@adcp/sdk 14.0.0-rc.49 → 14.0.0-rc.50

package/dist/lib/schemas-data/3.1/trusted-match/identity-match-request.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.18/trusted-match/identity-match-request.json",
+  "$id": "/schemas/3.1.24/trusted-match/identity-match-request.json",
   "title": "Identity Match Request",
   "description": "Sent by publisher to evaluate user eligibility for packages using an opaque identity token. MUST NOT contain page context. The request_id MUST NOT correlate with any context match request_id. The buyer resolves the active package set for this seller from `seller_agent_url`; if `package_ids` is provided, its composition MUST be independent of the current placement (e.g., all-active or fuzzed; see field description) to prevent set-correlation attacks. Extension fields (ext, context) are intentionally omitted to prevent data leakage across the identity privacy boundary. The optional `attestation` (per identity) and `sealed_credentials` (top-level) fields carry verifiable proof ABOUT the identity — on the identity side of that boundary, not page context — so they are a deliberate, reviewed widening of this otherwise-closed schema, not a leak.",
   "type": "object",
@@ -52,7 +52,7 @@
             "description": "Opaque token from an identity provider (ID5, LiveRamp, UID2) or publisher-generated. Buyer may map to internal identity graph but cannot reverse to PII."
           },
           "uid_type": {
-            "$ref": "/schemas/3.1.18/enums/uid-type.json",
+            "$ref": "/schemas/3.1.24/enums/uid-type.json",
             "description": "Type of the user identifier. Tells the buyer which identity graph to resolve against, avoiding trial-and-error matching."
           },
           "attestation": {
@@ -60,7 +60,7 @@
             "description": "Optional verifiable proof ABOUT this identity (e.g. World ID proof-of-personhood and/or age). The receiver MUST verify it (see conformance) and MUST treat an absent-or-unverifiable attestation as 'no attestation' — never as an asserted-true claim. Issuer-agnostic: World ID is the first scheme; mDL / VC-style issuers use the same shape. Receivers MUST bound attestation size to prevent DoS.",
             "properties": {
               "issuer": {
-                "$ref": "/schemas/3.1.18/core/brand-ref.json",
+                "$ref": "/schemas/3.1.24/core/brand-ref.json",
                 "description": "Attestation authority / identity issuer, referenced as a vendor BrandRef (e.g. {\"domain\": \"world.org\"}) — the same vendor-reference shape AdCP uses for measurement and signals vendors. The issuer's canonical domain is the anchor; brand.json hosting is optional. `scheme` selects the verifier version within the issuer."
               },
               "scheme": {
@@ -80,7 +80,7 @@
                 "type": "array",
                 "description": "Claims this attestation establishes. Closed, issuer-agnostic set.",
                 "items": {
-                  "$ref": "/schemas/3.1.18/enums/attestation-claim.json"
+                  "$ref": "/schemas/3.1.24/enums/attestation-claim.json"
                 },
                 "minItems": 1,
                 "uniqueItems": true,

package/dist/lib/schemas-data/3.1/trusted-match/identity-match-response.json

@@ -1,15 +1,15 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.18/trusted-match/identity-match-response.json",
+  "$id": "/schemas/3.1.24/trusted-match/identity-match-response.json",
   "title": "Identity Match Response (Router → Publisher)",
   "description": "Router-to-publisher shape of the Identity Match response. The router collects each identity agent's ordered TMPX chunks (see provider-identity-match-response.json) and forwards them under the emitting `provider_id`, preserving provider attribution and chunk order. Each chunk is a provider-declared `{slot_id, value}` pair; the publisher's deployment configuration (see publisher-tmpx-config.json) maps `(provider_id, slot_id)` to the local ad-server macro name, targeting key, VAST substitution, or play-log field. The provider→router boundary never carries a publisher-local destination name, so no cross-provider name-hijack surface exists. Provider-hop fields (`tmpx_chunks` at the root) MUST NOT appear on this shape — a router that leaks them alongside `tmpx_providers` corrupts per-provider accounting. Envelope extension fields (`context`, `ext`) are intentionally omitted to prevent data leakage across the identity privacy boundary; they are forbidden by this schema. The serve_window_sec field defines a per-package single-shot fcap: after serving the user one impression on each eligible package, the publisher MUST re-query Identity Match before serving from those packages again.",
   "type": "object",
   "allOf": [
     {
-      "$ref": "/schemas/3.1.18/core/version-envelope.json"
+      "$ref": "/schemas/3.1.24/core/version-envelope.json"
     },
     {
-      "$ref": "/schemas/3.1.18/core/protocol-envelope.json"
+      "$ref": "/schemas/3.1.24/core/protocol-envelope.json"
     }
   ],
   "x-status": "experimental",
@@ -56,7 +56,7 @@
             "type": "array",
             "description": "Ordered TMPX chunks for this provider. Each entry is a `{slot_id, value}` pair copied verbatim from the provider's `tmpx_chunks`. Ordered-prefix invariant: the sequence of `slot_id`s MUST equal an ordered prefix of the provider's registered `tmpx_slots` — publishers MAY reject responses whose slot_ids or ordering diverge. Cap of 2 chunks in v1; the cap MAY rise without a shape change.",
             "items": {
-              "$ref": "/schemas/3.1.18/trusted-match/tmpx-chunk.json"
+              "$ref": "/schemas/3.1.24/trusted-match/tmpx-chunk.json"
             },
             "minItems": 1,
             "maxItems": 2

