@adcp/sdk 15.8.0 → 15.9.0

package/dist/lib/server/wire-spec-fields.generated.mjs

@@ -1,160 +1,160 @@
 const WIRE_SPEC_FIELDS = Object.freeze({
-  /** schemas/cache/3.2.3/brand/acquire-rights-request.json */
+  /** schemas/cache/3.2.4/brand/acquire-rights-request.json */
   AcquireRightsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "buyer", "campaign", "context", "ext", "governance_context", "idempotency_key", "pricing_option_id", "push_notification_config", "revocation_webhook", "rights_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/signals/activate-signal-request.json */
+  /** schemas/cache/3.2.4/signals/activate-signal-request.json */
   ActivateSignalRequest: Object.freeze({
     fields: Object.freeze(["account", "action", "adcp_major_version", "adcp_version", "context", "destinations", "ext", "governance_context", "idempotency_key", "pricing_option_id", "signal_agent_segment_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/media-buy/build-creative-request.json */
+  /** schemas/cache/3.2.4/media-buy/build-creative-request.json */
   BuildCreativeRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "brand", "concept_id", "config", "context", "creative_id", "creative_manifest", "creative_representation_set", "evaluator", "ext", "governance_context", "idempotency_key", "include_preview", "item_limit", "keep_mode", "macro_values", "max_creatives", "max_spend", "max_variants", "media_buy_id", "message", "mode", "package_id", "preview_inputs", "preview_output_format", "preview_quality", "push_notification_config", "quality", "refine_from_build_variant_id", "representation_destination", "representation_selection_strategy", "selection_strategy", "signal_conditions", "target_capability_id", "target_capability_ids", "target_format_id", "target_format_ids", "transformer_id", "variant_axis"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/content-standards/calibrate-content-request.json */
+  /** schemas/cache/3.2.4/content-standards/calibrate-content-request.json */
   CalibrateContentRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "artifact", "context", "ext", "idempotency_key", "standards_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/collection/create-collection-list-request.json */
+  /** schemas/cache/3.2.4/collection/create-collection-list-request.json */
   CreateCollectionListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_collections", "brand", "context", "description", "ext", "filters", "idempotency_key", "name"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/content-standards/create-content-standards-request.json */
+  /** schemas/cache/3.2.4/content-standards/create-content-standards-request.json */
   CreateContentStandardsRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "calibration_exemplars", "context", "ext", "idempotency_key", "policies", "registry_policy_ids", "scope"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/media-buy/create-media-buy-request.json */
+  /** schemas/cache/3.2.4/media-buy/create-media-buy-request.json */
   CreateMediaBuyRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "advertiser_industry", "agency_estimate_number", "artifact_webhook", "bidding", "brand", "budget_allocation", "budget_cap_timezone", "context", "daily_budget_cap", "end_time", "ext", "frequency_cap", "governance_context", "idempotency_key", "invoice_recipient", "io_acceptance", "name", "opportunity", "pacing", "packages", "paused", "plan_id", "po_number", "proposal_id", "push_notification_config", "reporting_webhook", "start_time", "total_budget"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/property/create-property-list-request.json */
+  /** schemas/cache/3.2.4/property/create-property-list-request.json */
   CreatePropertyListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_properties", "brand", "context", "description", "ext", "filters", "idempotency_key", "name"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/collection/delete-collection-list-request.json */
+  /** schemas/cache/3.2.4/collection/delete-collection-list-request.json */
   DeleteCollectionListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "list_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/property/delete-property-list-request.json */
+  /** schemas/cache/3.2.4/property/delete-property-list-request.json */
   DeletePropertyListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "list_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/media-buy/get-media-buy-delivery-request.json */
+  /** schemas/cache/3.2.4/media-buy/get-media-buy-delivery-request.json */
   GetMediaBuyDeliveryRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "attribution_window", "context", "end_date", "ext", "include_package_daily_breakdown", "include_window_breakdown", "media_buy_ids", "pagination", "reporting_dimensions", "reporting_revision_id", "requested_metrics", "start_date", "status_filter", "time_granularity"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/media-buy/get-reporting-status-request.json */
+  /** schemas/cache/3.2.4/media-buy/get-reporting-status-request.json */
   GetReportingStatusRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "changes_after", "context", "delivery_config_ids", "ext", "feed_purposes", "finality", "health", "media_buy_ids", "pagination", "period", "reporting_revision_id", "view"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/media-buy/log-event-request.json */
+  /** schemas/cache/3.2.4/media-buy/log-event-request.json */
   LogEventRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "event_source_id", "events", "ext", "idempotency_key", "test_event_code"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/media-buy/provide-performance-feedback-request.json */
+  /** schemas/cache/3.2.4/media-buy/provide-performance-feedback-request.json */
   ProvidePerformanceFeedbackRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "as_of", "baseline", "context", "creative_id", "evidence", "evidence_ref", "ext", "feedback_source", "final", "idempotency_key", "measurement_period", "media_buy_id", "methodology", "methodology_version", "metric", "metric_type", "package_id", "performance_index", "producer", "study_ref", "supersedes_feedback_id", "vendor"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/governance/report-plan-outcome-request.json */
+  /** schemas/cache/3.2.4/governance/report-plan-outcome-request.json */
   ReportPlanOutcomeRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "check_id", "context", "delivery", "error", "ext", "governance_context", "idempotency_key", "outcome", "plan_id", "purchase_type", "seller_response"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/account/report-usage-request.json */
+  /** schemas/cache/3.2.4/account/report-usage-request.json */
   ReportUsageRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "reporting_period", "usage"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/sponsored-intelligence/si-initiate-session-request.json */
+  /** schemas/cache/3.2.4/sponsored-intelligence/si-initiate-session-request.json */
   SIInitiateSessionRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "identity", "intent", "media_buy_id", "offering_id", "offering_token", "placement", "sponsored_context_receipt", "supported_capabilities"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/sponsored-intelligence/si-send-message-request.json */
+  /** schemas/cache/3.2.4/sponsored-intelligence/si-send-message-request.json */
   SISendMessageRequest: Object.freeze({
     fields: Object.freeze(["action_response", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "message", "session_id", "sponsored_context_receipt"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/account/sync-accounts-request.json */
+  /** schemas/cache/3.2.4/account/sync-accounts-request.json */
   SyncAccountsRequest: Object.freeze({
     fields: Object.freeze(["accounts", "adcp_major_version", "adcp_version", "context", "delete_missing", "dry_run", "ext", "idempotency_key", "push_notification_config"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/media-buy/sync-audiences-request.json */
+  /** schemas/cache/3.2.4/media-buy/sync-audiences-request.json */
   SyncAudiencesRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "audiences", "context", "delete_missing", "ext", "idempotency_key"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/media-buy/sync-catalogs-request.json */
+  /** schemas/cache/3.2.4/media-buy/sync-catalogs-request.json */
   SyncCatalogsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "catalog_ids", "catalogs", "context", "delete_missing", "dry_run", "ext", "idempotency_key", "item_availability_queries", "item_availability_updates", "push_notification_config", "validation_mode"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/creative/sync-creatives-request.json */
+  /** schemas/cache/3.2.4/creative/sync-creatives-request.json */
   SyncCreativesRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "assignment_operations", "assignments", "context", "creative_ids", "creatives", "delete_missing", "dry_run", "ext", "idempotency_key", "push_notification_config", "validation_mode"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/media-buy/sync-event-sources-request.json */
+  /** schemas/cache/3.2.4/media-buy/sync-event-sources-request.json */
   SyncEventSourcesRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "delete_missing", "event_sources", "ext", "idempotency_key"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/account/sync-governance-request.json */
+  /** schemas/cache/3.2.4/account/sync-governance-request.json */
   SyncGovernanceRequest: Object.freeze({
     fields: Object.freeze(["accounts", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/governance/sync-plans-request.json */
+  /** schemas/cache/3.2.4/governance/sync-plans-request.json */
   SyncPlansRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "plans"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/media-buy/sync-reporting-receipts-request.json */
+  /** schemas/cache/3.2.4/media-buy/sync-reporting-receipts-request.json */
   SyncReportingReceiptsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "adjustment_receipts", "context", "ext", "idempotency_key", "receipts"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/media-buy/sync-reporting-status-request.json */
