@adcp/sdk 15.8.1 → 16.0.0-beta.1

package/dist/lib/testing/compliance/comply.js

@@ -429,13 +429,18 @@ async function comply(agentUrl, options = {}) {
       `Refusing to run compliance against a non-HTTPS URL: ${agentUrl}. Production agents MUST terminate TLS. Pass { allow_http: true } (or --allow-http) for local development.`
     );
   }
-  return (0, import_protocols.withMCPConnectionScope)(async () => {
-    try {
-      return await complyImpl(agentUrl, options);
-    } finally {
-      await (0, import_protocols.closeScopedConnections)(options.protocol);
-    }
-  });
+  return (0, import_client.withTestClientScope)(
+    () => (0, import_protocols.withMCPConnectionScope)(
+      async () => {
+        try {
+          return await complyImpl(agentUrl, options);
+        } finally {
+          await (0, import_protocols.closeScopedConnections)(options.protocol);
+        }
+      },
+      { isolate: true }
+    )
+  );
 }
 function sanitizeAgentText(text, max = 500) {
   const cleaned = text.replace(/[\p{C}\u2028\u2029\u202A-\u202E\u2066-\u2069]/gu, "").trim();
@@ -912,6 +917,15 @@ function buildNotApplicableStoryboardResult(agentUrl, na) {
   };
 }
 async function runComplyStoryboard(agentUrl, storyboard, runOptions, profile, routeStoryboard) {
+  runOptions = { ...runOptions, _discoveryPass: {} };
+  const resolution = (0, import_client.getOrCreateClientResolution)(agentUrl, runOptions);
+  const discovered = await (0, import_client.getOrDiscoverProfile)(resolution.client, runOptions);
+  if (discovered.step.passed) {
+    profile = discovered.profile;
+    runOptions = { ...runOptions, _profile: profile, agentTools: profile.tools };
+  } else {
+    runOptions = { ...runOptions, _profile: void 0, agentTools: void 0 };
+  }
   if (!routeStoryboard || (0, import_runner.storyboardCapabilityGateUnmet)(storyboard, runOptions) !== null) {
     return (0, import_runner.runStoryboard)(agentUrl, storyboard, runOptions);
   }
@@ -1371,7 +1385,7 @@ async function complyImpl(agentUrl, options) {
       profile,
       step: profileStep,
       caughtError: profileCaughtError
-    } = await (0, import_client.discoverAgentProfile)(discoveryClient, signal, complianceIndex.adcp_version);
+    } = await (0, import_client.getOrDiscoverProfile)(discoveryClient, { ...discoveryOptions, signal }, complianceIndex.adcp_version);
     if (testOptions.versionEnvelope === void 0 && profile.tools.includes("get_adcp_capabilities") && profile.raw_capabilities === void 0 && !profileStep.error?.startsWith("VERSION_UNSUPPORTED:")) {
       const legacyDiscoveryOptions = { ...effectiveOptions, versionEnvelope: "major-only" };
       const legacyDiscoveryClient = (0, import_client.createTestClient)(
@@ -1379,7 +1393,11 @@ async function complyImpl(agentUrl, options) {
         effectiveOptions.protocol ?? "mcp",
         legacyDiscoveryOptions
       );
-      const legacyDiscovery = await (0, import_client.discoverAgentProfile)(legacyDiscoveryClient, signal, complianceIndex.adcp_version);
+      const legacyDiscovery = await (0, import_client.getOrDiscoverProfile)(
+        legacyDiscoveryClient,
+        { ...legacyDiscoveryOptions, signal },
+        complianceIndex.adcp_version
+      );
       if (legacyDiscovery.profile.raw_capabilities !== void 0) {
         discoveryOptions = legacyDiscoveryOptions;
         discoveryClient = legacyDiscoveryClient;
@@ -1394,7 +1412,7 @@ async function complyImpl(agentUrl, options) {
       ...testOptions.adcpVersion !== void 0 && { callerAdcpVersion: testOptions.adcpVersion },
       ...testOptions.versionEnvelope !== void 0 && { callerVersionEnvelope: testOptions.versionEnvelope }
     });
-    const client = discoveryOptions === effectiveOptions ? discoveryClient : (0, import_client.createTestClient)(agentUrl, effectiveOptions.protocol ?? "mcp", effectiveOptions);
+    const client = discoveryOptions === effectiveOptions ? discoveryClient : (0, import_client.getOrCreateClientResolution)(agentUrl, effectiveOptions).client;
     (0, import_client.seedTestClientSigningCapability)(client, profile, complianceIndex.adcp_version);
     effectiveOptions._client = client;
     effectiveOptions._profile = profile;
@@ -1456,6 +1474,7 @@ async function complyImpl(agentUrl, options) {
         if (runnable.length > 0) {
           allObservations.push(...authCheck.observations);
           effectiveOptions._profile = degraded;
+          (0, import_client.seedAuthRejectedTestClientProfile)(client, degraded, complianceIndex.adcp_version);
           return await runWithDegradedProfile(
             agentUrl,
             degraded,

