@adcp/sdk 16.0.0-beta.1 → 16.0.0-beta.3

package/dist/lib/signing/webhook-verifier.js

@@ -172,8 +172,8 @@ async function verifyWebhookSignature(request, options) {
     parsedInput.signatureParamsValue,
     "3.2"
   );
-  const publicKey = (0, import_crypto.jwkToPublicKey)(jwk);
-  const valid = (0, import_crypto.verifySignature)(parsedInput.params.alg, publicKey, Buffer.from(base, "utf8"), parsedSig.bytes);
+  (0, import_crypto.jwkToPublicKey)(jwk);
+  const valid = await (0, import_crypto.verifySignatureAsync)(parsedInput.params.alg, jwk, Buffer.from(base, "utf8"), parsedSig.bytes);
   if (!valid) {
     throw new import_errors.WebhookSignatureError(
       "webhook_signature_invalid",
@@ -209,7 +209,7 @@ async function verifyWebhookSignature(request, options) {
   if (keyResolution.operatorAuthorizationValidUntil !== void 0) {
     assertDelegatedOperatorAuthorizationActive(keyResolution.operatorAuthorizationValidUntil, currentTime());
   }
-  const remaining = parsedInput.params.expires - now + import_types.CLOCK_SKEW_TOLERANCE_SECONDS;
+  const remaining = parsedInput.params.expires - now + import_types.CLOCK_SKEW_TOLERANCE_SECONDS + 1;
   const ttl = Math.max(remaining, import_types.MAX_SIGNATURE_WINDOW_SECONDS + import_types.CLOCK_SKEW_TOLERANCE_SECONDS);
   const insertResult = await options.replayStore.insert(jwk.kid, replayScope, parsedInput.params.nonce, ttl, now);
   if (insertResult === "replayed") {

package/dist/lib/signing/webhook-verifier.mjs

@@ -4,7 +4,7 @@ import { RequestSignatureError, WebhookSignatureError } from "./errors.mjs";
 import { AgentResolverError } from "./agent-resolver/errors.mjs";
 import { BrandJsonResolverError } from "./brand-jwks.mjs";
 import { parseSignature, parseSignatureInput } from "./parser.mjs";
-import { jwkToPublicKey, verifySignature } from "./crypto.mjs";
+import { jwkToPublicKey, verifySignatureAsync } from "./crypto.mjs";
 import { assertPublisherPins } from "./publisher-pins.mjs";
 import { InMemoryReplayStore } from "./replay.mjs";
 import { InMemoryRevocationStore } from "./revocation.mjs";
@@ -145,8 +145,8 @@ async function verifyWebhookSignature(request, options) {
     parsedInput.signatureParamsValue,
     "3.2"
   );
-  const publicKey = jwkToPublicKey(jwk);
-  const valid = verifySignature(parsedInput.params.alg, publicKey, Buffer.from(base, "utf8"), parsedSig.bytes);
+  jwkToPublicKey(jwk);
+  const valid = await verifySignatureAsync(parsedInput.params.alg, jwk, Buffer.from(base, "utf8"), parsedSig.bytes);
   if (!valid) {
     throw new WebhookSignatureError(
       "webhook_signature_invalid",
@@ -182,7 +182,7 @@ async function verifyWebhookSignature(request, options) {
   if (keyResolution.operatorAuthorizationValidUntil !== void 0) {
     assertDelegatedOperatorAuthorizationActive(keyResolution.operatorAuthorizationValidUntil, currentTime());
   }
-  const remaining = parsedInput.params.expires - now + CLOCK_SKEW_TOLERANCE_SECONDS;
+  const remaining = parsedInput.params.expires - now + CLOCK_SKEW_TOLERANCE_SECONDS + 1;
   const ttl = Math.max(remaining, MAX_SIGNATURE_WINDOW_SECONDS + CLOCK_SKEW_TOLERANCE_SECONDS);
   const insertResult = await options.replayStore.insert(jwk.kid, replayScope, parsedInput.params.nonce, ttl, now);
   if (insertResult === "replayed") {