+  /** schemas/cache/3.2.4/media-buy/sync-reporting-status-request.json */
   SyncReportingStatusRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "statuses"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/collection/update-collection-list-request.json */
+  /** schemas/cache/3.2.4/collection/update-collection-list-request.json */
   UpdateCollectionListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_collections", "brand", "context", "description", "ext", "filters", "idempotency_key", "list_id", "name", "webhook_url"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/content-standards/update-content-standards-request.json */
+  /** schemas/cache/3.2.4/content-standards/update-content-standards-request.json */
   UpdateContentStandardsRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "calibration_exemplars", "context", "ext", "idempotency_key", "policies", "registry_policy_ids", "scope", "standards_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/media-buy/update-media-buy-request.json */
+  /** schemas/cache/3.2.4/media-buy/update-media-buy-request.json */
   UpdateMediaBuyRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "bidding", "budget_allocation", "budget_cap_timezone", "canceled", "cancellation_reason", "context", "daily_budget_cap", "end_time", "ext", "frequency_cap", "governance_context", "idempotency_key", "invoice_recipient", "media_buy_id", "name", "new_packages", "pacing", "packages", "paused", "push_notification_config", "reporting_webhook", "revision", "start_time", "total_budget"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/property/update-property-list-request.json */
+  /** schemas/cache/3.2.4/property/update-property-list-request.json */
   UpdatePropertyListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_properties", "brand", "context", "description", "ext", "filters", "idempotency_key", "list_id", "name", "webhook_url"]),
     __type: null
   }),
-  /** schemas/cache/3.2.3/brand/update-rights-request.json */
+  /** schemas/cache/3.2.4/brand/update-rights-request.json */
   UpdateRightsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "end_date", "ext", "governance_context", "idempotency_key", "impression_cap", "paused", "pricing_option_id", "push_notification_config", "rights_id"]),
     __type: null

package/dist/lib/signing/verifier.js

@@ -176,6 +176,14 @@ async function verifyRequestSignature(request, options) {
       `Per-keyid replay cache cap exceeded for keyid=${jwk.kid}`
     );
   }
+  const receivedHost = (0, import_canonicalize.getHeaderValue)(request.headers, "Host");
+  if (receivedHost !== void 0) {
+    if (/[\s/?#@\\]/.test(receivedHost)) {
+      throw new import_errors.RequestSignatureError("request_target_uri_malformed", 10, "Host header is not a valid authority");
+    }
+    (0, import_canonicalize.rejectNonAsciiHost)(`https://${receivedHost}/`);
+    (0, import_canonicalize.canonicalAuthority)(`https://${receivedHost}/`, "3.2");
+  }
   const base = (0, import_canonicalize.buildSignatureBase)(
     parsedInput.components,
     request,

package/dist/lib/signing/verifier.mjs

@@ -1,6 +1,7 @@
 import { parseDictionary } from "structured-headers";
 import {
   buildSignatureBase,
+  canonicalAuthority,
   canonicalTargetUri,
   getHeaderValue,
   rejectNonAsciiHost
@@ -164,6 +165,14 @@ async function verifyRequestSignature(request, options) {
       `Per-keyid replay cache cap exceeded for keyid=${jwk.kid}`
     );
   }
+  const receivedHost = getHeaderValue(request.headers, "Host");
+  if (receivedHost !== void 0) {
+    if (/[\s/?#@\\]/.test(receivedHost)) {
+      throw new RequestSignatureError("request_target_uri_malformed", 10, "Host header is not a valid authority");
+    }
+    rejectNonAsciiHost(`https://${receivedHost}/`);
+    canonicalAuthority(`https://${receivedHost}/`, "3.2");
+  }
   const base = buildSignatureBase(
     parsedInput.components,
     request,

package/dist/lib/testing/storyboard/request-signing/builder.js

@@ -28,11 +28,55 @@ var import_signing = require('../../../signing/index.js');
 var import_vector_loader = require('./vector-loader.js');
 function buildPositiveRequest(vector, keys, options = {}) {
   const key = signerKeyFor(vector, keys);
-  return sign(key, vector, {
+  const retargeted = options.baseUrl !== void 0 || (options.transport ?? "raw") !== "raw";
+  const fixture = retargeted ? withoutFixtureHost(vector) : vector;
+  const shape = POSITIVE_SHAPES[positiveShapeKey(vector.id)];
+  if (shape) return shape(key, fixture, options);
+  return sign(key, fixture, {
     coverContentDigest: vector.verifier_capability.covers_content_digest === "required",
     ...options
   });
 }
+function withoutFixtureHost(vector) {
+  const headers = Object.fromEntries(
+    Object.entries(vector.request.headers).filter(([name]) => name.toLowerCase() !== "host")
+  );
+  return { ...vector, request: { ...vector.request, headers } };
+}
+const POSITIVE_SHAPES = {
+  // Two distinct labels on both headers. `sig1` is a real signature; `sig2`
+  // keeps the fixture's well-formed, correctly sized, non-verifying value and
+  // a different covered-component set and nonce. A verifier must process
+  // exactly one label and ignore the rest.