package/dist/lib/testing/compliance/comply.mjs

@@ -1,4 +1,11 @@
-import { createTestClient, discoverAgentProfile, seedTestClientSigningCapability } from "../client.mjs";
+import {
+  createTestClient,
+  getOrCreateClientResolution,
+  getOrDiscoverProfile,
+  seedTestClientSigningCapability,
+  seedAuthRejectedTestClientProfile,
+  withTestClientScope
+} from "../client.mjs";
 import { collectDetachedAssertionFailures, mapStoryboardResultsToTrackResult, TRACK_LABELS } from "./storyboard-tracks.mjs";
 import {
   applyAdcpVersionRunOptions,
@@ -412,13 +419,18 @@ async function comply(agentUrl, options = {}) {
       `Refusing to run compliance against a non-HTTPS URL: ${agentUrl}. Production agents MUST terminate TLS. Pass { allow_http: true } (or --allow-http) for local development.`
     );
   }
-  return withMCPConnectionScope(async () => {
-    try {
-      return await complyImpl(agentUrl, options);
-    } finally {
-      await closeScopedConnections(options.protocol);
-    }
-  });
+  return withTestClientScope(
+    () => withMCPConnectionScope(
+      async () => {
+        try {
+          return await complyImpl(agentUrl, options);
+        } finally {
+          await closeScopedConnections(options.protocol);
+        }
+      },
+      { isolate: true }
+    )
+  );
 }
 function sanitizeAgentText(text, max = 500) {
   const cleaned = text.replace(/[\p{C}\u2028\u2029\u202A-\u202E\u2066-\u2069]/gu, "").trim();
@@ -895,6 +907,15 @@ function buildNotApplicableStoryboardResult(agentUrl, na) {
   };
 }
 async function runComplyStoryboard(agentUrl, storyboard, runOptions, profile, routeStoryboard) {
+  runOptions = { ...runOptions, _discoveryPass: {} };
+  const resolution = getOrCreateClientResolution(agentUrl, runOptions);
+  const discovered = await getOrDiscoverProfile(resolution.client, runOptions);
+  if (discovered.step.passed) {
+    profile = discovered.profile;
+    runOptions = { ...runOptions, _profile: profile, agentTools: profile.tools };
+  } else {
+    runOptions = { ...runOptions, _profile: void 0, agentTools: void 0 };
+  }
   if (!routeStoryboard || storyboardCapabilityGateUnmet(storyboard, runOptions) !== null) {
     return runStoryboard(agentUrl, storyboard, runOptions);
   }
@@ -1354,7 +1375,7 @@ async function complyImpl(agentUrl, options) {
       profile,
       step: profileStep,
       caughtError: profileCaughtError
-    } = await discoverAgentProfile(discoveryClient, signal, complianceIndex.adcp_version);
+    } = await getOrDiscoverProfile(discoveryClient, { ...discoveryOptions, signal }, complianceIndex.adcp_version);
     if (testOptions.versionEnvelope === void 0 && profile.tools.includes("get_adcp_capabilities") && profile.raw_capabilities === void 0 && !profileStep.error?.startsWith("VERSION_UNSUPPORTED:")) {
       const legacyDiscoveryOptions = { ...effectiveOptions, versionEnvelope: "major-only" };
       const legacyDiscoveryClient = createTestClient(
@@ -1362,7 +1383,11 @@ async function complyImpl(agentUrl, options) {
         effectiveOptions.protocol ?? "mcp",
         legacyDiscoveryOptions
       );
-      const legacyDiscovery = await discoverAgentProfile(legacyDiscoveryClient, signal, complianceIndex.adcp_version);
+      const legacyDiscovery = await getOrDiscoverProfile(
+        legacyDiscoveryClient,
+        { ...legacyDiscoveryOptions, signal },
+        complianceIndex.adcp_version
+      );
       if (legacyDiscovery.profile.raw_capabilities !== void 0) {
         discoveryOptions = legacyDiscoveryOptions;
         discoveryClient = legacyDiscoveryClient;
@@ -1377,7 +1402,7 @@ async function complyImpl(agentUrl, options) {
       ...testOptions.adcpVersion !== void 0 && { callerAdcpVersion: testOptions.adcpVersion },
       ...testOptions.versionEnvelope !== void 0 && { callerVersionEnvelope: testOptions.versionEnvelope }
     });
-    const client = discoveryOptions === effectiveOptions ? discoveryClient : createTestClient(agentUrl, effectiveOptions.protocol ?? "mcp", effectiveOptions);
+    const client = discoveryOptions === effectiveOptions ? discoveryClient : getOrCreateClientResolution(agentUrl, effectiveOptions).client;
     seedTestClientSigningCapability(client, profile, complianceIndex.adcp_version);
     effectiveOptions._client = client;
     effectiveOptions._profile = profile;
@@ -1439,6 +1464,7 @@ async function complyImpl(agentUrl, options) {
         if (runnable.length > 0) {
           allObservations.push(...authCheck.observations);
           effectiveOptions._profile = degraded;
+          seedAuthRejectedTestClientProfile(client, degraded, complianceIndex.adcp_version);
           return await runWithDegradedProfile(
             agentUrl,
             degraded,

