standdown 0.1.0 → 0.2.0

package/dist/content.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/content.ts"],"names":["decision"],"mappings":";;;;;AAqBA,IAAM,4BAAA,GAA+B,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AACpD,IAAM,qBAAA,GAAwB;AAAA,EAC5B,kBAAA;AAAA,EACA,iBAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;AAyDO,SAAS,uBACd,IAAA,EAC4B;AAC5B,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,IAAU,aAAA,EAAc;AAChD,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,GAAA;AAC7B,EAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,IAAS,kBAAA,CAAmB,UAAA,EAAY,MAAM,GAAG,CAAA;AACpE,EAAA,MAAM,UAAU,IAAI,gBAAA;AAAA,IAClB,KAAA;AAAA,IACA,KAAK,QAAA,KAAa,MAAA,GAAY,SAAY,EAAE,QAAA,EAAU,KAAK,QAAA;AAAS,GACtE;AAEA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,MAAM,cAAA,GAAiB,YAAA,CAAa,UAAA,EAAY,kBAAkB,CAAA;AAClE,EAAA,MAAM,aAAa,MAAM;AACvB,IAAA,kBAAA,EAAmB;AAAA,EACrB,CAAA;AAEA,EAAA,UAAA,EAAY,gBAAA,GAAmB,YAAY,UAAU,CAAA;AAErD,EAAA,eAAe,QAAA,GAA8B;AAC3C,IAAA,IAAI,OAAA;AAEJ,IAAA,IAAI;AACF,MAAA,MAAM,aAAA,GAKF,EAAE,GAAA,EAAI;AAEV,MAAA,IAAI,eAAe,KAAA,CAAA,EAAW;AAC5B,QAAA,aAAA,CAAc,MAAA,GAAS,UAAA;AAAA,MACzB;AAEA,MAAA,IAAI,IAAA,CAAK,iBAAiB,KAAA,CAAA,EAAW;AACnC,QAAA,aAAA,CAAc,eAAe,IAAA,CAAK,YAAA;AAAA,MACpC;AAEA,MAAA,IAAI,IAAA,CAAK,mBAAmB,KAAA,CAAA,EAAW;AACrC,QAAA,aAAA,CAAc,iBAAiB,IAAA,CAAK,cAAA;AAAA,MACtC;AAEA,MAAA,OAAA,GAAU,sBAAsB,aAAa,CAAA;AAAA,IAC/C,CAAA,CAAA,MAAQ;AACN,MAAA,MAAMA,SAAAA,GAAW,mBAAmB,yBAAyB,CAAA;AAC7D,MAAA,IAAA,CAAK,aAAaA,SAAAA,EAAU;AAAA,QAC1B,GAAA,EAAK,EAAA;AAAA,QACL,KAAK,GAAA;AAAI,OACV,CAAA;AACD,MAAA,OAAOA,SAAAA;AAAA,IACT;AAEA,IAAA,MAAM,WAAW,MAAM,OAAA,CAAQ,MAAA,CAAO,OAAA,EAAS,KAAK,QAAQ,CAAA;AAC5D,IAAA,IAAA,CAAK,UAAA,GAAa,UAAU,OAAO,CAAA;AACnC,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,SAAS,kBAAA,GAA2B;AAClC,IAAA,IAAI,YAAY,OAAA,EAAS;AACvB,MAAA;AAAA,IACF;AAEA,IAAA,OAAA,GAAU,IAAA;AACV,IAAA,MAAM,MAAM,MAAM;AAChB,MAAA,OAAA,GAAU,KAAA;AAEV,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,KAAK,QAAA,EAAS;AAAA,MAChB;AAAA,IACF,CAAA;AAEA,IAAA,IAAI,UAAA,EAAY,eAAe,MAAA,EAAW;AACxC,MAAA,UAAA,CAAW,UAAA,CAAW,KAAK,CAAC,CAAA;AAC5B,MAAA;AAAA,IACF;AAEA,IAAA,cAAA,CAAe,GAAG,CAAA;AAAA,EACpB;AAEA,EAAA,eAAe,eAAA,CACb,cAAA,EACA,EAAA,GAAK,GAAA,EAAI,EACU;AACnB,IAAA,MAAM,IAAA,GACJ,mBACC,UAAA,KAAe,MAAA,GAAY,SAAY,WAAA,CAAY,UAAA,CAAW,SAAS,IAAI,CAAA,CAAA;AAE9E,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAO,mBAAmB,yBAAyB,CAAA;AAAA,IACrD;AAEA,IAAA,OAAO,OAAA,CAAQ,eAAA,CAAgB,IAAA,EAAM,EAAE,CAAA;AAAA,EACzC;AAEA,EAAA,SAAS,OAAA,GAAgB;AACvB,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,cAAA,EAAe;AACf,IAAA,UAAA,EAAY,mBAAA,GAAsB,YAAY,UAAU,CAAA;AAAA,EAC1D;AAEA,EAAA,MAAM,QAAQ,QAAA,EAAS;AAEvB,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACF;AACF;AAEO,SAAS,qBAAA,CACd,IAAA,GAAqC,EAAC,EAC7B;AACT,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,IAAU,aAAA,EAAc;AAChD,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,GAAA;AAE7B,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,OAAA,GAAmB;AAAA,IACvB,GAAA,EAAK,WAAW,QAAA,CAAS,IAAA;AAAA,IACzB,KAAK,GAAA;AAAI,GACX;AACA,EAAA,MAAM,QAAA,GAAW,WAAW,QAAA,CAAS,QAAA;AACrC,EAAA,MAAM,WAAA,GAAc,qBAAA,CAAsB,UAAA,CAAW,QAAA,CAAS,MAAM,CAAA;AAEpE,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AACjD,IAAA,OAAA,CAAQ,QAAA,GAAW,QAAA;AAAA,EACrB;AAEA,EAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,IAAA,OAAA,CAAQ,WAAA,GAAc,WAAA;AAAA,EACxB;AAEA,EAAA,IAAI,IAAA,CAAK,iBAAiB,MAAA,EAAW;AACnC,IAAA,OAAA,CAAQ,eAAe,IAAA,CAAK,YAAA;AAAA,EAC9B;AAEA,EAAA,IAAI,IAAA,CAAK,mBAAmB,MAAA,EAAW;AACrC,IAAA,OAAA,CAAQ,iBAAiB,IAAA,CAAK,cAAA;AAAA,EAChC;AAEA,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,sBAAsB,MAAA,EAA0B;AAC9D,EAAA,IAAI,MAAA,CAAO,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AAC9B,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,OAAO,OACJ,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAA,EAAM,EACzB,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,CAAC,CAAA,CAChC,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK,IAAK,EAAE,EAC9C,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,CAAC,CAAA;AACrC;AAEA,SAAS,kBAAA,CACP,UAAA,EACA,IAAA,EACA,GAAA,EACY;AACZ,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,OAAO,IAAI,sBAAsB,4BAA4B,CAAA;AAAA,EAC/D;AAEA,EAAA,IAAI,IAAA,CAAK,YAAY,WAAA,EAAa;AAChC,IAAA,IAAI,UAAA,CAAW,iBAAiB,MAAA,EAAW;AACzC,MAAA,OAAO,IAAI,sBAAsB,0BAA0B,CAAA;AAAA,IAC7D;AAEA,IAAA,MAAM,YAAA,GAIF;AAAA,MACF,KAAA,EAAO,KAAK,KAAA,IAAS,4BAAA;AAAA,MACrB;AAAA,KACF;AAEA,IAAA,IAAI,UAAA,CAAW,mBAAmB,MAAA,EAAW;AAC3C,MAAA,YAAA,CAAa,iBAAiB,UAAA,CAAW,cAAA;AAAA,IAC3C;AAEA,IAAA,OAAO,IAAI,yBAAA,CAA0B,UAAA,CAAW,YAAA,EAAc,YAAY,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,UAAA,CAAW,mBAAmB,MAAA,EAAW;AAC3C,IAAA,OAAO,IAAI,sBAAsB,4BAA4B,CAAA;AAAA,EAC/D;AAEA,EAAA,OAAO,IAAI,wBAAA,CAAyB,UAAA,CAAW,cAAc,CAAA;AAC/D;AAEA,SAAS,YAAA,CACP,YACA,YAAA,EACY;AACZ,EAAA,MAAM,UAAU,UAAA,EAAY,OAAA;AAE5B,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,OAAO,MAAM;AAAA,IAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,iBAAA,GAAoB,OAAA,CAAQ,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA;AACxD,EAAA,MAAM,oBAAA,GAAuB,OAAA,CAAQ,YAAA,CAAa,IAAA,CAAK,OAAO,CAAA;AAE9D,EAAA,OAAA,CAAQ,SAAA,GAAY,IAAI,IAAA,KAAS;AAC/B,IAAA,iBAAA,CAAkB,GAAG,IAAI,CAAA;AACzB,IAAA,YAAA,EAAa;AAAA,EACf,CAAA;AAEA,EAAA,OAAA,CAAQ,YAAA,GAAe,IAAI,IAAA,KAAS;AAClC,IAAA,oBAAA,CAAqB,GAAG,IAAI,CAAA;AAC5B,IAAA,YAAA