+  "013-two-signature-labels-distinct": (key, vector, options) => {
+    const signed = sign(key, vector, options);
+    const fixtureSig2 = /(?:^|,\s*)(sig2=:[^:,\s]+:)/.exec(vector.request.headers["Signature"] ?? "")?.[1];
+    if (!fixtureSig2) throw new Error(`${vector.id}: fixture Signature carries no sig2 member`);
+    const sig1Input = signed.headers["Signature-Input"] ?? "";
+    const sig2Input = sig1Input.replace(/^sig1=\([^)]*\)/, 'sig2=("@method" "@target-uri" "@authority")').replace(/nonce="[^"]*"/, `nonce="${randomNonce()}"`);
+    if (sig2Input === sig1Input) throw new Error(`${vector.id}: could not derive the sig2 member`);
+    return {
+      ...signed,
+      headers: {
+        ...signed.headers,
+        "Signature-Input": `${sig1Input}, ${sig2Input}`,
+        Signature: `${signed.headers["Signature"]}, ${fixtureSig2}`
+      }
+    };
+  },
+  // Content-Digest lists sha-256 and sha-512, each correct for the body that
+  // is actually sent, and the signature covers that exact header value.
+  "014-content-digest-two-algorithms": (key, vector, options) => signWithComponents(
+    key,
+    vector,
+    options,
+    ["@method", "@target-uri", "@authority", "content-type", "content-digest"],
+    (body, encoding) => `${(0, import_signing.computeContentDigest)(body, encoding)}, sha-512=:${(0, import_crypto.createHash)("sha512").update(body).digest(encoding === "legacy-base64url" ? "base64url" : "base64")}:`
+  )
+};
+function positiveShapeKey(id) {
+  return id.replace(/^profile-3\.2\/positive\//, "");
+}
 function buildNegativeRequest(vector, keys, options = {}) {
   const mutation = MUTATIONS[vector.id];
   if (!mutation) {
@@ -163,6 +207,40 @@ const MUTATIONS = {
     const key = signerKeyFor(vector, keys);
     return sign(key, vector, options);
   },
+  // The Signature header repeats label `sig1`. Both members carry the same real
+  // signature over a well-formed Signature-Input, so a verifier that keeps
+  // either the first or the last member finds no second fault and must refuse
+  // the duplicate itself.
+  "029-duplicate-signature-label": (vector, keys, options) => {
+    const signed = sign(signerKeyFor(vector, keys), vector, options);
+    const member = /^sig1=:[^:,\s]+:$/.exec(signed.headers["Signature"] ?? "")?.[0];
+    if (!member) throw new Error(`${vector.id}: signer did not emit a single sig1 member`);
+    return { ...signed, headers: { ...signed.headers, Signature: `${member}, ${member}` } };
+  },
+  // Content-Digest carries `SHA-256` and `sha-256`, both correct for the body
+  // that is sent, covered by a real signature. The uppercase dictionary key is
+  // the only fault.
+  "030-content-digest-key-case": (vector, keys, options) => signWithComponents(
+    signerKeyFor(vector, keys),
+    vector,
+    options,
+    ["@method", "@target-uri", "@authority", "content-type", "content-digest"],
+    (body, encoding) => {
+      const digest = (0, import_signing.computeContentDigest)(body, encoding);
+      return `SHA-256${digest.slice("sha-256".length)}, ${digest}`;
+    }
+  ),
+  // The signature is real over the base for the URL authority; the fixture's
+  // `Host` header (an unbracketed IPv6 literal) is the only fault, so it must
+  // reach the output unchanged.
