@gradial/aci 0.1.52-rc.16 → 0.1.52-rc.21

package/dist/internal/domain/edge/record/codec.d.ts

@@ -10,14 +10,17 @@ interface CompactDispatch {
     ap: string;
 }
 interface CompactCondition {
-    f: string;
-    o: string;
+    f?: string;
+    o?: string;
     w?: unknown;
+    a?: CompactCondition[];
+    n?: CompactCondition[];
 }
 interface CompactRule {
     a?: CompactCondition[];
     n?: CompactCondition[];
 }
+export declare const COMPACT_MAX_DEPTH = 32;
 interface CompactVariant {
     pr?: number;
     r?: CompactRule;

package/dist/internal/domain/edge/record/codec.js

@@ -41,9 +41,13 @@ const DISPATCH_KIND_FROM_COMPACT = {
 };
 const OPERATOR_TO_COMPACT = {
     equals: 'eq', contains: 'ct', startsWith: 'sw', exists: 'ex',
+    greaterThan: 'gt', greaterThanOrEqual: 'ge', lessThan: 'lt', lessThanOrEqual: 'le',
+    before: 'bf', after: 'af', between: 'bt', in: 'in',
 };
 const OPERATOR_FROM_COMPACT = {
     eq: 'equals', ct: 'contains', sw: 'startsWith', ex: 'exists',
+    gt: 'greaterThan', ge: 'greaterThanOrEqual', lt: 'lessThan', le: 'lessThanOrEqual',
+    bf: 'before', af: 'after', bt: 'between', in: 'in',
 };
 const EXPERIMENT_STATUS_TO_COMPACT = {
     running: 'r', paused: 'p', completed: 'd',
@@ -78,20 +82,89 @@ function expandDispatch(raw) {
         return INVALID;
     return { kind, artifactPath };
 }
-function projectCondition(cond) {
-    if (!cond || !cond.field || !cond.operator)
-        return null;
+// Structural recursion guard, deliberately looser than the authored MaxDepth
+// (5) the validators enforce. The codec's job is to bound adversarial
+// recursion in a byte-constrained runtime; the authored contract is
+// validation's. Keeping it looser is what lets an over-depth expression
+// round-trip and be rejected by validation identically in every runtime,
+// rather than being erased by the codec first (ADR 0040).
+export const COMPACT_MAX_DEPTH = 32;
+// A member carrying all/any is an envelope, not a condition — the same
+// presence rule the evaluators apply, so the codec cannot disagree with them
+// about what a member is.
+function isGroupMember(cond) {
+    return !!cond && (cond.all !== undefined || cond.any !== undefined);
+}
+function projectCondition(cond, depth) {
+    // Projection runs at publish time in a trusted context behind write-time
+    // validation: a malformed condition or an operator with no compact token is
+    // vocabulary/codec drift, and silently dropping the condition would ship a
+    // rule missing a leaf — MORE permissive than authored (ADR 0038). The same
+    // reasoning covers a group node: dropping one publishes a rule the author
+    // did not write. Expansion stays fail-closed for already-deployed bundles.
+    if (!cond) {
+        throw new Error('edge rule condition must name a field and operator');
+    }
+    if (isGroupMember(cond)) {
+        if (depth > COMPACT_MAX_DEPTH) {
+            throw new Error('edge rule nests deeper than the codec can project');
+        }
+        if (cond.field !== undefined || cond.operator !== undefined || cond.value !== undefined) {
+            throw new Error('edge rule member mixes group and leaf keys');
+        }
+        const group = {};
+        if (cond.all && cond.all.length > 0)
+            group.a = cond.all.map((member) => projectCondition(member, depth + 1));
