@adcp/sdk 16.0.0-beta.7 → 16.0.0-beta.8

package/dist/lib/core/SingleAgentClient.mjs

@@ -163,7 +163,9 @@ import { resolveWebhookUrl, selectWebhookTemplate } from "./webhook-url.mjs";
 import { getV25Adapter } from "../adapters/legacy/v2-5/index.mjs";
 import {
   ProductPropertyPolicyError,
-  validateProductsAgainstPropertyPolicy
+  validateProductsAgainstPropertyPolicy,
+  isSupportedPropertyIdentifierType,
+  normalizeDomainForPropertyPolicy
 } from "../media-buy/property-policy.mjs";
 import { resolvePropertyList } from "../server/targeting-helpers.mjs";
 import {
@@ -787,7 +789,9 @@ function productIdForPricingDiagnostics(product) {
   return typeof id === "string" ? id : void 0;
 }
 function propertyListReferenceFromRequest(params) {
-  const value = params.property_list;
+  const filters = params.filters;
+  const nested = filters && typeof filters === "object" && !Array.isArray(filters) && Object.hasOwn(filters, "property_list") && filters.property_list !== void 0;
+  const value = nested ? filters.property_list : params.property_list;
   if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
   const ref = value;
   if (typeof ref.agent_url !== "string" || typeof ref.list_id !== "string") return void 0;
@@ -800,21 +804,37 @@ function propertyListReferenceFromRequest(params) {
 function productPolicyRequestSnapshot(requestParams) {
   const account = canonicalAccountRoutingSnapshot(requestParams.account);
   const propertyList = propertyListReferenceFromRequest(requestParams);
+  const referenceError = propertyListReferenceError(requestParams);
   return Object.freeze({
     ...account ? { account } : {},
-    ...propertyList ? { property_list: Object.freeze(propertyList) } : {}
+    ...propertyList ? { property_list: Object.freeze(propertyList) } : {},
+    ...referenceError ? { property_list_error: referenceError } : {}
   });
 }
+function propertyListReferenceError(params) {
+  if (typeof params.property_list_error === "string") return params.property_list_error;
+  const filters = params.filters;
+  if (params.property_list !== void 0 && !propertyListReferenceFromRequest({ property_list: params.property_list }))
+    return "property_list_invalid_reference";
+  if (!filters || typeof filters !== "object" || Array.isArray(filters) || !Object.hasOwn(filters, "property_list") || filters.property_list === void 0)
+    return void 0;
+  const nested = propertyListReferenceFromRequest(params);
+  if (!nested) return "property_list_invalid_reference";
+  if (params.property_list !== void 0) {
+    const legacy = propertyListReferenceFromRequest({ property_list: params.property_list });
+    if (!legacy || nested.agent_url !== legacy.agent_url || nested.list_id !== legacy.list_id || nested.auth_token !== legacy.auth_token) {
+      return "property_list_conflicting_references";
+    }
+  }
+  return void 0;
+}
 function hasProductPropertyPolicyRules(policy) {
   return Boolean(
     policy.allowedDomains?.length || policy.allowedPropertyIdentifiers?.length || policy.requireAllowedPropertyMatch || policy.excludedDomains?.length || policy.excludedPropertyIds?.length || policy.strict || policy.unknownSelectorBehavior || policy.missingPublisherPropertiesBehavior
   );
 }
-function comparablePropertyIdentifiers(identifiers) {
-  return identifiers.filter((identifier) => identifier.type === "domain" || identifier.type === "subdomain").map((identifier) => ({ type: identifier.type, value: identifier.value }));
-}
 function unsupportedPropertyIdentifiers(identifiers) {
-  return identifiers.filter((identifier) => identifier.type !== "domain" && identifier.type !== "subdomain").map((identifier) => ({ type: identifier.type }));
+  return identifiers.filter((identifier) => !isSupportedPropertyIdentifierType(identifier.type)).map((identifier) => ({ type: identifier.type }));
 }
 function sanitizeDiagnosticUrl(value) {
   try {
@@ -1411,8 +1431,17 @@ class SingleAgentClient {
   }
   assertDurablePropertyListCredentialSupported(taskType, requestParams) {
     if (!this.config.deferredStorage || taskType !== "get_products") return;
-    const propertyList = propertyListReferenceFromRequest(requestParams);
-    if (!propertyList?.auth_token) return;
+    const filters = requestParams.filters;
+    const references = [
+      requestParams.property_list,
+      filters && typeof filters === "object" ? filters.property_list : void 0
+    ];
+    const hasCredential = references.some((reference) => {
+      if (!reference || typeof reference !== "object") return false;
+      const token = reference.auth_token;
+      return token !== void 0 && token !== null && token !== "";
+    });
+    if (!hasCredential) return;
     const policyConfig = this.config.validation?.productPropertyPolicy;
