@adcp/sdk 16.0.0-beta.9 → 16.0.0

package/dist/lib/signing/web-bot-auth.mjs

@@ -26,8 +26,9 @@ const WEB_BOT_AUTH_PROFILE = "web-bot-auth";
 const WEB_BOT_AUTH_DRAFT_REVISION = "draft-ietf-webbotauth-httpsig-protocol-00";
 const SIGNATURE_DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
 const SIGNATURE_DIRECTORY_MEDIA_TYPE = "application/http-message-signatures-directory+json";
-const WEB_BOT_AUTH_ALGORITHMS = Object.freeze(["ed25519", "rsa-pss-sha512"]);
+const WEB_BOT_AUTH_ALGORITHMS = Object.freeze(["ed25519"]);
 const DIRECTORY_TAG = "http-message-signatures-directory";
+const PRIVATE_JWK_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth", "k"]);
 const CLOCK_SKEW_SECONDS = 60;
 const MAX_LIFETIME_SECONDS = 300;
 const REQUIRED_PARAMETERS = ["created", "expires", "nonce", "keyid", "alg", "tag"];
@@ -138,26 +139,29 @@ function jwkThumbprint(jwk) {
   else return denied("unsupported_key");
   return createHash("sha256").update(JSON.stringify(fields)).digest("base64url");
 }
+function keyAlgorithm(jwk) {
+  return jwk.kty === "OKP" && jwk.crv === "Ed25519" ? "ed25519" : void 0;
+}
 function algorithm(jwk) {
-  if (jwk.kty === "OKP" && jwk.crv === "Ed25519") return "ed25519";
-  if (jwk.kty === "RSA" && typeof jwk.n === "string" && jwk.e === "AQAB") {
-    const bytes = Buffer.from(jwk.n, "base64url").length;
-    if (bytes >= 256 && bytes <= 512) return "rsa-pss-sha512";
-  }
-  return denied("unsupported_key");
+  return keyAlgorithm(jwk) ?? denied("unsupported_key");
 }
 function signingAlgorithm(jwk) {
   try {
     return algorithm(jwk);
   } catch {
-    throw new TypeError(
-      "Web Bot Auth signs with Ed25519 or RSA-PSS-SHA512 (2048-4096 bit, e=65537) keys only; ES256 remains on the AdCP RFC 9421 profile"
-    );
+    throw new TypeError("Web Bot Auth signs with Ed25519 keys only; ES256 remains on the AdCP RFC 9421 profile");
   }
 }
 function assertWebBotAuthSigningKey(key) {
   signingAlgorithm("privateKey" in key ? key.privateKey : key.publicKey);
 }
+function signingOrigin(value) {
+  try {
+    return receivedAgentOrigin(canonicalAgentOrigin(value));
+  } catch {
+    throw new TypeError("Web Bot Auth signs as an https origin only (WBA section 5.2.1)");
+  }
+}
 function inputs(headers, limit) {
   const members = dictionary(getHeaderValue(headers, "signature-input"), "Signature-Input");
   if (members.size > limit) bad("signature_input");
@@ -170,6 +174,7 @@ function inputs(headers, limit) {
   });
 }
 function receivedAgentOrigin(value) {
+  if (!value.startsWith("https://")) return denied("agent_origin");
   try {
     canonicalAgentUrl(value);
     const origin = canonicalAgentOrigin(value);
@@ -392,8 +397,10 @@ async function verifyWebBotAuth(request, options) {
       if (!(member2[0] instanceof ArrayBuffer) || member2[1].size !== 0) bad("signature");
     for (const member2 of agents?.values() ?? []) if (typeof member2[0] !== "string") bad("signature_agent");
     if (!inputMembers || !signatureMembers) return denied("headers_missing");
-    if (inputMembers.size !== 1 || signatureMembers.size !== 1) denied("signature_count");
-    label = inputMembers.keys().next().value;
+    const tagged = [...inputMembers].filter(([, member2]) => member2[1].get("tag") === WEB_BOT_AUTH_PROFILE);
+    if (tagged.length === 0) denied("profile");
+    if (tagged.length > 1) denied("signature_count");
+    label = tagged[0][0];
     if (!signatureMembers.has(label)) denied("signature_label");
     try {
       parseSignature(signatureHeader, label, "rfc8941-base64");
@@ -406,7 +413,6 @@ async function verifyWebBotAuth(request, options) {
     } catch {
       return denied("parameters");
     }
-    if (input.params.tag !== WEB_BOT_AUTH_PROFILE) denied("profile");
     if (!agents || agents.size !== 1) denied(agents ? "agent_count" : "agent_missing");
     const agentMember = `signature-agent;key="${label}"`;
     const agentComponents = input.components.filter((c) => c.startsWith("signature-agent;"));
@@ -414,7 +420,7 @@ async function verifyWebBotAuth(request, options) {
     const member = agents.get(label);