package/dist/lib/substitution/compile.js

@@ -22,6 +22,7 @@ __export(compile_exports, {
 });
 module.exports = __toCommonJS(compile_exports);
 var import_enums = require('../types/enums.generated.js');
+var import_consent_macros = require('./consent-macros.js');
 const BUILT_IN_SOURCE_SYNTAXES = /* @__PURE__ */ new Set([
   "adcp",
   "double_brace",
@@ -61,7 +62,7 @@ function universalMacroName(token) {
 }
 function isUniversalMacro(token) {
   const name = universalMacroName(token);
-  return name !== null && UNIVERSAL_MACRO_NAMES.has(name);
+  return name !== null && (UNIVERSAL_MACRO_NAMES.has(name) || (0, import_consent_macros.isConsentMacro)(token));
 }
 function syntaxForExactToken(token, builtIns, customSyntaxes) {
   for (const syntax of customSyntaxes) {

package/dist/lib/substitution/compile.mjs

@@ -1,4 +1,5 @@
 import { UniversalMacroValues } from "../types/enums.generated.mjs";
+import { isConsentMacro } from "./consent-macros.mjs";
 const BUILT_IN_SOURCE_SYNTAXES = /* @__PURE__ */ new Set([
   "adcp",
   "double_brace",
@@ -38,7 +39,7 @@ function universalMacroName(token) {
 }
 function isUniversalMacro(token) {
   const name = universalMacroName(token);
-  return name !== null && UNIVERSAL_MACRO_NAMES.has(name);
+  return name !== null && (UNIVERSAL_MACRO_NAMES.has(name) || isConsentMacro(token));
 }
 function syntaxForExactToken(token, builtIns, customSyntaxes) {
   for (const syntax of customSyntaxes) {

package/dist/lib/substitution/consent-macros.d.mts

@@ -0,0 +1,4 @@
+/** The complete token retains the receiving vendor's positive decimal GVL ID. */
+export declare function isVendorScopedConsentMacro(token: string): boolean;
+/** Recognize privacy signals for helper compilation and consent diagnostics. */
+export declare function isConsentMacro(token: string): boolean;

package/dist/lib/substitution/consent-macros.d.ts

@@ -0,0 +1,4 @@
+/** The complete token retains the receiving vendor's positive decimal GVL ID. */
+export declare function isVendorScopedConsentMacro(token: string): boolean;
+/** Recognize privacy signals for helper compilation and consent diagnostics. */
+export declare function isConsentMacro(token: string): boolean;

package/dist/lib/substitution/consent-macros.js

@@ -0,0 +1,45 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var consent_macros_exports = {};
+__export(consent_macros_exports, {
+  isConsentMacro: () => isConsentMacro,
+  isVendorScopedConsentMacro: () => isVendorScopedConsentMacro
+});
+module.exports = __toCommonJS(consent_macros_exports);
+const VENDOR_SCOPED_CONSENT_MACRO = /^\{GDPR_CONSENT_[1-9][0-9]*\}$/;
+const CONSENT_MACROS = /* @__PURE__ */ new Set([
+  "{GDPR}",
+  "{GDPR_CONSENT}",
+  "{ADDTL_CONSENT}",
+  "{US_PRIVACY}",
+  "{GPP_STRING}",
+  "{GPP_SID}",
+  "{LIMIT_AD_TRACKING}"
+]);
+function isVendorScopedConsentMacro(token) {
+  return VENDOR_SCOPED_CONSENT_MACRO.test(token);
+}
+function isConsentMacro(token) {
+  return CONSENT_MACROS.has(token) || isVendorScopedConsentMacro(token);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  isConsentMacro,
+  isVendorScopedConsentMacro
+});

package/dist/lib/substitution/consent-macros.mjs

@@ -0,0 +1,20 @@
+const VENDOR_SCOPED_CONSENT_MACRO = /^\{GDPR_CONSENT_[1-9][0-9]*\}$/;
+const CONSENT_MACROS = /* @__PURE__ */ new Set([
+  "{GDPR}",
+  "{GDPR_CONSENT}",
+  "{ADDTL_CONSENT}",
+  "{US_PRIVACY}",
+  "{GPP_STRING}",
+  "{GPP_SID}",
+  "{LIMIT_AD_TRACKING}"
+]);
+function isVendorScopedConsentMacro(token) {
+  return VENDOR_SCOPED_CONSENT_MACRO.test(token);
+}
+function isConsentMacro(token) {
+  return CONSENT_MACROS.has(token) || isVendorScopedConsentMacro(token);
+}
+export {
+  isConsentMacro,
+  isVendorScopedConsentMacro
+};