package/dist/lib/schemas-data/3.1/trusted-match/offer-price.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.18/trusted-match/offer-price.json",
+  "$id": "/schemas/3.1.24/trusted-match/offer-price.json",
   "title": "Offer Price",
   "description": "Lightweight price for a TMP offer. Used when the product supports variable pricing and the buyer specifies a price at match time.",
   "x-status": "experimental",

package/dist/lib/schemas-data/3.1/trusted-match/offer.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.18/trusted-match/offer.json",
+  "$id": "/schemas/3.1.24/trusted-match/offer.json",
   "title": "Offer",
   "description": "A buyer's response to a context match request. Generalizes package activation — a simple activation is an offer with just package_id. A rich response includes brand, price, summary, and optionally an inline creative manifest.",
   "x-status": "experimental",
@@ -11,15 +11,15 @@
       "description": "Package identifier from the media buy."
     },
     "seller_agent": {
-      "$ref": "/schemas/3.1.18/core/seller-agent-ref.json",
+      "$ref": "/schemas/3.1.24/core/seller-agent-ref.json",
       "description": "Optional echo of the package's seller agent from sync-time metadata. Provided for publisher-side observability so log pipelines can attribute offers to sellers without round-tripping to the media-buy store. Non-authoritative: the binding on the cached AvailablePackage is source of truth. When omitted, the router MAY stamp this field from its cached package→seller map."
     },
     "brand": {
-      "$ref": "/schemas/3.1.18/core/brand-ref.json",
+      "$ref": "/schemas/3.1.24/core/brand-ref.json",
       "description": "Brand for this offer. Required when the product allows dynamic brands (brand selected at match time rather than fixed on the package). For single-brand packages, the brand is already known from the media buy."
     },
     "price": {
-      "$ref": "/schemas/3.1.18/trusted-match/offer-price.json",
+      "$ref": "/schemas/3.1.24/trusted-match/offer-price.json",
       "description": "Price for this offer. Only present when the product supports variable pricing. For fixed-price packages, price is already set on the media buy."
     },
     "summary": {
@@ -27,7 +27,7 @@
       "description": "Buyer-generated description of the offer, for the publisher to judge relevance. E.g., '50% off Goldenfield mayo — recipe integration'. The publisher (or their AI assistant) uses this to decide whether the offer fits the context."
     },
     "creative_manifest": {
-      "$ref": "/schemas/3.1.18/core/creative-manifest.json",
+      "$ref": "/schemas/3.1.24/core/creative-manifest.json",
       "description": "Full creative details, inline. When present, the publisher has everything needed to render. Inline for small creatives (markdown, product card). For large creatives (VAST, video), the manifest references external assets via URLs."
     },
     "macros": {

package/dist/lib/schemas-data/3.1/trusted-match/provider-identity-match-response.json