     if (policyConfig === false || policyConfig?.enforceRequestPropertyList === false) return;
     throw new ConfigurationError(
@@ -4223,39 +4252,40 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       message = "Property list not adhered to",
       enforceRequestPropertyList = true,
       propertyListResolveOptions,
+      resolvePublisherProperties,
+      maxPublisherLookups = 100,
+      publisherLookupTimeoutMs = 1e4,
+      publisherLookupBudgetMs = 1e4,
       ...explicitPolicy
     } = policyConfig || {};
     const policy = {
       ...explicitPolicy
     };
     let resolvedRequestPropertyList;
-    if (requestPropertyList && enforceRequestPropertyList) {
+    const referenceError = propertyListReferenceError(requestParams);
+    if ((requestPropertyList || referenceError) && enforceRequestPropertyList) {
       try {
+        if (referenceError) throw new Error(referenceError);
         const resolved = await resolvePropertyList(requestPropertyList, propertyListResolveOptions);
-        const comparableIdentifiers = comparablePropertyIdentifiers(resolved.identifiers);
         const unsupportedIdentifiers = unsupportedPropertyIdentifiers(resolved.identifiers);
-        if (unsupportedIdentifiers.length > 0) {
-          throw new Error("property_list_unsupported_identifier_types");
-        }
-        if (comparableIdentifiers.length > 0 || resolved.identifiers.length === 0) {
-          policy.allowedPropertyIdentifiers = [...policy.allowedPropertyIdentifiers ?? [], ...comparableIdentifiers];
-          policy.requireAllowedPropertyMatch = true;
-        }
+        policy.allowedPropertyIdentifiers = [...policy.allowedPropertyIdentifiers ?? [], ...resolved.identifiers];
+        policy.requireAllowedPropertyMatch = true;
         policy.strict = policy.strict ?? true;
         resolvedRequestPropertyList = {
           listId: resolved.listId,
           agentUrl: resolved.agentUrl,
           identifierCount: resolved.identifiers.length,
+          unsupportedIdentifierTypes: [...new Set(unsupportedIdentifiers.map((identifier) => identifier.type))],
           ...resolved.cacheValidUntil ? { cacheValidUntil: resolved.cacheValidUntil } : {}
         };
       } catch (err) {
         const errorCode = propertyListResolutionErrorCode(err);
-        const diagnosticAgentUrl = sanitizeDiagnosticUrl(requestPropertyList.agent_url);
+        const diagnosticAgentUrl = requestPropertyList ? sanitizeDiagnosticUrl(requestPropertyList.agent_url) : "invalid_url";
         return attachMatch({
           success: false,
           status: "failed",
           data: response,
-          error: `${message}: could not resolve property_list ${requestPropertyList.list_id}`,
+          error: `${message}: could not resolve property_list`,
           metadata: {
             ...result.metadata,
             status: "failed",
@@ -4268,7 +4298,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
               message,
               diagnostics: [],
               request_property_list: {
-                list_id: requestPropertyList.list_id,
+                list_id: requestPropertyList?.list_id ?? "invalid_reference",
                 agent_url: diagnosticAgentUrl,
                 resolution_error: errorCode
               }
@@ -4283,7 +4313,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
               mode,
               ok: false,
               request_property_list: {
-                list_id: requestPropertyList.list_id,
+                list_id: requestPropertyList?.list_id,
                 agent_url: diagnosticAgentUrl,
                 resolution_error: errorCode
               }
@@ -4293,6 +4323,65 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       }
     }
     if (!hasProductPropertyPolicyRules(policy)) return result;
+    if (resolvePublisherProperties && policy.allowedPropertyIdentifiers?.some(
+      (identifier) => identifier.type !== "domain" && identifier.type !== "subdomain"
+    )) {
+      if (!Number.isSafeInteger(maxPublisherLookups) || maxPublisherLookups < 1 || !Number.isSafeInteger(publisherLookupTimeoutMs) || publisherLookupTimeoutMs < 1 || publisherLookupTimeoutMs > 2147483647 || !Number.isSafeInteger(publisherLookupBudgetMs) || publisherLookupBudgetMs < 1 || publisherLookupBudgetMs > 2147483647) {
+        throw new ConfigurationError("Publisher lookup limits must be positive bounded integers");
+      }
+      const { validatePublisherDomain } = await import("../identifiers.mjs");
+      const catalogs = Object.assign(
+        /* @__PURE__ */ Object.create(null),
+        policy.publisherProperties
+      );
+      const domains = new Set(
+        response.products.flatMap(