,EAAa;AAAA,EACf,CAAA;AAEA,EAAA,OAAO,MAAM;AACX,IAAA,OAAA,CAAQ,SAAA,GAAY,iBAAA;AACpB,IAAA,OAAA,CAAQ,YAAA,GAAe,oBAAA;AAAA,EACzB,CAAA;AACF;AAEA,SAAS,aAAA,GAA+C;AACtD,EAAA,MAAM,QAAS,UAAA,CAEZ,MAAA;AAEH,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,YAAY,KAAA,EAAmC;AACtD,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,IAAI,KAAK,CAAA,CAAE,SAAS,WAAA,EAAY,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,MAAA,EAA0B;AACpD,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,IAAA;AAAA,IACX,MAAA;AAAA,IACA,SAAA,EAAW,CAAC,GAAG,qBAAqB;AAAA,GACtC;AACF;AAEA,IAAM,wBAAN,MAAkD;AAAA,EACvC,OAAA;AAAA,EAET,YAAY,MAAA,EAAgB;AAC1B,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA,EAEA,MAAM,IAAA,GAAuB;AAC3B,IAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,MAAM,IAAA,GAAuB;AAC3B,IAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA;AAAA,EAC9B;AACF,CAAA","file":"content.mjs","sourcesContent":["import { StanddownSession } from './session';\nimport {\n  LocalStorageTtlStateStore,\n  SessionStorageStateStore,\n  type WebStorageLike,\n} from './stores';\nimport type {\n  Behavior,\n  Decision,\n  SelfExemption,\n  Signals,\n  StanddownPolicy,\n  StateStore,\n} from './types';\n\nexport {\n  LocalStorageTtlStateStore,\n  SessionStorageStateStore,\n  type WebStorageLike,\n} from './stores';\n\nconst DEFAULT_LOCAL_STORAGE_TTL_MS = 24 * 60 * 60 * 1_000;\nconst FAIL_CLOSED_BEHAVIORS = [\n  'suppress-prompts',\n  'no-cookie-write',\n  'no-redirect',\n  'no-background-tracking',\n] as const satisfies readonly Behavior[];\n\nexport type ContentStorageMode = 'session' | 'local-ttl';\n\nexport interface CreateContentStanddownOptions {\n  readonly policies: readonly StanddownPolicy[];\n  readonly selfPatterns?: readonly SelfExemption[];\n  readonly publisherSites?: readonly string[];\n  readonly store?: StateStore;\n  readonly storage?: ContentStorageMode;\n  /**\n   * Sliding envelope TTL for `storage: 'local-ttl'`. Defaults to 24 hours.\n   * Every save refreshes the envelope; expiry clears session records but keeps\n   * audit entries. Per-policy stand-down durations are still enforced by core.\n   */\n  readonly ttlMs?: number;\n  readonly window?: ContentWindowLike;\n  readonly now?: () => number;\n  readonly auditLog?: boolean;\n  readonly onDecision?: (decision: Decision, signals: Signals) => void;\n}\n\nexport interface ContentStanddownController {\n  readonly session: StanddownSession;\n  readonly store: StateStore;\n  readonly ready: Promise<Decision>;\n  evaluate(): Promise<Decision>;\n  shouldStandDown(advertiserHost?: string, now?: number): Promise<Decision>;\n  dispose(): void;\n}\n\nexport interface CollectContentSignalsOptions {\n  readonly window?: ContentWindowLike;\n  readonly selfPatterns?: readonly SelfExemption[];\n  readonly publisherSites?: readonly string[];\n  readonly now?: () => number;\n}\n\nexport interface ContentWindowLike {\n  readonly location: { readonly href: string };\n  readonly document: {\n    readonly referrer?: string;\n    readonly cookie: string;\n  };\n  readonly sessionStorage?: WebStorageLike | undefined;\n  readonly localStorage?: WebStorageLike | undefined;\n  readonly history?: ContentHistoryLike;\n  readonly setTimeout?: (handler: () => void, timeout?: number) => unknown;\n  addEventListener?(type: 'popstate', listener: () => void): void;\n  removeEventListener?(type: 'popstate', listener: () => void): void;\n}\n\nexport interface ContentHistoryLike {\n  pushState(data: unknown, unused: string, url?: string | URL | null): void;\n  replaceState(data: unknown, unused: string, url?: string | URL | null): void;\n}\n\nexport function createContentStanddown(\n  opts: CreateContentStanddownOptions,\n): ContentStanddownController {\n  const windowLike = opts.window ?? currentWindow();\n  const now = opts.now ?? Date.now;\n  const store = opts.store ?? createContentStore(windowLike, opts, now);\n  const session = new StanddownSession(\n    store,\n    opts.auditLog === undefined ? undefined : { auditLog: opts.auditLog },\n  );\n\n  let disposed = false;\n  let pending = false;\n  const restoreHistory = patchHistory(windowLike, scheduleEvaluation);\n  const onPopState = () => {\n    scheduleEvaluation();\n  };\n\n  windowLike?.addEventListener?.('popstate', onPopState);\n\n  async function evaluate(): Promise<Decision> {\n    let signals: Signals;\n\n    try {\n      const signalOptions: {\n        window?: ContentWindowLike;\n        selfPatterns?: readonly SelfExemption[];\n        publisherSites?: readonly string[];\n        now: () => number;\n      } = { now };\n\n      if (windowLike !== undefined) {\n        signalOptions.window = windowLike;\n      }\n\n      if (opts.selfPatterns !== undefined) {\n        signalOptions.selfPatterns = opts.selfPatterns;\n      }\n\n      if (opts.publisherSites !== undefined) {\n        signalOptions.publisherSites = opts.publisherSites;\n      }\n\n      signals = collectContentSignals(signalOptions);\n    } catch {\n      const decision = failClosedDecision('signal-collection-error');\n      opts.onDecision?.(decision, {\n        url: '',\n        now: now(),\n      });\n      return decision;\n    }\n\n    const decision = await session.ingest(signals, opts.policies);\n    opts.onDecision?.