@@ -1,15 +1,15 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.18/trusted-match/provider-identity-match-response.json",
+  "$id": "/schemas/3.1.24/trusted-match/provider-identity-match-response.json",
   "title": "Identity Match Response (Provider → Router)",
   "description": "Provider-to-router shape of the Identity Match response. An identity agent returns eligibility, the per-package serve-window throttle, and — when it mints one — an ordered list of TMPX chunks. Each chunk pairs a provider-local `slot_id` (declared at registration in `tmpx_slots`) with an opaque URL-safe `value`. Publisher-local destination names (ad-server macros, GAM key-values, VAST URL macros, DOOH play-log fields) MUST NOT appear on this hop; the router keys chunks under the emitting `provider_id` and the publisher's deployment configuration resolves `(provider_id, slot_id)` to the local destination (see publisher-tmpx-config.json). Router-hop fields (`tmpx_providers`, `tmpx`) MUST NOT appear on this shape — a router receiving them from a provider MUST reject the response. Envelope extension fields (`context`, `ext`) are intentionally omitted to prevent data leakage across the identity privacy boundary; they are forbidden by this schema.",
   "type": "object",
   "allOf": [
     {
-      "$ref": "/schemas/3.1.18/core/version-envelope.json"
+      "$ref": "/schemas/3.1.24/core/version-envelope.json"
     },
     {
-      "$ref": "/schemas/3.1.18/core/protocol-envelope.json"
+      "$ref": "/schemas/3.1.24/core/protocol-envelope.json"
     }
   ],
   "x-status": "experimental",
@@ -40,7 +40,7 @@
       "type": "array",
       "description": "Ordered TMPX chunk/value pairs this identity agent mints. Each entry names the provider-local `slot_id` the value fills (from the provider's registered `tmpx_slots` in provider-registration.json). Ordered-prefix invariant: a response that carries fewer chunks than the provider registered MUST emit an ordered prefix of the registered `tmpx_slots` — routers MUST NOT reorder or fill gaps. The router MUST validate this contract before forwarding: if the provider has no `tmpx_slots` registration, or if the chunk `slot_id` sequence is not an exact non-empty ordered prefix of the registered list (duplicate, reordered, sparse, or unregistered slot IDs), the router MUST drop that provider's chunks atomically and MUST NOT forward them into `tmpx_providers`. Cap of 2 chunks in v1 aligned with the GAM macro-slot budget; the cap MAY rise without a shape change. Omitted when this provider mints no TMPX (e.g. no eligible packages).",
       "items": {
-        "$ref": "/schemas/3.1.18/trusted-match/tmpx-chunk.json"
+        "$ref": "/schemas/3.1.24/trusted-match/tmpx-chunk.json"
       },
       "minItems": 1,
       "maxItems": 2

package/dist/lib/schemas-data/3.1/trusted-match/provider-registration.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.18/trusted-match/provider-registration.json",
+  "$id": "/schemas/3.1.24/trusted-match/provider-registration.json",
   "title": "TMP Provider Registration",
   "description": "Declares a TMP provider's endpoint, capabilities, and operational parameters. Used in router configuration (static YAML or dynamic API) and referenced by product-level provider entries. The publisher controls which providers participate in their ad decisioning. Endpoint URLs MUST be validated against SSRF, and dynamic registration endpoints MUST authenticate callers — see docs/trusted-match/specification#provider-registration-security.",
   "x-status": "experimental",
@@ -39,7 +39,7 @@
       "type": "array",
       "description": "Identity types this provider can resolve. The router selects Identity Match providers whose uid_types overlaps with any uid_type in the request's identities array. MUST be present and non-empty when identity_match is true.",
       "items": {
-        "$ref": "/schemas/3.1.18/enums/uid-type.json"
+        "$ref": "/schemas/3.1.24/enums/uid-type.json"
       },
       "minItems": 1
     },

package/dist/lib/schemas-data/3.1/trusted-match/publisher-tmpx-config.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.18/trusted-match/publisher-tmpx-config.json",
+  "$id": "/schemas/3.1.24/trusted-match/publisher-tmpx-config.json",
   "title": "Publisher TMPX Macro Mapping",
   "description": "Publisher-owned deployment configuration that maps each identity provider's TMPX slots to the ad-server macro names (or targeting keys, VAST substitutions, DOOH play-log fields) the publisher wants those chunks fired into on this surface. Mapping is authored by the publisher — the same operator who trafficks the corresponding ad-server line items — and never travels on the wire between identity provider and router. This keeps macro naming a deployment concern rather than a protocol identifier: providers emit chunks as `{slot_id, value}` pairs (see provider-identity-match-response.json), the router preserves ordering and slot IDs under the emitting `provider_id` (see identity-match-response.json), and this configuration resolves each `(provider_id, slot_id)` to a local destination on the way to the ad server. A publisher may map the same provider to different destinations across surfaces (GAM key-values vs. VAST macros vs. DOOH play-log fields) by carrying one instance of this configuration per surface.",
   "x-status": "experimental",