+          (product) => Array.isArray(product.publisher_properties) ? product.publisher_properties.flatMap(
+            (selector) => selector && typeof selector === "object" && "publisher_domain" in selector ? [selector.publisher_domain] : []
+          ) : []
+        )
+      );
+      const hosts = [
+        ...new Set(
+          [...domains].flatMap(
+            (domain) => typeof domain === "string" ? [normalizeDomainForPropertyPolicy(domain)?.host] : []
+          )
+        )
+      ].filter((host) => typeof host === "string" && !Object.hasOwn(catalogs, host));
+      for (const host of hosts) catalogs[host] = void 0;
+      const lookupStartedAt = performance.now();
+      for (const host of hosts.slice(0, maxPublisherLookups)) {
+        throwIfAborted(taskSignal);
+        const remainingBudgetMs = publisherLookupBudgetMs - (performance.now() - lookupStartedAt);
+        if (remainingBudgetMs <= 0) break;
+        if (!validatePublisherDomain(host).ok || isLikelyPrivateUrl(`https://${host}`)) continue;
+        const controller = new AbortController();
+        const signal = taskSignal ? AbortSignal.any([taskSignal, controller.signal]) : controller.signal;
+        let timeout;
+        let budgetExpired = false;
+        try {
+          catalogs[host] = await Promise.race([
+            resolvePublisherProperties(host, { signal }),
+            new Promise((_, reject) => {
+              timeout = setTimeout(
+                () => {
+                  if (remainingBudgetMs <= publisherLookupTimeoutMs) budgetExpired = true;
+                  controller.abort();
+                  reject(new Error("publisher_catalog_timeout"));
+                },
+                Math.min(publisherLookupTimeoutMs, remainingBudgetMs)
+              );
+            })
+          ]);
+        } catch {
+          catalogs[host] = void 0;
+        } finally {
+          if (timeout) clearTimeout(timeout);
+        }
+        if (budgetExpired) break;
+      }
+      policy.publisherProperties = catalogs;
+    }
     let validation;
     try {
       validation = validateProductsAgainstPropertyPolicy({
@@ -4316,6 +4405,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
           list_id: resolvedRequestPropertyList.listId,
           agent_url: sanitizeDiagnosticUrl(resolvedRequestPropertyList.agentUrl),
           identifier_count: resolvedRequestPropertyList.identifierCount,
+          unsupported_identifier_types: resolvedRequestPropertyList.unsupportedIdentifierTypes,
           ...resolvedRequestPropertyList.cacheValidUntil ? { cache_valid_until: resolvedRequestPropertyList.cacheValidUntil } : {}
         }
       } : {},

package/dist/lib/identifiers.d.mts

@@ -0,0 +1,53 @@
+import type { PropertyIdentifierTypes } from './types/core.generated.mjs';
+export type IdentifierValidationErrorCode = 'invalid_identifier' | 'unsupported_identifier_type' | 'invalid_publisher_domain';
+export declare class IdentifierValidationError extends TypeError {
+    readonly code: IdentifierValidationErrorCode;
+    readonly identifierType: string;
+    readonly name = "IdentifierValidationError";
+    constructor(code: IdentifierValidationErrorCode, identifierType: string, message: string);
+}
+export interface IdentifierRewrite {
+    from: string;
+    to: string;
+}
+export type IdentifierValidationResult = {
+    ok: true;
+    value: string;
+    rewrite?: IdentifierRewrite;
+} | {
+    ok: false;
+    error: IdentifierValidationError;
+};
+/** Validate a registration hostname as supplied. This deliberately does not repair URLs or wildcards. */
+export declare function validatePublisherDomain(value: string): IdentifierValidationResult;
+export declare const normalizeDomainIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeSubdomainIdentifier: (value: string) => IdentifierValidationResult;
+/** Bundle identifiers are case-sensitive; normalization preserves their case. */
+export declare const normalizeIosBundleIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeAndroidPackageIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeAppleAppStoreIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeGooglePlayIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeRokuStoreIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeFireTvAsinIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeSamsungAppIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeAppleTvBundleIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeBundleIdentifier: (value: string) => IdentifierValidationResult;
+/**
+ * Validate and canonicalize an AdCP identifier. Opaque identifier families keep
+ * their spelling and case; only surrounding whitespace is removed. No network
+ * lookup or existence/ownership assertion is performed.
