standdown 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dupe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/POLICIES.md

@@ -0,0 +1,44 @@
+# standdown.js policy packs
+
+All bundled policies were last verified on `2026-07-10`. Each policy carries
+`metadata.sourceUrl`, `metadata.lastVerified`, and optional `metadata.notes`.
+
+## Defaults
+
+`cocDefaults` implements the Affiliate Software Code of Conduct duration model
+used when a network-specific duration is not available: advertiser scope,
+60-minute inactivity window, 90-minute fallback minimum, and complete
+suppression behaviors (`suppress-prompts`, `no-cookie-write`, `no-redirect`,
+`no-background-tracking`).
+
+## Pack sources
+
+| Policy | Signals | Stand-down | Activation | Primary citation |
+| --- | --- | --- | --- | --- |
+| `cj` | `cjevent`, `cjdata`, `utm_source=cj`, `sf_cs=cj`, `afsrc=1`, CJ rotating domains, `cje` / `cjevent_dc` cookie names | Session-or-minimum 30m | User click | https://www.cj.com/legal/software-policy and https://github.com/piedotorg/standdown-domains |
+| `impact` | `afsrc=1`, `irclickid`, `irgwc`, `im_ref` cookie names | Session-or-minimum 30m | User click | https://impact.com/stand-down-policy.ihtml |
+| `rakuten` | `ranMID` + `ranEAID` + `ranSiteID`, `ranEAID` + `ranSiteID`, `ranSiteID`, `siteID`, LinkSynergy/JRS redirect domains, LinkShare cookie names | Session-or-minimum with CoC fallback minimum | User click | https://github.com/rakutenrewards/PublisherStandown-SDK |
+| `awin` | `awc`, `utm_source=aw`, `source=aw`, `awin1.com` | CoC defaults | User click | https://success.awin.com/s/article/Downloadable-Software-Guidelines, https://success.awin.com/s/article/Soft-Click-Cookie-Status, and https://github.com/piedotorg/standdown-domains |
+| `shareasale` | `sscid`, `shareasale.com`, `shrsl.com`, `sscid` cookie names | CoC defaults | User click | https://success.awin.com/s/article/Downloadable-Software-Guidelines and https://github.com/piedotorg/standdown-domains |
+| `ebay-epn` | `campid`, `pubid`, `mkevt`, `mkcid`, `mkrid`, `[campid + _trkparms]`, `[mktype + gclid]`, `rover.ebay.com`, non-approved referrer class scoped to `ebay.<tld>` | CoC defaults | User click, max 2 prompts, own-site/organic/direct only | https://partnernetwork.ebay.com/browser-extension-policy and https://github.com/piedotorg/standdown-domains |
+| `amazon` | `tag` | CoC fallback minimum for detected attribution visibility | Never | https://affiliate-program.amazon.com/help/operating/policies |
+| `sovrn-skimlinks` | `go.skimresources.com`, `go.redirectingat.com` | CoC defaults | User click | https://www.sovrn.com/sovrn-commerce-publisher-code-of-conduct/ |
+| `partnerize` | `clickref`, `prf.hn` | CoC defaults | User click | https://partnerize.com/legal/terms-and-conditions/ |
+| `universal` | Full piedotorg/standdown-domains regex rule list, plus `afsrc=1` final-URL detection | CoC defaults | User click | https://github.com/piedotorg/standdown-domains and https://raw.githubusercontent.com/piedotorg/standdown-domains/main/standdown-domains.json |
+
+Low-confidence entries remain bundled but are explicitly marked in
+`metadata.notes`: `sovrn-skimlinks` redirect domains and `partnerize` `prf.hn`
+were taken from research/domain knowledge rather than verified network policy
+docs.
+
+## Third-party data attribution
+
+The `universal` policy imports the full
+`piedotorg/standdown-domains` rule set from
+https://raw.githubusercontent.com/piedotorg/standdown-domains/main/standdown-domains.json.
+That repository is licensed MIT:
+
+> Copyright (c) 2025 The People's Internet Experiment Inc.
+
+The bundled rules preserve the upstream comments as `DomainRule.comment`
+values, with wording adjusted only to make the attribution explicit.

package/README.md

@@ -0,0 +1,171 @@
+# standdown
+
+Affiliate stand-down, done right, for browser extensions.
+
+Built and maintained by Dupe.
+
+`standdown` is a zero-runtime-dependency TypeScript library for extension
+developers who need to detect existing affiliate attribution, suppress
+competing activation, and prove that suppression decisions were made locally and
+deterministically.
+
+It ships four surfaces:
+
+| Import | Purpose |
+| --- | --- |
+| `standdown` | Pure core: detection, session state machine, activation guard, policy validation, signed bundle verification, Rakuten converters |
+| `standdown/policies` | Bundled policy packs and helpers |
+| `standdown/webext` | Manifest V3 background/service-worker adapter |
+| `standdown/content` | Content-script signal collector and evaluator |
+
+## Install
+
+```sh
+npm install standdown
+```
+
+This package is pre-release. Publishing is a human launch step; the repo should
+not publish from CI.
+
+## Webext Quickstart
+
+```ts
+import { allPolicies } from 'standdown/policies';
+import { createStanddown } from 'standdown/webext';
+
+const standdown = createStanddown({
+  policies: allPolicies,
+  selfPatterns: [{ name: 'my_click_id', networkId: 'cj' }],
+  publisherSites: ['example-publisher.com'],
+});
+```
+
+The adapter observes `chrome.webRequest.onBeforeRequest` redirect chains when
+available and falls back to `chrome.webNavigation.onCommitted` final-URL signal
+collection when reduced permissions or Safari-style APIs require it. Content
+scripts and popups can query the background worker with:
+
+`chrome.webNavigation.onCommitted` is required. `createStanddown()` throws when
+that API is unavailable because an adapter that observes no navigations would
+fail open.
+
+```ts
+const response = await chrome.runtime.sendMessage({
+  type: 'standdown:shouldStandDown',
+  tabId,
+  url,
+});
+```
+
+Signed policy refresh is optional and runs outside the decision path:
+
+```ts
+createStanddown({
+  policies: allPolicies,
+  refresh: {
+    url: 'https://static.example.com/standdown.bundle.json',
+    publicKeyJwk,
+    intervalMs: 60 * 60 * 1000,
+  },
+});
+```
+
+Only monotone updates are applied: detection coverage may broaden, durations may
+lengthen, and activation rules must remain unchanged. Added overlapping
+policies cannot downgrade a decision because the session layer unions behaviors
+from every policy matching the advertiser. Signed bundles also reject overly
+complex regex `DomainRule` patterns before they can enter local detection.
