@adcp/sdk 13.0.0-rc.6 → 13.0.0-rc.7

package/dist/lib/schemas-data/3.1/sponsored-intelligence/si-sponsored-context-receipt.json

@@ -1,13 +1,13 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.8/sponsored-intelligence/si-sponsored-context-receipt.json",
+  "$id": "/schemas/3.1.10/sponsored-intelligence/si-sponsored-context-receipt.json",
   "title": "SI Sponsored Context Receipt",
   "description": "Host receipt for sponsored context previously delivered into an SI host boundary. The receipt records what use mode the host accepted and what disclosure commitment it made; it does not claim that AdCP inspected hidden model reasoning.",
   "x-status": "experimental",
   "type": "object",
   "properties": {
     "sponsored_context": {
-      "$ref": "/schemas/3.1.8/sponsored-intelligence/si-sponsored-context.json",
+      "$ref": "/schemas/3.1.10/sponsored-intelligence/si-sponsored-context.json",
       "description": "The sponsored-context declaration the host received and is accepting or rejecting."
     },
     "host_receipt": {
@@ -23,7 +23,7 @@
           ]
         },
         "accepted_context_use": {
-          "$ref": "/schemas/3.1.8/sponsored-intelligence/si-context-use.json",
+          "$ref": "/schemas/3.1.10/sponsored-intelligence/si-context-use.json",
           "description": "Use mode the host accepted. When host_receipt.status is accepted, this MUST match the declaration's context_use; a host that cannot honor the declared use mode rejects the sponsored context instead of down-scoping it."
         },
         "received_at": {
@@ -121,7 +121,7 @@
       ]
     },
     "ext": {
-      "$ref": "/schemas/3.1.8/core/ext.json"
+      "$ref": "/schemas/3.1.10/core/ext.json"
     }
   },
   "required": [

package/dist/lib/schemas-data/3.1/sponsored-intelligence/si-sponsored-context.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.8/sponsored-intelligence/si-sponsored-context.json",
+  "$id": "/schemas/3.1.10/sponsored-intelligence/si-sponsored-context.json",
   "title": "SI Sponsored Context",
   "description": "Declaration attached to sponsored context delivered into an SI host boundary. Separates the economic accountability fact (`paying_principal`) from the host's receipt/acceptance record, which is carried separately by si-sponsored-context-receipt.json.",
   "x-status": "experimental",
@@ -11,7 +11,7 @@
       "description": "Economic accountability fact: the brand that funded or sponsored this context, with optional account/operator context. This identifies who paid for the sponsored context; it is distinct from the host's later receipt and use commitment.",
       "properties": {
         "brand": {
-          "$ref": "/schemas/3.1.8/core/brand-ref.json",
+          "$ref": "/schemas/3.1.10/core/brand-ref.json",
           "description": "Brand economically accountable for the sponsored context."
         },
         "account": {
@@ -46,7 +46,7 @@
       "additionalProperties": true
     },
     "context_use": {
-      "$ref": "/schemas/3.1.8/sponsored-intelligence/si-context-use.json",
+      "$ref": "/schemas/3.1.10/sponsored-intelligence/si-context-use.json",
       "description": "Declared host-side use mode for this sponsored context."
     },
     "disclosure_obligation": {
@@ -154,7 +154,7 @@
       "additionalProperties": true
     },
     "ext": {
-      "$ref": "/schemas/3.1.8/core/ext.json"
+      "$ref": "/schemas/3.1.10/core/ext.json"
     }
   },
   "required": [

package/dist/lib/schemas-data/3.1/sponsored-intelligence/si-terminate-session-request.json

