Celtra event envelopes check encoded JSON data.

Source-scoped warning checks for Celtra /json/ browser-base64 UTF-8 event and redirect envelopes. Checks encoding, container shapes and common runtime metadata when instantiation is supplied. Caller overrides, blank values, empty batches, legacy fields and custom data remain open. Pixel and collect transports are excluded.

What this pack matches

Hosts: track.celtra.com
Paths: Full path expression: /json/.*
Vendor docs: cache-ssl.celtra.com/api/creatives/4635ae75/compiled/web.js?v=8-f374ba190d-moatvideo&secure=1

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`celtra_payload`	optional	The first-party sender appends nonempty browser btoa output for UTF-8 JSON after /json/. Capture the entire remainder, including raw plus, slash and padding. Query or form fields cannot supply an empty physical path slot. Presence diagnostic severity: warning. Fix: Compare the physical path with the original sender output; preserve its encoded bytes.	`vendor.celtra-json.param.celtra_payload.empty`	docs
`root`	optional	The source pixel and redirect helpers wrap their payload in an object. Unknown object properties remain accepted. Decoded body source: celtra_payload. Encoding: base64_json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: object.	`vendor.celtra-json.body.root.invalid`	docs
`events`	recommended	Both published helpers emit an events array. Empty arrays are native for redirect and empty-batch cases; no per-batch maximum is inferred from the runtime session event counter. Decoded body source: celtra_payload. Encoding: base64_json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: array.	`vendor.celtra-json.body.events.missing` `vendor.celtra-json.body.events.invalid`	docs
`pixels`	optional	The redirect helper carries its pending pixel URLs in an array. The ordinary event helper omits this field. Values, URL schemes and receiver behavior remain open. Decoded body source: celtra_payload. Encoding: base64_json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: array.	`vendor.celtra-json.body.pixels.invalid`	docs
`root`	optional	TrackingCenter creates plain event objects and shallow-merges caller fields. Arbitrary event properties and overridden native values remain accepted. Body scope: events[]. Decoded body source: celtra_payload. Encoding: base64_json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: object.	`vendor.celtra-json.body.root.invalid`	docs
`instantiation`	optional	This source-generated runtime carrier selects default-completeness advice. No type, numeric grammar or missing-field requirement is imposed on the marker itself. Body scope: events[]. Decoded body source: celtra_payload. Encoding: base64_json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning.		docs
`sessionId`	recommended	When the runtime instantiation carrier is supplied, compare this common TrackingCenter default with the source-produced event. Its value remains unrestricted because the sender permits caller overrides. Body scope: events[]. Decoded body source: celtra_payload. Encoding: base64_json. Decoding diagnostic severity: warning. Applies when {"kind":"exists","param":"instantiation"}. Presence diagnostic severity: warning. Fix: Compare the event with the originating Celtra runtime. This is producer-completeness advice, not a receiver rejection rule.	`vendor.celtra-json.body.sessionId.missing`	docs
`index`	recommended	When the runtime instantiation carrier is supplied, compare this common TrackingCenter default with the source-produced event. Its value remains unrestricted because the sender permits caller overrides. Body scope: events[]. Decoded body source: celtra_payload. Encoding: base64_json. Decoding diagnostic severity: warning. Applies when {"kind":"exists","param":"instantiation"}. Presence diagnostic severity: warning. Fix: Compare the event with the originating Celtra runtime. This is producer-completeness advice, not a receiver rejection rule.	`vendor.celtra-json.body.index.missing`	docs
`clientTimestamp`	recommended	When the runtime instantiation carrier is supplied, compare this common TrackingCenter default with the source-produced event. Its value remains unrestricted because the sender permits caller overrides. Body scope: events[]. Decoded body source: celtra_payload. Encoding: base64_json. Decoding diagnostic severity: warning. Applies when {"kind":"exists","param":"instantiation"}. Presence diagnostic severity: warning. Fix: Compare the event with the originating Celtra runtime. This is producer-completeness advice, not a receiver rejection rule.	`vendor.celtra-json.body.clientTimestamp.missing`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack vendor/celtra-json

Try this failing payload in the playground. An example with a validation finding.

https://track.celtra.com/json/

cargo install pixellint · npm install pixellint