@peax/consent-core 0.6.0

package/dist/enforcement/request-rules.d.ts

@@ -0,0 +1,248 @@
+import * as z from 'zod/mini';
+
+/** Disjoint category/use decisions for one scope actually presented to the user. */
+declare type BatchCommand = z.infer<typeof consentDecisionsCommandSchema>;
+
+/** Records choices only for category members in userConsentedPolicy, not future members. */
+declare type CategoryConsentCommand = z.infer<typeof categoryConsentCommandSchema>;
+
+declare const categoryConsentCommandSchema: z.ZodMiniReadonly<z.ZodMiniObject<{
+    userConsentedPolicy: z.ZodMiniReadonly<z.ZodMiniObject<{
+        purposes: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniReadonly<z.ZodMiniObject<{
+            id: z.ZodMiniString<string>;
+            title: z.ZodMiniString<string>;
+            description: z.ZodMiniString<string>;
+        }, z.core.$strict>>>>;
+        uses: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniReadonly<z.ZodMiniObject<{
+            id: z.ZodMiniString<string>;
+            serviceId: z.ZodMiniString<string>;
+            categoryId: z.ZodMiniString<string>;
+            purposeId: z.ZodMiniString<string>;
+            consentVersion: z.ZodMiniInt;
+        }, z.core.$strict>>>>;
+    }, z.core.$strict>>;
+    categoryId: z.ZodMiniString<string>;
+    decision: z.ZodMiniEnum<{
+        granted: "granted";
+        denied: "denied";
+    }>;
+}, z.core.$strict>>;
+
+/** userConsentedPolicy is the scope shown for this decision, including a denial. */
+declare type ConsentDecisionCommand = z.infer<typeof consentDecisionCommandSchema>;
+
+declare const consentDecisionCommandSchema: z.ZodMiniReadonly<z.ZodMiniObject<{
+    userConsentedPolicy: z.ZodMiniReadonly<z.ZodMiniObject<{
+        purposes: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniReadonly<z.ZodMiniObject<{
+            id: z.ZodMiniString<string>;
+            title: z.ZodMiniString<string>;
+            description: z.ZodMiniString<string>;
+        }, z.core.$strict>>>>;
+        uses: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniReadonly<z.ZodMiniObject<{
+            id: z.ZodMiniString<string>;
+            serviceId: z.ZodMiniString<string>;
+            categoryId: z.ZodMiniString<string>;
+            purposeId: z.ZodMiniString<string>;
+            consentVersion: z.ZodMiniInt;
+        }, z.core.$strict>>>>;
+    }, z.core.$strict>>;
+    useId: z.ZodMiniString<string>;
+    decision: z.ZodMiniEnum<{
+        granted: "granted";
+        denied: "denied";
+    }>;
+}, z.core.$strict>>;
+
+declare type ConsentDecisionsCommand = Readonly<Omit<BatchCommand, 'decisions'> & {
+    decisions: readonly ExclusiveTarget<BatchCommand['decisions'][number]>[];
+}>;
+
+declare const consentDecisionsCommandSchema: z.ZodMiniReadonly<z.ZodMiniObject<{
+    userConsentedPolicy: z.ZodMiniReadonly<z.ZodMiniObject<{
+        purposes: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniReadonly<z.ZodMiniObject<{
+            id: z.ZodMiniString<string>;
+            title: z.ZodMiniString<string>;
+            description: z.ZodMiniString<string>;
+        }, z.core.$strict>>>>;
+        uses: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniReadonly<z.ZodMiniObject<{
+            id: z.ZodMiniString<string>;
+            serviceId: z.ZodMiniString<string>;
+            categoryId: z.ZodMiniString<string>;
+            purposeId: z.ZodMiniString<string>;
+            consentVersion: z.ZodMiniInt;
+        }, z.core.$strict>>>>;
+    }, z.core.$strict>>;
+    decisions: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniUnion<readonly [z.ZodMiniReadonly<z.ZodMiniObject<{
+        useId: z.ZodMiniString<string>;
+        decision: z.ZodMiniEnum<{
+            granted: "granted";
+            denied: "denied";
+        }>;
+    }, z.core.$strict>>, z.ZodMiniReadonly<z.ZodMiniObject<{
+        categoryId: z.ZodMiniString<string>;
+        decision: z.ZodMiniEnum<{
+            granted: "granted";
+            denied: "denied";
+        }>;
+    }, z.core.$strict>>]>>>;
+}, z.core.$strict>>;
+
+declare type ConsentDeniedReason = 'unknown-use' | 'undecided' | 'denied' | 'consent-version-mismatch';