+        if (cond.any && cond.any.length > 0)
+            group.n = cond.any.map((member) => projectCondition(member, depth + 1));
+        if (!group.a && !group.n) {
+            throw new Error('edge rule group must include at least one member');
+        }
+        return group;
+    }
+    if (!cond.field || !cond.operator) {
+        throw new Error('edge rule condition must name a field and operator');
+    }
     const compactOp = OPERATOR_TO_COMPACT[cond.operator];
-    if (!compactOp)
-        return null;
+    if (!compactOp) {
+        throw new Error(`edge rule operator has no compact token: ${cond.operator}`);
+    }
     const result = { f: cond.field, o: compactOp };
     if (cond.value !== undefined)
         result.w = cond.value;
     return result;
 }
-function expandCondition(raw) {
+function expandCondition(raw, depth) {
     if (!isObj(raw))
         return INVALID;
+    if (raw.a !== undefined || raw.n !== undefined) {
+        if (depth > COMPACT_MAX_DEPTH)
+            return INVALID;
+        // A member cannot be both: expanding a mixed record would hand the
+        // evaluator something neither a group nor a condition.
+        if (raw.f !== undefined || raw.o !== undefined || raw.w !== undefined)
+            return INVALID;
+        const group = {};
+        for (const [compact, key] of [['a', 'all'], ['n', 'any']]) {
+            if (raw[compact] === undefined)
+                continue;
+            if (!Array.isArray(raw[compact]))
+                return INVALID;
+            const members = [];
+            for (const member of raw[compact]) {
+                const expanded = expandCondition(member, depth + 1);
+                if (expanded === INVALID)
+                    return INVALID;
+                members.push(expanded);
+            }
+            group[key] = members;
+        }
+        // Length, not truthiness: [] is truthy, so a group whose only list is
+        // empty would otherwise expand into a member with no predicate at all.
+        if ((group.all?.length || 0) + (group.any?.length || 0) === 0)
+            return INVALID;
+        return group;
+    }
     const f = raw.f;
     const co = raw.o;
     if (typeof f !== 'string')
@@ -109,9 +182,9 @@ function projectRule(rule) {
         return undefined;
     const result = {};
     if (rule.all && rule.all.length > 0)
-        result.a = rule.all.map(projectCondition).filter((c) => c !== null);
+        result.a = rule.all.map((cond) => projectCondition(cond, 1));
     if (rule.any && rule.any.length > 0)
-        result.n = rule.any.map(projectCondition).filter((c) => c !== null);
+        result.n = rule.any.map((cond) => projectCondition(cond, 1));
     if (!result.a && !result.n)
         return undefined;
     return result;
@@ -124,7 +197,7 @@ function expandRule(raw) {
     const rule = {};
     if (Array.isArray(raw.a))
         for (const c of raw.a) {
-            const r = expandCondition(c);
+            const r = expandCondition(c, 1);
             if (r === INVALID)
                 return INVALID;
             if (r)
@@ -132,7 +205,7 @@ function expandRule(raw) {
         }
     if (Array.isArray(raw.n))
         for (const c of raw.n) {
-            const r = expandCondition(c);
+            const r = expandCondition(c, 1);
             if (r === INVALID)
                 return INVALID;
             if (r)

