@adcp/sdk 9.6.1 → 9.7.0

package/dist/lib/schemas-data/3.1/trusted-match/context-match-request.json

@@ -0,0 +1,231 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/3.1.1/trusted-match/context-match-request.json",
+  "title": "Context Match Request",
+  "description": "Sent by publisher to router or provider to evaluate packages against contextual signals. The provider uses its synced package set for the placement. MUST NOT contain user identity. The request_id MUST NOT correlate with any identity match request_id. Extension fields (ext, context) are intentionally omitted — extension data in the context path could inadvertently carry or correlate user identity signals.",
+  "type": "object",
+  "x-status": "experimental",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "format": "uri",
+      "description": "Optional schema URI for validation. Ignored at runtime."
+    },
+    "adcp_version": {
+      "type": "string",
+      "description": "Release-precision AdCP version (VERSION.RELEASE, e.g. \"3.0\", \"3.1\", \"3.1-beta\"). On a request: the buyer's release pin. Inlined here (rather than via core/version-envelope.json allOf) so this schema can keep `additionalProperties: false` — the privacy boundary on this endpoint is contract-bearing.",
+      "pattern": "^\\d+\\.\\d+(-[a-zA-Z0-9.-]+)?$"
+    },
+    "adcp_major_version": {
+      "type": "integer",
+      "description": "DEPRECATED in favor of adcp_version. Removed in 4.0. Inlined alongside adcp_version to preserve strict-mode on this endpoint.",
+      "minimum": 1,
+      "maximum": 99
+    },
+    "type": {
+      "type": "string",
+      "const": "context_match_request",
+      "description": "Message type discriminator for deserialization."
+    },
+    "protocol_version": {
+      "type": "string",
+      "description": "TMP protocol version. Allows receivers to handle semantic differences across versions.",
+      "default": "1.0"
+    },
+    "request_id": {
+      "type": "string",
+      "description": "Unique request identifier. MUST NOT correlate with any identity match request_id."
+    },
+    "property_rid": {
+      "type": "string",
+      "format": "uuid",
+      "description": "Property catalog UUID (UUID v7). Globally unique, stable identifier assigned by the property catalog. The primary key for TMP matching and property list targeting."
+    },
+    "property_id": {
+      "$ref": "/schemas/3.1.1/core/property-id.json",
+      "description": "Publisher's human-readable property slug (e.g., 'cnn_homepage'). Optional when property_rid is present. Useful for logging and debugging."
+    },
+    "property_type": {
+      "$ref": "/schemas/3.1.1/enums/property-type.json",
+      "description": "Type of the publisher property"
+    },
+    "placement_id": {
+      "type": "string",
+      "description": "Placement identifier from the publisher's placement registry in adagents.json. Identifies where on the property this ad opportunity exists. One placement per request."
+    },
+    "seller_agent_url": {
+      "type": "string",
+      "format": "uri",
+      "description": "API endpoint URL of the seller agent issuing this request. The provider uses this to resolve the active package set it has synced for this seller; when `package_ids` is omitted, evaluation occurs against that full set. If `seller_agent_url` does not match any seller the provider has synced packages for, the provider MUST return an empty offer set — it MUST NOT fall back to another seller's active set. The value identifies the asking seller, is identical for every user on a given placement, and carries no user identity, so it neither varies the request per user nor weakens the context/identity decorrelation boundary. Compared using the AdCP URL canonicalization rules, not byte-equality — see docs/reference/url-canonicalization. Consistent with `seller_agent_url` on the identity match request, `seller_agent.agent_url` on `AvailablePackage`, and `agent_url` in `adagents.json`."
+    },
+    "artifact": {
+      "$ref": "/schemas/3.1.1/content-standards/artifact.json",
+      "description": "Full content artifact adjacent to this ad opportunity. Same schema used for content standards evaluation. The publisher sends the artifact when they want the buyer to evaluate the full content. Contractual protections govern buyer use. TEE deployment upgrades contractual trust to cryptographic verification. Publishers MUST NOT include asset access credentials (bearer tokens, service accounts) — the router fans out to multiple buyer agents. For secured assets, use signed URLs with short expiry. Routers MUST strip access fields from artifacts before forwarding."