package/dist/lib/schemas-data/3.1/trusted-match/tmpx-chunk.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.18/trusted-match/tmpx-chunk.json",
+  "$id": "/schemas/3.1.24/trusted-match/tmpx-chunk.json",
   "title": "TMPX Chunk",
   "description": "A single provider TMPX chunk — the provider-local `slot_id` (declared at registration in `tmpx_slots`) and its opaque URL-safe `value`. Same shape on both hops of the Identity Match response: providers emit `tmpx_chunks[]` on the provider→router shape, the router forwards them under `tmpx_providers[provider_id].chunks[]` on the router→publisher shape. Publisher-local destination names never appear here — the publisher's deployment configuration resolves `(provider_id, slot_id)` → local destination via publisher-tmpx-config.json.",
   "x-status": "experimental",

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-09-28T00:15:43.773Z"
+  "synced_at": "2026-09-29T15:03:00.076Z"
 }

package/dist/lib/server/decisioning/runtime/from-platform.js

@@ -2051,12 +2051,20 @@ function createAdcpServerFromPlatform(platform, opts) {
           const refFromTop = input.account;
           const refFromContext = input.context?.account;
           const accountRef = refFromTop ?? refFromContext;
-          enforceAccountRefShapeForResolution(platform.accounts.resolution, accountRef);
+          if (accountRef !== void 0 && (typeof accountRef !== "object" || Array.isArray(accountRef))) {
+            return (0, import_errors.adcpError)("INVALID_REQUEST", { message: "account must be an object" });
+          }
+          const requestedAccountId = (0, import_account.refAccountId)(accountRef);
+          if (requestedAccountId !== void 0 && (typeof requestedAccountId !== "string" || requestedAccountId.length === 0 || accountRef !== void 0 && ("brand" in accountRef || "operator" in accountRef))) {
+            return (0, import_errors.adcpError)("INVALID_REQUEST", { message: "Invalid account_id reference" });
+          }
+          const resolverRef = requestedAccountId === void 0 ? accountRef : { account_id: requestedAccountId };
           let resolvedAccount = null;
           const agent = principalAuthority.agent;
           try {
+            enforceAccountRefShapeForResolution(platform.accounts.resolution, accountRef);
             resolvedAccount = await platform.accounts.resolve(
-              accountRef,
+              resolverRef,
               toResolveCtx(
                 {
                   ...extra?.authInfo !== void 0 && { authInfo: extra.authInfo },
@@ -2069,7 +2077,17 @@ function createAdcpServerFromPlatform(platform, opts) {
                 input
               )
             );
-          } catch {
+          } catch (err) {
+            if (err instanceof import_account.AccountNotFoundError || err instanceof import_async_outcome.AdcpError && err.code === "ACCOUNT_NOT_FOUND") {
+              resolvedAccount = null;
+            } else if (err instanceof import_async_outcome.AdcpError) {
+              return (0, import_errors.adcpError)(err.code, err.toStructuredError());
+            } else {
+              fwLogger.error?.("Account resolution failed during comply controller dispatch", {
+                error_type: err instanceof Error ? err.name : typeof err
+              });
+              return (0, import_errors.adcpError)("SERVICE_UNAVAILABLE", { message: "Account resolution failed" });
+            }
           }
           resolvedAccount = assertResolvedAccountMatchesRef(
             platform.accounts.resolution,