(decision, signals);\n    return decision;\n  }\n\n  function scheduleEvaluation(): void {\n    if (disposed || pending) {\n      return;\n    }\n\n    pending = true;\n    const run = () => {\n      pending = false;\n\n      if (!disposed) {\n        void evaluate();\n      }\n    };\n\n    if (windowLike?.setTimeout !== undefined) {\n      windowLike.setTimeout(run, 0);\n      return;\n    }\n\n    queueMicrotask(run);\n  }\n\n  async function shouldStandDown(\n    advertiserHost?: string,\n    at = now(),\n  ): Promise<Decision> {\n    const host =\n      advertiserHost ??\n      (windowLike === undefined ? undefined : hostFromUrl(windowLike.location.href));\n\n    if (host === undefined) {\n      return failClosedDecision('missing-advertiser-host');\n    }\n\n    return session.shouldStandDown(host, at);\n  }\n\n  function dispose(): void {\n    disposed = true;\n    restoreHistory();\n    windowLike?.removeEventListener?.('popstate', onPopState);\n  }\n\n  const ready = evaluate();\n\n  return {\n    session,\n    store,\n    ready,\n    evaluate,\n    shouldStandDown,\n    dispose,\n  };\n}\n\nexport function collectContentSignals(\n  opts: CollectContentSignalsOptions = {},\n): Signals {\n  const windowLike = opts.window ?? currentWindow();\n  const now = opts.now ?? Date.now;\n\n  if (windowLike === undefined) {\n    throw new Error('content window unavailable');\n  }\n\n  const signals: Signals = {\n    url: windowLike.location.href,\n    now: now(),\n  };\n  const referrer = windowLike.document.referrer;\n  const cookieNames = cookieNamesFromString(windowLike.document.cookie);\n\n  if (referrer !== undefined && referrer.length > 0) {\n    signals.referrer = referrer;\n  }\n\n  if (cookieNames.length > 0) {\n    signals.cookieNames = cookieNames;\n  }\n\n  if (opts.selfPatterns !== undefined) {\n    signals.selfPatterns = opts.selfPatterns;\n  }\n\n  if (opts.publisherSites !== undefined) {\n    signals.publisherSites = opts.publisherSites;\n  }\n\n  return signals;\n}\n\nexport function cookieNamesFromString(cookie: string): string[] {\n  if (cookie.trim().length === 0) {\n    return [];\n  }\n\n  return cookie\n    .split(';')\n    .map((part) => part.trim())\n    .filter((part) => part.length > 0)\n    .map((part) => part.split('=')[0]?.trim() ?? '')\n    .filter((name) => name.length > 0);\n}\n\nfunction createContentStore(\n  windowLike: ContentWindowLike | undefined,\n  opts: CreateContentStanddownOptions,\n  now: () => number,\n): StateStore {\n  if (windowLike === undefined) {\n    return new UnavailableStateStore('content window unavailable');\n  }\n\n  if (opts.storage === 'local-ttl') {\n    if (windowLike.localStorage === undefined) {\n      return new UnavailableStateStore('localStorage unavailable');\n    }\n\n    const storeOptions: {\n      ttlMs: number;\n      sessionStorage?: WebStorageLike;\n      now: () => number;\n    } = {\n      ttlMs: opts.ttlMs ?? DEFAULT_LOCAL_STORAGE_TTL_MS,\n      now,\n    };\n\n    if (windowLike.sessionStorage !== undefined) {\n      storeOptions.sessionStorage = windowLike.sessionStorage;\n    }\n\n    return new LocalStorageTtlStateStore(windowLike.localStorage, storeOptions);\n  }\n\n  if (windowLike.sessionStorage === undefined) {\n    return new UnavailableStateStore('sessionStorage unavailable');\n  }\n\n  return new SessionStorageStateStore(windowLike.sessionStorage);\n}\n\nfunction patchHistory(\n  windowLike: ContentWindowLike | undefined,\n  onNavigation: () => void,\n): () => void {\n  const history = windowLike?.history;\n\n  if (history === undefined) {\n    return () => {};\n  }\n\n  const originalPushState = history.pushState.bind(history);\n  const originalReplaceState = history.replaceState.bind(history);\n\n  history.pushState = (...args) => {\n    originalPushState(...args);\n    onNavigation();\n  };\n\n  history.replaceState = (...args) => {\n    originalReplaceState(...args);\n    onNavigation();\n  };\n\n  return () => {\n    history.pushState = originalPushState;\n    history.replaceState = originalReplaceState;\n  };\n}\n\nfunction currentWindow(): ContentWindowLike | undefined {\n  const value = (globalThis as typeof globalThis & {\n    window?: ContentWindowLike;\n  }).window;\n\n  return value;\n}\n\nfunction hostFromUrl(value: string): string | undefined {\n  try {\n    return new URL(value).hostname.toLowerCase().replace(/\\.$/, '');\n  } catch {\n    return undefined;\n  }\n}\n\nfunction failClosedDecision(reason: string): Decision {\n  return {\n    standDown: true,\n    reason,\n    behaviors: [...FAIL_CLOSED_BEHAVIORS],\n  };\n}\n\nclass UnavailableStateStore implements StateStore {\n  readonly #reason: string;\n\n  constructor(reason: string) {\n    this.#reason = reason;\n  }\n\n  async load(): Promise<never> {\n    throw new Error(this.#reason);\n  }\n\n  async save(): Promise<never> {\n    throw new Error(this.#reason);\n  }\n}\n"]}