package/dist/internal/domain/edge/resolve.js

@@ -49,7 +49,7 @@ export async function resolvePersonalizationRequest(request, config) {
             : consent.allowsIdentityTier
                 ? await verifyClaims(signedClaims, config.claimsKeys || {}, now)
                 : null;
-        const decision = resolvePersonalizationDecision(toPersonalizationRequestContext(request), matchedRoute, claims, config.experiments, identityHash
+        const decision = resolvePersonalizationDecision(toPersonalizationRequestContext(request, now, config.onRuleRejected), matchedRoute, claims, config.experiments, identityHash
             ? { usable: true, siteId: config.siteId, namespace: 'aci_id', identityHash }
             : undefined);
         if (decision.variant) {
@@ -62,7 +62,13 @@ export async function resolvePersonalizationRequest(request, config) {
     }
     return { variantKey };
 }
-function toPersonalizationRequestContext(request) {
+// The return type is annotated rather than inferred so the contract is stated
+// at the construction site: a misspelled property would then silently never
+// fire at the sink, which is the exact failure mode this context exists to
+// make visible. No tsconfig covers internal/domain/** today (esbuild/tsx strip
+// types without checking), so the annotation is documentation now and becomes
+// real protection under any future typecheck of these trees.
+function toPersonalizationRequestContext(request, now, onRuleRejected) {
     const url = new URL(request.url);
     const cookies = parseCookieHeader(request.headers.get('cookie'));
     const query = {};
@@ -80,6 +86,11 @@ function toPersonalizationRequestContext(request) {
         query,
         headers,
         cookies: Object.fromEntries(cookies.entries()),
+        // The host's pinned per-request clock resolves the time.now fact
+        // (ADR 0038), so claims verification and window evaluation read one
+        // instant — and config.now-injected tests are deterministic.
+        now: now.getTime(),
         ...(Object.keys(geo).length > 0 ? { signals: { geo } } : {}),
+        ...(onRuleRejected ? { onRuleRejected } : {}),
     };
 }