package/dist/lib/substitution/index.d.mts

@@ -33,7 +33,7 @@ export type { CatalogMacroVectorName } from './vectors.mjs';
 export { extractTrackerUrls, matchBindings, assertNoNestedExpansion, assertRfc3986Safe, assertSchemePreserved, assertUnreservedOnly, DEFAULT_MACRO_PROHIBITED_PATTERN, enforceSsrfPolicy, enforceSsrfPolicyResolved, DEFAULT_SSRF_POLICY, } from './observer/index.mjs';
 export { encodeUnreserved, equalUnderHexCasePolicy, isUnreservedOnly, divergenceOffset } from './rfc3986.mjs';
 export type { AssertionOptions, AssertionResult, BindingMatch, CatalogBinding, CatalogMacroVector, PolicyResult, SsrfPolicy, TrackerUrlRecord, } from './types.mjs';
-export { translateUniversalMacros, UnsafeNativeMappingError } from './translate.mjs';
+export { translateUniversalMacros, UnsafeNativeMappingError, MultipleVendorConsentMacrosError } from './translate.mjs';
 export type { MacroMapping, TranslateResult } from './translate.mjs';
 export { compileUniversalMacroTemplate } from './compile.mjs';
 export type { BuiltInSourceMacroSyntax, CompileUniversalMacroTemplateInput, CompileUniversalMacroTemplateResult, CustomSourceMacroSyntax, MacroDocumentationReference, SourceMacroMapping, SourceMacroRequirement, SourceMacroRequirementSatisfaction, SourceMacroSyntax, SourceMacroSyntaxDeclaration, UniversalMacroCompileDiagnostic, UniversalMacroOccurrence, } from './compile.mjs';

package/dist/lib/substitution/index.d.ts

@@ -33,7 +33,7 @@ export type { CatalogMacroVectorName } from './vectors';
 export { extractTrackerUrls, matchBindings, assertNoNestedExpansion, assertRfc3986Safe, assertSchemePreserved, assertUnreservedOnly, DEFAULT_MACRO_PROHIBITED_PATTERN, enforceSsrfPolicy, enforceSsrfPolicyResolved, DEFAULT_SSRF_POLICY, } from './observer';
 export { encodeUnreserved, equalUnderHexCasePolicy, isUnreservedOnly, divergenceOffset } from './rfc3986';
 export type { AssertionOptions, AssertionResult, BindingMatch, CatalogBinding, CatalogMacroVector, PolicyResult, SsrfPolicy, TrackerUrlRecord, } from './types';
-export { translateUniversalMacros, UnsafeNativeMappingError } from './translate';
+export { translateUniversalMacros, UnsafeNativeMappingError, MultipleVendorConsentMacrosError } from './translate';
 export type { MacroMapping, TranslateResult } from './translate';
 export { compileUniversalMacroTemplate } from './compile';
 export type { BuiltInSourceMacroSyntax, CompileUniversalMacroTemplateInput, CompileUniversalMacroTemplateResult, CustomSourceMacroSyntax, MacroDocumentationReference, SourceMacroMapping, SourceMacroRequirement, SourceMacroRequirementSatisfaction, SourceMacroSyntax, SourceMacroSyntaxDeclaration, UniversalMacroCompileDiagnostic, UniversalMacroOccurrence, } from './compile';

package/dist/lib/substitution/index.js

@@ -22,6 +22,7 @@ __export(substitution_exports, {
   DEFAULT_MACRO_PROHIBITED_PATTERN: () => import_observer.DEFAULT_MACRO_PROHIBITED_PATTERN,
   DEFAULT_SSRF_POLICY: () => import_observer.DEFAULT_SSRF_POLICY,
   MacroInRawValueError: () => import_SubstitutionEncoder.MacroInRawValueError,
+  MultipleVendorConsentMacrosError: () => import_translate.MultipleVendorConsentMacrosError,
   PreviewFetchError: () => import_SubstitutionObserver.PreviewFetchError,
   SubstitutionEncoder: () => import_SubstitutionEncoder.SubstitutionEncoder,
   SubstitutionObserver: () => import_SubstitutionObserver.SubstitutionObserver,
@@ -56,6 +57,7 @@ var import_compile = require('./compile.js');
   DEFAULT_MACRO_PROHIBITED_PATTERN,
   DEFAULT_SSRF_POLICY,
   MacroInRawValueError,
+  MultipleVendorConsentMacrosError,
   PreviewFetchError,
   SubstitutionEncoder,
   SubstitutionObserver,