+    },
+    "artifact_refs": {
+      "type": "array",
+      "description": "Public content references adjacent to this ad opportunity. Each artifact identifies content via a public identifier the buyer can resolve independently — no private registry sync required.",
+      "items": {
+        "type": "object",
+        "properties": {
+          "type": {
+            "type": "string",
+            "description": "Identifier type. 'url' for web pages, 'url_hash' for URL-addressable content the publisher prefers not to share directly (buyer matches against pre-crawled index), 'eidr' for film/TV (EIDR DOI), 'gracenote' for music/TV (Gracenote TMS ID), 'isrc' for music recordings (International Standard Recording Code), 'gtin' for products (Global Trade Item Number — UPC, EAN, ISBN-13), 'rss_guid' for podcast episodes (RSS GUID), 'isbn' for books, 'custom' for publisher-defined identifiers.",
+            "enum": [
+              "url",
+              "url_hash",
+              "eidr",
+              "gracenote",
+              "isrc",
+              "gtin",
+              "rss_guid",
+              "isbn",
+              "custom"
+            ]
+          },
+          "value": {
+            "type": "string",
+            "description": "The identifier value. For 'url': the canonical content URL — MUST NOT contain user-specific path segments, query parameters, or fragments; use 'url_hash' when the publisher prefers not to reveal the URL. For 'url_hash': Blake3 hash of the canonicalized URL, base64-encoded (canonicalization: strip scheme, strip www./m./amp. prefixes, lowercase, strip trailing slash, strip query params and fragments). For 'eidr': the EIDR DOI (e.g., '10.5240/xxxx'). For 'gracenote': the Gracenote TMS ID (e.g., 'SH032541890000'). For 'isrc': the ISRC code (e.g., 'USRC17607839'). For 'gtin': the GTIN (e.g., '00012345678905'). For 'rss_guid': the episode GUID from the RSS feed. For 'isbn': the ISBN (e.g., '978-0-123456-78-9'). For 'custom': a publisher-defined identifier."
+          }
+        },
+        "required": [
+          "type",
+          "value"
+        ],
+        "additionalProperties": false
+      },
+      "minItems": 1,
+      "maxItems": 20
+    },
+    "geo": {
+      "type": "object",
+      "description": "Coarse geographic location of the viewer. Publisher controls granularity — country is sufficient for regulatory compliance and volume filtering, region or metro helps with campaign targeting and valuation. Coarsened to prevent user identification: no postcode, no coordinates. All fields optional.",
+      "properties": {
+        "country": {
+          "type": "string",
+          "description": "ISO 3166-1 alpha-2 country code (e.g., 'US', 'GB', 'DE').",
+          "pattern": "^[A-Z]{2}$"
+        },
+        "region": {
+          "type": "string",
+          "description": "ISO 3166-2 subdivision code (e.g., 'US-CA', 'GB-SCT').",
+          "pattern": "^[A-Z]{2}-[A-Z0-9]{1,3}$"
+        },
+        "metro": {
+          "type": "object",
+          "description": "Metro area, using the same classification systems as AdCP targeting.",
+          "properties": {
+            "system": {
+              "$ref": "/schemas/3.1.1/enums/metro-system.json",
+              "description": "Metro area classification system (e.g., 'nielsen_dma', 'uk_itl2')."
+            },
+            "value": {
+              "type": "string",
+              "description": "Metro code within the system (e.g., '501' for New York DMA)."