+  "031-malformed-host-authority": (vector, keys, options) => {
+    const signed = sign(signerKeyFor(vector, keys), vector, options);
+    const fixtureHost = Object.entries(vector.request.headers).find(([name]) => name.toLowerCase() === "host");
+    if (!fixtureHost) throw new Error(`${vector.id}: fixture carries no Host header`);
+    const emitted = Object.entries(signed.headers).find(([name]) => name.toLowerCase() === "host");
+    if (emitted?.[1] !== fixtureHost[1]) throw new Error(`${vector.id}: the fixture Host header was not preserved`);
+    return signed;
+  },
   // Vectors 021-026 ship their exact malformed headers in the fixture — the
   // adversarial shape (duplicate sig-input label, multi-valued content-type
   // / content-digest, unquoted string param, malformed JWK, non-ASCII host)
@@ -192,7 +270,16 @@ const MUTATIONS = {
   // transport-ungradable by the live probe because no HTTP client can route
   // to that intentionally invalid host spelling.
   "profile-3.2/negative/001-base64url-sf-binary": (vector, _keys, options) => passthrough(vector, options),
-  "profile-3.2/negative/001-no-signature-header": delegateToRoot("001-no-signature-header"),
+  // The unsigned 3.2 mirrors ship a correct Content-Digest alongside the missing
+  // signature, so the step-0 refusal is their only fault. Keep the digest,
+  // recomputed for the body actually sent after any transport reshaping.
+  "profile-3.2/negative/001-no-signature-header": (vector, _keys, options) => {
+    const shaped = applyTransport(vector, options);
+    const headers = Object.fromEntries(
+      Object.entries(shaped.headers).filter(([name]) => !/^signature(-input)?$/i.test(name))
+    );
+    return withRefreshedDigest(vector, { method: shaped.method, url: shaped.url, headers, body: shaped.body });
+  },
   "profile-3.2/negative/002-multiple-trailing-dots": (vector, _keys, options) => passthrough(vector, options),
   "profile-3.2/negative/002-wrong-tag": delegateToRoot("002-wrong-tag"),
   "profile-3.2/negative/003-expired-signature": delegateToRoot("003-expired-signature"),
@@ -230,10 +317,11 @@ const MUTATIONS = {
   "profile-3.2/negative/024-unquoted-string-param": delegateToRoot("024-unquoted-string-param"),
   "profile-3.2/negative/025-jwk-alg-crv-mismatch": delegateToRoot("025-jwk-alg-crv-mismatch"),
   "profile-3.2/negative/026-non-ascii-host": delegateToRoot("026-non-ascii-host"),
-  "profile-3.2/negative/027-webhook-registration-authentication-unsigned": delegateToRoot(
-    "027-webhook-registration-authentication-unsigned"
-  ),
-  "profile-3.2/negative/028-unsigned-protocol-method-required": delegateToRoot("028-unsigned-protocol-method-required")
+  "profile-3.2/negative/027-webhook-registration-authentication-unsigned": (vector, _keys, options) => withRefreshedDigest(vector, passthrough(vector, options)),
+  "profile-3.2/negative/028-unsigned-protocol-method-required": (vector, _keys, options) => withRefreshedDigest(vector, protocolMethodPassthrough(vector, options)),
+  "profile-3.2/negative/029-duplicate-signature-label": delegateToRoot("029-duplicate-signature-label"),
+  "profile-3.2/negative/030-content-digest-key-case": delegateToRoot("030-content-digest-key-case"),
+  "profile-3.2/negative/031-malformed-host-authority": delegateToRoot("031-malformed-host-authority")
 };
 function delegateToRoot(rootId) {
   return (vector, keys, options) => {
@@ -242,6 +330,18 @@ function delegateToRoot(rootId) {
     return mutation(vector, keys, options);
   };
 }
+function withRefreshedDigest(vector, request) {
+  if (!Object.keys(vector.request.headers).some((name) => name.toLowerCase() === "content-digest")) return request;
+  return {
+    ...request,
+    headers: mergeHeadersCaseInsensitively(request.headers, {
+      "Content-Digest": (0, import_signing.computeContentDigest)(
+        request.body ?? "",
+        (0, import_signing.requestSigningEncodingForVersion)(vector.signing_profile_version)