package/dist/lib/testing/storyboard/account-sync-contract.d.mts

@@ -0,0 +1,3 @@
+import type { AssertionSpec } from './assertions.mjs';
+/** Opt-in invariant for account provisioning storyboards, including fresh keys. */
+export declare const accountSyncContractAssertion: AssertionSpec;

package/dist/lib/testing/storyboard/account-sync-contract.d.ts

@@ -0,0 +1,3 @@
+import type { AssertionSpec } from './assertions';
+/** Opt-in invariant for account provisioning storyboards, including fresh keys. */
+export declare const accountSyncContractAssertion: AssertionSpec;

package/dist/lib/testing/storyboard/account-sync-contract.js

@@ -0,0 +1,79 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var account_sync_contract_exports = {};
+__export(account_sync_contract_exports, {
+  accountSyncContractAssertion: () => accountSyncContractAssertion
+});
+module.exports = __toCommonJS(account_sync_contract_exports);
+var import_account_key = require('../../core/account-key.js');
+const accountSyncContractAssertion = {
+  id: "account.sync_contract",
+  default: false,
+  description: "Natural-key syncs preserve identity, accept or reject terms, and expose agent billing fields.",
+  onStep(ctx, step) {
+    if (step.skipped || !["sync_accounts", "list_accounts"].includes(step.task)) return [];
+    const payload = step.request?.payload;
+    const raw = step.response ?? step.response_record?.payload;
+    const response = raw?.data ?? raw;
+    if (!Array.isArray(response?.accounts)) return [];
+    const seen = ctx.state.accounts ??= /* @__PURE__ */ new Map();
+    const results = [];
+    for (const [index, row] of response.accounts.entries()) {
+      if (row.action === "failed" || row.status === "rejected") continue;
+      const problems = [];
+      const entry = payload?.accounts?.[index];
+      if (step.task === "list_accounts" && [...seen.values()].some((prior) => prior.id === row.account_id && prior.billing === "agent") && row.billing === void 0)
+        problems.push("known agent-billed account omits billing");
+      if (row.billing === "agent" && row.payment_terms === void 0)
+        problems.push("agent-billed account omits payment_terms");
+      if (step.task === "sync_accounts" && entry) {
+        if (entry.billing === "agent" && row.billing === void 0) problems.push("agent-billed sync omits billing");
+        if (entry.billing === "agent" && row.billing !== void 0 && row.billing !== "agent")
+          problems.push("agent-billed sync changed billing party");
+        if (entry.payment_terms !== void 0 && row.status === "active" && row.payment_terms !== entry.payment_terms)
+          problems.push("active account did not accept requested payment_terms");
+        const ref = entry.account ?? entry;
+        if ("brand" in ref && ref.brand && typeof ref.operator === "string" && payload?.dry_run !== true) {
+          const key = JSON.stringify([step.agent_url ?? ctx.agentUrl, (0, import_account_key.accountReferenceKey)(ref)]);
+          const prior = seen.get(key);
+          if (prior && (prior.id !== row.account_id || (payload?.idempotency_key === void 0 || !prior.requestKeys.has(payload.idempotency_key)) && row.action === "created"))
+            problems.push("repeat natural-key sync created a different account or reported created");
+          const requestKeys = prior?.requestKeys ?? /* @__PURE__ */ new Set();
+          requestKeys.add(payload?.idempotency_key);
+          seen.set(key, {
+            id: prior?.id ?? row.account_id,
+            billing: row.billing,
+            requestKeys
+          });
+        }
+      }
+      results.push({
+        passed: problems.length === 0,
+        description: `Account contract for ${step.task} row ${index}`,
+        step_id: step.step_id,
+        ...problems.length && { error: problems.join("; ") }
+      });
+    }
+    return results;
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  accountSyncContractAssertion
+});