     if (!member) denied("agent_not_covered");
     const type = member[1].get("type");
-    if (type !== void 0 && type !== "directory") denied("agent_type");
+    if (type !== void 0 && String(type) !== "directory") denied("agent_type");
     const origin = receivedAgentOrigin(member[0]);
     const { created, expires, nonce, keyid, alg } = input.params;
     if ([created, expires, nonce, keyid, alg].some((value) => value === void 0)) denied("parameters_missing");
@@ -538,11 +544,13 @@ async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}
     let expires = Infinity;
     for (const raw of document.keys) {
       if (!raw || typeof raw !== "object") denied("directory_key");
+      if (Object.keys(raw).some((k) => PRIVATE_JWK_MEMBERS.has(k.toLowerCase()) || k.startsWith("_private")))
+        denied("directory_key");
+      if (!keyAlgorithm(raw)) continue;
       const thumbprint = jwkThumbprint(raw);
       const key = { ...raw, kid: raw.kid ?? thumbprint };
-      if (key.kid !== thumbprint || kids.has(key.kid) || key.d !== void 0 || Object.keys(key).some((k) => k.startsWith("_private")) || key.adcp_use !== void 0 || !testKeysAllowed(options.allowTestKeys) && TEST_KIDS.has(key.kid))
+      if (key.kid !== thumbprint || kids.has(key.kid) || key.adcp_use !== void 0 || !testKeysAllowed(options.allowTestKeys) && TEST_KIDS.has(key.kid))
         denied("directory_key");
-      algorithm(key);
       kids.add(key.kid);
       keys.push(key);
       const proof = signatures.find((input) => input.params.keyid === key.kid && input.params.tag === DIRECTORY_TAG);
@@ -585,6 +593,7 @@ async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}
       );
       expires = Math.min(expires, proof.params.expires);
     }
+    if (!keys.length) denied("directory_keys");
     return { keys, expires, signed: true, proof: response };
   } catch (error) {
     if (error instanceof WebBotAuthError) {
@@ -714,7 +723,7 @@ async function signWebBotAuth(request, key, options) {
     throw new TypeError(
       "Web Bot Auth relays were removed from the profile (adcp#7894): an intermediary signs as itself with one signature"
     );
-  const origin = canonicalAgentOrigin(options.origin);
+  const origin = signingOrigin(options.origin);
   const label = options.label ?? "sig1";
   if (!/^[a-z][a-z0-9_.*-]*$/.test(label)) throw new TypeError("Invalid signature label");
   const jwk = "privateKey" in key ? key.privateKey : key.publicKey;
@@ -769,7 +778,7 @@ async function signWebBotAuth(request, key, options) {
   return headers;
 }
 async function createSignedSignatureDirectory(originUrl, signingKeys, options = {}) {
-  const origin = canonicalAgentOrigin(originUrl);
+  const origin = signingOrigin(originUrl);
   const now = Math.floor((options.now ?? (() => Date.now() / 1e3))());
   const lifetime = options.lifetimeSeconds ?? 86400;
   if (!Number.isFinite(now) || !Number.isSafeInteger(lifetime) || lifetime < 1 || !Number.isSafeInteger(now + lifetime))
@@ -778,12 +787,7 @@ async function createSignedSignatureDirectory(originUrl, signingKeys, options =
   const keys = signingKeys.map((key) => {
     const jwk = "privateKey" in key ? key.privateKey : key.publicKey;
     signingAlgorithm(jwk);
-    return {
-      kty: jwk.kty,
-      ...jwk.kty === "RSA" ? { n: jwk.n, e: jwk.e } : { crv: jwk.crv, x: jwk.x },
-      kid: jwkThumbprint(jwk),
-      use: "sig"
-    };
+    return { kty: jwk.kty, crv: jwk.crv, x: jwk.x, kid: jwkThumbprint(jwk), use: "sig" };
   });
   if (new Set(keys.map((k) => k.kid)).size !== keys.length) throw new TypeError("Duplicate directory key");
   const body = JSON.stringify({ keys });
@@ -829,6 +833,7 @@ async function createSignedSignatureDirectory(originUrl, signingKeys, options =
 }
 function createWebBotAuthFetch(upstream, key, options) {
   assertWebBotAuthSigningKey(key);
+  signingOrigin(options.origin);
   return async (input, init) => {
     const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
     if (options.shouldSign && !options.shouldSign(url, init)) return upstream(input, init);