+
+declare type ConsentEvaluation = Readonly<{
+    allowed: true;
+}> | Readonly<{
+    allowed: false;
+    reason: ConsentDeniedReason;
+}>;
+
+declare type ConsentPolicy = z.infer<typeof consentPolicySchema>;
+
+declare const consentPolicySchema: z.ZodMiniReadonly<z.ZodMiniObject<{
+    purposes: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniReadonly<z.ZodMiniObject<{
+        id: z.ZodMiniString<string>;
+        title: z.ZodMiniString<string>;
+        description: z.ZodMiniString<string>;
+    }, z.core.$strict>>>>;
+    uses: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniReadonly<z.ZodMiniObject<{
+        id: z.ZodMiniString<string>;
+        serviceId: z.ZodMiniString<string>;
+        categoryId: z.ZodMiniString<string>;
+        purposeId: z.ZodMiniString<string>;
+        consentVersion: z.ZodMiniInt;
+    }, z.core.$strict>>>>;
+}, z.core.$strict>>;
+
+export declare type ConsentRequestRule = Readonly<{
+    id: string;
+    useId: string;
+    match: Readonly<{
+        hostname: string;
+        includeSubdomains?: boolean;
+        pathnamePrefix?: string;
+        methods?: readonly string[];
+    }>;
+}>;
+
+export declare type ConsentRequestRuleBlockedEvent = Readonly<{
+    transport: ConsentRequestRuleTransport;
+    ruleIds: readonly string[];
+    blockedUses: readonly ConsentRequestRuleBlockedUse[];
+    reason: ConsentRequestRuleErrorReason;
+}>;
+
+export declare type ConsentRequestRuleBlockedUse = Readonly<{
+    useId: string;
+    reason: ConsentRequestRuleErrorReason;
+}>;
+
+/** No request URL, credentials, body or native transport error is retained. */
+export declare class ConsentRequestRuleError extends Error implements ConsentRequestRuleBlockedEvent {
+    readonly name = "ConsentRequestRuleError";
+    readonly transport: ConsentRequestRuleBlockedEvent['transport'];
+    readonly ruleIds: ConsentRequestRuleBlockedEvent['ruleIds'];
+    readonly blockedUses: ConsentRequestRuleBlockedEvent['blockedUses'];
+    readonly reason: ConsentRequestRuleBlockedEvent['reason'];
+    constructor(event: ConsentRequestRuleBlockedEvent);
+}
+
+export declare type ConsentRequestRuleErrorReason = ConsentDeniedReason | 'disposed' | 'grant-ended' | 'evaluation-error';
+
+export declare type ConsentRequestRuleGuard = Readonly<{
+    /** Install before SDK initialization. Idempotent; configuration/ownership failures throw. */
+    start: () => void;
+    /** Cancel matched work and restore only patches still owned by this guard. Terminal. */
+    dispose: () => void;
+}>;
+
+export declare type ConsentRequestRuleGuardOptions = Readonly<{
+    /** Forward the runtime's stable immutable getSnapshot() to enable grant-capture caching. */
+    consent: Pick<ConsentRuntime, 'evaluate' | 'subscribe'> & Partial<Pick<ConsentRuntime, 'getSnapshot'>>;
+    rules: readonly ConsentRequestRule[];
+    /** Defaults to the current window at start(), never at import/construction. */
+    target?: Window & typeof globalThis;
+    onBlocked?: (event: ConsentRequestRuleBlockedEvent) => void;
+    onIssue?: (issue: ConsentRequestRuleIssue) => void;
+}>;
+
+export declare type ConsentRequestRuleIssue = Readonly<{
+    code: 'evaluation-error' | 'callback-error' | 'patch-replaced' | 'untracked-xhr' | 'cleanup-error';
+}>;
+
+export declare type ConsentRequestRuleTransport = 'fetch' | 'xhr';
+
+/** A current use with no decision or a grant for a different consent version. */
+declare type ConsentRequirement = Readonly<{
+    useId: string;
+    categoryId: string;
+    /** The version required by the current policy for this use. */
+    consentVersion: number;
+    reason: 'undecided' | 'consent-version-mismatch';
+}>;
+
+/** In-memory runtime; methods can be passed as callbacks without binding. */
+declare type ConsentRuntime = Readonly<{
+    getSnapshot: () => ConsentSnapshot;
+    evaluate: (useId: string) => ConsentEvaluation;
+    /** Includes undecided uses and version-mismatched grants, not explicit denials. */
+    getMismatchedConsent: () => readonly ConsentRequirement[];
+    /**
+     * Replace all choices from trusted persistence, preserving unknown uses and recorded versions.