package/dist/lib/substitution/index.mjs

@@ -14,13 +14,14 @@ import {
   DEFAULT_SSRF_POLICY
 } from "./observer/index.mjs";
 import { encodeUnreserved, equalUnderHexCasePolicy, isUnreservedOnly, divergenceOffset } from "./rfc3986.mjs";
-import { translateUniversalMacros, UnsafeNativeMappingError } from "./translate.mjs";
+import { translateUniversalMacros, UnsafeNativeMappingError, MultipleVendorConsentMacrosError } from "./translate.mjs";
 import { compileUniversalMacroTemplate } from "./compile.mjs";
 export {
   CATALOG_MACRO_VECTORS,
   DEFAULT_MACRO_PROHIBITED_PATTERN,
   DEFAULT_SSRF_POLICY,
   MacroInRawValueError,
+  MultipleVendorConsentMacrosError,
   PreviewFetchError,
   SubstitutionEncoder,
   SubstitutionObserver,

package/dist/lib/substitution/translate.d.mts

@@ -4,7 +4,8 @@
  * position pass through untouched — only query-parameter values are translated.
  *
  * Universal macros match `\{[A-Z][A-Z0-9_]*\}` (upper-snake, single braces).
- * Native ad-server tokens (`%%X%%`, `{{x}}`) are not matched and pass through.
+ * Native ad-server tokens (`%%X%%`, `{{x}}`, `${x}`, `[X]`) pass through
+ * without translating their interiors.
  *
  * Per query parameter:
  *   - No universal macro → left untouched (literal param passes through).
@@ -64,6 +65,15 @@ export declare class UnsafeNativeMappingError extends Error {
     readonly macro: string;
     constructor(macro: string);
 }
+/**
+ * Thrown before emitting a URL containing a second vendor-scoped TCF macro.
+ * Only the canonical second token is retained, never the URL or consent data.
+ */
+export declare class MultipleVendorConsentMacrosError extends Error {
+    readonly code: "multiple_vendor_consent_macros";
+    readonly macro: string;
+    constructor(macro: string);
+}
 /** Result of {@link translateUniversalMacros}. */
 export interface TranslateResult {
     /** The translated URL. Base, path, and fragment are unchanged. */
@@ -82,7 +92,8 @@ export interface TranslateResult {
     unmapped_macros: string[];
     /**
      * Subset of `unmapped_macros` that are consent/privacy signals (`{GDPR}`,
-     * `{GDPR_CONSENT}`, `{US_PRIVACY}`, `{GPP_STRING}`, `{GPP_SID}`,
+     * `{GDPR_CONSENT}`, `{GDPR_CONSENT_<gvl_id>}`, `{ADDTL_CONSENT}`,
+     * `{US_PRIVACY}`, `{GPP_STRING}`, `{GPP_SID}`,
      * `{LIMIT_AD_TRACKING}`). Surfaced separately so a forgotten-mapping drop of
      * a compliance-relevant macro isn't lost among benign drops. Deduplicated.
      */
@@ -115,5 +126,7 @@ export interface TranslateResult {
  * @throws {UnsafeNativeMappingError} If any native mapping entry contains
  * U+0000-U+001F or U+007F. The whole mapping is checked before translation,
  * including entries not referenced by `input_pixel_url`.
+ * @throws {MultipleVendorConsentMacrosError} If the final URL contains more
+ * than one scoped TCF consent macro, after unsupported parameters are dropped.
  */
 export declare function translateUniversalMacros(input_pixel_url: string, mapping: MacroMapping): TranslateResult;