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "16.0.0-beta.9";
+export declare const RUNNER_CAPABILITY_VERSION = "16.0.0";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "16.0.0-beta.9";
+export declare const RUNNER_CAPABILITY_VERSION = "16.0.0";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/v2/projection/catalog.d.mts

@@ -70,6 +70,10 @@ export interface V1FormatDefinition {
         required?: boolean;
         asset_type?: string;
         requirements?: Record<string, unknown>;
+        /** Reference-catalog extension used to match pixel-tracker slots. */
+        event?: string;
+        /** Caller-defined tracker extension; required to match a custom event. */
+        custom_event_name?: string;
     }>;
     /**
      * v2 canonical projection. Always object-shaped per

package/dist/lib/v2/projection/catalog.d.ts

@@ -70,6 +70,10 @@ export interface V1FormatDefinition {
         required?: boolean;
         asset_type?: string;
         requirements?: Record<string, unknown>;
+        /** Reference-catalog extension used to match pixel-tracker slots. */
+        event?: string;
+        /** Caller-defined tracker extension; required to match a custom event. */
+        custom_event_name?: string;
     }>;
     /**
      * v2 canonical projection. Always object-shaped per

package/dist/lib/v2/projection/creative-delivery.d.mts

@@ -4,6 +4,7 @@ import type { CanonicalFormatLegacyResolver } from './v2-to-v1.mjs';
 import type { CanonicalFormatKind, ProjectionDiagnostic, V1FormatId } from './types.mjs';
 import type { CanonicalFormatDeclaration } from './legacy-metadata.mjs';
 import type { UndeclaredFormatOptionSelector } from './legacy-routes.mjs';
+import { type V1FormatDefinition } from './catalog.mjs';
 type DistributiveOmit<T, K extends PropertyKey> = T extends unknown ? Omit<T, Extract<keyof T, K>> : never;
 /**
  * Primary SDK creative shape. Spell out the named fields rather than using
@@ -276,15 +277,20 @@ export declare class CreativeFormatCapabilityError extends Error {
     readonly code = "ADCP_CREATIVE_FORMAT_CAPABILITY_CONTRADICTION";
     constructor(message: string);
 }
-export declare function projectCreativeForDelivery<T extends CreativeAsset>(creative: T, selectorContainer: CreativeFormatSelectorContainer, wireMode?: 'canonical', operation?: string, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): CanonicalProjectedCreative<T>;
-export declare function projectCreativeForDelivery<T extends CreativeAsset>(creative: T, selectorContainer: CreativeFormatSelectorContainer, wireMode: 'legacy' | 'unknown', operation?: string, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): LegacyProjectedCreative<T>;
-export declare function projectCreativeForDelivery<T extends CreativeAsset>(creative: T, selectorContainer: CreativeFormatSelectorContainer, wireMode: CreativeFormatWireMode, operation?: string, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): CanonicalProjectedCreative<T> | LegacyProjectedCreative<T>;
-export declare function projectMediaBuyCreativesForDelivery<T>(request: T, wireMode: 'canonical', operation?: 'create_media_buy' | 'update_media_buy', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): ProjectedMediaBuyCreativeRequest<T, 'canonical'>;
-export declare function projectMediaBuyCreativesForDelivery<T>(request: T, wireMode: 'legacy' | 'unknown', operation?: 'create_media_buy' | 'update_media_buy', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): ProjectedMediaBuyCreativeRequest<T, 'legacy'>;
-export declare function projectMediaBuyCreativesForDelivery<T>(request: T, wireMode: CreativeFormatWireMode, operation?: 'create_media_buy' | 'update_media_buy', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): ProjectedMediaBuyCreativeRequest<T, 'canonical'> | ProjectedMediaBuyCreativeRequest<T, 'legacy'>;
-export declare function projectSyncCreativesForDelivery<T>(request: T, selectorContainers: ReadonlyArray<CreativeFormatSelectorContainer>, wireMode: 'canonical', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): ProjectedSyncCreativeRequest<T, 'canonical'>;
-export declare function projectSyncCreativesForDelivery<T>(request: T, selectorContainers: ReadonlyArray<CreativeFormatSelectorContainer>, wireMode: 'legacy' | 'unknown', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): ProjectedSyncCreativeRequest<T, 'legacy'>;
-export declare function projectSyncCreativesForDelivery<T>(request: T, selectorContainers: ReadonlyArray<CreativeFormatSelectorContainer>, wireMode: CreativeFormatWireMode, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): ProjectedSyncCreativeRequest<T, 'canonical'> | ProjectedSyncCreativeRequest<T, 'legacy'>;
+/**
+ * Project identity and asset keys for the selected wire mode. Optional
+ * `legacyFormatDefinitions` override bundled definitions by exact format owner
+ * and ID; ambiguous definitions leave asset keys unchanged.
+ */
+export declare function projectCreativeForDelivery<T extends CreativeAsset>(creative: T, selectorContainer: CreativeFormatSelectorContainer, wireMode?: 'canonical', operation?: string, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): CanonicalProjectedCreative<T>;
+export declare function projectCreativeForDelivery<T extends CreativeAsset>(creative: T, selectorContainer: CreativeFormatSelectorContainer, wireMode: 'legacy' | 'unknown', operation?: string, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): LegacyProjectedCreative<T>;
+export declare function projectCreativeForDelivery<T extends CreativeAsset>(creative: T, selectorContainer: CreativeFormatSelectorContainer, wireMode: CreativeFormatWireMode, operation?: string, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): CanonicalProjectedCreative<T> | LegacyProjectedCreative<T>;
+export declare function projectMediaBuyCreativesForDelivery<T>(request: T, wireMode: 'canonical', operation?: 'create_media_buy' | 'update_media_buy', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): ProjectedMediaBuyCreativeRequest<T, 'canonical'>;
+export declare function projectMediaBuyCreativesForDelivery<T>(request: T, wireMode: 'legacy' | 'unknown', operation?: 'create_media_buy' | 'update_media_buy', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): ProjectedMediaBuyCreativeRequest<T, 'legacy'>;
+export declare function projectMediaBuyCreativesForDelivery<T>(request: T, wireMode: CreativeFormatWireMode, operation?: 'create_media_buy' | 'update_media_buy', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): ProjectedMediaBuyCreativeRequest<T, 'canonical'> | ProjectedMediaBuyCreativeRequest<T, 'legacy'>;
+export declare function projectSyncCreativesForDelivery<T>(request: T, selectorContainers: ReadonlyArray<CreativeFormatSelectorContainer>, wireMode: 'canonical', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): ProjectedSyncCreativeRequest<T, 'canonical'>;
+export declare function projectSyncCreativesForDelivery<T>(request: T, selectorContainers: ReadonlyArray<CreativeFormatSelectorContainer>, wireMode: 'legacy' | 'unknown', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): ProjectedSyncCreativeRequest<T, 'legacy'>;
+export declare function projectSyncCreativesForDelivery<T>(request: T, selectorContainers: ReadonlyArray<CreativeFormatSelectorContainer>, wireMode: CreativeFormatWireMode, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): ProjectedSyncCreativeRequest<T, 'canonical'> | ProjectedSyncCreativeRequest<T, 'legacy'>;
 export type { UndeclaredFormatOptionSelector } from './legacy-routes.mjs';
 /**
  * Looks up a format option the SDK derived from a seller's legacy `format_ids`.

