@runbound/config-browser 0.0.0-stage → 0.1.0-alpha.1

package/dist/config-public-decision.js

@@ -0,0 +1 @@
+import*as e from"@noble/hashes/sha2.js";import*as t from"@noble/hashes/utils.js";var n={802(e){!function(t){"use strict";let n="(0?\\d+|0x[a-f0-9]+)",i={fourOctet:RegExp(`^${n}\\.${n}\\.${n}\\.${n}$`,"i"),threeOctet:RegExp(`^${n}\\.${n}\\.${n}$`,"i"),twoOctet:RegExp(`^${n}\\.${n}$`,"i"),longValue:RegExp(`^${n}$`,"i")},r=RegExp("^0[0-7]+$","i"),o=RegExp("^0x[a-f0-9]+$","i"),s="%[0-9a-z]{1,}",a="(?:[0-9a-f]+::?)+",c={zoneIndex:RegExp(s,"i"),native:RegExp(`^(::)?(${a})?([0-9a-f]+)?(::)?(${s})?$`,"i"),deprecatedTransitional:RegExp(`^(?:::)(${n}\\.${n}\\.${n}\\.${n}(${s})?)$`,"i"),transitional:RegExp(`^((?:${a})|(?:::)(?:${a})?)${n}\\.${n}\\.${n}\\.${n}(${s})?$`,"i")};function u(e,t){let n,i;if(e.indexOf("::")!==e.lastIndexOf("::"))return null;let r=0,o=-1,s=(e.match(c.zoneIndex)||[])[0];for(s&&(s=s.substring(1),e=e.replace(/%.+$/,""));(o=e.indexOf(":",o+1))>=0;)r++;if("::"===e.substr(0,2)&&r--,"::"===e.substr(-2,2)&&r--,r>t)return null;for(i=t-r,n=":";i--;)n+="0:";return":"===(e=e.replace("::",n))[0]&&(e=e.slice(1)),":"===e[e.length-1]&&(e=e.slice(0,-1)),{parts:t=function(){let t=e.split(":"),n=[];for(let e=0;e<t.length;e++)n.push(parseInt(t[e],16));return n}(),zoneId:s}}function l(e,t,n,i){let r;if(e.length!==t.length)throw Error("ipaddr: cannot match CIDR for objects with different lengths");let o=0;for(;i>0;){if((r=n-i)<0&&(r=0),e[o]>>r!=t[o]>>r)return!1;i-=n,o+=1}return!0}function d(e){if(o.test(e))return parseInt(e,16);if("0"===e[0]&&!isNaN(parseInt(e[1],10))){if(r.test(e))return parseInt(e,8);throw Error(`ipaddr: cannot parse ${e} as octal`)}return parseInt(e,10)}let p={};p.IPv4=function(){function e(e){let t,n;if(4!==e.length)throw Error("ipaddr: ipv4 octet count should be 4");for(t=0;t<e.length;t++)if(!(0<=(n=e[t])&&n<=255))throw Error("ipaddr: ipv4 octet should fit in 8 bits");this.octets=e}return e.prototype.SpecialRanges={unspecified:[[new e([0,0,0,0]),8]],broadcast:[[new e([255,255,255,255]),32]],multicast:[[new e([224,0,0,0]),4]],linkLocal:[[new e([169,254,0,0]),16]],loopback:[[new e([127,0,0,0]),8]],carrierGradeNat:[[new e([100,64,0,0]),10]],private:[[new e([10,0,0,0]),8],[new e([172,16,0,0]),12],[new e([192,168,0,0]),16]],reserved:[[new e([192,0,0,0]),24],[new e([192,0,2,0]),24],[new e([192,88,99,0]),24],[new e([198,18,0,0]),15],[new e([198,51,100,0]),24],[new e([203,0,113,0]),24],[new e([240,0,0,0]),4]],as112:[[new e([192,175,48,0]),24],[new e([192,31,196,0]),24]],amt:[[new e([192,52,193,0]),24]]},e.prototype.kind=function(){return"ipv4"},e.prototype.match=function(e,t){let n;if(void 0===t&&(e=(n=e)[0],t=n[1]),"ipv4"!==e.kind())throw Error("ipaddr: cannot match ipv4 address with non-ipv4 one");return l(this.octets,e.octets,8,t)},e.prototype.prefixLengthFromSubnetMask=function(){let e,t,n,i=0,r=!1,o={0:8,128:7,192:6,224:5,240:4,248:3,252:2,254:1,255:0};for(e=3;e>=0;e-=1){if(!((t=this.octets[e])in o)||(n=o[t],r&&0!==n))return null;8!==n&&(r=!0),i+=n}return 32-i},e.prototype.range=function(){return p.subnetMatch(this,this.SpecialRanges)},e.prototype.toByteArray=function(){return this.octets.slice(0)},e.prototype.toIPv4MappedAddress=function(){return p.IPv6.parse(`::ffff:${this.toString()}`)},e.prototype.toNormalizedString=function(){return this.toString()},e.prototype.toString=function(){return this.octets.join(".")},e}(),p.IPv4.broadcastAddressFromCIDR=function(e){try{let t=this.parseCIDR(e),n=t[0].toByteArray(),i=this.subnetMaskFromPrefixLength(t[1]).toByteArray(),r=[],o=0;for(;o<4;)r.push(parseInt(n[o],10)|255^parseInt(i[o],10)),o++;return new this(r)}catch(e){throw Error("ipaddr: the address does not have IPv4 CIDR format")}},p.IPv4.isIPv4=function(e){return null!==this.parser(e)},p.IPv4.isValid=function(e){try{return new this(this.parser(e)),!0}catch(e){return!1}},p.IPv4.isValidCIDR=function(e){try{return this.parseCIDR(e),!0}catch(e){return!1}},p.IPv4.isValidFourPartDecimal=function(e){return!!(p.IPv4.isValid(e)&&e.match(/^(0|[1-9]\d*)(\.(0|[1-9]\d*)){3}$/))},p.IPv4.isValidCIDRFourPartDecimal=function(e){let t=e.match(/^(.+)\/(\d+)$/);return!!p.IPv4.isValidCIDR(e)&&!!t&&p.IPv4.isValidFourPartDecimal(t[1])},p.IPv4.networkAddressFromCIDR=function(e){let t,n,i,r,o;try{for(i=(t=this.parseCIDR(e))[0].toByteArray(),o=this.subnetMaskFromPrefixLength(t[1]).toByteArray(),r=[],n=0;n<4;)r.push(parseInt(i[n],10)&parseInt(o[n],10)),n++;return new this(r)}catch(e){throw Error("ipaddr: the address does not have IPv4 CIDR format")}},p.IPv4.parse=function(e){let t=this.parser(e);if(null===t)throw Error("ipaddr: string is not formatted like an IPv4 Address");return new this(t)},p.IPv4.parseCIDR=function(e){let t;if(t=e.match(/^(.+)\/(\d+)$/)){let e=parseInt(t[2]);if(e>=0&&e<=32){let n=[this.parse(t[1]),e];return Object.defineProperty(n,"toString",{value:function(){return this.join("/")}}),n}}throw Error("ipaddr: string is not formatted like an IPv4 CIDR range")},p.IPv4.parser=function(e){let t,n;if(t=e.match(i.fourOctet)){let e=t.slice(1,6),n=[];for(let t=0;t<e.length;t++)n.push(d(e[t]));return n}if(t=e.match(i.longValue)){if((n=d(t[1]))>0xffffffff||n<0)throw Error("ipaddr: address outside defined range");return(function(){let e,t=[];for(e=0;e<=24;e+=8)t.push(n>>e&255);return t})().reverse()}if(t=e.match(i.twoOctet)){let e=t.slice(1,4),i=[];if((n=d(e[1]))>0xffffff||n<0)throw Error("ipaddr: address outside defined range");return i.push(d(e[0])),i.push(n>>16&255),i.push(n>>8&255),i.push(255&n),i}{if(!(t=e.match(i.threeOctet)))return null;let r=t.slice(1,5),o=[];if((n=d(r[2]))>65535||n<0)throw Error("ipaddr: address outside defined range");return o.push(d(r[0])),o.push(d(r[1])),o.push(n>>8&255),o.push(255&n),o}},p.IPv4.subnetMaskFromPrefixLength=function(e){if((e=parseInt(e))<0||e>32)throw Error("ipaddr: invalid IPv4 prefix length");let t=[0,0,0,0],n=0,i=Math.floor(e/8);for(;n<i;)t[n]=255,n++;return i<4&&(t[i]=Math.pow(2,e%8)-1<<8-e%8),new this(t)},p.IPv6=function(){function e(e,t){let n,i;if(16===e.length)for(this.parts=[],n=0;n<=14;n+=2)this.parts.push(e[n]<<8|e[n+1]);else if(8===e.length)this.parts=e;else throw Error("ipaddr: ipv6 part count should be 8 or 16");for(n=0;n<this.parts.length;n++)if(!(0<=(i=this.parts[n])&&i<=65535))throw Error("ipaddr: ipv6 part should fit in 16 bits");t&&(this.zoneId=t)}return e.prototype.SpecialRanges={unspecified:[new e([0,0,0,0,0,0,0,0]),128],linkLocal:[new e([65152,0,0,0,0,0,0,0]),10],multicast:[new e([65280,0,0,0,0,0,0,0]),8],loopback:[new e([0,0,0,0,0,0,0,1]),128],uniqueLocal:[new e([64512,0,0,0,0,0,0,0]),7],ipv4Mapped:[new e([0,0,0,0,0,65535,0,0]),96],deprecatedSiteLocal:[new e([65216,0,0,0,0,0,0,0]),10],discard:[new e([256,0,0,0,0,0,0,0]),64],rfc6145:[new e([0,0,0,0,65535,0,0,0]),96],rfc6052:[[new e([100,65435,0,0,0,0,0,0]),96],[new e([100,65435,1,0,0,0,0,0]),48]],"6to4":[new e([8194,0,0,0,0,0,0,0]),16],teredo:[new e([8193,0,0,0,0,0,0,0]),32],benchmarking:[new e([8193,2,0,0,0,0,0,0]),48],amt:[new e([8193,3,0,0,0,0,0,0]),32],as112v6:[[new e([8193,4,274,0,0,0,0,0]),48],[new e([9760,79,32768,0,0,0,0,0]),48]],deprecatedOrchid:[new e([8193,16,0,0,0,0,0,0]),28],orchid2:[new e([8193,32,0,0,0,0,0,0]),28],droneRemoteIdProtocolEntityTags:[new e([8193,48,0,0,0,0,0,0]),28],segmentRouting:[new e([24320,0,0,0,0,0,0,0]),16],reserved:[[new e([8193,0,0,0,0,0,0,0]),23],[new e([8193,3512,0,0,0,0,0,0]),32],[new e([16383,0,0,0,0,0,0,0]),20]]},e.prototype.isIPv4MappedAddress=function(){return"ipv4Mapped"===this.range()},e.prototype.kind=function(){return"ipv6"},e.prototype.match=function(e,t){let n;if(void 0===t&&(e=(n=e)[0],t=n[1]),"ipv6"!==e.kind())throw Error("ipaddr: cannot match ipv6 address with non-ipv6 one");return l(this.parts,e.parts,16,t)},e.prototype.prefixLengthFromSubnetMask=function(){let e,t,n=0,i=!1,r={0:16,32768:15,49152:14,57344:13,61440:12,63488:11,64512:10,65024:9,65280:8,65408:7,65472:6,65504:5,65520:4,65528:3,65532:2,65534:1,65535:0};for(let o=7;o>=0;o-=1){if(!((e=this.parts[o])in r)||(t=r[e],i&&0!==t))return null;16!==t&&(i=!0),n+=t}return 128-n},e.prototype.range=function(){return p.subnetMatch(this,this.SpecialRanges)},e.prototype.toByteArray=function(){let e,t=[],n=this.parts;for(let i=0;i<n.length;i++)t.push((e=n[i])>>8),t.push(255&e);return t},e.prototype.toFixedLengthString=function(){let e=(function(){let e=[];for(let t=0;t<this.parts.length;t++)e.push(function(e){for(;e.length<4;)e=`0${e}`;return e}(this.parts[t].toString(16)));return e}).call(this).join(":"),t="";return this.zoneId&&(t=`%${this.zoneId}`),e+t},e.prototype.toIPv4Address=function(){if(!this.isIPv4MappedAddress())throw Error("ipaddr: trying to convert a generic ipv6 address to ipv4");let e=this.parts.slice(-2),t=e[0],n=e[1];return new p.IPv4([t>>8,255&t,n>>8,255&n])},e.prototype.toNormalizedString=function(){let e=(function(){let e=[];for(let t=0;t<this.parts.length;t++)e.push(this.parts[t].toString(16));return e}).call(this).join(":"),t="";return this.zoneId&&(t=`%${this.zoneId}`),e+t},e.prototype.toRFC5952String=function(){let e,t=/((^|:)(0(:|$)){2,})/g,n=this.toNormalizedString(),i=0,r=-1;for(;e=t.exec(n);)e[0].length>r&&(i=e.index,r=e[0].length);return r<0?n:`${n.substring(0,i)}::${n.substring(i+r)}`},e.prototype.toString=function(){return this.toRFC5952String()},e}(),p.IPv6.broadcastAddressFromCIDR=function(e){try{let t=this.parseCIDR(e),n=t[0].toByteArray(),i=this.subnetMaskFromPrefixLength(t[1]).toByteArray(),r=[],o=0;for(;o<16;)r.push(parseInt(n[o],10)|255^parseInt(i[o],10)),o++;return new this(r)}catch(e){throw Error(`ipaddr: the address does not have IPv6 CIDR format (${e})`)}},p.IPv6.isIPv6=function(e){return null!==this.parser(e)},p.IPv6.isValid=function(e){if("string"==typeof e&&-1===e.indexOf(":"))return!1;try{let t=this.parser(e);return new this(t.parts,t.zoneId),!0}catch(e){return!1}},p.IPv6.isValidCIDR=function(e){if("string"==typeof e&&-1===e.indexOf(":"))return!1;try{return this.parseCIDR(e),!0}catch(e){return!1}},p.IPv6.networkAddressFromCIDR=function(e){let t,n,i,r,o;try{for(i=(t=this.parseCIDR(e))[0].toByteArray(),o=this.subnetMaskFromPrefixLength(t[1]).toByteArray(),r=[],n=0;n<16;)r.push(parseInt(i[n],10)&parseInt(o[n],10)),n++;return new this(r)}catch(e){throw Error(`ipaddr: the address does not have IPv6 CIDR format (${e})`)}},p.IPv6.parse=function(e){let t=this.parser(e);if(null===t.parts)throw Error("ipaddr: string is not formatted like an IPv6 Address");return new this(t.parts,t.zoneId)},p.IPv6.parseCIDR=function(e){let t,n,i;if((n=e.match(/^(.+)\/(\d+)$/))&&(t=parseInt(n[2]))>=0&&t<=128)return Object.defineProperty(i=[this.parse(n[1]),t],"toString",{value:function(){return this.join("/")}}),i;throw Error("ipaddr: string is not formatted like an IPv6 CIDR range")},p.IPv6.parser=function(e){let t,n,i,r,o,s;if(i=e.match(c.deprecatedTransitional))return this.parser(`::ffff:${i[1]}`);if(c.native.test(e))return u(e,8);if((i=e.match(c.transitional))&&(s=i[6]||"",t=i[1],i[1].endsWith("::")||(t=t.slice(0,-1)),(t=u(t+s,6)).parts)){for(o=[parseInt(i[2]),parseInt(i[3]),parseInt(i[4]),parseInt(i[5])],n=0;n<o.length;n++)if(!(0<=(r=o[n])&&r<=255))return null;return t.parts.push(o[0]<<8|o[1]),t.parts.push(o[2]<<8|o[3]),{parts:t.parts,zoneId:t.zoneId}}return null},p.IPv6.subnetMaskFromPrefixLength=function(e){if((e=parseInt(e))<0||e>128)throw Error("ipaddr: invalid IPv6 prefix length");let t=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],n=0,i=Math.floor(e/8);for(;n<i;)t[n]=255,n++;return i<16&&(t[i]=Math.pow(2,e%8)-1<<8-e%8),new this(t)},p.fromByteArray=function(e){let t=e.length;if(4===t)return new p.IPv4(e);if(16===t)return new p.IPv6(e);throw Error("ipaddr: the binary input is neither an IPv6 nor IPv4 address")},p.isValid=function(e){return p.IPv6.isValid(e)||p.IPv4.isValid(e)},p.isValidCIDR=function(e){return p.IPv6.isValidCIDR(e)||p.IPv4.isValidCIDR(e)},p.parse=function(e){if(p.IPv6.isValid(e))return p.IPv6.parse(e);if(p.IPv4.isValid(e))return p.IPv4.parse(e);throw Error("ipaddr: the address has neither IPv6 nor IPv4 format")},p.parseCIDR=function(e){try{return p.IPv6.parseCIDR(e)}catch(t){try{return p.IPv4.parseCIDR(e)}catch(e){throw Error("ipaddr: the address has neither IPv6 nor IPv4 CIDR format")}}},p.process=function(e){let t=this.parse(e);return"ipv6"===t.kind()&&t.isIPv4MappedAddress()?t.toIPv4Address():t},p.subnetMatch=function(e,t,n){let i,r,o,s;for(r in null==n&&(n="unicast"),t)if(Object.prototype.hasOwnProperty.call(t,r)){for(!(o=t[r])[0]||o[0]instanceof Array||(o=[o]),i=0;i<o.length;i++)if(s=o[i],e.kind()===s[0].kind()&&e.match.apply(e,s))return r}return n},e.exports?e.exports=p:t.ipaddr=p}(this)},533(e,t,n){let i;var r=n(961),o=n(334);Object.freeze({maximumArrayItems:1024,maximumDepth:32,maximumDocumentBytes:1048576,maximumProperties:2048,maximumSchemaBytes:524288,maximumStringBytes:262144});class s extends Error{diagnostics;constructor(e,t){super(e),this.name="ConfigContractError",this.diagnostics=t}}function a(e){return function e(t,n){if(null!==t&&"boolean"!=typeof t&&"string"!=typeof t&&!("number"==typeof t&&Number.isFinite(t)&&(!Number.isInteger(t)||Number.isSafeInteger(t)))){if(Array.isArray(t))return void t.forEach((t,i)=>{e(t,p(n,String(i)))});if(function(e){if("object"!=typeof e||null===e||Array.isArray(e))return!1;let t=Object.getPrototypeOf(e);return t===Object.prototype||function(e){if("object"!=typeof e||null===e||null!==Object.getPrototypeOf(e))return!1;let t=e.constructor;return"function"==typeof t&&"Object"===t.name&&t.prototype===e}(t)}(t))return void Object.entries(t).forEach(([t,i])=>{if(!d(t))throw function(e,t){return new s("Invalid JSON object key.",[f("json.unicode","Object keys must contain well-formed Unicode.",p(e,t))])}(n,t);e(i,p(n,t))});throw new s("Value is not canonical JSON.",[f("json.value","Only finite, safe JSON values are accepted.",n)])}}(e,""),function e(t){let n,i;if(null===t)return"null";if("boolean"==typeof t)return t?"true":"false";if("number"==typeof t)return Object.is(t,-0)?"0":JSON.stringify(t);if("string"==typeof t){if(!d(t))throw new s("Invalid Unicode string.",[f("json.unicode","Strings must contain well-formed Unicode.","")]);return JSON.stringify(t)}return Array.isArray(t)?