+
+## Content Quickstart
+
+```ts
+import { allPolicies } from 'standdown/policies';
+import { createContentStanddown } from 'standdown/content';
+
+const standdown = createContentStanddown({
+  policies: allPolicies,
+  storage: 'session',
+  publisherSites: ['example-publisher.com'],
+});
+
+const decision = await standdown.ready;
+```
+
+The content adapter collects only local page signals: `location.href`,
+`document.referrer`, and first-party cookie names. Cookie values are never
+included. SPA navigations are re-evaluated via `pushState`, `replaceState`, and
+`popstate` hooks.
+
+`storage: 'local-ttl'` stores session records in `localStorage` with a sliding
+24-hour envelope TTL by default. The TTL clears session records, not audit
+history; per-policy stand-down durations remain enforced by the core state
+machine.
+
+## Core Usage
+
+```ts
+import { MemoryStateStore, StanddownSession, guardActivation } from 'standdown';
+import { cjPolicy } from 'standdown/policies';
+
+const session = new StanddownSession(new MemoryStateStore());
+const decision = await session.ingest(
+  { url: 'https://merchant.example/?cjevent=abc', now: Date.now() },
+  [cjPolicy],
+);
+
+const guard = guardActivation({
+  decision,
+  userGesture: { isTrusted: true, type: 'click', timeStamp: performance.now() },
+  benefit: { kind: 'cashback', description: 'Activate cashback.' },
+  policy: cjPolicy,
+});
+```
+
+## Public Commitments
+
+- **I1: Client-side decisions only.** No network call participates in a
+  stand-down decision. Refresh may update the already-applied local policy
+  bundle asynchronously, but decisions use local state synchronously.
+- **I2: No user profiling.** Signals are a closed type and exclude user identity,
+  accounts, balances, emails, login state, and tester-differentiating data.
+- **I3: Fail toward standing down.** Unknown, ambiguous, malformed, or storage
+  error states suppress activation.
+- **I4: Monotone remote updates.** Signed refresh bundles may only broaden
+  detection or lengthen durations and may not edit activation rules.
+- **I5: Audit log on by default.** Decisions and refresh outcomes are locally
+  auditable.
+- **I6: No remote code.** Policies are data. No eval, remote scripts, or dynamic
+  code loading.
+- **I7: Deterministic and loggable.** Given the same local signals, policies,
+  state, and clock, decisions are reproducible.
+
+## Interop
+
+`fromRakutenPolicy()` and `toRakutenPolicy()` convert Rakuten
+`NetworkPolicy` schemaVersion 2 data. Rakuten's schema is detection-only, so
+native fields such as cookie rules, initiator rules, activation guard details,
+stand-down behaviors, citations, audit semantics, multi-group `anyOf` param
+rules, and `match: 'contains'` params are lossy when emitting Rakuten v2. The
+bundled `rakuten` policy itself intentionally does not round-trip exactly.
+
+## Policy Packs
+
+| Policy | Main signals | Stand-down | Activation |
+| --- | --- | --- | --- |
+| `cj` | `cjevent`, `cjdata`, `utm_source=cj`, `sf_cs=cj`, `afsrc=1`, CJ redirect domains, CJ cookie names | Session-or-min 30m | User click |
+| `impact` | `afsrc=1`, `irclickid`, `irgwc`, `im_ref` cookie names | Session-or-min 30m | User click |
+| `rakuten` | `ranMID`, `ranEAID`, `ranSiteID`, `siteID`, LinkSynergy redirect domains, LinkShare cookie names | Session-or-min fallback | User click |
+| `awin` | `awc`, `utm_source=aw`, `source=aw`, `awin1.com` | CoC defaults | User click |
+| `shareasale` | `sscid`, ShareASale redirect domains, `sscid` cookie name | CoC defaults | User click |
+| `ebay-epn` | eBay EPN params, `rover.ebay.com`, scoped referrer classification | CoC defaults | User click, max 2 prompts |
+| `amazon` | Amazon `tag` on Amazon advertiser hosts | Suppression visibility only | Never |
+| `sovrn-skimlinks` | Skimlinks redirect domains | CoC defaults | User click |
+| `partnerize` | `clickref`, `prf.hn` | CoC defaults | User click |
+| `universal` | Full `piedotorg/standdown-domains` list plus `afsrc=1` | CoC defaults | User click |
+
+See [POLICIES.md](./POLICIES.md) for citations and attribution.
+
+## Example
+
+See [examples/mv3-extension](./examples/mv3-extension) for a minimal Manifest V3
+background worker and popup using `standdown/webext`.

