@gradial/aci 0.1.52-rc.9 → 0.1.52

package/dist/internal/domain/edge/personalization_index.d.ts

@@ -0,0 +1,17 @@
+import type { PersonalizationExperiment, PersonalizationRoute, PersonalizationVariant } from './types.js';
+export interface AuthoredCandidate {
+    readonly key: string;
+    readonly variant: PersonalizationVariant;
+    readonly values: Record<string, string>;
+    readonly experiments: readonly PersonalizationExperiment[];
+}
+export interface PersonalizationSelection {
+    readonly sourceExperiments: Record<string, PersonalizationExperiment> | undefined;
+    readonly authored: readonly AuthoredCandidate[];
+    readonly experiments: readonly PersonalizationExperiment[];
+    readonly arms: Readonly<Record<string, Readonly<Record<string, PersonalizationVariant>>>>;
+    readonly tuples: Readonly<Record<string, PersonalizationVariant>>;
+    readonly legacyExperimentExclusions: number;
+}
+export declare function preparePersonalizationRoute(route: PersonalizationRoute, experiments?: Record<string, PersonalizationExperiment>): PersonalizationRoute;
+export declare function personalizationSelection(route: PersonalizationRoute, experiments?: Record<string, PersonalizationExperiment>): PersonalizationSelection;

package/dist/internal/domain/edge/personalization_index.js

@@ -0,0 +1,55 @@
+import { compareUTF8, variantValuesFromKey } from './variant_key.js';
+const preparedSelection = Symbol('prepared personalization selection');
+// Call once when an immutable partition is decoded. The derived index is a
+// non-enumerable symbol property, so it cannot alter any serialized record.
+export function preparePersonalizationRoute(route, experiments) {
+    const existing = route[preparedSelection];
+    if (existing && existing.sourceExperiments === experiments)
+        return route;
+    return Object.freeze(Object.defineProperty({ ...route }, preparedSelection, { value: deriveSelection(route, experiments) }));
+}
+export function personalizationSelection(route, experiments) {
+    return preparePersonalizationRoute(route, experiments)[preparedSelection];
+}
+function deriveSelection(route, experiments) {
+    const authored = [];
+    const arms = Object.create(null);
+    const legacy = new Set();
+    const qualified = new Set();
+    for (const [key, variant] of Object.entries(route.variants || {})) {
+        const values = Object.freeze({ ...(variant.variantValues || variantValuesFromKey(key)) });
+        // DEBT(edge-functions): ADR-0045 bounded pair reader and counter. Remove
+        // only when every retained release in every tenant compiles under the
+        // post-removal compiler; pair entries then become malformed.
+        if (isPairVariant(key, values)) {
+            const id = values.experiment || key.split(';').find((part) => part.startsWith('experiment='))?.slice('experiment='.length);
+            if (id && experiments?.[id])
+                legacy.add(id);
+            continue;
+        }
+        const names = Object.keys(values);
+        const ids = names.filter((name) => name.startsWith('experiment.')).map((name) => name.slice('experiment.'.length));
+        for (const id of ids)
+            qualified.add(id);
+        if (ids.length === 1 && names.length === 1) {
+            const id = ids[0];
+            (arms[id] ||= Object.create(null))[values[`experiment.${id}`]] = variant;
+        }
+        const factors = ids.map((id) => experiments?.[id]);
+        if (factors.some((item) => !item || item.kind !== 'xt' || item.status !== 'running'))
+            continue;
+        authored.push(Object.freeze({ key, variant, values, experiments: Object.freeze(factors) }));
+    }
+    for (const id of qualified)
+        legacy.delete(id);
+    authored.sort((left, right) => (right.variant.priority || 0) - (left.variant.priority || 0) || compareUTF8(left.key, right.key));
+    const scoped = Object.keys(experiments || {}).sort(compareUTF8).map((id) => experiments[id])
+        .filter((item) => (item.kind === 'ab' || item.kind === 'abn') && item.status === 'running' && !legacy.has(item.id));
+    for (const entries of Object.values(arms))
+        Object.freeze(entries);
+    return Object.freeze({ sourceExperiments: experiments, authored: Object.freeze(authored), experiments: Object.freeze(scoped), arms: Object.freeze(arms), tuples: route.variants || {}, legacyExperimentExclusions: legacy.size });
+}
+function isPairVariant(key, values) {
+    const names = [...key.split(';').map((part) => part.split('=')[0]), ...Object.keys(values)];
+    return names.some((name) => name.toLowerCase() === 'experiment' || name.toLowerCase() === 'experimentarm');
+}

package/dist/internal/domain/edge/resolve.js

@@ -1,58 +1,91 @@
 // resolvePersonalizationRequest — the edge decisioning entry point.