@@ -1,12 +1,12 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.8/sponsored-intelligence/si-terminate-session-request.json",
+  "$id": "/schemas/3.1.10/sponsored-intelligence/si-terminate-session-request.json",
   "title": "SI Terminate Session Request",
   "description": "Request to terminate an SI session. Naturally idempotent — `session_id` is the dedup boundary, and terminating an already-terminated session is a no-op that returns the same terminal state. No `idempotency_key` is needed on this request.",
   "type": "object",
   "allOf": [
     {
-      "$ref": "/schemas/3.1.8/core/version-envelope.json"
+      "$ref": "/schemas/3.1.10/core/version-envelope.json"
     }
   ],
   "x-status": "experimental",
@@ -62,10 +62,10 @@
       "additionalProperties": true
     },
     "context": {
-      "$ref": "/schemas/3.1.8/core/context.json"
+      "$ref": "/schemas/3.1.10/core/context.json"
     },
     "ext": {
-      "$ref": "/schemas/3.1.8/core/ext.json"
+      "$ref": "/schemas/3.1.10/core/ext.json"
     }
   },
   "required": [

package/dist/lib/schemas-data/3.1/sponsored-intelligence/si-terminate-session-response.json

@@ -1,15 +1,15 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.8/sponsored-intelligence/si-terminate-session-response.json",
+  "$id": "/schemas/3.1.10/sponsored-intelligence/si-terminate-session-response.json",
   "title": "SI Terminate Session Response",
   "description": "Confirmation of session termination",
   "type": "object",
   "allOf": [
     {
-      "$ref": "/schemas/3.1.8/core/version-envelope.json"
+      "$ref": "/schemas/3.1.10/core/version-envelope.json"
     },
     {
-      "$ref": "/schemas/3.1.8/core/protocol-envelope.json"
+      "$ref": "/schemas/3.1.10/core/protocol-envelope.json"
     }
   ],
   "x-status": "experimental",
@@ -24,7 +24,7 @@
       "description": "Whether session was successfully terminated"
     },
     "session_status": {
-      "$ref": "/schemas/3.1.8/enums/si-session-status.json",
+      "$ref": "/schemas/3.1.10/enums/si-session-status.json",
       "description": "Resulting session state. 'complete' for handoff_transaction/handoff_complete, 'terminated' for user_exit/session_timeout/host_terminated."
     },
     "acp_handoff": {
@@ -76,14 +76,14 @@
     "errors": {
       "type": "array",
       "items": {
-        "$ref": "/schemas/3.1.8/core/error.json"
+        "$ref": "/schemas/3.1.10/core/error.json"
       }
     },
     "context": {
-      "$ref": "/schemas/3.1.8/core/context.json"
+      "$ref": "/schemas/3.1.10/core/context.json"
     },
     "ext": {
-      "$ref": "/schemas/3.1.8/core/ext.json"
+      "$ref": "/schemas/3.1.10/core/ext.json"
     }
   },
   "required": [

package/dist/lib/schemas-data/3.1/sponsored-intelligence/si-ui-element.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.8/sponsored-intelligence/si-ui-element.json",
+  "$id": "/schemas/3.1.10/sponsored-intelligence/si-ui-element.json",
   "title": "SI UI Element",
   "description": "Standard visual component that brand returns and host renders",
   "x-status": "experimental",

package/dist/lib/schemas-data/3.1/trusted-match/available-package.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.8/trusted-match/available-package.json",
+  "$id": "/schemas/3.1.10/trusted-match/available-package.json",
   "title": "Available Package",
   "description": "A package available for contextual matching. Synced to providers at media buy creation time — not sent per request. Providers cache this metadata and use it when evaluating context match requests for the placement. The `seller_agent` field binds the package to the originating seller agent; providers MUST use this binding rather than re-deriving seller identity from media_buy_id.",
   "x-status": "experimental",
@@ -15,21 +15,21 @@
       "description": "Media buy that this package belongs to"
     },
     "seller_agent": {
-      "$ref": "/schemas/3.1.8/core/seller-agent-ref.json",
+      "$ref": "/schemas/3.1.10/core/seller-agent-ref.json",
       "description": "The seller agent that owns this package. `agent_url` MUST match one of `authorized_agents[].url` in the publisher's adagents.json authoritative for every property this package may serve. Providers SHOULD validate at sync time and reject mismatches with `seller_not_authorized`. Cached alongside the package and used for offer attribution, per-seller observability, and dispute resolution — not for request-time filtering."
     },
     "format_ids": {
       "type": "array",
       "description": "Creative format identifiers eligible for this package. Uses the standard AdCP format-id object with agent_url and id for unambiguous format resolution across namespaces.",
       "items": {
-        "$ref": "/schemas/3.1.8/core/format-id.json"
+        "$ref": "/schemas/3.1.10/core/format-id.json"
       }
     },
     "catalogs": {
       "type": "array",
       "description": "The buyer's catalogs attached to this package, with selectors (ids, gtins, tags, category, query) scoping which items are in play. References synced catalogs by catalog_id. The provider resolves items from its cached copy.",
       "items": {
-        "$ref": "/schemas/3.1.8/core/catalog.json"
+        "$ref": "/schemas/3.1.10/core/catalog.json"
       }
     }
   },

