@adcp/sdk 15.8.1 → 15.9.0

package/compliance/cache/3.2.4/test-vectors/request-signing/positive/015-bracketed-ipv6-host-with-port.json

@@ -0,0 +1,32 @@
+{
+  "name": "Bracketed IPv6 literal with non-default port in both the URL and the Host header",
+  "spec_reference": "#adcp-rfc-9421-profile (@authority derived from as-received Host; IPv6 brackets preserved, non-default port kept)",
+  "signing_profile_version": "3.1",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://[2001:db8::1]:8443/adcp/create_media_buy",
+    "headers": {
+      "Host": "[2001:db8::1]:8443",
+      "Content-Type": "application/json",
+      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+      "Signature": "sig1=:KFJa1rmiEAYePBhzr1bHsjvkvrD9cs7MXGPiVv6wD9LZINvTTeDR50N3mE5GaCwbcuxaesexETAJeTcj4MPYDg:"
+    },
+    "body": "{\"idempotency_key\":\"vector-positive-015-bracketed-ipv6-host-with-port\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "either",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://[2001:db8::1]:8443/adcp/create_media_buy\n\"@authority\": [2001:db8::1]:8443\n\"content-type\": application/json\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": true
+  },
+  "$comment": "False-positive guard for negative/031. The Host header carries a well-formed bracketed IPv6 authority with a non-default port; it byte-matches the authority of the canonical @target-uri, so @authority is '[2001:db8::1]:8443' and the request verifies. Without this vector a verifier passes 031 by rejecting every Host header that contains ':' or '['. Extends 011-ipv6-authority (no Host header, default port) and 012 (default port stripped) to a non-default port carried on the Host header. Signature generated with the test-ed25519-2026 private key from expected_signature_base."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/negative/001-no-signature-header.json

@@ -0,0 +1,31 @@
+{
+  "name": "AdCP 3.2 unsigned request to an operation in required_for (Content-Digest sent, nothing signed)",
+  "spec_reference": "#verifier-checklist-requests pre-check (required_for enforcement); AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/adcp/create_media_buy",
+    "headers": {
+      "Content-Type": "application/json",
+      "Content-Digest": "sha-256=:nODniPasrOwG+VeIC4UcO5eGL3o1AGoffQ8Ih3JDVx0=:"
+    },
+    "body": "{\"idempotency_key\":\"vector-profile-3-2-negative-001-no-signature-header\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_required",
+    "failed_step": 0
+  },
+  "$comment": "3.2-profile counterpart of negative/001-no-signature-header.json. AdCP 3.2 profile: the verifier advertises covers_content_digest='required' and the request carries a correct Content-Digest, but no usable signature is presented, so the step-0 fault is the only fault. Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/negative/011-malformed-header.json

@@ -0,0 +1,33 @@
+{
+  "name": "AdCP 3.2 Signature-Input present but syntactically invalid (downgrade protection; Content-Digest sent)",
+  "spec_reference": "#verifier-checklist-requests pre-check (malformed header, no bearer fallback); AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/adcp/sync_creatives",
+    "headers": {
+      "Content-Type": "application/json",
+      "Signature-Input": "this-is-not-a-valid-rfc-9421-signature-input",
+      "Signature": "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==:",
+      "Content-Digest": "sha-256=:iRu+uxya7cmJRTbXUq8l2H8PYiwq7hD6MymHur+cd5w=:"
+    },
+    "body": "{\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"creatives\":[{\"creative_id\":\"c_0001\",\"name\":\"Test Creative\",\"format_id\":{\"agent_url\":\"https://creative.adcontextprotocol.org/\",\"id\":\"display_300x250_image\"},\"assets\":{\"banner\":{\"asset_type\":\"image\",\"url\":\"https://example.com/banner.png\",\"width\":300,\"height\":250}}}],\"idempotency_key\":\"vector-profile-3-2-negative-011-malformed-header\",\"delete_missing\":false,\"dry_run\":false,\"validation_mode\":\"strict\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_header_malformed",
+    "failed_step": 1
+  },
+  "$comment": "3.2-profile counterpart of negative/011-malformed-header.json. AdCP 3.2 profile: the verifier advertises covers_content_digest='required' and the request carries a correct Content-Digest. The Signature-Input value is not parseable, so there is no covered-components list in which content-digest could be covered and no signature base to sign. Signature is the 64-zero-byte placeholder (step-ordering canary): the targeted check runs before cryptographic verification, so a verifier that verifies first returns request_signature_invalid instead of the expected code. Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/negative/019-signature-without-signature-input.json