+            }
+          },
+          "required": [
+            "system",
+            "value"
+          ],
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "context_signals": {
+      "type": "object",
+      "description": "Pre-computed classifier outputs for the content environment. Use when the publisher wants to provide classified context without sharing content or public references. Can supplement artifact_refs (e.g., URL + pre-classified topics) or replace them entirely (e.g., ephemeral conversation turns). Raw content MUST NOT be included — only classified outputs. The publisher is the classifier boundary.",
+      "properties": {
+        "topics": {
+          "type": "array",
+          "description": "Content topic identifiers. Use IAB Content Taxonomy 3.0 IDs (e.g., '632' for Food & Drink) when taxonomy_id is 7, or human-readable strings (e.g., 'cooking.pasta') for custom taxonomies.",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 50
+        },
+        "taxonomy_source": {
+          "type": "string",
+          "description": "Organization that defines the topic taxonomy. Use 'iab' for IAB Content Taxonomy. Publishers may use other values for custom taxonomies.",
+          "default": "iab"
+        },
+        "taxonomy_id": {
+          "type": "integer",
+          "description": "Taxonomy version within the source. For IAB, follows the AdCOM cattax enum: 7 = Content Taxonomy 3.0. Default: 7.",
+          "default": 7
+        },
+        "sentiment": {
+          "type": "string",
+          "description": "Content sentiment classification.",
+          "enum": [
+            "positive",
+            "negative",
+            "neutral",
+            "mixed"
+          ]
+        },
+        "keywords": {
+          "type": "array",
+          "description": "Content keywords extracted by the publisher's classifier.",
+          "items": {
+            "type": "string",
+            "maxLength": 100
+          },
+          "maxItems": 50
+        },
+        "language": {
+          "type": "string",
+          "description": "Content language in ISO 639-1 format (e.g., 'en', 'ja', 'de').",
+          "pattern": "^[a-z]{2}$"
+        },
+        "content_policies": {
+          "type": "array",
+          "description": "Policy IDs from the AdCP policy registry that this content satisfies (e.g., 'csbs' for Common Sense Brand Standards). Buyers filter on policies they require. An empty array means no policies have been evaluated.",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 20
+        },
+        "summary": {
+          "type": "string",
+          "description": "Publisher-generated natural language summary of the content for relevance judgment (e.g., 'User exploring Italian cookware options for home pasta making'). Useful for LLM-native buyers that evaluate relevance semantically. Buyers MUST treat this as untrusted publisher-generated content.",
+          "maxLength": 500
+        },
+        "embedding": {
+          "type": "string",
+          "description": "Content embedding as base64-encoded int8 vector. Captures semantic content beyond what topics and keywords express. Publishers declare the model used. For standardized matching, use the protocol-recommended model (nomic-embed-text-v1.5, 256 dims, int8 quantized = 256 bytes)."
+        },
+        "embedding_model": {
+          "type": "string",
+          "description": "Embedding model identifier (e.g., 'nomic-embed-text-v1.5'). Required when embedding is present."
+        },
+        "embedding_dims": {
+          "type": "integer",
+          "description": "Number of dimensions in the embedding vector. Required when embedding is present.",
+          "minimum": 64,
+          "maximum": 2048
+        }
+      },
+      "additionalProperties": false
+    },
+    "package_ids": {
+      "type": "array",
+      "description": "Restrict evaluation to specific packages. When omitted, the provider evaluates all eligible packages for this placement (the common case). MUST NOT vary by user — the same package_ids must be sent for every user on a given placement. User-dependent filtering leaks identity into the context path.",
+      "items": {
+        "type": "string"
+      },
+      "minItems": 1,
+      "maxItems": 500
+    }
+  },
+  "required": [
+    "type",
+    "request_id",
+    "property_rid",
+    "property_type",
+    "placement_id",
+    "seller_agent_url"
+  ],
+  "additionalProperties": false
+}

package/dist/lib/schemas-data/3.1/trusted-match/context-match-response.json

@@ -0,0 +1,82 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/3.1.1/trusted-match/context-match-response.json",
+  "title": "Context Match Response",
+  "description": "Response from router or provider with offers for matched packages. An empty offers array means no packages matched. For simple GAM integration, package_id flows as a macro via signals. For rich integrations, the offer includes brand, price, summary, and optionally an inline creative manifest. Extension fields (ext, context) are intentionally omitted — extension data in the context path could inadvertently carry or correlate user identity signals.",
+  "type": "object",
+  "allOf": [
+    {
+      "$ref": "/schemas/3.1.1/core/version-envelope.json"
+    },
+    {
+      "$ref": "/schemas/3.1.1/core/protocol-envelope.json"
+    }
+  ],
+  "x-status": "experimental",
+  "properties": {
+    "type": {
+      "type": "string",
+      "const": "context_match_response",
+      "description": "Message type discriminator for deserialization."