+{"version":3,"sources":["../src/content.ts"],"names":["decision"],"mappings":";;;;;AAqBA,IAAM,4BAAA,GAA+B,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AACpD,IAAM,qBAAA,GAAwB;AAAA,EAC5B,kBAAA;AAAA,EACA,iBAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;AAgEO,SAAS,uBACd,IAAA,EAC4B;AAC5B,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,IAAU,aAAA,EAAc;AAChD,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,GAAA;AAC7B,EAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,IAAS,kBAAA,CAAmB,UAAA,EAAY,MAAM,GAAG,CAAA;AACpE,EAAA,MAAM,UAAU,IAAI,gBAAA,CAAiB,KAAA,EAAO,qBAAA,CAAsB,IAAI,CAAC,CAAA;AAEvE,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,MAAM,cAAA,GAAiB,YAAA,CAAa,UAAA,EAAY,kBAAkB,CAAA;AAClE,EAAA,MAAM,aAAa,MAAM;AACvB,IAAA,kBAAA,EAAmB;AAAA,EACrB,CAAA;AAEA,EAAA,UAAA,EAAY,gBAAA,GAAmB,YAAY,UAAU,CAAA;AAErD,EAAA,eAAe,QAAA,GAA8B;AAC3C,IAAA,IAAI,OAAA;AAEJ,IAAA,IAAI;AACF,MAAA,MAAM,aAAA,GAKF,EAAE,GAAA,EAAI;AAEV,MAAA,IAAI,eAAe,KAAA,CAAA,EAAW;AAC5B,QAAA,aAAA,CAAc,MAAA,GAAS,UAAA;AAAA,MACzB;AAEA,MAAA,IAAI,IAAA,CAAK,iBAAiB,KAAA,CAAA,EAAW;AACnC,QAAA,aAAA,CAAc,eAAe,IAAA,CAAK,YAAA;AAAA,MACpC;AAEA,MAAA,IAAI,IAAA,CAAK,mBAAmB,KAAA,CAAA,EAAW;AACrC,QAAA,aAAA,CAAc,iBAAiB,IAAA,CAAK,cAAA;AAAA,MACtC;AAEA,MAAA,OAAA,GAAU,sBAAsB,aAAa,CAAA;AAAA,IAC/C,CAAA,CAAA,MAAQ;AACN,MAAA,MAAMA,SAAAA,GAAW,mBAAmB,yBAAyB,CAAA;AAC7D,MAAA,IAAA,CAAK,aAAaA,SAAAA,EAAU;AAAA,QAC1B,GAAA,EAAK,EAAA;AAAA,QACL,KAAK,GAAA;AAAI,OACV,CAAA;AACD,MAAA,OAAOA,SAAAA;AAAA,IACT;AAEA,IAAA,MAAM,WAAW,MAAM,OAAA,CAAQ,MAAA,CAAO,OAAA,EAAS,KAAK,QAAQ,CAAA;AAC5D,IAAA,IAAA,CAAK,UAAA,GAAa,UAAU,OAAO,CAAA;AACnC,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,SAAS,kBAAA,GAA2B;AAClC,IAAA,IAAI,YAAY,OAAA,EAAS;AACvB,MAAA;AAAA,IACF;AAEA,IAAA,OAAA,GAAU,IAAA;AACV,IAAA,MAAM,MAAM,MAAM;AAChB,MAAA,OAAA,GAAU,KAAA;AAEV,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,KAAK,QAAA,EAAS;AAAA,MAChB;AAAA,IACF,CAAA;AAEA,IAAA,IAAI,UAAA,EAAY,eAAe,MAAA,EAAW;AACxC,MAAA,UAAA,CAAW,UAAA,CAAW,KAAK,CAAC,CAAA;AAC5B,MAAA;AAAA,IACF;AAEA,IAAA,cAAA,CAAe,GAAG,CAAA;AAAA,EACpB;AAEA,EAAA,eAAe,eAAA,CACb,cAAA,EACA,EAAA,GAAK,GAAA,EAAI,EACU;AACnB,IAAA,MAAM,IAAA,GACJ,mBACC,UAAA,KAAe,MAAA,GAAY,SAAY,WAAA,CAAY,UAAA,CAAW,SAAS,IAAI,CAAA,CAAA;AAE9E,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAO,mBAAmB,yBAAyB,CAAA;AAAA,IACrD;AAEA,IAAA,OAAO,OAAA,CAAQ,eAAA,CAAgB,IAAA,EAAM,EAAE,CAAA;AAAA,EACzC;AAEA,EAAA,SAAS,OAAA,GAAgB;AACvB,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,cAAA,EAAe;AACf,IAAA,UAAA,EAAY,mBAAA,GAAsB,YAAY,UAAU,CAAA;AAAA,EAC1D;AAEA,EAAA,MAAM,QAAQ,QAAA,EAAS;AAEvB,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,KAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACF;AACF;AAEO,SAAS,qBAAA,CACd,IAAA,GAAqC,EAAC,EAC7B;AACT,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,IAAU,aAAA,EAAc;AAChD,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,GAAA;AAE7B,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,OAAA,GAAmB;AAAA,IACvB,GAAA,EAAK,WAAW,QAAA,CAAS,IAAA;AAAA,IACzB,KAAK,GAAA,EAAI;AAAA;AAAA;AAAA,IAGT,cAAA,EAAgB;AAAA,GAClB;AACA,EAAA,MAAM,QAAA,GAAW,WAAW,QAAA,CAAS,QAAA;AACrC,EAAA,MAAM,WAAA,GAAc,qBAAA,CAAsB,UAAA,CAAW,QAAA,CAAS,MAAM,CAAA;AAEpE,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AACjD,IAAA,OAAA,CAAQ,QAAA,GAAW,QAAA;AAAA,EACrB;AAEA,EAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,IAAA,OAAA,CAAQ,WAAA,GAAc,WAAA;AAAA,EACxB;AAEA,EAAA,IAAI,IAAA,CAAK,iBAAiB,MAAA,EAAW;AACnC,IAAA,OAAA,CAAQ,eAAe,IAAA,CAAK,YAAA;AAAA,EAC9B;AAEA,EAAA,IAAI,IAAA,CAAK,mBAAmB,MAAA,EAAW;AACrC,IAAA,OAAA,CAAQ,iBAAiB,IAAA,CAAK,cAAA;AAAA,EAChC;AAEA,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,sBAAsB,MAAA,EAA0B;AAC9D,EAAA,IAAI,MAAA,CAAO,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AAC9B,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,OAAO,OACJ,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAA,EAAM,EACzB,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,CAAC,CAAA,CAChC,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK,IAAK,EAAE,EAC9C,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,CAAC,CAAA;AACrC;AAEA,SAAS,sBACP,IAAA,EAGY;AACZ,EAAA,MAAM,cAGF,EAAC;AAEL,EAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EAAW;AAC/B,IAAA,WAAA,CAAY,WAAW,IAAA,CAAK,QAAA;AAAA,EAC9B;AAEA,EAAA,IAAI,IAAA,CAAK,uBAAuB,MAAA,EAAW;AACzC,IAAA,WAAA,CAAY,qBAAqB,IAAA,CAAK,kBAAA;AAAA,EACxC;AAEA,EAAA,OAAO,OAAO,IAAA,CAAK,WAAW,CAAA,CAAE,MAAA,GAAS,IAAI,WAAA,GAAc,MAAA;AAC7D;AAEA,SAAS,kBAAA,CACP,UAAA,EACA,IAAA,EACA,GAAA,EACY;AACZ,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,OAAO,IAAI,sBAAsB,4BAA4B,CAAA;AAAA,EAC/D;AAEA,EAAA,IAAI,IAAA,CAAK,YAAY,WAAA,EAAa;AAChC,IAAA,IAAI,UAAA,CAAW,iBAAiB,MAAA,EAAW;AACzC,MAAA,OAAO,IAAI,sBAAsB,0BAA0B,CAAA;AAAA,IAC7D;AAEA,IAAA,MAAM,YAAA,GAIF;AAAA,MACF,KAAA,EAAO,KAAK,KAAA,IAAS,4BAAA;AAAA,MACrB;AAAA,KACF;AAEA,IAAA,IAAI,UAAA,CAAW,mBAAmB,MAAA,EAAW;AAC3C,MAAA,YAAA,CAAa,iBAAiB,UAAA,CAAW,cAAA;AAAA,IAC3C;AAEA,IAAA,OAAO,IAAI,yBAAA,CAA0B,UAAA,CAAW,YAAA,EAAc,YAAY,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,UAAA,CAAW,mBAAmB,MAAA,EAAW;AAC3C,IAAA,OAAO,IAAI,sBAAsB,4BAA4B,CAAA;AAAA,EAC/D;AAEA,EAAA,OAAO,IAAI,wBAAA,CAAyB,UAAA,CAAW,cAAc,CAAA;AAC/D;AAEA,SAAS,YAAA,CACP,YACA,YAAA,EACY;AACZ,EAAA,MAAM,UAAU,UAAA,EAAY,OAAA;AAE5B,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,OAAO,MAAM;AAAA,IAAC,CAAA;AAAA,EAChB;AAEA,EAAA,MAAM,iBAAA,GAAoB,OAAA,CAAQ,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA;AACxD,EAAA,MAAM,oBAAA,GAAuB,OAAA,CAAQ,YAAA,CAAa,IAAA,CAAK,OAAO,CAAA;AAE9D,EAAA,OAAA,CAAQ,SAAA,GAAY,IAAI,IAAA,KAAS;AAC/B,IAAA,iBAAA,CAAkB,GAAG,IAAI,CAAA;AACzB,IAAA,YAAA,EAAa;AAAA,EACf,CAAA;AAEA,EAAA,OAAA,CAAQ,YAAA,GAAe,IAAI,IAAA,KAAS;AAClC,IAAA,oBAAA,CAAqB,GAAG,IAAI,CAAA;AAC5B,IAAA,YAAA,EAAa;AAAA,EACf,CAAA;AAEA,EAAA,OAAO,MAAM;AACX,IAAA,OAAA,CAAQ,SAAA,GAAY,iBAAA;AACpB,IAAA,OAAA,CAAQ,YAAA,GAAe,oBAAA;AAAA,EACzB,CAAA;AACF;AAEA,SAAS,aAAA,GAA+C;AACtD,EAAA,MAAM,QAAS,UAAA,CAEZ,MAAA;AAEH,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,YAAY,KAAA,EAAmC;AACtD,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,IAAI,KAAK,CAAA,CAAE,SAAS,WAAA,EAAY,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,MAAA,EAA0B;AACpD,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,IAAA;AAAA,IACX,MAAA;AAAA,IACA,SAAA,EAAW,CAAC,GAAG,qBAAqB;AAAA,GACtC;AACF;AAEA,IAAM,wBAAN,MAAkD;AAAA,EACvC,OAAA;AAAA,EAET,YAAY,MAAA,EAAgB;AAC1B,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA,EAEA,MAAM,IAAA,GAAuB;AAC3B,IAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA;AAAA,EAC9B;AAAA,EAEA,MAAM,IAAA,GAAuB;AAC3B,IAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA;AAAA,EAC9B;AACF,CAAA","file":"content.mjs","sourcesContent":["import { StanddownSession } from './session';\nimport {\n  LocalStorageTtlStateStore,\n  SessionStorageStateStore,\n  type WebStorageLike,\n} from './stores';\nimport type {\n  Behavior,\n  Decision,\n  SelfExemption,\n  Signals,\n  StanddownPolicy,\n  StateStore,\n} from './types';\n\nexport {\n  LocalStorageTtlStateStore,\n  SessionStorageStateStore,\n  type WebStorageLike,\n} from './stores';\n\nconst DEFAULT_LOCAL_STORAGE_TTL_MS = 24 * 60 * 60 * 1_000;\nconst FAIL_CLOSED_BEHAVIORS = [\n  'suppress-prompts',\n  'no-cookie-write',\n  'no-redirect',\n  'no-background-tracking',\n] as const satisfies readonly Behavior[];\n\nexport type ContentStorageMode = 'session' | 'local-ttl';\n\nexport interface CreateContentStanddownOptions {\n  readonly policies: readonly StanddownPolicy[];\n  readonly selfPatterns?: readonly SelfExemption[];\n  readonly publisherSites?: readonly string[];\n  readonly store?: StateStore;\n  readonly storage?: ContentStorageMode;\n  /**\n   * Sliding envelope TTL for `storage: 'local-ttl'`. Defaults to 24 hours.\n   * Every save refreshes the envelope; expiry clears session records but keeps\n   * audit entries. Per-policy stand-down durations are still enforced by core.\n   */\n  readonly ttlMs?: number;\n  readonly window?: ContentWindowLike;\n  readonly now?: () => number;\n  readonly auditLog?: boolean;\n  /**\n   * How long a `selfPatterns` match suppresses stand-down for its advertiser\n   * host. `'policy'` (default) exempts only the navigation carrying the param;\n   * `'session'` persists the exemption for the host across later param-less\n   * navigations (Dupe's `ignore_param` semantics).\n   */\n  readonly selfExemptionScope?: 'policy' | 'session';\n  readonly onDecision?: (decision: Decision, signals: Signals) => void;\n}\n\nexport interface ContentStanddownController {\n  readonly session: StanddownSession;\n  readonly store: StateStore;\n  readonly ready: Promise<Decision>;\n  evaluate(): Promise<Decision>;\n  shouldStandDown(advertiserHost?: string, now?: number): Promise<Decision>;\n  dispose(): void;\n}\n\nexport interface CollectContentSignalsOptions {\n  readonly window?: ContentWindowLike;\n  readonly selfPatterns?: readonly SelfExemption[];\n  readonly publisherSites?: readonly string[];\n  readonly now?: () => number;\n}\n\nexport interface ContentWindowLike {\n  readonly location: { readonly href: string };\n  readonly document: {\n    readonly referrer?: string;\n    readonly cookie: string;\n  };\n  readonly sessionStorage?: WebStorageLike | undefined;\n  readonly localStorage?: WebStorageLike | undefined;\n  readonly history?: ContentHistoryLike;\n  readonly setTimeout?: (handler: () => void, timeout?: number) => unknown;\n  addEventListener?(type: 'popstate', listener: () => void): void;\n  removeEventListener?(type: 'popstate', listener: () => void): void;\n}\n\nexport interface ContentHistoryLike {\n  pushState(data: unknown, unused: string, url?: string | URL | null): void;\n  replaceState(data: unknown, unused: string, url?: string | URL | null): void;\n}\n\nexport function createContentStanddown(\n  opts: CreateContentStanddownOptions,\n): ContentStanddownController {\n  const windowLike = opts.window ?? currentWindow();\n  const now = opts.now ?? Date.now;\n  const store = opts.store ?? createContentStore(windowLike, opts, now);\n  const session = new StanddownSession(store, contentSessionOptions(opts));\n\n  let disposed = false;\n  let pending = false;\n  const restoreHistory = patchHistory(windowLike, scheduleEvaluation);\n  const onPopState = () => {\n    scheduleEvaluation();\n  };\n\n  windowLike?.addEventListener?.('popstate', onPopState);\n\n  async function evaluate(): Promise<Decision> {\n    let signals: Signals;\n\n    try {\n      const signalOptions: {\n        window?: ContentWindowLike;\n        selfPatterns?: readonly SelfExemption[];\n        publisherSites?: readonly string[];\n        now: () => number;\n      } = { now };\n\n      if (windowLike !== undefined) {\n        signalOptions.window = windowLike;\n      }\n\n      if (opts.selfPatterns !== undefined) {\n        signalOptions.selfPatterns = opts.selfPatterns;\n      }\n\n      if (opts.publisherSites !== undefined) {\n        signalOptions.publisherSites = opts.publisherSites;\n      }\n\n      signals = collectContentSignals(signalOptions);\n    } catch {\n      const decision = failClosedDecision('signal-collection-error');\n      opts.onDecision?.(decision, {\n        url: '',\n        now: now(),\n      });\n      return decision;\n    }\n\n    const decision = await session.ingest(signals, opts.policies);\n    opts.onDecision?.