 //
-// Reads cookies for classification but never writes them (R25: consent-gated
-// identity model). Identity minting happens in the collect/consent endpoint,
-// not here. Public personalized responses may be private while providers cache
-// the selected immutable artifact by release and exact artifact path.
+// Reads cookies for classification but never writes them. It may issue a
+// first-party identity in memory when the host permits (ADR 0048); persisting
+// that identity is the host's job. Public personalized responses may be
+// private while providers cache the selected immutable artifact by release and
+// exact artifact path.
 import { resolvePersonalizationDecision, } from './personalization-core.js';
-import { consentSignals, verifyIdentityCookie, identityHashHex, verifyClaims, parseCookieHeader, } from './identity.js';
+import { consentSignals, verifyIdentityCookie, identityHashHex, randomIdentity, verifyClaims, parseCookieHeader, } from './identity.js';
 export async function resolvePersonalizationRequest(request, config) {
     const cookies = parseCookieHeader(request.headers.get('cookie'));
     const consent = consentSignals(request, cookies);
     const now = (config.now ?? (() => new Date()))();
-    // Consent-gated identity model (R25): static artifact selection NEVER mints
-    // identity. It reads cookies for classification but never writes them.
-    // Identity (aci_id) is minted by the collect/consent endpoint after
-    // explicit consent. This keeps all content responses cacheable and is
-    // GDPR-compliant (no non-essential cookie before consent).
+    // Identity model (ADR 0016 as amended by ADR 0048): experiment bucketing is
+    // measurement, keyed by the first-party aci_id. A verified cookie (or the
+    // provider bootstrap's identity) is used as presented. With none usable, and
+    // only when the host's issuance rule permits it for this request, resolve
+    // issues a fresh identity so the request that issues it is also bucketed —
+    // an unverifiable cookie is replaced the same way. Persisting the issued
+    // identity is the host's decision (page responses only, never shared-cached).
+    // Claims and memberships stay gated on the personalization grant.
     //
-    // GPC/DNT deny fully: no read, no identity, no experiment bucketing.
-    const rawIdentity = consent.privacyDenied
+    // GPC/DNT deny fully: no read, no identity, no issuance, no bucketing.
+    //
+    // Mimic (specs/features/audience-mimic): a validated mimicClaims input
+    // bypasses identity resolution entirely — the session reads no aci_id and
+    // no aci_claims (D-2/D-7), so identityHash stays empty and the experiment
+    // tier is structurally skipped (D-5). An ARMS-bearing token is the D-17
+    // exception: the experiment tier runs in forced mode — the token's named
+    // arm replaces the dice for each experiment the request selects through
+    // the ordinary gate — and identity still never exists (I-17).
+    const mimic = config.mimicClaims;
+    const verifiedVisitor = mimic || consent.privacyDenied ? undefined : config.verifiedVisitor;
+    const presentedIdentity = mimic || consent.privacyDenied
         ? null
-        : await verifyIdentityCookie(cookies.get('aci_id') || '', config.identityKeys);
+        : verifiedVisitor
+            ? verifiedVisitor.rawIdentity
+            : await verifyIdentityCookie(cookies.get('aci_id') || '', config.identityKeys);
+    const issuedIdentity = !presentedIdentity && !mimic && !consent.privacyDenied && config.issueIdentity
+        ? randomIdentity(config.randomBytes)
+        : undefined;
+    const rawIdentity = presentedIdentity || issuedIdentity || null;
     // The identity hash feeds experiment bucketing for identified visitors.