package/dist/internal/domain/edge/testdata/flat_only_validator_v1.d.ts

@@ -0,0 +1,10 @@
+export interface FrozenExpressionDiagnostic {
+    code: string;
+    path: string;
+    scope: 'request';
+    message: string;
+}
+export declare function frozenValidateRequestExpression(rule: {
+    all?: unknown[];
+    any?: unknown[];
+}): FrozenExpressionDiagnostic[];

package/dist/internal/domain/edge/testdata/flat_only_validator_v1.js

@@ -0,0 +1,253 @@
+// FROZEN FIXTURE — the request-expression validation path as it stood before
+// ADR 0040 added nested boolean expression trees, vendored from
+// `internal/domain/edge/personalization-core.ts` at commit 1b785e4ac^ (the
+// parent of the ADR 0040 landing commit). Do NOT update this file to track the
+// live validator: its whole value is that it is stale.
+//
+// It exists so one test can reproduce the incident ADR 0040 predicts and says
+// it could not previously debug — a lane running a flat-only evaluator meeting
+// a record carrying a valid nested rule. That evaluator has no concept of a
+// group node, so it classifies `{all:[...]}` as a leaf condition and reports
+// the leaf vocabulary as unsupported. The resulting diagnostics are what the
+// host recorder actually writes during real version skew, and they are NOT the
+// same as those produced by a current, nesting-aware validator refusing a
+// malformed rule.
+//
+// What is vendored: the COMPLETE validation path — `validateRequestExpression`
+// and `validateRequestCondition` with every branch (per-field operator
+// restrictions for device.class / time.now / audience.memberships, and every
+// value check), plus each helper those functions reach
+// (`expressionNumberInDomain`, `parseExpressionTimestamp`,
+// `expressionDaysInMonth`, `canonicalScalar`, `validExpressionRange`,
+// `homogeneousExpressionMembers`, and the DEVICE_CLASSES / MAX_IN_VALUES /
+// grammar constants). Evaluation, matching, and the fact vocabulary are
+// irrelevant to the record's shape and are deliberately absent.
+//
+// Adaptations from the source commit (everything not listed here is verbatim):
+//  1. Entry-point signature. The original `validateRequestExpression` was
+//     3-argument — its callers pre-extracted `all`/`any` with `rule.all || []`.
+//     The frozen export is 1-argument and derives them itself with
+//     `Array.isArray` guards (strictly stronger than the original `|| []`) so
+//     the fixture is safe to call directly on untrusted record data.
+//  2. The diagnostic type is renamed `FrozenExpressionDiagnostic` (from
+//     `ExpressionDiagnostic`) so a frozen diagnostic can never be confused
+//     with a live one at a call site.
+//  3. Export keywords were removed from the vendored internals; only the
+//     entry point and its diagnostic type are exported.
+const MAX_EXPRESSION_CONDITIONS = 64;
+const EXPRESSION_OPERATORS = [
+    'equals', 'contains', 'startsWith', 'exists',
+    'greaterThan', 'greaterThanOrEqual', 'lessThan', 'lessThanOrEqual',
+    'before', 'after', 'between', 'in',
+];
+const MAX_IN_VALUES = 32;
+// Observed values are gated on the published grammars before any host parser
+// runs (ADR 0038): Number() and Date.parse accept supersets (hex, empty
+// string, vendor date formats) that would let the same fact match here and
+// not in Go. Keep these literals identical to the capability artifact — the
+// drift test compares them byte-for-byte.
+const EXPRESSION_NUMBER_GRAMMAR = /^-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?$/;
+const EXPRESSION_TIMESTAMP_GRAMMAR = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(\.\d{1,9})?(Z|[+-]\d{2}:\d{2})$/;
+const DEVICE_CLASSES = ['desktop', 'mobile', 'tablet', 'unknown'];
+// Adaptation 1 (see header): the original was 3-argument with caller-extracted
+// `all`/`any`; this 1-argument form derives them with Array.isArray guards.
+// The body below this line is verbatim from the source commit.
+export function frozenValidateRequestExpression(rule) {
+    const all = (Array.isArray(rule.all) ? rule.all : []);
+    const any = (Array.isArray(rule.any) ? rule.any : []);
+    const diagnostics = [];
+    if (all.length + any.length === 0)
+        diagnostics.push({ code: 'expression.empty', path: 'expression', scope: 'request', message: 'expression must include at least one all or any condition' });
+    if (all.length + any.length > MAX_EXPRESSION_CONDITIONS)
+        diagnostics.push({ code: 'expression.conditions.too_many', path: 'expression', scope: 'request', message: `expression must contain at most ${MAX_EXPRESSION_CONDITIONS} conditions` });
+    Object.keys(rule).filter((group) => group !== 'all' && group !== 'any').sort().forEach((group) => {
+        diagnostics.push({ code: 'expression.group.unsupported', path: `expression.${group}`, scope: 'request', message: `expression.${group} is not a supported expression group` });
+    });
+    for (const [group, conditions] of [['all', all], ['any', any]]) {
+        conditions.forEach((condition, index) => frozenValidateRequestCondition(condition, `expression.${group}[${index}]`, diagnostics));