(decision, signals);\n    return decision;\n  }\n\n  function scheduleEvaluation(): void {\n    if (disposed || pending) {\n      return;\n    }\n\n    pending = true;\n    const run = () => {\n      pending = false;\n\n      if (!disposed) {\n        void evaluate();\n      }\n    };\n\n    if (windowLike?.setTimeout !== undefined) {\n      windowLike.setTimeout(run, 0);\n      return;\n    }\n\n    queueMicrotask(run);\n  }\n\n  async function shouldStandDown(\n    advertiserHost?: string,\n    at = now(),\n  ): Promise<Decision> {\n    const host =\n      advertiserHost ??\n      (windowLike === undefined ? undefined : hostFromUrl(windowLike.location.href));\n\n    if (host === undefined) {\n      return failClosedDecision('missing-advertiser-host');\n    }\n\n    return session.shouldStandDown(host, at);\n  }\n\n  function dispose(): void {\n    disposed = true;\n    restoreHistory();\n    windowLike?.removeEventListener?.('popstate', onPopState);\n  }\n\n  const ready = evaluate();\n\n  return {\n    session,\n    store,\n    ready,\n    evaluate,\n    shouldStandDown,\n    dispose,\n  };\n}\n\nexport function collectContentSignals(\n  opts: CollectContentSignalsOptions = {},\n): Signals {\n  const windowLike = opts.window ?? currentWindow();\n  const now = opts.now ?? Date.now;\n\n  if (windowLike === undefined) {\n    throw new Error('content window unavailable');\n  }\n\n  const signals: Signals = {\n    url: windowLike.location.href,\n    now: now(),\n    // The content plane never observes redirect chains, so a non-stand-down\n    // here can miss redirect-only attribution.\n    signalCoverage: 'partial',\n  };\n  const referrer = windowLike.document.referrer;\n  const cookieNames = cookieNamesFromString(windowLike.document.cookie);\n\n  if (referrer !== undefined && referrer.length > 0) {\n    signals.referrer = referrer;\n  }\n\n  if (cookieNames.length > 0) {\n    signals.cookieNames = cookieNames;\n  }\n\n  if (opts.selfPatterns !== undefined) {\n    signals.selfPatterns = opts.selfPatterns;\n  }\n\n  if (opts.publisherSites !== undefined) {\n    signals.publisherSites = opts.publisherSites;\n  }\n\n  return signals;\n}\n\nexport function cookieNamesFromString(cookie: string): string[] {\n  if (cookie.trim().length === 0) {\n    return [];\n  }\n\n  return cookie\n    .split(';')\n    .map((part) => part.trim())\n    .filter((part) => part.length > 0)\n    .map((part) => part.split('=')[0]?.trim() ?? '')\n    .filter((name) => name.length > 0);\n}\n\nfunction contentSessionOptions(\n  opts: CreateContentStanddownOptions,\n):\n  | { auditLog?: boolean; selfExemptionScope?: 'policy' | 'session' }\n  | undefined {\n  const sessionOpts: {\n    auditLog?: boolean;\n    selfExemptionScope?: 'policy' | 'session';\n  } = {};\n\n  if (opts.auditLog !== undefined) {\n    sessionOpts.auditLog = opts.auditLog;\n  }\n\n  if (opts.selfExemptionScope !== undefined) {\n    sessionOpts.selfExemptionScope = opts.selfExemptionScope;\n  }\n\n  return Object.keys(sessionOpts).length > 0 ? sessionOpts : undefined;\n}\n\nfunction createContentStore(\n  windowLike: ContentWindowLike | undefined,\n  opts: CreateContentStanddownOptions,\n  now: () => number,\n): StateStore {\n  if (windowLike === undefined) {\n    return new UnavailableStateStore('content window unavailable');\n  }\n\n  if (opts.storage === 'local-ttl') {\n    if (windowLike.localStorage === undefined) {\n      return new UnavailableStateStore('localStorage unavailable');\n    }\n\n    const storeOptions: {\n      ttlMs: number;\n      sessionStorage?: WebStorageLike;\n      now: () => number;\n    } = {\n      ttlMs: opts.ttlMs ?? DEFAULT_LOCAL_STORAGE_TTL_MS,\n      now,\n    };\n\n    if (windowLike.sessionStorage !== undefined) {\n      storeOptions.sessionStorage = windowLike.sessionStorage;\n    }\n\n    return new LocalStorageTtlStateStore(windowLike.localStorage, storeOptions);\n  }\n\n  if (windowLike.sessionStorage === undefined) {\n    return new UnavailableStateStore('sessionStorage unavailable');\n  }\n\n  return new SessionStorageStateStore(windowLike.sessionStorage);\n}\n\nfunction patchHistory(\n  windowLike: ContentWindowLike | undefined,\n  onNavigation: () => void,\n): () => void {\n  const history = windowLike?.history;\n\n  if (history === undefined) {\n    return () => {};\n  }\n\n  const originalPushState = history.pushState.bind(history);\n  const originalReplaceState = history.replaceState.bind(history);\n\n  history.pushState = (...args) => {\n    originalPushState(...args);\n    onNavigation();\n  };\n\n  history.replaceState = (...args) => {\n    originalReplaceState(...args);\n    onNavigation();\n  };\n\n  return () => {\n    history.pushState = originalPushState;\n    history.replaceState = originalReplaceState;\n  };\n}\n\nfunction currentWindow(): ContentWindowLike | undefined {\n  const value = (globalThis as typeof globalThis & {\n    window?: ContentWindowLike;\n  }).window;\n\n  return value;\n}\n\nfunction hostFromUrl(value: string): string | undefined {\n  try {\n    return new URL(value).hostname.toLowerCase().replace(/\\.$/, '');\n  } catch {\n    return undefined;\n  }\n}\n\nfunction failClosedDecision(reason: string): Decision {\n  return {\n    standDown: true,\n    reason,\n    behaviors: [...FAIL_CLOSED_BEHAVIORS],\n  };\n}\n\nclass UnavailableStateStore implements StateStore {\n  readonly #reason: string;\n\n  constructor(reason: string) {\n    this.#reason = reason;\n  }\n\n  async load(): Promise<never> {\n    throw new Error(this.#reason);\n  }\n\n  async save(): Promise<never> {\n    throw new Error(this.#reason);\n  }\n}\n"]}

