{
  "_comment": [
    "Shared signature vectors. Every SDK in this directory verifies against this",
    "exact file, and so does the server's own reference implementation in",
    "packages/shared/src/signing.ts.",
    "",
    "WHY THIS FILE EXISTS: four independent implementations of the same HMAC in",
    "four languages will agree on the easy cases and disagree on exactly the ones",
    "that matter — a body containing non-ASCII, a base64 secret decoded as text",
    "instead of bytes, a signature list produced during rotation. A vector file is",
    "the only thing that makes 'they agree' a testable claim rather than a hope.",
    "",
    "Signed content is always `{id}.{timestamp}.{body}`, HMAC-SHA256 over the",
    "secret's decoded BYTES, base64-encoded. The body is the exact bytes that",
    "arrived — never a re-serialisation of a parsed object."
  ],
  "secret": "whsec_9Vv0Zt2sLZ7BvVvKQ0lJnQ2Xh1mYQ0mHhVn6xkq1lQE=",
  "cases": [
    {
      "name": "plain ascii json",
      "id": "msg_01H8XGJWBWBAQ4E1S0TZY6P8YV",
      "timestamp": 1755500000,
      "body": "{\"type\":\"order.created\",\"data\":{\"id\":42}}",
      "signature": "v1,ZeHt1vME7mDymvGEFjFJpLlkrXUOb5AnnDTHq7mVlJA="
    },
    {
      "name": "empty body",
      "id": "msg_01H8XGJWBWBAQ4E1S0TZY6P8YW",
      "timestamp": 1755500000,
      "body": "",
      "signature": "v1,1/IhXb9RAuU4d1Tt15/xYniaDdfdtwlh8LW/A1/pDk4="
    },
    {
      "name": "utf-8 body — the case where byte-vs-character handling diverges",
      "id": "msg_01H8XGJWBWBAQ4E1S0TZY6P8YX",
      "timestamp": 1755500000,
      "body": "{\"note\":\"שלום עולם — naïve café 🎉\"}",
      "signature": "v1,fJxRO8G2qgcv0WVNEFE+osWkKoG27YeZFBiGsAmWfrY="
    },
    {
      "name": "body with a literal backslash and quote",
      "id": "msg_01H8XGJWBWBAQ4E1S0TZY6P8YY",
      "timestamp": 1755500000,
      "body": "{\"path\":\"C:\\\\temp\\\\a.txt\",\"q\":\"\\\"quoted\\\"\"}",
      "signature": "v1,v8zV2eWjFxOc+uvmhWHcDoh4ryuMi/SbZ+/YeSZXCUE="
    }
  ]
}