package/dist/lib/v2/projection/creative-delivery.d.ts

@@ -4,6 +4,7 @@ import type { CanonicalFormatLegacyResolver } from './v2-to-v1';
 import type { CanonicalFormatKind, ProjectionDiagnostic, V1FormatId } from './types';
 import type { CanonicalFormatDeclaration } from './legacy-metadata';
 import type { UndeclaredFormatOptionSelector } from './legacy-routes';
+import { type V1FormatDefinition } from './catalog';
 type DistributiveOmit<T, K extends PropertyKey> = T extends unknown ? Omit<T, Extract<keyof T, K>> : never;
 /**
  * Primary SDK creative shape. Spell out the named fields rather than using
@@ -276,15 +277,20 @@ export declare class CreativeFormatCapabilityError extends Error {
     readonly code = "ADCP_CREATIVE_FORMAT_CAPABILITY_CONTRADICTION";
     constructor(message: string);
 }
-export declare function projectCreativeForDelivery<T extends CreativeAsset>(creative: T, selectorContainer: CreativeFormatSelectorContainer, wireMode?: 'canonical', operation?: string, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): CanonicalProjectedCreative<T>;
-export declare function projectCreativeForDelivery<T extends CreativeAsset>(creative: T, selectorContainer: CreativeFormatSelectorContainer, wireMode: 'legacy' | 'unknown', operation?: string, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): LegacyProjectedCreative<T>;
-export declare function projectCreativeForDelivery<T extends CreativeAsset>(creative: T, selectorContainer: CreativeFormatSelectorContainer, wireMode: CreativeFormatWireMode, operation?: string, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): CanonicalProjectedCreative<T> | LegacyProjectedCreative<T>;
-export declare function projectMediaBuyCreativesForDelivery<T>(request: T, wireMode: 'canonical', operation?: 'create_media_buy' | 'update_media_buy', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): ProjectedMediaBuyCreativeRequest<T, 'canonical'>;
-export declare function projectMediaBuyCreativesForDelivery<T>(request: T, wireMode: 'legacy' | 'unknown', operation?: 'create_media_buy' | 'update_media_buy', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): ProjectedMediaBuyCreativeRequest<T, 'legacy'>;
-export declare function projectMediaBuyCreativesForDelivery<T>(request: T, wireMode: CreativeFormatWireMode, operation?: 'create_media_buy' | 'update_media_buy', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): ProjectedMediaBuyCreativeRequest<T, 'canonical'> | ProjectedMediaBuyCreativeRequest<T, 'legacy'>;
-export declare function projectSyncCreativesForDelivery<T>(request: T, selectorContainers: ReadonlyArray<CreativeFormatSelectorContainer>, wireMode: 'canonical', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): ProjectedSyncCreativeRequest<T, 'canonical'>;
-export declare function projectSyncCreativesForDelivery<T>(request: T, selectorContainers: ReadonlyArray<CreativeFormatSelectorContainer>, wireMode: 'legacy' | 'unknown', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): ProjectedSyncCreativeRequest<T, 'legacy'>;
-export declare function projectSyncCreativesForDelivery<T>(request: T, selectorContainers: ReadonlyArray<CreativeFormatSelectorContainer>, wireMode: CreativeFormatWireMode, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver): ProjectedSyncCreativeRequest<T, 'canonical'> | ProjectedSyncCreativeRequest<T, 'legacy'>;
+/**
+ * Project identity and asset keys for the selected wire mode. Optional
+ * `legacyFormatDefinitions` override bundled definitions by exact format owner
+ * and ID; ambiguous definitions leave asset keys unchanged.
+ */
+export declare function projectCreativeForDelivery<T extends CreativeAsset>(creative: T, selectorContainer: CreativeFormatSelectorContainer, wireMode?: 'canonical', operation?: string, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): CanonicalProjectedCreative<T>;
+export declare function projectCreativeForDelivery<T extends CreativeAsset>(creative: T, selectorContainer: CreativeFormatSelectorContainer, wireMode: 'legacy' | 'unknown', operation?: string, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): LegacyProjectedCreative<T>;
+export declare function projectCreativeForDelivery<T extends CreativeAsset>(creative: T, selectorContainer: CreativeFormatSelectorContainer, wireMode: CreativeFormatWireMode, operation?: string, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): CanonicalProjectedCreative<T> | LegacyProjectedCreative<T>;
+export declare function projectMediaBuyCreativesForDelivery<T>(request: T, wireMode: 'canonical', operation?: 'create_media_buy' | 'update_media_buy', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): ProjectedMediaBuyCreativeRequest<T, 'canonical'>;
+export declare function projectMediaBuyCreativesForDelivery<T>(request: T, wireMode: 'legacy' | 'unknown', operation?: 'create_media_buy' | 'update_media_buy', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): ProjectedMediaBuyCreativeRequest<T, 'legacy'>;
+export declare function projectMediaBuyCreativesForDelivery<T>(request: T, wireMode: CreativeFormatWireMode, operation?: 'create_media_buy' | 'update_media_buy', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): ProjectedMediaBuyCreativeRequest<T, 'canonical'> | ProjectedMediaBuyCreativeRequest<T, 'legacy'>;
+export declare function projectSyncCreativesForDelivery<T>(request: T, selectorContainers: ReadonlyArray<CreativeFormatSelectorContainer>, wireMode: 'canonical', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): ProjectedSyncCreativeRequest<T, 'canonical'>;
+export declare function projectSyncCreativesForDelivery<T>(request: T, selectorContainers: ReadonlyArray<CreativeFormatSelectorContainer>, wireMode: 'legacy' | 'unknown', legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): ProjectedSyncCreativeRequest<T, 'legacy'>;
+export declare function projectSyncCreativesForDelivery<T>(request: T, selectorContainers: ReadonlyArray<CreativeFormatSelectorContainer>, wireMode: CreativeFormatWireMode, legacyFormatConverter?: LegacyFormatConverter, canonicalFormatLegacyResolver?: CanonicalFormatLegacyResolver, legacyFormatDefinitions?: readonly V1FormatDefinition[]): ProjectedSyncCreativeRequest<T, 'canonical'> | ProjectedSyncCreativeRequest<T, 'legacy'>;
 export type { UndeclaredFormatOptionSelector } from './legacy-routes';
 /**
  * Looks up a format option the SDK derived from a seller's legacy `format_ids`.

