+    },
+    {
+      "id": "scope-missing",
+      "description": "A credential names its scope.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        }
+      },
+      "expected": {
+        "ok": false,
+        "problem": "scope"
+      }
+    },
+    {
+      "id": "scope-http",
+      "description": "Scopes are https.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "http://registry.example.net/example.com"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "scope"
+      }
+    },
+    {
+      "id": "scope-with-query",
+      "description": "A scope has no query.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "https://registry.example.net/?publisher=example.com"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "scope"
+      }
+    },
+    {
+      "id": "scope-excludes-resource",
+      "description": "The scope must contain the resource asked for.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "https://registry.example.net/example.org"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "scope-excludes-resource"
+      }
+    },
+    {
+      "id": "scope-on-a-partial-segment",
+      "description": "Containment is on whole segments.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "https://registry.example.net/example.co"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "scope-excludes-resource"
+      }
+    },
+    {
+      "id": "scope-other-origin",
+      "description": "Another origin never contains the resource.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "https://example.com/"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "scope-excludes-resource"
+      }
+    },
+    {
+      "id": "expires-at-not-a-number",
+      "description": "expiresAt is Unix seconds.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "https://registry.example.net/example.com",
+        "expiresAt": "2026-10-08T00:00:00Z"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "expires-at"
+      }
+    },
+    {
+      "id": "expired",
+      "description": "An expired credential is never attached: expiresAt must be after now.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "credential",
+        "headers": {
+          "Authorization": "Bearer example-token"
+        },
+        "scope": "https://registry.example.net/example.com",
+        "expiresAt": 1791000000
+      },
+      "expected": {
+        "ok": false,
+        "problem": "expired"
+      }
+    },
+    {
+      "id": "reason-not-a-string",
+      "description": "A decline's reason is a string.",
+      "request": {
+        "resource": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+        "method": "GET"
+      },
+      "now": 1791000000,
+      "answer": {
+        "version": 1,
+        "status": "declined",
+        "reason": [
+          "no"
+        ]
+      },
+      "expected": {
+        "ok": false,
+        "problem": "reason"
+      }
+    }
+  ],
+  "eraseAnswers": [
+    {
+      "id": "erased",
+      "answer": {
+        "version": 1,
+        "status": "erased"
+      },
+      "expected": {
+        "ok": true,
+        "answer": {
+          "status": "erased"
+        }
+      },
+      "description": "The one erase answer."
+    },
+    {
+      "id": "erased-with-extra-fields",
+      "answer": {
+        "version": 1,
+        "status": "erased",
+        "removed": 1
+      },
+      "expected": {
+        "ok": true,
+        "answer": {
+          "status": "erased"
+        }
+      },
+      "description": "Extra fields are ignored."
+    },
+    {
+      "id": "empty-object",
+      "answer": {},
+      "expected": {
+        "ok": false,
+        "problem": "version"
+      },
+      "description": "Empty output is not an answer: erase prints {\"version\": 1, \"status\": \"erased\"}."
+    },
+    {
+      "id": "wrong-status",
+      "answer": {
+        "version": 1,
+        "status": "declined"
+      },
+      "expected": {
+        "ok": false,
+        "problem": "status"
+      },
+      "description": "erase answers erased, even for a credential it no longer holds."
+    }
+  ],
+  "scopes": [
+    {
+      "id": "origin-contains-every-path",
+      "description": "A scope of an origin's root covers every path on it.",
+      "scope": "https://registry.example.net/",
+      "url": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+      "contains": true
+    },
+    {
+      "id": "origin-without-trailing-slash",
+      "description": "An origin written without a trailing slash is the same scope.",
+      "scope": "https://registry.example.net",
+      "url": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+      "contains": true
+    },
+    {
+      "id": "publisher-prefix-contains-its-packages",
+      "description": "A registry serving many publishers scopes a credential to one publisher's path.",
+      "scope": "https://registry.example.net/example.com",
+      "url": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+      "contains": true
+    },
+    {
+      "id": "prefix-contains-itself",