+    },
+    "request_id": {
+      "type": "string",
+      "description": "Echoed request identifier from the context match request"
+    },
+    "offers": {
+      "type": "array",
+      "description": "Offers from the buyer, one per activated package. An empty array means no packages matched. For simple activation, each offer has just package_id. For richer responses, offers include brand, price, summary, and creative manifest.",
+      "items": {
+        "$ref": "/schemas/3.1.1/trusted-match/offer.json"
+      }
+    },
+    "cache_ttl": {
+      "type": "integer",
+      "description": "Optional override for the default 5-minute cache TTL, in seconds. When present, the router MUST use this value instead of its default. Set to 0 to disable caching (e.g., when targeting configuration has just changed).",
+      "minimum": 0,
+      "maximum": 86400
+    },
+    "signals": {
+      "type": "object",
+      "description": "Response-level targeting signals for ad server pass-through. In the GAM case, these carry the key-value pairs that trigger line items. Not per-offer — applies to the response as a whole.",
+      "properties": {
+        "segments": {
+          "type": "array",
+          "description": "Contextual segment identifiers",
+          "items": {
+            "type": "string"
+          }
+        },
+        "targeting_kvs": {
+          "type": "array",
+          "description": "Key-value pairs for ad server targeting",
+          "items": {
+            "type": "object",
+            "properties": {
+              "key": {
+                "type": "string",
+                "description": "Targeting key"
+              },
+              "value": {
+                "type": "string",
+                "description": "Targeting value"
+              }
+            },
+            "required": [
+              "key",
+              "value"
+            ],
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": true
+    }
+  },
+  "required": [
+    "type",
+    "request_id",
+    "offers"
+  ],
+  "additionalProperties": true
+}

package/dist/lib/schemas-data/3.1/trusted-match/error.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/3.1.1/trusted-match/error.json",
+  "title": "TMP Error",
+  "description": "Error response from a TMP provider or router. Returned instead of a normal response when the provider cannot process the request. Distinguishes errors from empty results (an empty offers array is a valid response meaning no matches, not an error).",
+  "x-status": "experimental",
+  "type": "object",
+  "properties": {
+    "type": {
+      "type": "string",
+      "const": "error",
+      "description": "Message type discriminator for deserialization."
+    },
+    "request_id": {
+      "type": "string",
+      "description": "Echoed request identifier from the original request"
+    },
+    "code": {
+      "type": "string",
+      "description": "Machine-readable error code. `seller_not_authorized` is returned by providers at sync time when an AvailablePackage declares a `seller_agent.agent_url` that is not present in the `authorized_agents` list of the publisher's adagents.json for a property the package claims to serve.",
+      "enum": [
+        "invalid_request",
+        "unknown_package",
+        "seller_not_authorized",
+        "rate_limited",
+        "timeout",
+        "internal_error",
+        "provider_unavailable"
+      ]
+    },
+    "message": {
+      "type": "string",
+      "description": "Human-readable error description for debugging"
+    }
+  },
+  "required": [
+    "type",
+    "request_id",
+    "code"
+  ],
+  "additionalProperties": true
+}

package/dist/lib/schemas-data/3.1/trusted-match/identity-match-request.json

@@ -0,0 +1,200 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "/schemas/3.1.1/trusted-match/identity-match-request.json",
+  "title": "Identity Match Request",
+  "description": "Sent by publisher to evaluate user eligibility for packages using an opaque identity token. MUST NOT contain page context. The request_id MUST NOT correlate with any context match request_id. The buyer resolves the active package set for this seller from `seller_agent_url`; if `package_ids` is provided, its composition MUST be independent of the current placement (e.g., all-active or fuzzed; see field description) to prevent set-correlation attacks. Extension fields (ext, context) are intentionally omitted to prevent data leakage across the identity privacy boundary. The optional `attestation` (per identity) and `sealed_credentials` (top-level) fields carry verifiable proof ABOUT the identity — on the identity side of that boundary, not page context — so they are a deliberate, reviewed widening of this otherwise-closed schema, not a leak.",
+  "type": "object",
+  "x-status": "experimental",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "format": "uri",
+      "description": "Optional schema URI for validation. Ignored at runtime."
+    },
+    "adcp_version": {
+      "type": "string",
+      "description": "Release-precision AdCP version (VERSION.RELEASE, e.g. \"3.0\", \"3.1\", \"3.1-beta\"). On a request: the buyer's release pin. Inlined here (rather than via core/version-envelope.json allOf) so this schema can keep `additionalProperties: false` — the privacy boundary on this endpoint is contract-bearing.",
+      "pattern": "^\\d+\\.\\d+(-[a-zA-Z0-9.-]+)?$"
+    },
+    "adcp_major_version": {
+      "type": "integer",
+      "description": "DEPRECATED in favor of adcp_version. Removed in 4.0. Inlined alongside adcp_version to preserve strict-mode on this endpoint.",
+      "minimum": 1,
+      "maximum": 99
+    },
+    "type": {
+      "type": "string",
+      "const": "identity_match_request",
+      "description": "Message type discriminator for deserialization."
+    },
+    "protocol_version": {
+      "type": "string",
+      "description": "TMP protocol version. Allows receivers to handle semantic differences across versions.",
+      "default": "1.0"
+    },
+    "request_id": {
+      "type": "string",
+      "description": "Unique request identifier. MUST NOT correlate with any context match request_id."
