@adcp/sdk 15.9.2 → 15.9.4

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/negative/021-duplicate-signature-input-label.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\", sig1=(\"@method\" \"@target-uri\");created=1776520800;expires=1776521100;nonce=\"AAAAAAAAAAAAAAAAAAAAAA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:"
     },
-    "body": "{\"plan_id\":\"plan_001\"}"
+    "body": "{\"idempotency_key\":\"vector-negative-021-duplicate-signature-input-label\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/negative/022-multi-valued-content-type.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:"
     },
-    "body": "{\"plan_id\":\"plan_001\"}"
+    "body": "{\"idempotency_key\":\"vector-negative-022-multi-valued-content-type\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/negative/023-multi-valued-content-digest.json

@@ -11,7 +11,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:"
     },
-    "body": "{\"plan_id\":\"plan_001\"}"
+    "body": "{\"idempotency_key\":\"vector-negative-023-multi-valued-content-digest\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/negative/024-unquoted-string-param.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=test-ed25519-2026;alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:"
     },
-    "body": "{\"plan_id\":\"plan_001\"}"
+    "body": "{\"idempotency_key\":\"vector-negative-024-unquoted-string-param\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/negative/025-jwk-alg-crv-mismatch.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-alg-crv-mismatch-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:"
     },
-    "body": "{\"plan_id\":\"plan_001\"}"
+    "body": "{\"idempotency_key\":\"vector-negative-025-jwk-alg-crv-mismatch\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/negative/026-non-ascii-host.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:"
     },
-    "body": "{\"plan_id\":\"plan_001\"}"
+    "body": "{\"idempotency_key\":\"vector-negative-026-non-ascii-host\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/negative/027-webhook-registration-authentication-unsigned.json

@@ -9,7 +9,7 @@
       "Content-Type": "application/json",
       "Authorization": "Bearer test-bearer-token"
     },
-    "body": "{\"media_buy_id\":\"mb_001\",\"push_notification_config\":{\"url\":\"https://buyer.example.com/webhook\",\"authentication\":{\"scheme\":\"HMAC-SHA256\",\"credentials\":\"shared-secret-placeholder\"}}}"
+    "body": "{\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"media_buy_id\":\"mb_001\",\"idempotency_key\":\"vector-negative-027-webhook-registration-authentication-unsigned\",\"brand\":{\"domain\":\"brand.example\"},\"push_notification_config\":{\"url\":\"https://buyer.example.com/webhook\",\"authentication\":{\"schemes\":[\"HMAC-SHA256\"],\"credentials\":\"ssssssssssssssssssssssssssssssssssssssss\"}}}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/positive/001-basic-post.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:U51PJzU9nMJxMAH_u-UDpSecT5SQX1-deSnWE3XpFo-BLT2_2h5FgMltntNCW05chhmFnjZEzkRmaYKeU0UUBw:"
     },
-    "body": "{\"plan_id\":\"plan_001\",\"packages\":[{\"package_id\":\"pkg_1\",\"budget\":{\"amount\":1000,\"currency\":\"USD\"}}]}"
+    "body": "{\"idempotency_key\":\"vector-positive-001-basic-post\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/3.1.29/test-vectors/request-signing/positive/002-post-with-content-digest.json

@@ -0,0 +1,31 @@
+{
+  "name": "POST with content-digest covered, Ed25519",
+  "spec_reference": "#content-digest-and-proxy-compatibility and #verifier-checklist-requests",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/adcp/create_media_buy",
+    "headers": {
+      "Content-Type": "application/json",
+      "Content-Digest": "sha-256=:is1voRwXKSXQ5ZVlp7fJLEd9soKRki7uTQDj0kPi0FA=:",
+      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+      "Signature": "sig1=:w4ByI-ggGFgkQKAGox1g0KfS9cXDcZA6DY1D6yFZRVWSHGjE8H2Lbk81mZFW5wRW9DXmXcVuNuw6OGUYF1V_BA:"
+    },
+    "body": "{\"idempotency_key\":\"request-signing-positive-002-2026\",\"account\":{\"account_id\":\"request-signing-account\"},\"brand\":{\"domain\":\"acme-corp.example\"},\"start_time\":\"asap\",\"end_time\":\"2026-04-30T00:00:00Z\",\"packages\":[{\"product_id\":\"request-signing-product\",\"pricing_option_id\":\"request-signing-price\",\"budget\":1000}]}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/adcp/create_media_buy\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:is1voRwXKSXQ5ZVlp7fJLEd9soKRki7uTQDj0kPi0FA=:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": true
+  },
+  "$comment": "Signature is Ed25519 over expected_signature_base using the public test-only test-ed25519-2026 private key (_private_d_for_test_only) in keys.json. Ed25519 is deterministic, and tests/request-signing-vector-bodies.test.cjs re-signs and compares it. The Signature member is an RFC 8941 Byte Sequence (RFC 9421 §4.2), but the AdCP profile overrides RFC 8941's alphabet: see docs/building/by-layer/L1/security.mdx (section 'Binary value encoding'). Signature MUST be emitted as base64url WITHOUT padding, so it carries no '+', '/' or '='; the same test enforces that grammar. Content-Digest below is ALSO non-conformant under the same rule (security.mdx rule 1 names Signature and Content-Digest together), and is deliberately NOT fixed here, to keep this change a pure re-encode: content-digest is a covered component, so its literal field value is part of expected_signature_base, and changing it would mean a genuine re-sign rather than a re-encode of the same bytes. Tracked as follow-up. Note also that in THIS vector content-digest is covered WITHOUT RFC 9421's ';sf' parameter, so the base carries the verbatim received field bytes; a verifier must not normalise Content-Digest to base64url before rebuilding the base, or this vector will fail to verify."
+}