package/dist/lib/server/decisioning/runtime/from-platform.mjs

@@ -2080,12 +2080,20 @@ function createAdcpServerFromPlatform(platform, opts) {
           const refFromTop = input.account;
           const refFromContext = input.context?.account;
           const accountRef = refFromTop ?? refFromContext;
-          enforceAccountRefShapeForResolution(platform.accounts.resolution, accountRef);
+          if (accountRef !== void 0 && (typeof accountRef !== "object" || Array.isArray(accountRef))) {
+            return adcpError("INVALID_REQUEST", { message: "account must be an object" });
+          }
+          const requestedAccountId = refAccountId(accountRef);
+          if (requestedAccountId !== void 0 && (typeof requestedAccountId !== "string" || requestedAccountId.length === 0 || accountRef !== void 0 && ("brand" in accountRef || "operator" in accountRef))) {
+            return adcpError("INVALID_REQUEST", { message: "Invalid account_id reference" });
+          }
+          const resolverRef = requestedAccountId === void 0 ? accountRef : { account_id: requestedAccountId };
           let resolvedAccount = null;
           const agent = principalAuthority.agent;
           try {
+            enforceAccountRefShapeForResolution(platform.accounts.resolution, accountRef);
             resolvedAccount = await platform.accounts.resolve(
-              accountRef,
+              resolverRef,
               toResolveCtx(
                 {
                   ...extra?.authInfo !== void 0 && { authInfo: extra.authInfo },
@@ -2098,7 +2106,17 @@ function createAdcpServerFromPlatform(platform, opts) {
                 input
               )
             );
-          } catch {
+          } catch (err) {
+            if (err instanceof AccountNotFoundError || err instanceof AdcpError && err.code === "ACCOUNT_NOT_FOUND") {
+              resolvedAccount = null;
+            } else if (err instanceof AdcpError) {
+              return adcpError(err.code, err.toStructuredError());
+            } else {
+              fwLogger.error?.("Account resolution failed during comply controller dispatch", {
+                error_type: err instanceof Error ? err.name : typeof err
+              });
+              return adcpError("SERVICE_UNAVAILABLE", { message: "Account resolution failed" });
+            }
           }
           resolvedAccount = assertResolvedAccountMatchesRef(
             platform.accounts.resolution,

package/dist/lib/server/serve.js

@@ -521,6 +521,8 @@ function serve(createAgent, options) {
       res.end("Not found");
     }
   });
+  httpServer.keepAliveTimeout = 6e4;
+  httpServer.headersTimeout = 65e3;
   const doListen = () => {
     httpServer.listen(port, () => {
       const actualPort = httpServer.address().port;

package/dist/lib/server/serve.mjs

@@ -504,6 +504,8 @@ function serve(createAgent, options) {
       res.end("Not found");
     }
   });
+  httpServer.keepAliveTimeout = 6e4;
+  httpServer.headersTimeout = 65e3;
   const doListen = () => {
     httpServer.listen(port, () => {
       const actualPort = httpServer.address().port;

package/dist/lib/testing/storyboard/request-builder.js

@@ -102,6 +102,27 @@ function resolveMediaBuyAccount(fixtureAccount, contextAccount, options) {
   }
   return resolvedAccount;
 }
+const OPERATION_SCOPED_CONTROLLER_SCENARIOS = /* @__PURE__ */ new Set([
+  "force_create_media_buy_arm",
+  "force_get_products_arm",
+  "force_get_signals_arm",
+  "force_task_completion",
+  "simulate_delivery",
+  "simulate_budget_spend",
+  "force_media_buy_status",
+  "seed_media_buy"
+]);
+function isOperationScopedControllerScenario(scenario) {
+  return typeof scenario === "string" && OPERATION_SCOPED_CONTROLLER_SCENARIOS.has(scenario);
+}
+function hasAuthoredAccountIdentity(account) {
+  if (account === null || typeof account !== "object" || Array.isArray(account)) return false;
+  const ref = account;
+  return typeof ref.account_id === "string" && ref.account_id.length > 0 || typeof ref.operator === "string" && ref.operator.length > 0;
+}
+function isExactRevisionId(value) {
+  return typeof value === "string" && value.length > 0;
+}
 function generatedIdSuffix(step, runnerVars, nowMs) {
   const timestamp = nowMs ?? runClockMs(runnerVars);
   if (runnerVars?.runStartMs === void 0) return String(timestamp);
@@ -290,8 +311,9 @@ const REQUEST_ENRICHERS = {
       (0, import_context.injectContext)({ ...step.sample_request }, context)
     ) : {};
     const result = { ...fixtureFields };
-    result.account = resolveMediaBuyAccount(fixtureFields.account, context.account, options);
-    if (context.media_buy_id != null && result.media_buy_ids === void 0) {
+    const exactRevision = isExactRevisionId(fixtureFields.reporting_revision_id);
+    result.account = exactRevision && hasAuthoredAccountIdentity(fixtureFields.account) ? typeof fixtureFields.account.account_id === "string" ? { account_id: fixtureFields.account.account_id } : { ...fixtureFields.account, sandbox: true } : resolveMediaBuyAccount(fixtureFields.account, context.account, options);
+    if (!exactRevision && context.media_buy_id != null && result.media_buy_ids === void 0) {
       result.media_buy_ids = [context.media_buy_id];
     }
     return result;
@@ -668,8 +690,15 @@ const REQUEST_ENRICHERS = {
     const controllerFields = step.sample_request ? omitEnvelopeFields(
       (0, import_context.injectContext)({ ...step.sample_request }, context)
     ) : void 0;
-    const controllerScenario = controllerFields?.scenario;
-    const accountScope = controllerScenario === "force_create_media_buy_arm" || controllerScenario === "force_get_products_arm" || controllerScenario === "force_get_signals_arm" || controllerScenario === "force_task_completion" ? resolveMediaBuyAccount(controllerFields?.account, context.account, options) : context.account ?? (0, import_client.resolveAccount)(options);
+    const authoredAccount = controllerFields?.account;
+    let accountScope;
+    if (controllerFields?.scenario === "seed_account") {
+      accountScope = context.account ?? (0, import_client.resolveAccount)(options);
+    } else if (isOperationScopedControllerScenario(controllerFields?.scenario)) {
+      accountScope = resolveMediaBuyAccount(authoredAccount, context.account, options);
+    } else {
+      accountScope = hasAuthoredAccountIdentity(authoredAccount) ? authoredAccount : context.account ?? (0, import_client.resolveAccount)(options);
+    }
     const account = {
       ...accountScope,
       sandbox: true