+      )
+    })
+  };
+}
 function passthrough(vector, options) {
   const shaped = applyTransport(vector, options);
   return {
@@ -420,7 +520,7 @@ function signWithParamOverride(key, vector, options, override) {
 }
 function signWithComponents(key, vector, options, components, refreshDigest = false) {
   const shaped = applyTransport(vector, options);
-  if (refreshDigest) refreshContentDigest(shaped, vector);
+  if (refreshDigest) refreshContentDigest(shaped, vector, refreshDigest === true ? void 0 : refreshDigest);
   const url = shaped.url;
   const request = {
     method: shaped.method,
@@ -452,12 +552,11 @@ function signWithComponents(key, vector, options, components, refreshDigest = fa
     body: shaped.body
   };
 }
-function refreshContentDigest(shaped, vector) {
+function refreshContentDigest(shaped, vector, shape) {
+  const encoding = (0, import_signing.requestSigningEncodingForVersion)(vector.signing_profile_version);
+  const body = shaped.body ?? "";
   shaped.headers = mergeHeadersCaseInsensitively(shaped.headers, {
-    "Content-Digest": (0, import_signing.computeContentDigest)(
-      shaped.body ?? "",
-      (0, import_signing.requestSigningEncodingForVersion)(vector.signing_profile_version)
-    )
+    "Content-Digest": shape ? shape(body, encoding) : (0, import_signing.computeContentDigest)(body, encoding)
   });
 }
 function formatParamsWithOmissions(components, params, override) {

package/dist/lib/testing/storyboard/request-signing/builder.mjs

@@ -1,4 +1,4 @@
-import { createPrivateKey, randomBytes, randomUUID, sign as nodeSign } from "crypto";
+import { createHash, createPrivateKey, randomBytes, randomUUID, sign as nodeSign } from "crypto";
 import {
   buildSignatureBase,
   computeContentDigest,
@@ -11,11 +11,55 @@ import {
 import { findKey } from "./vector-loader.mjs";
 function buildPositiveRequest(vector, keys, options = {}) {
   const key = signerKeyFor(vector, keys);
-  return sign(key, vector, {
+  const retargeted = options.baseUrl !== void 0 || (options.transport ?? "raw") !== "raw";
+  const fixture = retargeted ? withoutFixtureHost(vector) : vector;
+  const shape = POSITIVE_SHAPES[positiveShapeKey(vector.id)];
+  if (shape) return shape(key, fixture, options);
+  return sign(key, fixture, {
     coverContentDigest: vector.verifier_capability.covers_content_digest === "required",
     ...options
   });
 }
+function withoutFixtureHost(vector) {
+  const headers = Object.fromEntries(
+    Object.entries(vector.request.headers).filter(([name]) => name.toLowerCase() !== "host")
+  );
+  return { ...vector, request: { ...vector.request, headers } };
+}
+const POSITIVE_SHAPES = {
+  // Two distinct labels on both headers. `sig1` is a real signature; `sig2`
+  // keeps the fixture's well-formed, correctly sized, non-verifying value and
+  // a different covered-component set and nonce. A verifier must process
+  // exactly one label and ignore the rest.
+  "013-two-signature-labels-distinct": (key, vector, options) => {
+    const signed = sign(key, vector, options);
+    const fixtureSig2 = /(?:^|,\s*)(sig2=:[^:,\s]+:)/.exec(vector.request.headers["Signature"] ?? "")?.[1];
+    if (!fixtureSig2) throw new Error(`${vector.id}: fixture Signature carries no sig2 member`);
+    const sig1Input = signed.headers["Signature-Input"] ?? "";
+    const sig2Input = sig1Input.replace(/^sig1=\([^)]*\)/, 'sig2=("@method" "@target-uri" "@authority")').replace(/nonce="[^"]*"/, `nonce="${randomNonce()}"`);
+    if (sig2Input === sig1Input) throw new Error(`${vector.id}: could not derive the sig2 member`);
+    return {
+      ...signed,
+      headers: {
+        ...signed.headers,
+        "Signature-Input": `${sig1Input}, ${sig2Input}`,
+        Signature: `${signed.headers["Signature"]}, ${fixtureSig2}`
+      }
+    };
+  },
+  // Content-Digest lists sha-256 and sha-512, each correct for the body that
+  // is actually sent, and the signature covers that exact header value.