package/dist/lib/substitution/translate.d.ts

@@ -4,7 +4,8 @@
  * position pass through untouched — only query-parameter values are translated.
  *
  * Universal macros match `\{[A-Z][A-Z0-9_]*\}` (upper-snake, single braces).
- * Native ad-server tokens (`%%X%%`, `{{x}}`) are not matched and pass through.
+ * Native ad-server tokens (`%%X%%`, `{{x}}`, `${x}`, `[X]`) pass through
+ * without translating their interiors.
  *
  * Per query parameter:
  *   - No universal macro → left untouched (literal param passes through).
@@ -64,6 +65,15 @@ export declare class UnsafeNativeMappingError extends Error {
     readonly macro: string;
     constructor(macro: string);
 }
+/**
+ * Thrown before emitting a URL containing a second vendor-scoped TCF macro.
+ * Only the canonical second token is retained, never the URL or consent data.
+ */
+export declare class MultipleVendorConsentMacrosError extends Error {
+    readonly code: "multiple_vendor_consent_macros";
+    readonly macro: string;
+    constructor(macro: string);
+}
 /** Result of {@link translateUniversalMacros}. */
 export interface TranslateResult {
     /** The translated URL. Base, path, and fragment are unchanged. */
@@ -82,7 +92,8 @@ export interface TranslateResult {
     unmapped_macros: string[];
     /**
      * Subset of `unmapped_macros` that are consent/privacy signals (`{GDPR}`,
-     * `{GDPR_CONSENT}`, `{US_PRIVACY}`, `{GPP_STRING}`, `{GPP_SID}`,
+     * `{GDPR_CONSENT}`, `{GDPR_CONSENT_<gvl_id>}`, `{ADDTL_CONSENT}`,
+     * `{US_PRIVACY}`, `{GPP_STRING}`, `{GPP_SID}`,
      * `{LIMIT_AD_TRACKING}`). Surfaced separately so a forgotten-mapping drop of
      * a compliance-relevant macro isn't lost among benign drops. Deduplicated.
      */
@@ -115,5 +126,7 @@ export interface TranslateResult {
  * @throws {UnsafeNativeMappingError} If any native mapping entry contains
  * U+0000-U+001F or U+007F. The whole mapping is checked before translation,
  * including entries not referenced by `input_pixel_url`.
+ * @throws {MultipleVendorConsentMacrosError} If the final URL contains more
+ * than one scoped TCF consent macro, after unsupported parameters are dropped.
  */
 export declare function translateUniversalMacros(input_pixel_url: string, mapping: MacroMapping): TranslateResult;