-    // Claims are a signed cookie written by /collect; the EdgeRouter
-    // never reads the customer object store to refresh or revoke them.
-    let signedClaims = cookies.get('aci_claims') || '';
+    // Claims are a signed cookie written by /collect or the provider identity
+    // bootstrap; the EdgeRouter never reads the customer object store to
+    // refresh or revoke them.
     let identityHash = '';
     if (rawIdentity) {
         identityHash = await identityHashHex('aci_id', rawIdentity);
     }
-    if (rawIdentity && consent.allowsIdentityTier && signedClaims) {
-        if (!await verifyClaims(signedClaims, config.claimsKeys || {}, now)) {
-            signedClaims = '';
-        }
-    }
     const matchedRoute = config.route;
     let variantKey = '';
     if (matchedRoute) {
-        const claims = consent.allowsIdentityTier
-            ? await verifyClaims(signedClaims, config.claimsKeys || {}, now)
-            : null;
-        const decision = resolvePersonalizationDecision(toPersonalizationRequestContext(request), matchedRoute, claims, config.experiments, identityHash
+        const claims = mimic
+            ? { aud: mimic.aud, seg: mimic.seg, iat: 0, exp: 0 }
+            : consent.allowsIdentityTier
+                ? verifiedVisitor
+                    ? verifiedVisitor.claims
+                    : await verifyClaims(cookies.get('aci_claims') || '', config.claimsKeys || {}, now)
+                : null;
+        const decision = resolvePersonalizationDecision(toPersonalizationRequestContext(request, now, config.requestGeo, config.onRuleRejected), matchedRoute, claims, config.experiments, identityHash
             ? { usable: true, siteId: config.siteId, namespace: 'aci_id', identityHash }
-            : undefined);
+            : undefined, mimic?.arms);
         if (decision.variant) {
             variantKey = decision.variant.variantKey;
         }
-        const experiment = decision.experiment
-            ? { id: decision.experiment.experimentId, arm: decision.experiment.armId, allocationVersion: decision.experiment.allocationVersion }
-            : undefined;
-        return { variantKey, experiment };
+        const experiments = decision.experiments.map((item) => ({
+            id: item.experimentId,
+            arm: item.armId,
+            allocationVersion: item.allocationVersion,
+            ...(item.forced ? { forced: true } : {}),
+        }));
+        return {
+            variantKey,
+            experiments,
+            ...(decision.legacyExperimentExclusions ? { legacyExperimentExclusions: decision.legacyExperimentExclusions } : {}),
+            ...(issuedIdentity ? { issuedIdentity } : {}),
+        };
     }
-    return { variantKey };
+    return { variantKey, experiments: [], ...(issuedIdentity ? { issuedIdentity } : {}) };
 }
-function toPersonalizationRequestContext(request) {
+// The return type is annotated rather than inferred so the contract is stated
+// at the construction site: a misspelled property would then silently never
+// fire at the sink, which is the exact failure mode this context exists to
+// make visible. No tsconfig covers internal/domain/** today (esbuild/tsx strip
+// types without checking), so the annotation is documentation now and becomes
+// real protection under any future typecheck of these trees.
+function toPersonalizationRequestContext(request, now, requestGeo, onRuleRejected) {
     const url = new URL(request.url);
     const cookies = parseCookieHeader(request.headers.get('cookie'));
     const query = {};
@@ -60,17 +93,21 @@ function toPersonalizationRequestContext(request) {
         (query[key] ||= []).push(value);
     });
     const headers = Object.fromEntries(request.headers.entries());
+    // geo.* facts come only from the host's trusted geo. Reading provider geo
+    // headers here trusted whatever the viewer sent on every lane whose
+    // provider does not stamp that exact header before the decision runs.