package/dist/index.cjs

@@ -45,6 +45,9 @@ function validatePolicy(value) {
   optionalArray(detection.initiatorRules, "policy.detection.initiatorRules").forEach(
     validateInitiatorRule
   );
+  optionalArray(detection.disableHosts, "policy.detection.disableHosts").forEach(
+    validateDomainRule
+  );
   const standdown = object(policy.standdown, "policy.standdown");
   literal(standdown.scope, "advertiser", "policy.standdown.scope");
   if (standdown.sessionRule !== "session-or-min" && standdown.sessionRule !== "inactivity-window") {
@@ -70,12 +73,6 @@ function validatePolicy(value) {
   if (activation.mode !== "user-click" && activation.mode !== "never") {
     throw new TypeError("policy.activation.mode is invalid");
   }
-  if (activation.maxPromptsPerJourney !== void 0) {
-    nonNegativeFiniteNumber(
-      activation.maxPromptsPerJourney,
-      "policy.activation.maxPromptsPerJourney"
-    );
-  }
   for (const referrerClass of optionalArray(
     activation.allowedReferrerClasses,
     "policy.activation.allowedReferrerClasses"
@@ -504,8 +501,24 @@ function detect(signals, policies) {
   }
   const advertiserHost = currentUrl.hostname.toLowerCase();
   const matched = [];
+  const selfExemptScopes = [];
   let selfMatch = false;
   for (const policy of policies) {
+    const disabledHostRule = (policy.detection.disableHosts ?? []).find(
+      (rule) => domainRuleMatchesUrl(rule, advertiserHost)
+    );
+    if (disabledHostRule) {
+      matched.push(
+        matchedRule(
+          policy,
+          "disabled-host",
+          `${disabledHostRule.kind}:${disabledHostRule.pattern}`,
+          advertiserHost,
+          disabledHostRule.comment ?? "host disabled for this network"
+        )
+      );
+      continue;
+    }
     const scopedSelfMatch = hasScopedSelfExemption(
       currentUrl,
       signals.selfPatterns,
@@ -519,6 +532,10 @@ function detect(signals, policies) {
       selfMatch = true;
     }
     if (scopedSelfMatch) {
+      selfExemptScopes.push({
+        policyId: policy.id,
+        networkId: policy.network.id
+      });
       continue;
     }
     matched.push(
@@ -531,7 +548,14 @@ function detect(signals, policies) {
     advertiserHost: matched[0].advertiserHost,
     reason: matched[0].reason
   } : void 0;
-  return strongest ? { matched, selfMatch, strongest } : { matched, selfMatch };
+  const base = { matched, selfMatch };
+  if (strongest) {
+    base.strongest = strongest;
+  }
+  if (selfExemptScopes.length > 0) {
+    base.selfExemptScopes = selfExemptScopes;
+  }
+  return base;
 }
 function classifyReferrer(signals, advertiserHost) {
   const candidate = signals.initiator ?? signals.referrer;
@@ -648,16 +672,19 @@ function matchedRule(policy, kind, rule, advertiserHost, reason) {
   };
 }
 function kindPriority(kind) {
-  if (kind === "redirect-domain") {
+  if (kind === "disabled-host") {
     return 0;
   }
-  if (kind === "landing-param") {
+  if (kind === "redirect-domain") {
     return 1;
   }
-  if (kind === "cookie") {
+  if (kind === "landing-param") {
     return 2;
   }
-  return 3;
+  if (kind === "cookie") {
+    return 3;
+  }
+  return 4;
 }
 function paramRuleMatches(rule, params) {
   return rule.anyOf.some(
@@ -743,10 +770,6 @@ function guardActivation(req) {
   if (req.benefit.description.trim() === "") {
     return { allowed: false, reason: "missing-user-benefit" };
   }
-  const maxPrompts = req.policy.activation.maxPromptsPerJourney;
-  if (maxPrompts !== void 0 && (req.decision.promptCount ?? 0) >= maxPrompts) {
-    return { allowed: false, reason: "max-prompts-exhausted" };
-  }
   const allowedReferrerClasses = req.policy.activation.allowedReferrerClasses;
   if (allowedReferrerClasses !== void 0) {
     if (req.decision.referrerClass === void 0) {
@@ -976,11 +999,13 @@ var StanddownSession = class {
   #store;
   #auditLog;
   #maxAuditEntries;
+  #selfExemptionScope;
   #readOnlyAuditLog = [];
   constructor(store, opts) {
     this.#store = store;
     this.#auditLog = opts?.auditLog ?? true;
     this.#maxAuditEntries = Math.max(0, opts?.maxAuditEntries ?? 1e3);
+    this.#selfExemptionScope = opts?.selfExemptionScope ?? "policy";
   }
   async ingest(signals, policies) {
     const advertiserHost = hostFromUrl2(signals.url);
@@ -1006,38 +1031,49 @@ var StanddownSession = class {
     }
     return this.#withState(signals.now, (state) => {
       pruneExpiredSessions(state, signals.now);
-      if (detection.strongest) {
-        const matchedPolicies = policiesForDetection(policies, detection);
+      let effective = detection;
+      if (this.#selfExemptionScope === "session" && advertiserHost) {
+        recordSessionExemptions(state, advertiserHost, detection, signals.now);
+        effective = applySessionExemptions(
+          advertiserHost,
+          detection,
+          state.exemptions?.[advertiserHost]
+        );
+      }