+ */
+export declare function normalizePropertyIdentifier(type: PropertyIdentifierTypes | string, value: string): IdentifierValidationResult;
+/** Validation includes the same explicit rewrite report as normalization. */
+export declare const validatePropertyIdentifier: typeof normalizePropertyIdentifier;
+export declare const validateDomainIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateSubdomainIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateIosBundleIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateAndroidPackageIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateAppleAppStoreIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateGooglePlayIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateRokuStoreIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateFireTvAsinIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateSamsungAppIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateAppleTvBundleIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateBundleIdentifier: (value: string) => IdentifierValidationResult;

package/dist/lib/identifiers.d.ts

@@ -0,0 +1,53 @@
+import type { PropertyIdentifierTypes } from './types/core.generated';
+export type IdentifierValidationErrorCode = 'invalid_identifier' | 'unsupported_identifier_type' | 'invalid_publisher_domain';
+export declare class IdentifierValidationError extends TypeError {
+    readonly code: IdentifierValidationErrorCode;
+    readonly identifierType: string;
+    readonly name = "IdentifierValidationError";
+    constructor(code: IdentifierValidationErrorCode, identifierType: string, message: string);
+}
+export interface IdentifierRewrite {
+    from: string;
+    to: string;
+}
+export type IdentifierValidationResult = {
+    ok: true;
+    value: string;
+    rewrite?: IdentifierRewrite;
+} | {
+    ok: false;
+    error: IdentifierValidationError;
+};
+/** Validate a registration hostname as supplied. This deliberately does not repair URLs or wildcards. */
+export declare function validatePublisherDomain(value: string): IdentifierValidationResult;
+export declare const normalizeDomainIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeSubdomainIdentifier: (value: string) => IdentifierValidationResult;
+/** Bundle identifiers are case-sensitive; normalization preserves their case. */
+export declare const normalizeIosBundleIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeAndroidPackageIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeAppleAppStoreIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeGooglePlayIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeRokuStoreIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeFireTvAsinIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeSamsungAppIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeAppleTvBundleIdentifier: (value: string) => IdentifierValidationResult;
+export declare const normalizeBundleIdentifier: (value: string) => IdentifierValidationResult;
+/**
+ * Validate and canonicalize an AdCP identifier. Opaque identifier families keep
+ * their spelling and case; only surrounding whitespace is removed. No network
+ * lookup or existence/ownership assertion is performed.
+ */
+export declare function normalizePropertyIdentifier(type: PropertyIdentifierTypes | string, value: string): IdentifierValidationResult;
+/** Validation includes the same explicit rewrite report as normalization. */
+export declare const validatePropertyIdentifier: typeof normalizePropertyIdentifier;
+export declare const validateDomainIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateSubdomainIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateIosBundleIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateAndroidPackageIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateAppleAppStoreIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateGooglePlayIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateRokuStoreIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateFireTvAsinIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateSamsungAppIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateAppleTvBundleIdentifier: (value: string) => IdentifierValidationResult;
+export declare const validateBundleIdentifier: (value: string) => IdentifierValidationResult;

package/dist/lib/identifiers.js

@@ -0,0 +1,212 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var identifiers_exports = {};
+__export(identifiers_exports, {
+  IdentifierValidationError: () => IdentifierValidationError,