@@ -0,0 +1,31 @@
+{
+  "name": "AdCP 3.2 Signature header present but Signature-Input header absent (downgrade loophole; content-digest covered in the stripped shape)",
+  "spec_reference": "#verifier-checklist-requests pre-check (header pair enforcement); AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/adcp/create_media_buy",
+    "headers": {
+      "Content-Type": "application/json",
+      "Content-Digest": "sha-256=:CDVo0AYxcfmqk71EoGxOY8jRDCjJ0VURRSRLJ7stOMs=:",
+      "Signature": "sig1=:D4eGZiMi78duzNDkwDxHACBK9tlbnb3P0uqWBgzaSURvwAv2jwI85rUAeTZEZF/vs9Nm8OyAdqZ62wBT69KkDg==:"
+    },
+    "body": "{\"idempotency_key\":\"vector-profile-3-2-negative-019-signature-without-signature-input\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": []
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/adcp/create_media_buy\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:CDVo0AYxcfmqk71EoGxOY8jRDCjJ0VURRSRLJ7stOMs=:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_header_malformed",
+    "failed_step": 1
+  },
+  "$comment": "3.2-profile counterpart of negative/019-signature-without-signature-input.json. AdCP 3.2 profile: the signature covers content-digest, binary values use RFC 8941 sf-binary (standard padded Base64), and the verifier advertises covers_content_digest='required'. The operation is not in required_for, so the unpaired Signature is the only fault whatever order the pre-check bullets are read in. The request is a correctly signed 3.2 request (content-digest covered) whose Signature-Input a proxy stripped. The Signature is a real Ed25519 signature by test-ed25519-2026 over expected_signature_base, the base the stripped Signature-Input would have described; no other fault is present, so rejecting at step 1 is the only conformant outcome. Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/negative/021-duplicate-signature-input-label.json

@@ -0,0 +1,34 @@
+{
+  "name": "AdCP 3.2 Signature-Input header declares label 'sig1' twice (malformed structured dictionary, content-digest covered)",
+  "spec_reference": "#verifier-checklist-requests step 1 (RFC 9421 §4.1 Signature-Input is a Dictionary; duplicate keys malformed); AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/adcp/create_media_buy",
+    "headers": {
+      "Content-Type": "application/json",
+      "Content-Digest": "sha-256=:NNAjLIoYP1NsXiVnKObP56aOW35CIrOFXinWZPEj5Oc=:",
+      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\", sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+      "Signature": "sig1=:y0pNBJ+oSxrvMdXjzwNfabP4m1pZuyUO4ny3Ti+PFN5P1zUDRS3hIaLJZZVX2ao+KF7G6aUaESx7g70NNUzUAQ==:"
+    },
+    "body": "{\"idempotency_key\":\"vector-profile-3-2-negative-021-duplicate-signature-input-label\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/adcp/create_media_buy\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:NNAjLIoYP1NsXiVnKObP56aOW35CIrOFXinWZPEj5Oc=:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_header_malformed",
+    "failed_step": 1
+  },
+  "$comment": "3.2-profile counterpart of negative/021-duplicate-signature-input-label.json. AdCP 3.2 profile: the signature covers content-digest, binary values use RFC 8941 sf-binary (standard padded Base64), and the verifier advertises covers_content_digest='required'. The Signature-Input header repeats the same sig1 member twice, byte for byte; it covers content-digest and its Signature is a valid Ed25519 signature over expected_signature_base. A verifier that keeps either member therefore verifies the request, so the duplicate label is the only fault. (The root vector's second member is weaker; the 3.2 mirror repeats the first so that no second fault is reachable by keeping the last one.) Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/negative/022-multi-valued-content-type.json