package/dist/chunk-25A7QG5Z.mjs

@@ -0,0 +1,274 @@
+import { validatePolicies } from './chunk-SVN6UWA4.mjs';
+
+// src/bundle.ts
+var textEncoder = new TextEncoder();
+var MAX_SIGNED_BUNDLE_REGEX_LENGTH = 256;
+async function verifyPolicyBundle(current, update, publicKeyJwk) {
+  try {
+    validatePolicies(current);
+    validatePolicies(update.policies);
+  } catch (error) {
+    return { ok: false, violation: `malformed-policy: ${messageFromError(error)}` };
+  }
+  if (update.schemaVersion !== 1) {
+    return { ok: false, violation: "unsupported-bundle-version" };
+  }
+  const signatureOk = await verifySignature(
+    update.signature.algorithm,
+    publicKeyJwk,
+    update.signature.value,
+    canonicalPolicyBundlePayload(update)
+  );
+  if (!signatureOk) {
+    return { ok: false, violation: "bad-signature" };
+  }
+  const regexViolation = regexComplexityViolation(update.policies);
+  if (regexViolation !== void 0) {
+    return { ok: false, violation: regexViolation };
+  }
+  const monotonicityViolation = checkMonotonicity(current, update.policies);
+  if (monotonicityViolation !== void 0) {
+    return { ok: false, violation: monotonicityViolation };
+  }
+  return { ok: true, policies: update.policies.map(clonePolicy) };
+}
+function canonicalPolicyBundlePayload(bundle) {
+  return canonicalJson({
+    schemaVersion: bundle.schemaVersion,
+    policies: bundle.policies
+  });
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") {
+    if (typeof value === "number" && !Number.isFinite(value)) {
+      throw new TypeError("canonical JSON only supports finite numbers");
+    }
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+  }
+  const record = value;
+  const entries = Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`);
+  return `{${entries.join(",")}}`;
+}
+function checkMonotonicity(current, update) {
+  const updateById = new Map(update.map((policy) => [policy.id, policy]));
+  for (const currentPolicy of current) {
+    const updatedPolicy = updateById.get(currentPolicy.id);
+    if (updatedPolicy === void 0) {
+      return `policy-removed:${currentPolicy.id}`;
+    }
+    const detectionResult = detectionViolation(currentPolicy, updatedPolicy);
+    if (detectionResult !== void 0) {
+      return `${currentPolicy.id}:${detectionResult}`;
+    }
+    const standdownResult = standdownViolation(currentPolicy, updatedPolicy);
+    if (standdownResult !== void 0) {
+      return `${currentPolicy.id}:${standdownResult}`;
+    }
+    if (!sameJson(currentPolicy.activation, updatedPolicy.activation)) {
+      return `${currentPolicy.id}:activation-edited`;
+    }
+  }
+  return void 0;
+}
+function detectionViolation(currentPolicy, updatedPolicy) {
+  if (!domainRulesSurvive(
+    currentPolicy.detection.advertiserHosts,
+    updatedPolicy.detection.advertiserHosts,
+    { advertiserHosts: true }
+  )) {
+    return "advertiser-hosts-narrowed";
+  }
+  if (!paramRulesSurvive(
+    currentPolicy.detection.landingParams,
+    updatedPolicy.detection.landingParams
+  )) {
+    return "landing-params-narrowed";
+  }
+  if (!domainRulesSurvive(
+    currentPolicy.detection.redirectDomains,
+    updatedPolicy.detection.redirectDomains
+  )) {
+    return "redirect-domains-narrowed";
+  }
+  if (!cookieRulesSurvive(
+    currentPolicy.detection.cookiePatterns,
+    updatedPolicy.detection.cookiePatterns
+  )) {
+    return "cookie-patterns-narrowed";
+  }
+  if (!initiatorRulesSurvive(
+    currentPolicy.detection.initiatorRules,
+    updatedPolicy.detection.initiatorRules
+  )) {
+    return "initiator-rules-narrowed";
+  }
+  return void 0;
+}
+function standdownViolation(currentPolicy, updatedPolicy) {
+  if (updatedPolicy.standdown.scope !== currentPolicy.standdown.scope) {
+    return "standdown-scope-edited";
+  }
+  if (updatedPolicy.standdown.sessionRule !== currentPolicy.standdown.sessionRule) {
+    return "session-rule-edited";
+  }
+  if (updatedPolicy.standdown.minDurationMs < currentPolicy.standdown.minDurationMs) {
+    return "min-duration-shortened";
+  }
+  if (currentPolicy.standdown.inactivityMs !== void 0 && (updatedPolicy.standdown.inactivityMs === void 0 || updatedPolicy.standdown.inactivityMs < currentPolicy.standdown.inactivityMs)) {
+    return "inactivity-duration-shortened";
+  }
+  for (const behavior of currentPolicy.standdown.behaviors) {
+    if (!updatedPolicy.standdown.behaviors.includes(behavior)) {
+      return "standdown-behavior-removed";
+    }
+  }
+  return void 0;
+}
+function domainRulesSurvive(current, update, opts = {}) {
+  if (opts.advertiserHosts && current === void 0) {
+    return update === void 0;
+  }
+  if (current === void 0 || current.length === 0) {
+    return true;
+  }
+  if (opts.advertiserHosts && update === void 0) {
+    return true;
+  }
+  if (update === void 0 || update.length === 0) {
+    return false;
+  }
+  return current.every(
+    (rule) => update.some((candidate) => domainRuleCovers(rule, candidate))