+    }
+    return diagnostics;
+}
+// Verbatim from the source commit: the full flat-era condition validator,
+// including the per-field operator restrictions and every value check.
+function frozenValidateRequestCondition(condition, path, diagnostics) {
+    Object.keys(condition).filter((property) => !['field', 'operator', 'value'].includes(property)).sort().forEach((property) => {
+        diagnostics.push({ code: 'expression.property.unsupported', path: `${path}.${property}`, scope: 'request', message: `${path}.${property} is not a supported condition property` });
+    });
+    const field = String(condition.field || '');
+    if (field !== 'referrer' && field !== 'device.class' && field !== 'time.now' && field !== 'audience.memberships' && !['query.', 'header.', 'cookie.', 'geo.', 'utm.'].some((prefix) => field.startsWith(prefix) && field.length > prefix.length)) {
+        diagnostics.push({ code: 'expression.field.unsupported', path: `${path}.field`, scope: 'request', message: `${path}.field ${JSON.stringify(field)} is not supported` });
+    }
+    const operator = String(condition.operator || '');
+    if (!EXPRESSION_OPERATORS.includes(operator)) {
+        diagnostics.push({ code: 'expression.operator.unsupported', path: `${path}.operator`, scope: 'request', message: `${path}.operator ${JSON.stringify(operator)} is not supported` });
+        return;
+    }
+    // device.class compares against a closed four-value set, so substring
+    // operators express nothing the set cannot — and admitting them would
+    // re-create the user-agent-substring habit inside the safe field (ADR 0037).
+    if (field === 'device.class' && !['equals', 'in', 'exists'].includes(operator)) {
+        diagnostics.push({ code: 'expression.operator.unsupported', path: `${path}.operator`, scope: 'request', message: `${path}.operator ${JSON.stringify(operator)} is not supported for field ${JSON.stringify(field)}, which compares against a closed value set` });
+        return;
+    }
+    // time.now is a sub-second-churning clock: string operators are silently
+    // inert on it and the numeric family can never match an RFC 3339 string
+    // (ADR 0038).
+    if (field === 'time.now' && !['before', 'after', 'between', 'exists'].includes(operator)) {
+        diagnostics.push({ code: 'expression.operator.unsupported', path: `${path}.operator`, scope: 'request', message: `${path}.operator ${JSON.stringify(operator)} is not supported for field ${JSON.stringify(field)}, which supports only before, after, between, exists` });
+        return;
+    }
+    // audience.memberships is an opaque-ID list: equals is already
+    // any-member-equals under the multi-valued match loop, so the substring
+    // family would only add silent overmatching of prefixed IDs, and the
+    // numeric/instant families can never match an ID (ADR 0039).
+    if (field === 'audience.memberships' && !['equals', 'in', 'exists'].includes(operator)) {
+        diagnostics.push({ code: 'expression.operator.unsupported', path: `${path}.operator`, scope: 'request', message: `${path}.operator ${JSON.stringify(operator)} is not supported for field ${JSON.stringify(field)}, which supports only equals, in, exists` });
+        return;
+    }
+    const value = condition.value;
+    if (operator === 'exists') {
+        if (value !== undefined && value !== null && typeof value !== 'boolean') {
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be a boolean for operator exists` });
+        }
+        return;
+    }
+    if (value === undefined || value === null) {
+        diagnostics.push({ code: 'expression.value.required', path: `${path}.value`, scope: 'request', message: `${path}.value is required for operator ${operator}` });
+        return;
+    }
+    if (['equals', 'contains', 'startsWith'].includes(operator)) {
+        if (!['string', 'number', 'boolean'].includes(typeof value)
+            || (typeof value === 'number' && !expressionNumberInDomain(value))) {
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be a string, boolean, or finite number using only safe integers` });
+        }
+        else if (field === 'device.class' && DEVICE_CLASSES.indexOf(canonicalScalar(value)) < 0) {
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be one of ${DEVICE_CLASSES.join(', ')} for field ${JSON.stringify(field)}` });
+        }
+        return;
+    }
+    if (['greaterThan', 'greaterThanOrEqual', 'lessThan', 'lessThanOrEqual'].includes(operator)) {
+        if (typeof value !== 'number' || !expressionNumberInDomain(value)) {
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be a finite JSON number using only safe integers for operator ${operator}` });
+        }
+        return;
+    }
+    if (operator === 'before' || operator === 'after') {
+        if (typeof value !== 'string' || parseExpressionTimestamp(value) === null) {
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be an RFC 3339 timestamp with an explicit UTC offset for operator ${operator}` });
+        }