package/dist/lib/testing/storyboard/request-builder.mjs

@@ -76,6 +76,27 @@ function resolveMediaBuyAccount(fixtureAccount, contextAccount, options) {
   }
   return resolvedAccount;
 }
+const OPERATION_SCOPED_CONTROLLER_SCENARIOS = /* @__PURE__ */ new Set([
+  "force_create_media_buy_arm",
+  "force_get_products_arm",
+  "force_get_signals_arm",
+  "force_task_completion",
+  "simulate_delivery",
+  "simulate_budget_spend",
+  "force_media_buy_status",
+  "seed_media_buy"
+]);
+function isOperationScopedControllerScenario(scenario) {
+  return typeof scenario === "string" && OPERATION_SCOPED_CONTROLLER_SCENARIOS.has(scenario);
+}
+function hasAuthoredAccountIdentity(account) {
+  if (account === null || typeof account !== "object" || Array.isArray(account)) return false;
+  const ref = account;
+  return typeof ref.account_id === "string" && ref.account_id.length > 0 || typeof ref.operator === "string" && ref.operator.length > 0;
+}
+function isExactRevisionId(value) {
+  return typeof value === "string" && value.length > 0;
+}
 function generatedIdSuffix(step, runnerVars, nowMs) {
   const timestamp = nowMs ?? runClockMs(runnerVars);
   if (runnerVars?.runStartMs === void 0) return String(timestamp);
@@ -264,8 +285,9 @@ const REQUEST_ENRICHERS = {
       injectContext({ ...step.sample_request }, context)
     ) : {};
     const result = { ...fixtureFields };
-    result.account = resolveMediaBuyAccount(fixtureFields.account, context.account, options);
-    if (context.media_buy_id != null && result.media_buy_ids === void 0) {
+    const exactRevision = isExactRevisionId(fixtureFields.reporting_revision_id);
+    result.account = exactRevision && hasAuthoredAccountIdentity(fixtureFields.account) ? typeof fixtureFields.account.account_id === "string" ? { account_id: fixtureFields.account.account_id } : { ...fixtureFields.account, sandbox: true } : resolveMediaBuyAccount(fixtureFields.account, context.account, options);
+    if (!exactRevision && context.media_buy_id != null && result.media_buy_ids === void 0) {
       result.media_buy_ids = [context.media_buy_id];
     }
     return result;
@@ -642,8 +664,15 @@ const REQUEST_ENRICHERS = {
     const controllerFields = step.sample_request ? omitEnvelopeFields(
       injectContext({ ...step.sample_request }, context)
     ) : void 0;
-    const controllerScenario = controllerFields?.scenario;
-    const accountScope = controllerScenario === "force_create_media_buy_arm" || controllerScenario === "force_get_products_arm" || controllerScenario === "force_get_signals_arm" || controllerScenario === "force_task_completion" ? resolveMediaBuyAccount(controllerFields?.account, context.account, options) : context.account ?? resolveAccount(options);
+    const authoredAccount = controllerFields?.account;
+    let accountScope;
+    if (controllerFields?.scenario === "seed_account") {
+      accountScope = context.account ?? resolveAccount(options);
+    } else if (isOperationScopedControllerScenario(controllerFields?.scenario)) {
+      accountScope = resolveMediaBuyAccount(authoredAccount, context.account, options);
+    } else {
+      accountScope = hasAuthoredAccountIdentity(authoredAccount) ? authoredAccount : context.account ?? resolveAccount(options);
+    }
     const account = {
       ...accountScope,
       sandbox: true