+  );
+}
+function regexComplexityViolation(policies) {
+  for (const policy of policies) {
+    for (const [field, rules] of domainRuleEntries(policy)) {
+      for (const rule of rules ?? []) {
+        if (rule.kind === "regex" && isComplexRegex(rule.pattern)) {
+          return `${policy.id}:complex-regex:${field}`;
+        }
+      }
+    }
+  }
+  return void 0;
+}
+function domainRuleEntries(policy) {
+  return [
+    ["detection.advertiserHosts", policy.detection.advertiserHosts],
+    ["detection.redirectDomains", policy.detection.redirectDomains]
+  ];
+}
+function isComplexRegex(pattern) {
+  return pattern.length > MAX_SIGNED_BUNDLE_REGEX_LENGTH || hasRegexBackreference(pattern) || hasRegexLookaround(pattern) || hasNestedUnboundedQuantifier(pattern);
+}
+function hasRegexBackreference(pattern) {
+  return /(^|[^\\])\\[1-9]/.test(pattern);
+}
+function hasRegexLookaround(pattern) {
+  return /\(\?(?:[=!]|<[=!])/.test(pattern);
+}
+function hasNestedUnboundedQuantifier(pattern) {
+  return /\((?:[^()\\]|\\.)*[+*](?:[^()\\]|\\.)*\)(?:[+*]|\{\d*,?\})/.test(
+    pattern
+  );
+}
+function domainRuleCovers(current, update) {
+  if (current.kind === "suffix" && update.kind === "suffix") {
+    return domainSuffixMatches(current.pattern, update.pattern);
+  }
+  return sameJson(current, update);
+}
+function paramRulesSurvive(current, update) {
+  return exactRulesSurvive(current, update);
+}
+function cookieRulesSurvive(current, update) {
+  return exactRulesSurvive(current, update);
+}
+function initiatorRulesSurvive(current, update) {
+  return exactRulesSurvive(current, update);
+}
+function exactRulesSurvive(current, update) {
+  if (current === void 0 || current.length === 0) {
+    return true;
+  }
+  if (update === void 0 || update.length === 0) {
+    return false;
+  }
+  const updatedRules = new Set(update.map((rule) => canonicalJson(rule)));
+  return current.every((rule) => updatedRules.has(canonicalJson(rule)));
+}
+async function verifySignature(algorithm, publicKeyJwk, signatureValue, payload) {
+  try {
+    const publicKey = await importVerificationKey(algorithm, publicKeyJwk);
+    const signature = base64UrlToBytes(signatureValue);
+    const data = bytesToArrayBuffer(textEncoder.encode(payload));
+    if (algorithm === "ECDSA-P256") {
+      return crypto.subtle.verify(
+        { name: "ECDSA", hash: "SHA-256" },
+        publicKey,
+        bytesToArrayBuffer(signature),
+        data
+      );
+    }
+    return crypto.subtle.verify(
+      "Ed25519",
+      publicKey,
+      bytesToArrayBuffer(signature),
+      data
+    );
+  } catch {
+    return false;
+  }
+}
+async function importVerificationKey(algorithm, publicKeyJwk) {
+  if (algorithm === "ECDSA-P256") {
+    return crypto.subtle.importKey(
+      "jwk",
+      publicKeyJwk,
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      ["verify"]
+    );
+  }
+  return crypto.subtle.importKey("jwk", publicKeyJwk, "Ed25519", false, [
+    "verify"
+  ]);
+}
+function base64UrlToBytes(value) {
+  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+}
+function bytesToArrayBuffer(bytes) {
+  return bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength
+  );
+}
+function sameJson(left, right) {
+  return canonicalJson(left) === canonicalJson(right);
+}
+function domainSuffixMatches(host, pattern) {
+  const normalizedHost = host.toLowerCase().replace(/^\./, "").replace(/\.$/, "");
+  const normalizedPattern = pattern.toLowerCase().replace(/^\./, "").replace(/\.$/, "");
+  return normalizedHost === normalizedPattern || normalizedHost.endsWith(`.${normalizedPattern}`);
+}
+function clonePolicy(policy) {
+  return JSON.parse(JSON.stringify(policy));
+}
+function messageFromError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+export { canonicalJson, canonicalPolicyBundlePayload, verifyPolicyBundle };
+//# sourceMappingURL=chunk-25A7QG5Z.mjs.map
+//# sourceMappingURL=chunk-25A7QG5Z.mjs.map

package/dist/chunk-25A7QG5Z.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/bundle.ts"],"names":[],"mappings":";;;AAYA,IAAM,WAAA,GAAc,IAAI,WAAA,EAAY;AACpC,IAAM,8BAAA,GAAiC,GAAA;AAEvC,eAAsB,kBAAA,CACpB,OAAA,EACA,MAAA,EACA,YAAA,EACyC;AACzC,EAAA,IAAI;AACF,IAAA,gBAAA,CAAiB,OAAO,CAAA;AACxB,IAAA,gBAAA,CAAiB,OAAO,QAAQ,CAAA;AAAA,EAClC,SAAS,KAAA,EAAO;AACd,IAAA,OAAO,EAAE,IAAI,KAAA,EAAO,SAAA,EAAW,qBAAqB,gBAAA,CAAiB,KAAK,CAAC,CAAA,CAAA,EAAG;AAAA,EAChF;AAEA,EAAA,IAAI,MAAA,CAAO,kBAAkB,CAAA,EAAG;AAC9B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,SAAA,EAAW,4BAAA,EAA6B;AAAA,EAC9D;AAEA,EAAA,MAAM,cAAc,MAAM,eAAA;AAAA,IACxB,OAAO,SAAA,CAAU,SAAA;AAAA,IACjB,YAAA;AAAA,IACA,OAAO,SAAA,CAAU,KAAA;AAAA,IACjB,6BAA6B,MAAM;AAAA,GACrC;AAEA,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,SAAA,EAAW,eAAA,EAAgB;AAAA,EACjD;AAEA,EAAA,MAAM,cAAA,GAAiB,wBAAA,CAAyB,MAAA,CAAO,QAAQ,CAAA;AAE/D,EAAA,IAAI,mBAAmB,MAAA,EAAW;AAChC,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,SAAA,EAAW,cAAA,EAAe;AAAA,EAChD;AAEA,EAAA,MAAM,qBAAA,GAAwB,iBAAA,CAAkB,OAAA,EAAS,MAAA,CAAO,QAAQ,CAAA;AAExE,EAAA,IAAI,0BAA0B,MAAA,EAAW;AACvC,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,SAAA,EAAW,qBAAA,EAAsB;AAAA,EACvD;AAEA,EAAA,OAAO,EAAE,IAAI,IAAA,EAAM,QAAA,EAAU,OAAO,QAAA,CAAS,GAAA,CAAI,WAAW,CAAA,EAAE;AAChE;AAEO,SAAS,6BACd,MAAA,EACQ;AACR,EAAA,OAAO,aAAA,CAAc;AAAA,IACnB,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,UAAU,MAAA,CAAO;AAAA,GAClB,CAAA;AACH;AAEO,SAAS,cAAc,KAAA,EAAwB;AACpD,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,EAAU;AAC/C,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AACxD,MAAA,MAAM,IAAI,UAAU,6CAA6C,CAAA;AAAA,IACnE;AAEA,IAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EAC7B;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,CAAA,CAAA,EAAI,KAAA,CAAM,GAAA,CAAI,CAAC,IAAA,KAAS,aAAA,CAAc,IAAI,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EAC/D;AAEA,EAAA,MAAM,MAAA,GAAS,KAAA;AACf,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAC/B,MAAA,CAAO,CAAC,GAAA,KAAQ,MAAA,CAAO,GAAG,CAAA,KAAM,MAAS,CAAA,CACzC,IAAA,EAAK,CACL,GAAA,CAAI,CAAC,GAAA,KAAQ,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,EAAI,aAAA,CAAc,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA,CAAE,CAAA;AAEtE,EAAA,OAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC9B;AAEA,SAAS,iBAAA,CACP,SACA,MAAA,EACoB;AACpB,EAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,MAAA,CAAO,GAAA,CAAI,CAAC,MAAA,KAAW,CAAC,MAAA,CAAO,EAAA,EAAI,MAAM,CAAC,CAAC,CAAA;AAEtE,EAAA,KAAA,MAAW,iBAAiB,OAAA,EAAS;AACnC,IAAA,MAAM,aAAA,GAAgB,UAAA,CAAW,GAAA,CAAI,aAAA,CAAc,EAAE,CAAA;AAErD,IAAA,IAAI,kBAAkB,MAAA,EAAW;AAC/B,MAAA,OAAO,CAAA,eAAA,EAAkB,cAAc,EAAE,CAAA,CAAA;AAAA,IAC3C;AAEA,IAAA,MAAM,eAAA,GAAkB,kBAAA,CAAmB,aAAA,EAAe,aAAa,CAAA;AAEvE,IAAA,IAAI,oBAAoB,MAAA,EAAW;AACjC,MAAA,OAAO,CAAA,EAAG,aAAA,CAAc,EAAE,CAAA,CAAA,EAAI,eAAe,CAAA,CAAA;AAAA,IAC/C;AAEA,IAAA,MAAM,eAAA,GAAkB,kBAAA,CAAmB,aAAA,EAAe,aAAa,CAAA;AAEvE,IAAA,IAAI,oBAAoB,MAAA,EAAW;AACjC,MAAA,OAAO,CAAA,EAAG,aAAA,CAAc,EAAE,CAAA,CAAA,EAAI,eAAe,CAAA,CAAA;AAAA,IAC/C;AAEA,IAAA,IAAI,CAAC,QAAA,CAAS,aAAA,CAAc,UAAA,EAAY,aAAA,CAAc,UAAU,CAAA,EAAG;AACjE,MAAA,OAAO,CAAA,EAAG,cAAc,EAAE,CAAA,kBAAA,CAAA;AAAA,IAC5B;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,kBAAA,CACP,eACA,aAAA,EACoB;AACpB,EAAA,IACE,CAAC,kBAAA;AAAA,IACC,cAAc,SAAA,CAAU,eAAA;AAAA,IACxB,cAAc,SAAA,CAAU,eAAA;AAAA,IACxB,EAAE,iBAAiB,IAAA;AAAK,GAC1B,EACA;AACA,IAAA,OAAO,2BAAA;AAAA,EACT;AAEA,EAAA,IACE,CAAC,iBAAA;AAAA,IACC,cAAc,SAAA,CAAU,aAAA;AAAA,IACxB,cAAc,SAAA,CAAU;AAAA,GAC1B,EACA;AACA,IAAA,OAAO,yBAAA;AAAA,EACT;AAEA,EAAA,IACE,CAAC,kBAAA;AAAA,IACC,cAAc,SAAA,CAAU,eAAA;AAAA,IACxB,cAAc,SAAA,CAAU;AAAA,GAC1B,EACA;AACA,IAAA,OAAO,2BAAA;AAAA,EACT;AAEA,EAAA,IACE,CAAC,kBAAA;AAAA,IACC,cAAc,SAAA,CAAU,cAAA;AAAA,IACxB,cAAc,SAAA,CAAU;AAAA,GAC1B,EACA;AACA,IAAA,OAAO,0BAAA;AAAA,EACT;AAEA,EAAA,IACE,CAAC,qBAAA;AAAA,IACC,cAAc,SAAA,CAAU,cAAA;AAAA,IACxB,cAAc,SAAA,CAAU;AAAA,GAC1B,EACA;AACA,IAAA,OAAO,0BAAA;AAAA,EACT;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,kBAAA,CACP,eACA,aAAA,EACoB;AACpB,EAAA,IAAI,aAAA,CAAc,SAAA,CAAU,KAAA,KAAU,aAAA,CAAc,UAAU,KAAA,EAAO;AACnE,IAAA,OAAO,wBAAA;AAAA,EACT;AAEA,EAAA,IAAI,aAAA,CAAc,SAAA,CAAU,WAAA,KAAgB,aAAA,CAAc,UAAU,WAAA,EAAa;AAC/E,IAAA,OAAO,qBAAA;AAAA,EACT;AAEA,EAAA,IAAI,aAAA,CAAc,SAAA,CAAU,aAAA,GAAgB,aAAA,CAAc,UAAU,aAAA,EAAe;AACjF,IAAA,OAAO,wBAAA;AAAA,EACT;AAEA,EAAA,IACE,aAAA,CAAc,SAAA,CAAU,YAAA,KAAiB,MAAA,KACxC,aAAA,CAAc,SAAA,CAAU,YAAA,KAAiB,MAAA,IACxC,aAAA,CAAc,SAAA,CAAU,YAAA,GAAe,aAAA,CAAc,UAAU,YAAA,CAAA,EACjE;AACA,IAAA,OAAO,+BAAA;AAAA,EACT;AAEA,EAAA,KAAA,MAAW,QAAA,IAAY,aAAA,CAAc,SAAA,CAAU,SAAA,EAAW;AACxD,IAAA,IAAI,CAAC,aAAA,CAAc,SAAA,CAAU,SAAA,CAAU,QAAA,CAAS,QAAQ,CAAA,EAAG;AACzD,MAAA,OAAO,4BAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,kBAAA,CACP,OAAA,EACA,MAAA,EACA,IAAA,GAAsC,EAAC,EAC9B;AACT,EAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,OAAA,KAAY,MAAA,EAAW;AACjD,IAAA,OAAO,MAAA,KAAW,MAAA;AAAA,EACpB;AAEA,EAAA,IAAI,OAAA,KAAY,MAAA,IAAa,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG;AACjD,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,MAAA,KAAW,MAAA,EAAW;AAChD,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG;AAC/C,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,OAAA,CAAQ,KAAA;AAAA,IAAM,CAAC,SACpB,MAAA,CAAO,IAAA,CAAK,CAAC,SAAA,KAAc,gBAAA,CAAiB,IAAA,EAAM,SAAS,CAAC;AAAA,GAC9D;AACF;AAEA,SAAS,yBACP,QAAA,EACoB;AACpB,EAAA,KAAA,MAAW,UAAU,QAAA,EAAU;AAC7B,IAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,CAAA,IAAK,iBAAA,CAAkB,MAAM,CAAA,EAAG;AACtD,MAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,IAAS,EAAC,EAAG;AAC9B,QAAA,IAAI,KAAK,IAAA,KAAS,OAAA,IAAW,cAAA,CAAe,IAAA,CAAK,OAAO,CAAA,EAAG;AACzD,UAAA,OAAO,CAAA,EAAG,MAAA,CAAO,EAAE,CAAA,eAAA,EAAkB,KAAK,CAAA,CAAA;AAAA,QAC5C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,kBACP,MAAA,EACmE;AACnE,EAAA,OAAO;AAAA,IACL,CAAC,2BAAA,EAA6B,MAAA,CAAO,SAAA,CAAU,eAAe,CAAA;AAAA,IAC9D,CAAC,2BAAA,EAA6B,MAAA,CAAO,SAAA,CAAU,eAAe;AAAA,GAChE;AACF;AAEA,SAAS,eAAe,OAAA,EAA0B;AAChD,EAAA,OACE,OAAA,CAAQ,MAAA,GAAS,8BAAA,IACjB,qBAAA,CAAsB,OAAO,KAC7B,kBAAA,CAAmB,OAAO,CAAA,IAC1B,4BAAA,CAA6B,OAAO,CAAA;AAExC;AAEA,SAAS,sBAAsB,OAAA,EAA0B;AACvD,EAAA,OAAO,kBAAA,CAAmB,KAAK,OAAO,CAAA;AACxC;AAEA,SAAS,mBAAmB,OAAA,EAA0B;AACpD,EAAA,OAAO,oBAAA,CAAqB,KAAK,OAAO,CAAA;AAC1C;AAEA,SAAS,6BAA6B,OAAA,EAA0B;AAC9D,EAAA,OAAO,4DAAA,CAA6D,IAAA;AAAA,IAClE;AAAA,GACF;AACF;AAEA,SAAS,gBAAA,CAAiB,SAAqB,MAAA,EAA6B;AAC1E,EAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,QAAA,IAAY,MAAA,CAAO,SAAS,QAAA,EAAU;AACzD,IAAA,OAAO,mBAAA,CAAoB,OAAA,CAAQ,OAAA,EAAS,MAAA,CAAO,OAAO,CAAA;AAAA,EAC5D;AAEA,EAAA,OAAO,QAAA,CAAS,SAAS,MAAM,CAAA;AACjC;AAEA,SAAS,iBAAA,CACP,SACA,MAAA,EACS;AACT,EAAA,OAAO,iBAAA,CAAkB,SAAS,MAAM,CAAA;AAC1C;AAEA,SAAS,kBAAA,CACP,SACA,MAAA,EACS;AACT,EAAA,OAAO,iBAAA,CAAkB,SAAS,MAAM,CAAA;AAC1C;AAEA,SAAS,qBAAA,CACP,SACA,MAAA,EACS;AACT,EAAA,OAAO,iBAAA,CAAkB,SAAS,MAAM,CAAA;AAC1C;AAEA,SAAS,iBAAA,CACP,SACA,MAAA,EACS;AACT,EAAA,IAAI,OAAA,KAAY,MAAA,IAAa,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG;AACjD,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG;AAC/C,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,YAAA,GAAe,IAAI,GAAA,CAAI,MAAA,CAAO,GAAA,CAAI,CAAC,IAAA,KAAS,aAAA,CAAc,IAAI,CAAC,CAAC,CAAA;AAEtE,EAAA,OAAO,OAAA,CAAQ,MAAM,CAAC,IAAA,KAAS,aAAa,GAAA,CAAI,aAAA,CAAc,IAAI,CAAC,CAAC,CAAA;AACtE;AAEA,eAAe,eAAA,CACb,SAAA,EACA,YAAA,EACA,cAAA,EACA,OAAA,EACkB;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,MAAM,qBAAA,CAAsB,SAAA,EAAW,YAAY,CAAA;AACrE,IAAA,MAAM,SAAA,GAAY,iBAAiB,cAAc,CAAA;AACjD,IAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,WAAA,CAAY,MAAA,CAAO,OAAO,CAAC,CAAA;AAE3D,IAAA,IAAI,cAAc,YAAA,EAAc;AAC9B,MAAA,OAAO,OAAO,MAAA,CAAO,MAAA;AAAA,QACnB,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,QACjC,SAAA;AAAA,QACA,mBAAmB,SAAS,CAAA;AAAA,QAC5B;AAAA,OACF;AAAA,IACF;AAEA,IAAA,OAAO,OAAO,MAAA,CAAO,MAAA;AAAA,MACnB,SAAA;AAAA,MACA,SAAA;AAAA,MACA,mBAAmB,SAAS,CAAA;AAAA,MAC5B;AAAA,KACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,eAAe,qBAAA,CACb,WACA,YAAA,EACoB;AACpB,EAAA,IAAI,cAAc,YAAA,EAAc;AAC9B,IAAA,OAAO,OAAO,MAAA,CAAO,SAAA;AAAA,MACnB,KAAA;AAAA,MACA,YAAA;AAAA,MACA,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,MACrC,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AAAA,EACF;AAEA,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,YAAA,EAAc,WAAW,KAAA,EAAO;AAAA,IACpE;AAAA,GACD,CAAA;AACH;AAEA,SAAS,iBAAiB,KAAA,EAA2B;AACnD,EAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,OAAO,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,EAAG,GAAG,CAAA;AAClE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAE1C,EAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,MAAA,CAAO,MAAA,EAAQ,SAAS,CAAA,EAAG;AACrD,IAAA,KAAA,CAAM,KAAK,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,KAAK,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,mBAAmB,KAAA,EAAgC;AAC1D,EAAA,OAAO,MAAM,MAAA,CAAO,KAAA;AAAA,IAClB,KAAA,CAAM,UAAA;AAAA,IACN,KAAA,CAAM,aAAa,KAAA,CAAM;AAAA,GAC3B;AACF;AAEA,SAAS,QAAA,CAAS,MAAe,KAAA,EAAyB;AACxD,EAAA,OAAO,aAAA,CAAc,IAAI,CAAA,KAAM,aAAA,CAAc,KAAK,CAAA;AACpD;AAEA,SAAS,mBAAA,CAAoB,MAAc,OAAA,EAA0B;AACnE,EAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,WAAA,EAAY,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC9E,EAAA,MAAM,iBAAA,GAAoB,OAAA,CACvB,WAAA,EAAY,CACZ,OAAA,CAAQ,OAAO,EAAE,CAAA,CACjB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEpB,EAAA,OACE,mBAAmB,iBAAA,IACnB,cAAA,CAAe,QAAA,CAAS,CAAA,CAAA,EAAI,iBAAiB,CAAA,CAAE,CAAA;AAEnD;AAEA,SAAS,YAAY,MAAA,EAA0C;AAC7D,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAC1C;AAEA,SAAS,iBAAiB,KAAA,EAAwB;AAChD,EAAA,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAC9D","file":"chunk-25A7QG5Z.mjs","sourcesContent":["import type {\n  CookieRule,\n  DomainRule,\n  InitiatorRule,\n  ParamRule,\n  PolicyBundleVerificationResult,\n  SignedBundleSignatureAlgorithm,\n  SignedPolicyBundle,\n  StanddownPolicy,\n} from './types';\nimport { validatePolicies } from './validation';\n\nconst textEncoder = new TextEncoder();\nconst MAX_SIGNED_BUNDLE_REGEX_LENGTH = 256;\n\nexport async function verifyPolicyBundle(\n  current: readonly StanddownPolicy[],\n  update: SignedPolicyBundle,\n  publicKeyJwk: JsonWebKey,\n): Promise<PolicyBundleVerificationResult> {\n  try {\n    validatePolicies(current);\n    validatePolicies(update.policies);\n  } catch (error) {\n    return { ok: false, violation: `malformed-policy: ${messageFromError(error)}` };\n  }\n\n  if (update.schemaVersion !== 1) {\n    return { ok: false, violation: 'unsupported-bundle-version' };\n  }\n\n  const signatureOk = await verifySignature(\n    update.signature.algorithm,\n    publicKeyJwk,\n    update.signature.value,\n    canonicalPolicyBundlePayload(update),\n  );\n\n  if (!signatureOk) {\n    return { ok: false, violation: 'bad-signature' };\n  }\n\n  const regexViolation = regexComplexityViolation(update.policies);\n\n  if (regexViolation !== undefined) {\n    return { ok: false, violation: regexViolation };\n  }\n\n  const monotonicityViolation = checkMonotonicity(current, update.policies);\n\n  if (monotonicityViolation !== undefined) {\n    return { ok: false, violation: monotonicityViolation };\n  }\n\n  return { ok: true, policies: update.policies.map(clonePolicy) };\n}\n\nexport function canonicalPolicyBundlePayload(\n  bundle: Pick<SignedPolicyBundle, 'schemaVersion' | 'policies'>,\n): string {\n  return canonicalJson({\n    schemaVersion: bundle.schemaVersion,\n    policies: bundle.policies,\n  });\n}\n\nexport function canonicalJson(value: unknown): string {\n  if (value === null || typeof value !== 'object') {\n    if (typeof value === 'number' && !Number.isFinite(value)) {\n      throw new TypeError('canonical JSON only supports finite numbers');\n    }\n\n    return JSON.stringify(value);\n  }\n\n  if (Array.isArray(value)) {\n    return `[${value.map((item) => canonicalJson(item)).join(',')}]`;\n  }\n\n  const record = value as Record<string, unknown>;\n  const entries = Object.keys(record)\n    .filter((key) => record[key] !== undefined)\n    .sort()\n    .map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`);\n\n  return `{${entries.join(',')}}`;\n}\n\nfunction checkMonotonicity(\n  current: readonly StanddownPolicy[],\n  update: readonly StanddownPolicy[],\n): string | undefined {\n  const updateById = new Map(update.map((policy) => [policy.id, policy]));\n\n  for (const currentPolicy of current) {\n    const updatedPolicy = updateById.get(currentPolicy.id);\n\n    if (updatedPolicy === undefined) {\n      return `policy-removed:${currentPolicy.id}`;\n    }\n\n    const detectionResult = detectionViolation(currentPolicy, updatedPolicy);\n\n    if (detectionResult !== undefined) {\n      return `${currentPolicy.id}:${detectionResult}`;\n    }\n\n    const standdownResult = standdownViolation(currentPolicy, updatedPolicy);\n\n    if (standdownResult !== undefined) {\n      return `${currentPolicy.id}:${standdownResult}`;\n    }\n\n    if (!sameJson(currentPolicy.activation, updatedPolicy.activation)) {\n      return `${currentPolicy.id}:activation-edited`;\n    }\n  }\n\n  return undefined;\n}\n\nfunction detectionViolation(\n  currentPolicy: StanddownPolicy,\n  updatedPolicy: StanddownPolicy,\n): string | undefined {\n  if (\n    !domainRulesSurvive(\n      currentPolicy.detection.advertiserHosts,\n      updatedPolicy.detection.advertiserHosts,\n      { advertiserHosts: true },\n    )\n  ) {\n    return 'advertiser-hosts-narrowed';\n  }\n\n  if (\n    !paramRulesSurvive(\n      currentPolicy.detection.landingParams,\n      updatedPolicy.detection.landingParams,\n    )\n  ) {\n    return 'landing-params-narrowed';\n  }\n\n  if (\n    !domainRulesSurvive(\n      currentPolicy.detection.redirectDomains,\n      updatedPolicy.detection.redirectDomains,\n    )\n  ) {\n    return 'redirect-domains-narrowed';\n  }\n\n  if (\n    !cookieRulesSurvive(\n      currentPolicy.detection.cookiePatterns,\n      updatedPolicy.detection.cookiePatterns,\n    )\n  ) {\n    return 'cookie-patterns-narrowed';\n  }\n\n  if (\n    !initiatorRulesSurvive(\n      currentPolicy.detection.initiatorRules,\n      updatedPolicy.detection.initiatorRules,\n    )\n  ) {\n    return 'initiator-rules-narrowed';\n  }\n\n  return undefined;\n}\n\nfunction standdownViolation(\n  currentPolicy: StanddownPolicy,\n  updatedPolicy: StanddownPolicy,\n): string | undefined {\n  if (updatedPolicy.standdown.scope !== currentPolicy.standdown.scope) {\n    return 'standdown-scope-edited';\n  }\n\n  if (updatedPolicy.standdown.sessionRule !== currentPolicy.standdown.sessionRule) {\n    return 'session-rule-edited';\n  }\n\n  if (updatedPolicy.standdown.minDurationMs < currentPolicy.standdown.minDurationMs) {\n    return 'min-duration-shortened';\n  }\n\n  if (\n    currentPolicy.standdown.inactivityMs !== undefined &&\n    (updatedPolicy.standdown.inactivityMs === undefined ||\n      updatedPolicy.standdown.inactivityMs < currentPolicy.standdown.inactivityMs)\n  ) {\n    return 'inactivity-duration-shortened';\n  }\n\n  for (const behavior of currentPolicy.standdown.behaviors) {\n    if (!updatedPolicy.standdown.behaviors.includes(behavior)) {\n      return 'standdown-behavior-removed';\n    }\n  }\n\n  return undefined;\n}\n\nfunction domainRulesSurvive(\n  current: readonly DomainRule[] | undefined,\n  update: readonly DomainRule[] | undefined,\n  opts: { advertiserHosts?: boolean } = {},\n): boolean {\n  if (opts.advertiserHosts && current === undefined) {\n    return update === undefined;\n  }\n\n  if (current === undefined || current.length === 0) {\n    return true;\n  }\n\n  if (opts.advertiserHosts && update === undefined) {\n    return true;\n  }\n\n  if (update === undefined || update.length === 0) {\n    return false;\n  }\n\n  return current.every((rule) =>\n    update.some((candidate) => domainRuleCovers(rule, candidate)),\n  );\n}\n\nfunction regexComplexityViolation(\n  policies: readonly StanddownPolicy[],\n): string | undefined {\n  for (const policy of policies) {\n    for (const [field, rules] of domainRuleEntries(policy)) {\n      