+  "014-content-digest-two-algorithms": (key, vector, options) => signWithComponents(
+    key,
+    vector,
+    options,
+    ["@method", "@target-uri", "@authority", "content-type", "content-digest"],
+    (body, encoding) => `${computeContentDigest(body, encoding)}, sha-512=:${createHash("sha512").update(body).digest(encoding === "legacy-base64url" ? "base64url" : "base64")}:`
+  )
+};
+function positiveShapeKey(id) {
+  return id.replace(/^profile-3\.2\/positive\//, "");
+}
 function buildNegativeRequest(vector, keys, options = {}) {
   const mutation = MUTATIONS[vector.id];
   if (!mutation) {
@@ -146,6 +190,40 @@ const MUTATIONS = {
     const key = signerKeyFor(vector, keys);
     return sign(key, vector, options);
   },
+  // The Signature header repeats label `sig1`. Both members carry the same real
+  // signature over a well-formed Signature-Input, so a verifier that keeps
+  // either the first or the last member finds no second fault and must refuse
+  // the duplicate itself.
+  "029-duplicate-signature-label": (vector, keys, options) => {
+    const signed = sign(signerKeyFor(vector, keys), vector, options);
+    const member = /^sig1=:[^:,\s]+:$/.exec(signed.headers["Signature"] ?? "")?.[0];
+    if (!member) throw new Error(`${vector.id}: signer did not emit a single sig1 member`);
+    return { ...signed, headers: { ...signed.headers, Signature: `${member}, ${member}` } };
+  },
+  // Content-Digest carries `SHA-256` and `sha-256`, both correct for the body
+  // that is sent, covered by a real signature. The uppercase dictionary key is
+  // the only fault.
+  "030-content-digest-key-case": (vector, keys, options) => signWithComponents(
+    signerKeyFor(vector, keys),
+    vector,
+    options,
+    ["@method", "@target-uri", "@authority", "content-type", "content-digest"],
+    (body, encoding) => {
+      const digest = computeContentDigest(body, encoding);
+      return `SHA-256${digest.slice("sha-256".length)}, ${digest}`;
+    }
+  ),
+  // The signature is real over the base for the URL authority; the fixture's
+  // `Host` header (an unbracketed IPv6 literal) is the only fault, so it must
+  // reach the output unchanged.
+  "031-malformed-host-authority": (vector, keys, options) => {
+    const signed = sign(signerKeyFor(vector, keys), vector, options);
+    const fixtureHost = Object.entries(vector.request.headers).find(([name]) => name.toLowerCase() === "host");
+    if (!fixtureHost) throw new Error(`${vector.id}: fixture carries no Host header`);
+    const emitted = Object.entries(signed.headers).find(([name]) => name.toLowerCase() === "host");
+    if (emitted?.[1] !== fixtureHost[1]) throw new Error(`${vector.id}: the fixture Host header was not preserved`);
+    return signed;
+  },
   // Vectors 021-026 ship their exact malformed headers in the fixture — the
   // adversarial shape (duplicate sig-input label, multi-valued content-type
   // / content-digest, unquoted string param, malformed JWK, non-ASCII host)
@@ -175,7 +253,16 @@ const MUTATIONS = {
   // transport-ungradable by the live probe because no HTTP client can route
   // to that intentionally invalid host spelling.
   "profile-3.2/negative/001-base64url-sf-binary": (vector, _keys, options) => passthrough(vector, options),
-  "profile-3.2/negative/001-no-signature-header": delegateToRoot("001-no-signature-header"),
+  // The unsigned 3.2 mirrors ship a correct Content-Digest alongside the missing
+  // signature, so the step-0 refusal is their only fault. Keep the digest,
+  // recomputed for the body actually sent after any transport reshaping.