+     * Validation checks structure, not evidence of user consent; use decision methods for new choices.
+     * Does not replace policy, renew versions or perform I/O. Effective changes notify existing guards.
+     */
+    restoreState: (state: unknown) => ValidationResult<ConsentSnapshot>;
+    setConsentDecision: (command: ConsentDecisionCommand) => ValidationResult<ConsentSnapshot>;
+    setCategoryConsent: (command: CategoryConsentCommand) => ValidationResult<ConsentSnapshot>;
+    /** Validates all targets before one commit; observer errors can throw after that commit. */
+    setConsentDecisions: (command: ConsentDecisionsCommand) => ValidationResult<ConsentSnapshot>;
+    updatePolicy: (currentAppPolicy: unknown) => ValidationResult<ConsentSnapshot>;
+    subscribe: (listener: () => void) => () => void;
+}>;
+
+/** One active app policy and recorded choices; not a history of policies shown to users. */
+declare type ConsentSnapshot = Readonly<{
+    currentAppPolicy: ConsentPolicy;
+    state: ConsentState;
+}>;
+
+declare type ConsentState = z.infer<typeof consentStateSchema>;
+
+declare const consentStateSchema: z.ZodMiniReadonly<z.ZodMiniObject<{
+    choices: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniReadonly<z.ZodMiniObject<{
+        useId: z.ZodMiniString<string>;
+        consentVersion: z.ZodMiniInt;
+        decision: z.ZodMiniEnum<{
+            granted: "granted";
+            denied: "denied";
+        }>;
+    }, z.core.$strict>>>>;
+}, z.core.$strict>>;
+
+/** Optional window-local safety net. No browser access, subscriptions or patches until start(). */
+export declare function createConsentRequestRuleGuard(options: ConsentRequestRuleGuardOptions): ConsentRequestRuleGuard;
+
+declare type ExclusiveTarget<T> = T extends {
+    useId: string;
+} ? T & {
+    readonly categoryId?: never;
+} : T & {
+    readonly useId?: never;
+};
+
+/** A validation issue without a copy of the rejected input. */
+declare type ValidationIssue = Readonly<{
+    code: string;
+    path: readonly (string | number)[];
+    message: string;
+}>;
+
+declare type ValidationResult<T> = Readonly<{
+    success: true;
+    data: T;
+}> | Readonly<{
+    success: false;
+    issues: readonly ValidationIssue[];
+}>;
+
+export { }

package/dist/enforcement/request-rules.js

@@ -0,0 +1,434 @@
+import { n as retainSignal, t as createConsentRequestScope } from "../createConsentRequestScope-D7U8uK6m.js";
+import { n as requireUseId, t as requireConsent } from "../validate-D16G7mdG.js";
+//#region src/enforcement/request-rules/ConsentRequestRuleError.ts
+/** No request URL, credentials, body or native transport error is retained. */
+var ConsentRequestRuleError = class extends Error {
+	name = "ConsentRequestRuleError";
+	transport;
+	ruleIds;
+	blockedUses;
+	reason;
+	constructor(event) {
+		super("Request blocked by consent.");
+		this.transport = event.transport;
+		this.ruleIds = Object.freeze([...event.ruleIds]);
+		this.blockedUses = Object.freeze(event.blockedUses.map((use) => Object.freeze({ ...use })));
+		this.reason = event.reason;
+	}
+};
+//#endregion
+//#region src/enforcement/request-rules/compileRules.ts
+function object(value, keys) {
+	if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !keys.includes(key))) throw new TypeError("Invalid request rule configuration.");
+}
+function compileRules(input) {
+	if (!Array.isArray(input)) throw new TypeError("Expected request rules.");
+	const ids = /* @__PURE__ */ new Set();
+	return Object.freeze(input.map((rule) => {
+		object(rule, [
+			"id",
+			"useId",
+			"match"
+		]);
+		if (typeof rule.id !== "string" || !rule.id.trim()) throw new TypeError("Expected a non blank request rule ID.");