@@ -0,0 +1,34 @@
+{
+  "name": "AdCP 3.2 Content-Type header sent as multiple field values (malformed — covered field must be single-valued, content-digest covered)",
+  "spec_reference": "#verifier-checklist-requests step 1 (covered component fields must be single-valued; RFC 9421 §2.1 derivation rules do not permit concatenation for non-list headers); AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/adcp/create_media_buy",
+    "headers": {
+      "Content-Type": "application/json, text/plain",
+      "Content-Digest": "sha-256=:Ef1MgmdCrkSSjOvZz3yx3jRIWt8AalT41OMgMPsPgs0=:",
+      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+      "Signature": "sig1=:P2P7xqNLLvR7x+Byyepc5ihnIUGps5YY81FHkLj3RdNLs21nvIhSc3KzujOj/T9w3bI934D+E70kqu9Z0VjWAw==:"
+    },
+    "body": "{\"idempotency_key\":\"vector-profile-3-2-negative-022-multi-valued-content-type\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/adcp/create_media_buy\n\"@authority\": seller.example.com\n\"content-type\": application/json, text/plain\n\"content-digest\": sha-256=:Ef1MgmdCrkSSjOvZz3yx3jRIWt8AalT41OMgMPsPgs0=:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_header_malformed",
+    "failed_step": 1
+  },
+  "$comment": "3.2-profile counterpart of negative/022-multi-valued-content-type.json. AdCP 3.2 profile: the signature covers content-digest, binary values use RFC 8941 sf-binary (standard padded Base64), and the verifier advertises covers_content_digest='required'. The Signature is a valid Ed25519 signature over expected_signature_base, which carries the Content-Type value exactly as sent, so the multi-valued field is the only fault. Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/negative/023-multi-valued-content-digest.json

@@ -0,0 +1,34 @@
+{
+  "name": "AdCP 3.2 Content-Digest header sent as multiple field values (malformed, content-digest covered)",
+  "spec_reference": "#verifier-checklist-requests step 1 (Content-Digest covered in signature must be single-valued; RFC 9530); AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/adcp/create_media_buy",
+    "headers": {
+      "Content-Type": "application/json",
+      "Content-Digest": "sha-256=:NhC0hsbCQ3lWjG8FkOteUEaHCB1/tNMbRvTxDKsMhdU=:, sha-256=:NhC0hsbCQ3lWjG8FkOteUEaHCB1/tNMbRvTxDKsMhdU=:",
+      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+      "Signature": "sig1=:+chRWRUwyDCbZZwlQXclhQrql5Ycxrd3ENjOxVQz76ZYWUwnuF9XUbf0tXuSqTBaVG6KcgbPlO81WxTBZPuyDQ==:"
+    },
+    "body": "{\"idempotency_key\":\"vector-profile-3-2-negative-023-multi-valued-content-digest\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/adcp/create_media_buy\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:NhC0hsbCQ3lWjG8FkOteUEaHCB1/tNMbRvTxDKsMhdU=:, sha-256=:NhC0hsbCQ3lWjG8FkOteUEaHCB1/tNMbRvTxDKsMhdU=:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_header_malformed",
+    "failed_step": 1
+  },
+  "$comment": "3.2-profile counterpart of negative/023-multi-valued-content-digest.json. AdCP 3.2 profile: the signature covers content-digest, binary values use RFC 8941 sf-binary (standard padded Base64), and the verifier advertises covers_content_digest='required'. Both Content-Digest members are the correct sha-256 of the body, so a verifier that keeps either one finds a matching digest. The Signature is a valid Ed25519 signature over expected_signature_base, which carries the Content-Digest value exactly as sent, so the repeated algorithm is the only fault. Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/negative/024-unquoted-string-param.json