package/dist/lib/schemas-data/3.1/trusted-match/context-match-request.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.8/trusted-match/context-match-request.json",
+  "$id": "/schemas/3.1.10/trusted-match/context-match-request.json",
   "title": "Context Match Request",
   "description": "Sent by publisher to router or provider to evaluate packages against contextual signals. The provider uses its synced package set for the placement. MUST NOT contain user identity. The request_id MUST NOT correlate with any identity match request_id. Extension fields (ext, context) are intentionally omitted — extension data in the context path could inadvertently carry or correlate user identity signals.",
   "type": "object",
@@ -42,11 +42,11 @@
       "description": "Property catalog UUID (UUID v7). Globally unique, stable identifier assigned by the property catalog. The primary key for TMP matching and property list targeting."
     },
     "property_id": {
-      "$ref": "/schemas/3.1.8/core/property-id.json",
+      "$ref": "/schemas/3.1.10/core/property-id.json",
       "description": "Publisher's human-readable property slug (e.g., 'cnn_homepage'). Optional when property_rid is present. Useful for logging and debugging."
     },
     "property_type": {
-      "$ref": "/schemas/3.1.8/enums/property-type.json",
+      "$ref": "/schemas/3.1.10/enums/property-type.json",
       "description": "Type of the publisher property"
     },
     "placement_id": {
@@ -59,7 +59,7 @@
       "description": "API endpoint URL of the seller agent issuing this request. The provider uses this to resolve the active package set it has synced for this seller; when `package_ids` is omitted, evaluation occurs against that full set. If `seller_agent_url` does not match any seller the provider has synced packages for, the provider MUST return an empty offer set — it MUST NOT fall back to another seller's active set. The value identifies the asking seller, is identical for every user on a given placement, and carries no user identity, so it neither varies the request per user nor weakens the context/identity decorrelation boundary. Compared using the AdCP URL canonicalization rules, not byte-equality — see docs/reference/url-canonicalization. Consistent with `seller_agent_url` on the identity match request, `seller_agent.agent_url` on `AvailablePackage`, and `agent_url` in `adagents.json`."
     },
     "artifact": {
-      "$ref": "/schemas/3.1.8/content-standards/artifact.json",
+      "$ref": "/schemas/3.1.10/content-standards/artifact.json",
       "description": "Full content artifact adjacent to this ad opportunity. Same schema used for content standards evaluation. The publisher sends the artifact when they want the buyer to evaluate the full content. Contractual protections govern buyer use. TEE deployment upgrades contractual trust to cryptographic verification. Publishers MUST NOT include asset access credentials (bearer tokens, service accounts) — the router fans out to multiple buyer agents. For secured assets, use signed URLs with short expiry. Routers MUST strip access fields from artifacts before forwarding."
     },
     "artifact_refs": {
@@ -116,7 +116,7 @@
           "description": "Metro area, using the same classification systems as AdCP targeting.",
           "properties": {
             "system": {
-              "$ref": "/schemas/3.1.8/enums/metro-system.json",
+              "$ref": "/schemas/3.1.10/enums/metro-system.json",
               "description": "Metro area classification system (e.g., 'nielsen_dma', 'uk_itl2')."
             },
             "value": {