package/dist/lib/substitution/translate.js

@@ -18,21 +18,51 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var translate_exports = {};
 __export(translate_exports, {
+  MultipleVendorConsentMacrosError: () => MultipleVendorConsentMacrosError,
   UnsafeNativeMappingError: () => UnsafeNativeMappingError,
   translateUniversalMacros: () => translateUniversalMacros
 });
 module.exports = __toCommonJS(translate_exports);
 var import_rfc3986 = require('./rfc3986.js');
-const UNIVERSAL_MACRO = /\{[A-Z][A-Z0-9_]*\}/g;
-const NATIVE_TOKEN_SHAPE = /^(?:%%.+%%|\{\{.+\}\}|\$\{.+\}|\[[A-Z][A-Z0-9_]*\])$/;
-const CONSENT_MACROS = /* @__PURE__ */ new Set([
-  "{GDPR}",
-  "{GDPR_CONSENT}",
-  "{US_PRIVACY}",
-  "{GPP_STRING}",
-  "{GPP_SID}",
-  "{LIMIT_AD_TRACKING}"
-]);
+var import_consent_macros = require('./consent-macros.js');
+function* macroTokens(text) {
+  const missingClosers = /* @__PURE__ */ new Set();
+  let cursor = 0;
+  while (cursor < text.length) {
+    let end = -1;
+    let native = true;
+    const close = text.startsWith("%%", cursor) ? "%%" : text.startsWith("{{", cursor) ? "}}" : text.startsWith("${", cursor) ? "}" : null;
+    if (close && !missingClosers.has(close)) {
+      const closer = text.indexOf(close, cursor + 2);
+      if (closer === -1) missingClosers.add(close);
+      else end = closer + close.length;
+    }
+    if (end === -1 && (text[cursor] === "{" || text[cursor] === "[")) {
+      let nameEnd = cursor + 1;
+      if (/[A-Z]/.test(text[nameEnd] ?? "")) {
+        nameEnd += 1;
+        while (/[A-Z0-9_]/.test(text[nameEnd] ?? "")) nameEnd += 1;
+        if (text[nameEnd] === (text[cursor] === "{" ? "}" : "]")) {
+          end = nameEnd + 1;
+          native = text[cursor] === "[";
+        }
+      }
+    }
+    if (end === -1) {
+      cursor += 1;
+      continue;
+    }
+    yield { text: text.slice(cursor, end), start: cursor, end, native };
+    cursor = end;
+  }
+}
+function hasNativeTokenSyntax(value) {
+  for (const token of macroTokens(value)) {
+    const minimumLength = token.text.startsWith("${") ? 3 : token.text.startsWith("[") ? 2 : 4;
+    if (token.native && token.text.length > minimumLength) return true;
+  }
+  return false;
+}
 const UNSAFE_NATIVE_CHARACTER = /[\u0000-\u001F\u007F]/;
 class UnsafeNativeMappingError extends Error {
   code = "unsafe_native_mapping";
@@ -46,6 +76,83 @@ class UnsafeNativeMappingError extends Error {
     this.macro = macro;
   }
 }
+class MultipleVendorConsentMacrosError extends Error {
+  code = "multiple_vendor_consent_macros";
+  macro;
+  constructor(macro) {
+    super(`Multiple vendor-scoped consent macros; second token is ${JSON.stringify(macro)}`);
+    this.name = "MultipleVendorConsentMacrosError";
+    this.macro = macro;
+  }
+}
+function overlappingRange(ranges, candidate) {
+  let low = 0;
+  let high = ranges.length;
+  while (low < high) {
+    const middle = Math.floor((low + high) / 2);
+    if (ranges[middle].end <= candidate.start) low = middle + 1;
+    else high = middle;
+  }
+  const range = ranges[low];
+  return range && range.start < candidate.end ? range : void 0;
+}
+function assertSingleScopedConsent(spans, mapping) {
+  const url = spans.map((span) => span.text).join("");
+  const concrete = [];
+  const sources = [];
+  let offset = 0;
+  for (const span of spans) {
+    const range = { start: offset, end: offset + span.text.length };
+    if (span.concrete && range.start < range.end) {
+      const previous = concrete[concrete.length - 1];
+      if (previous?.end === range.start) previous.end = range.end;
+      else concrete.push(range);
+    }
+    if (span.scopedSource && span.text.length > 0) sources.push({ ...range, macro: span.scopedSource });
+    offset = range.end;
+  }
+  const occurrences = [];
+  const shells = [];
+  for (const token of macroTokens(url)) {
+    const range = { start: token.start, end: token.end };
+    shells.push(range);
+    const canonical = token.text.startsWith("${") ? token.text.slice(1) : token.text;
+    if ((0, import_consent_macros.isVendorScopedConsentMacro)(canonical)) {
+      occurrences.push({ ...range, macro: canonical });
+    }
+  }
+  const aliases = [];
+  for (const [macro, entry] of Object.entries(mapping)) {
+    if (!(0, import_consent_macros.isVendorScopedConsentMacro)(macro) || !("native" in entry) || entry.native.length === 0) continue;
+    let start = url.indexOf(entry.native);
+    while (start !== -1) {
+      const range = { start, end: start + entry.native.length };
+      const shell = overlappingRange(shells, range);
+      const completeShell = shell?.start === range.start && shell.end === range.end;
+      const insideShell = shell && shell.start <= range.start && range.end <= shell.end && !completeShell;
+      const data = overlappingRange(concrete, range);
+      const entirelyConcrete = data && data.start <= range.start && range.end <= data.end;