`[${(i="",t.map(t=>"string"==typeof t?(t!==n&&(i=e(t),n=t),i):(n=void 0,e(t)))).join(",")}]`:`{${Object.keys(t).sort().map(n=>`${JSON.stringify(n)}:${e(t[n])}`).join(",")}}`}(e)}function c(e){return new TextEncoder().encode(a(e))}function u(e){return function(e){let t=function(){if(!l){let e=function(){let e=globalThis.process?.getBuiltinModule;try{return e?.("node:crypto")}catch{return}}();i="function"==typeof e?.hash?e.hash.bind(e):void 0,l=!0}return i}();if(t)return`sha256:${t("sha256",e,"hex")}`;let n="string"==typeof e?new TextEncoder().encode(e):e;return`sha256:${(0,o.bytesToHex)((0,r.sha256)(n))}`}(e instanceof Uint8Array?e:a(e))}Object.freeze({maximumCurrentWindowMs:9e5,maximumFutureNotBeforeMs:9e5,maximumStaleWindowMs:864e5,version:"runbound.config.freshness-policy.v1"});let l=!1;function d(e){return!/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u.test(e)}function p(e,t){return`${e}/${t.replaceAll("~","~0").replaceAll("/","~1")}`}function f(e,t,n){return{code:e,message:t,path:n}}n.d(t,{$h:()=>s,Mr:()=>c,dj:()=>a,sI:()=>u})},595(e,t,n){var i=n(533),r=n(88),o=n(187);function s(e){if((0,r.cg)(e.contextContract),(0,i.sI)(e.contextContract)!==e.ir.contextContractDigest)throw f("audience.contextDigest","Decision IR does not bind the supplied context contract.","/contextContractDigest");if(e.ir.configId!==e.contextContract.configId||e.ir.projectId!==e.contextContract.projectId)throw f("audience.configIdentity","Decision IR and context contract must bind one exact Config resource.","/configId");let t=e.ir.decisions.filter(({delivery:t})=>t.allowedAudiences.includes(e.audience));if(0===t.length)throw f("audience.empty","Audience projection contains no authorized decisions.","/decisions");let n=new Set(t.map(({decisionId:e})=>e));for(let e of t)for(let t of e.prerequisites)if(!n.has(t.decisionId))throw f("audience.privatePrerequisite","Audience projection depends on a decision unavailable to that audience.",`/decisions/${d(e.decisionId)}/prerequisites`);let s=Object.fromEntries(t.map(({decisionId:t})=>[t,e.ir.rules[t]??[]]).sort(([e],[t])=>l(e,t))),a=Object.values(s).flatMap(e=>e.flatMap(({condition:e})=>(function e(t){return"all"in t?t.all.flatMap(e):"any"in t?t.any.flatMap(e):"not"in t?e(t.not):"segment"in t?[t.segment]:[]})(e)));for(let t of Object.values(s))for(let n of t)for(let t of function e(t){return"all"in t?t.all.flatMap(e):"any"in t?t.any.flatMap(e):"not"in t?e(t.not):"segment"in t?[]:[t]}(n.condition))(0,r._j)(e.contextContract,t);let u=new Set,p=[];for(let t of a){let n=(e.segmentRevisions??[]).filter(e=>e.segmentId===t.segmentId&&e.sourceRevision===t.sourceRevision);if(1!==n.length)throw f("audience.segmentRevision","Audience projection must resolve one exact immutable segment revision.",`/segments/${d(t.segmentId)}`);let r=n[0];if((0,o.vd)(r),r.configId!==e.ir.configId||r.projectId!==e.ir.projectId||r.tenantId!==e.contextContract.tenantId)throw f("audience.segmentIdentity","Audience segment revision does not bind the exact Config resource.",`/segments/${d(t.segmentId)}`);let s=(0,i.sI)(r);if(!e.ir.segmentRevisionDigests.includes(s))throw f("audience.segmentDigest","Audience segment revision is not bound by the canonical decision IR.",`/segments/${d(t.segmentId)}`);u.add(s),p.push(r)}if("localPublic"===e.audience){if(t.some(e=>(e.targets?.length??0)>0))throw f("audience.privateDirectTarget","Local-public projections cannot expose raw exact-target unit keys.","/decisions");for(let t of p){if(!t.publicEligible||"rule"!==t.source.type)throw f("audience.privateSegmentMembership","Local-public projections cannot expose private segment membership.",`/segments/${d(t.segmentId)}`);c(e.contextContract,new Set([t.segmentId]),{[t.segmentId]:[{condition:t.source.expression}]})}c(e.contextContract,n,s)}let m=[...u].sort(l),g={canonicalProgramDigest:e.ir.canonicalProgramDigest,configId:e.ir.configId,contextContractDigest:e.ir.contextContractDigest,decisions:t,formatVersion:"runbound.config.decision-ir.v1",projectId:e.ir.projectId,rules:s,segmentRevisionDigests:m},h=(0,i.sI)(g),v={audience:e.audience,canonicalProgramDigest:e.ir.canonicalProgramDigest,configId:e.ir.configId,contextContractDigest:e.ir.contextContractDigest,formatVersion:"runbound.config.audience-artifact.v1",ir:g,projectId:e.ir.projectId,projectionDigest:h,segmentRevisionDigests:m},I=(0,i.Mr)(v).byteLength,y="localPublic"===e.audience?r.LO.maximumPublicArtifactBytes:r.LO.maximumPrivateArtifactBytes;if(I>y)throw f("audience.size",`Audience artifact exceeds its ${y}-byte limit.`,"");return v}function a(e){let t=[];if(!u(e))throw f("activationSet.shape","Decisioning activation set must be an object.","");for(let n of(function(e,t,n){let i=new Set(t);for(let t of Object.keys(e))i.has(t)||n.push(p("decisioning.unknownField","Field is not declared by the contract.",`/${d(t)}`))}(e,["activationSetId","allocationManifestDigest","appId","assignmentId","audience","audienceArtifactDigest","baseActivationIds","channel","configId","consumerRegistrationId","contextContractDigest","environmentId","formatVersion","keyId","projectId","sequence","signature","signatureAlgorithm","softwareReleaseIds","tenantId"],t),"runbound.config.targeted-activation-set.v1"!==e.formatVersion&&t.push(p("activationSet.version","Decisioning activation-set version is unsupported.","/formatVersion")),["allocationManifestDigest","audienceArtifactDigest","contextContractDigest"]))"string"==typeof e[n]&&/^sha256:[0-9a-f]{64}$/u.test(e[n])||t.push(p("activationSet.digest","Activation-set digest must be canonical SHA-256.",`/${n}`));for(let n of["activationSetId","appId","assignmentId","channel","configId","consumerRegistrationId","environmentId","keyId","projectId","tenantId","signature"])("string"!=typeof e[n]||0===e[n].length)&&t.push(p("activationSet.field","Activation-set field must be non-empty.",`/${n}`));for(let n of("string"==typeof e.audience&&["edge","localPrivate","localPublic","remote"].includes(e.audience)||t.push(p("activationSet.audience","Activation-set audience is unsupported.","/audience")),["baseActivationIds","softwareReleaseIds"]))(!Array.isArray(e[n])||0===e[n].length||new Set(e[n]).size!==e[n].length||e[n].some(e=>"string"!=typeof e||0===e.length))&&t.push(p("activationSet.members","Activation-set members must be a non-empty unique string list.",`/${n}`));if((!Number.isSafeInteger(e.sequence)||1>Number(e.sequence))&&t.push(p("activationSet.sequence","Activation-set sequence must be a positive safe integer.","/sequence")),"ECDSA_SHA_256"!==e.signatureAlgorithm&&"Ed25519"!==e.signatureAlgorithm&&t.push(p("activationSet.signatureAlgorithm","Activation-set signature algorithm is unsupported.","/signatureAlgorithm")),function e(t){return null===t||"boolean"==typeof t||"string"==typeof t||("number"==typeof t?Number.isFinite(t):Array.isArray(t)?t.every(e):u(t)&&Object.values(t).every(e))}(e)&&(0,i.Mr)(e).byteLength>r.LO.maximumActivationSetBytes&&t.push(p("activationSet.size","Decisioning activation set exceeds its byte limit.","")),t.length>0)throw new i.$h("Invalid Runbound Config decisioning activation set.",t)}function c(e,t,n){let i=new Map(e.kinds.flatMap(e=>e.attributes.map(t=>[`${e.kind}\0${t.path}`,t])));for(let e of t)for(let t of n[e]??[])for(let n of function e(t){return"all"in t?t.all.flatMap(e):"any"in t?t.any.flatMap(e):"not"in t?e(t.not):"segment"in t?[]:[t]}(t.condition)){let t=i.get(`${n.contextKind}\0${n.path}`);if(!t?.publicRuleEligible||"public"!==t.sensitivity||"authenticatedWorkload"===t.source||"serverEnriched"===t.source)throw f("audience.privateContext","Local-public projection depends on a private or unavailable context attribute.",`/rules/${d(e)}/${d(n.path)}`)}}function u(e){return"object"==typeof e&&null!==e&&!Array.isArray(e)}function l(e,t){return e<t?-1:+(e>t)}function d(e){return e.replaceAll("~","~0").replaceAll("/","~1")}function p(e,t,n){return{code:e,message:t,path:n}}function f(e,t,n){return new i.$h(t,[p(e,t,n)])}n.d(t,{O:()=>s,X:()=>a})},796(e,t,n){var i=n(533),r=n(88),o=n(187),s=n(692);function a(e){let t=[];if(!b(e)){var n,o;throw n="decisionProgram.shape",o="Decision program must be an object.",new i.$h(o,[R(n,o,"")])}y(e,["configId","contextContractDigest","decisions","formatVersion","programRevisionId","projectId","rules","segmentRevisionIds","tenantId"],"",t),"runbound.config.decision-program.v1"!==e.formatVersion&&t.push(R("decisionProgram.version","Decision program version is unsupported.","/formatVersion")),I(e.contextContractDigest,"/contextContractDigest",t),h(e.configId,"/configId",t),h(e.programRevisionId,"/programRevisionId",t),h(e.projectId,"/projectId",t),h(e.tenantId,"/tenantId",t),!Array.isArray(e.segmentRevisionIds)||e.segmentRevisionIds.length>r.LO.maximumSegmentsPerProgram||new Set(e.segmentRevisionIds).size!==e.segmentRevisionIds.length?t.push(R("decisionProgram.segments",`Segment revisions must be unique and cannot exceed ${r.LO.maximumSegmentsPerProgram}.`,"/segmentRevisionIds")):e.segmentRevisionIds.forEach((e,n)=>{I(e,`/segmentRevisionIds/${n}`,t)}),(!Array.isArray(e.decisions)||0===e.decisions.length||e.decisions.length>r.LO.maximumDecisionsPerProgram)&&t.push(R("decisionProgram.decisionCount",`Decision program must contain 1 to ${r.LO.maximumDecisionsPerProgram} decisions.`,"/decisions"));let s=new Map;Array.isArray(e.decisions)&&e.decisions.forEach((e,n)=>{!function(e,t,n,i){let o=`/decisions/${t}`;if(!b(e))return i.push(R("decision.shape","Decision must be an object.",o));if(y(e,["decisionId","delivery","description","disabledVariationId","fallthroughVariationId","fallback","openFeaturePrimaryContextKind","prerequisites","targets","valueSchema","variations"],o,i),h(e.decisionId,`${o}/decisionId`,i),h(e.openFeaturePrimaryContextKind,`${o}/openFeaturePrimaryContextKind`,i),("string"!=typeof e.description||0===e.description.length)&&i.push(R("decision.description","Decision description is required.",`${o}/description`)),b(e.delivery)){y(e.delivery,["allowedAudiences","publicRuleApproved"],`${o}/delivery`,i);let t=["edge","localPrivate","localPublic","remote"];(!Array.isArray(e.delivery.allowedAudiences)||0===e.delivery.allowedAudiences.length||new Set(e.delivery.allowedAudiences).size!==e.delivery.allowedAudiences.length||e.delivery.allowedAudiences.some(e=>"string"!=typeof e||!t.includes(e)))&&i.push(R("decision.deliveryAudience","Decision delivery audiences must be non-empty, unique, and supported.",`${o}/delivery/allowedAudiences`)),"boolean"!=typeof e.delivery.publicRuleApproved&&i.push(R("decision.publicRuleApproval","Public-rule approval must be boolean.",`${o}/delivery/publicRuleApproved`)),Array.isArray(e.delivery.allowedAudiences)&&e.delivery.allowedAudiences.includes("localPublic")&&!0!==e.delivery.publicRuleApproved&&i.push(R("decision.publicRuleApproval","Local-public delivery requires explicit public-rule approval.",`${o}/delivery`))}else i.push(R("decision.deliveryShape","Decision delivery policy must be an object.",`${o}/delivery`));if("string"==typeof e.decisionId&&(n.has(e.decisionId)?i.push(R("decision.duplicate","Decision identity is duplicated.",`${o}/decisionId`)):n.set(e.decisionId,e)),!Array.isArray(e.variations)||0===e.variations.length||e.variations.length>r.LO.maximumVariationsPerDecision)return i.push(R("decision.variationCount","Decision variation count is outside its bound.",`${o}/variations`));let s=new Set;for(let t of(e.variations.forEach((e,t)=>{b(e)?(y(e,["description","value","variationId"],`${o}/variations/${t}`,i),h(e.variationId,`${o}/variations/${t}/variationId`,i),"string"==typeof e.variationId&&(s.has(e.variationId)&&i.push(R("variation.duplicate","Variation identity is duplicated.",`${o}/variations/${t}/variationId`)),s.add(e.variationId)),x(e.value)||i.push(R("variation.value","Variation value must be canonical JSON.",`${o}/variations/${t}/value`))):i.push(R("variation.shape","Variation must be an object.",`${o}/variations/${t}`))}),["fallthroughVariationId","disabledVariationId"]))void 0===e[t]||"string"==typeof e[t]&&s.has(e[t])||i.push(R("decision.variationReference",`${t} must reference a declared variation.`,`${o}/${t}`));if(void 0!==e.targets&&(!Array.isArray(e.targets)||e.targets.length>r.LO.maximumDirectTargetsPerDecision))i.push(R("decision.targetCount",`Decision direct targets cannot exceed ${r.LO.maximumDirectTargetsPerDecision}.`,`${o}/targets`));else if(Array.isArray(e.targets)){let t=new Set,n=new Set;e.targets.forEach((e,r)=>{let a=`${o}/targets/${r}`;if(!b(e))return void i.push(R("decision.targetShape","Direct target must be an object.",a));if(y(e,["contextKind","targetId","unitKey","variationId"],a,i),h(e.contextKind,`${a}/contextKind`,i),h(e.targetId,`${a}/targetId`,i),v(e.unitKey,`${a}/unitKey`,i),"string"==typeof e.variationId&&s.has(e.variationId)||i.push(R("decision.targetVariation","Direct target must reference a declared variation.",`${a}/variationId`)),"string"==typeof e.targetId&&(t.has(e.targetId)&&i.push(R("decision.targetDuplicate","Direct target identity is duplicated.",`${a}/targetId`)),t.add(e.targetId)),"string"==typeof e.contextKind&&"string"==typeof e.unitKey){let t=`${e.contextKind}\0${e.unitKey}`;n.has(t)&&i.push(R("decision.targetAmbiguous","A context identity cannot have multiple direct targets in one decision.",a)),n.add(t)}})}if(!Array.isArray(e.prerequisites)||e.prerequisites.length>r.LO.maximumDirectPrerequisites)i.push(R("decision.prerequisiteCount","Decision prerequisite count is outside its bound.",`${o}/prerequisites`));else{let t=new Set;e.prerequisites.forEach((e,n)=>{let r=`${o}/prerequisites/${n}`;b(e)?(y(e,["decisionId","variationIds"],r,i),h(e.decisionId,`${r}/decisionId`,i),"string"==typeof e.decisionId&&t.has(e.decisionId)&&i.push(R("decision.prerequisiteDuplicate","Prerequisite decision is duplicated.",`${r}/decisionId`)),"string"==typeof e.decisionId&&t.add(e.decisionId),(!Array.isArray(e.variationIds)||0===e.variationIds.length||new Set(e.variationIds).size!==e.variationIds.length||e.variationIds.some(e=>"string"!