@@ -0,0 +1,34 @@
+{
+  "name": "AdCP 3.2 Signature-Input sig-param string value sent unquoted (keyid=foo instead of keyid=\"foo\", content-digest covered)",
+  "spec_reference": "#verifier-checklist-requests step 1 (RFC 9421 §2.3 sig-params; RFC 8941 §3.3 string values MUST be double-quoted); AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/adcp/create_media_buy",
+    "headers": {
+      "Content-Type": "application/json",
+      "Content-Digest": "sha-256=:Q3FQYXttiTxTTe/Uyd4kU85SugyiiPGIIISxQAuF2VU=:",
+      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=test-ed25519-2026;alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+      "Signature": "sig1=:AmBtcnmPqvAgc/2i+tLjfZYF7flBtLf1Bds/vD9wc3MHxc9XQ7x2bjgp1XwMXQMfpkMNLgnFN8vD12ZmF81yBQ==:"
+    },
+    "body": "{\"idempotency_key\":\"vector-profile-3-2-negative-024-unquoted-string-param\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/adcp/create_media_buy\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:Q3FQYXttiTxTTe/Uyd4kU85SugyiiPGIIISxQAuF2VU=:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=test-ed25519-2026;alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_header_malformed",
+    "failed_step": 1
+  },
+  "$comment": "3.2-profile counterpart of negative/024-unquoted-string-param.json. AdCP 3.2 profile: the signature covers content-digest, binary values use RFC 8941 sf-binary (standard padded Base64), and the verifier advertises covers_content_digest='required'. The Signature is a valid Ed25519 signature over expected_signature_base, which carries the sig-params exactly as sent (unquoted keyid), so the unquoted string is the only fault. Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/negative/026-non-ascii-host.json

@@ -0,0 +1,34 @@
+{
+  "name": "AdCP 3.2 URL authority contains raw IDN U-label (non-ASCII bytes in host, content-digest covered)",
+  "spec_reference": "#adcp-rfc-9421-profile (@target-uri canonicalization: hosts MUST be ASCII A-labels; RFC 5891 §4.4); security.mdx error table: raw non-ASCII host → request_target_uri_malformed; AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://bücher.example.com/adcp/create_media_buy",
+    "headers": {
+      "Content-Type": "application/json",
+      "Content-Digest": "sha-256=:kIaEys2lgdMw3nBKsDVxqowKlhUAwuZ7fv/ao1EWz30=:",
+      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+      "Signature": "sig1=:kPfSDWSJkxG8dJjqL6sGEgUIilMlas5j7LqD9AnjvcupsVqVB3e1wziTlvJX9//oAlSraR/4ZwpVAtwvwDqZDQ==:"
+    },
+    "body": "{\"idempotency_key\":\"vector-profile-3-2-negative-026-non-ascii-host\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://xn--bcher-kva.example.com/adcp/create_media_buy\n\"@authority\": xn--bcher-kva.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:kIaEys2lgdMw3nBKsDVxqowKlhUAwuZ7fv/ao1EWz30=:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_target_uri_malformed",
+    "failed_step": 10
+  },
+  "$comment": "3.2-profile counterpart of negative/026-non-ascii-host.json. AdCP 3.2 profile: the signature covers content-digest, binary values use RFC 8941 sf-binary (standard padded Base64), and the verifier advertises covers_content_digest='required'. The Signature is a valid Ed25519 signature over the base for the A-label form of the host (xn--bcher-kva.example.com), the base a signer that canonicalized correctly would produce. A verifier that silently re-normalizes the U-label would therefore verify the signature; docs/reference/url-canonicalization.mdx requires the comparer to reject a raw non-ASCII host instead, so the raw U-label on the wire is the only fault. The expected code follows root 026 (request_target_uri_malformed at step 10, per the maintainer decision on adcp#7905). Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/negative/027-webhook-registration-authentication-unsigned.json

@@ -0,0 +1,30 @@
+{
+  "name": "AdCP 3.2 webhook registration with push_notification_config.authentication over bearer (unsigned); operation NOT in required_for (Content-Digest sent)",
+  "spec_reference": "#webhook-security Downgrade and injection resistance — MUST require 9421 when authentication is present; AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/adcp/update_media_buy",
+    "headers": {
+      "Content-Type": "application/json",
+      "Authorization": "Bearer test-bearer-token",
+      "Content-Digest": "sha-256=:E+LdIY2+s0VOVRV19uSrCWt4s85QWjv4VDcyc3m+sog=:"
+    },
+    "body": "{\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"media_buy_id\":\"mb_001\",\"idempotency_key\":\"vector-profile-3-2-negative-027-webhook-registration-authentication-unsigned\",\"brand\":{\"domain\":\"brand.example\"},\"push_notification_config\":{\"url\":\"https://buyer.example.com/webhook\",\"authentication\":{\"schemes\":[\"HMAC-SHA256\"],\"credentials\":\"ssssssssssssssssssssssssssssssssssssssss\"}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": []
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_required",
+    "failed_step": 0
+  },
+  "$comment": "3.2-profile counterpart of negative/027-webhook-registration-authentication-unsigned.json. AdCP 3.2 profile: the verifier advertises covers_content_digest='required' and the request carries a correct Content-Digest, but no usable signature is presented, so the step-0 fault is the only fault. Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/negative/028-unsigned-protocol-method-required.json