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/positive/003-es256-post.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-es256-2026\";alg=\"ecdsa-p256-sha256\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:iROVe9SPqEARfTlnbJsJYdg6Mv7WPr7fWD05rZ31H3o1Nprm-n181yGQpixU9EvgDnAUO3f-9FVpttLxDoRGxA:"
     },
-    "body": "{\"plan_id\":\"plan_001\"}"
+    "body": "{\"idempotency_key\":\"vector-positive-003-es256-post\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/positive/004-multiple-signature-labels.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\", sig2=(\"@method\" \"@target-uri\");created=1776520800;expires=1776521100;nonce=\"DIFFERENT-NONCE-FOR-SIG2____\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:U51PJzU9nMJxMAH_u-UDpSecT5SQX1-deSnWE3XpFo-BLT2_2h5FgMltntNCW05chhmFnjZEzkRmaYKeU0UUBw:, sig2=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:"
     },
-    "body": "{\"plan_id\":\"plan_001\",\"packages\":[{\"package_id\":\"pkg_1\",\"budget\":{\"amount\":1000,\"currency\":\"USD\"}}]}"
+    "body": "{\"idempotency_key\":\"vector-positive-004-multiple-signature-labels\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/positive/005-default-port-stripped.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:U51PJzU9nMJxMAH_u-UDpSecT5SQX1-deSnWE3XpFo-BLT2_2h5FgMltntNCW05chhmFnjZEzkRmaYKeU0UUBw:"
     },
-    "body": "{\"plan_id\":\"plan_001\"}"
+    "body": "{\"idempotency_key\":\"vector-positive-005-default-port-stripped\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/positive/006-dot-segment-path.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:U51PJzU9nMJxMAH_u-UDpSecT5SQX1-deSnWE3XpFo-BLT2_2h5FgMltntNCW05chhmFnjZEzkRmaYKeU0UUBw:"
     },
-    "body": "{\"plan_id\":\"plan_001\"}"
+    "body": "{\"idempotency_key\":\"vector-positive-006-dot-segment-path\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/positive/009-percent-encoded-unreserved-decoded.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:o2kFcTvxhbtnyteqXSKBvg_WcDeh7Ev-6rmhbl5bqEa5LHEDBBQbzoB8JEgOxtYjsrANKz8qygxfc0JOUQnKBg:"
     },
-    "body": "{\"plan_id\":\"plan_001\"}"
+    "body": "{\"idempotency_key\":\"vector-positive-009-percent-encoded-unreserved-decoded\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/positive/010-percent-encoded-slash-preserved.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:2MVpRwioVrc-gLepGnleM5Nk0hI8M-V5A9buqMly0oL5Z4p3VfPh92ijitH1fKL2o7i97160AJ0Sf_wP9Q0KCQ:"
     },
-    "body": "{\"plan_id\":\"plan_001\"}"
+    "body": "{\"idempotency_key\":\"vector-positive-010-percent-encoded-slash-preserved\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/positive/011-ipv6-authority.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:QplWbT2vVnF_TSfY5w5d8zQYkLpD7Bp4rxE9uKHl14UjBmUnF6mwKB8pEgoFTKHF1jVwwL14hx_AM6sFBtT9CA:"
     },
-    "body": "{\"plan_id\":\"plan_001\"}"
+    "body": "{\"idempotency_key\":\"vector-positive-011-ipv6-authority\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/test-vectors/request-signing/positive/012-ipv6-authority-default-port-stripped.json