=typeof e))&&i.push(R("decision.prerequisiteVariations","Prerequisite variations must be a non-empty unique string list.",`${r}/variationIds`))):i.push(R("decision.prerequisiteShape","Prerequisite must be an object.",r))})}}(e,n,s,t)});let a=0,c=0;if(b(e.rules))for(let[n,i]of Object.entries(e.rules)){let e=s.get(n);if(!e){t.push(R("decisionProgram.ruleDecision","Rules reference an unknown decision.",`/rules/${A(n)}`));continue}if(!Array.isArray(i)||i.length>r.LO.maximumRulesPerDecision){t.push(R("decisionProgram.ruleCount",`A decision cannot exceed ${r.LO.maximumRulesPerDecision} rules.`,`/rules/${A(n)}`));continue}a+=i.length;let o=0;i.forEach((i,s)=>{o+=function(e,t,n,i){if(!b(e))return i.push(R("rule.shape","Decision rule must be an object.",n)),0;y(e,["allocation","condition","ruleId","schedule","variationId"],n,i),h(e.ruleId,`${n}/ruleId`,i);let o=new Set(t.variations.map(({variationId:e})=>e));void 0===e.variationId||"string"==typeof e.variationId&&o.has(e.variationId)||i.push(R("rule.variation","Rule references an unknown variation.",`${n}/variationId`)),void 0===e.variationId==(void 0===e.allocation)&&i.push(R("rule.outcome","Rule must select exactly one variation or allocation.",n));let s=function e(t,n,i,o){var s;if(i>r.LO.maximumRuleBooleanDepth)return o.push(R("rule.depth","Rule exceeds its boolean depth limit.",n)),0;if(!b(t))return o.push(R("rule.expression","Rule expression must be an object.",n)),0;if("all"in t||"any"in t){let r="all"in t?"all":"any";y(t,[r],n,o);let s=t[r];return!Array.isArray(s)||s.length<2?(o.push(R("rule.expressionParts","Boolean groups require at least two children.",`${n}/${r}`)),0):s.reduce((t,s,a)=>t+e(s,`${n}/${r}/${a}`,i+1,o),0)}if("not"in t)return y(t,["not"],n,o),e(t.not,`${n}/not`,i+1,o);if("segment"in t)return(y(t,["segment"],n,o),b(t.segment))?(y(t.segment,["segmentId","sourceRevision"],`${n}/segment`,o),h(t.segment.segmentId,`${n}/segment/segmentId`,o),v(t.segment.sourceRevision,`${n}/segment/sourceRevision`,o)):o.push(R("rule.segmentShape","Segment membership must name one immutable revision.",`${n}/segment`)),1;return y(t,["contextKind","expected","operator","path"],n,o),h(t.contextKind,`${n}/contextKind`,o),h(t.path,`${n}/path`,o),"string"!=typeof t.operator&&o.push(R("rule.operator","Rule operator is required.",`${n}/operator`)),null===(s=t.expected)||"boolean"==typeof s||"string"==typeof s||"number"==typeof s&&Number.isFinite(s)||Array.isArray(s)&&s.every(e=>"string"==typeof e)||o.push(R("rule.expected","Rule expected value is invalid.",`${n}/expected`)),1}(e.condition,`${n}/condition`,1,i);if(s>r.LO.maximumRuleClauses&&i.push(R("rule.clauseCount","Rule exceeds its clause limit.",`${n}/condition`)),void 0!==e.allocation&&function(e,t,n,i){if(!b(e))return i.push(R("allocation.shape","Rule allocation must be an object.",n));if(y(e,["allocationNamespace","missingRandomizationUnitPolicy","randomizationContextKind","ranges","reassignmentEpoch","reassignmentPolicy","reservationClass","revision","salt"],n,i),h(e.allocationNamespace,`${n}/allocationNamespace`,i),h(e.randomizationContextKind,`${n}/randomizationContextKind`,i),/^[0-9a-f]{32}$/u.test(String(e.salt))||i.push(R("allocation.salt","Allocation salt must be lowercase 128-bit hex.",`${n}/salt`)),(!Number.isSafeInteger(e.revision)||1>Number(e.revision))&&i.push(R("allocation.revision","Allocation revision must be positive.",`${n}/revision`)),(!Number.isSafeInteger(e.reassignmentEpoch)||1>Number(e.reassignmentEpoch))&&i.push(R("allocation.reassignmentEpoch","Allocation reassignment epoch must be a positive safe integer.",`${n}/reassignmentEpoch`)),"error"!==e.missingRandomizationUnitPolicy&&"fallthrough"!==e.missingRandomizationUnitPolicy&&i.push(R("allocation.missingRandomizationUnitPolicy","Allocation missing-randomization-unit policy is unsupported.",`${n}/missingRandomizationUnitPolicy`)),"explicitLedger"!==e.reassignmentPolicy&&"rebucket"!==e.reassignmentPolicy&&"stickyExpansion"!==e.reassignmentPolicy&&i.push(R("allocation.reassignmentPolicy","Allocation reassignment policy is unsupported.",`${n}/reassignmentPolicy`)),"experiment"!==e.reservationClass&&"holdout"!==e.reservationClass&&"rollout"!==e.reservationClass&&i.push(R("allocation.reservationClass","Allocation reservation class is unsupported.",`${n}/reservationClass`)),!Array.isArray(e.ranges)||0===e.ranges.length||e.ranges.length>r.LO.maximumAllocationRangesPerRule)return i.push(R("allocation.ranges","Allocation range count is outside its bound.",`${n}/ranges`));let o=0;e.ranges.forEach((e,s)=>{let a=`${n}/ranges/${s}`;b(e)?(y(e,["end","start","variationId"],a,i),(!Number.isInteger(e.start)||!Number.isInteger(e.end)||Number(e.start)<o||0>Number(e.start)||Number(e.end)<=Number(e.start)||Number(e.end)>r.LO.slotCount)&&i.push(R("allocation.range","Allocation ranges must be ordered, non-overlapping half-open slots.",a)),o=Number(e.end),void 0===e.variationId||"string"==typeof e.variationId&&t.has(e.variationId)||i.push(R("allocation.variation","Allocation range references an unknown variation.",`${a}/variationId`))):i.push(R("allocation.rangeShape","Allocation range must be an object.",a))})}(e.allocation,o,`${n}/allocation`,i),void 0!==e.schedule)if(b(e.schedule)){for(let t of(y(e.schedule,["endsAt","startsAt"],`${n}/schedule`,i),["startsAt","endsAt"]))void 0===e.schedule[t]||(0,r.xI)(e.schedule[t])||i.push(R("rule.scheduleTime","Rule schedule time must be valid.",`${n}/schedule/${t}`));"string"==typeof e.schedule.startsAt&&"string"==typeof e.schedule.endsAt&&Date.parse(e.schedule.startsAt)>=Date.parse(e.schedule.endsAt)&&i.push(R("rule.scheduleOrder","Rule schedule must end after it starts.",`${n}/schedule`))}else i.push(R("rule.scheduleShape","Rule schedule must be an object.",`${n}/schedule`));return s}(i,e,`/rules/${A(n)}/${s}`,t)}),c+=o,o>r.LO.maximumRuleClausesPerDecision&&t.push(R("decisionProgram.decisionClauseCount",`A decision cannot exceed ${r.LO.maximumRuleClausesPerDecision} rule clauses.`,`/rules/${A(n)}`))}else t.push(R("decisionProgram.rulesShape","Rules must be an object.","/rules"));if(a>r.LO.maximumProgramRules&&t.push(R("decisionProgram.totalRules","Decision program exceeds the total rule limit.","/rules")),c>r.LO.maximumProgramClauses&&t.push(R("decisionProgram.totalClauses","Decision program exceeds the total clause limit.","/rules")),function(e,t){let n=(i,o,s,a,c)=>{if(s>r.LO.maximumPrerequisiteDepth)return void t.push(R("decision.prerequisiteDepth","Prerequisite graph exceeds its depth limit.",`/decisions/${A(i)}`));if(o.has(i))return void t.push(R("decision.prerequisiteCycle","Prerequisite graph contains a cycle.",`/decisions/${A(i)}`));let u=e.get(i);if(u&&Array.isArray(u.prerequisites)){for(let l of(o.add(i),u.prerequisites)){if(!b(l)||"string"!=typeof l.decisionId)continue;let u=e.get(l.decisionId);if(!u){t.push(R("decision.prerequisiteMissing","Prerequisite references an unknown decision.",`/decisions/${A(i)}/prerequisites`));continue}if(l.decisionId!==c&&!a.has(l.decisionId)&&(a.add(l.decisionId),a.size>r.LO.maximumDependencyNodesPerEvaluation))return void t.push(R("decision.prerequisiteNodes","Prerequisite graph exceeds its per-evaluation dependency-node limit.",`/decisions/${A(c)}/prerequisites`));let d=new Set(u.variations.map(({variationId:e})=>e));if((!Array.isArray(l.variationIds)||0===l.variationIds.length||l.variationIds.some(e=>!d.has(e)))&&t.push(R("decision.prerequisiteVariation","Prerequisite references an unknown variation.",`/decisions/${A(i)}/prerequisites`)),n(l.decisionId,o,s+1,a,c),a.size>r.LO.maximumDependencyNodesPerEvaluation)break}o.delete(i)}};for(let t of e.keys())n(t,new Set,1,new Set,t)}(s,t),x(e)&&(0,i.Mr)(e).byteLength>r.LO.maximumProgramIrBytes&&t.push(R("decisionProgram.size","Decision program exceeds the canonical IR byte limit.","")),0===t.length&&t.push(...(function(e){let t=[],n=new Map((void 0)??[]),r=new Map(e.decisions.map(e=>[e.decisionId,e]));for(let[n,o]of Object.entries(e.rules)){let e=r.get(n),s=o.map(e=>(0,i.sI)(e.condition));o.forEach((i,r)=>{let a=`/rules/${A(n)}/${r}`;for(let e=0;e<r;e+=1)if(s[e]===s[r]&&function(e,t){let n=e.schedule?.startsAt?Date.parse(e.schedule.startsAt):-1/0,i=e.schedule?.endsAt?Date.parse(e.schedule.endsAt):1/0,r=t.schedule?.startsAt?Date.parse(t.schedule.startsAt):-1/0;return n<(t.schedule?.endsAt?Date.parse(t.schedule.endsAt):1/0)&&r<i}(o[e],i)){t.push(R("decisionProgram.overlappingRule","This ordered rule has the same condition as an earlier rule during an overlapping schedule.",a)),function(e,t){let n=e.schedule?.startsAt?Date.parse(e.schedule.startsAt):-1/0,i=e.schedule?.endsAt?Date.parse(e.schedule.endsAt):1/0,r=t.schedule?.startsAt?Date.parse(t.schedule.startsAt):-1/0,o=t.schedule?.endsAt?Date.parse(t.schedule.endsAt):1/0;return n<=r&&i>=o}(o[e],i)&&t.push(R("decisionProgram.unreachableRule","An earlier rule with the same condition covers this rule's complete schedule.",a));break}!1;e?.delivery.allowedAudiences.includes("localPublic")&&((e.targets?.length??0)>0&&t.push(R("decisionProgram.publicLeak","A local-public decision contains raw exact-target identities.",`/decisions/${A(n)}/targets`)),function e(t){return"all"in t?t.all.some(e):"any"in t?t.any.some(e):"not"in t?e(t.not):"segment"in t}(i.condition)&&t.push(R("decisionProgram.publicSegmentReview","A local-public segment reference requires audience-projection review.",`${a}/condition`)))})}return t})(e).filter(({code:e})=>"decisionProgram.unreachableRule"===e)),t.length>0)throw new i.$h("Invalid Runbound Config decision program.",t)}function c(e){return(0,r.YU)(e.contextContract,e.context),function(e){if("runbound.config.decision-ir.v1"!==e.ir.formatVersion||e.ir.configId!==e.contextContract.configId||e.ir.projectId!==e.projectId||e.contextContract.projectId!==e.projectId||e.contextContract.tenantId!==e.tenantId)return d(e,{errorCode:"PARSE_ERROR",reason:"ERROR"},[]);let t=(void 0)??new Map(e.ir.decisions.map(e=>[e.decisionId,e])),n=[],a=function e(t,n,s,a,c){let d;if(!u(c))return{errorCode:"GENERAL",reason:"ERROR"};let f=s.get(t);if(!f)return{errorCode:"FLAG_NOT_FOUND",reason:"ERROR"};if(c.active.has(t))return{errorCode:"PARSE_ERROR",reason:"ERROR"};c.active.add(t);let m=new Map(f.variations.map(e=>[e.variationId,e]));try{d=n.resolveOverride?.(t)}catch{return c.active.delete(t),{errorCode:"GENERAL",reason:"ERROR"}}if(d)return(a.push({decisionId:t,outcome:d.variationId,step:"override",subjectId:d.overrideId}),c.active.delete(t),m.has(d.variationId))?{...l(f,m,d.variationId,"TARGETING_MATCH"),matchedId:d.overrideId,overrideSource:"localTest"}:{errorCode:"PARSE_ERROR",reason:"ERROR"};if(f.disabledVariationId)return a.push({decisionId:t,outcome:f.disabledVariationId,step:"fallthrough"}),c.active.delete(t),l(f,m,f.disabledVariationId,"DISABLED");for(let i of f.prerequisites){let r=e(i.decisionId,n,s,a,c);if(c.exhausted)return c.active.delete(t),{errorCode:"GENERAL",reason:"ERROR"};if(a.push({decisionId:t,outcome:r.variationId??r.errorCode??"unavailable",step:"prerequisite",subjectId:i.decisionId}),"ERROR"===r.reason||!r.variationId||!i.variationIds.includes(r.variationId))return c.active.delete(t),l(f,m,f.fallthroughVariationId,"DEFAULT")}for(let e of f.targets??[]){if(!u(c))return c.active.delete(t),{errorCode:"GENERAL",reason:"ERROR"};let i=n.context.kinds.find(({kind:t})=>t===e.contextKind);if(i?.key===e.unitKey)return a.push({decisionId:t,outcome:e.variationId,step:"target",subjectId:e.targetId}),c.active.delete(t),{...l(f,m,e.variationId,"TARGETING_MATCH"),matchedId:e.targetId}}for(let e of n.ir.rules[t]??[]){if(!u(c))return c.active.delete(t),{errorCode:"GENERAL",reason:"ERROR"};if(!function(e,t){if(!e.schedule)return!0;let n=t.getTime();return(void 0===e.schedule.startsAt||Date.parse(e.schedule.startsAt)<=n)&&(void 0===e.schedule.endsAt||n<Date.parse(e.schedule.endsAt))}(e,n.now??new Date))continue;let s=function e(t,n,s,a,c){if(!u(c))return{errorCode:"GENERAL",matched:!1};if("all"in t){for(let i of t.all){let t=e(i,n,s,a,c);if(t.errorCode||!t.matched)return t}return{matched:!0}}if("any"in t){for(let i of t.any){let t=e(i,n,s,a,c);if(t.errorCode||t.matched)return t}return{matched:!1}}if("not"in t){let i=e(t.not,n,s,a,c);return i.errorCode?i:{matched:!i.matched}}if("segment"in t){let e=(n.segmentRevisions??[]).filter(e=>e.configId===n.ir.configId&&e.projectId===n.projectId&&e.tenantId===n.tenantId&&e.segmentId===t.segment.segmentId&&e.sourceRevision===t.segment.sourceRevision);if(1!==e.length||!n.ir.segmentRevisionDigests.includes((0,i.sI)(e[0])))return s.push({decisionId:a,outcome:"REVISION_MISSING",step:"segment",subjectId:t.segment.segmentId}),{errorCode:"PARSE_ERROR",matched:!1};try{let t=(0,o.Ud)({audience:n.audience,context:n.context,contextContract:n.contextContract,externalMembership:n.externalSegmentMembership,now:n.now,revision:e[0]});return s.push({decisionId:a,outcome:t.reason,step:"segment",subjectId:t.segmentId,subjectRevision:t.revision,subjectSourceRevision:t.sourceRevision}),{matched:t.matched}}catch(n){let e=n instanceof i.