@@ -0,0 +1,32 @@
+{
+  "name": "AdCP 3.2 unsigned tasks/cancel JSON-RPC POST; method is in protocol_methods_required_for (Content-Digest sent)",
+  "spec_reference": "#signed-requests-transport-layer (protocol_methods_* namespace; pre-check 0); AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/mcp",
+    "headers": {
+      "Content-Type": "application/json",
+      "Content-Digest": "sha-256=:3P1xXLJI+Tke1E3EQTdP9Htsynb0Oq9aqD3vguuCULE=:"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"method\":\"tasks/cancel\",\"params\":{\"taskId\":\"task_conformance_001\"},\"id\":1}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [],
+    "protocol_methods_required_for": [
+      "tasks/cancel"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_required",
+    "failed_step": 0
+  },
+  "$comment": "3.2-profile counterpart of negative/028-unsigned-protocol-method-required.json. AdCP 3.2 profile: the verifier advertises covers_content_digest='required' and the request carries a correct Content-Digest, but no usable signature is presented, so the step-0 fault is the only fault. Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/negative/029-duplicate-signature-label.json

@@ -0,0 +1,34 @@
+{
+  "name": "AdCP 3.2 Signature header declares label 'sig1' twice (malformed structured dictionary, content-digest covered)",
+  "spec_reference": "#verifier-checklist-requests step 1 (RFC 9421 §4.2 Signature is a Dictionary; RFC 8941 §3.2 keys are unique; AdCP rejects duplicate labels rather than retaining the last); AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/adcp/create_media_buy",
+    "headers": {
+      "Content-Type": "application/json",
+      "Content-Digest": "sha-256=:Fl7pGOE8MXD49dUig9o72/y73tU2xqwfL6n9eHg2kXM=:",
+      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+      "Signature": "sig1=:r/DDnXNu+Yz9tDymMybuOJFt+POlsgiINuVzHvVHgu+OrYBHiJQvHQ1KCtzTkU+0FRId6ZyWUGzgGZ9y2XT7DQ==:, sig1=:r/DDnXNu+Yz9tDymMybuOJFt+POlsgiINuVzHvVHgu+OrYBHiJQvHQ1KCtzTkU+0FRId6ZyWUGzgGZ9y2XT7DQ==:"
+    },
+    "body": "{\"idempotency_key\":\"vector-profile-3-2-negative-029-duplicate-signature-label\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/adcp/create_media_buy\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:Fl7pGOE8MXD49dUig9o72/y73tU2xqwfL6n9eHg2kXM=:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_header_malformed",
+    "failed_step": 1
+  },
+  "$comment": "3.2-profile counterpart of negative/029-duplicate-signature-label.json. AdCP 3.2 profile: the signature covers content-digest, binary values use RFC 8941 sf-binary (standard padded Base64), and the verifier advertises covers_content_digest='required'. Signature-Input carries sig1 exactly once, covers content-digest, and is well formed; only the Signature header repeats the label. Both Signature members are the same valid Ed25519 signature over expected_signature_base, so a verifier that keeps either one verifies it and the repeated label is the only fault. Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/negative/030-content-digest-key-case.json