package/dist/lib/testing/storyboard/account-sync-contract.mjs

@@ -0,0 +1,55 @@
+import { accountReferenceKey } from "../../core/account-key.mjs";
+const accountSyncContractAssertion = {
+  id: "account.sync_contract",
+  default: false,
+  description: "Natural-key syncs preserve identity, accept or reject terms, and expose agent billing fields.",
+  onStep(ctx, step) {
+    if (step.skipped || !["sync_accounts", "list_accounts"].includes(step.task)) return [];
+    const payload = step.request?.payload;
+    const raw = step.response ?? step.response_record?.payload;
+    const response = raw?.data ?? raw;
+    if (!Array.isArray(response?.accounts)) return [];
+    const seen = ctx.state.accounts ??= /* @__PURE__ */ new Map();
+    const results = [];
+    for (const [index, row] of response.accounts.entries()) {
+      if (row.action === "failed" || row.status === "rejected") continue;
+      const problems = [];
+      const entry = payload?.accounts?.[index];
+      if (step.task === "list_accounts" && [...seen.values()].some((prior) => prior.id === row.account_id && prior.billing === "agent") && row.billing === void 0)
+        problems.push("known agent-billed account omits billing");
+      if (row.billing === "agent" && row.payment_terms === void 0)
+        problems.push("agent-billed account omits payment_terms");
+      if (step.task === "sync_accounts" && entry) {
+        if (entry.billing === "agent" && row.billing === void 0) problems.push("agent-billed sync omits billing");
+        if (entry.billing === "agent" && row.billing !== void 0 && row.billing !== "agent")
+          problems.push("agent-billed sync changed billing party");
+        if (entry.payment_terms !== void 0 && row.status === "active" && row.payment_terms !== entry.payment_terms)
+          problems.push("active account did not accept requested payment_terms");
+        const ref = entry.account ?? entry;
+        if ("brand" in ref && ref.brand && typeof ref.operator === "string" && payload?.dry_run !== true) {
+          const key = JSON.stringify([step.agent_url ?? ctx.agentUrl, accountReferenceKey(ref)]);
+          const prior = seen.get(key);
+          if (prior && (prior.id !== row.account_id || (payload?.idempotency_key === void 0 || !prior.requestKeys.has(payload.idempotency_key)) && row.action === "created"))
+            problems.push("repeat natural-key sync created a different account or reported created");
+          const requestKeys = prior?.requestKeys ?? /* @__PURE__ */ new Set();
+          requestKeys.add(payload?.idempotency_key);
+          seen.set(key, {
+            id: prior?.id ?? row.account_id,
+            billing: row.billing,
+            requestKeys
+          });
+        }
+      }
+      results.push({
+        passed: problems.length === 0,
+        description: `Account contract for ${step.task} row ${index}`,
+        step_id: step.step_id,
+        ...problems.length && { error: problems.join("; ") }
+      });
+    }
+    return results;
+  }
+};
+export {
+  accountSyncContractAssertion
+};