+    const geo = Object.fromEntries(Object.entries(requestGeo ?? {})
+        .filter((entry) => typeof entry[1] === 'string' && entry[1] !== ''));
     return {
         path: url.pathname,
         query,
         headers,
         cookies: Object.fromEntries(cookies.entries()),
-        signals: {
-            geo: {
-                country: headers['x-vercel-ip-country'] || headers['cloudfront-viewer-country'] || '',
-                region: headers['x-vercel-ip-country-region'] || headers['cloudfront-viewer-country-region'] || '',
-                city: headers['x-vercel-ip-city'] || headers['cloudfront-viewer-city'] || '',
-            },
-        },
+        // The host's pinned per-request clock resolves the time.now fact
+        // (ADR 0038), so claims verification and window evaluation read one
+        // instant — and config.now-injected tests are deterministic.
+        now: now.getTime(),
+        ...(Object.keys(geo).length > 0 ? { signals: { geo } } : {}),
+        ...(onRuleRejected ? { onRuleRejected } : {}),
     };
 }

package/dist/internal/domain/edge/testdata/flat_only_validator_v1.d.ts

@@ -0,0 +1,10 @@
+export interface FrozenExpressionDiagnostic {
+    code: string;
+    path: string;
+    scope: 'request';
+    message: string;
+}
+export declare function frozenValidateRequestExpression(rule: {
+    all?: unknown[];
+    any?: unknown[];
+}): FrozenExpressionDiagnostic[];

package/dist/internal/domain/edge/testdata/flat_only_validator_v1.js

@@ -0,0 +1,253 @@
+// FROZEN FIXTURE — the request-expression validation path as it stood before
+// ADR 0040 added nested boolean expression trees, vendored from
+// `internal/domain/edge/personalization-core.ts` at commit 1b785e4ac^ (the
+// parent of the ADR 0040 landing commit). Do NOT update this file to track the
+// live validator: its whole value is that it is stale.
+//
+// It exists so one test can reproduce the incident ADR 0040 predicts and says
+// it could not previously debug — a lane running a flat-only evaluator meeting
+// a record carrying a valid nested rule. That evaluator has no concept of a
+// group node, so it classifies `{all:[...]}` as a leaf condition and reports
+// the leaf vocabulary as unsupported. The resulting diagnostics are what the
+// host recorder actually writes during real version skew, and they are NOT the
+// same as those produced by a current, nesting-aware validator refusing a
+// malformed rule.
+//
+// What is vendored: the COMPLETE validation path — `validateRequestExpression`
+// and `validateRequestCondition` with every branch (per-field operator
+// restrictions for device.class / time.now / audience.memberships, and every
+// value check), plus each helper those functions reach
+// (`expressionNumberInDomain`, `parseExpressionTimestamp`,
+// `expressionDaysInMonth`, `canonicalScalar`, `validExpressionRange`,
+// `homogeneousExpressionMembers`, and the DEVICE_CLASSES / MAX_IN_VALUES /
+// grammar constants). Evaluation, matching, and the fact vocabulary are
+// irrelevant to the record's shape and are deliberately absent.
+//
+// Adaptations from the source commit (everything not listed here is verbatim):
+//  1. Entry-point signature. The original `validateRequestExpression` was
+//     3-argument — its callers pre-extracted `all`/`any` with `rule.all || []`.
+//     The frozen export is 1-argument and derives them itself with
+//     `Array.isArray` guards (strictly stronger than the original `|| []`) so
+//     the fixture is safe to call directly on untrusted record data.
+//  2. The diagnostic type is renamed `FrozenExpressionDiagnostic` (from
+//     `ExpressionDiagnostic`) so a frozen diagnostic can never be confused
+//     with a live one at a call site.
+//  3. Export keywords were removed from the vendored internals; only the
+//     entry point and its diagnostic type are exported.