$h?n.diagnostics[0]?.code??"segment.error":"segment.error";return s.push({decisionId:a,outcome:e,step:"segment",subjectId:t.segment.segmentId}),{errorCode:"segment.missingContext"===e?"INVALID_CONTEXT":"segment.stale"===e||"segment.sourceUnavailable"===e?"GENERAL":"PARSE_ERROR",matched:!1}}}return{matched:function(e,t,n){let i=t.kinds.find(({kind:t})=>t===e.contextKind),o=n.kinds.find(({kind:t})=>t===e.contextKind)?.attributes.find(({path:t})=>t===e.path),s=!!i&&Object.hasOwn(i.attributes,e.path),a=i?.attributes[e.path];if("exists"===e.operator)return s;if(!s||null==a)return!1;switch(e.operator){case"equals":return g(a,e.expected);case"notEquals":return!g(a,e.expected);case"greaterThan":return p(a,e.expected,o)>0;case"greaterThanOrEqual":return p(a,e.expected,o)>=0;case"lessThan":return 0>p(a,e.expected,o);case"lessThanOrEqual":return 0>=p(a,e.expected,o);case"prefix":return"string"==typeof a&&"string"==typeof e.expected&&a.startsWith(e.expected);case"suffix":return"string"==typeof a&&"string"==typeof e.expected&&a.endsWith(e.expected);case"substring":return"string"==typeof a&&"string"==typeof e.expected&&a.includes(e.expected);case"inSet":return Array.isArray(e.expected)&&e.expected.some(e=>g(a,e));case"intersects":{let t=e.expected;if(!C(a)||!C(t))return!1;return a.some(e=>t.includes(e))}case"ipInCidr":return"string"==typeof a&&"string"==typeof e.expected&&(0,r.H$)(a,e.expected);default:return!1}}(t,n.context,n.contextContract)}}(e.condition,n,a,t,c);if(s.errorCode)return c.active.delete(t),{errorCode:s.errorCode,reason:"ERROR"};if(s.matched){if(a.push({decisionId:t,outcome:"matched",step:"rule",subjectId:e.ruleId}),e.variationId)return c.active.delete(t),{...l(f,m,e.variationId,"TARGETING_MATCH"),matchedId:e.ruleId};if(e.allocation){let i=e.allocation,o=n.context.kinds.find(({kind:e})=>e===i.randomizationContextKind);if(!o){if(a.push({decisionId:t,outcome:"missing-randomization-unit",step:"allocation",subjectId:e.ruleId}),"fallthrough"===i.missingRandomizationUnitPolicy)return a.push({decisionId:t,outcome:f.fallthroughVariationId,step:"fallthrough"}),c.active.delete(t),{...l(f,m,f.fallthroughVariationId,"DEFAULT"),allocationNamespace:i.allocationNamespace,reassignmentEpoch:i.reassignmentEpoch,reservationClass:i.reservationClass};return c.active.delete(t),{errorCode:"TARGETING_KEY_MISSING",reason:"ERROR"}}if(n.resolveAllocationReservation){var h;let r;try{r=n.resolveAllocationReservation({allocationNamespace:i.allocationNamespace,allocationRevision:i.revision,decisionId:t,reassignmentEpoch:i.reassignmentEpoch,reservationClass:i.reservationClass,unitKey:o.key})}catch{return c.active.delete(t),{errorCode:"GENERAL",reason:"ERROR"}}if(r&&!(("experiment"===(h=r).reservationClass||"holdout"===h.reservationClass||"rollout"===h.reservationClass)&&"string"==typeof h.reservationId&&h.reservationId.length>0&&new TextEncoder().encode(h.reservationId).byteLength<=512))return c.active.delete(t),{errorCode:"PARSE_ERROR",reason:"ERROR"};if(a.push({decisionId:t,outcome:r?.reservationClass??"available",step:"reservation",subjectId:r?.reservationId??e.ruleId}),r)return a.push({decisionId:t,outcome:f.fallthroughVariationId,step:"fallthrough"}),c.active.delete(t),{...l(f,m,f.fallthroughVariationId,"DEFAULT"),allocationNamespace:i.allocationNamespace,reassignmentEpoch:i.reassignmentEpoch,reservationClass:r.reservationClass,reservationId:r.reservationId}}if("explicitLedger"===i.reassignmentPolicy){let e;try{e=n.resolveAssignment?.({allocationNamespace:i.allocationNamespace,allocationRevision:i.revision,decisionId:t,reassignmentEpoch:i.reassignmentEpoch,unitKey:o.key})}catch{return c.active.delete(t),{errorCode:"GENERAL",reason:"ERROR"}}if(e){if(a.push({decisionId:t,outcome:e.variationId,step:"override",subjectId:e.assignmentId}),c.active.delete(t),!m.has(e.variationId))return{errorCode:"PARSE_ERROR",reason:"ERROR"};return{...l(f,m,e.variationId,"SPLIT"),allocationNamespace:i.allocationNamespace,matchedId:e.assignmentId,overrideSource:"assignmentLedger",reassignmentEpoch:i.reassignmentEpoch,reservationClass:i.reservationClass}}}let s=(0,r.ro)({allocationNamespace:i.allocationNamespace,projectId:n.projectId,randomizationContextKind:i.randomizationContextKind,reassignmentEpoch:i.reassignmentEpoch,salt:i.salt,tenantId:n.tenantId,unitKey:o.key}),u=i.ranges.find(({end:e,start:t})=>s.bucket>=t&&s.bucket<e);if(a.push({decisionId:t,outcome:u?.variationId??"excluded",step:"allocation",subjectId:e.ruleId}),u?.variationId)return c.active.delete(t),{...l(f,m,u.variationId,"SPLIT"),allocationNamespace:i.allocationNamespace,bucket:s.bucket,matchedId:e.ruleId,reassignmentEpoch:i.reassignmentEpoch,reservationClass:i.reservationClass}}}}c.active.delete(t);let v=0===f.prerequisites.length&&(f.targets?.length??0)===0&&(n.ir.rules[t]?.length??0)===0;return a.push({decisionId:t,outcome:f.fallthroughVariationId,step:"fallthrough"}),l(f,m,f.fallthroughVariationId,v?"STATIC":"DEFAULT")}(e.decisionId,e,t,n,{active:new Set,exhausted:!1,steps:0}),c=(0,s.b)(n),f=d(e,a,c,void 0);return e.onTrace&&e.onTrace({formatVersion:"runbound.config.decision-trace.v1",steps:structuredClone(c.steps),traceDigest:f.details.traceDigest}),f}(e)}function u(e){return e.steps>=r.LO.maximumEvaluationSteps?(e.exhausted=!0,!1):(e.steps+=1,!0)}function l(e,t,n,i){let r=t.get(n);if(!r)return{errorCode:"PARSE_ERROR",reason:"ERROR"};let o=r.value;return{reason:i,value:null!==o&&"object"==typeof o?structuredClone(o):o,variationId:n}}function d(e,t,n,r){var o;let a="canonicalArrayBytes"in n?n:(0,s.b)(n),c=(0,i.sI)(a.canonicalArrayBytes),u=t.variationId&&e.configReleaseId&&e.softwareReleaseId&&e.audience?Object.values(o={activationSetId:e.activationSetId,artifactDigest:e.artifactDigest,configReleaseId:e.configReleaseId,contextDigest:r??(0,i.sI)(e.context),decisionId:e.decisionId,evaluationMode:e.audience,softwareReleaseId:e.softwareReleaseId,traceDigest:c,variationId:t.variationId}).every(e=>"string"==typeof e&&!/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u.test(e))?(0,i.sI)(new TextEncoder().encode(JSON.stringify(o))):(0,i.sI)(o):void 0;return{details:{activationSetId:e.activationSetId,allocationNamespace:t.allocationNamespace,artifactFreshness:e.artifactFreshness,artifactDigest:e.artifactDigest,bucket:t.bucket,configReleaseId:e.configReleaseId,decisionId:e.decisionId,errorCode:t.errorCode,evaluationMode:e.audience,exposureToken:u,matchedId:t.matchedId,overrideSource:t.overrideSource,reason:t.reason,reassignmentEpoch:t.reassignmentEpoch,reservationClass:t.reservationClass,reservationId:t.reservationId,softwareReleaseId:e.softwareReleaseId,traceDigest:c,variationId:t.variationId},value:t.value}}function p(e,t,n){if("number"==typeof e&&"number"==typeof t)return e-t;if("string"==typeof e&&"string"==typeof t){if(n?.type==="semanticVersion")return function(e,t){let n=f(e),i=f(t);if(!n||!i)return 0/0;for(let[e,t]of[[n.core[0],i.core[0]],[n.core[1],i.core[1]],[n.core[2],i.core[2]]]){let n=m(e,t);if(0!==n)return n}if(0===n.pre.length||0===i.pre.length)return n.pre.length===i.pre.length?0:0===n.pre.length?1:-1;let r=Math.max(n.pre.length,i.pre.length);for(let e=0;e<r;e+=1){let t=n.pre[e],r=i.pre[e];if(void 0===t||void 0===r)return t===r?0:void 0===t?-1:1;if(t===r)continue;let o=/^\d+$/u.test(t),s=/^\d+$/u.test(r);if(o&&s)return m(t,r);if(o!==s)return o?-1:1;return function(e,t){return e<t?-1:+(e>t)}(t,r)}return 0}(e,t);if(n?.type==="timestamp")return Date.parse(e)-Date.parse(t)}return 0/0}function f(e){if(!(0,r.Tx)(e))return;let t=/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u.exec(e);if(!t)return;let n=t[1],i=t[2],o=t[3];if(void 0!==n&&void 0!==i&&void 0!==o)return{core:[n,i,o],pre:t[4]?.split(".")??[]}}function m(e,t){var n,i;return e.length===t.length?(n=e)<(i=t)?-1:+(n>i):e.length-t.length}function g(e,t){return Array.isArray(e)||Array.isArray(t)?Array.isArray(e)&&Array.isArray(t)&&e.length===t.length&&e.every((e,n)=>e===t[n]):e===t}function h(e,t,n){("string"!=typeof e||0===e.length||new TextEncoder().encode(e).byteLength>512)&&n.push(R("decisioning.identifier","Identifier must contain 1 to 512 UTF-8 bytes.",t))}function v(e,t,n){("string"!=typeof e||0===e.length||new TextEncoder().encode(e).byteLength>r.LO.maximumUnitKeyBytes)&&n.push(R("decisioning.unitKey",`Unit key must contain 1 to ${r.LO.maximumUnitKeyBytes} UTF-8 bytes.`,t))}function I(e,t,n){"string"==typeof e&&/^sha256:[0-9a-f]{64}$/u.test(e)||n.push(R("decisioning.digest","Digest must be canonical SHA-256.",t))}function y(e,t,n,i){let r=new Set(t);for(let t of Object.keys(e))r.has(t)||i.push(R("decisioning.unknownField","Field is not declared by the contract.",`${n}/${A(t)}`))}function b(e){return"object"==typeof e&&null!==e&&!Array.isArray(e)}function x(e){return null===e||"boolean"==typeof e||"string"==typeof e||("number"==typeof e?Number.isFinite(e):Array.isArray(e)?e.every(x):b(e)&&Object.values(e).every(x))}function C(e){return Array.isArray(e)&&e.every(e=>"string"==typeof e)}function A(e){return e.replaceAll("~","~0").replaceAll("/","~1")}function R(e,t,n){return{code:e,message:t,path:n}}n.d(t,{DL:()=>a,UW:()=>c})},187(e,t,n){var i=n(533),r=n(88);let o=/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/u,s=new Set(["equals","exists","greaterThan","greaterThanOrEqual","inSet","intersects","lessThan","lessThanOrEqual","notEquals","prefix","substring","suffix"]);function a(e){var t,n,o;let a=[];if(!y(e))throw x("segment.shape","Segment revision must be an object.","");for(let t of(v(e,["configId","environmentId","expiresAt","formatVersion","generatedAt","missingBehavior","projectId","publicEligible","revision","segmentId","source","sourceRevision","staleBehavior","tenantId"],"",a),"runbound.config.segment-revision.v1"!==e.formatVersion&&a.push(b("segment.version","Segment revision version is unsupported.","/formatVersion")),["configId","environmentId","projectId","segmentId","tenantId"]))m(e[t],`/${t}`,a);t=e.sourceRevision,n="/sourceRevision",o=a,"string"==typeof t&&g(t,r.LO.maximumContextStringBytes)||o.push(b("decisioning.string","Value must be a bounded non-empty Unicode string.",n)),(!Number.isSafeInteger(e.revision)||1>Number(e.revision))&&a.push(b("segment.revision","Segment revision must be a positive safe integer.","/revision")),"boolean"!=typeof e.publicEligible&&a.push(b("segment.publicEligible","Segment public eligibility must be boolean.","/publicEligible")),I(e.missingBehavior,["error","exclude"],"segment.missingBehavior","/missingBehavior",a),I(e.staleBehavior,["error","exclude","useStale"],"segment.staleBehavior","/staleBehavior",a);let c=h(e.generatedAt,"/generatedAt",a),l=void 0===e.expiresAt?void 0:h(e.expiresAt,"/expiresAt",a);void 0!==c&&void 0!==l&&l<=c&&a.push(b("segment.freshnessOrder","Segment expiry must be after its generation time.","/expiresAt")),function(e,t){if(!y(e))return t.push(b("segment.sourceShape","Segment source must be an object.","/source"));if("explicit"===e.type){v(e,["contextKind","exclude","include","type"],"/source",t),m(e.contextKind,"/source/contextKind",t);let n=u(e.include,"/source/include",t),i=u(e.exclude,"/source/exclude",t);n.length+i.length>r.LO.maximumExplicitSegmentMembers&&t.push(b("segment.memberCount",`Combined explicit membership cannot exceed ${r.LO.maximumExplicitSegmentMembers}.`,"/source")),n.some(e=>i.includes(e))&&t.push(b("segment.memberConflict","Explicit include and exclude membership must be disjoint.","/source"));return}if("external"===e.type){var n,o,a;v(e,["contextKind","snapshotDigest","type"],"/source",t),m(e.contextKind,"/source/contextKind",t),n=e.snapshotDigest,o="/source/snapshotDigest",a=t,"string"==typeof n&&/^sha256:[0-9a-f]{64}$/u.test(n)||a.push(b("segment.digest","Segment digest must be canonical SHA-256.",o));return}if("rule"===e.type){v(e,["expression","type"],"/source",t),function e(t,n,o,a){var c;if(o>r.LO.maximumRuleBooleanDepth)return a.push(b("segment.ruleDepth","Segment rule exceeds its boolean depth limit.",n)),0;if(!y(t))return a.push(b("segment.ruleShape","Segment rule expression must be an object.",n)),0;if("all"in t||"any"in t){let i="all"in t?"all":"any";v(t,[i],n,a);let r=t[i];return!Array.isArray(r)||r.length<2?(a.push(b("segment.ruleParts","Segment boolean groups require at least two children.",`${n}/${i}`)),0):r.reduce((t,r,s)=>t+e(r,`${n}/${i}/${s}`,o+1,a),0)}return"not"in t?(v(t,["not"],n,a),e(t.not,`${n}/not`,o+1,a)):("segment"in t?a.push(b("segment.ruleDependency","Segment rules cannot depend on another segment.",n)):(v(t,["contextKind","expected","operator","path"],n,a),m(t.contextKind,`${n}/contextKind`,a),m(t.path,`${n}/path`,a),"string"==typeof t.operator&&s.has(t.operator)||a.push(b("segment.ruleOperator","Segment targeting operator is unsupported.",`${n}/operator`)),null===(c=t.expected)||"boolean"==typeof c||"number"==typeof c&&Number.isFinite(c)||("string"==typeof c?g(c,r.LO.maximumContextStringBytes):Array.isArray(c)&&c.length<=r.LO.maximumBoundedSetItems&&new Set(c).size===c.length&&c.every(e=>"string"==typeof e&&g(e,r.LO.maximumContextStringBytes))&&(0,i.Mr)(c).byteLength<=r.LO.maximumBoundedSetBytes)||a.push(b("segment.ruleExpected","Segment expected value is invalid.",`${n}/expected`))),1)}(e.expression,"/source/expression",1,t)>r.LO.maximumRuleClauses&&t.push(b("segment.ruleClauses","Segment rule exceeds its clause limit.","/source/expression"));return}t.push(b("segment.sourceType","Segment source type is unsupported.","/source/type"))}(e.source,a),function e(t){return null===t||"boolean"==typeof t||"string"==typeof t||("number"==typeof t?Number.isFinite(t):Array.isArray(t)?t.every(e):y(t)&&Object.values(t).every(e))}(e)&&(0,i.Mr)(e).byteLength>r.LO.maximumSegmentSnapshotBytes&&a.push(b("segment.size","Segment revision exceeds its canonical byte limit.","")),function(e,t){if(t.length>0)throw new i.$h(e,t)}("Invalid Runbound Config segment revision.",a)}function c(e){var t,n,i,o,s;let c,u,m;if(a(e.revision),(0,r.YU)(e.contextContract,e.context),"localPublic"===e.audience&&!e.revision.publicEligible)throw x("segment.publicIneligible","Segment is not eligible for local-public evaluation.","/publicEligible");"localPublic"===e.audience&&"rule"===e.revision.source.type&&(t=e.revision.source.expression,u=new Map(e.contextContract.kinds.flatMap(e=>e.attributes.map(t=>[`${e.kind}\0${t.path}`,t]))),(m=e=>{if("all"in e)return void e.all.forEach(m);if("any"in e)return void e.any.forEach(m);if("not"in e)return void m(e.not);if("segment"in e)throw x("segment.ruleDependency","Segment rules cannot depend on another segment.","/source/expression");let t=u.get(`${e.contextKind}\0${e.path}`);if(!t?.publicRuleEligible||"public"!==t.sensitivity||"authenticatedWorkload"===t.source||"serverEnriched"===t.source)throw x("segment.privateContext","Local-public segment rule depends on private or unavailable context.","/source/expression")})(t));let g=e.now??new Date;if(!Number.isFinite(g.getTime()))throw x("segment.now","Resolution time must be valid.","/now");if(g.getTime()<Date.parse(e.revision.generatedAt))throw x("segment.notCurrent","Segment revision is not current at the requested resolution time.","/generatedAt");let h=void 0!