package/dist/lib/testing/storyboard/default-invariants.js

@@ -26,6 +26,7 @@ var import_envelope_allowlist = require('../../server/envelope-allowlist.js');
 var import_error_codes = require('../../types/error-codes.js');
 var import_state_machine = require('../../server/state-machine.js');
 var import_assertions = require('./assertions.js');
+var import_account_sync_contract = require('./account-sync-contract.js');
 const REGISTERED = /* @__PURE__ */ new Set();
 function registerOnce(id, spec) {
   if (REGISTERED.has(id)) return;
@@ -33,6 +34,7 @@ function registerOnce(id, spec) {
   (0, import_assertions.registerAssertion)(spec);
 }
 function registerDefaultInvariants() {
+  registerOnce(import_account_sync_contract.accountSyncContractAssertion.id, import_account_sync_contract.accountSyncContractAssertion);
   registerOnce("idempotency.conflict_no_payload_leak", {
     id: "idempotency.conflict_no_payload_leak",
     default: true,

package/dist/lib/testing/storyboard/default-invariants.mjs

@@ -6,6 +6,7 @@ import {
   MEDIA_BUY_TRANSITIONS as MEDIA_BUY_TRANSITIONS_TYPED
 } from "../../server/state-machine.mjs";
 import { registerAssertion } from "./assertions.mjs";
+import { accountSyncContractAssertion } from "./account-sync-contract.mjs";
 const REGISTERED = /* @__PURE__ */ new Set();
 function registerOnce(id, spec) {
   if (REGISTERED.has(id)) return;
@@ -13,6 +14,7 @@ function registerOnce(id, spec) {
   registerAssertion(spec);
 }
 function registerDefaultInvariants() {
+  registerOnce(accountSyncContractAssertion.id, accountSyncContractAssertion);
   registerOnce("idempotency.conflict_no_payload_leak", {
     id: "idempotency.conflict_no_payload_leak",
     default: true,