+      if (!insideShell && (completeShell || !entirelyConcrete) && !overlappingRange(occurrences, range)) {
+        aliases.push({ ...range, macro });
+      }
+      start = url.indexOf(entry.native, range.end);
+    }
+  }
+  aliases.sort((a, b) => a.start - b.start || b.end - a.end);
+  const selectedAliases = [];
+  for (const alias of aliases) {
+    const previous = selectedAliases[selectedAliases.length - 1];
+    if (!previous || previous.end <= alias.start) selectedAliases.push(alias);
+  }
+  for (const alias of selectedAliases) occurrences.push(alias);
+  occurrences.sort((a, b) => a.start - b.start);
+  const unmatchedSources = sources.filter((source) => !overlappingRange(occurrences, source));
+  for (const source of unmatchedSources) occurrences.push(source);
+  occurrences.sort((a, b) => a.start - b.start);
+  const second = occurrences[1];
+  if (second) throw new MultipleVendorConsentMacrosError(second.macro);
+  return url;
+}
 function translateUniversalMacros(input_pixel_url, mapping) {
   const suspect_native_values = [];
   const suspectSeen = /* @__PURE__ */ new Set();
@@ -58,11 +165,11 @@ function translateUniversalMacros(input_pixel_url, mapping) {
       }
       continue;
     }
-    if (CONSENT_MACROS.has(macro) && !frozenConsentSeen.has(macro)) {
+    if ((0, import_consent_macros.isConsentMacro)(macro) && !frozenConsentSeen.has(macro)) {
       frozenConsentSeen.add(macro);
       frozen_consent_macros.push(macro);
     }
-    if (NATIVE_TOKEN_SHAPE.test(entry.value) && !suspectSeen.has(macro)) {
+    if (hasNativeTokenSyntax(entry.value) && !suspectSeen.has(macro)) {
       suspectSeen.add(macro);
       suspect_native_values.push(macro);
     }
@@ -73,7 +180,7 @@ function translateUniversalMacros(input_pixel_url, mapping) {
   const queryIdx = withoutFragment.indexOf("?");
   if (queryIdx === -1) {
     return {
-      url: input_pixel_url,
+      url: assertSingleScopedConsent([{ text: input_pixel_url }], mapping),
       dropped_params: [],
       unmapped_macros: [],
       dropped_consent_macros: [],
@@ -93,12 +200,12 @@ function translateUniversalMacros(input_pixel_url, mapping) {
     const eqIdx = rawParam.indexOf("=");
     const key = eqIdx === -1 ? rawParam : rawParam.slice(0, eqIdx);
     const value = eqIdx === -1 ? "" : rawParam.slice(eqIdx + 1);
-    const tokens = value.match(UNIVERSAL_MACRO);
-    if (!tokens) {
-      outputParts.push(rawParam);
+    const tokens = [...macroTokens(value)].filter((token) => !token.native);
+    if (tokens.length === 0) {
+      outputParts.push([{ text: rawParam }]);
       continue;
     }
-    const missing = tokens.filter((t) => !(t in mapping));
+    const missing = tokens.map((token) => token.text).filter((token) => !(token in mapping));
     if (missing.length > 0) {
       dropped_params.push(key);
       for (const m of missing) {
@@ -106,24 +213,38 @@ function translateUniversalMacros(input_pixel_url, mapping) {
           unmappedSeen.add(m);
           unmapped_macros.push(m);
         }
-        if (CONSENT_MACROS.has(m) && !consentSeen.has(m)) {
+        if ((0, import_consent_macros.isConsentMacro)(m) && !consentSeen.has(m)) {
           consentSeen.add(m);
           dropped_consent_macros.push(m);
         }
       }
       continue;
     }
-    const translated = value.replace(UNIVERSAL_MACRO, (token) => {
+    const translated = [{ text: `${key}=` }];
+    let cursor = 0;
+    for (const match of tokens) {
+      const token = match.text;
+      translated.push({ text: value.slice(cursor, match.start) });
       const entry = mapping[token];
-      if (!entry) {
-        return token;
+      if ("native" in entry) {
+        translated.push({
+          text: entry.native,
+          ...(0, import_consent_macros.isVendorScopedConsentMacro)(token) ? { scopedSource: token } : {}
+        });
+      } else {
+        translated.push({ text: (0, import_rfc3986.encodeUnreserved)(entry.value), concrete: true });
       }
-      return "native" in entry ? entry.native : (0, import_rfc3986.encodeUnreserved)(entry.value);
-    });
-    outputParts.push(`${key}=${translated}`);
+      cursor = match.end;
+    }
+    translated.push({ text: value.slice(cursor) });
+    outputParts.push(translated);
   }
-  const newQuery = outputParts.join("&");
-  const url = newQuery ? `${base}?${newQuery}${fragment}` : `${base}${fragment}`;
+  const querySpans = outputParts.flatMap((part, index) => index === 0 ? part : [{ text: "&" }, ...part]);
+  const hasQuery = querySpans.some((span) => span.text.length > 0);
+  const url = assertSingleScopedConsent(
+    [{ text: base }, ...hasQuery ? [{ text: "?" }, ...querySpans] : [], { text: fragment }],
+    mapping
+  );
   return {
     url,
     dropped_params,
@@ -135,6 +256,7 @@ function translateUniversalMacros(input_pixel_url, mapping) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  MultipleVendorConsentMacrosError,
   UnsafeNativeMappingError,
   translateUniversalMacros
 });