@@ -0,0 +1,34 @@
+{
+  "name": "AdCP 3.2 Content-Digest carries SHA-256 and sha-256 (uppercase dictionary key is not a case-insensitive synonym, content-digest covered)",
+  "spec_reference": "#verifier-checklist-requests step 1 (RFC 9530 §2 Content-Digest is an RFC 8941 Dictionary; RFC 8941 §3.1.2 keys are lowercase only); AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/adcp/create_media_buy",
+    "headers": {
+      "Content-Type": "application/json",
+      "Content-Digest": "SHA-256=:21dxJDSRQbO0g8ppYqCLM3nGKNTR454hle8yfY3DWiA=:, sha-256=:21dxJDSRQbO0g8ppYqCLM3nGKNTR454hle8yfY3DWiA=:",
+      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+      "Signature": "sig1=:7wOfKIt+6DUYjlPDijJx19de+TWuhWpD0Gwg/4bRAdjKoWsCMx0kaueGgjZBFMKzqr/tLlKXvtmExsJ635FlBg==:"
+    },
+    "body": "{\"idempotency_key\":\"vector-profile-3-2-negative-030-content-digest-key-case\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/adcp/create_media_buy\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": SHA-256=:21dxJDSRQbO0g8ppYqCLM3nGKNTR454hle8yfY3DWiA=:, sha-256=:21dxJDSRQbO0g8ppYqCLM3nGKNTR454hle8yfY3DWiA=:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_header_malformed",
+    "failed_step": 1
+  },
+  "$comment": "3.2-profile counterpart of negative/030-content-digest-key-case.json. AdCP 3.2 profile: the signature covers content-digest, binary values use RFC 8941 sf-binary (standard padded Base64), and the verifier advertises covers_content_digest='required'. Both members are the correct digest of the body in standard padded Base64, and the Signature is a valid Ed25519 signature over expected_signature_base, which carries the Content-Digest value exactly as sent, so the uppercase key is the only fault. Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/negative/031-malformed-host-authority.json

@@ -0,0 +1,35 @@
+{
+  "name": "AdCP 3.2 Host header carries an unbracketed IPv6 literal (malformed authority) while the URL is clean (content-digest covered)",
+  "spec_reference": "#adcp-rfc-9421-profile (@authority derived from the as-received Host header and canonicalized by the URL canonicalization algorithm; malformed authority → request_target_uri_malformed); AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://[::1]/adcp/create_media_buy",
+    "headers": {
+      "Host": "::1",
+      "Content-Type": "application/json",
+      "Content-Digest": "sha-256=:9zL8fhx5CdjqPaxHFqS+b2lrm4hc2syRWMV5jmlbjtY=:",
+      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+      "Signature": "sig1=:+O4ID3iFmdHlAGeD7vbGNL+x0Z6Rb/Ae0qIh+sj2zEJN376Q2EzQMQaviCXYZpTC9fBeVIO4tFVwg8BdDlRVBA==:"
+    },
+    "body": "{\"idempotency_key\":\"vector-profile-3-2-negative-031-malformed-host-authority\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://[::1]/adcp/create_media_buy\n\"@authority\": [::1]\n\"content-type\": application/json\n\"content-digest\": sha-256=:9zL8fhx5CdjqPaxHFqS+b2lrm4hc2syRWMV5jmlbjtY=:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_target_uri_malformed",
+    "failed_step": 10
+  },
+  "$comment": "3.2-profile counterpart of negative/031-malformed-host-authority.json. AdCP 3.2 profile: the signature covers content-digest, binary values use RFC 8941 sf-binary (standard padded Base64), and the verifier advertises covers_content_digest='required'. The URL is the valid bracketed form and the Signature is a real Ed25519 signature over the base computed from the URL authority [::1], so the Host header is the only fault. A verifier that derives @authority from the URL alone verifies it. Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/positive/013-two-signature-labels-distinct.json