+		requireUseId(rule.useId);
+		if (ids.has(rule.id)) throw new TypeError("Duplicate request rule ID.");
+		ids.add(rule.id);
+		object(rule.match, [
+			"hostname",
+			"includeSubdomains",
+			"pathnamePrefix",
+			"methods"
+		]);
+		const match = rule.match;
+		if (typeof match.hostname !== "string" || !match.hostname || match.hostname.trim() !== match.hostname) throw new TypeError("Expected a hostname.");
+		const url = new URL(`https://${match.hostname}`);
+		if (url.username || url.password || url.port || url.pathname !== "/" || url.search || url.hash || match.hostname.includes(":") && !(match.hostname.startsWith("[") && match.hostname.endsWith("]")) || /[/\\?#@]/.test(match.hostname)) throw new TypeError("Expected a hostname, not a URL or port.");
+		if (match.includeSubdomains !== void 0 && typeof match.includeSubdomains !== "boolean") throw new TypeError("Expected includeSubdomains.");
+		if (match.pathnamePrefix !== void 0 && (typeof match.pathnamePrefix !== "string" || !match.pathnamePrefix.startsWith("/"))) throw new TypeError("Expected a pathname prefix.");
+		let methods;
+		if (match.methods !== void 0) {
+			if (!Array.isArray(match.methods) || !match.methods.length) throw new TypeError("Expected request methods.");
+			methods = new Set(match.methods.map((method) => {
+				if (typeof method !== "string" || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(method)) throw new TypeError("Expected an HTTP method token.");
+				return method.toUpperCase();
+			}));
+		}
+		return Object.freeze({
+			id: rule.id,
+			useId: rule.useId,
+			hostname: url.hostname.replace(/\.$/, ""),
+			includeSubdomains: match.includeSubdomains ?? false,
+			pathnamePrefix: match.pathnamePrefix ?? "/",
+			methods
+		});
+	}));
+}
+function matchRules(rules, url, method) {
+	if (url.protocol !== "http:" && url.protocol !== "https:") return [];
+	const hostname = url.hostname.replace(/\.$/, "");
+	return rules.filter((rule) => (hostname === rule.hostname || rule.includeSubdomains && hostname.endsWith(`.${rule.hostname}`)) && url.pathname.startsWith(rule.pathnamePrefix) && (!rule.methods || rule.methods.has(method.toUpperCase())));
+}
+//#endregion
+//#region src/enforcement/request-rules/createFetchInterceptor.ts
+/** Dispatch only; the factory captures nativeFetch before app-owned subscriptions and owns patches. */
+function createFetchInterceptor(target, nativeFetch, rules, permissions) {
+	return async (input, init) => {
+		permissions.assertAllowed("fetch", [], /* @__PURE__ */ new Map());
+		const captured = permissions.captureGrants();
+		const request = new target.Request(input, init);
+		const matched = matchRules(rules, new target.URL(request.url), request.method);
+		const signals = permissions.assertAllowed("fetch", matched, captured);
+		if (!matched.length) return nativeFetch.call(target, request);
+		const signal = target.AbortSignal.any([request.signal, ...signals]);
+		if (signal.aborted) permissions.assertAllowed("fetch", matched, captured);
+		signal.throwIfAborted();
+		const response = await nativeFetch.call(target, request, {
+			signal,
+			referrer: request.referrer,
+			referrerPolicy: request.referrerPolicy
+		});
+		retainSignal(signal, response, response.body);
+		return response;
+	};
+}
+//#endregion
+//#region src/enforcement/request-rules/createRulePermissions.ts
+/** One existing request scope per configured use, not a new policy evaluator. */
+function createRulePermissions(options, rules, report, isDisposed) {
+	const scopes = /* @__PURE__ */ new Map();
+	let closed = false;
+	let cache;
+	let cacheRevision = 0;
+	function invalidateCapture() {
+		cache = void 0;
+		cacheRevision++;
+	}