package/dist/lib/schemas-data/3.1/trusted-match/context-match-response.json

@@ -1,15 +1,15 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.8/trusted-match/context-match-response.json",
+  "$id": "/schemas/3.1.10/trusted-match/context-match-response.json",
   "title": "Context Match Response",
   "description": "Response from router or provider with offers for matched packages. An empty offers array means no packages matched. For simple GAM integration, package_id flows as a macro via signals. For rich integrations, the offer includes brand, price, summary, and optionally an inline creative manifest. Extension fields (ext, context) are intentionally omitted — extension data in the context path could inadvertently carry or correlate user identity signals.",
   "type": "object",
   "allOf": [
     {
-      "$ref": "/schemas/3.1.8/core/version-envelope.json"
+      "$ref": "/schemas/3.1.10/core/version-envelope.json"
     },
     {
-      "$ref": "/schemas/3.1.8/core/protocol-envelope.json"
+      "$ref": "/schemas/3.1.10/core/protocol-envelope.json"
     }
   ],
   "x-status": "experimental",
@@ -27,7 +27,7 @@
       "type": "array",
       "description": "Offers from the buyer, one per activated package. An empty array means no packages matched. For simple activation, each offer has just package_id. For richer responses, offers include brand, price, summary, and creative manifest.",
       "items": {
-        "$ref": "/schemas/3.1.8/trusted-match/offer.json"
+        "$ref": "/schemas/3.1.10/trusted-match/offer.json"
       }
     },
     "cache_ttl": {

package/dist/lib/schemas-data/3.1/trusted-match/error.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.8/trusted-match/error.json",
+  "$id": "/schemas/3.1.10/trusted-match/error.json",
   "title": "TMP Error",
   "description": "Error response from a TMP provider or router. Returned instead of a normal response when the provider cannot process the request. Distinguishes errors from empty results (an empty offers array is a valid response meaning no matches, not an error).",
   "x-status": "experimental",

package/dist/lib/schemas-data/3.1/trusted-match/identity-match-request.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.8/trusted-match/identity-match-request.json",
+  "$id": "/schemas/3.1.10/trusted-match/identity-match-request.json",
   "title": "Identity Match Request",
   "description": "Sent by publisher to evaluate user eligibility for packages using an opaque identity token. MUST NOT contain page context. The request_id MUST NOT correlate with any context match request_id. The buyer resolves the active package set for this seller from `seller_agent_url`; if `package_ids` is provided, its composition MUST be independent of the current placement (e.g., all-active or fuzzed; see field description) to prevent set-correlation attacks. Extension fields (ext, context) are intentionally omitted to prevent data leakage across the identity privacy boundary. The optional `attestation` (per identity) and `sealed_credentials` (top-level) fields carry verifiable proof ABOUT the identity — on the identity side of that boundary, not page context — so they are a deliberate, reviewed widening of this otherwise-closed schema, not a leak.",
   "type": "object",
@@ -52,7 +52,7 @@
             "description": "Opaque token from an identity provider (ID5, LiveRamp, UID2) or publisher-generated. Buyer may map to internal identity graph but cannot reverse to PII."
           },
           "uid_type": {
-            "$ref": "/schemas/3.1.8/enums/uid-type.json",
+            "$ref": "/schemas/3.1.10/enums/uid-type.json",
             "description": "Type of the user identifier. Tells the buyer which identity graph to resolve against, avoiding trial-and-error matching."
           },
           "attestation": {
@@ -60,7 +60,7 @@
             "description": "Optional verifiable proof ABOUT this identity (e.g. World ID proof-of-personhood and/or age). The receiver MUST verify it (see conformance) and MUST treat an absent-or-unverifiable attestation as 'no attestation' — never as an asserted-true claim. Issuer-agnostic: World ID is the first scheme; mDL / VC-style issuers use the same shape. Receivers MUST bound attestation size to prevent DoS.",
             "properties": {
               "issuer": {
-                "$ref": "/schemas/3.1.8/core/brand-ref.json",
+                "$ref": "/schemas/3.1.10/core/brand-ref.json",
                 "description": "Attestation authority / identity issuer, referenced as a vendor BrandRef (e.g. {\"domain\": \"world.org\"}) — the same vendor-reference shape AdCP uses for measurement and signals vendors. The issuer's canonical domain is the anchor; brand.json hosting is optional. `scheme` selects the verifier version within the issuer."
               },
               "scheme": {
@@ -80,7 +80,7 @@
                 "type": "array",
                 "description": "Claims this attestation establishes. Closed, issuer-agnostic set.",
                 "items": {
-                  "$ref": "/schemas/3.1.8/enums/attestation-claim.json"
+                  "$ref": "/schemas/3.1.10/enums/attestation-claim.json"
                 },
                 "minItems": 1,
                 "uniqueItems": true,