+const MAX_EXPRESSION_CONDITIONS = 64;
+const EXPRESSION_OPERATORS = [
+    'equals', 'contains', 'startsWith', 'exists',
+    'greaterThan', 'greaterThanOrEqual', 'lessThan', 'lessThanOrEqual',
+    'before', 'after', 'between', 'in',
+];
+const MAX_IN_VALUES = 32;
+// Observed values are gated on the published grammars before any host parser
+// runs (ADR 0038): Number() and Date.parse accept supersets (hex, empty
+// string, vendor date formats) that would let the same fact match here and
+// not in Go. Keep these literals identical to the capability artifact — the
+// drift test compares them byte-for-byte.
+const EXPRESSION_NUMBER_GRAMMAR = /^-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?$/;
+const EXPRESSION_TIMESTAMP_GRAMMAR = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(\.\d{1,9})?(Z|[+-]\d{2}:\d{2})$/;
+const DEVICE_CLASSES = ['desktop', 'mobile', 'tablet', 'unknown'];
+// Adaptation 1 (see header): the original was 3-argument with caller-extracted
+// `all`/`any`; this 1-argument form derives them with Array.isArray guards.
+// The body below this line is verbatim from the source commit.
+export function frozenValidateRequestExpression(rule) {
+    const all = (Array.isArray(rule.all) ? rule.all : []);
+    const any = (Array.isArray(rule.any) ? rule.any : []);
+    const diagnostics = [];
+    if (all.length + any.length === 0)
+        diagnostics.push({ code: 'expression.empty', path: 'expression', scope: 'request', message: 'expression must include at least one all or any condition' });
+    if (all.length + any.length > MAX_EXPRESSION_CONDITIONS)
+        diagnostics.push({ code: 'expression.conditions.too_many', path: 'expression', scope: 'request', message: `expression must contain at most ${MAX_EXPRESSION_CONDITIONS} conditions` });
+    Object.keys(rule).filter((group) => group !== 'all' && group !== 'any').sort().forEach((group) => {
+        diagnostics.push({ code: 'expression.group.unsupported', path: `expression.${group}`, scope: 'request', message: `expression.${group} is not a supported expression group` });
+    });
+    for (const [group, conditions] of [['all', all], ['any', any]]) {
+        conditions.forEach((condition, index) => frozenValidateRequestCondition(condition, `expression.${group}[${index}]`, diagnostics));
+    }
+    return diagnostics;
+}
+// Verbatim from the source commit: the full flat-era condition validator,
+// including the per-field operator restrictions and every value check.
+function frozenValidateRequestCondition(condition, path, diagnostics) {
+    Object.keys(condition).filter((property) => !['field', 'operator', 'value'].includes(property)).sort().forEach((property) => {
+        diagnostics.push({ code: 'expression.property.unsupported', path: `${path}.${property}`, scope: 'request', message: `${path}.${property} is not a supported condition property` });
+    });
+    const field = String(condition.field || '');
+    if (field !== 'referrer' && field !== 'device.class' && field !== 'time.now' && field !== 'audience.memberships' && !['query.', 'header.', 'cookie.', 'geo.', 'utm.'].some((prefix) => field.startsWith(prefix) && field.length > prefix.length)) {
+        diagnostics.push({ code: 'expression.field.unsupported', path: `${path}.field`, scope: 'request', message: `${path}.field ${JSON.stringify(field)} is not supported` });
+    }
+    const operator = String(condition.operator || '');
+    if (!EXPRESSION_OPERATORS.includes(operator)) {
+        diagnostics.push({ code: 'expression.operator.unsupported', path: `${path}.operator`, scope: 'request', message: `${path}.operator ${JSON.stringify(operator)} is not supported` });
+        return;
+    }
+    // device.class compares against a closed four-value set, so substring
+    // operators express nothing the set cannot — and admitting them would
+    // re-create the user-agent-substring habit inside the safe field (ADR 0037).