+	function readSnapshot() {
+		try {
+			return options.consent.getSnapshot?.();
+		} catch {
+			invalidateCapture();
+			return;
+		}
+	}
+	const scopeConsent = {
+		subscribe: (listener) => options.consent.subscribe(listener),
+		evaluate: (useId) => {
+			try {
+				return options.consent.evaluate(useId);
+			} catch (error) {
+				invalidateCapture();
+				throw error;
+			}
+		}
+	};
+	try {
+		for (const rule of rules) if (!scopes.has(rule.useId)) scopes.set(rule.useId, createConsentRequestScope(scopeConsent, rule.useId, () => /* @__PURE__ */ new Error("Consent grant ended.")));
+	} catch (error) {
+		for (const scope of scopes.values()) try {
+			scope.dispose();
+		} catch {
+			report("cleanup-error");
+		}
+		throw error;
+	}
+	function block(transport, matched, blockedUses, reason) {
+		const error = new ConsentRequestRuleError({
+			transport,
+			ruleIds: matched.map((rule) => rule.id),
+			blockedUses,
+			reason
+		});
+		try {
+			Promise.resolve(options.onBlocked?.(Object.freeze({
+				transport,
+				ruleIds: error.ruleIds,
+				blockedUses: error.blockedUses,
+				reason
+			}))).catch(() => report("callback-error"));
+		} catch {
+			report("callback-error");
+		}
+		throw error;
+	}
+	return {
+		/** Capture before normalization without letting unrelated unavailable uses block essential traffic. */
+		captureGrants() {
+			if (closed || isDisposed()) return /* @__PURE__ */ new Map();
+			const snapshot = readSnapshot();
+			if (snapshot && cache?.snapshot === snapshot) return cache.grants;
+			invalidateCapture();
+			const revision = cacheRevision;
+			const captured = /* @__PURE__ */ new Map();
+			for (const [useId, scope] of scopes) try {
+				captured.set(useId, scope.begin());
+			} catch {
+				captured.set(useId, void 0);
+			}
+			const latestSnapshot = snapshot ? readSnapshot() : void 0;
+			if (snapshot && latestSnapshot === snapshot && revision === cacheRevision && !closed && !isDisposed()) cache = {
+				snapshot,
+				grants: captured
+			};
+			return captured;
+		},
+		/** Return original signals only if ALL matched uses are allowed; otherwise report and throw once. */
+		assertAllowed(transport, matched, captured) {
+			if (closed || isDisposed()) block(transport, matched, [], "disposed");
+			const blocked = [];
+			const signals = [];
+			for (const useId of new Set(matched.map((rule) => rule.useId))) try {
+				const result = options.consent.evaluate(useId);
+				const signal = captured.get(useId);
+				if (!result.allowed) blocked.push({
+					useId,
+					reason: result.reason
+				});
+				else if (!signal || signal.aborted) {
+					invalidateCapture();
+					blocked.push({
+						useId,
+						reason: "grant-ended"
+					});
+				} else signals.push(signal);
+			} catch {
+				invalidateCapture();
+				report("evaluation-error");
+				blocked.push({
+					useId,
+					reason: "evaluation-error"
+				});
+			}
+			if (blocked.length) block(transport, matched, blocked, blocked[0]?.reason ?? "grant-ended");
+			return signals;
+		},
+		dispose() {
+			closed = true;
+			invalidateCapture();
+			for (const scope of scopes.values()) try {
+				scope.dispose();
+			} catch {
+				report("cleanup-error");
+			}
+			scopes.clear();
+		}
+	};
+}
+//#endregion
+//#region src/enforcement/request-rules/normalizeXhrBody.ts
+/** Web IDL string conversion must run before our final URL/permission check. */
+function domString(value) {
+	if (typeof value === "symbol") throw new TypeError("Cannot convert a Symbol to a string.");
+	return String(value);
+}
+var probes = [
+	(value) => Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength")?.get?.call(value),
+	(value, target) => Object.getOwnPropertyDescriptor(target.Blob.prototype, "size")?.get?.call(value),