+    },
+    "seller_agent_url": {
+      "type": "string",
+      "format": "uri",
+      "description": "API endpoint URL of the seller agent issuing this request. The buyer's identity-match service uses this to resolve the active package set it has registered for this seller; when `package_ids` is omitted, evaluation occurs against that full set. If `seller_agent_url` does not match any seller for which the buyer has registered active packages, the buyer MUST return an empty `eligible_package_ids` set — it MUST NOT fall back to evaluating against another seller's active set. Compared using the AdCP URL canonicalization rules, not byte-equality — see docs/reference/url-canonicalization. Consistent with `seller_agent.agent_url` on `AvailablePackage` and `agent_url` in `adagents.json`."
+    },
+    "identities": {
+      "type": "array",
+      "description": "Identity tokens for the user, each tagged with its type. Publishers SHOULD include every token they have available — the buyer resolves on whichever graph matches. Entry order is not semantically significant; buyers use their own preference order when multiple entries resolve. Duplicate `(uid_type, user_token)` pairs MUST NOT appear; routers MAY reject or dedupe. `maxItems: 3` matches the TMPX plaintext budget (~120 bytes after HPKE overhead fits three 32-byte tokens); exceeding it forces buyer-side truncation.",
+      "items": {
+        "type": "object",
+        "properties": {
+          "user_token": {
+            "type": "string",
+            "description": "Opaque token from an identity provider (ID5, LiveRamp, UID2) or publisher-generated. Buyer may map to internal identity graph but cannot reverse to PII."
+          },
+          "uid_type": {
+            "$ref": "/schemas/3.1.1/enums/uid-type.json",
+            "description": "Type of the user identifier. Tells the buyer which identity graph to resolve against, avoiding trial-and-error matching."
+          },
+          "attestation": {
+            "type": "object",
+            "description": "Optional verifiable proof ABOUT this identity (e.g. World ID proof-of-personhood and/or age). The receiver MUST verify it (see conformance) and MUST treat an absent-or-unverifiable attestation as 'no attestation' — never as an asserted-true claim. Issuer-agnostic: World ID is the first scheme; mDL / VC-style issuers use the same shape. Receivers MUST bound attestation size to prevent DoS.",
+            "properties": {
+              "issuer": {
+                "$ref": "/schemas/3.1.1/core/brand-ref.json",
+                "description": "Attestation authority / identity issuer, referenced as a vendor BrandRef (e.g. {\"domain\": \"world.org\"}) — the same vendor-reference shape AdCP uses for measurement and signals vendors. The issuer's canonical domain is the anchor; brand.json hosting is optional. `scheme` selects the verifier version within the issuer."
+              },
+              "scheme": {
+                "type": "string",
+                "description": "Proof scheme and version, e.g. \"world_id_v4\". Selects how `proof` is verified."
+              },
+              "relying_party_id": {
+                "type": "string",
+                "x-entity": "identity_relying_party",
+                "description": "Relying-party id the proof was minted for. The receiver checks this against the relying_party_id's published owner (brand.json `identity_relying_parties[]`) so a forwarded proof cannot be replayed under a different owner."
+              },
+              "action": {
+                "type": "string",
+                "description": "Issuer action/scope the proof was bound to (e.g. \"humanity-check-for-ads\")."
+              },
+              "claims": {
+                "type": "array",
+                "description": "Claims this attestation establishes. Closed, issuer-agnostic set.",
+                "items": {
+                  "$ref": "/schemas/3.1.1/enums/attestation-claim.json"
+                },
+                "minItems": 1,
+                "uniqueItems": true,
+                "maxItems": 16
+              },
+              "verification_level": {
+                "type": "string",
+                "enum": [
+                  "orb",
+                  "device",
+                  "document"
+                ],
+                "description": "Credential strength (e.g. World ID Orb = biometric unique-human; Device = weaker; Document = passport/NFC)."
+              },
+              "signal_binding": {
+                "type": "string",
+                "description": "Hash of the signal the proof commits to. The receiver MUST verify it matches the context the receiver expects (e.g. a buyer-issued nonce or the request_id) and that the attestation is within its freshness window; this, plus nullifier-reuse tracking, is the replay defense."