for (const rule of rules ?? []) {\n        if (rule.kind === 'regex' && isComplexRegex(rule.pattern)) {\n          return `${policy.id}:complex-regex:${field}`;\n        }\n      }\n    }\n  }\n\n  return undefined;\n}\n\nfunction domainRuleEntries(\n  policy: StanddownPolicy,\n): readonly (readonly [string, readonly DomainRule[] | undefined])[] {\n  return [\n    ['detection.advertiserHosts', policy.detection.advertiserHosts],\n    ['detection.redirectDomains', policy.detection.redirectDomains],\n  ] as const;\n}\n\nfunction isComplexRegex(pattern: string): boolean {\n  return (\n    pattern.length > MAX_SIGNED_BUNDLE_REGEX_LENGTH ||\n    hasRegexBackreference(pattern) ||\n    hasRegexLookaround(pattern) ||\n    hasNestedUnboundedQuantifier(pattern)\n  );\n}\n\nfunction hasRegexBackreference(pattern: string): boolean {\n  return /(^|[^\\\\])\\\\[1-9]/.test(pattern);\n}\n\nfunction hasRegexLookaround(pattern: string): boolean {\n  return /\\(\\?(?:[=!]|<[=!])/.test(pattern);\n}\n\nfunction hasNestedUnboundedQuantifier(pattern: string): boolean {\n  return /\\((?:[^()\\\\]|\\\\.)*[+*](?:[^()\\\\]|\\\\.)*\\)(?:[+*]|\\{\\d*,?\\})/.test(\n    pattern,\n  );\n}\n\nfunction domainRuleCovers(current: DomainRule, update: DomainRule): boolean {\n  if (current.kind === 'suffix' && update.kind === 'suffix') {\n    return domainSuffixMatches(current.pattern, update.pattern);\n  }\n\n  return sameJson(current, update);\n}\n\nfunction paramRulesSurvive(\n  current: readonly ParamRule[] | undefined,\n  update: readonly ParamRule[] | undefined,\n): boolean {\n  return exactRulesSurvive(current, update);\n}\n\nfunction cookieRulesSurvive(\n  current: readonly CookieRule[] | undefined,\n  update: readonly CookieRule[] | undefined,\n): boolean {\n  return exactRulesSurvive(current, update);\n}\n\nfunction initiatorRulesSurvive(\n  current: readonly InitiatorRule[] | undefined,\n  update: readonly InitiatorRule[] | undefined,\n): boolean {\n  return exactRulesSurvive(current, update);\n}\n\nfunction exactRulesSurvive<T>(\n  current: readonly T[] | undefined,\n  update: readonly T[] | undefined,\n): boolean {\n  if (current === undefined || current.length === 0) {\n    return true;\n  }\n\n  if (update === undefined || update.length === 0) {\n    return false;\n  }\n\n  const updatedRules = new Set(update.map((rule) => canonicalJson(rule)));\n\n  return current.every((rule) => updatedRules.has(canonicalJson(rule)));\n}\n\nasync function verifySignature(\n  algorithm: SignedBundleSignatureAlgorithm,\n  publicKeyJwk: JsonWebKey,\n  signatureValue: string,\n  payload: string,\n): Promise<boolean> {\n  try {\n    const publicKey = await importVerificationKey(algorithm, publicKeyJwk);\n    const signature = base64UrlToBytes(signatureValue);\n    const data = bytesToArrayBuffer(textEncoder.encode(payload));\n\n    if (algorithm === 'ECDSA-P256') {\n      return crypto.subtle.verify(\n        { name: 'ECDSA', hash: 'SHA-256' },\n        publicKey,\n        bytesToArrayBuffer(signature),\n        data,\n      );\n    }\n\n    return crypto.subtle.verify(\n      'Ed25519',\n      publicKey,\n      bytesToArrayBuffer(signature),\n      data,\n    );\n  } catch {\n    return false;\n  }\n}\n\nasync function importVerificationKey(\n  algorithm: SignedBundleSignatureAlgorithm,\n  publicKeyJwk: JsonWebKey,\n): Promise<CryptoKey> {\n  if (algorithm === 'ECDSA-P256') {\n    return crypto.subtle.importKey(\n      'jwk',\n      publicKeyJwk,\n      { name: 'ECDSA', namedCurve: 'P-256' },\n      false,\n      ['verify'],\n    );\n  }\n\n  return crypto.subtle.importKey('jwk', publicKeyJwk, 'Ed25519', false, [\n    'verify',\n  ]);\n}\n\nfunction base64UrlToBytes(value: string): Uint8Array {\n  const base64 = value.replace(/-/g, '+').replace(/_/g, '/');\n  const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');\n  const binary = atob(padded);\n  const bytes = new Uint8Array(binary.length);\n\n  for (let index = 0; index < binary.length; index += 1) {\n    bytes[index] = binary.charCodeAt(index);\n  }\n\n  return bytes;\n}\n\nfunction bytesToArrayBuffer(bytes: Uint8Array): ArrayBuffer {\n  return bytes.buffer.slice(\n    bytes.byteOffset,\n    bytes.byteOffset + bytes.byteLength,\n  ) as ArrayBuffer;\n}\n\nfunction sameJson(left: unknown, right: unknown): boolean {\n  return canonicalJson(left) === canonicalJson(right);\n}\n\nfunction domainSuffixMatches(host: string, pattern: string): boolean {\n  const normalizedHost = host.toLowerCase().replace(/^\\./, '').replace(/\\.$/, '');\n  const normalizedPattern = pattern\n    .toLowerCase()\n    .replace(/^\\./, '')\n    .replace(/\\.$/, '');\n\n  return (\n    normalizedHost === normalizedPattern ||\n    normalizedHost.endsWith(`.${normalizedPattern}`)\n  );\n}\n\nfunction clonePolicy(policy: StanddownPolicy): StanddownPolicy {\n  return JSON.parse(JSON.stringify(policy)) as StanddownPolicy;\n}\n\nfunction messageFromError(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n"]}