package/dist/lib/schemas-data/3.1/trusted-match/identity-match-response.json

@@ -1,15 +1,15 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.8/trusted-match/identity-match-response.json",
-  "title": "Identity Match Response",
-  "description": "Response indicating which packages the user is eligible for. The serve_window_sec field defines a per-package single-shot fcap: after serving the user one impression on each eligible package, the publisher MUST re-query Identity Match before serving from those packages again. Extension fields (ext, context) are intentionally omitted to prevent data leakage across the identity privacy boundary.",
+  "$id": "/schemas/3.1.10/trusted-match/identity-match-response.json",
+  "title": "Identity Match Response (Router → Publisher)",
+  "description": "Router-to-publisher shape of the Identity Match response. The router collects each identity agent's ordered TMPX chunks (see provider-identity-match-response.json) and forwards them under the emitting `provider_id`, preserving provider attribution and chunk order. Each chunk is a provider-declared `{slot_id, value}` pair; the publisher's deployment configuration (see publisher-tmpx-config.json) maps `(provider_id, slot_id)` to the local ad-server macro name, targeting key, VAST substitution, or play-log field. The provider→router boundary never carries a publisher-local destination name, so no cross-provider name-hijack surface exists. Provider-hop fields (`tmpx_chunks` at the root) MUST NOT appear on this shape — a router that leaks them alongside `tmpx_providers` corrupts per-provider accounting. Envelope extension fields (`context`, `ext`) are intentionally omitted to prevent data leakage across the identity privacy boundary; they are forbidden by this schema. The serve_window_sec field defines a per-package single-shot fcap: after serving the user one impression on each eligible package, the publisher MUST re-query Identity Match before serving from those packages again.",
   "type": "object",
   "allOf": [
     {
-      "$ref": "/schemas/3.1.8/core/version-envelope.json"
+      "$ref": "/schemas/3.1.10/core/version-envelope.json"
     },
     {
-      "$ref": "/schemas/3.1.8/core/protocol-envelope.json"
+      "$ref": "/schemas/3.1.10/core/protocol-envelope.json"
     }
   ],
   "x-status": "experimental",
@@ -40,69 +40,69 @@
       "type": "string",
       "description": "DEPRECATED in favor of tmpx_providers. Routers MAY continue to populate this field for back-compat with consumers that only know the single-token shape; when both fields are present, tmpx_providers is authoritative. Single HPKE-encrypted exposure token containing the resolved user identity tokens. Wire format: kid.base64url_nopad(ciphertext) — unpadded base64url per RFC 4648 section 5 (no = characters). Publishers MUST treat this value as opaque pass-through data. Removed in 4.0."
     },
-    "tmpx_macros": {
-      "type": "array",
-      "description": "Provider-emitted: the identity agent's ordered TMPX chunks paired with the macro name each chunk fills. Macro names MUST be drawn from the provider's registered `tmpx_macros` list (provider-registration.json) and appear in the same order — names are part of operational setup, not protocol-synthesized. Capped at 2 chunks in v1; the cap MAY rise without a shape change. Each `value` is an opaque URL-safe wire string the publisher substitutes verbatim into the matching ad-server macro slot — publishers MUST NOT parse, decode, transform, or choose an encoding. The router collects entries from every provider that emits them into `tmpx_providers`, keyed by provider_id; consumers reading the merged response SHOULD consume `tmpx_providers` and ignore `tmpx_macros` at the root.",
-      "items": {
-        "$ref": "#/$defs/TmpxMacro"
-      },
-      "minItems": 1,
-      "maxItems": 2
-    },
     "tmpx_providers": {
       "type": "object",
-      "description": "Router-populated: TMPX macro/value pairs grouped by the originating identity provider's provider_id, so the publisher fires each provider's tokens through that provider's specific ad-server macros (configured per provider in GAM / VAST URL / DOOH play log). Each entry's `macros[]` is a copy of the provider's emitted `tmpx_macros` ordered list. SHAPE CHANGE: was `Map<provider_id, string>` in the experimental surface that shipped in #5689; now `Map<provider_id, {macros: [TmpxMacro]}>` to carry exact macro/value pairs and support multi-chunk TMPX. Sanctioned by the experimental contract (`x-status: experimental` on this schema). Required by router conformance when any identity provider emitted TMPX in this request; collapsing per-provider tokens into a single string loses attribution and breaks per-provider impression accounting. Map keys MUST be valid provider_ids registered for this fan-out. Publishers MUST traffic only the macro names the response advertises; macro names MUST NOT be derived from provider_id at runtime.",