+  normalizeAndroidPackageIdentifier: () => normalizeAndroidPackageIdentifier,
+  normalizeAppleAppStoreIdentifier: () => normalizeAppleAppStoreIdentifier,
+  normalizeAppleTvBundleIdentifier: () => normalizeAppleTvBundleIdentifier,
+  normalizeBundleIdentifier: () => normalizeBundleIdentifier,
+  normalizeDomainIdentifier: () => normalizeDomainIdentifier,
+  normalizeFireTvAsinIdentifier: () => normalizeFireTvAsinIdentifier,
+  normalizeGooglePlayIdentifier: () => normalizeGooglePlayIdentifier,
+  normalizeIosBundleIdentifier: () => normalizeIosBundleIdentifier,
+  normalizePropertyIdentifier: () => normalizePropertyIdentifier,
+  normalizeRokuStoreIdentifier: () => normalizeRokuStoreIdentifier,
+  normalizeSamsungAppIdentifier: () => normalizeSamsungAppIdentifier,
+  normalizeSubdomainIdentifier: () => normalizeSubdomainIdentifier,
+  validateAndroidPackageIdentifier: () => validateAndroidPackageIdentifier,
+  validateAppleAppStoreIdentifier: () => validateAppleAppStoreIdentifier,
+  validateAppleTvBundleIdentifier: () => validateAppleTvBundleIdentifier,
+  validateBundleIdentifier: () => validateBundleIdentifier,
+  validateDomainIdentifier: () => validateDomainIdentifier,
+  validateFireTvAsinIdentifier: () => validateFireTvAsinIdentifier,
+  validateGooglePlayIdentifier: () => validateGooglePlayIdentifier,
+  validateIosBundleIdentifier: () => validateIosBundleIdentifier,
+  validatePropertyIdentifier: () => validatePropertyIdentifier,
+  validatePublisherDomain: () => validatePublisherDomain,
+  validateRokuStoreIdentifier: () => validateRokuStoreIdentifier,
+  validateSamsungAppIdentifier: () => validateSamsungAppIdentifier,
+  validateSubdomainIdentifier: () => validateSubdomainIdentifier
+});
+module.exports = __toCommonJS(identifiers_exports);
+var import_node_net = require("node:net");
+var import_node_url = require("node:url");
+class IdentifierValidationError extends TypeError {
+  constructor(code, identifierType, message) {
+    super(message);
+    this.code = code;
+    this.identifierType = identifierType;
+  }
+  code;
+  identifierType;
+  name = "IdentifierValidationError";
+}
+const PUBLISHER_DOMAIN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/;
+function isDomain(value) {
+  if (value.length > 253 || !PUBLISHER_DOMAIN.test(value) || value.split(".").some((label) => label.length > 63) || (0, import_node_net.isIP)(value))
+    return false;
+  try {
+    return !(0, import_node_net.isIP)(new URL(`https://${value}`).hostname);
+  } catch {
+    return false;
+  }
+}
+function accepted(input, value) {
+  return { ok: true, value, ...input === value ? {} : { rewrite: { from: input, to: value } } };
+}
+function rejected(type, code = "invalid_identifier") {
+  return {
+    ok: false,
+    error: new IdentifierValidationError(
+      code,
+      type,
+      code === "invalid_publisher_domain" ? "publisher_domain must be a canonical lowercase hostname without wildcards, URLs, or IP addresses" : `Invalid ${type} identifier`
+    )
+  };
+}
+function validatePublisherDomain(value) {
+  return typeof value === "string" && isDomain(value) ? accepted(value, value) : rejected("publisher_domain", "invalid_publisher_domain");
+}
+function normalizeHostname(input, type) {
+  if (typeof input !== "string") return rejected(type);
+  let value = input.trim();
+  if (/^https?:\/\//i.test(value)) {
+    try {
+      const url = new URL(value);
+      if (url.username || url.password) return rejected(type);
+      value = url.hostname;
+    } catch {
+      return rejected(type);
+    }
+  }
+  const wildcard = value.startsWith("*.");
+  if (wildcard && type !== "domain") return rejected(type);
+  if (/[\s/\\:@?#%]/.test(wildcard ? value.slice(2) : value)) return rejected(type);
+  const host = (0, import_node_url.domainToASCII)((wildcard ? value.slice(2) : value).toLowerCase().replace(/\.$/, ""));
+  if (!isDomain(host)) return rejected(type);
+  return accepted(input, `${wildcard ? "*." : ""}${host}`);
+}
+const normalizeDomainIdentifier = (value) => normalizeHostname(value, "domain");
+const normalizeSubdomainIdentifier = (value) => normalizeHostname(value, "subdomain");
+function normalizePattern(type, input, pattern, uppercase = false) {
+  if (typeof input !== "string") return rejected(type);
+  const value = uppercase ? input.trim().toUpperCase() : input.trim();
+  return pattern.test(value) ? accepted(input, value) : rejected(type);
+}
+const normalizeIosBundleIdentifier = (value) => normalizePattern("ios_bundle", value, /^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/);