==e.revision.expiresAt&&g.getTime()>=Date.parse(e.revision.expiresAt);if(h&&"error"===e.revision.staleBehavior)throw x("segment.stale","Segment revision is stale and its policy requires an error.","/expiresAt");if(h&&"exclude"===e.revision.staleBehavior)return f(e.revision,!1,"STALE_EXCLUDED",!0);let v=e.revision.source;if("explicit"===v.type){let t=e.context.kinds.find(({kind:e})=>e===v.contextKind);c=t?v.include.includes(t.key):"missing"}else if("external"===v.type){let t=e.context.kinds.find(({kind:e})=>e===v.contextKind);if(t)if(e.externalMembership){let n=e.externalMembership({contextKind:v.contextKind,segmentId:e.revision.segmentId,snapshotDigest:v.snapshotDigest,sourceRevision:e.revision.sourceRevision,unitKey:t.key});c="match"===n||"noMatch"!==n&&"unavailable"}else c="unavailable";else c="missing"}else{c=[...function e(t,n=new Set){if("all"in t)t.all.forEach(t=>{e(t,n)});else if("any"in t)t.any.forEach(t=>{e(t,n)});else if("not"in t)e(t.not,n);else{if("segment"in t)return n;n.add(t.contextKind)}return n}(v.expression)].some(t=>!e.context.kinds.some(e=>e.kind===t))?"missing":(n=v.expression,i=e.context,o=e.contextContract,s=e.revision,function e(t,n,i){return"all"in t?t.all.every(t=>e(t,n,i)):"any"in t?t.any.some(t=>e(t,n,i)):"not"in t?!e(t.not,n,i):!("segment"in t)&&function(e,t,n){let i=t.kinds.find(({kind:t})=>t===e.contextKind),o=n.kinds.find(({kind:t})=>t===e.contextKind)?.attributes.find(({path:t})=>t===e.path),s=!!i&&Object.hasOwn(i.attributes,e.path),a=i?.attributes[e.path];if("exists"===e.operator)return s;if(!s||null==a)return!1;switch(e.operator){case"equals":return d(a,e.expected);case"notEquals":return!d(a,e.expected);case"greaterThan":return l(a,e.expected,o)>0;case"greaterThanOrEqual":return l(a,e.expected,o)>=0;case"lessThan":return 0>l(a,e.expected,o);case"lessThanOrEqual":return 0>=l(a,e.expected,o);case"prefix":return"string"==typeof a&&"string"==typeof e.expected&&a.startsWith(e.expected);case"suffix":return"string"==typeof a&&"string"==typeof e.expected&&a.endsWith(e.expected);case"substring":return"string"==typeof a&&"string"==typeof e.expected&&a.includes(e.expected);case"inSet":return Array.isArray(e.expected)&&e.expected.some(e=>d(a,e));case"intersects":{if(!p(a)||!p(e.expected))return!1;let t=e.expected;return a.some(e=>t.includes(e))}case"ipInCidr":return"string"==typeof a&&"string"==typeof e.expected&&(0,r.H$)(a,e.expected)}}(t,n,i)}(n,i,o))}if("missing"===c){if("error"===e.revision.missingBehavior)throw x("segment.missingContext","Segment resolution is missing a required context kind.","/source");return f(e.revision,!1,"MISSING_CONTEXT",h)}if("unavailable"===c){if("error"===e.revision.missingBehavior)throw x("segment.sourceUnavailable","External segment membership is unavailable.","/source");return f(e.revision,!1,"SOURCE_UNAVAILABLE",h)}return f(e.revision,c,h?"STALE_USED":c?"MATCH":"NO_MATCH",h)}function u(e,t,n){if(!Array.isArray(e)||e.length>r.LO.maximumExplicitSegmentMembers||new Set(e).size!==e.length)return n.push(b("segment.members","Explicit membership must be a unique bounded list.",t)),[];let i=[];return e.forEach((e,o)=>{var s,a,c;s=e,a=`${t}/${o}`,c=n,("string"==typeof s&&g(s,r.LO.maximumUnitKeyBytes)||(c.push(b("segment.unitKey","Segment unit key is outside its UTF-8 bound.",a)),0))&&i.push(e)}),i}function l(e,t,n){if("number"==typeof e&&"number"==typeof t)return e-t;if("string"==typeof e&&"string"==typeof t){if(n?.type==="timestamp")return Date.parse(e)-Date.parse(t);if(n?.type==="semanticVersion")return function(e,t){let n=e=>{let t=/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u.exec(e);return t?{core:[BigInt(t[1]),BigInt(t[2]),BigInt(t[3])],pre:t[4]?.split(".")??[]}:void 0},i=n(e),r=n(t);if(!i||!r)return 0/0;for(let e=0;e<3;e+=1){let t=i.core[e]-r.core[e];if(0n!==t)return t<0n?-1:1}if(0===i.pre.length||0===r.pre.length)return i.pre.length===r.pre.length?0:0===i.pre.length?1:-1;let o=Math.max(i.pre.length,r.pre.length);for(let e=0;e<o;e+=1){let t=i.pre[e],n=r.pre[e];if(void 0===t||void 0===n)return t===n?0:void 0===t?-1:1;if(t===n)continue;let o=/^\d+$/u.test(t),s=/^\d+$/u.test(n);if(o&&s)return BigInt(t)-BigInt(n)<0n?-1:1;if(o!==s)return o?-1:1;return t<n?-1:1}return 0}(e,t)}return 0/0}function d(e,t){return Array.isArray(e)||Array.isArray(t)?Array.isArray(e)&&Array.isArray(t)&&e.length===t.length&&e.every((e,n)=>e===t[n]):e===t}function p(e){return Array.isArray(e)&&e.every(e=>"string"==typeof e)}function f(e,t,n,i){return{formatVersion:"runbound.config.segment-resolution.v1",matched:t,reason:n,revision:e.revision,segmentId:e.segmentId,sourceRevision:e.sourceRevision,stale:i}}function m(e,t,n){"string"==typeof e&&o.test(e)&&g(e,r.LO.maximumContextStringBytes)||n.push(b("decisioning.name","Value must be a bounded canonical lowercase name.",t))}function g(e,t){if(0===e.length||new TextEncoder().encode(e).byteLength>t)return!1;for(let t=0;t<e.length;t+=1){let n=e.charCodeAt(t);if(n>=55296&&n<=56319){let n=e.charCodeAt(t+1);if(!(n>=56320&&n<=57343))return!1;t+=1}else if(n>=56320&&n<=57343)return!1}return!0}function h(e,t,n){return(0,r.xI)(e)?Date.parse(e):void n.push(b("segment.timestamp","Segment timestamp must be canonical UTC.",t))}function v(e,t,n,i){let r=new Set(t);for(let t of Object.keys(e))r.has(t)||i.push(b("decisioning.unknownField","Field is not declared by the contract.",`${n}/${t.replaceAll("~","~0").replaceAll("/","~1")}`))}function I(e,t,n,i,r){"string"==typeof e&&t.includes(e)||r.push(b(n,"Value is outside the closed vocabulary.",i))}function y(e){return"object"==typeof e&&null!==e&&!Array.isArray(e)}function b(e,t,n){return{code:e,message:t,path:n}}function x(e,t,n){return new i.$h(t,[b(e,t,n)])}n.d(t,{Ud:()=>c,vd:()=>a})},692(e,t,n){var i=n(533),r=n(88);let o=(0,i.Mr)({formatVersion:"runbound.config.decision-trace.v1",steps:[],traceDigest:`sha256:${"0".repeat(64)}`}).byteLength-2;function s(e){let t=[],n=2,s=Math.min(e.length,r.LO.maximumTraceSteps);for(let a=0;a<s;a+=1){let s=(0,i.Mr)(e[a]),c=n+s.byteLength+ +(0!==a);if(o+c>r.LO.maximumTraceBytes)break;t.push(s),n=c}let a=new Uint8Array(n);a[0]=91;let c=1;for(let e=0;e<t.length;e+=1){e>0&&(a[c++]=44);let n=t[e];a.set(n,c),c+=n.byteLength}return a[c]=93,{steps:e.slice(0,t.length),canonicalArrayBytes:a}}n.d(t,{b:()=>s})},88(e,t,n){var i=n(961),r=n(334),o=n(802),s=n.n(o),a=n(533);let c=Object.freeze({maximumActivationSetBytes:0x2000000,maximumAllocationFieldBytes:4096,maximumAllocationRangesPerRule:64,maximumAttributePathBytes:256,maximumAttributesPerKind:64,maximumAttributesTotal:256,maximumBoundedSetBytes:16384,maximumBoundedSetItems:64,maximumContextBytes:32768,maximumContextContractBytes:524288,maximumContextKinds:16,maximumContextStringBytes:4096,maximumDecisionsPerProgram:1024,maximumEvaluationDetailsBytes:16384,maximumDependencyNodesPerEvaluation:128,maximumDirectPrerequisites:16,maximumDirectTargetsPerDecision:128,maximumEvaluationSteps:1e4,maximumExplicitSegmentMembers:1e4,maximumInlineSimulationCases:1024,maximumReferencedCohortUnits:1e5,maximumPrerequisiteDepth:32,maximumPrivateArtifactBytes:0x1000000,maximumProgramClauses:65536,maximumProgramIrBytes:8388608,maximumProgramRules:16384,maximumPublicArtifactBytes:4194304,maximumRemoteRequestBytes:65536,maximumRemoteResponseBytes:32768,maximumRuleBooleanDepth:8,maximumRuleClauses:32,maximumRuleClausesPerDecision:2048,maximumRulesPerDecision:128,maximumSegmentSnapshotBytes:0x1000000,maximumSegmentsPerProgram:1024,maximumTraceBytes:65536,maximumTraceSteps:512,maximumUnitKeyBytes:512,maximumVariationsPerDecision:32,slotCount:1e6});function u(e,t){if(!Number.isSafeInteger(e)||e<0)throw RangeError(`${t} must be a non-negative safe integer.`)}Object.freeze({artifactDelivery:Object.freeze({bindingBurst:20,bindingPerMinute:120,tenantBurst:200,tenantPerMinute:1200}),remoteEvaluation:Object.freeze({credentialBurst:200,credentialInFlight:64,credentialPerMinute:6e3,tenantBurst:2e3,tenantInFlight:512,tenantPerMinute:6e4}),simulation:Object.freeze({principalInFlight:2,principalPerMinute:30,tenantInFlight:8,tenantPerMinute:300})}),Object.freeze({artifactDelivery:(e,t=!0)=>(u(e,"Artifact body bytes"),t&&0!==e)?Math.max(1,Math.ceil(e/1048576)):0,remoteEvaluation:e=>(u(e,"Accepted remote decisions"),e),simulation:e=>(u(e,"Decision-context pairs"),0===e?0:Math.ceil(e/1e3))}),Object.freeze({artifactLoad:Object.freeze({p95Ms:500,peakRssGrowthBytes:0x6000000}),localBudgetEdge:Object.freeze({p95Ms:10,p99Ms:20}),localCommon:Object.freeze({minimumEvaluationsPerSecond:25e3,p95Ms:.5,p99Ms:1}),localSoak:Object.freeze({durationSeconds:300,maximumP95DriftRatio:.1,postWarmRssGrowthBytes:0x1000000,minimumEvaluations:75e5}),remoteBudgetEdge:Object.freeze({p95Ms:500,p99Ms:1e3}),remoteCold:Object.freeze({p99Ms:2e3}),remoteWarm:Object.freeze({p95Ms:150,p99Ms:500}),retainedBaseline:Object.freeze({maximumP95Ratio:1.25,minimumThroughputRatio:.9})});let l=/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/u,d=/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u,p=/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{3}))?Z$/u,f=new WeakSet;function m(e){if("string"!=typeof e)return!1;let t=d.exec(e);return!!t&&(t[4]?.split(".")??[]).every(e=>!/^\d+$/u.test(e)||"0"===e||!e.startsWith("0"))}function g(e){if("string"!=typeof e)return!1;let t=p.exec(e);if(!t)return!1;let[n,i,r,o,s,a,c]=t.slice(1).map(e=>Number(e??0)),u=new Date(e);return Number.isFinite(u.getTime())&&u.getUTCFullYear()===n&&u.getUTCMonth()+1===i&&u.getUTCDate()===r&&u.getUTCHours()===o&&u.getUTCMinutes()===s&&u.getUTCSeconds()===a&&u.getUTCMilliseconds()===c}let h=Object.freeze({boolean:new Set(["equals","exists","notEquals"]),finiteNumber:new Set(["equals","exists","greaterThan","greaterThanOrEqual","lessThan","lessThanOrEqual","notEquals"]),ipAddress:new Set(["equals","exists","inSet","ipInCidr","notEquals"]),semanticVersion:new Set(["equals","exists","greaterThan","greaterThanOrEqual","lessThan","lessThanOrEqual","notEquals"]),string:new Set(["equals","exists","inSet","notEquals","prefix","substring","suffix"]),stringSet:new Set(["exists","intersects"]),timestamp:new Set(["equals","exists","greaterThan","greaterThanOrEqual","lessThan","lessThanOrEqual","notEquals"])});function v(e){let t=[];if(!B(e))throw _("contextContract.shape","Context contract must be an object.","");if(!(Object.isFrozen(e)&&f.has(e))){if(D(e,["configId","contextContractId","formatVersion","kinds","projectId","revision","tenantId"],"",t),w(e.configId,"/configId",t),w(e.contextContractId,"/contextContractId",t),w(e.projectId,"/projectId",t),w(e.tenantId,"/tenantId",t),"runbound.config.decisioning.v1"!==e.formatVersion&&t.push(L("contextContract.version","Context contract version is unsupported.","/formatVersion")),(!Number.isSafeInteger(e.revision)||1>Number(e.revision))&&t.push(L("contextContract.revision","Context contract revision must be a positive safe integer.","/revision")),j(e)&&(0,a.Mr)(e).byteLength>c.maximumContextContractBytes&&t.push(L("contextContract.size",`Context contract exceeds ${c.maximumContextContractBytes} bytes.`,"")),!Array.isArray(e.kinds)||0===e.kinds.length||e.kinds.length>c.maximumContextKinds)t.push(L("contextContract.kindCount",`Context contract must contain 1 to ${c.maximumContextKinds} kinds.`,"/kinds"));else{let n=new Set,i=0;e.kinds.forEach((e,r)=>{(function(e,t,n,i){let r=`/kinds/${t}`;if(!B(e))return i.push(L("contextContract.kindShape","Context kind must be an object.",r));if(D(e,["attributes","description","kind","owner","required","unitKey"],r,i),w(e.kind,`${r}/kind`,i),O(e.unitKey,`${r}/unitKey`,i),P(e.description,`${r}/description`,i),P(e.owner,`${r}/owner`,i),"boolean"!=typeof e.required&&i.push(L("contextContract.required","Required must be boolean.",`${r}/required`)),"string"==typeof e.kind&&(n.has(e.kind)&&i.push(L("contextContract.duplicateKind","Context kind is duplicated.",`${r}/kind`)),n.add(e.kind)),!Array.isArray(e.attributes)||0===e.attributes.length||e.attributes.length>c.maximumAttributesPerKind)return i.push(L("contextContract.attributeCount",`Context kind must declare 1 to ${c.maximumAttributesPerKind} attributes.`,`${r}/attributes`));let o=new Set;e.attributes.forEach((e,t)=>{!function(e,t,n,i){var r,o,s;if(!B(e))return i.push(L("contextContract.attributeShape","Context attribute must be an object.",t));D(e,["allowedOperators","description","lifecycle","nullable","owner","path","publicRuleEligible","required","retention","sensitivity","source","type"],t,i),r=e.path,o=`${t}/path`,s=i,"string"==typeof r&&l.test(r)&&R(r)&&!(new TextEncoder().encode(r).byteLength>c.maximumAttributePathBytes)||s.push(L("contextContract.attributePath",`Attribute path must be canonical and at most ${c.maximumAttributePathBytes} UTF-8 bytes.`,o)),P(e.description,`${t}/description`,i),P(e.owner,`${t}/owner`,i),"string"==typeof e.path&&(n.has(e.path)&&i.push(L("contextContract.duplicateAttribute","Context attribute is duplicated.",`${t}/path`)),n.add(e.path));let a=h[e.type];for(let n of(a||i.push(L("contextContract.attributeType","Context attribute type is unsupported.",`${t}/type`)),(!Array.isArray(e.allowedOperators)||0===e.allowedOperators.length||new Set(e.allowedOperators).size!==e.allowedOperators.length||e.allowedOperators.some(e=>"string"!=typeof e||!a?.has(e)))&&i.push(L("contextContract.operators","Context attribute operators must be unique and valid for its type.",`${t}/allowedOperators`)),["nullable","publicRuleEligible","required"]))"boolean"!=typeof e[n]&&i.push(L("contextContract.boolean",`${n} must be boolean.`,`${t}/${n}`));!0===e.required&&!0===e.nullable&&i.push(L("contextContract.requiredNullable","A required context attribute cannot be nullable.",t)),!0===e.publicRuleEligible&&("public"!==e.sensitivity||"metric"===e.retention)&&i.push(L("contextContract.publicEligibility","Public-rule attributes must be public and cannot require metric retention.",t)),"ipAddress"===e.type&&(!1!==e.publicRuleEligible||"authenticatedWorkload"!==e.source&&"serverEnriched"!