@@ -10,7 +10,7 @@
       "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\");created=1776520800;expires=1776521100;nonce=\"KXYnfEfJ0PBRZXQyVXfVQA\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
       "Signature": "sig1=:QplWbT2vVnF_TSfY5w5d8zQYkLpD7Bp4rxE9uKHl14UjBmUnF6mwKB8pEgoFTKHF1jVwwL14hx_AM6sFBtT9CA:"
     },
-    "body": "{\"plan_id\":\"plan_001\"}"
+    "body": "{\"idempotency_key\":\"vector-positive-012-ipv6-authority-default-port-stripped\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000.0,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}"
   },
   "verifier_capability": {
     "supported": true,

package/compliance/cache/{3.1.24 → 3.1.29}/universal/read-tool-idempotency.yaml

@@ -198,7 +198,6 @@ phases:
 
         sample_request:
           idempotency_key: "$generate:uuid_v4#read_tools_3_1_list_formats"
-          type: "display"
           pagination:
             max_results: 10
           context:

package/compliance/cache/{3.1.24 → 3.1.29}/universal/storyboard-schema.yaml

@@ -407,6 +407,14 @@
 #             operator: "buyer.example"
 #             billing: "operator"
 #             sandbox: true
+#       creative_formats:
+#         - format_id: "seller_display_300x250"
+#           fixture:
+#             format_id: { agent_url: "https://formats.seller.example/", id: "seller_display_300x250" }
+#             name: "Seller display 300x250"
+#             type: "display"
+#             assets:
+#               - { item_type: "individual", asset_id: "image", asset_type: "image", required: true }
 #       creatives:
 #         - creative_id: "campaign_hero_video"
 #           status: "approved"
@@ -419,7 +427,15 @@
 #           status: "active"
 #   Each top-level key maps to a seed_* scenario (accounts → seed_account,
 #   products → seed_product, pricing_options → seed_pricing_option,
-#   creatives → seed_creative, plans → seed_plan, media_buys → seed_media_buy).
+#   creative_formats → seed_creative_format, creatives → seed_creative,
+#   plans → seed_plan, media_buys → seed_media_buy).
+#
+#   Declaring ANY fixture key makes its seed_* scenario required: if the agent's
+#   comply_test_controller `list_scenarios` does not advertise it, the runner
+#   skips the WHOLE storyboard as `fixture_seed_unsupported` / not_applicable
+#   rather than seeding partially. Adding a fixture key to an existing
+#   storyboard therefore removes coverage from every agent that does not yet
+#   implement that scenario — weigh that before adding one.
 #   Storyboards that need an
 #   external measurement vendor catalog SHOULD add an explicit
 #   comply_test_controller step with scenario: seed_measurement_catalog. Product
@@ -431,6 +447,7 @@
 #     product ──┬─→ pricing_option
 #               ├─→ plan
 #               └─→ media_buy
+#     creative_format ─→ creative
 #     creative ────→ media_buy
 #     plan ────────→ media_buy
 #

package/compliance/cache/{3.1.24 → 3.1.29}/universal/webhook-emission.yaml

@@ -1,5 +1,5 @@
 id: webhook_emission
-version: "1.3.0"
+version: "1.3.1"
 title: "Webhook emission — outbound webhook conformance (operation ID + signing + idempotency + sync silence)"
 category: core
 summary: "Any agent that emits webhooks MUST echo the caller-supplied operation_id in every payload, carry a stable idempotency_key across retries, avoid duplicate webhook side effects on request replay, and — when the buyer has not opted into the deprecated HMAC fallback — MUST sign deliveries under the RFC 9421 webhook profile. Sellers MUST NOT emit task webhooks for inline terminal responses; any future sync-completion notification mode would be explicit and capability-advertised. Graded by a runner hosting a webhook receiver during storyboard execution."
@@ -162,6 +162,46 @@ phases:
             path: "supported_protocols"
             description: "Agent declares its supported AdCP protocols"
 