+      if (effective.strongest) {
+        const matchedPolicies = policiesForDetection(policies, effective);
         if (matchedPolicies.length === 0) {
           return {
             decision: failClosedDecision("matched-policy-missing"),
-            detection
+            detection: effective
           };
         }
         const record = upsertSessionRecord(
           state,
-          detection.strongest.advertiserHost,
-          detection.strongest.policyId,
+          effective.strongest.advertiserHost,
+          effective.strongest.policyId,
           matchedPolicies,
           signals.now
         );
         return {
           decision: decisionFromRecord(record, signals.now, {
-            reason: detection.strongest.reason,
+            reason: effective.strongest.reason,
             referrerClass: classifyReferrer(signals, record.advertiserHost)
           }),
-          detection
+          detection: effective
         };
       }
       const activeDecision = advertiserHost ? activeDecisionForHost(state, advertiserHost, signals.now) : void 0;
+      const sessionExempted = detection.strongest !== void 0 && effective.strongest === void 0;
       return {
         decision: activeDecision ?? {
           standDown: false,
-          reason: detection.selfMatch ? "self-exempted-no-active-standdown" : "no-active-standdown",
+          reason: sessionExempted ? "self-exempted-session" : detection.selfMatch ? "self-exempted-no-active-standdown" : "no-active-standdown",
           behaviors: [],
-          referrerClass: advertiserHost ? classifyReferrer(signals, advertiserHost) : "other"
+          referrerClass: advertiserHost ? classifyReferrer(signals, advertiserHost) : "other",
+          ...signals.signalCoverage === "partial" ? { degraded: true } : {}
         },
-        detection
+        detection: effective
       };
     }, "ingest");
   }
@@ -1206,6 +1242,66 @@ function upsertSessionRecord(state, advertiserHost, primaryPolicyId, policies, n
   state.sessions[key] = baseRecord;
   return baseRecord;
 }
+function recordSessionExemptions(state, advertiserHost, detection, now) {
+  const scopes = detection.selfExemptScopes;
+  if (!scopes || scopes.length === 0) {
+    return;
+  }
+  if (activeDecisionForHost(state, advertiserHost, now) !== void 0) {
+    return;
+  }
+  const key = normalizeHost(advertiserHost);
+  if (state.exemptions === void 0) {
+    state.exemptions = {};
+  }
+  const exemptions = state.exemptions;
+  const existing = exemptions[key];
+  const policyIds = new Set(existing?.policyIds ?? []);
+  const networkIds = new Set(existing?.networkIds ?? []);
+  for (const scope of scopes) {
+    policyIds.add(scope.policyId);
+    networkIds.add(scope.networkId);
+  }
+  exemptions[key] = {
+    advertiserHost: key,
+    policyIds: [...policyIds],
+    networkIds: [...networkIds],
+    grantedAt: existing?.grantedAt ?? now
+  };
+}
+function applySessionExemptions(advertiserHost, detection, record) {
+  if (!record) {
+    return detection;
+  }
+  const host = normalizeHost(advertiserHost);
+  const policyIds = new Set(record.policyIds);
+  const networkIds = new Set(record.networkIds);
+  const filtered = detection.matched.filter((match) => {
+    if (match.kind === "disabled-host") {
+      return true;
+    }
+    if (normalizeHost(match.advertiserHost) !== host) {
+      return true;
+    }
+    return !(policyIds.has(match.policyId) || networkIds.has(match.networkId));
+  });
+  if (filtered.length === detection.matched.length) {
+    return detection;
+  }
+  const strongest = filtered[0] ? {
+    policyId: filtered[0].policyId,
+    advertiserHost: filtered[0].advertiserHost,
+    reason: filtered[0].reason
+  } : void 0;
+  const next = { matched: filtered, selfMatch: detection.selfMatch };
+  if (strongest) {
+    next.strongest = strongest;
+  }
+  if (detection.selfExemptScopes) {
+    next.selfExemptScopes = detection.selfExemptScopes;
+  }
+  return next;
+}
 function policiesForDetection(policies, detection) {
   if (detection.strongest === void 0) {
     return [];
@@ -1302,7 +1398,7 @@ function auditEntry(value) {
   return entry;
 }
 function cloneState(state) {
-  return {
+  const cloned = {
     sessions: Object.fromEntries(
       Object.entries(state.sessions).map(([host, record]) => [
         host,
@@ -1314,6 +1410,19 @@ function cloneState(state) {
     ),
     auditLog: state.auditLog.map(cloneAuditEntry)
   };
+  if (state.exemptions) {
+    cloned.exemptions = Object.fromEntries(
+      Object.entries(state.exemptions).map(([host, record]) => [
+        host,
+        {
+          ...record,
+          policyIds: [...record.policyIds],
+          networkIds: [...record.networkIds]
+        }
+      ])
+    );
+  }
+  return cloned;
 }
 function cloneAuditEntry(entry) {
   const cloned = {
@@ -1331,6 +1440,11 @@ function cloneAuditEntry(entry) {
     if (entry.detection.strongest !== void 0) {
       detection.strongest = { ...entry.detection.strongest };
     }
+    if (entry.detection.selfExemptScopes !== void 0) {
+      detection.selfExemptScopes = entry.detection.selfExemptScopes.map(
+        (scope) => ({ ...scope })
+      );
+    }
     if (entry.detection.failClosedReason !== void 0) {
       detection.failClosedReason = entry.detection.failClosedReason;
     }