+              },
+              "proof": {
+                "type": "object",
+                "description": "Scheme-specific verifiable proof material. Opaque to this schema; validated by the scheme's verifier. MUST carry only scheme-defined verification material — never page context or additional user identifiers.",
+                "additionalProperties": true
+              },
+              "expires_at": {
+                "type": "string",
+                "format": "date-time",
+                "description": "Attestation validity horizon. Receivers MUST reject when past."
+              }
+            },
+            "required": [
+              "issuer",
+              "scheme",
+              "claims",
+              "proof"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "required": [
+          "user_token",
+          "uid_type"
+        ],
+        "additionalProperties": false
+      },
+      "minItems": 1,
+      "maxItems": 3
+    },
+    "consent": {
+      "type": "object",
+      "description": "Privacy consent signals. Buyers in regulated jurisdictions MUST NOT process the user token without consent information.",
+      "properties": {
+        "gdpr": {
+          "type": "boolean",
+          "description": "Whether GDPR applies to this request."
+        },
+        "tcf_consent": {
+          "type": "string",
+          "description": "IAB TCF v2.2 consent string. Present when gdpr is true."
+        },
+        "gpp": {
+          "type": "string",
+          "description": "IAB Global Privacy Platform string."
+        },
+        "us_privacy": {
+          "type": "string",
+          "description": "US Privacy string (CCPA). Deprecated in favor of GPP but still widely used."
+        }
+      },
+      "additionalProperties": false
+    },
+    "package_ids": {
+      "type": "array",
+      "description": "Optional. When omitted, the buyer evaluates eligibility against the full set of active packages it has registered for `seller_agent_url`. When provided, the composition of `package_ids` MUST be statistically independent of the current placement — sending only the page-specific subset would let the buyer correlate Identity Match with Context Match by comparing package sets. Two acceptable modes: (a) **all-active** — include every active package this buyer has at this publisher; (b) **fuzzed** — include a random sample of active packages, optionally padded with synthetic non-existent IDs, drawn from a distribution that does not depend on the current placement. The buyer's silent-drop behavior on unknown IDs (specified below) is what makes synthetic-ID padding safe — they do not affect the response shape and cannot leak registry membership. When both `seller_agent_url` and `package_ids` are present, the buyer evaluates against the intersection of its registered active set and `package_ids`; IDs in `package_ids` that the buyer has not registered for this seller MUST be silently ignored (not surfaced as errors) to avoid leaking registry membership back to the publisher.",
+      "items": {
+        "type": "string"
+      },
+      "minItems": 1
+    },
+    "country": {
+      "type": "string",
+      "pattern": "^[A-Z]{2}$",
+      "description": "ISO 3166-1 alpha-2 country code. Routing directive for the TMP Router — used to select the correct regional provider. The router MUST strip this field before forwarding the request to the buyer agent. Not an identity signal."
+    },
+    "sealed_credentials": {
+      "type": "array",
+      "description": "Optional HPKE-sealed credentials addressed to specific audiences — the network-as-RP (\"issuer-as-RP\"/Mechanism B) carrier. Each payload is opaque to the publisher, who relays it untouched; the inner plaintext is an `attestation` (see identities[].attestation) scoped to the audience's relying party. Reuses the TMPX envelope format. Router handling (normative — see docs/trusted-match/specification.mdx): the router forwards each entry only to the provider that owns its `audience_kid` (not broadcast), folds `sealed_credentials` into the per-provider re-signature canonical bytes so an injected/swapped blob breaks the signature, and includes a `sealed_credentials_hash` in the dedup cache key. Receivers decrypt only entries whose `audience_kid` they hold a key for and ignore the rest. Receivers MUST bound count and size to prevent DoS amplification.",
+      "maxItems": 8,
+      "items": {
+        "type": "object",
+        "properties": {
+          "audience_kid": {
+            "type": "string",
+            "maxLength": 128,
+            "description": "Key id identifying the recipient (network / relying party) whose HPKE private key opens `payload`."
+          },
+          "payload": {
+            "type": "string",
+            "maxLength": 8192,
+            "description": "HPKE-sealed attestation in the TMPX envelope format: `kid.base64url_nopad(ciphertext)` — unpadded base64url per RFC 4648 §5. Opaque pass-through for the publisher."
+          }
+        },
+        "required": [
+          "audience_kid",
+          "payload"
+        ],
+        "additionalProperties": false
+      }
+    }
+  },
+  "required": [
+    "type",
+    "request_id",
+    "seller_agent_url",
+    "identities"
+  ],
+  "additionalProperties": false
+}