package/dist/lib/testing/storyboard/request-signing/builder.js

@@ -28,11 +28,55 @@ var import_signing = require('../../../signing/index.js');
 var import_vector_loader = require('./vector-loader.js');
 function buildPositiveRequest(vector, keys, options = {}) {
   const key = signerKeyFor(vector, keys);
-  return sign(key, vector, {
+  const retargeted = options.baseUrl !== void 0 || (options.transport ?? "raw") !== "raw";
+  const fixture = retargeted ? withoutFixtureHost(vector) : vector;
+  const shape = POSITIVE_SHAPES[positiveShapeKey(vector.id)];
+  if (shape) return shape(key, fixture, options);
+  return sign(key, fixture, {
     coverContentDigest: vector.verifier_capability.covers_content_digest === "required",
     ...options
   });
 }
+function withoutFixtureHost(vector) {
+  const headers = Object.fromEntries(
+    Object.entries(vector.request.headers).filter(([name]) => name.toLowerCase() !== "host")
+  );
+  return { ...vector, request: { ...vector.request, headers } };
+}
+const POSITIVE_SHAPES = {
+  // Two distinct labels on both headers. `sig1` is a real signature; `sig2`
+  // keeps the fixture's well-formed, correctly sized, non-verifying value and
+  // a different covered-component set and nonce. A verifier must process
+  // exactly one label and ignore the rest.
+  "013-two-signature-labels-distinct": (key, vector, options) => {
+    const signed = sign(key, vector, options);
+    const fixtureSig2 = /(?:^|,\s*)(sig2=:[^:,\s]+:)/.exec(vector.request.headers["Signature"] ?? "")?.[1];
+    if (!fixtureSig2) throw new Error(`${vector.id}: fixture Signature carries no sig2 member`);
+    const sig1Input = signed.headers["Signature-Input"] ?? "";
+    const sig2Input = sig1Input.replace(/^sig1=\([^)]*\)/, 'sig2=("@method" "@target-uri" "@authority")').replace(/nonce="[^"]*"/, `nonce="${randomNonce()}"`);
+    if (sig2Input === sig1Input) throw new Error(`${vector.id}: could not derive the sig2 member`);
+    return {
+      ...signed,
+      headers: {
+        ...signed.headers,
+        "Signature-Input": `${sig1Input}, ${sig2Input}`,
+        Signature: `${signed.headers["Signature"]}, ${fixtureSig2}`
+      }
+    };
+  },
+  // Content-Digest lists sha-256 and sha-512, each correct for the body that
+  // is actually sent, and the signature covers that exact header value.
+  "014-content-digest-two-algorithms": (key, vector, options) => signWithComponents(
+    key,
+    vector,
+    options,
+    ["@method", "@target-uri", "@authority", "content-type", "content-digest"],
+    (body, encoding) => `${(0, import_signing.computeContentDigest)(body, encoding)}, sha-512=:${(0, import_crypto.createHash)("sha512").update(body).digest(encoding === "legacy-base64url" ? "base64url" : "base64")}:`
+  )
+};
+function positiveShapeKey(id) {
+  return id.replace(/^profile-3\.2\/positive\//, "");
+}
 function buildNegativeRequest(vector, keys, options = {}) {
   const mutation = MUTATIONS[vector.id];
   if (!mutation) {
@@ -163,6 +207,40 @@ const MUTATIONS = {
     const key = signerKeyFor(vector, keys);
     return sign(key, vector, options);
   },
+  // The Signature header repeats label `sig1`. Both members carry the same real
+  // signature over a well-formed Signature-Input, so a verifier that keeps
+  // either the first or the last member finds no second fault and must refuse
+  // the duplicate itself.
+  "029-duplicate-signature-label": (vector, keys, options) => {
+    const signed = sign(signerKeyFor(vector, keys), vector, options);
+    const member = /^sig1=:[^:,\s]+:$/.exec(signed.headers["Signature"] ?? "")?.[0];
+    if (!member) throw new Error(`${vector.id}: signer did not emit a single sig1 member`);
+    return { ...signed, headers: { ...signed.headers, Signature: `${member}, ${member}` } };
+  },
+  // Content-Digest carries `SHA-256` and `sha-256`, both correct for the body
+  // that is sent, covered by a real signature. The uppercase dictionary key is
+  // the only fault.
+  "030-content-digest-key-case": (vector, keys, options) => signWithComponents(
+    signerKeyFor(vector, keys),
+    vector,
+    options,
+    ["@method", "@target-uri", "@authority", "content-type", "content-digest"],
+    (body, encoding) => {
+      const digest = (0, import_signing.computeContentDigest)(body, encoding);
+      return `SHA-256${digest.slice("sha-256".length)}, ${digest}`;
+    }
+  ),
+  // The signature is real over the base for the URL authority; the fixture's
+  // `Host` header (an unbracketed IPv6 literal) is the only fault, so it must
+  // reach the output unchanged.
+  "031-malformed-host-authority": (vector, keys, options) => {
+    const signed = sign(signerKeyFor(vector, keys), vector, options);
+    const fixtureHost = Object.entries(vector.request.headers).find(([name]) => name.toLowerCase() === "host");
+    if (!fixtureHost) throw new Error(`${vector.id}: fixture carries no Host header`);
+    const emitted = Object.entries(signed.headers).find(([name]) => name.toLowerCase() === "host");