+      "description": "Router-populated: ordered TMPX chunk/value pairs grouped by the originating identity provider's `provider_id`. Each entry's `chunks[]` is a copy of the provider's emitted `tmpx_chunks` list, in the same order. Each chunk carries a provider-local `slot_id` (from the provider's registered `tmpx_slots`) and an opaque URL-safe `value`; the publisher's deployment configuration (see publisher-tmpx-config.json) resolves each `(provider_id, slot_id)` pair to the ad-server macro name, targeting key, VAST substitution, or play-log field for that surface. The protocol carries values and attribution only. Required by router conformance when any identity provider emitted TMPX in this request; collapsing per-provider tokens into a single string loses attribution and breaks per-provider impression accounting. Map keys MUST match the provider_id charset registered in provider-registration.json (enforced by `propertyNames`). Publishers MUST NOT parse, decode, or transform any chunk's `value` — each is an opaque URL-safe wire string substituted verbatim into the mapped destination.",
+      "propertyNames": {
+        "type": "string",
+        "pattern": "^[A-Za-z0-9_]+$",
+        "minLength": 1,
+        "maxLength": 64
+      },
       "additionalProperties": {
         "type": "object",
         "properties": {
-          "macros": {
+          "chunks": {
             "type": "array",
-            "description": "Ordered TMPX macro/value pairs for this provider. Names MUST match the provider's registered `tmpx_macros`.",
+            "description": "Ordered TMPX chunks for this provider. Each entry is a `{slot_id, value}` pair copied verbatim from the provider's `tmpx_chunks`. Ordered-prefix invariant: the sequence of `slot_id`s MUST equal an ordered prefix of the provider's registered `tmpx_slots` — publishers MAY reject responses whose slot_ids or ordering diverge. Cap of 2 chunks in v1; the cap MAY rise without a shape change.",
             "items": {
-              "$ref": "#/$defs/TmpxMacro"
+              "$ref": "/schemas/3.1.10/trusted-match/tmpx-chunk.json"
             },
             "minItems": 1,
             "maxItems": 2
           }
         },
         "required": [
-          "macros"
+          "chunks"
         ],
         "additionalProperties": false
       }
     }
   },
-  "$defs": {
-    "TmpxMacro": {
-      "type": "object",
-      "description": "A single ad-server macro slot and the URL-safe value the publisher substitutes into it.",
-      "properties": {
-        "name": {
-          "type": "string",
-          "pattern": "^[A-Z][A-Z0-9_]*$",
-          "minLength": 1,
-          "maxLength": 64,
-          "description": "Macro name as configured in the publisher's ad server (e.g. `PIN_TMPX_1`). MUST appear in the emitting provider's registered `tmpx_macros` list. Provider-namespaced so the publisher can target distinct slots per provider."
-        },
-        "value": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 1024,
-          "description": "Opaque, URL-safe wire string the publisher substitutes verbatim into the named macro slot. Publishers MUST NOT parse, decode, or transform this value. The protocol fixes the wire format so platforms interoperate; a platform that can carry raw bytes MAY optimize privately but the wire contract remains the URL-safe string."
-        }
-      },
-      "required": [
-        "name",
-        "value"
-      ],
-      "additionalProperties": false
-    }
-  },
   "required": [
     "type",
     "request_id",
     "eligible_package_ids",
     "serve_window_sec"
   ],
+  "not": {
+    "anyOf": [
+      {
+        "required": [
+          "tmpx_chunks"
+        ]
+      },
+      {
+        "required": [
+          "tmpx_values"
+        ]
+      },
+      {
+        "required": [
+          "tmpx_macros"
+        ]
+      },
+      {
+        "required": [
+          "context"
+        ]
+      },
+      {
+        "required": [
+          "ext"
+        ]
+      }
+    ]
+  },
   "additionalProperties": true
 }