+        return;
+    }
+    if (operator === 'between') {
+        if (!validExpressionRange(value)) {
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be a min/max object whose bounds are both numbers or both timestamps with min not above max` });
+        }
+        else if (field === 'time.now' && typeof value.min === 'number') {
+            // An instant field's observed values are instants: a numeric range on
+            // it would validate and then sit silently inert at execution.
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value bounds must be timestamps for field ${JSON.stringify(field)}` });
+        }
+        return;
+    }
+    // in: bounded, non-empty, every member one canonicalizable scalar, all
+    // members one JSON type — a mixed list is almost always an authoring bug.
+    const members = homogeneousExpressionMembers(value);
+    if (members === null) {
+        diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be an array of 1 to ${MAX_IN_VALUES} scalars sharing one type` });
+        return;
+    }
+    if (field === 'device.class') {
+        for (const member of members) {
+            if (DEVICE_CLASSES.indexOf(member) < 0) {
+                diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be one of ${DEVICE_CLASSES.join(', ')} for field ${JSON.stringify(field)}` });
+                return;
+            }
+        }
+    }
+}
+// ── Validation helpers, verbatim from the source commit ──────────────────
+function expressionNumberInDomain(value) {
+    if (!Number.isFinite(value))
+        return false;
+    if (Number.isInteger(value) && !Number.isSafeInteger(value))
+        return false;
+    return true;
+}
+// Explicit calendar validation runs before Date arithmetic because Date.UTC
+// (like Go's time.Date) silently normalizes impossible dates. Instants
+// compare as epoch milliseconds; fractional seconds truncate to milliseconds.
+function parseExpressionTimestamp(value) {
+    const match = EXPRESSION_TIMESTAMP_GRAMMAR.exec(value);
+    if (!match)
+        return null;
+    const year = Number(match[1]), month = Number(match[2]), day = Number(match[3]);
+    const hour = Number(match[4]), minute = Number(match[5]), second = Number(match[6]);
+    if (month < 1 || month > 12 || day < 1 || day > expressionDaysInMonth(year, month))
+        return null;
+    if (hour > 23 || minute > 59 || second > 59)
+        return null;
+    let offsetMinutes = 0;
+    if (match[8] !== 'Z') {
+        const offsetHour = Number(match[8].slice(1, 3)), offsetMinute = Number(match[8].slice(4, 6));
+        if (offsetHour > 23 || offsetMinute > 59)
+            return null;
+        offsetMinutes = offsetHour * 60 + offsetMinute;
+        if (match[8][0] === '-')
+            offsetMinutes = -offsetMinutes;
+    }
+    const fractionMillis = match[7] ? Number((match[7].slice(1) + '00').slice(0, 3)) : 0;
+    // setUTCFullYear, not Date.UTC: Date.UTC maps two-digit years to 1900+.
+    const date = new Date(0);
+    date.setUTCFullYear(year, month - 1, day);
+    date.setUTCHours(hour, minute, second, 0);
+    return date.getTime() - offsetMinutes * 60000 + fractionMillis;
+}
+function expressionDaysInMonth(year, month) {
+    if (month === 4 || month === 6 || month === 9 || month === 11)
+        return 30;
+    if (month === 2)
+        return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0) ? 29 : 28;
+    return 31;
+}
+function canonicalScalar(value) {
+    if (typeof value === 'number')
+        return Object.is(value, -0) ? '0' : JSON.stringify(value);
+    return String(value);
+}
+function validExpressionRange(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const record = value;
+    if (Object.keys(record).some((key) => key !== 'min' && key !== 'max'))
+        return false;
+    const min = record.min, max = record.max;
+    if (min === undefined || min === null || max === undefined || max === null)
+        return false;
+    if (typeof min === 'number' && expressionNumberInDomain(min)) {
+        return typeof max === 'number' && expressionNumberInDomain(max) && min <= max;
+    }
+    const minMillis = typeof min === 'string' ? parseExpressionTimestamp(min) : null;
+    if (minMillis === null)
+        return false;
+    const maxMillis = typeof max === 'string' ? parseExpressionTimestamp(max) : null;
+    return maxMillis !== null && minMillis <= maxMillis;
+}
+function homogeneousExpressionMembers(value) {
+    if (!Array.isArray(value) || value.length === 0 || value.length > MAX_IN_VALUES)
+        return null;
+    let memberKind = '';
+    const members = [];
+    for (const member of value) {
+        const kind = typeof member;
+        if (kind !== 'string' && kind !== 'number' && kind !== 'boolean')
+            return null;
+        if (kind === 'number' && !expressionNumberInDomain(member))
+            return null;
+        if (!memberKind)
+            memberKind = kind;
+        else if (memberKind !== kind)
+            return null;
+        members.push(canonicalScalar(member));
+    }
+    return members;
+}