+	(value, target) => target.FormData.prototype.has.call(value, ""),
+	(value, target) => target.URLSearchParams.prototype.has.call(value, ""),
+	(value, target) => Object.getOwnPropertyDescriptor(target.Node.prototype, "nodeType")?.get?.call(value) === 9 ? true : void 0
+];
+/** Native brand probes retain cross-realm BodyInit values without duck typing/getters. */
+function normalizeXhrBody(value, target) {
+	if (value == null) return null;
+	if (ArrayBuffer.isView(value)) return value;
+	for (const probe of probes) try {
+		if (probe(value, target) !== void 0) return value;
+	} catch {}
+	return domString(value);
+}
+//#endregion
+//#region src/enforcement/request-rules/createXhrInterceptor.ts
+function createXhrInterceptor(target, rules, permissions, report) {
+	const prototype = target.XMLHttpRequest.prototype;
+	const nativeOpen = prototype.open;
+	const nativeSend = prototype.send;
+	const nativeAbort = prototype.abort;
+	const entries = /* @__PURE__ */ new WeakMap();
+	const active = /* @__PURE__ */ new Set();
+	const untracked = /* @__PURE__ */ new WeakSet();
+	const open = function(...args) {
+		permissions.assertAllowed("xhr", [], /* @__PURE__ */ new Map());
+		if (args.length < 2) return Reflect.apply(nativeOpen, this, args);
+		const method = domString(args[0]);
+		const urlInput = domString(args[1]);
+		const rest = args.slice(2, 5).map((value, index) => index === 0 ? Boolean(value) : value == null ? null : domString(value));
+		let url;
+		try {
+			url = new target.URL(urlInput, target.document.baseURI);
+		} catch {
+			return Reflect.apply(nativeOpen, this, [
+				method,
+				urlInput,
+				...rest
+			]);
+		}
+		const previous = entries.get(this);
+		const entry = {
+			url,
+			method
+		};
+		entries.set(this, entry);
+		try {
+			Reflect.apply(nativeOpen, this, [
+				method,
+				url.href,
+				...rest
+			]);
+			previous?.release?.();
+		} catch (error) {
+			if (entries.get(this) === entry) {
+				if (previous) entries.set(this, previous);
+				else entries.delete(this);
+			}
+			throw error;
+		}
+	};
+	const send = function(body) {
+		const captured = permissions.captureGrants();
+		const normalized = normalizeXhrBody(body, target);
+		const entry = entries.get(this);
+		const matched = entry ? matchRules(rules, entry.url, entry.method) : [];
+		const signals = permissions.assertAllowed("xhr", matched, captured);
+		if (!entry) {
+			if (!untracked.has(this)) {
+				untracked.add(this);
+				report("untracked-xhr");
+			}
+			return nativeSend.call(this, normalized);
+		}
+		if (!matched.length) return nativeSend.call(this, normalized);
+		if (entry.release) return nativeSend.call(this, normalized);
+		const signal = target.AbortSignal.any(signals);
+		let live = true;
+		const release = () => {
+			if (!live) return;
+			live = false;
+			signal.removeEventListener("abort", cancel);
+			this.removeEventListener("loadend", release);
+			active.delete(cancel);
+			if (entry.release === release) delete entry.release;
+		};
+		const cancel = () => {
+			release();
+			if (entries.get(this) !== entry) return;
+			try {
+				nativeAbort.call(this);
+			} catch {
+				report("cleanup-error");
+			}
+		};
+		entry.release = release;
+		active.add(cancel);
+		signal.addEventListener("abort", cancel, { once: true });
+		this.addEventListener("loadend", release);
+		try {
+			if (signal.aborted) permissions.assertAllowed("xhr", matched, captured);
+			signal.throwIfAborted();
+			nativeSend.call(this, normalized);
+			if (this.readyState === 4) release();
+		} catch (error) {
+			release();
+			throw error;
+		}
+	};
+	return {
+		open,
+		send,
+		dispose() {