package/dist/lib/testing/storyboard/request-signing/builder.js

@@ -192,8 +192,44 @@ const MUTATIONS = {
   // transport-ungradable by the live probe because no HTTP client can route
   // to that intentionally invalid host spelling.
   "profile-3.2/negative/001-base64url-sf-binary": (vector, _keys, options) => passthrough(vector, options),
-  "profile-3.2/negative/002-multiple-trailing-dots": (vector, _keys, options) => passthrough(vector, options)
+  "profile-3.2/negative/002-multiple-trailing-dots": (vector, _keys, options) => passthrough(vector, options),
+  "profile-3.2/negative/002-wrong-tag": delegateToRoot("002-wrong-tag"),
+  "profile-3.2/negative/003-expired-signature": delegateToRoot("003-expired-signature"),
+  "profile-3.2/negative/004-window-too-long": delegateToRoot("004-window-too-long"),
+  "profile-3.2/negative/005-alg-not-allowed": delegateToRoot("005-alg-not-allowed"),
+  "profile-3.2/negative/006-missing-covered-component": (vector, keys, options) => signWithComponents(
+    signerKeyFor(vector, keys),
+    vector,
+    options,
+    ["@method", "@target-uri", "content-type", "content-digest"],
+    true
+  ),
+  "profile-3.2/negative/007-missing-content-digest": delegateToRoot("007-missing-content-digest"),
+  "profile-3.2/negative/008-unknown-keyid": delegateToRoot("008-unknown-keyid"),
+  "profile-3.2/negative/009-key-ops-missing-verify": delegateToRoot("009-key-ops-missing-verify"),
+  "profile-3.2/negative/010-content-digest-mismatch": delegateToRoot("010-content-digest-mismatch"),
+  "profile-3.2/negative/012-missing-expires-param": delegateToRoot("012-missing-expires-param"),
+  "profile-3.2/negative/013-expires-le-created": delegateToRoot("013-expires-le-created"),
+  "profile-3.2/negative/014-missing-nonce-param": delegateToRoot("014-missing-nonce-param"),
+  "profile-3.2/negative/015-signature-invalid": (vector, keys, options) => {
+    const signed = sign(signerKeyFor(vector, keys), vector, options);
+    return {
+      ...signed,
+      headers: { ...signed.headers, Signature: `sig1=:${Buffer.alloc(64).toString("base64")}:` }
+    };
+  },
+  "profile-3.2/negative/016-replayed-nonce": delegateToRoot("016-replayed-nonce"),
+  "profile-3.2/negative/017-key-revoked": delegateToRoot("017-key-revoked"),
+  "profile-3.2/negative/020-rate-abuse": delegateToRoot("020-rate-abuse"),
+  "profile-3.2/negative/025-jwk-alg-crv-mismatch": delegateToRoot("025-jwk-alg-crv-mismatch")
 };
+function delegateToRoot(rootId) {
+  return (vector, keys, options) => {
+    const mutation = MUTATIONS[rootId];
+    if (!mutation) throw new Error(`Missing root request-signing mutation "${rootId}"`);
+    return mutation(vector, keys, options);
+  };
+}
 function passthrough(vector, options) {
   const shaped = applyTransport(vector, options);
   return {
@@ -217,6 +253,12 @@ function protocolMethodPassthrough(vector, options) {
     body: vector.request.body
   };
 }
+function binaryEncoding(vector) {
+  return (0, import_signing.requestSigningEncodingForVersion)(vector.signing_profile_version) === "rfc8941-base64" ? "base64" : "base64url";
+}
+function canonicalizationProfile(vector) {
+  return binaryEncoding(vector) === "base64" ? "3.2" : "legacy";
+}
 function sign(key, vector, args) {
   const shaped = applyTransport(vector, args);
   const request = {
@@ -229,7 +271,7 @@ function sign(key, vector, args) {
     request,
     { keyid: key.keyid, alg: key.alg },
     {
-      coverContentDigest: args.coverContentDigest === true,
+      coverContentDigest: args.coverContentDigest ?? vector.verifier_capability.covers_content_digest === "required",
       now: args.now !== void 0 ? () => args.now : void 0,