package/dist/lib/schemas-data/3.1/trusted-match/offer-price.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.8/trusted-match/offer-price.json",
+  "$id": "/schemas/3.1.10/trusted-match/offer-price.json",
   "title": "Offer Price",
   "description": "Lightweight price for a TMP offer. Used when the product supports variable pricing and the buyer specifies a price at match time.",
   "x-status": "experimental",

package/dist/lib/schemas-data/3.1/trusted-match/offer.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "/schemas/3.1.8/trusted-match/offer.json",
+  "$id": "/schemas/3.1.10/trusted-match/offer.json",
   "title": "Offer",
   "description": "A buyer's response to a context match request. Generalizes package activation — a simple activation is an offer with just package_id. A rich response includes brand, price, summary, and optionally an inline creative manifest.",
   "x-status": "experimental",
@@ -11,15 +11,15 @@
       "description": "Package identifier from the media buy."
     },
     "seller_agent": {
-      "$ref": "/schemas/3.1.8/core/seller-agent-ref.json",
+      "$ref": "/schemas/3.1.10/core/seller-agent-ref.json",
       "description": "Optional echo of the package's seller agent from sync-time metadata. Provided for publisher-side observability so log pipelines can attribute offers to sellers without round-tripping to the media-buy store. Non-authoritative: the binding on the cached AvailablePackage is source of truth. When omitted, the router MAY stamp this field from its cached package→seller map."
     },
     "brand": {
-      "$ref": "/schemas/3.1.8/core/brand-ref.json",
+      "$ref": "/schemas/3.1.10/core/brand-ref.json",
       "description": "Brand for this offer. Required when the product allows dynamic brands (brand selected at match time rather than fixed on the package). For single-brand packages, the brand is already known from the media buy."
     },
     "price": {
-      "$ref": "/schemas/3.1.8/trusted-match/offer-price.json",
+      "$ref": "/schemas/3.1.10/trusted-match/offer-price.json",
       "description": "Price for this offer. Only present when the product supports variable pricing. For fixed-price packages, price is already set on the media buy."
     },
     "summary": {
@@ -27,7 +27,7 @@
       "description": "Buyer-generated description of the offer, for the publisher to judge relevance. E.g., '50% off Goldenfield mayo — recipe integration'. The publisher (or their AI assistant) uses this to decide whether the offer fits the context."
     },
     "creative_manifest": {
-      "$ref": "/schemas/3.1.8/core/creative-manifest.json",
+      "$ref": "/schemas/3.1.10/core/creative-manifest.json",
       "description": "Full creative details, inline. When present, the publisher has everything needed to render. Inline for small creatives (markdown, product card). For large creatives (VAST, video), the manifest references external assets via URLs."
     },
     "macros": {

package/dist/lib/schemas-data/3.1/trusted-match/provider-identity-match-response.json