==e.source)&&i.push(L("contextContract.ipAuthority","IP address attributes are server-only and cannot be public-rule eligible.",t)),N(e.lifecycle,["active","deprecated"],"contextContract.lifecycle",`${t}/lifecycle`,i),N(e.retention,["assignment","exposure","metric","none","request"],"contextContract.retention",`${t}/retention`,i),N(e.sensitivity,["confidential","internal","public","restricted"],"contextContract.sensitivity",`${t}/sensitivity`,i),N(e.source,["advisoryClientAsserted","applicationAsserted","authenticatedWorkload","runboundRegistered","serverEnriched"],"contextContract.source",`${t}/source`,i)}(e,`${r}/attributes/${t}`,o,i)})})(e,r,n,t),B(e)&&Array.isArray(e.attributes)&&(i+=e.attributes.length)}),i>c.maximumAttributesTotal&&t.push(L("contextContract.attributeTotal",`Context contract cannot exceed ${c.maximumAttributesTotal} attributes.`,"/kinds"))}T("Invalid Runbound Config context contract.",t),function e(t,n=new Set){return!!(null===t||"object"!=typeof t||n.has(t))||!!Object.isFrozen(t)&&(n.add(t),Object.values(t).every(t=>e(t,n)))}(e)&&f.add(e)}}function I(e,t){v(e),function(e,t,n,i=!1){let r=[];if(!B(t))throw _("context.shape","Evaluation context must be an object.","");if(D(t,["formatVersion","kinds"],"",r),"runbound.config.evaluation-context.v1"!==t.formatVersion&&r.push(L("context.version","Evaluation context version is unsupported.","/formatVersion")),!Array.isArray(t.kinds)||t.kinds.length>c.maximumContextKinds)r.push(L("context.kindCount",`Evaluation context cannot exceed ${c.maximumContextKinds} kinds.`,"/kinds"));else{let i=new Set;for(let o of(t.kinds.forEach((e,t)=>{!function(e,t,n,i,r,o){let s=`/kinds/${t}`;if(!B(e))return r.push(L("context.entityShape","Context entity must be an object.",s));D(e,["attributes","key","kind"],s,r),O(e.key,`${s}/key`,r),w(e.kind,`${s}/kind`,r);let a="string"==typeof e.kind?n.get(e.kind):void 0;if(!a)return r.push(L("context.unknownKind","Context kind is not declared by the contract.",`${s}/kind`));if(i.has(a.kind)&&r.push(L("context.duplicateKind","Evaluation context contains a duplicate kind.",`${s}/kind`)),i.add(a.kind),!B(e.attributes))return r.push(L("context.attributesShape","Context attributes must be an object.",`${s}/attributes`));let c=o?.get(a.kind)??new Map(a.attributes.map(e=>[e.path,e]));for(let[t,n]of Object.entries(e.attributes)){let e=c.get(t);if(!e){r.push(L("context.unknownAttribute","Context attribute is not declared by the contract.",`${s}/attributes/${k(t)}`));continue}A(e,n,`${s}/attributes/${k(t)}`,r)}for(let t of a.attributes)t.required&&!Object.hasOwn(e.attributes,t.path)&&r.push(L("context.requiredAttribute",`Required attribute ${t.path} is missing.`,`${s}/attributes`))}(e,t,n,i,r,void 0)}),e.kinds))o.required&&!i.has(o.kind)&&r.push(L("context.requiredKind",`Required context kind ${o.kind} is missing.`,"/kinds"))}let o=i&&0===r.length?function(e){let t='{"formatVersion":"runbound.config.evaluation-context.v1","kinds":[';for(let n=0;n<e.kinds.length;n+=1){if(n>0&&(t+=","),!(n in e.kinds))continue;let i=e.kinds[n];t+='{"attributes":{';let r=Object.keys(i.attributes).sort();for(let e=0;e<r.length;e+=1){let n=r[e],o=i.attributes[n];if("number"==typeof o&&Number.isInteger(o)&&!Number.isSafeInteger(o))return;e>0&&(t+=","),t+=`${JSON.stringify(n)}:${y(o)}`}t+=`},"key":${JSON.stringify(i.key)},"kind":${JSON.stringify(i.kind)}}`}return new TextEncoder().encode(`${t}]}`)}(t):void 0;(void 0!==o||j(t))&&(o??=(0,a.Mr)(t)).byteLength>c.maximumContextBytes&&r.push(L("context.size",`Evaluation context exceeds ${c.maximumContextBytes} bytes.`,"")),T("Invalid Runbound Config evaluation context.",r)}(e,t,new Map(e.kinds.map(e=>[e.kind,e])))}function y(e){return Array.isArray(e)?`[${e.map(e=>JSON.stringify(e)).join(",")}]`:JSON.stringify(e)}function b(e,t){v(e);let n=e.kinds.find(({kind:e})=>e===t.contextKind)?.attributes.find(({path:e})=>e===t.path);if(!n)throw _("rule.contextAttribute","Decision rule references an undeclared context attribute.","/condition");if(!n.allowedOperators.includes(t.operator))throw _("rule.contextOperator","Decision rule operator is not allowed by the context attribute contract.","/condition/operator");if("exists"===t.operator)return;if("ipInCidr"===t.operator){if("ipAddress"!==n.type||"string"!=typeof t.expected||!s().isValidCIDR(t.expected))throw _("rule.contextExpected","IP containment requires a valid CIDR expected value.","/condition/expected");return}if("inSet"===t.operator||"intersects"===t.operator){if(!Array.isArray(t.expected)||0===t.expected.length||"string"!==n.type&&"stringSet"!==n.type&&"ipAddress"!==n.type||"ipAddress"===n.type&&t.expected.some(e=>!S(e)))throw _("rule.contextExpected","Set operators require a non-empty expected set matching the context attribute type.","/condition/expected");return}let i=[];A(n,t.expected,"/condition/expected",i),T("Invalid Runbound Config decision clause.",i)}function x(e,t){try{let n=s().process(e),[i,r]=s().parseCIDR(t),o=i instanceof s().IPv6&&i.isIPv4MappedAddress(),a=o?i.toIPv4Address():i,c=o?r-96:r;return c>=0&&n.kind()===a.kind()&&n.match(a,c)}catch{return!1}}function C(e){if(!Number.isSafeInteger(e.reassignmentEpoch)||e.reassignmentEpoch<1)throw _("allocation.reassignmentEpoch","Allocation reassignment epoch must be a positive safe integer.","/reassignmentEpoch");if(!/^[0-9a-f]{32}$/u.test(e.salt))throw _("allocation.salt","Allocation salt must be a lowercase-hex 128-bit value.","/salt");let{bucket:t,digest:n}=function(e){let t=e.map((e,t)=>(function(e,t){if("string"!=typeof e||!R(e))throw _("allocation.unicode","Allocation fields must be valid Unicode scalar sequences.",`/fields/${t}`);let n=new TextEncoder().encode(e);if(0===n.byteLength||n.byteLength>c.maximumAllocationFieldBytes)throw _("allocation.fieldSize",`Allocation fields must contain 1 to ${c.maximumAllocationFieldBytes} UTF-8 bytes.`,`/fields/${t}`);let i=new Uint8Array(4+n.byteLength);return new DataView(i.buffer).setUint32(0,n.byteLength,!1),i.set(n,4),i})(e,t)),n=new Uint8Array(t.reduce((e,t)=>e+t.byteLength,0)),o=0;for(let e of t)n.set(e,o),o+=e.byteLength;let s=(0,i.sha256)(n),a=0n;for(let e of s.subarray(0,8))a=a<<8n|BigInt(e);return{bucket:Number(a*BigInt(c.slotCount)/(1n<<64n)),digest:`sha256:${(0,r.bytesToHex)(s)}`}}(["runbound.config.bucket","1",e.tenantId,e.projectId,e.allocationNamespace,String(e.reassignmentEpoch),e.salt,e.randomizationContextKind,e.unitKey]);return{bucket:t,digest:n,protocolVersion:1}}function A(e,t,n,i){if(null===t){e.nullable||i.push(L("context.null","Context attribute cannot be null.",n));return}switch(e.type){case"boolean":"boolean"!=typeof t&&E(n,i);return;case"finiteNumber":"number"==typeof t&&Number.isFinite(t)||E(n,i);return;case"ipAddress":"string"==typeof t&&S(t)?$(t,n,i):E(n,i);return;case"semanticVersion":m(t)?$(t,n,i):E(n,i);return;case"string":"string"!=typeof t?E(n,i):$(t,n,i);return;case"stringSet":!Array.isArray(t)||t.length>c.maximumBoundedSetItems||new Set(t).size!==t.length||t.some(e=>"string"!=typeof e||!R(e))?E(n,i):(t.forEach((e,t)=>{$(e,`${n}/${t}`,i)}),new TextEncoder().encode(y(t)).byteLength>c.maximumBoundedSetBytes&&i.push(L("context.setSize",`Context set exceeds ${c.maximumBoundedSetBytes} bytes.`,n)));return;case"timestamp":g(t)||E(n,i)}}function R(e){for(let t=0;t<e.length;t+=1){let n=e.charCodeAt(t);if(n>=55296&&n<=56319){let n=e.charCodeAt(t+1);if(!(n>=56320&&n<=57343))return!1;t+=1}else if(n>=56320&&n<=57343)return!1}return!0}function E(e,t){t.push(L("context.attributeType","Context attribute does not match its declared type.",e))}function S(e){return"string"==typeof e&&!e.includes("%")&&s().isValid(e)}function w(e,t,n){"string"==typeof e&&l.test(e)?$(e,t,n):n.push(L("decisioning.name","Value must be a canonical lowercase name.",t))}function O(e,t,n){("string"!=typeof e||0===e.length||!R(e)||new TextEncoder().encode(e).byteLength>c.maximumUnitKeyBytes)&&n.push(L("context.unitKey",`Unit key must contain 1 to ${c.maximumUnitKeyBytes} valid UTF-8 bytes.`,t))}function P(e,t,n){"string"!=typeof e||e.trim()!==e||0===e.length?n.push(L("decisioning.text","Value must be non-empty trimmed text.",t)):$(e,t,n)}function $(e,t,n){("string"!=typeof e||0===e.length||!R(e)||new TextEncoder().encode(e).byteLength>c.maximumContextStringBytes)&&n.push(L("decisioning.string",`String must contain 1 to ${c.maximumContextStringBytes} valid UTF-8 bytes.`,t))}function D(e,t,n,i){let r=new Set(t);for(let t of Object.keys(e))r.has(t)||i.push(L("decisioning.unknownField","Field is not declared by the contract.",`${n}/${k(t)}`))}function N(e,t,n,i,r){"string"==typeof e&&t.includes(e)||r.push(L(n,"Value is outside the closed vocabulary.",i))}function B(e){return"object"==typeof e&&null!==e&&!Array.isArray(e)}function j(e){return null===e||"boolean"==typeof e||"string"==typeof e||("number"==typeof e?Number.isFinite(e):Array.isArray(e)?e.every(j):B(e)&&Object.values(e).every(j))}function k(e){return e.replaceAll("~","~0").replaceAll("/","~1")}function L(e,t,n){return{code:e,message:t,path:n}}function _(e,t,n){return new a.$h(t,[L(e,t,n)])}function T(e,t){if(t.length>0)throw new a.$h(e,t)}n.d(t,{H$:()=>x,Tx:()=>m,YU:()=>I,_j:()=>b,cg:()=>v,ro:()=>C,xI:()=>g},{LO:c})},961(t){t.exports=e},334(e){e.exports=t}},i={};function r(e){var t=i[e];if(void 0!==t)return t.exports;var o=i[e]={exports:{}};return n[e].call(o.exports,o,o.exports,r),o.exports}r.n=e=>{var t=e&&e.__esModule?()=>e.default:()=>e;return r.d(t,{a:t}),t},r.d=(e,t,n)=>{var i=(t,n)=>{for(var i in t)r.o(t,i)&&!r.o(e,i)&&Object.defineProperty(e,i,{enumerable:!0,[n]:t[i]})};i(t,"get"),i(n,"value")},r.o=(e,t)=>Object.prototype.hasOwnProperty.call(e,t);var o={},s=r(533),a=r(595),c=r(796);class u extends Error{code;constructor(e,t){super(t),this.code=e,this.name="ConfigBrowserPublicDecisionError"}}class l{#e;constructor(e){this.#e=e}static async create(e){let t=function(e){let t,n=e;if(e instanceof Uint8Array){(0===e.byteLength||e.byteLength>4194304)&&C("CONFIG_BROWSER_PUBLIC_PARSE","Public Config decision bundle JSON is invalid.");try{n=t=new TextDecoder("utf-8",{fatal:!0}).decode(e)}catch{C("CONFIG_BROWSER_PUBLIC_PARSE","Public Config decision bundle JSON is invalid.")}}if("string"==typeof n){t=n,(0===n.length||n.length>4194304)&&C("CONFIG_BROWSER_PUBLIC_PARSE","Public Config decision bundle JSON is invalid.");try{n=JSON.parse(n)}catch{C("CONFIG_BROWSER_PUBLIC_PARSE","Public Config decision bundle JSON is invalid.")}}b(n)||C("CONFIG_BROWSER_PUBLIC_PARSE","Public Config decision bundle must be an object.");try{let e=(0,s.dj)(n);return void 0!==t&&t!==e&&C("CONFIG_BROWSER_PUBLIC_NONCANONICAL_JSON","Public Config decision bundle bytes must use canonical JSON."),structuredClone(n)}catch(e){if(e instanceof u)throw e;C("CONFIG_BROWSER_PUBLIC_PARSE","Public Config decision bundle must contain closed JSON values.")}}(e.bundle),n=function(e){for(let[t,n]of(g(e,["activationSetId","configId","keyId","minimumActivationSequenceExclusive","projectId","schemaDigest","softwareReleaseId","tenantId"],"scope",["minimumActivationSequenceExclusive"]),Object.entries({activationSetId:e.activationSetId,configId:e.configId,keyId:e.keyId,projectId:e.projectId,softwareReleaseId:e.softwareReleaseId,tenantId:e.tenantId})))v(n,t);return I(e.schemaDigest)||C("CONFIG_BROWSER_PUBLIC_SCOPE_INVALID","Public Config runtime scope is invalid."),void 0!==e.minimumActivationSequenceExclusive&&(!Number.isSafeInteger(e.minimumActivationSequenceExclusive)||e.minimumActivationSequenceExclusive<0)&&C("CONFIG_BROWSER_PUBLIC_SCOPE_INVALID","Public Config runtime scope is invalid."),e}(e.scope),i=e.crypto??globalThis.crypto;i?.subtle&&"function"==typeof i.subtle.verify||C("CONFIG_BROWSER_PUBLIC_CRYPTO_UNAVAILABLE","Public Config decision verification requires WebCrypto."),m(t),function(e){g(e,["activationSet","artifact","contextContract","formatVersion","manifest"],"bundle"),"runbound.config.browser-public-decision-bundle.v1"!==e.formatVersion&&C("CONFIG_BROWSER_PUBLIC_BUNDLE_VERSION","Public Config decision bundle version is unsupported.");try{(0,a.X)(e.activationSet)}catch(e){if(e instanceof u)throw e;C("CONFIG_BROWSER_PUBLIC_ACTIVATION_INVALID","Public Config activation set is invalid or open.")}g(e.manifest,["activationSequence","activationSetId","artifactDigest","audience","configId","contextContractDigest","currentUntil","formatVersion","keyId","notBefore","projectId","schemaDigest","signature","signatureAlgorithm","softwareReleaseId","tenantId"],"manifest");let t=e.manifest;for(let[e,n]of("localPublic"!==t.audience&&C("CONFIG_BROWSER_PUBLIC_PRIVATE_PROJECTION","Browser evaluation accepts only local-public delivery manifests."),"runbound.config.browser-public-decision-manifest.v1"===t.formatVersion&&Number.isSafeInteger(t.activationSequence)&&!(t.activationSequence<1)&&I(t.artifactDigest)&&I(t.contextContractDigest)&&I(t.schemaDigest)&&["ECDSA_SHA_256","Ed25519"].includes(t.signatureAlgorithm)||C("CONFIG_BROWSER_PUBLIC_MANIFEST_INVALID","Public Config decision manifest is invalid."),Object.entries({activationSetId:t.activationSetId,configId:t.configId,keyId:t.keyId,projectId:t.projectId,softwareReleaseId:t.softwareReleaseId,tenantId:t.tenantId})))v(n,e);y(t.signature),h(t.notBefore,"notBefore"),h(t.currentUntil,"currentUntil"),t.notBefore>=t.currentUntil&&C("CONFIG_BROWSER_PUBLIC_FRESHNESS_INVALID","Public Config decision freshness interval is invalid.")}(t),function(e){let t;"localPublic"!==e.artifact.audience&&C("CONFIG_BROWSER_PUBLIC_PRIVATE_PROJECTION","Browser evaluation accepts only the compiler-approved local-public projection."),function(e){for(let t of e.ir.decisions)for(let e of((t.disabledVariationId||(t.targets?.length??0)>0)&&C("CONFIG_BROWSER_PUBLIC_UNSUPPORTED","Browser Config projection contains an unsupported decision feature."),t.variations))!function(e,t){switch(e.type){case"boolean":return"boolean"==typeof t;case"number":return"number"==typeof t&&Number.isFinite(t);case"string":return"string"==typeof t;case"enum":return"string"==typeof t&&Array.isArray(e.values)&&e.values.includes(t);case"object":return b(t);default:return!1}}(t.valueSchema,e.value)&&C("CONFIG_BROWSER_PUBLIC_PROJECTION_INVALID","Browser Config variation does not match its declared value schema.");for(let t of Object.values(e.ir.rules))for(let e of t)(e.schedule||function e(t){return!!b(t)&&(!!Object.hasOwn(t,"segment")||(Array.isArray(t.all)?t.all.some(e):Array.isArray(t.any)?t.any.some(e):Object.hasOwn(t,"not")&&e(t.not)))}(e.condition))&&C("CONFIG_BROWSER_PUBLIC_UNSUPPORTED","Browser Config projection contains an unsupported decision feature.")