+      "description": "The prefix's own path is inside it.",
+      "scope": "https://registry.example.net/example.com",
+      "url": "https://registry.example.net/example.com",
+      "contains": true
+    },
+    {
+      "id": "trailing-slash-prefix",
+      "description": "A prefix written with a trailing slash matches the same paths.",
+      "scope": "https://registry.example.net/example.com/",
+      "url": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+      "contains": true
+    },
+    {
+      "id": "trailing-slash-prefix-contains-its-bare-path",
+      "description": "/example.com/ and /example.com name the same segment.",
+      "scope": "https://registry.example.net/example.com/",
+      "url": "https://registry.example.net/example.com",
+      "contains": true
+    },
+    {
+      "id": "segment-boundary",
+      "description": "The prefix matches whole path segments: /example.com never covers /example.com.evil.",
+      "scope": "https://registry.example.net/example.com",
+      "url": "https://registry.example.net/example.com.evil/core/1.0.0.kan.yml",
+      "contains": false
+    },
+    {
+      "id": "partial-segment",
+      "description": "A prefix that ends mid-segment covers nothing beyond that exact segment.",
+      "scope": "https://registry.example.net/example",
+      "url": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+      "contains": false
+    },
+    {
+      "id": "sibling-publisher",
+      "description": "Another publisher on the same registry is outside.",
+      "scope": "https://registry.example.net/example.com",
+      "url": "https://registry.example.net/example.org/core/1.0.0.kan.yml",
+      "contains": false
+    },
+    {
+      "id": "other-host",
+      "description": "Another host is outside, so a redirect to a CDN never carries the credential.",
+      "scope": "https://registry.example.net/",
+      "url": "https://cdn.example.net/example.com/core/1.0.0.kan.yml",
+      "contains": false
+    },
+    {
+      "id": "subdomain-is-another-origin",
+      "description": "A subdomain is another origin.",
+      "scope": "https://example.com/",
+      "url": "https://pkg.example.com/core/1.0.0.kan.yml",
+      "contains": false
+    },
+    {
+      "id": "other-port",
+      "description": "Another port is another origin.",
+      "scope": "https://example.com/",
+      "url": "https://example.com:8443/core/1.0.0.kan.yml",
+      "contains": false
+    },
+    {
+      "id": "default-port-is-the-same-origin",
+      "description": "An explicit default port is the same origin.",
+      "scope": "https://example.com:443/",
+      "url": "https://example.com/core/1.0.0.kan.yml",
+      "contains": true
+    },
+    {
+      "id": "host-is-case-insensitive",
+      "description": "Hosts compare case-insensitively.",
+      "scope": "https://Registry.Example.NET/example.com",
+      "url": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+      "contains": true
+    },
+    {
+      "id": "path-is-case-sensitive",
+      "description": "Paths compare case-sensitively.",
+      "scope": "https://registry.example.net/Example.com",
+      "url": "https://registry.example.net/example.com/core/1.0.0.kan.yml",
+      "contains": false
+    },
+    {
+      "id": "http-url-is-never-inside",
+      "description": "A credential is never attached to plain http.",
+      "scope": "https://example.com/",
+      "url": "http://example.com/core/1.0.0.kan.yml",
+      "contains": false
+    },
+    {
+      "id": "url-query-is-ignored",
+      "description": "A query on the requested URL does not change which path it names.",
+      "scope": "https://registry.example.net/example.com",
+      "url": "https://registry.example.net/example.com/core/1.0.0.kan.yml?download=1",
+      "contains": true
+    },
+    {
+      "id": "dot-segments-are-resolved-first",
+      "description": "Dot segments are resolved before matching: this URL names /example.org/...",
+      "scope": "https://registry.example.net/example.com",
+      "url": "https://registry.example.net/example.com/../example.org/core/1.0.0.kan.yml",
+      "contains": false
+    }
+  ],
+  "invalidScopes": [
+    {
+      "id": "http",
+      "scope": "http://example.com/",
+      "description": "Only https."
+    },
+    {
+      "id": "relative",
+      "scope": "/example.com",
+      "description": "A scope is an absolute URL."
+    },
+    {
+      "id": "bare-host",
+      "scope": "example.com",
+      "description": "A host alone is not a URL."
+    },
+    {
+      "id": "query",
+      "scope": "https://example.com/?publisher=example.com",
+      "description": "A query cannot bound a path prefix."
+    },
+    {
+      "id": "empty-query",
+      "scope": "https://example.com/?",
+      "description": "Even an empty query."
+    },
+    {
+      "id": "fragment",
+      "scope": "https://example.com/#core",
+      "description": "Nor can a fragment."
+    },
+    {
+      "id": "userinfo",
+      "scope": "https://user@example.com/",
+      "description": "A scope never carries userinfo."