+    if (field === 'device.class' && !['equals', 'in', 'exists'].includes(operator)) {
+        diagnostics.push({ code: 'expression.operator.unsupported', path: `${path}.operator`, scope: 'request', message: `${path}.operator ${JSON.stringify(operator)} is not supported for field ${JSON.stringify(field)}, which compares against a closed value set` });
+        return;
+    }
+    // time.now is a sub-second-churning clock: string operators are silently
+    // inert on it and the numeric family can never match an RFC 3339 string
+    // (ADR 0038).
+    if (field === 'time.now' && !['before', 'after', 'between', 'exists'].includes(operator)) {
+        diagnostics.push({ code: 'expression.operator.unsupported', path: `${path}.operator`, scope: 'request', message: `${path}.operator ${JSON.stringify(operator)} is not supported for field ${JSON.stringify(field)}, which supports only before, after, between, exists` });
+        return;
+    }
+    // audience.memberships is an opaque-ID list: equals is already
+    // any-member-equals under the multi-valued match loop, so the substring
+    // family would only add silent overmatching of prefixed IDs, and the
+    // numeric/instant families can never match an ID (ADR 0039).
+    if (field === 'audience.memberships' && !['equals', 'in', 'exists'].includes(operator)) {
+        diagnostics.push({ code: 'expression.operator.unsupported', path: `${path}.operator`, scope: 'request', message: `${path}.operator ${JSON.stringify(operator)} is not supported for field ${JSON.stringify(field)}, which supports only equals, in, exists` });
+        return;
+    }
+    const value = condition.value;
+    if (operator === 'exists') {
+        if (value !== undefined && value !== null && typeof value !== 'boolean') {
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be a boolean for operator exists` });
+        }
+        return;
+    }
+    if (value === undefined || value === null) {
+        diagnostics.push({ code: 'expression.value.required', path: `${path}.value`, scope: 'request', message: `${path}.value is required for operator ${operator}` });
+        return;
+    }
+    if (['equals', 'contains', 'startsWith'].includes(operator)) {
+        if (!['string', 'number', 'boolean'].includes(typeof value)
+            || (typeof value === 'number' && !expressionNumberInDomain(value))) {
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be a string, boolean, or finite number using only safe integers` });
+        }
+        else if (field === 'device.class' && DEVICE_CLASSES.indexOf(canonicalScalar(value)) < 0) {
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be one of ${DEVICE_CLASSES.join(', ')} for field ${JSON.stringify(field)}` });
+        }
+        return;
+    }
+    if (['greaterThan', 'greaterThanOrEqual', 'lessThan', 'lessThanOrEqual'].includes(operator)) {
+        if (typeof value !== 'number' || !expressionNumberInDomain(value)) {
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be a finite JSON number using only safe integers for operator ${operator}` });
+        }
+        return;
+    }
+    if (operator === 'before' || operator === 'after') {
+        if (typeof value !== 'string' || parseExpressionTimestamp(value) === null) {
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be an RFC 3339 timestamp with an explicit UTC offset for operator ${operator}` });
+        }
+        return;
+    }
+    if (operator === 'between') {
+        if (!validExpressionRange(value)) {
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be a min/max object whose bounds are both numbers or both timestamps with min not above max` });
+        }
+        else if (field === 'time.now' && typeof value.min === 'number') {
+            // An instant field's observed values are instants: a numeric range on
+            // it would validate and then sit silently inert at execution.
+            diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value bounds must be timestamps for field ${JSON.stringify(field)}` });
+        }
+        return;
+    }
+    // in: bounded, non-empty, every member one canonicalizable scalar, all
+    // members one JSON type — a mixed list is almost always an authoring bug.