package/dist/lib/v2/projection/creative-delivery.js

@@ -33,6 +33,7 @@ var import_v1_to_v2 = require('./v1-to-v2.js');
 var import_v2_to_v1 = require('./v2-to-v1.js');
 var import_legacy_metadata = require('./legacy-metadata.js');
 var import_jcs = require('../../utils/jcs.js');
+var import_catalog = require('./catalog.js');
 function stripLegacyCreativeIdentity(value) {
   const legacyTokens = /* @__PURE__ */ new Set();
   const legacyUrlTokens = /* @__PURE__ */ new Set();
@@ -591,11 +592,55 @@ function selectLegacyRef(creative, container, canonicalFormatLegacyResolver, ope
   matching = preferMostConstrainedLegacyCandidates(matching, creative);
   return matching.length === 1 ? matching[0].ref : void 0;
 }
-function projectCreative(creative, formatId) {
+function projectLegacyAssetKeys(assetsValue, definition) {
+  const assets = record(assetsValue);
+  if (!assets || !Array.isArray(definition?.assets)) return assetsValue;
+  const slots = definition.assets.filter((slot) => record(slot) !== void 0);
+  if (slots.some((slot) => slot.item_type !== void 0 && slot.item_type !== "individual")) return assetsValue;
+  const declaredIds = new Set(slots.map((slot) => slot.asset_id));
+  const availableSlots = slots.filter(
+    (slot) => (slot.item_type === void 0 || slot.item_type === "individual") && typeof slot.asset_id === "string" && slot.asset_id.length > 0 && !Object.hasOwn(assets, slot.asset_id)
+  );
+  const targetBySource = /* @__PURE__ */ new Map();
+  const sourcesByTarget = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(assets)) {
+    if (declaredIds.has(key)) continue;
+    const asset = record(value);
+    if (!asset || typeof asset.asset_type !== "string") continue;
+    const matches = availableSlots.filter((slot) => {
+      if (slot.asset_type !== asset.asset_type) return false;
+      if (asset.asset_type === "url") {
+        return typeof asset.url_type === "string" && asset.url_type === slot.requirements?.url_type;
+      }
+      if (asset.asset_type === "pixel_tracker") {
+        return typeof asset.event === "string" && asset.event === slot.event && (asset.event !== "custom" || typeof asset.custom_event_name === "string" && asset.custom_event_name === slot.custom_event_name);
+      }
+      return true;
+    });
+    if (matches.length !== 1) continue;
+    const target = matches[0].asset_id;
+    targetBySource.set(key, target);
+    const sources = sourcesByTarget.get(target) ?? [];
+    sources.push(key);
+    sourcesByTarget.set(target, sources);
+  }
+  for (const sources of sourcesByTarget.values()) {
+    if (sources.length > 1) for (const source of sources) targetBySource.delete(source);
+  }
+  if (targetBySource.size === 0) return assetsValue;
+  return Object.fromEntries(Object.entries(assets).map(([key, value]) => [targetBySource.get(key) ?? key, value]));
+}
+function projectCreative(creative, formatId, legacyFormatDefinitions) {
   const next = { ...creative };
   delete next.format_kind;
   delete next.format_option_ref;
   next.format_id = { ...formatId };
+  const supplied = legacyFormatDefinitions?.filter((definition2) => {
+    const ref = legacyRef(record(definition2)?.format_id);
+    return ref !== void 0 && sameLegacyIdentity(ref, formatId);
+  });
+  const definition = supplied?.length ? supplied.length === 1 ? supplied[0] : void 0 : (0, import_catalog.lookupV1Format)(formatId);
+  if (Object.hasOwn(creative, "assets")) next.assets = projectLegacyAssetKeys(creative.assets, definition);
   return next;
 }
 function dedupeLegacyRefs(refs) {
@@ -829,7 +874,7 @@ function canonicalizeCreative(creative, selectorContainer, operation, legacyForm
   }
   return next;
 }
-function projectCreativeForDelivery(creative, selectorContainer, wireMode = "canonical", operation = "creative_delivery", legacyFormatConverter, canonicalFormatLegacyResolver) {
+function projectCreativeForDelivery(creative, selectorContainer, wireMode = "canonical", operation = "creative_delivery", legacyFormatConverter, canonicalFormatLegacyResolver, legacyFormatDefinitions) {
   const inputRecord = creative;
   const originalLegacyRef = legacyRef(inputRecord.format_id);