+      - id: get_products_discovery
+        title: "Discover a product for webhook trigger steps"
+        narrative: |
+          Sales-agent triggers need a real catalog product and its pricing option.
+          Capture both before create_media_buy; an empty catalog or missing
+          pricing option fails setup instead of sending placeholder identifiers.
+          Brief discovery may complete inline or asynchronously. The
+          task_completion captures wait for a submitted/working task to finish
+          before binding IDs, and also accept an inline completed response.
+          Retain product metadata so request enrichment can honor auction floors.
+          Agents without get_products skip this sales-specific setup step.
+        task: get_products
+        requires_tool: get_products
+        schema_ref: "media-buy/get-products-request.json"
+        response_schema_ref: "media-buy/get-products-response.json"
+        doc_ref: "/media-buy/task-reference/get_products"
+        stateful: false
+        sample_request:
+          idempotency_key: "$generate:uuid_v4#webhook_emission_get_products_discovery"
+          buying_mode: "brief"
+          brief: "Advertising inventory for Acme Outdoor's outdoor gear campaign."
+          account:
+            brand:
+              domain: "acmeoutdoor.example"
+            operator: "pinnacle-agency.example"
+        context_outputs:
+          - path: "task_completion.products"
+            key: "products"
+          - path: "task_completion.products[0].product_id"
+            key: "product_id"
+          - path: "task_completion.products[0].pricing_options[0].pricing_option_id"
+            key: "pricing_option_id"
+        validations:
+          - check: response_schema
+            description: "Discovery response matches get-products-response.json"
+        expected: |
+          Complete discovery with at least one product and pricing option.
+          All sales-agent webhook triggers use the captured product and pricing
+          option IDs only after discovery reaches a successful result.
+
   - id: idempotency_key_presence
     title: "Every webhook payload carries idempotency_key"
     narrative: |
@@ -187,12 +227,25 @@ phases:
           `authentication` block (9421 is the baseline for conformance).
         task: "$test_kit.operations.primary_webhook_emitter"
         task_default: create_media_buy
-        schema_ref: "$test_kit.schemas.primary_request"
-        response_schema_ref: "$test_kit.schemas.primary_response"
+        schema_ref: "media-buy/create-media-buy-request.json"
+        response_schema_ref: "media-buy/create-media-buy-response.json"
         doc_ref: "/building/implementation/webhooks"
         comply_scenario: webhook_trigger
         stateful: false
         sample_request:
+          brand:
+            domain: "acmeoutdoor.example"
+          account:
+            brand:
+              domain: "acmeoutdoor.example"
+            operator: "pinnacle-agency.example"
+          # The runner rolls elapsed sample dates to a fresh seven-day flight.
+          start_time: "2025-01-01T00:00:00Z"
+          end_time: "2025-01-08T00:00:00Z"
+          packages:
+            - product_id: "$context.product_id"
+              pricing_option_id: "$context.pricing_option_id"
+              budget: 1000
           push_notification_config:
             url: "{{runner.webhook_url:trigger_webhook_operation}}"
             operation_id: "op_webhook_presence_explicit"
@@ -252,12 +305,25 @@ phases:
           payload echo must come from the explicit operation_id field.
         task: "$test_kit.operations.primary_webhook_emitter"
         task_default: create_media_buy
-        schema_ref: "$test_kit.schemas.primary_request"
-        response_schema_ref: "$test_kit.schemas.primary_response"
+        schema_ref: "media-buy/create-media-buy-request.json"
+        response_schema_ref: "media-buy/create-media-buy-response.json"
         doc_ref: "/building/implementation/webhooks"
         comply_scenario: webhook_operation_id_echo_trigger
         stateful: false
         sample_request:
+          brand:
+            domain: "acmeoutdoor.example"
+          account:
+            brand:
+              domain: "acmeoutdoor.example"
+            operator: "pinnacle-agency.example"
+          # The runner rolls elapsed sample dates to a fresh seven-day flight.
+          start_time: "2025-01-01T00:00:00Z"
+          end_time: "2025-01-08T00:00:00Z"
+          packages:
+            - product_id: "$context.product_id"
+              pricing_option_id: "$context.pricing_option_id"
+              budget: 1000
           push_notification_config:
             url: "{{runner.webhook_url:trigger_operation_id_echo}}"
             operation_id: "op_storyboard_echo_123"
@@ -320,12 +386,25 @@ phases:
           duplicate.
         task: "$test_kit.operations.primary_webhook_emitter"
         task_default: create_media_buy
-        schema_ref: "$test_kit.schemas.primary_request"
-        response_schema_ref: "$test_kit.schemas.primary_response"
+        schema_ref: "media-buy/create-media-buy-request.json"