+  "profile-3.2/negative/001-no-signature-header": (vector, _keys, options) => {
+    const shaped = applyTransport(vector, options);
+    const headers = Object.fromEntries(
+      Object.entries(shaped.headers).filter(([name]) => !/^signature(-input)?$/i.test(name))
+    );
+    return withRefreshedDigest(vector, { method: shaped.method, url: shaped.url, headers, body: shaped.body });
+  },
   "profile-3.2/negative/002-multiple-trailing-dots": (vector, _keys, options) => passthrough(vector, options),
   "profile-3.2/negative/002-wrong-tag": delegateToRoot("002-wrong-tag"),
   "profile-3.2/negative/003-expired-signature": delegateToRoot("003-expired-signature"),
@@ -213,10 +300,11 @@ const MUTATIONS = {
   "profile-3.2/negative/024-unquoted-string-param": delegateToRoot("024-unquoted-string-param"),
   "profile-3.2/negative/025-jwk-alg-crv-mismatch": delegateToRoot("025-jwk-alg-crv-mismatch"),
   "profile-3.2/negative/026-non-ascii-host": delegateToRoot("026-non-ascii-host"),
-  "profile-3.2/negative/027-webhook-registration-authentication-unsigned": delegateToRoot(
-    "027-webhook-registration-authentication-unsigned"
-  ),
-  "profile-3.2/negative/028-unsigned-protocol-method-required": delegateToRoot("028-unsigned-protocol-method-required")
+  "profile-3.2/negative/027-webhook-registration-authentication-unsigned": (vector, _keys, options) => withRefreshedDigest(vector, passthrough(vector, options)),
+  "profile-3.2/negative/028-unsigned-protocol-method-required": (vector, _keys, options) => withRefreshedDigest(vector, protocolMethodPassthrough(vector, options)),
+  "profile-3.2/negative/029-duplicate-signature-label": delegateToRoot("029-duplicate-signature-label"),
+  "profile-3.2/negative/030-content-digest-key-case": delegateToRoot("030-content-digest-key-case"),
+  "profile-3.2/negative/031-malformed-host-authority": delegateToRoot("031-malformed-host-authority")
 };
 function delegateToRoot(rootId) {
   return (vector, keys, options) => {
@@ -225,6 +313,18 @@ function delegateToRoot(rootId) {
     return mutation(vector, keys, options);
   };
 }
+function withRefreshedDigest(vector, request) {
+  if (!Object.keys(vector.request.headers).some((name) => name.toLowerCase() === "content-digest")) return request;
+  return {
+    ...request,
+    headers: mergeHeadersCaseInsensitively(request.headers, {
+      "Content-Digest": computeContentDigest(
+        request.body ?? "",
+        requestSigningEncodingForVersion(vector.signing_profile_version)
+      )
+    })
+  };
+}
 function passthrough(vector, options) {
   const shaped = applyTransport(vector, options);
   return {
@@ -403,7 +503,7 @@ function signWithParamOverride(key, vector, options, override) {
 }
 function signWithComponents(key, vector, options, components, refreshDigest = false) {
   const shaped = applyTransport(vector, options);
-  if (refreshDigest) refreshContentDigest(shaped, vector);
+  if (refreshDigest) refreshContentDigest(shaped, vector, refreshDigest === true ? void 0 : refreshDigest);
   const url = shaped.url;
   const request = {
     method: shaped.method,
@@ -435,12 +535,11 @@ function signWithComponents(key, vector, options, components, refreshDigest = fa
     body: shaped.body
   };
 }
-function refreshContentDigest(shaped, vector) {
+function refreshContentDigest(shaped, vector, shape) {
+  const encoding = requestSigningEncodingForVersion(vector.signing_profile_version);
+  const body = shaped.body ?? "";
   shaped.headers = mergeHeadersCaseInsensitively(shaped.headers, {
-    "Content-Digest": computeContentDigest(
-      shaped.body ?? "",
-      requestSigningEncodingForVersion(vector.signing_profile_version)
-    )
+    "Content-Digest": shape ? shape(body, encoding) : computeContentDigest(body, encoding)
   });
 }
 function formatParamsWithOmissions(components, params, override) {