+    if (emitted?.[1] !== fixtureHost[1]) throw new Error(`${vector.id}: the fixture Host header was not preserved`);
+    return signed;
+  },
   // Vectors 021-026 ship their exact malformed headers in the fixture — the
   // adversarial shape (duplicate sig-input label, multi-valued content-type
   // / content-digest, unquoted string param, malformed JWK, non-ASCII host)
@@ -192,7 +270,16 @@ const MUTATIONS = {
   // transport-ungradable by the live probe because no HTTP client can route
   // to that intentionally invalid host spelling.
   "profile-3.2/negative/001-base64url-sf-binary": (vector, _keys, options) => passthrough(vector, options),
-  "profile-3.2/negative/001-no-signature-header": delegateToRoot("001-no-signature-header"),
+  // The unsigned 3.2 mirrors ship a correct Content-Digest alongside the missing
+  // signature, so the step-0 refusal is their only fault. Keep the digest,
+  // recomputed for the body actually sent after any transport reshaping.
+  "profile-3.2/negative/001-no-signature-header": (vector, _keys, options) => {
+    const shaped = applyTransport(vector, options);
+    const headers = Object.fromEntries(
+      Object.entries(shaped.headers).filter(([name]) => !/^signature(-input)?$/i.test(name))
+    );
+    return withRefreshedDigest(vector, { method: shaped.method, url: shaped.url, headers, body: shaped.body });
+  },
   "profile-3.2/negative/002-multiple-trailing-dots": (vector, _keys, options) => passthrough(vector, options),
   "profile-3.2/negative/002-wrong-tag": delegateToRoot("002-wrong-tag"),
   "profile-3.2/negative/003-expired-signature": delegateToRoot("003-expired-signature"),
@@ -230,10 +317,11 @@ const MUTATIONS = {
   "profile-3.2/negative/024-unquoted-string-param": delegateToRoot("024-unquoted-string-param"),
   "profile-3.2/negative/025-jwk-alg-crv-mismatch": delegateToRoot("025-jwk-alg-crv-mismatch"),
   "profile-3.2/negative/026-non-ascii-host": delegateToRoot("026-non-ascii-host"),
-  "profile-3.2/negative/027-webhook-registration-authentication-unsigned": delegateToRoot(
-    "027-webhook-registration-authentication-unsigned"
-  ),
-  "profile-3.2/negative/028-unsigned-protocol-method-required": delegateToRoot("028-unsigned-protocol-method-required")
+  "profile-3.2/negative/027-webhook-registration-authentication-unsigned": (vector, _keys, options) => withRefreshedDigest(vector, passthrough(vector, options)),
+  "profile-3.2/negative/028-unsigned-protocol-method-required": (vector, _keys, options) => withRefreshedDigest(vector, protocolMethodPassthrough(vector, options)),
+  "profile-3.2/negative/029-duplicate-signature-label": delegateToRoot("029-duplicate-signature-label"),
+  "profile-3.2/negative/030-content-digest-key-case": delegateToRoot("030-content-digest-key-case"),
+  "profile-3.2/negative/031-malformed-host-authority": delegateToRoot("031-malformed-host-authority")
 };
 function delegateToRoot(rootId) {
   return (vector, keys, options) => {
@@ -242,6 +330,18 @@ function delegateToRoot(rootId) {
     return mutation(vector, keys, options);
   };
 }
+function withRefreshedDigest(vector, request) {
+  if (!Object.keys(vector.request.headers).some((name) => name.toLowerCase() === "content-digest")) return request;
+  return {
+    ...request,
+    headers: mergeHeadersCaseInsensitively(request.headers, {
+      "Content-Digest": (0, import_signing.computeContentDigest)(
+        request.body ?? "",
+        (0, import_signing.requestSigningEncodingForVersion)(vector.signing_profile_version)
+      )
+    })
+  };
+}
 function passthrough(vector, options) {
   const shaped = applyTransport(vector, options);
   return {
@@ -420,7 +520,7 @@ function signWithParamOverride(key, vector, options, override) {
 }
 function signWithComponents(key, vector, options, components, refreshDigest = false) {
   const shaped = applyTransport(vector, options);
-  if (refreshDigest) refreshContentDigest(shaped, vector);
+  if (refreshDigest) refreshContentDigest(shaped, vector, refreshDigest === true ? void 0 : refreshDigest);
   const url = shaped.url;
   const request = {
     method: shaped.method,
@@ -452,12 +552,11 @@ function signWithComponents(key, vector, options, components, refreshDigest = fa
     body: shaped.body
   };
 }
-function refreshContentDigest(shaped, vector) {
+function refreshContentDigest(shaped, vector, shape) {
+  const encoding = (0, import_signing.requestSigningEncodingForVersion)(vector.signing_profile_version);
+  const body = shaped.body ?? "";
   shaped.headers = mergeHeadersCaseInsensitively(shaped.headers, {
-    "Content-Digest": (0, import_signing.computeContentDigest)(
-      shaped.body ?? "",
-      (0, import_signing.requestSigningEncodingForVersion)(vector.signing_profile_version)
-    )
+    "Content-Digest": shape ? shape(body, encoding) : (0, import_signing.computeContentDigest)(body, encoding)
   });
 }
 function formatParamsWithOmissions(components, params, override) {