   const creativeRecord = canonicalizeCreative(inputRecord, selectorContainer, operation, legacyFormatConverter);
@@ -837,7 +882,11 @@ function projectCreativeForDelivery(creative, selectorContainer, wireMode = "can
   if (originalLegacyRef) {
     const selectedOriginal = selectLegacyRef(inputRecord, selectorContainer, canonicalFormatLegacyResolver, operation);
     if (selectedOriginal) {
-      return projectCreative(creativeRecord, selectedOriginal);
+      return projectCreative(
+        creativeRecord,
+        selectedOriginal,
+        legacyFormatDefinitions
+      );
     }
     throw new CreativeFormatProjectionError(
       operation,
@@ -846,7 +895,8 @@ function projectCreativeForDelivery(creative, selectorContainer, wireMode = "can
     );
   }
   const formatId = selectLegacyRef(creativeRecord, selectorContainer, canonicalFormatLegacyResolver, operation);
-  if (formatId) return projectCreative(creativeRecord, formatId);
+  if (formatId)
+    return projectCreative(creativeRecord, formatId, legacyFormatDefinitions);
   if (typeof creativeRecord.format_kind === "string") {
     const creativeId = typeof creativeRecord.creative_id === "string" ? creativeRecord.creative_id : "(unknown)";
     const allCandidates = candidatesFromContainer(selectorContainer, canonicalFormatLegacyResolver, operation);
@@ -881,10 +931,19 @@ function projectCreativeForDelivery(creative, selectorContainer, wireMode = "can
         "canonical format legacy resolver returned an invalid or ambiguous creative mapping"
       );
     }
-    if (resolved) return projectCreative(creativeRecord, resolved[0]);
+    if (resolved)
+      return projectCreative(
+        creativeRecord,
+        resolved[0],
+        legacyFormatDefinitions
+      );
     const pinned = optionReference(creativeRecord.format_option_ref) !== void 0;
     if (candidates.length === 1 && !pinned) {
-      return projectCreative(creativeRecord, candidates[0].ref);
+      return projectCreative(
+        creativeRecord,
+        candidates[0].ref,
+        legacyFormatDefinitions
+      );
     }
     if (candidates.length > 1) {
       throw new CreativeFormatProjectionError(
@@ -898,7 +957,7 @@ function projectCreativeForDelivery(creative, selectorContainer, wireMode = "can
   }
   return creative;
 }
-function projectMediaBuyCreativesForDelivery(request, wireMode = "canonical", operation = "create_media_buy", legacyFormatConverter, canonicalFormatLegacyResolver) {
+function projectMediaBuyCreativesForDelivery(request, wireMode = "canonical", operation = "create_media_buy", legacyFormatConverter, canonicalFormatLegacyResolver, legacyFormatDefinitions) {
   const requestRecord = record(request);
   if (!requestRecord) return request;
   let changed = false;
@@ -918,7 +977,8 @@ function projectMediaBuyCreativesForDelivery(request, wireMode = "canonical", op
           wireMode,
           operation,
           legacyFormatConverter,
-          canonicalFormatLegacyResolver
+          canonicalFormatLegacyResolver,
+          legacyFormatDefinitions
         );
         if (projected !== creativeValue) changed = true;
         return projected;
@@ -936,7 +996,7 @@ function projectMediaBuyCreativesForDelivery(request, wireMode = "canonical", op
   }
   return changed ? next : request;
 }
-function projectSyncCreativesForDelivery(request, selectorContainers, wireMode = "canonical", legacyFormatConverter, canonicalFormatLegacyResolver) {
+function projectSyncCreativesForDelivery(request, selectorContainers, wireMode = "canonical", legacyFormatConverter, canonicalFormatLegacyResolver, legacyFormatDefinitions) {
   const requestRecord = record(request);
   if (!requestRecord || !Array.isArray(requestRecord.creatives)) {
     return request;
@@ -965,7 +1025,8 @@ function projectSyncCreativesForDelivery(request, selectorContainers, wireMode =
       wireMode,
       "sync_creatives",
       legacyFormatConverter,
-      canonicalFormatLegacyResolver
+      canonicalFormatLegacyResolver,
+      legacyFormatDefinitions
     );
     if (projected !== creativeValue) changed = true;
     return projected;