       nonce: args.nonce,
       windowSeconds: args.windowSeconds,
@@ -327,6 +369,7 @@ function wrapMcpEnvelope(operation, rawBody, idOverride) {
 }
 function signWithParamOverride(key, vector, options, override) {
   const shaped = applyTransport(vector, options);
+  if (vector.verifier_capability.covers_content_digest === "required") refreshContentDigest(shaped, vector);
   const url = shaped.url;
   const request = {
     method: shaped.method,
@@ -336,6 +379,9 @@ function signWithParamOverride(key, vector, options, override) {
   };
   const hasBody = (request.body ?? "").length > 0;
   const components = hasBody ? ["@method", "@target-uri", "@authority", "content-type"] : ["@method", "@target-uri", "@authority"];
+  if (hasBody && vector.verifier_capability.covers_content_digest === "required") {
+    components.push("content-digest");
+  }
   const now = nowSeconds(options);
   const windowSeconds = options.windowSeconds ?? 300;
   const params = {
@@ -347,7 +393,7 @@ function signWithParamOverride(key, vector, options, override) {
     tag: override.tag ?? import_signing.REQUEST_SIGNING_TAG
   };
   const paramsString = formatParamsWithOmissions(components, params, override);
-  const base = (0, import_signing.buildSignatureBase)(components, request, params, paramsString);
+  const base = (0, import_signing.buildSignatureBase)(components, request, params, paramsString, canonicalizationProfile(vector));
   const signature = produceSignature(key, Buffer.from(base, "utf8"));
   return {
     method: shaped.method,
@@ -355,13 +401,14 @@ function signWithParamOverride(key, vector, options, override) {
     headers: {
       ...shaped.headers,
       "Signature-Input": `sig1=${paramsString}`,
-      Signature: `sig1=:${Buffer.from(signature).toString("base64url")}:`
+      Signature: `sig1=:${Buffer.from(signature).toString(binaryEncoding(vector))}:`
     },
     body: shaped.body
   };
 }
-function signWithComponents(key, vector, options, components) {
+function signWithComponents(key, vector, options, components, refreshDigest = false) {
   const shaped = applyTransport(vector, options);
+  if (refreshDigest) refreshContentDigest(shaped, vector);
   const url = shaped.url;
   const request = {
     method: shaped.method,
@@ -380,7 +427,7 @@ function signWithComponents(key, vector, options, components) {
     tag: import_signing.REQUEST_SIGNING_TAG
   };
   const paramsString = (0, import_signing.formatSignatureParams)(components, params);
-  const base = (0, import_signing.buildSignatureBase)(components, request, params, paramsString);
+  const base = (0, import_signing.buildSignatureBase)(components, request, params, paramsString, canonicalizationProfile(vector));
   const signature = produceSignature(key, Buffer.from(base, "utf8"));
   return {
     method: shaped.method,
@@ -388,11 +435,19 @@ function signWithComponents(key, vector, options, components) {
     headers: {
       ...shaped.headers,
       "Signature-Input": `sig1=${paramsString}`,
-      Signature: `sig1=:${Buffer.from(signature).toString("base64url")}:`
+      Signature: `sig1=:${Buffer.from(signature).toString(binaryEncoding(vector))}:`
     },
     body: shaped.body
   };
 }
+function refreshContentDigest(shaped, vector) {
+  shaped.headers = mergeHeadersCaseInsensitively(shaped.headers, {
+    "Content-Digest": (0, import_signing.computeContentDigest)(
+      shaped.body ?? "",
+      (0, import_signing.requestSigningEncodingForVersion)(vector.signing_profile_version)
+    )
+  });
+}
 function formatParamsWithOmissions(components, params, override) {
   const componentList = components.map((c) => `"${c}"`).join(" ");
   const pairs = [];