@@ -0,0 +1,90 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/3.1.10/trusted-match/provider-identity-match-response.json",
+  "title": "Identity Match Response (Provider → Router)",
+  "description": "Provider-to-router shape of the Identity Match response. An identity agent returns eligibility, the per-package serve-window throttle, and — when it mints one — an ordered list of TMPX chunks. Each chunk pairs a provider-local `slot_id` (declared at registration in `tmpx_slots`) with an opaque URL-safe `value`. Publisher-local destination names (ad-server macros, GAM key-values, VAST URL macros, DOOH play-log fields) MUST NOT appear on this hop; the router keys chunks under the emitting `provider_id` and the publisher's deployment configuration resolves `(provider_id, slot_id)` to the local destination (see publisher-tmpx-config.json). Router-hop fields (`tmpx_providers`, `tmpx`) MUST NOT appear on this shape — a router receiving them from a provider MUST reject the response. Envelope extension fields (`context`, `ext`) are intentionally omitted to prevent data leakage across the identity privacy boundary; they are forbidden by this schema.",
+  "type": "object",
+  "allOf": [
+    {
+      "$ref": "/schemas/3.1.10/core/version-envelope.json"
+    },
+    {
+      "$ref": "/schemas/3.1.10/core/protocol-envelope.json"
+    }
+  ],
+  "x-status": "experimental",
+  "properties": {
+    "type": {
+      "type": "string",
+      "const": "identity_match_response",
+      "description": "Message type discriminator for deserialization. Same const as the router→publisher variant so publisher-facing decoders can key off type before dispatching on shape."
+    },
+    "request_id": {
+      "type": "string",
+      "description": "Echoed request identifier from the identity match request."
+    },
+    "eligible_package_ids": {
+      "type": "array",
+      "description": "Package IDs the user is eligible for. Packages not listed are ineligible.",
+      "items": {
+        "type": "string"
+      }
+    },
+    "serve_window_sec": {
+      "type": "integer",
+      "description": "Per-package single-shot fcap window, in seconds. After serving the user one impression on each eligible package within this window, the publisher MUST re-query Identity Match before serving from those packages again. Not a router response cache TTL — it is a buyer-asserted serve throttle. Multi-impression frequency caps are handled separately by the buyer's impression tracker. Maximum 300.",
+      "minimum": 1,
+      "maximum": 300
+    },
+    "tmpx_chunks": {
+      "type": "array",
+      "description": "Ordered TMPX chunk/value pairs this identity agent mints. Each entry names the provider-local `slot_id` the value fills (from the provider's registered `tmpx_slots` in provider-registration.json). Ordered-prefix invariant: a response that carries fewer chunks than the provider registered MUST emit an ordered prefix of the registered `tmpx_slots` — routers MUST NOT reorder or fill gaps. The router MUST validate this contract before forwarding: if the provider has no `tmpx_slots` registration, or if the chunk `slot_id` sequence is not an exact non-empty ordered prefix of the registered list (duplicate, reordered, sparse, or unregistered slot IDs), the router MUST drop that provider's chunks atomically and MUST NOT forward them into `tmpx_providers`. Cap of 2 chunks in v1 aligned with the GAM macro-slot budget; the cap MAY rise without a shape change. Omitted when this provider mints no TMPX (e.g. no eligible packages).",
+      "items": {
+        "$ref": "/schemas/3.1.10/trusted-match/tmpx-chunk.json"
+      },
+      "minItems": 1,
+      "maxItems": 2
+    }
+  },
+  "required": [
+    "type",
+    "request_id",
+    "eligible_package_ids",
+    "serve_window_sec"
+  ],
+  "not": {
+    "anyOf": [
+      {
+        "required": [
+          "tmpx_providers"
+        ]
+      },
+      {
+        "required": [
+          "tmpx"
+        ]
+      },
+      {
+        "required": [
+          "tmpx_values"
+        ]
+      },
+      {
+        "required": [
+          "tmpx_macros"
+        ]
+      },
+      {
+        "required": [
+          "context"
+        ]
+      },
+      {
+        "required": [
+          "ext"
+        ]
+      }
+    ]
+  },
+  "additionalProperties": true
+}