package/dist/lib/v2/projection/creative-delivery.mjs

@@ -12,6 +12,7 @@ import {
   transferLegacyCreativeMetadata
 } from "./legacy-metadata.mjs";
 import { canonicalize as canonicalizeJson } from "../../utils/jcs.mjs";
+import { lookupV1Format } from "./catalog.mjs";
 function stripLegacyCreativeIdentity(value) {
   const legacyTokens = /* @__PURE__ */ new Set();
   const legacyUrlTokens = /* @__PURE__ */ new Set();
@@ -570,11 +571,55 @@ function selectLegacyRef(creative, container, canonicalFormatLegacyResolver, ope
   matching = preferMostConstrainedLegacyCandidates(matching, creative);
   return matching.length === 1 ? matching[0].ref : void 0;
 }
-function projectCreative(creative, formatId) {
+function projectLegacyAssetKeys(assetsValue, definition) {
+  const assets = record(assetsValue);
+  if (!assets || !Array.isArray(definition?.assets)) return assetsValue;
+  const slots = definition.assets.filter((slot) => record(slot) !== void 0);
+  if (slots.some((slot) => slot.item_type !== void 0 && slot.item_type !== "individual")) return assetsValue;
+  const declaredIds = new Set(slots.map((slot) => slot.asset_id));
+  const availableSlots = slots.filter(
+    (slot) => (slot.item_type === void 0 || slot.item_type === "individual") && typeof slot.asset_id === "string" && slot.asset_id.length > 0 && !Object.hasOwn(assets, slot.asset_id)
+  );
+  const targetBySource = /* @__PURE__ */ new Map();
+  const sourcesByTarget = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(assets)) {
+    if (declaredIds.has(key)) continue;
+    const asset = record(value);
+    if (!asset || typeof asset.asset_type !== "string") continue;
+    const matches = availableSlots.filter((slot) => {
+      if (slot.asset_type !== asset.asset_type) return false;
+      if (asset.asset_type === "url") {
+        return typeof asset.url_type === "string" && asset.url_type === slot.requirements?.url_type;
+      }
+      if (asset.asset_type === "pixel_tracker") {
+        return typeof asset.event === "string" && asset.event === slot.event && (asset.event !== "custom" || typeof asset.custom_event_name === "string" && asset.custom_event_name === slot.custom_event_name);
+      }
+      return true;
+    });
+    if (matches.length !== 1) continue;
+    const target = matches[0].asset_id;
+    targetBySource.set(key, target);
+    const sources = sourcesByTarget.get(target) ?? [];
+    sources.push(key);
+    sourcesByTarget.set(target, sources);
+  }
+  for (const sources of sourcesByTarget.values()) {
+    if (sources.length > 1) for (const source of sources) targetBySource.delete(source);
+  }
+  if (targetBySource.size === 0) return assetsValue;
+  return Object.fromEntries(Object.entries(assets).map(([key, value]) => [targetBySource.get(key) ?? key, value]));
+}
+function projectCreative(creative, formatId, legacyFormatDefinitions) {
   const next = { ...creative };
   delete next.format_kind;
   delete next.format_option_ref;
   next.format_id = { ...formatId };
+  const supplied = legacyFormatDefinitions?.filter((definition2) => {
+    const ref = legacyRef(record(definition2)?.format_id);
+    return ref !== void 0 && sameLegacyIdentity(ref, formatId);
+  });
+  const definition = supplied?.length ? supplied.length === 1 ? supplied[0] : void 0 : lookupV1Format(formatId);
+  if (Object.hasOwn(creative, "assets")) next.assets = projectLegacyAssetKeys(creative.assets, definition);
   return next;
 }
 function dedupeLegacyRefs(refs) {
@@ -808,7 +853,7 @@ function canonicalizeCreative(creative, selectorContainer, operation, legacyForm
   }
   return next;
 }
-function projectCreativeForDelivery(creative, selectorContainer, wireMode = "canonical", operation = "creative_delivery", legacyFormatConverter, canonicalFormatLegacyResolver) {
+function projectCreativeForDelivery(creative, selectorContainer, wireMode = "canonical", operation = "creative_delivery", legacyFormatConverter, canonicalFormatLegacyResolver, legacyFormatDefinitions) {
   const inputRecord = creative;
   const originalLegacyRef = legacyRef(inputRecord.format_id);
   const creativeRecord = canonicalizeCreative(inputRecord, selectorContainer, operation, legacyFormatConverter);
@@ -816,7 +861,11 @@ function projectCreativeForDelivery(creative, selectorContainer, wireMode = "can
   if (originalLegacyRef) {
     const selectedOriginal = selectLegacyRef(inputRecord, selectorContainer, canonicalFormatLegacyResolver, operation);