+const normalizeAndroidPackageIdentifier = (value) => normalizePattern("android_package", value, /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)+$/);
+const normalizeAppleAppStoreIdentifier = (value) => normalizePattern("apple_app_store_id", value, /^[1-9][0-9]*$/);
+const normalizeGooglePlayIdentifier = (value) => normalizePattern("google_play_id", value, /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)+$/);
+const normalizeRokuStoreIdentifier = (value) => normalizePattern("roku_store_id", value, /^[1-9][0-9]*$/);
+const normalizeFireTvAsinIdentifier = (value) => normalizePattern("fire_tv_asin", value, /^[A-Z0-9]{10}$/, true);
+const normalizeSamsungAppIdentifier = (value) => normalizePattern("samsung_app_id", value, /^[A-Za-z0-9._-]+$/);
+const normalizeAppleTvBundleIdentifier = (value) => normalizePattern("apple_tv_bundle", value, /^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/);
+const normalizeBundleIdentifier = (value) => normalizePattern("bundle_id", value, /^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)+$/);
+function normalizePropertyIdentifier(type, value) {
+  switch (type) {
+    case "domain":
+      return normalizeDomainIdentifier(value);
+    case "subdomain":
+      return normalizeSubdomainIdentifier(value);
+    case "ios_bundle":
+      return normalizeIosBundleIdentifier(value);
+    case "android_package":
+      return normalizeAndroidPackageIdentifier(value);
+    case "apple_app_store_id":
+      return normalizeAppleAppStoreIdentifier(value);
+    case "google_play_id":
+      return normalizeGooglePlayIdentifier(value);
+    case "roku_store_id":
+      return normalizeRokuStoreIdentifier(value);
+    case "fire_tv_asin":
+      return normalizeFireTvAsinIdentifier(value);
+    case "samsung_app_id":
+      return normalizeSamsungAppIdentifier(value);
+    case "apple_tv_bundle":
+      return normalizeAppleTvBundleIdentifier(value);
+    case "bundle_id":
+      return normalizeBundleIdentifier(value);
+    case "apple_podcast_id":
+      return normalizePattern(type, value, /^[1-9][0-9]*$/);
+    case "rss_url": {
+      if (typeof value !== "string") return rejected(type);
+      try {
+        const url = new URL(value.trim());
+        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || !isDomain(url.hostname))
+          return rejected(type);
+        return accepted(value, url.toString());
+      } catch {
+        return rejected(type);
+      }
+    }
+    case "network_id":
+    case "venue_id":
+    case "screen_id":
+    case "openooh_venue_type":
+    case "spotify_collection_id":
+    case "podcast_guid":
+    case "station_id":
+    case "facility_id":
+      return normalizePattern(type, value, /^[^\x00-\x1f\x7f]+$/);
+    default:
+      return rejected(type, "unsupported_identifier_type");
+  }
+}
+const validatePropertyIdentifier = normalizePropertyIdentifier;
+const validateDomainIdentifier = normalizeDomainIdentifier;
+const validateSubdomainIdentifier = normalizeSubdomainIdentifier;
+const validateIosBundleIdentifier = normalizeIosBundleIdentifier;
+const validateAndroidPackageIdentifier = normalizeAndroidPackageIdentifier;
+const validateAppleAppStoreIdentifier = normalizeAppleAppStoreIdentifier;
+const validateGooglePlayIdentifier = normalizeGooglePlayIdentifier;
+const validateRokuStoreIdentifier = normalizeRokuStoreIdentifier;
+const validateFireTvAsinIdentifier = normalizeFireTvAsinIdentifier;
+const validateSamsungAppIdentifier = normalizeSamsungAppIdentifier;
+const validateAppleTvBundleIdentifier = normalizeAppleTvBundleIdentifier;
+const validateBundleIdentifier = normalizeBundleIdentifier;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  IdentifierValidationError,
+  normalizeAndroidPackageIdentifier,
+  normalizeAppleAppStoreIdentifier,
+  normalizeAppleTvBundleIdentifier,
+  normalizeBundleIdentifier,
+  normalizeDomainIdentifier,
+  normalizeFireTvAsinIdentifier,
+  normalizeGooglePlayIdentifier,
+  normalizeIosBundleIdentifier,
+  normalizePropertyIdentifier,
+  normalizeRokuStoreIdentifier,
+  normalizeSamsungAppIdentifier,
+  normalizeSubdomainIdentifier,
+  validateAndroidPackageIdentifier,
+  validateAppleAppStoreIdentifier,
+  validateAppleTvBundleIdentifier,
+  validateBundleIdentifier,
+  validateDomainIdentifier,
+  validateFireTvAsinIdentifier,
+  validateGooglePlayIdentifier,
+  validateIosBundleIdentifier,
+  validatePropertyIdentifier,
+  validatePublisherDomain,
+  validateRokuStoreIdentifier,
+  validateSamsungAppIdentifier,
+  validateSubdomainIdentifier
+});