+    const members = homogeneousExpressionMembers(value);
+    if (members === null) {
+        diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be an array of 1 to ${MAX_IN_VALUES} scalars sharing one type` });
+        return;
+    }
+    if (field === 'device.class') {
+        for (const member of members) {
+            if (DEVICE_CLASSES.indexOf(member) < 0) {
+                diagnostics.push({ code: 'expression.value.invalid', path: `${path}.value`, scope: 'request', message: `${path}.value must be one of ${DEVICE_CLASSES.join(', ')} for field ${JSON.stringify(field)}` });
+                return;
+            }
+        }
+    }
+}
+// ── Validation helpers, verbatim from the source commit ──────────────────
+function expressionNumberInDomain(value) {
+    if (!Number.isFinite(value))
+        return false;
+    if (Number.isInteger(value) && !Number.isSafeInteger(value))
+        return false;
+    return true;
+}
+// Explicit calendar validation runs before Date arithmetic because Date.UTC
+// (like Go's time.Date) silently normalizes impossible dates. Instants
+// compare as epoch milliseconds; fractional seconds truncate to milliseconds.
+function parseExpressionTimestamp(value) {
+    const match = EXPRESSION_TIMESTAMP_GRAMMAR.exec(value);
+    if (!match)
+        return null;
+    const year = Number(match[1]), month = Number(match[2]), day = Number(match[3]);
+    const hour = Number(match[4]), minute = Number(match[5]), second = Number(match[6]);
+    if (month < 1 || month > 12 || day < 1 || day > expressionDaysInMonth(year, month))
+        return null;
+    if (hour > 23 || minute > 59 || second > 59)
+        return null;
+    let offsetMinutes = 0;
+    if (match[8] !== 'Z') {
+        const offsetHour = Number(match[8].slice(1, 3)), offsetMinute = Number(match[8].slice(4, 6));
+        if (offsetHour > 23 || offsetMinute > 59)
+            return null;
+        offsetMinutes = offsetHour * 60 + offsetMinute;
+        if (match[8][0] === '-')
+            offsetMinutes = -offsetMinutes;
+    }
+    const fractionMillis = match[7] ? Number((match[7].slice(1) + '00').slice(0, 3)) : 0;
+    // setUTCFullYear, not Date.UTC: Date.UTC maps two-digit years to 1900+.
+    const date = new Date(0);
+    date.setUTCFullYear(year, month - 1, day);
+    date.setUTCHours(hour, minute, second, 0);
+    return date.getTime() - offsetMinutes * 60000 + fractionMillis;
+}
+function expressionDaysInMonth(year, month) {
+    if (month === 4 || month === 6 || month === 9 || month === 11)
+        return 30;
+    if (month === 2)
+        return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0) ? 29 : 28;
+    return 31;
+}
+function canonicalScalar(value) {
+    if (typeof value === 'number')
+        return Object.is(value, -0) ? '0' : JSON.stringify(value);
+    return String(value);
+}
+function validExpressionRange(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const record = value;
+    if (Object.keys(record).some((key) => key !== 'min' && key !== 'max'))
+        return false;
+    const min = record.min, max = record.max;
+    if (min === undefined || min === null || max === undefined || max === null)
+        return false;
+    if (typeof min === 'number' && expressionNumberInDomain(min)) {
+        return typeof max === 'number' && expressionNumberInDomain(max) && min <= max;
+    }
+    const minMillis = typeof min === 'string' ? parseExpressionTimestamp(min) : null;
+    if (minMillis === null)
+        return false;
+    const maxMillis = typeof max === 'string' ? parseExpressionTimestamp(max) : null;
+    return maxMillis !== null && minMillis <= maxMillis;
+}
+function homogeneousExpressionMembers(value) {
+    if (!Array.isArray(value) || value.length === 0 || value.length > MAX_IN_VALUES)
+        return null;
+    let memberKind = '';
+    const members = [];
+    for (const member of value) {
+        const kind = typeof member;
+        if (kind !== 'string' && kind !== 'number' && kind !== 'boolean')
+            return null;
+        if (kind === 'number' && !expressionNumberInDomain(member))
+            return null;
+        if (!memberKind)
+            memberKind = kind;
+        else if (memberKind !== kind)
+            return null;
+        members.push(canonicalScalar(member));
+    }
+    return members;
+}