     if (selectedOriginal) {
-      return projectCreative(creativeRecord, selectedOriginal);
+      return projectCreative(
+        creativeRecord,
+        selectedOriginal,
+        legacyFormatDefinitions
+      );
     }
     throw new CreativeFormatProjectionError(
       operation,
@@ -825,7 +874,8 @@ function projectCreativeForDelivery(creative, selectorContainer, wireMode = "can
     );
   }
   const formatId = selectLegacyRef(creativeRecord, selectorContainer, canonicalFormatLegacyResolver, operation);
-  if (formatId) return projectCreative(creativeRecord, formatId);
+  if (formatId)
+    return projectCreative(creativeRecord, formatId, legacyFormatDefinitions);
   if (typeof creativeRecord.format_kind === "string") {
     const creativeId = typeof creativeRecord.creative_id === "string" ? creativeRecord.creative_id : "(unknown)";
     const allCandidates = candidatesFromContainer(selectorContainer, canonicalFormatLegacyResolver, operation);
@@ -860,10 +910,19 @@ function projectCreativeForDelivery(creative, selectorContainer, wireMode = "can
         "canonical format legacy resolver returned an invalid or ambiguous creative mapping"
       );
     }
-    if (resolved) return projectCreative(creativeRecord, resolved[0]);
+    if (resolved)
+      return projectCreative(
+        creativeRecord,
+        resolved[0],
+        legacyFormatDefinitions
+      );
     const pinned = optionReference(creativeRecord.format_option_ref) !== void 0;
     if (candidates.length === 1 && !pinned) {
-      return projectCreative(creativeRecord, candidates[0].ref);
+      return projectCreative(
+        creativeRecord,
+        candidates[0].ref,
+        legacyFormatDefinitions
+      );
     }
     if (candidates.length > 1) {
       throw new CreativeFormatProjectionError(
@@ -877,7 +936,7 @@ function projectCreativeForDelivery(creative, selectorContainer, wireMode = "can
   }
   return creative;
 }
-function projectMediaBuyCreativesForDelivery(request, wireMode = "canonical", operation = "create_media_buy", legacyFormatConverter, canonicalFormatLegacyResolver) {
+function projectMediaBuyCreativesForDelivery(request, wireMode = "canonical", operation = "create_media_buy", legacyFormatConverter, canonicalFormatLegacyResolver, legacyFormatDefinitions) {
   const requestRecord = record(request);
   if (!requestRecord) return request;
   let changed = false;
@@ -897,7 +956,8 @@ function projectMediaBuyCreativesForDelivery(request, wireMode = "canonical", op
           wireMode,
           operation,
           legacyFormatConverter,
-          canonicalFormatLegacyResolver
+          canonicalFormatLegacyResolver,
+          legacyFormatDefinitions
         );
         if (projected !== creativeValue) changed = true;
         return projected;
@@ -915,7 +975,7 @@ function projectMediaBuyCreativesForDelivery(request, wireMode = "canonical", op
   }
   return changed ? next : request;
 }
-function projectSyncCreativesForDelivery(request, selectorContainers, wireMode = "canonical", legacyFormatConverter, canonicalFormatLegacyResolver) {
+function projectSyncCreativesForDelivery(request, selectorContainers, wireMode = "canonical", legacyFormatConverter, canonicalFormatLegacyResolver, legacyFormatDefinitions) {
   const requestRecord = record(request);
   if (!requestRecord || !Array.isArray(requestRecord.creatives)) {
     return request;
@@ -944,7 +1004,8 @@ function projectSyncCreativesForDelivery(request, selectorContainers, wireMode =
       wireMode,
       "sync_creatives",
       legacyFormatConverter,
-      canonicalFormatLegacyResolver
+      canonicalFormatLegacyResolver,
+      legacyFormatDefinitions
     );
     if (projected !== creativeValue) changed = true;
     return projected;

package/dist/lib/version.d.mts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "16.0.0-beta.9";
+export declare const LIBRARY_VERSION = "16.0.0";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "16.0.0-beta.9";
+    readonly library: "16.0.0";
     readonly adcp: "3.2.5";
     readonly compatibleVersions: readonly ["v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.1.25", "3.1.26", "3.1.27", "3.1.28", "3.1.29", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4", "3.2.5"];
-    readonly generatedAt: "2026-10-19T19:41:05.601Z";
+    readonly generatedAt: "2026-10-19T23:27:30.750Z";
 };
 /**
  * Get the AdCP specification version this library is built for