+    }
+  ],
+  "challenges": [
+    {
+      "id": "bearer-resource-metadata",
+      "description": "RFC 9728 §5.1: a 401 naming the resource's metadata.",
+      "wwwAuthenticate": "Bearer resource_metadata=\"https://registry.example.net/.well-known/oauth-protected-resource/example.com\", error=\"invalid_token\"",
+      "challenges": [
+        {
+          "scheme": "Bearer",
+          "params": {
+            "resource_metadata": "https://registry.example.net/.well-known/oauth-protected-resource/example.com",
+            "error": "invalid_token"
+          }
+        }
+      ]
+    },
+    {
+      "id": "insufficient-scope",
+      "description": "RFC 6750 §3.1: valid but not enough; the transport asks again with no erase.",
+      "wwwAuthenticate": "Bearer error=\"insufficient_scope\", scope=\"packages:read\"",
+      "challenges": [
+        {
+          "scheme": "Bearer",
+          "params": {
+            "error": "insufficient_scope",
+            "scope": "packages:read"
+          }
+        }
+      ]
+    },
+    {
+      "id": "bare-scheme",
+      "description": "A scheme with no parameters.",
+      "wwwAuthenticate": "Bearer",
+      "challenges": [
+        {
+          "scheme": "Bearer",
+          "params": {}
+        }
+      ]
+    },
+    {
+      "id": "two-challenges",
+      "description": "Several challenges keep the server's order (RFC 9449 servers send DPoP and Bearer together).",
+      "wwwAuthenticate": "DPoP algs=\"ES256 PS256\", Bearer realm=\"example\"",
+      "challenges": [
+        {
+          "scheme": "DPoP",
+          "params": {
+            "algs": "ES256 PS256"
+          }
+        },
+        {
+          "scheme": "Bearer",
+          "params": {
+            "realm": "example"
+          }
+        }
+      ]
+    },
+    {
+      "id": "param-names-are-case-insensitive",
+      "description": "Parameter names are lower-cased; values are kept.",
+      "wwwAuthenticate": "Bearer Error=\"invalid_token\"",
+      "challenges": [
+        {
+          "scheme": "Bearer",
+          "params": {
+            "error": "invalid_token"
+          }
+        }
+      ]
+    },
+    {
+      "id": "scheme-keeps-its-spelling",
+      "description": "The scheme keeps the server's spelling; compare it case-insensitively.",
+      "wwwAuthenticate": "bearer error=\"invalid_token\"",
+      "challenges": [
+        {
+          "scheme": "bearer",
+          "params": {
+            "error": "invalid_token"
+          }
+        }
+      ]
+    },
+    {
+      "id": "unquoted-token-value",
+      "description": "A parameter value may be a token instead of a quoted-string.",
+      "wwwAuthenticate": "Bearer error=invalid_token",
+      "challenges": [
+        {
+          "scheme": "Bearer",
+          "params": {
+            "error": "invalid_token"
+          }
+        }
+      ]
+    },
+    {
+      "id": "quoted-pair",
+      "description": "Backslash escapes inside a quoted-string are removed.",
+      "wwwAuthenticate": "Bearer realm=\"the \\\"main\\\" registry\"",
+      "challenges": [
+        {
+          "scheme": "Bearer",
+          "params": {
+            "realm": "the \"main\" registry"
+          }
+        }
+      ]
+    },
+    {
+      "id": "comma-inside-quotes",
+      "description": "A comma inside a quoted-string separates nothing.",
+      "wwwAuthenticate": "Bearer realm=\"a, b\", error=\"invalid_token\"",
+      "challenges": [
+        {
+          "scheme": "Bearer",
+          "params": {
+            "realm": "a, b",
+            "error": "invalid_token"
+          }
+        }
+      ]
+    },
+    {
+      "id": "whitespace-around-equals",
+      "description": "BWS is allowed around '='.",
+      "wwwAuthenticate": "Bearer realm = \"example\"",
+      "challenges": [
+        {
+          "scheme": "Bearer",
+          "params": {
+            "realm": "example"
+          }
+        }
+      ]
+    },
+    {
+      "id": "token68",
+      "description": "A challenge may carry a token68 instead of parameters.",
+      "wwwAuthenticate": "Negotiate YIIBhwYGKwYBBQUC",
+      "challenges": [
+        {
+          "scheme": "Negotiate",
+          "params": {},
+          "token68": "YIIBhwYGKwYBBQUC"
+        }
+      ]
+    },
+    {
+      "id": "token68-with-padding",
+      "description": "A token68's '=' padding is not a parameter.",
+      "wwwAuthenticate": "Basic dXNlcjpwYXNz==",
+      "challenges": [
+        {
+          "scheme": "Basic",
+          "params": {},
+          "token68": "dXNlcjpwYXNz=="
+        }
+      ]
+    },
+    {
+      "id": "empty-list-elements",
+      "description": "Empty list elements are skipped.",
+      "wwwAuthenticate": ", Bearer realm=\"a\" ,, Basic realm=\"b\"",
+      "challenges": [
+        {
+          "scheme": "Bearer",
+          "params": {
+            "realm": "a"
+          }
+        },
+        {
+          "scheme": "Basic",
+          "params": {
+            "realm": "b"
+          }
+        }
+      ]
+    }
+  ],
+  "malformedChallenges": [
+    {
+      "id": "unterminated-quoted-string",
+      "wwwAuthenticate": "Bearer realm=\"example",
+      "description": "A quoted-string that never ends."
+    },
+    {
+      "id": "repeated-parameter",
+      "wwwAuthenticate": "Bearer error=\"a\", error=\"b\"",
+      "description": "RFC 9110: a parameter occurs once per challenge."
+    },
+    {
+      "id": "missing-comma",
+      "wwwAuthenticate": "Bearer realm=\"a\" error=\"b\"",
+      "description": "Parameters are comma-separated."
+    },
+    {
+      "id": "no-space-after-scheme",
+      "wwwAuthenticate": "Bearer=\"x\"",
+      "description": "The scheme is followed by a space before its parameters."
+    }
+  ]
+}