}(e.artifact);try{(0,c.DL)({configId:e.artifact.ir.configId,contextContractDigest:e.artifact.ir.contextContractDigest,decisions:e.artifact.ir.decisions,formatVersion:"runbound.config.decision-program.v1",programRevisionId:"browser-public-projection-validation",projectId:e.artifact.ir.projectId,rules:e.artifact.ir.rules,segmentRevisionIds:e.artifact.ir.segmentRevisionDigests,tenantId:e.contextContract.tenantId}),t=(0,a.O)({audience:"localPublic",contextContract:e.contextContract,ir:e.artifact.ir})}catch{C("CONFIG_BROWSER_PUBLIC_PROJECTION_INVALID","Browser Config projection is invalid or exposes private information flow.")}(0,s.dj)(t)!==(0,s.dj)(e.artifact)&&C("CONFIG_BROWSER_PUBLIC_PROJECTION_OPEN","Browser Config projection is open, incomplete, or not canonical.")}(t),function(e,t){let{activationSet:n,artifact:i,contextContract:r,manifest:o}=e,a=(0,s.sI)(i),c=(0,s.sI)(r);o.activationSetId===t.activationSetId&&o.configId===t.configId&&o.keyId===t.keyId&&o.projectId===t.projectId&&o.schemaDigest===t.schemaDigest&&o.softwareReleaseId===t.softwareReleaseId&&o.tenantId===t.tenantId&&o.artifactDigest===a&&o.contextContractDigest===c&&o.activationSetId===n.activationSetId&&o.activationSequence===n.sequence&&o.keyId===n.keyId&&o.configId===n.configId&&o.projectId===n.projectId&&o.tenantId===n.tenantId&&o.audience===n.audience&&o.artifactDigest===n.audienceArtifactDigest&&o.contextContractDigest===n.contextContractDigest&&n.softwareReleaseIds.includes(o.softwareReleaseId)&&o.configId===i.configId&&o.projectId===i.projectId&&o.contextContractDigest===i.contextContractDigest&&o.configId===r.configId&&o.projectId===r.projectId&&o.tenantId===r.tenantId||C("CONFIG_BROWSER_PUBLIC_SCOPE_MISMATCH","Public Config bundle does not match its exact trusted runtime scope."),void 0!==t.minimumActivationSequenceExclusive&&n.sequence<=t.minimumActivationSequenceExclusive&&C("CONFIG_BROWSER_PUBLIC_SEQUENCE_REPLAY","Public Config activation does not advance trusted replay state.")}(t,n),f(t.manifest,e.now??new Date);let r=function(e){(0===e.length||e.length>32)&&C("CONFIG_BROWSER_PUBLIC_TRUST_INVALID","Public Config trusted key set is invalid.");let t=new Map;for(let n of e)g(n,["algorithm","key","keyId"],"trusted key"),v(n.keyId,"trusted keyId"),(!["ECDSA_SHA_256","Ed25519"].includes(n.algorithm)||t.has(n.keyId))&&C("CONFIG_BROWSER_PUBLIC_TRUST_INVALID","Public Config trusted key set is invalid."),t.set(n.keyId,Object.freeze({...n}));return t}(e.trustedKeys);return await d(t.activationSet,t.activationSet.signature,t.activationSet.signatureAlgorithm,t.activationSet.keyId,r,i,"activation set"),await d(t.manifest,t.manifest.signature,t.manifest.signatureAlgorithm,t.manifest.keyId,r,i,"public decision manifest"),new l(x(t))}evaluate(e,t,n=new Date){return v(e,"decisionId"),f(this.#e.manifest,n),m(t),x((0,c.UW)({activationSetId:this.#e.manifest.activationSetId,artifactDigest:this.#e.manifest.artifactDigest,artifactFreshness:"current",audience:"localPublic",context:t,contextContract:this.#e.contextContract,decisionId:e,ir:this.#e.artifact.ir,now:n,projectId:this.#e.manifest.projectId,softwareReleaseId:this.#e.manifest.softwareReleaseId,tenantId:this.#e.manifest.tenantId}))}status(){let{manifest:e}=this.#e;return Object.freeze({activationSequence:e.activationSequence,activationSetId:e.activationSetId,artifactDigest:e.artifactDigest,audience:e.audience,currentUntil:e.currentUntil,schemaDigest:e.schemaDigest,softwareReleaseId:e.softwareReleaseId})}}async function d(e,t,n,i,r,o,a){let c=r.get(i);c&&c.algorithm===n||C("CONFIG_BROWSER_PUBLIC_KEY_UNTRUSTED",`Public Config ${a} signing key is not trusted.`);let u={...e};delete u.signature;let l=!1;try{let e=y(t);l=await o.subtle.verify("Ed25519"===n?{name:"Ed25519"}:{hash:"SHA-256",name:"ECDSA"},c.key,"ECDSA_SHA_256"===n?function(e){if(64===e.byteLength)return e;let t=0,n=()=>e[t++];if(48!==n())throw Error("ECDSA signature sequence is invalid");let i=p(e,()=>n());if(t+i!==e.byteLength)throw Error("ECDSA signature sequence length is invalid");let r=()=>{if(2!==n())throw Error("ECDSA signature component is invalid");let i=p(e,()=>n()),r=e.slice(t,t+i);for(t+=i;r.byteLength>0&&0===r[0];)r=r.slice(1);if(0===r.byteLength||r.byteLength>32)throw Error("ECDSA signature component length is invalid");let o=new Uint8Array(32);return o.set(r,32-r.byteLength),o},o=r(),s=r();if(t!==e.byteLength)throw Error("ECDSA signature contains trailing content");let a=new Uint8Array(64);return a.set(o,0),a.set(s,32),a}(e):e,new Uint8Array((0,s.Mr)(u)))}catch{l=!1}l||C("CONFIG_BROWSER_PUBLIC_SIGNATURE_INVALID",`Public Config ${a} signature is invalid.`)}function p(e,t){let n=t();if(void 0===n)throw Error("DER length is missing");if((128&n)==0)return n;let i=127&n;if(0===i||i>2)throw Error("DER length is invalid");let r=0;for(let e=0;e<i;e+=1){let e=t();if(void 0===e)throw Error("DER length is truncated");r=r<<8|e}if(r>e.byteLength)throw Error("DER length exceeds input");return r}function f(e,t){(!(t instanceof Date)||!Number.isFinite(t.getTime())||t.getTime()<Date.parse(e.notBefore)||t.getTime()>=Date.parse(e.currentUntil))&&C("CONFIG_BROWSER_PUBLIC_FRESHNESS_EXPIRED","Public Config activation is outside its signed current freshness window.")}function m(e){if(b(e))for(let t of("v1"===e.$runboundSecretReference&&C("CONFIG_BROWSER_PUBLIC_SECRET_REFERENCE","Browser Config decision bundles and contexts cannot contain secret references."),Object.values(e)))m(t);else if(Array.isArray(e))for(let t of e)m(t)}function g(e,t,n,i=[]){b(e)||C("CONFIG_BROWSER_PUBLIC_OPEN_CONTRACT",`Public Config ${n} is invalid.`),(Object.keys(e).some(e=>!t.includes(e))||t.some(t=>!i.includes(t)&&!Object.hasOwn(e,t)))&&C("CONFIG_BROWSER_PUBLIC_OPEN_CONTRACT",`Public Config ${n} is open or incomplete.`)}function h(e,t){"string"==typeof e&&/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u.test(e)&&Number.isFinite(Date.parse(e))&&new Date(e).toISOString()===e||C("CONFIG_BROWSER_PUBLIC_FRESHNESS_INVALID",`Public Config ${t} is not a canonical instant.`)}function v(e,t){("string"!=typeof e||0===e.length||e.length>256||e.trim()!==e)&&C("CONFIG_BROWSER_PUBLIC_TOKEN_INVALID",`Public Config ${t} is invalid.`)}function I(e){return"string"==typeof e&&/^sha256:[0-9a-f]{64}$/u.test(e)}function y(e){"string"==typeof e&&0!==e.length&&/^[A-Za-z0-9_-]+$/u.test(e)||C("CONFIG_BROWSER_PUBLIC_SIGNATURE_INVALID","Public Config signature is not canonical base64url.");try{let t=e.length%4,n=e.replaceAll("-","+").replaceAll("_","/")+(0===t?"":"=".repeat(4-t)),i=atob(n),r=Uint8Array.from(i,e=>e.charCodeAt(0));if(r.byteLength<32||r.byteLength>512)throw Error("length");return r}catch{C("CONFIG_BROWSER_PUBLIC_SIGNATURE_INVALID","Public Config signature is invalid.")}}function b(e){return"object"==typeof e&&null!==e&&!Array.isArray(e)}function x(e){if(e&&"object"==typeof e&&!Object.isFrozen(e))for(let t of(Object.freeze(e),Object.values(e)))x(t);return e}function C(e,t){throw new u(e,t)}r.d(o,{C:()=>u,f:()=>l});var A=o.f,R=o.C;export{A as ConfigBrowserPublicDecisionClient,R as ConfigBrowserPublicDecisionError};

package/dist/config-refresh.d.ts

@@ -0,0 +1,69 @@
+import type { ConfigDeliveryClient, ConfigDeliverySnapshot, ConfigDeliveryValues } from "./config-delivery-store.js";
+export type ConfigBrowserRefreshReason = "gap-recovery" | "invalidation" | "manual" | "poll";
+export type ConfigBrowserPublicResponse = Readonly<{
+    artifactDigest: string;
+    bytes: Uint8Array;
+    headers: Readonly<Record<string, string>>;
+    sequence: number;
+    status: "modified";
+}> | Readonly<{
+    headers: Readonly<Record<string, string>>;
+    sequence: number;
+    status: "not-modified";
+}>;
+export interface ConfigBrowserPublicTransport {
+    fetch(input: Readonly<{
+        clientOrigin: string;
+        credentials: "omit";
+        endpoint: string;
+        expectedAfterSequence: number;
+        headers: Readonly<{
+            accept: "application/vnd.runbound.config+json";
+        }>;
+    }>): Promise<ConfigBrowserPublicResponse>;
+}
+export interface ConfigBrowserPublicVerifier<Values extends ConfigDeliveryValues> {
+    verify(input: Readonly<{
+        artifactDigest: string;
+        bytes: Uint8Array;
+        clientOrigin: string;
+        deliveryOrigin: string;
+        sequence: number;
+    }>): Promise<ConfigDeliverySnapshot<Values>>;
+}
+export type ConfigBrowserRefreshResult = Readonly<{
+    activeSequence: number;
+    nextPollDelayMs: number;
+    reason: ConfigBrowserRefreshReason;
+    status: "activated" | "current" | "superseded";
+}>;
+export declare class ConfigBrowserRefreshError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string, options?: ErrorOptions);
+}
+export declare class ConfigBrowserRefreshController<Values extends ConfigDeliveryValues> {
+    #private;
+    constructor(input: Readonly<{
+        client: ConfigDeliveryClient<Values>;
+        clientOrigin: string;
+        deliveryOrigin: string;
+        maximumPollIntervalMs: number;
+        minimumPollIntervalMs: number;
+        random?: () => number;
+        transport: ConfigBrowserPublicTransport;
+        verifier: ConfigBrowserPublicVerifier<Values>;
+    }>);
+    get diagnostic(): Readonly<{
+        activeSequence: number;
+        clientOrigin: string;
+        deliveryOrigin: string;
+        lastReason: ConfigBrowserRefreshReason | undefined;
+        lastStatus: "activated" | "current" | "superseded" | undefined;
+        valuesIncluded: false;
+    }>;
+    handleInvalidation(input: Readonly<{
+        sequence: number;
+    }>): Promise<ConfigBrowserRefreshResult>;
+    poll(): Promise<ConfigBrowserRefreshResult>;
+    refresh(reason?: ConfigBrowserRefreshReason): Promise<ConfigBrowserRefreshResult>;
+}

package/dist/config-refresh.js

@@ -0,0 +1 @@
+var e={};e.d=(i,t,r)=>{var n=(t,r)=>{for(var n in t)e.o(t,n)&&!e.o(i,n)&&Object.defineProperty(i,n,{enumerable:!0,[r]:t[n]})};n(t,"get"),n(r,"value")},e.o=(e,i)=>Object.prototype.hasOwnProperty.call(e,i);var i={};let t=new Set(["https://config.eu.runbound.io","https://config.runbound.io"]);class r extends Error{code;constructor(e,i,t){super(i,t),this.code=e,this.name="ConfigBrowserRefreshError"}}class n{#e;#i;#t;#r;#n;#s;#a;#o;#l=0;#c=Promise.resolve();#u;#h;constructor(e){this.#e=e.client,this.#i=s(e.clientOrigin,"clientOrigin",!1),this.#t=s(e.deliveryOrigin,"deliveryOrigin",!0),(!Number.isSafeInteger(e.minimumPollIntervalMs)||e.minimumPollIntervalMs<1e3||!Number.isSafeInteger(e.maximumPollIntervalMs)||e.maximumPollIntervalMs<e.minimumPollIntervalMs||e.maximumPollIntervalMs>36e5)&&o("CONFIG_BROWSER_REFRESH_INTERVAL_INVALID","Browser refresh polling bounds are invalid."),this.#n=e.minimumPollIntervalMs,this.#r=e.maximumPollIntervalMs,this.#s=e.random??Math.random,this.#a=e.transport,this.#o=e.verifier}get diagnostic(){return Object.freeze({activeSequence:this.#e.getSnapshot().activation.sequence,clientOrigin:this.#i,deliveryOrigin:this.#t,lastReason:this.#u,lastStatus:this.#h,valuesIncluded:!1})}handleInvalidation(e){a(e.sequence,"invalidation.sequence");let i=this.#e.getSnapshot().activation.sequence;return e.sequence<=i?Promise.resolve(this.#v("invalidation","current",i)):this.refresh(e.sequence>i+1?"gap-recovery":"invalidation")}poll(){return this.refresh("poll")}refresh(e="manual"){let i,t;this.#l+=1;let r=this.#l,n=new Promise((e,r)=>{i=e,t=r}),s=this.#c.then(async()=>{if(r!==this.#l)return void i(this.#v(e,"superseded",this.#e.getSnapshot().activation.sequence));try{i(await this.#d(e,r))}catch(e){t(e)}});return this.#c=s.then(()=>void 0,()=>void 0),n}async #d(e,i){var t,n,s;let l,c,u=this.#e.getSnapshot();try{c=await this.#a.fetch({clientOrigin:this.#i,credentials:"omit",endpoint:`${this.#t}/public/v1/config/resolve`,expectedAfterSequence:u.activation.sequence,headers:{accept:"application/vnd.runbound.config+json"}})}catch(e){throw new r("CONFIG_BROWSER_REFRESH_TRANSPORT_FAILED","Credentialless public Config refresh failed.",{cause:e})}if(t=c.headers,n=this.#i,((l=Object.fromEntries(Object.entries(t).map(([e,i])=>[e.toLowerCase(),i])))["access-control-allow-origin"]!==n||!l.vary?.split(",").map(e=>e.trim().toLowerCase()).includes("origin")||l["cache-control"]?.includes("private")||void 0!==l["set-cookie"]||void 0!==l["www-authenticate"]||void 0!==l.authorization)&&o("CONFIG_BROWSER_REFRESH_HEADERS_INVALID","Public Config response CORS, cache, or credential headers are invalid."),a(c.sequence,"response.sequence"),"not-modified"===c.status)return c.sequence!==u.activation.sequence&&o("CONFIG_BROWSER_REFRESH_NOT_MODIFIED_INVALID","Not-modified response did not match the active sequence."),this.#v(e,"current",u.activation.sequence);if(s=c.artifactDigest,/^sha256:[0-9a-f]{64}$/u.test(s)||o("CONFIG_BROWSER_REFRESH_INPUT_INVALID","artifactDigest is invalid."),c.sequence<=u.activation.sequence)return this.#v(e,"current",u.activation.sequence);let h=await this.#o.verify({artifactDigest:c.artifactDigest,bytes:new Uint8Array(c.bytes),clientOrigin:this.#i,deliveryOrigin:this.#t,sequence:c.sequence});if((h.activation.sequence!==c.sequence||h.activation.digest!==c.artifactDigest)&&o("CONFIG_BROWSER_REFRESH_VERIFICATION_INVALID","Verified public Config candidate did not match response identity."),i!==this.#l)return this.#v(e,"superseded",this.#e.getSnapshot().activation.sequence);let v=this.#e.commit("activation",h);return this.#v(e,"activated",v.activation.sequence)}#v(e,i,t){return this.#u=e,this.#h=i,Object.freeze({activeSequence:t,nextPollDelayMs:this.#m(),reason:e,status:i})}#m(){let e=this.#s();return(!Number.isFinite(e)||e<0||e>=1)&&o("CONFIG_BROWSER_REFRESH_RANDOM_INVALID","Browser refresh jitter source is invalid."),Math.floor(this.#n+e*(this.#r-this.#n+1))}}function s(e,i,r){let n;try{n=new URL(e)}catch{o("CONFIG_BROWSER_REFRESH_ORIGIN_INVALID",`${i} is invalid.`)}return(n.origin!==e||"https:"!==n.protocol||r&&!t.has(e))&&o("CONFIG_BROWSER_REFRESH_ORIGIN_INVALID",`${i} is invalid.`),e}function a(e,i){(!Number.isSafeInteger(e)||e<1)&&o("CONFIG_BROWSER_REFRESH_INPUT_INVALID",`${i} is invalid.`)}function o(e,i){throw new r(e,i)}e.d(i,{W:()=>r,e:()=>n});var l=i.e,c=i.W;export{l as ConfigBrowserRefreshController,c as ConfigBrowserRefreshError};