package/dist/internal/domain/edge/types.d.ts

@@ -4,10 +4,17 @@ export interface EdgeDispatch {
     /** Release-relative immutable HTML artifact selected for this route. */
     artifactPath: string;
 }
+/**
+ * One member of an expression group: a leaf condition, or a nested envelope
+ * when it carries `all`/`any` (ADR 0040). Presence of a group key decides
+ * which it is, so flat records stay a byte-identical subset.
+ */
 export interface EdgeRuleCondition {
-    field: string;
-    operator: 'exists' | 'equals' | 'contains' | 'startsWith' | string;
+    field?: string;
+    operator?: 'exists' | 'equals' | 'contains' | 'startsWith' | 'greaterThan' | 'greaterThanOrEqual' | 'lessThan' | 'lessThanOrEqual' | 'before' | 'after' | 'between' | 'in' | string;
     value?: unknown;
+    all?: EdgeRuleCondition[];
+    any?: EdgeRuleCondition[];
 }
 export interface EdgeRuleExpression {
     all?: EdgeRuleCondition[];
@@ -48,9 +55,28 @@ export interface PersonalizationRequestContext {
     signals?: {
         geo?: Record<string, string>;
     };
+    /**
+     * Epoch milliseconds resolving the time.now clock fact (ADR 0038).
+     * Defaults to Date.now(); hosts may pin it once per request so every
+     * expression in one evaluation reads the same instant.
+     */
+    now?: number;
     identityHash?: string;
     identityNamespace?: string;
     siteId?: string;
+    /**
+     * Called when a variant's rule fails validation during serving (ADR 0040).
+     * Records pass the write-time gate before shipping, so this only fires on
+     * version skew or a projection bug — a precise signal that must not vanish.
+     * Receives routing facts and diagnostic codes only, never request data.
+     */
+    onRuleRejected?: (event: RuleRejectionEvent) => void;
+}
+export interface RuleRejectionEvent {
+    variantKey: string;
+    diagnosticCode: string;
+    diagnosticPath: string;
+    diagnosticCount: number;
 }
 export interface PersonalizationClaims {
     aud?: string[];
@@ -58,13 +84,7 @@ export interface PersonalizationClaims {
     iat: number;
     exp: number;
 }
-export interface PersonalizationVariant {
-    variantKey: string;
-    variantValues?: Record<string, string>;
-    priority?: number;
-    rule?: EdgeRuleExpression;
-    dispatch: EdgeDispatch;
-}
+export type PersonalizationVariant = EdgeRouteVariant;
 export interface PersonalizationRoute {
     variants?: Record<string, PersonalizationVariant>;
 }
@@ -174,6 +194,13 @@ export interface PersonalizationHostConfig {
         aud?: string[];
         seg?: string[];
     };
+    /**
+     * Passed straight through to the request context's rejection sink so a host
+     * can record a variant skipped for a rule it could not validate (ADR 0040).
+     * Unset means the skip stays silent, which is what made the skew incident
+     * the ADR predicts undebuggable.
+     */
+    onRuleRejected?: (event: RuleRejectionEvent) => void;
 }
 export interface PersonalizationResolution {
     variantKey: string;

package/dist/internal/domain/edge/types.js

@@ -1,7 +1,7 @@
 // Shared edge-decisioning types.
 //
 // These types are the canonical shape for the edge decisioning algorithm.
-// All host adapters (AWS, Cloudflare, Vercel, emulator) import from here.
-// The SDK's personalization-core types mirror these — the two are kept in
-// sync by cross-language round-trip tests (spec edge-decisioning R-conformance).
+// All host adapters (AWS, Cloudflare, Vercel, emulator) import from here,
+// and the SDK build compiles this module into its dist/internal tree — there
+// is no SDK-side mirror (ADR 0041 retired the hand-ported copy).
 export { IdentityErasureFencedError } from '../../platform/collectionstore/errors.js';

package/dist/mimic/core.d.ts

@@ -1,34 +1,2 @@
-export interface MimicClaims {
-    scope: string;
-    siteId: string;
-    aud?: string[];
-    seg?: string[];
-    sub?: string;
-    jti?: string;
-    iat: string;
-    expiresAt: string;
-}
-export declare const MIMIC_PARAM = "aci_mimic";
-export declare const MIMIC_COOKIE = "aci_mimic";
-export declare const MIMIC_EXIT = "exit";
-export declare const MIMIC_MAX_MEMBERSHIPS = 32;
-export declare const MIMIC_MAX_TOKEN_BYTES = 2048;
-export declare function validateMimicToken(token: string, signKey: string, siteId: string): Promise<MimicClaims | null>;
-export interface MimicCookie {
-    name: string;
-    value: string;
-    options: {
-        httpOnly: boolean;
-        sameSite: 'lax';
-        maxAge: number;
-        path: string;
-        secure?: boolean;
-    };
-}
-export declare function createMimicEntryCookie(token: string, expiresAt: string, secure?: boolean): MimicCookie;
-export declare function createMimicClearCookie(secure?: boolean): MimicCookie;
-export declare function createMimicBannerHTML(claims: Pick<MimicClaims, 'aud' | 'seg'>, expiresAt: string): string;
-export declare function injectMimicBannerIntoHTML(html: string, banner: string): string;
 export declare const MIMIC_BANNER_HEADER = "x-aci-mimic-banner";
-export declare function encodeMimicBanner(claims: MimicClaims): string;
 export declare function decodeMimicBanner(encoded: string): string;