+			for (const cancel of [...active]) cancel();
+		}
+	};
+}
+//#endregion
+//#region src/enforcement/request-rules/installPatch.ts
+/** Restore the exact original descriptor, without overwriting a subsequent library's patch. */
+function installPatch(target, key, wrapper, replaced) {
+	const original = Object.getOwnPropertyDescriptor(target, key);
+	Object.defineProperty(target, key, {
+		configurable: true,
+		enumerable: original?.enumerable ?? true,
+		writable: true,
+		value: wrapper
+	});
+	return () => {
+		if (target[key] !== wrapper) {
+			replaced();
+			return;
+		}
+		if (original) Object.defineProperty(target, key, original);
+		else Reflect.deleteProperty(target, key);
+	};
+}
+//#endregion
+//#region src/enforcement/request-rules/createConsentRequestRuleGuard.ts
+var ownerKey = Symbol.for("@peax/consent-core/request-rules-owner");
+/** Optional window-local safety net. No browser access, subscriptions or patches until start(). */
+function createConsentRequestRuleGuard(options) {
+	requireConsent(options.consent);
+	const rules = compileRules(options.rules);
+	for (const callback of [options.onBlocked, options.onIssue]) if (callback !== void 0 && typeof callback !== "function") throw new TypeError("Expected a request-rule callback.");
+	let disposed = false;
+	let started = false;
+	let permissions;
+	let xhr;
+	const restore = [];
+	let releaseOwner;
+	function report(code) {
+		try {
+			Promise.resolve(options.onIssue?.(Object.freeze({ code }))).catch(() => {});
+		} catch {}
+	}
+	function teardown() {
+		permissions?.dispose();
+		xhr?.dispose();
+		for (const undo of restore.splice(0).reverse()) try {
+			undo();
+		} catch {
+			report("cleanup-error");
+		}
+		releaseOwner?.();
+		releaseOwner = void 0;
+	}
+	return Object.freeze({
+		start() {
+			if (disposed) throw new TypeError("Request-rule guard is disposed.");
+			if (started) return;
+			const target = options.target ?? (typeof window === "undefined" ? void 0 : window);
+			if (typeof target?.fetch !== "function" || typeof target.Request !== "function" || typeof target.AbortSignal?.any !== "function" || typeof target.XMLHttpRequest?.prototype.open !== "function" || typeof target.XMLHttpRequest.prototype.send !== "function") throw new TypeError("Expected a window with Fetch and XMLHttpRequest.");
+			const registry = target;
+			if (registry[ownerKey]) throw new TypeError("A request-rule guard already owns this window.");
+			const token = {};
+			Object.defineProperty(target, ownerKey, {
+				configurable: true,
+				value: token
+			});
+			releaseOwner = () => {
+				if (registry[ownerKey] === token) Reflect.deleteProperty(target, ownerKey);
+			};
+			try {
+				const nativeFetch = target.fetch;
+				const current = createRulePermissions(options, rules, report, () => disposed);
+				permissions = current;
+				if (disposed) throw new TypeError("Request-rule guard was disposed during startup.");
+				const fetch = createFetchInterceptor(target, nativeFetch, rules, current);
+				xhr = createXhrInterceptor(target, rules, current, report);
+				restore.push(installPatch(target, "fetch", fetch, () => report("patch-replaced")));
+				restore.push(installPatch(target.XMLHttpRequest.prototype, "open", xhr.open, () => report("patch-replaced")));
+				restore.push(installPatch(target.XMLHttpRequest.prototype, "send", xhr.send, () => report("patch-replaced")));
+				started = true;
+			} catch (error) {
+				teardown();
+				throw new TypeError("Could not install request-rule guard.", { cause: error });
+			}
+		},
+		dispose() {
+			if (disposed) return;
+			disposed = true;
+			teardown();
+		}
+	});
+}
+//#endregion
+export { ConsentRequestRuleError, createConsentRequestRuleGuard };