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+/** Framework-independent browser Config API. React is an optional consumer. */
+export * from "./config-context.js";
+export * from "./config-context-client.js";
+export * from "./config-delivery-store.js";
+export * from "./config-experiment-committed-render.js";
+export * from "./config-experimentation.js";
+export * from "./config-public-decision.js";
+export * from "./config-refresh.js";

package/dist/index.js

@@ -0,0 +1 @@
+export*from"./config-context.js";export*from"./config-context-client.js";export*from"./config-delivery-store.js";export*from"./config-experiment-committed-render.js";export*from"./config-experimentation.js";export*from"./config-public-decision.js";export*from"./config-refresh.js";

package/dist/internal/config-contract/base.d.ts

@@ -0,0 +1,180 @@
+export type ConfigKeyLike = object | string | Uint8Array;
+export declare const configContractVersion = "runbound.config.contract.v1";
+export declare const configLimits: Readonly<{
+    maximumArrayItems: 1024;
+    maximumDepth: 32;
+    maximumDocumentBytes: 1048576;
+    maximumProperties: 2048;
+    maximumSchemaBytes: 524288;
+    maximumStringBytes: 262144;
+}>;
+export type JsonPrimitive = boolean | null | number | string;
+export type JsonValue = JsonPrimitive | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export type ConfigExposure = "private" | "public";
+export type ConfigLifecycle = "live" | "startup";
+export type SecretReferenceShape = "binary" | "boolean" | "json" | "number" | "string";
+export type SecretReference = Readonly<{
+    $runboundSecretReference: "v1";
+    cache: "none" | "secureLastKnownGood";
+    expectedMaximumBytes: number;
+    expectedShape: SecretReferenceShape;
+    failure: "failClosed" | "useSecureLastKnownGood";
+    locator: string;
+    providerBindingId: string;
+    providerProfile: string;
+    selector: {
+        mode: "moving";
+        name: string;
+    } | {
+        mode: "pinned";
+        version: string;
+    };
+}>;
+export type ConfigJsonSchemaProjection = Readonly<{
+    $defs?: Readonly<Record<string, ConfigJsonSchemaProjection>>;
+    $ref?: string;
+    $schema?: "https://json-schema.org/draft/2020-12/schema";
+    additionalProperties?: boolean | ConfigJsonSchemaProjection;
+    default?: JsonValue;
+    description?: string;
+    enum?: readonly JsonPrimitive[];
+    format?: "date-time" | "duration" | "email" | "hostname" | "ipv4" | "ipv6" | "uri" | "uuid";
+    items?: ConfigJsonSchemaProjection;
+    maxItems?: number;
+    maxLength?: number;
+    maximum?: number;
+    minItems?: number;
+    minLength?: number;
+    minimum?: number;
+    oneOf?: readonly ConfigJsonSchemaProjection[];
+    pattern?: string;
+    properties?: Readonly<Record<string, ConfigJsonSchemaProjection>>;
+    required?: readonly string[];
+    type?: "array" | "boolean" | "integer" | "null" | "number" | "object" | "string" | readonly ("array" | "boolean" | "integer" | "null" | "number" | "object" | "string")[];
+    "x-runbound-exposure"?: ConfigExposure;
+    "x-runbound-compatibility-intent"?: "additive" | "breaking" | "stable";
+    "x-runbound-deprecated"?: boolean;
+    "x-runbound-element-id-property"?: string;
+    "x-runbound-fallback"?: "literal-default" | "none";
+    "x-runbound-field-id"?: string;
+    "x-runbound-lifecycle"?: ConfigLifecycle;
+    "x-runbound-local-override"?: boolean;
+    "x-runbound-owner-principal-ids"?: readonly string[];
+    "x-runbound-replacement-field-id"?: string;
+    "x-runbound-reviewer-principal-ids"?: readonly string[];
+    "x-runbound-secret-reference"?: boolean;
+    "x-runbound-staleness"?: "fail-closed" | "use-last-known-good";
+    "x-runbound-targeting"?: "allowed" | "forbidden";
+    "x-runbound-value-kind"?: "array" | "boolean" | "integer" | "null" | "number" | "object" | "string";
+}>;
+export type ConfigDiagnostic = Readonly<{
+    code: string;
+    location?: ConfigSourceLocation;
+    message: string;
+    path: string;
+}>;
+export type ConfigSourceLocation = Readonly<{
+    column: number;
+    end: number;
+    line: number;
+    start: number;
+}>;
+export declare class ConfigContractError extends Error {
+    readonly diagnostics: readonly ConfigDiagnostic[];
+    constructor(message: string, diagnostics: readonly ConfigDiagnostic[]);
+}
+export type ConfigContentEnvelope = Readonly<{
+    audience: "private";
+    configContractId: string;
+    configReleaseId: string;
+    contentDigest: string;
+    contentFormat: "application/runbound.config+json;v=1";
+    envelopeId: string;
+    generatedClientDigest: string;
+    keyId: string;
+    schemaDigest: string;
+    secretProviderBindingIds: string[];
+    signature: string;
+    signatureAlgorithm: ConfigSignatureAlgorithm;
+    tenantId: string;
+}>;
+export type UnsignedConfigContentEnvelope = Omit<ConfigContentEnvelope, "signature" | "signatureAlgorithm">;
+export type ConfigActivationManifest = Readonly<{
+    activationId: string;
+    bindingId: string;
+    channel: string;
+    configReleaseId: string;
+    contentDigest: string;
+    currentUntil: string;
+    envelopeDigest: string;
+    environmentId: string;
+    formatVersion: "runbound.config.activation.v1";
+    freshnessPolicyVersion: "runbound.config.freshness-policy.v1";
+    highWaterResetAuthorized: boolean;
+    highWaterResetId: string;
+    issuedAt: string;
+    keyId: string;
+    notBefore: string;
+    schemaDigest: string;
+    sequence: number;
+    signature: string;
+    signatureAlgorithm: ConfigSignatureAlgorithm;
+    softwareReleaseId: string;
+    staleUntil: string;
+    tenantId: string;
+}>;
+export type UnsignedConfigActivationManifest = Omit<ConfigActivationManifest, "signature" | "signatureAlgorithm">;
+export type ConfigSignatureAlgorithm = "ECDSA_SHA_256" | "Ed25519";
+export declare const configActivationFreshnessPolicy: Readonly<{
+    maximumCurrentWindowMs: number;
+    maximumFutureNotBeforeMs: number;
+    maximumStaleWindowMs: number;
+    version: "runbound.config.freshness-policy.v1";
+}>;
+export type ConfigArtifactSigner = Readonly<{
+    algorithm: ConfigSignatureAlgorithm;
+    keyId: string;
+    sign(bytes: Uint8Array): Promise<Uint8Array>;
+}>;
+export declare function canonicalJson(value: JsonValue): string;
+export declare function validateJsonValue(value: unknown): asserts value is JsonValue;
+export declare function canonicalBytes(value: JsonValue): Uint8Array;
+export declare function sha256Digest(value: JsonValue | Uint8Array): string;
+/**
+ * Shares canonical encodings between digests of overlapping values, such as a
+ * signed envelope and the artifact it embeds. `byteLength` validates and
+ * encodes a value once and keeps its bytes private; a later `digest` of that
+ * value, or of a value that reaches it through object keys, hashes the kept
+ * bytes instead of encoding the subtree again. Results equal
+ * `canonicalBytes(value).byteLength` and `sha256Digest(value)` exactly.
+ *
+ * Reuse is keyed by object identity, so a scope is only for a privately owned
+ * snapshot that nothing mutates while the scope is in use. Use one scope per
+ * snapshot and discard it with that snapshot.
+ */
+export declare class CanonicalEncodingScope {
+    #private;
+    byteLength(value: JsonValue): number;
+    digest(value: JsonValue): string;
+}
+export declare function validateConfigJsonSchemaProjection(value: unknown): asserts value is ConfigJsonSchemaProjection;
+export declare function materializeJsonSchemaDefaults(schema: ConfigJsonSchemaProjection, value: JsonValue | undefined): JsonValue;
+export declare function validateConfigJsonSchemaDocument(schema: ConfigJsonSchemaProjection, value: unknown): asserts value is JsonValue;
+export declare function compileJsonSchemaPublicProjection(schema: ConfigJsonSchemaProjection, value: JsonValue): {
+    schema: ConfigJsonSchemaProjection;
+    value: JsonValue;
+};
+export declare function isSecretReference(value: unknown): value is SecretReference;
+export declare function secretReference<T>(descriptor: Omit<SecretReference, "$runboundSecretReference">): SecretReference & {
+    readonly __value?: T;
+};
+export declare function signContentEnvelope(envelope: UnsignedConfigContentEnvelope, privateKey: ConfigKeyLike): ConfigContentEnvelope;
+export declare function signContentEnvelopeWith(envelope: UnsignedConfigContentEnvelope, signer: ConfigArtifactSigner): Promise<ConfigContentEnvelope>;
+export declare function verifyContentEnvelope(envelope: ConfigContentEnvelope, publicKey: ConfigKeyLike): void;
+export declare function signActivationManifest(manifest: UnsignedConfigActivationManifest, privateKey: ConfigKeyLike): ConfigActivationManifest;
+export declare function signActivationManifestWith(manifest: UnsignedConfigActivationManifest, signer: ConfigArtifactSigner): Promise<ConfigActivationManifest>;
+export declare function verifyActivationManifest(manifest: ConfigActivationManifest, publicKey: ConfigKeyLike): void;
+export declare function assertActivationFreshness(manifest: Pick<ConfigActivationManifest, "currentUntil" | "formatVersion" | "freshnessPolicyVersion" | "highWaterResetAuthorized" | "highWaterResetId" | "issuedAt" | "notBefore" | "staleUntil">): void;
+export declare function matchesConfigFormat(format: NonNullable<ConfigJsonSchemaProjection["format"]>, value: string): boolean;

package/dist/internal/config-contract/core.d.ts

@@ -0,0 +1,82 @@
+export type { ConfigDiagnostic, ConfigExposure, ConfigJsonSchemaProjection, ConfigLifecycle, ConfigSourceLocation, JsonPrimitive, JsonValue, SecretReference, SecretReferenceShape, } from "./base.js";
+export { CanonicalEncodingScope, ConfigContractError, canonicalBytes, canonicalJson, compileJsonSchemaPublicProjection, configContractVersion, configLimits, isSecretReference, matchesConfigFormat, materializeJsonSchemaDefaults, secretReference, sha256Digest, validateConfigJsonSchemaDocument, validateConfigJsonSchemaProjection, } from "./base.js";
+export type { ConfigSchema, ConfigSchemaDiagnostic, ConfigSchemaField, ConfigSchemaGovernance, ConfigSchemaNode, } from "./schema.js";
+export { ConfigSchemaError, compilePublicProjection, configJsonSchemaProjectionToSchema, configSchemaFormatVersion, configSchemaJsonProjectionMapping, configSchemaToJsonSchemaProjection, materializeDefaults, normalizeConfigSchema, parseConfigSchema, validateConfigDocument, validateConfigSchema, } from "./schema.js";
+import { type ConfigDiagnostic, type ConfigExposure, type ConfigSourceLocation, type JsonValue } from "./base.js";
+import { type ConfigSchema } from "./schema.js";
+export type ConfigDraftDocument = Readonly<{
+    canonicalDigest?: string;
+    diagnostics: readonly ConfigDiagnostic[];
+    invalidBufferDigest?: string;
+    parsed?: JsonValue;
+    propertySourceMap: Readonly<Record<string, ConfigSourceLocation>>;
+    rawText: string;
+    revision: number;
+    sourceMap: Readonly<Record<string, ConfigSourceLocation>>;
+    status: "invalid" | "valid";
+}>;
+export type ConfigDiffEntry = Readonly<{
+    afterDigest?: string;
+    beforeDigest?: string;
+    change: "added" | "changed" | "removed";
+    exposure: ConfigExposure;
+    path: string;
+    subject?: "schema" | "values";
+}>;
+export type ConfigDraftPatchOperation = Readonly<{
+    operation: "add" | "set";
+    path: string;
+    value: JsonValue;
+}> | Readonly<{
+    operation: "move";
+    from: string;
+    path: string;
+}> | Readonly<{
+    operation: "remove";
+    path: string;
+}>;
+export type ConfigMergeConflict = Readonly<{
+    base?: JsonValue;
+    current?: JsonValue;
+    path: string;
+    proposed?: JsonValue;
+    reason: "concurrent-change" | "whole-array";
+}>;
+export type ConfigMergeResult = Readonly<{
+    conflicts: readonly ConfigMergeConflict[];
+    merged?: JsonValue;
+}>;
+export type ConfigDraftParseOptions = Readonly<{
+    maximumArrayItems?: number;
+    maximumDepth?: number;
+    maximumProperties?: number;
+}>;
+export declare function parseConfigDraft(rawText: string, revision: number, options?: ConfigDraftParseOptions): ConfigDraftDocument;
+export declare function validateConfigDraft(schema: ConfigSchema, draft: ConfigDraftDocument): ConfigDraftDocument;
+export declare function applyConfigDraftPatch(input: {
+    draft: ConfigDraftDocument;
+    expectedRevision: number;
+    path: string;
+    value?: JsonValue;
+}): ConfigDraftDocument;
+export declare function applyConfigDraftPatches(input: {
+    draft: ConfigDraftDocument;
+    expectedRevision: number;
+    operations: readonly ConfigDraftPatchOperation[];
+}): ConfigDraftDocument;
+export declare function mergeConfigDrafts(input: {
+    base: JsonValue;
+    current: JsonValue;
+    proposed: JsonValue;
+    schema?: ConfigSchema;
+}): ConfigMergeResult;
+export declare function diffConfigDocuments(schema: ConfigSchema, before: JsonValue, after: JsonValue): readonly ConfigDiffEntry[];
+/**
+ * Describe the first published document without inventing a valid predecessor.
+ *
+ * A required Config document cannot generally be compared with `{}` through
+ * `diffConfigDocuments`, because `{}` is not valid under its schema. The first
+ * candidate still needs a path-level review diff, so this helper validates only
+ * the proposed document and walks it from an explicitly absent object root.
+ */
+export declare function diffInitialConfigDocument(schema: ConfigSchema, after: JsonValue): readonly ConfigDiffEntry[];