@@ -0,0 +1,33 @@
+{
+  "name": "AdCP 3.2 two distinct labels on both Signature-Input and Signature — verifier processes sig1 and does not reject the dictionaries (content-digest covered)",
+  "spec_reference": "#adcp-rfc-9421-profile (One signature per request); #verifier-checklist-requests step 1 (duplicate-key rejection applies to repeated labels, not to distinct ones); AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/adcp/create_media_buy",
+    "headers": {
+      "Content-Type": "application/json",
+      "Content-Digest": "sha-256=:VN/fNweBxR2Mt3rX0fhchkjSex6123k1Y5eOOeo4vdA=:",
+      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\", sig2=(\"@method\" \"@target-uri\" \"@authority\");created=1776520800;expires=1776521100;nonce=\"m4Fq2xYt9ZbCwLJd7sVn8g\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+      "Signature": "sig1=:4D2PJrWzBl9yuR631BO+RsRldBGginL+4XuO8lv+FPc0UmbxA4CV61JU37YJkAlYE6g662KcEa03urogNTGNCg==:, sig2=:AwoRGB8mLTQ7QklQV15lbHN6gYiPlp2kq7K5wMfO1dzj6vH4/wYNFBsiKTA3PkVMU1phaG92fYSLkpmgp661vA==:"
+    },
+    "body": "{\"idempotency_key\":\"vector-profile-3-2-positive-013-two-signature-labels-distinct\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/adcp/create_media_buy\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:VN/fNweBxR2Mt3rX0fhchkjSex6123k1Y5eOOeo4vdA=:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": true,
+    "verified_label": "sig1"
+  },
+  "$comment": "3.2-profile counterpart of positive/013-two-signature-labels-distinct.json. AdCP 3.2 profile: the signature covers content-digest, binary values use RFC 8941 sf-binary (standard padded Base64), and the verifier advertises covers_content_digest='required'. False-positive guard for negative/029 and 021. sig1 is a valid signature covering content-digest. sig2 has a different covered-components set, a different nonce, and a well-formed 64-byte value (the root vector's bytes, re-encoded as standard padded Base64) that does not verify. Verifiers MUST process exactly one label (conventionally sig1) and ignore the rest; attempting sig2 and rejecting is non-conformant. Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}

package/compliance/cache/3.2.4/test-vectors/request-signing/profile-3.2/positive/014-content-digest-two-algorithms.json

@@ -0,0 +1,32 @@
+{
+  "name": "AdCP 3.2 Content-Digest carries sha-256 and sha-512, both correct — distinct algorithm keys are legal (content-digest covered)",
+  "spec_reference": "#verifier-checklist-requests steps 1 and 11 (RFC 9530 §2: Content-Digest is a Dictionary keyed by lowercase algorithm name; RFC 8941 §3.1.2); AdCP 3.2 profile per #content-digest-and-proxy-compatibility and #adcp-rfc-9421-profile binary value encoding",
+  "signing_profile_version": "3.2",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/adcp/create_media_buy",
+    "headers": {
+      "Content-Type": "application/json",
+      "Content-Digest": "sha-256=:L7k6nKQUaZmWbGSlP3eii0WX+aijX8F0omEIPVcyUq0=:, sha-512=:2ichC2RWltILOGlam+IYJQjM9DY0zQ8xrYzFAPZo8cfZXEZJAF37118EWQYGMfRm5wMtngc7zu4N7+5PsZ6AGg==:",
+      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+      "Signature": "sig1=:H63J77EyvOnHa55rhsyxuDoNvRwiBINDEzb8Eg35YdecWl0hThD/jNGl2gpv0anrZdvlKB5fksfxcB+Yxop3Cg==:"
+    },
+    "body": "{\"idempotency_key\":\"vector-profile-3-2-positive-014-content-digest-two-algorithms\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/adcp/create_media_buy\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:L7k6nKQUaZmWbGSlP3eii0WX+aijX8F0omEIPVcyUq0=:, sha-512=:2ichC2RWltILOGlam+IYJQjM9DY0zQ8xrYzFAPZo8cfZXEZJAF37118EWQYGMfRm5wMtngc7zu4N7+5PsZ6AGg==:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": true
+  },
+  "$comment": "3.2-profile counterpart of positive/014-content-digest-two-algorithms.json. AdCP 3.2 profile: the signature covers content-digest, binary values use RFC 8941 sf-binary (standard padded Base64), and the verifier advertises covers_content_digest='required'. False-positive guard for negative/023 and 030. Both members are the correct digest of the body in standard padded Base64, and the Signature is a real Ed25519 signature over expected_signature_base, which carries the Content-Digest value verbatim. Generated by scripts/generate-request-signing-profile-3.2-vectors.mjs from the test keys in keys.json; do not hand-edit."
+}