+        response_schema_ref: "media-buy/create-media-buy-response.json"
         doc_ref: "/building/implementation/webhooks"
         comply_scenario: webhook_idempotency_replay_trigger
         stateful: true
         sample_request:
+          brand:
+            domain: "acmeoutdoor.example"
+          account:
+            brand:
+              domain: "acmeoutdoor.example"
+            operator: "pinnacle-agency.example"
+          # The runner rolls elapsed sample dates to a fresh seven-day flight.
+          start_time: "2025-01-01T00:00:00Z"
+          end_time: "2025-01-08T00:00:00Z"
+          packages:
+            - product_id: "$context.product_id"
+              pricing_option_id: "$context.pricing_option_id"
+              budget: 1000
           push_notification_config:
             url: "{{runner.webhook_url:trigger_idempotent_webhook_initial}}"
             operation_id: "op_webhook_idempotency_replay"
@@ -345,12 +424,25 @@ phases:
           webhook for the replay.
         task: "$test_kit.operations.primary_webhook_emitter"
         task_default: create_media_buy
-        schema_ref: "$test_kit.schemas.primary_request"
-        response_schema_ref: "$test_kit.schemas.primary_response"
+        schema_ref: "media-buy/create-media-buy-request.json"
+        response_schema_ref: "media-buy/create-media-buy-response.json"
         doc_ref: "/building/implementation/webhooks"
         comply_scenario: webhook_idempotency_replay_trigger
         stateful: true
         sample_request:
+          brand:
+            domain: "acmeoutdoor.example"
+          account:
+            brand:
+              domain: "acmeoutdoor.example"
+            operator: "pinnacle-agency.example"
+          # The runner rolls elapsed sample dates to a fresh seven-day flight.
+          start_time: "2025-01-01T00:00:00Z"
+          end_time: "2025-01-08T00:00:00Z"
+          packages:
+            - product_id: "$context.product_id"
+              pricing_option_id: "$context.pricing_option_id"
+              budget: 1000
           push_notification_config:
             url: "{{runner.webhook_url:trigger_idempotent_webhook_initial}}"
             operation_id: "op_webhook_idempotency_replay"
@@ -550,12 +642,25 @@ phases:
           will retry on each 5xx and eventually succeed.
         task: "$test_kit.operations.primary_webhook_emitter"
         task_default: create_media_buy
-        schema_ref: "$test_kit.schemas.primary_request"
-        response_schema_ref: "$test_kit.schemas.primary_response"
+        schema_ref: "media-buy/create-media-buy-request.json"
+        response_schema_ref: "media-buy/create-media-buy-response.json"
         doc_ref: "/building/implementation/webhooks"
         comply_scenario: webhook_retry_trigger
         stateful: false
         sample_request:
+          brand:
+            domain: "acmeoutdoor.example"
+          account:
+            brand:
+              domain: "acmeoutdoor.example"
+            operator: "pinnacle-agency.example"
+          # The runner rolls elapsed sample dates to a fresh seven-day flight.
+          start_time: "2025-01-01T00:00:00Z"
+          end_time: "2025-01-08T00:00:00Z"
+          packages:
+            - product_id: "$context.product_id"
+              pricing_option_id: "$context.pricing_option_id"
+              budget: 1000
           push_notification_config:
             url: "{{runner.webhook_url:trigger_retry_scenario}}"
             operation_id: "op_webhook_retry_explicit"
@@ -687,12 +792,25 @@ phases:
           forcing 9421 signing per the baseline rule.
         task: "$test_kit.operations.primary_webhook_emitter"
         task_default: create_media_buy
-        schema_ref: "$test_kit.schemas.primary_request"
-        response_schema_ref: "$test_kit.schemas.primary_response"
+        schema_ref: "media-buy/create-media-buy-request.json"
+        response_schema_ref: "media-buy/create-media-buy-response.json"
         doc_ref: "/building/implementation/webhooks"
         comply_scenario: webhook_signed_trigger
         stateful: false
         sample_request:
+          brand:
+            domain: "acmeoutdoor.example"
+          account:
+            brand:
+              domain: "acmeoutdoor.example"
+            operator: "pinnacle-agency.example"
+          # The runner rolls elapsed sample dates to a fresh seven-day flight.
+          start_time: "2025-01-01T00:00:00Z"
+          end_time: "2025-01-08T00:00:00Z"
+          packages:
+            - product_id: "$context.product_id"
+              pricing_option_id: "$context.pricing_option_id"
+              budget: 1000
           push_notification_config:
             url: "{{runner.webhook_url:trigger_signed_webhook}}"
             operation_id: "op_webhook_signed_explicit"

package/compliance/cache/{3.2.4 → 3.2.5}/domains/media-buy/scenarios/canonical_formats.yaml

@@ -892,6 +892,7 @@ phases:
                 width: 300
                 height: 250
                 max_file_size_kb: 200
+                image_formats: ["jpg", "png"]
               context:
                 buyer_ref: "canonical_formats_direct_selector_positive"
           context: