standdown 0.1.0

package/dist/webext.cjs

@@ -0,0 +1,1733 @@
+'use strict';
+
+// src/validation.ts
+var BEHAVIORS = /* @__PURE__ */ new Set([
+  "suppress-prompts",
+  "no-cookie-write",
+  "no-redirect",
+  "no-background-tracking"
+]);
+var PARAM_MATCHES = /* @__PURE__ */ new Set(["exists", "equals", "contains"]);
+var COOKIE_MATCHES = /* @__PURE__ */ new Set(["exact", "substring"]);
+var DOMAIN_KINDS = /* @__PURE__ */ new Set(["suffix", "regex"]);
+var REFERRER_CLASSES = /* @__PURE__ */ new Set([
+  "own-site",
+  "organic",
+  "direct",
+  "advertiser-internal",
+  "other"
+]);
+var ACTIVATION_REFERRER_CLASSES = /* @__PURE__ */ new Set(["own-site", "organic", "direct"]);
+function validatePolicy(value) {
+  const policy = object(value, "policy");
+  string(policy.id, "policy.id");
+  literal(policy.schemaVersion, 3, "policy.schemaVersion");
+  string(policy.policyVersion, "policy.policyVersion");
+  const network = object(policy.network, "policy.network");
+  string(network.id, "policy.network.id");
+  string(network.name, "policy.network.name");
+  if (network.policyUrl !== void 0) {
+    urlString(network.policyUrl, "policy.network.policyUrl");
+  }
+  const detection = object(policy.detection, "policy.detection");
+  optionalArray(detection.advertiserHosts, "policy.detection.advertiserHosts").forEach(
+    validateDomainRule
+  );
+  optionalArray(detection.landingParams, "policy.detection.landingParams").forEach(
+    validateParamRule
+  );
+  optionalArray(detection.redirectDomains, "policy.detection.redirectDomains").forEach(
+    validateDomainRule
+  );
+  optionalArray(detection.cookiePatterns, "policy.detection.cookiePatterns").forEach(
+    validateCookieRule
+  );
+  optionalArray(detection.initiatorRules, "policy.detection.initiatorRules").forEach(
+    validateInitiatorRule
+  );
+  const standdown = object(policy.standdown, "policy.standdown");
+  literal(standdown.scope, "advertiser", "policy.standdown.scope");
+  if (standdown.sessionRule !== "session-or-min" && standdown.sessionRule !== "inactivity-window") {
+    throw new TypeError("policy.standdown.sessionRule is invalid");
+  }
+  nonNegativeFiniteNumber(
+    standdown.minDurationMs,
+    "policy.standdown.minDurationMs"
+  );
+  if (standdown.inactivityMs !== void 0) {
+    nonNegativeFiniteNumber(
+      standdown.inactivityMs,
+      "policy.standdown.inactivityMs"
+    );
+  }
+  const behaviors = array(standdown.behaviors, "policy.standdown.behaviors");
+  for (const behavior of behaviors) {
+    if (!BEHAVIORS.has(behavior)) {
+      throw new TypeError(`policy.standdown.behaviors contains invalid behavior`);
+    }
+  }
+  const activation = object(policy.activation, "policy.activation");
+  if (activation.mode !== "user-click" && activation.mode !== "never") {
+    throw new TypeError("policy.activation.mode is invalid");
+  }
+  if (activation.maxPromptsPerJourney !== void 0) {
+    nonNegativeFiniteNumber(
+      activation.maxPromptsPerJourney,
+      "policy.activation.maxPromptsPerJourney"
+    );
+  }
+  for (const referrerClass of optionalArray(
+    activation.allowedReferrerClasses,
+    "policy.activation.allowedReferrerClasses"
+  )) {
+    if (!ACTIVATION_REFERRER_CLASSES.has(referrerClass)) {
+      throw new TypeError(
+        "policy.activation.allowedReferrerClasses contains invalid class"
+      );
+    }
+  }
+  const metadata = object(policy.metadata, "policy.metadata");
+  urlString(metadata.sourceUrl, "policy.metadata.sourceUrl");
+  dateString(metadata.lastVerified, "policy.metadata.lastVerified");
+  if (metadata.notes !== void 0) {
+    string(metadata.notes, "policy.metadata.notes");
+  }
+}
+function validatePolicies(values) {
+  values.forEach(validatePolicy);
+}
+function validateParamRule(ruleValue) {
+  const rule = object(ruleValue, "ParamRule");
+  const anyOf = array(rule.anyOf, "ParamRule.anyOf");
+  if (anyOf.length === 0) {
+    throw new TypeError("ParamRule.anyOf must not be empty");
+  }
+  for (const groupValue of anyOf) {
+    const group = object(groupValue, "ParamRule.anyOf[]");
+    const allOf = array(group.allOf, "ParamRule.anyOf[].allOf");
+    if (allOf.length === 0) {
+      throw new TypeError("ParamRule.anyOf[].allOf must not be empty");
+    }
+    allOf.forEach(validateParamMatcher);
+  }
+  if (rule.reason !== void 0) {
+    string(rule.reason, "ParamRule.reason");
+  }
+}
+function validateParamMatcher(matcherValue) {
+  const matcher = object(matcherValue, "ParamMatcher");
+  string(matcher.name, "ParamMatcher.name");
+  if (matcher.name.trim() === "") {
+    throw new TypeError("ParamMatcher.name must not be empty");
+  }
+  if (matcher.value !== void 0) {
+    string(matcher.value, "ParamMatcher.value");
+  }
+  if (matcher.match !== void 0 && !PARAM_MATCHES.has(matcher.match)) {
+    throw new TypeError("ParamMatcher.match is invalid");
+  }
+  if ((matcher.match === "equals" || matcher.match === "contains") && matcher.value === void 0) {
+    throw new TypeError("ParamMatcher.value is required for equals/contains");
+  }
+}
+function validateDomainRule(ruleValue) {
+  const rule = object(ruleValue, "DomainRule");
+  string(rule.pattern, "DomainRule.pattern");
+  if (!DOMAIN_KINDS.has(rule.kind)) {
+    throw new TypeError("DomainRule.kind is invalid");
+  }
+  if (rule.kind === "regex") {
+    try {
+      new RegExp(rule.pattern);
+    } catch {
+      throw new TypeError("DomainRule.pattern must be a valid regex");
+    }
+  }
+  if (rule.comment !== void 0) {
+    string(rule.comment, "DomainRule.comment");
+  }
+}
+function validateCookieRule(ruleValue) {
+  const rule = object(ruleValue, "CookieRule");
+  string(rule.name, "CookieRule.name");
+  if (!COOKIE_MATCHES.has(rule.match)) {
+    throw new TypeError("CookieRule.match is invalid");
+  }
+  if (rule.reason !== void 0) {
+    string(rule.reason, "CookieRule.reason");
+  }
+}
+function validateInitiatorRule(ruleValue) {
+  const rule = object(ruleValue, "InitiatorRule");
+  if (!REFERRER_CLASSES.has(rule.referrerClass)) {
+    throw new TypeError("InitiatorRule.referrerClass is invalid");
+  }
+  if (rule.reason !== void 0) {
+    string(rule.reason, "InitiatorRule.reason");
+  }
+}
+function object(value, path) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${path} must be an object`);
+  }
+  return value;
+}
+function string(value, path) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new TypeError(`${path} must be a non-empty string`);
+  }
+}
+function literal(value, expected, path) {
+  if (value !== expected) {
+    throw new TypeError(`${path} must be ${String(expected)}`);
+  }
+}
+function array(value, path) {
+  if (!Array.isArray(value)) {
+    throw new TypeError(`${path} must be an array`);
+  }
+  return value;
+}
+function optionalArray(value, path) {
+  if (value === void 0) {
+    return [];
+  }
+  return array(value, path);
+}
+function nonNegativeFiniteNumber(value, path) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    throw new TypeError(`${path} must be a non-negative finite number`);
+  }
+}
+function urlString(value, path) {
+  string(value, path);
+  try {
+    new URL(value);
+  } catch {
+    throw new TypeError(`${path} must be an absolute URL`);
+  }
+}
+function dateString(value, path) {
+  string(value, path);
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) {
+    throw new TypeError(`${path} must be YYYY-MM-DD`);
+  }
+}
+
+// src/bundle.ts
+var textEncoder = new TextEncoder();
+var MAX_SIGNED_BUNDLE_REGEX_LENGTH = 256;
+async function verifyPolicyBundle(current, update, publicKeyJwk) {
+  try {
+    validatePolicies(current);
+    validatePolicies(update.policies);
+  } catch (error) {
+    return { ok: false, violation: `malformed-policy: ${messageFromError(error)}` };
+  }
+  if (update.schemaVersion !== 1) {
+    return { ok: false, violation: "unsupported-bundle-version" };
+  }
+  const signatureOk = await verifySignature(
+    update.signature.algorithm,
+    publicKeyJwk,
+    update.signature.value,
+    canonicalPolicyBundlePayload(update)
+  );
+  if (!signatureOk) {
+    return { ok: false, violation: "bad-signature" };
+  }
+  const regexViolation = regexComplexityViolation(update.policies);
+  if (regexViolation !== void 0) {
+    return { ok: false, violation: regexViolation };
+  }
+  const monotonicityViolation = checkMonotonicity(current, update.policies);
+  if (monotonicityViolation !== void 0) {
+    return { ok: false, violation: monotonicityViolation };
+  }
+  return { ok: true, policies: update.policies.map(clonePolicy) };
+}
+function canonicalPolicyBundlePayload(bundle) {
+  return canonicalJson({
+    schemaVersion: bundle.schemaVersion,
+    policies: bundle.policies
+  });
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") {
+    if (typeof value === "number" && !Number.isFinite(value)) {
+      throw new TypeError("canonical JSON only supports finite numbers");
+    }
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+  }
+  const record = value;
+  const entries = Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`);
+  return `{${entries.join(",")}}`;
+}
+function checkMonotonicity(current, update) {
+  const updateById = new Map(update.map((policy) => [policy.id, policy]));
+  for (const currentPolicy of current) {
+    const updatedPolicy = updateById.get(currentPolicy.id);
+    if (updatedPolicy === void 0) {
+      return `policy-removed:${currentPolicy.id}`;
+    }
+    const detectionResult = detectionViolation(currentPolicy, updatedPolicy);
+    if (detectionResult !== void 0) {
+      return `${currentPolicy.id}:${detectionResult}`;
+    }
+    const standdownResult = standdownViolation(currentPolicy, updatedPolicy);
+    if (standdownResult !== void 0) {
+      return `${currentPolicy.id}:${standdownResult}`;
+    }
+    if (!sameJson(currentPolicy.activation, updatedPolicy.activation)) {
+      return `${currentPolicy.id}:activation-edited`;
+    }
+  }
+  return void 0;
+}
+function detectionViolation(currentPolicy, updatedPolicy) {
+  if (!domainRulesSurvive(
+    currentPolicy.detection.advertiserHosts,
+    updatedPolicy.detection.advertiserHosts,
+    { advertiserHosts: true }
+  )) {
+    return "advertiser-hosts-narrowed";
+  }
+  if (!paramRulesSurvive(
+    currentPolicy.detection.landingParams,
+    updatedPolicy.detection.landingParams
+  )) {
+    return "landing-params-narrowed";
+  }
+  if (!domainRulesSurvive(
+    currentPolicy.detection.redirectDomains,
+    updatedPolicy.detection.redirectDomains
+  )) {
+    return "redirect-domains-narrowed";
+  }
+  if (!cookieRulesSurvive(
+    currentPolicy.detection.cookiePatterns,
+    updatedPolicy.detection.cookiePatterns
+  )) {
+    return "cookie-patterns-narrowed";
+  }
+  if (!initiatorRulesSurvive(
+    currentPolicy.detection.initiatorRules,
+    updatedPolicy.detection.initiatorRules
+  )) {
+    return "initiator-rules-narrowed";
+  }
+  return void 0;
+}
+function standdownViolation(currentPolicy, updatedPolicy) {
+  if (updatedPolicy.standdown.scope !== currentPolicy.standdown.scope) {
+    return "standdown-scope-edited";
+  }
+  if (updatedPolicy.standdown.sessionRule !== currentPolicy.standdown.sessionRule) {
+    return "session-rule-edited";
+  }
+  if (updatedPolicy.standdown.minDurationMs < currentPolicy.standdown.minDurationMs) {
+    return "min-duration-shortened";
+  }
+  if (currentPolicy.standdown.inactivityMs !== void 0 && (updatedPolicy.standdown.inactivityMs === void 0 || updatedPolicy.standdown.inactivityMs < currentPolicy.standdown.inactivityMs)) {
+    return "inactivity-duration-shortened";
+  }
+  for (const behavior of currentPolicy.standdown.behaviors) {
+    if (!updatedPolicy.standdown.behaviors.includes(behavior)) {
+      return "standdown-behavior-removed";
+    }
+  }
+  return void 0;
+}
+function domainRulesSurvive(current, update, opts = {}) {
+  if (opts.advertiserHosts && current === void 0) {
+    return update === void 0;
+  }
+  if (current === void 0 || current.length === 0) {
+    return true;
+  }
+  if (opts.advertiserHosts && update === void 0) {
+    return true;
+  }
+  if (update === void 0 || update.length === 0) {
+    return false;
+  }
+  return current.every(
+    (rule) => update.some((candidate) => domainRuleCovers(rule, candidate))
+  );
+}
+function regexComplexityViolation(policies) {
+  for (const policy of policies) {
+    for (const [field, rules] of domainRuleEntries(policy)) {
+      for (const rule of rules ?? []) {
+        if (rule.kind === "regex" && isComplexRegex(rule.pattern)) {
+          return `${policy.id}:complex-regex:${field}`;
+        }
+      }
+    }
+  }
+  return void 0;
+}
+function domainRuleEntries(policy) {
+  return [
+    ["detection.advertiserHosts", policy.detection.advertiserHosts],
+    ["detection.redirectDomains", policy.detection.redirectDomains]
+  ];
+}
+function isComplexRegex(pattern) {
+  return pattern.length > MAX_SIGNED_BUNDLE_REGEX_LENGTH || hasRegexBackreference(pattern) || hasRegexLookaround(pattern) || hasNestedUnboundedQuantifier(pattern);
+}
+function hasRegexBackreference(pattern) {
+  return /(^|[^\\])\\[1-9]/.test(pattern);
+}
+function hasRegexLookaround(pattern) {
+  return /\(\?(?:[=!]|<[=!])/.test(pattern);
+}
+function hasNestedUnboundedQuantifier(pattern) {
+  return /\((?:[^()\\]|\\.)*[+*](?:[^()\\]|\\.)*\)(?:[+*]|\{\d*,?\})/.test(
+    pattern
+  );
+}
+function domainRuleCovers(current, update) {
+  if (current.kind === "suffix" && update.kind === "suffix") {
+    return domainSuffixMatches(current.pattern, update.pattern);
+  }
+  return sameJson(current, update);
+}
+function paramRulesSurvive(current, update) {
+  return exactRulesSurvive(current, update);
+}
+function cookieRulesSurvive(current, update) {
+  return exactRulesSurvive(current, update);
+}
+function initiatorRulesSurvive(current, update) {
+  return exactRulesSurvive(current, update);
+}
+function exactRulesSurvive(current, update) {
+  if (current === void 0 || current.length === 0) {
+    return true;
+  }
+  if (update === void 0 || update.length === 0) {
+    return false;
+  }
+  const updatedRules = new Set(update.map((rule) => canonicalJson(rule)));
+  return current.every((rule) => updatedRules.has(canonicalJson(rule)));
+}
+async function verifySignature(algorithm, publicKeyJwk, signatureValue, payload) {
+  try {
+    const publicKey = await importVerificationKey(algorithm, publicKeyJwk);
+    const signature = base64UrlToBytes(signatureValue);
+    const data = bytesToArrayBuffer(textEncoder.encode(payload));
+    if (algorithm === "ECDSA-P256") {
+      return crypto.subtle.verify(
+        { name: "ECDSA", hash: "SHA-256" },
+        publicKey,
+        bytesToArrayBuffer(signature),
+        data
+      );
+    }
+    return crypto.subtle.verify(
+      "Ed25519",
+      publicKey,
+      bytesToArrayBuffer(signature),
+      data
+    );
+  } catch {
+    return false;
+  }
+}
+async function importVerificationKey(algorithm, publicKeyJwk) {
+  if (algorithm === "ECDSA-P256") {
+    return crypto.subtle.importKey(
+      "jwk",
+      publicKeyJwk,
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      ["verify"]
+    );
+  }
+  return crypto.subtle.importKey("jwk", publicKeyJwk, "Ed25519", false, [
+    "verify"
+  ]);
+}
+function base64UrlToBytes(value) {
+  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+}
+function bytesToArrayBuffer(bytes) {
+  return bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength
+  );
+}
+function sameJson(left, right) {
+  return canonicalJson(left) === canonicalJson(right);
+}
+function domainSuffixMatches(host, pattern) {
+  const normalizedHost = host.toLowerCase().replace(/^\./, "").replace(/\.$/, "");
+  const normalizedPattern = pattern.toLowerCase().replace(/^\./, "").replace(/\.$/, "");
+  return normalizedHost === normalizedPattern || normalizedHost.endsWith(`.${normalizedPattern}`);
+}
+function clonePolicy(policy) {
+  return JSON.parse(JSON.stringify(policy));
+}
+function messageFromError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/detect.ts
+var ORGANIC_REFERRER_SUFFIXES = [
+  "google.com",
+  "bing.com",
+  "duckduckgo.com",
+  "yahoo.com",
+  "ecosia.org",
+  "baidu.com",
+  "yandex.com"
+];
+function detect(signals, policies) {
+  const currentUrl = parseUrl(signals.url);
+  if (!currentUrl) {
+    return {
+      matched: [],
+      selfMatch: false,
+      failClosedReason: "invalid-url"
+    };
+  }
+  const advertiserHost = currentUrl.hostname.toLowerCase();
+  const matched = [];
+  let selfMatch = false;
+  for (const policy of policies) {
+    const scopedSelfMatch = hasScopedSelfExemption(
+      currentUrl,
+      signals.selfPatterns,
+      policy
+    );
+    const unscopedSelfMatch = hasUnscopedSelfExemption(
+      currentUrl,
+      signals.selfPatterns
+    );
+    if (scopedSelfMatch || unscopedSelfMatch) {
+      selfMatch = true;
+    }
+    if (scopedSelfMatch) {
+      continue;
+    }
+    matched.push(
+      ...collectPolicyMatches(policy, signals, currentUrl, advertiserHost)
+    );
+  }
+  matched.sort((left, right) => kindPriority(left.kind) - kindPriority(right.kind));
+  const strongest = matched[0] ? {
+    policyId: matched[0].policyId,
+    advertiserHost: matched[0].advertiserHost,
+    reason: matched[0].reason
+  } : void 0;
+  return strongest ? { matched, selfMatch, strongest } : { matched, selfMatch };
+}
+function classifyReferrer(signals, advertiserHost) {
+  const candidate = signals.initiator ?? signals.referrer;
+  if (!candidate) {
+    return "direct";
+  }
+  const referrerHost = hostFromUrl(candidate);
+  if (!referrerHost) {
+    return "other";
+  }
+  if ((signals.publisherSites ?? []).some(
+    (site) => domainSuffixMatches2(referrerHost, site)
+  )) {
+    return "own-site";
+  }
+  if (domainSuffixMatches2(referrerHost, advertiserHost)) {
+    return "advertiser-internal";
+  }
+  if (ORGANIC_REFERRER_SUFFIXES.some(
+    (suffix) => domainSuffixMatches2(referrerHost, suffix)
+  )) {
+    return "organic";
+  }
+  return "other";
+}
+function domainRuleMatchesUrl(rule, value) {
+  const url = parseUrl(value);
+  const host = url?.hostname.toLowerCase() ?? value.toLowerCase();
+  if (rule.kind === "suffix") {
+    return domainSuffixMatches2(host, rule.pattern);
+  }
+  try {
+    const regex = new RegExp(rule.pattern, "i");
+    return regex.test(host) || (url ? regex.test(url.href) : regex.test(value));
+  } catch {
+    return false;
+  }
+}
+function collectPolicyMatches(policy, signals, currentUrl, advertiserHost) {
+  const matches = [];
+  const advertiserHostMatches = policy.detection.advertiserHosts === void 0 || policy.detection.advertiserHosts.some(
+    (rule) => domainRuleMatchesUrl(rule, advertiserHost)
+  );
+  if (advertiserHostMatches) {
+    for (const rule of policy.detection.landingParams ?? []) {
+      if (paramRuleMatches(rule, currentUrl.searchParams)) {
+        matches.push(
+          matchedRule(
+            policy,
+            "landing-param",
+            describeParamRule(rule),
+            advertiserHost,
+            rule.reason ?? "landing parameter matched"
+          )
+        );
+      }
+    }
+  }
+  for (const rule of policy.detection.redirectDomains ?? []) {
+    if ((signals.redirectChain ?? []).some((url) => domainRuleMatchesUrl(rule, url))) {
+      matches.push(
+        matchedRule(
+          policy,
+          "redirect-domain",
+          `${rule.kind}:${rule.pattern}`,
+          advertiserHost,
+          rule.comment ?? "redirect domain matched"
+        )
+      );
+    }
+  }
+  if (advertiserHostMatches) {
+    for (const rule of policy.detection.cookiePatterns ?? []) {
+      if (cookieRuleMatches(rule, signals.cookieNames ?? [])) {
+        matches.push(
+          matchedRule(
+            policy,
+            "cookie",
+            `${rule.match}:${rule.name}`,
+            advertiserHost,
+            rule.reason ?? "first-party cookie name matched"
+          )
+        );
+      }
+    }
+  }
+  if (advertiserHostMatches) {
+    for (const rule of policy.detection.initiatorRules ?? []) {
+      if (initiatorRuleMatches(rule, signals, advertiserHost)) {
+        matches.push(
+          matchedRule(
+            policy,
+            "initiator",
+            `referrer-class:${rule.referrerClass}`,
+            advertiserHost,
+            rule.reason ?? "initiator/referrer class matched"
+          )
+        );
+      }
+    }
+  }
+  return matches;
+}
+function matchedRule(policy, kind, rule, advertiserHost, reason) {
+  return {
+    policyId: policy.id,
+    networkId: policy.network.id,
+    networkName: policy.network.name,
+    kind,
+    rule,
+    advertiserHost,
+    reason,
+    sourceUrl: policy.metadata.sourceUrl
+  };
+}
+function kindPriority(kind) {
+  if (kind === "redirect-domain") {
+    return 0;
+  }
+  if (kind === "landing-param") {
+    return 1;
+  }
+  if (kind === "cookie") {
+    return 2;
+  }
+  return 3;
+}
+function paramRuleMatches(rule, params) {
+  return rule.anyOf.some(
+    (group) => group.allOf.every((matcher) => paramMatcherMatches(matcher, params))
+  );
+}
+function paramMatcherMatches(matcher, params) {
+  const values = params.getAll(matcher.name);
+  const mode = matcher.match ?? (matcher.value === void 0 ? "exists" : "equals");
+  if (mode === "exists") {
+    return values.length > 0;
+  }
+  const expectedValue = matcher.value;
+  if (expectedValue === void 0) {
+    return false;
+  }
+  if (mode === "equals") {
+    return values.some((value) => value === expectedValue);
+  }
+  return values.some((value) => value.includes(expectedValue));
+}
+function cookieRuleMatches(rule, cookieNames) {
+  if (rule.match === "exact") {
+    return cookieNames.some((name) => name === rule.name);
+  }
+  return cookieNames.some((name) => name.includes(rule.name));
+}
+function initiatorRuleMatches(rule, signals, advertiserHost) {
+  return classifyReferrer(signals, advertiserHost) === rule.referrerClass;
+}
+function hasScopedSelfExemption(currentUrl, selfPatterns, policy) {
+  return (selfPatterns ?? []).some((pattern) => {
+    const scopedToPolicy = pattern.policyId === policy.id;
+    const scopedToNetwork = pattern.networkId === policy.network.id;
+    return (scopedToPolicy || scopedToNetwork) && paramMatcherMatches(pattern, currentUrl.searchParams);
+  });
+}
+function hasUnscopedSelfExemption(currentUrl, selfPatterns) {
+  return (selfPatterns ?? []).some(
+    (pattern) => pattern.policyId === void 0 && pattern.networkId === void 0 && paramMatcherMatches(pattern, currentUrl.searchParams)
+  );
+}
+function domainSuffixMatches2(host, pattern) {
+  const normalizedHost = host.toLowerCase().replace(/\.$/, "");
+  const normalizedPattern = pattern.toLowerCase().replace(/^\./, "").replace(/\.$/, "");
+  return normalizedHost === normalizedPattern || normalizedHost.endsWith(`.${normalizedPattern}`);
+}
+function describeParamRule(rule) {
+  return rule.anyOf.map(
+    (group) => group.allOf.map((matcher) => {
+      const mode = matcher.match ?? (matcher.value === void 0 ? "exists" : "equals");
+      return matcher.value === void 0 ? `${matcher.name}:${mode}` : `${matcher.name}:${mode}:${matcher.value}`;
+    }).join("&")
+  ).join("|");
+}
+function parseUrl(value) {
+  try {
+    return new URL(value);
+  } catch {
+    return void 0;
+  }
+}
+function hostFromUrl(value) {
+  return parseUrl(value)?.hostname.toLowerCase();
+}
+
+// src/session.ts
+var StanddownSession = class {
+  #store;
+  #auditLog;
+  #maxAuditEntries;
+  #readOnlyAuditLog = [];
+  constructor(store, opts) {
+    this.#store = store;
+    this.#auditLog = opts?.auditLog ?? true;
+    this.#maxAuditEntries = Math.max(0, opts?.maxAuditEntries ?? 1e3);
+  }
+  async ingest(signals, policies) {
+    const advertiserHost = hostFromUrl2(signals.url);
+    try {
+      validatePolicies(policies);
+    } catch (error) {
+      return this.#failClosedWithAudit(
+        signals.now,
+        "ingest",
+        advertiserHost,
+        `malformed-policy: ${messageFromError2(error)}`
+      );
+    }
+    const detection = detect(signals, policies);
+    if (detection.failClosedReason) {
+      return this.#failClosedWithAudit(
+        signals.now,
+        "ingest",
+        advertiserHost,
+        detection.failClosedReason,
+        detection
+      );
+    }
+    return this.#withState(signals.now, (state) => {
+      pruneExpiredSessions(state, signals.now);
+      if (detection.strongest) {
+        const matchedPolicies = policiesForDetection(policies, detection);
+        if (matchedPolicies.length === 0) {
+          return {
+            decision: failClosedDecision("matched-policy-missing"),
+            detection
+          };
+        }
+        const record = upsertSessionRecord(
+          state,
+          detection.strongest.advertiserHost,
+          detection.strongest.policyId,
+          matchedPolicies,
+          signals.now
+        );
+        return {
+          decision: decisionFromRecord(record, signals.now, {
+            reason: detection.strongest.reason,
+            referrerClass: classifyReferrer(signals, record.advertiserHost)
+          }),
+          detection
+        };
+      }
+      const activeDecision = advertiserHost ? activeDecisionForHost(state, advertiserHost, signals.now) : void 0;
+      return {
+        decision: activeDecision ?? {
+          standDown: false,
+          reason: detection.selfMatch ? "self-exempted-no-active-standdown" : "no-active-standdown",
+          behaviors: [],
+          referrerClass: advertiserHost ? classifyReferrer(signals, advertiserHost) : "other"
+        },
+        detection
+      };
+    }, "ingest");
+  }
+  async shouldStandDown(advertiserHost, now) {
+    return this.#withState(
+      now,
+      (state) => {
+        pruneExpiredSessions(state, now);
+        return {
+          decision: activeDecisionForHost(state, advertiserHost, now) ?? {
+            standDown: false,
+            reason: "no-active-standdown",
+            behaviors: []
+          }
+        };
+      },
+      "shouldStandDown",
+      normalizeHost(advertiserHost),
+      { persist: false }
+    );
+  }
+  async recordActivity(now) {
+    await this.#withState(
+      now,
+      (state) => {
+        pruneExpiredSessions(state, now);
+        for (const record of Object.values(state.sessions)) {
+          if (record.sessionRule === "inactivity-window") {
+            record.lastActivityAt = now;
+            const expiresAt = computeExpiresAt(record);
+            if (expiresAt !== void 0) {
+              record.expiresAt = expiresAt;
+            }
+          }
+        }
+        return {
+          decision: {
+            standDown: false,
+            reason: "activity-recorded",
+            behaviors: []
+          }
+        };
+      },
+      "recordActivity"
+    );
+  }
+  async exportAuditLog() {
+    const state = await this.#loadState();
+    return trimAuditLog(
+      [...state.auditLog, ...this.#readOnlyAuditLog],
+      this.#maxAuditEntries
+    ).map(cloneAuditEntry);
+  }
+  async #withState(now, fn, action, advertiserHost, opts = {}) {
+    let state;
+    try {
+      state = await this.#loadState();
+    } catch {
+      return failClosedDecision("store-error");
+    }
+    const result = fn(state);
+    if (this.#auditLog) {
+      const entry = auditEntry({
+        time: now,
+        action,
+        advertiserHost: advertiserHost ?? result.detection?.strongest?.advertiserHost,
+        detection: result.detection,
+        decision: result.decision
+      });
+      if (opts.persist === false) {
+        appendAuditEntry(this.#readOnlyAuditLog, entry, this.#maxAuditEntries);
+      } else {
+        appendAuditEntry(state.auditLog, entry, this.#maxAuditEntries);
+      }
+    }
+    if (opts.persist === false) {
+      return result.decision;
+    }
+    try {
+      await this.#store.save(state);
+    } catch {
+      return failClosedDecision("store-error");
+    }
+    return result.decision;
+  }
+  async #failClosedWithAudit(now, action, advertiserHost, reason, detection) {
+    const decision = failClosedDecision(reason);
+    if (!this.#auditLog) {
+      return decision;
+    }
+    try {
+      const state = await this.#loadState();
+      appendAuditEntry(
+        state.auditLog,
+        auditEntry({
+          time: now,
+          action,
+          advertiserHost,
+          detection,
+          decision
+        }),
+        this.#maxAuditEntries
+      );
+      await this.#store.save(state);
+    } catch {
+      return failClosedDecision("store-error");
+    }
+    return decision;
+  }
+  async #loadState() {
+    return await this.#store.load() ?? { sessions: {}, auditLog: [] };
+  }
+};
+function appendAuditEntry(auditLog, entry, maxEntries) {
+  if (maxEntries === 0) {
+    auditLog.length = 0;
+    return;
+  }
+  auditLog.push(entry);
+  if (auditLog.length > maxEntries) {
+    auditLog.splice(0, auditLog.length - maxEntries);
+  }
+}
+function trimAuditLog(auditLog, maxEntries) {
+  if (maxEntries === 0) {
+    return [];
+  }
+  return auditLog.slice(Math.max(0, auditLog.length - maxEntries));
+}
+function upsertSessionRecord(state, advertiserHost, primaryPolicyId, policies, now) {
+  const key = normalizeHost(advertiserHost);
+  const existing = state.sessions[key];
+  const startedAt = existing?.startedAt ?? now;
+  const lastActivityAt = now;
+  const sessionRule = existing?.sessionRule === "session-or-min" || policies.some((policy) => policy.standdown.sessionRule === "session-or-min") ? "session-or-min" : "inactivity-window";
+  const baseRecord = {
+    advertiserHost: key,
+    policyId: primaryPolicyId,
+    startedAt,
+    lastActivityAt,
+    sessionRule,
+    minDurationMs: Math.max(
+      existing?.minDurationMs ?? 0,
+      ...policies.map((policy) => policy.standdown.minDurationMs)
+    ),
+    behaviors: unionBehaviors([
+      ...existing?.behaviors ?? [],
+      ...policies.flatMap((policy) => policy.standdown.behaviors)
+    ])
+  };
+  if (sessionRule === "inactivity-window") {
+    const inactivityMs = Math.max(
+      existing?.inactivityMs ?? 0,
+      ...policies.flatMap(
+        (policy) => policy.standdown.inactivityMs === void 0 ? [] : [policy.standdown.inactivityMs]
+      )
+    );
+    if (inactivityMs > 0) {
+      baseRecord.inactivityMs = inactivityMs;
+    }
+  }
+  const computedExpiresAt = computeExpiresAt(baseRecord);
+  if (computedExpiresAt !== void 0) {
+    baseRecord.expiresAt = Math.max(existing?.expiresAt ?? 0, computedExpiresAt);
+  }
+  state.sessions[key] = baseRecord;
+  return baseRecord;
+}
+function policiesForDetection(policies, detection) {
+  if (detection.strongest === void 0) {
+    return [];
+  }
+  const matchingPolicyIds = new Set(
+    detection.matched.filter(
+      (match) => match.advertiserHost === detection.strongest?.advertiserHost
+    ).map((match) => match.policyId)
+  );
+  return policies.filter((policy) => matchingPolicyIds.has(policy.id));
+}
+function unionBehaviors(behaviors) {
+  return [...new Set(behaviors)];
+}
+function activeDecisionForHost(state, advertiserHost, now) {
+  const record = state.sessions[normalizeHost(advertiserHost)];
+  if (!record || !isActive(record, now)) {
+    return void 0;
+  }
+  return decisionFromRecord(record, now);
+}
+function decisionFromRecord(record, now, overrides) {
+  const expiresAt = computeExpiresAt(record);
+  const decision = {
+    standDown: true,
+    policyId: record.policyId,
+    reason: overrides?.reason ?? `active-standdown:${record.policyId}`,
+    behaviors: [...record.behaviors]
+  };
+  if (expiresAt !== void 0) {
+    decision.expiresAt = expiresAt;
+  }
+  if (overrides?.referrerClass !== void 0) {
+    decision.referrerClass = overrides.referrerClass;
+  }
+  if (!isActive({ ...record, ...expiresAt === void 0 ? {} : { expiresAt } }, now)) {
+    return {
+      standDown: false,
+      reason: "standdown-expired",
+      behaviors: []
+    };
+  }
+  return decision;
+}
+function computeExpiresAt(record) {
+  if (record.sessionRule === "inactivity-window" && record.inactivityMs !== void 0) {
+    return Math.max(
+      record.startedAt + record.minDurationMs,
+      record.lastActivityAt + record.inactivityMs
+    );
+  }
+  return record.expiresAt;
+}
+function isActive(record, now) {
+  if (record.sessionRule === "session-or-min") {
+    return true;
+  }
+  const expiresAt = computeExpiresAt(record);
+  return expiresAt === void 0 ? false : now < expiresAt;
+}
+function pruneExpiredSessions(state, now) {
+  for (const [host, record] of Object.entries(state.sessions)) {
+    if (!isActive(record, now)) {
+      delete state.sessions[host];
+    }
+  }
+}
+function failClosedDecision(reason) {
+  return {
+    standDown: true,
+    reason,
+    behaviors: [
+      "suppress-prompts",
+      "no-cookie-write",
+      "no-redirect",
+      "no-background-tracking"
+    ]
+  };
+}
+function auditEntry(value) {
+  const entry = {
+    time: value.time,
+    action: value.action
+  };
+  if (value.advertiserHost !== void 0) {
+    entry.advertiserHost = value.advertiserHost;
+  }
+  if (value.detection !== void 0) {
+    entry.detection = value.detection;
+  }
+  if (value.decision !== void 0) {
+    entry.decision = value.decision;
+  }
+  return entry;
+}
+function cloneAuditEntry(entry) {
+  const cloned = {
+    time: entry.time,
+    action: entry.action
+  };
+  if (entry.advertiserHost !== void 0) {
+    cloned.advertiserHost = entry.advertiserHost;
+  }
+  if (entry.detection !== void 0) {
+    const detection = {
+      matched: entry.detection.matched.map((match) => ({ ...match })),
+      selfMatch: entry.detection.selfMatch
+    };
+    if (entry.detection.strongest !== void 0) {
+      detection.strongest = { ...entry.detection.strongest };
+    }
+    if (entry.detection.failClosedReason !== void 0) {
+      detection.failClosedReason = entry.detection.failClosedReason;
+    }
+    cloned.detection = detection;
+  }
+  if (entry.decision !== void 0) {
+    cloned.decision = {
+      ...entry.decision,
+      behaviors: [...entry.decision.behaviors]
+    };
+  }
+  return cloned;
+}
+function normalizeHost(host) {
+  return host.toLowerCase().replace(/\.$/, "");
+}
+function hostFromUrl2(value) {
+  try {
+    return normalizeHost(new URL(value).hostname);
+  } catch {
+    return void 0;
+  }
+}
+function messageFromError2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/stores.ts
+var DEFAULT_STATE_KEY = "standdown:state:v1";
+var DEFAULT_SESSION_ID_KEY = "standdown:session-id:v1";
+var ChromeLocalStateStore = class {
+  #localStorage;
+  #sessionStorage;
+  #runtime;
+  #key;
+  #identityKey;
+  #fixedSessionId;
+  #now;
+  #createSessionId;
+  #cachedSessionId;
+  constructor(localStorage, opts = {}) {
+    this.#localStorage = localStorage;
+    this.#sessionStorage = opts.sessionStorage;
+    this.#runtime = opts.runtime;
+    this.#key = opts.key ?? DEFAULT_STATE_KEY;
+    this.#identityKey = opts.identityKey ?? DEFAULT_SESSION_ID_KEY;
+    this.#fixedSessionId = opts.sessionId;
+    this.#now = opts.now ?? Date.now;
+    this.#createSessionId = opts.createSessionId ?? createSessionId;
+  }
+  async load() {
+    const sessionId = await this.#currentSessionId();
+    const items = await chromeGet(this.#localStorage, this.#key, this.#runtime);
+    const envelope = items[this.#key];
+    if (envelope === void 0) {
+      return void 0;
+    }
+    const persisted = parsePersistedState(envelope);
+    const state = cloneState(persisted.state);
+    if (sessionIdentityMismatch(persisted.sessionId, sessionId)) {
+      return dropSessionBoundRecords(state, this.#now());
+    }
+    return state;
+  }
+  async save(state) {
+    const sessionId = await this.#currentSessionId();
+    const envelope = {
+      schemaVersion: 1,
+      state: cloneState(state)
+    };
+    if (sessionId !== void 0) {
+      envelope.sessionId = sessionId;
+    }
+    await chromeSet(
+      this.#localStorage,
+      {
+        [this.#key]: envelope
+      },
+      this.#runtime
+    );
+  }
+  async #currentSessionId() {
+    if (this.#fixedSessionId !== void 0) {
+      return this.#fixedSessionId;
+    }
+    if (this.#cachedSessionId !== void 0) {
+      return this.#cachedSessionId;
+    }
+    if (this.#sessionStorage === void 0) {
+      return void 0;
+    }
+    const items = await chromeGet(
+      this.#sessionStorage,
+      this.#identityKey,
+      this.#runtime
+    );
+    const existing = items[this.#identityKey];
+    if (typeof existing === "string" && existing.length > 0) {
+      this.#cachedSessionId = existing;
+      return existing;
+    }
+    const next = this.#createSessionId();
+    await chromeSet(
+      this.#sessionStorage,
+      { [this.#identityKey]: next },
+      this.#runtime
+    );
+    this.#cachedSessionId = next;
+    return next;
+  }
+};
+function dropSessionBoundRecords(state, now) {
+  const next = cloneState(state);
+  for (const [host, record] of Object.entries(next.sessions)) {
+    if (record.sessionRule === "session-or-min" && now >= record.startedAt + record.minDurationMs) {
+      delete next.sessions[host];
+    }
+  }
+  return next;
+}
+function createSessionId() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  return `session-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
+function parsePersistedState(value) {
+  if (!isRecord(value)) {
+    throw new Error("invalid persisted state");
+  }
+  const sessionId = value.sessionId;
+  const savedAt = value.savedAt ?? 0;
+  const state = value.state;
+  if (sessionId !== void 0 && typeof sessionId !== "string" || typeof savedAt !== "number") {
+    throw new Error("invalid persisted state envelope");
+  }
+  return {
+    sessionId,
+    savedAt,
+    state: parseState(state)
+  };
+}
+function parseState(value) {
+  if (!isRecord(value) || !isRecord(value.sessions) || !Array.isArray(value.auditLog)) {
+    throw new Error("invalid standdown state");
+  }
+  const sessions = {};
+  for (const [host, record] of Object.entries(value.sessions)) {
+    sessions[host] = parseSessionRecord(record);
+  }
+  return {
+    sessions,
+    auditLog: value.auditLog.map(parseAuditEntry)
+  };
+}
+function parseSessionRecord(value) {
+  if (!isRecord(value)) {
+    throw new Error("invalid session record");
+  }
+  const {
+    advertiserHost,
+    policyId,
+    startedAt,
+    lastActivityAt,
+    expiresAt,
+    sessionRule,
+    minDurationMs,
+    inactivityMs,
+    behaviors
+  } = value;
+  if (typeof advertiserHost !== "string" || typeof policyId !== "string" || typeof startedAt !== "number" || typeof lastActivityAt !== "number" || expiresAt !== void 0 && typeof expiresAt !== "number" || sessionRule !== "session-or-min" && sessionRule !== "inactivity-window" || typeof minDurationMs !== "number" || inactivityMs !== void 0 && typeof inactivityMs !== "number" || !Array.isArray(behaviors) || !behaviors.every(isBehavior)) {
+    throw new Error("invalid session record");
+  }
+  const record = {
+    advertiserHost,
+    policyId,
+    startedAt,
+    lastActivityAt,
+    sessionRule,
+    minDurationMs,
+    behaviors
+  };
+  if (expiresAt !== void 0) {
+    record.expiresAt = expiresAt;
+  }
+  if (inactivityMs !== void 0) {
+    record.inactivityMs = inactivityMs;
+  }
+  return record;
+}
+function parseAuditEntry(value) {
+  if (!isRecord(value)) {
+    throw new Error("invalid audit entry");
+  }
+  const { time, action, advertiserHost, detection, decision } = value;
+  if (typeof time !== "number" || action !== "ingest" && action !== "shouldStandDown" && action !== "recordActivity" && action !== "refresh" || advertiserHost !== void 0 && typeof advertiserHost !== "string") {
+    throw new Error("invalid audit entry");
+  }
+  const entry = { time, action };
+  if (advertiserHost !== void 0) {
+    entry.advertiserHost = advertiserHost;
+  }
+  if (detection !== void 0) {
+    entry.detection = detection;
+  }
+  if (decision !== void 0) {
+    entry.decision = decision;
+  }
+  return entry;
+}
+function cloneState(state) {
+  return {
+    sessions: Object.fromEntries(
+      Object.entries(state.sessions).map(([host, record]) => [
+        host,
+        cloneSessionRecord(record)
+      ])
+    ),
+    auditLog: state.auditLog.map(cloneAuditEntry2)
+  };
+}
+function cloneSessionRecord(record) {
+  const next = {
+    advertiserHost: record.advertiserHost,
+    policyId: record.policyId,
+    startedAt: record.startedAt,
+    lastActivityAt: record.lastActivityAt,
+    sessionRule: record.sessionRule,
+    minDurationMs: record.minDurationMs,
+    behaviors: [...record.behaviors]
+  };
+  if (record.expiresAt !== void 0) {
+    next.expiresAt = record.expiresAt;
+  }
+  if (record.inactivityMs !== void 0) {
+    next.inactivityMs = record.inactivityMs;
+  }
+  return next;
+}
+function cloneAuditEntry2(entry) {
+  const next = {
+    time: entry.time,
+    action: entry.action
+  };
+  if (entry.advertiserHost !== void 0) {
+    next.advertiserHost = entry.advertiserHost;
+  }
+  if (entry.detection !== void 0) {
+    next.detection = {
+      matched: entry.detection.matched.map((match) => ({ ...match })),
+      selfMatch: entry.detection.selfMatch
+    };
+    if (entry.detection.strongest !== void 0) {
+      next.detection.strongest = { ...entry.detection.strongest };
+    }
+    if (entry.detection.failClosedReason !== void 0) {
+      next.detection.failClosedReason = entry.detection.failClosedReason;
+    }
+  }
+  if (entry.decision !== void 0) {
+    next.decision = {
+      ...entry.decision,
+      behaviors: [...entry.decision.behaviors]
+    };
+  }
+  return next;
+}
+function chromeGet(storage, key, runtime) {
+  return new Promise((resolve, reject) => {
+    try {
+      const result = storage.get(key, (items) => {
+        const error = runtime?.lastError;
+        if (error !== void 0) {
+          reject(new Error(error.message ?? "chrome storage error"));
+          return;
+        }
+        resolve(items ?? {});
+      });
+      if (isPromiseLike(result)) {
+        result.then(resolve, reject);
+      }
+    } catch (error) {
+      reject(error);
+    }
+  });
+}
+function chromeSet(storage, items, runtime) {
+  return new Promise((resolve, reject) => {
+    try {
+      const result = storage.set(items, () => {
+        const error = runtime?.lastError;
+        if (error !== void 0) {
+          reject(new Error(error.message ?? "chrome storage error"));
+          return;
+        }
+        resolve();
+      });
+      if (isPromiseLike(result)) {
+        result.then(resolve, reject);
+      }
+    } catch (error) {
+      reject(error);
+    }
+  });
+}
+function isPromiseLike(value) {
+  return isRecord(value) && typeof value.then === "function" && typeof value.catch === "function";
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function sessionIdentityMismatch(persistedSessionId, currentSessionId) {
+  return persistedSessionId !== void 0 && currentSessionId !== void 0 && persistedSessionId !== currentSessionId;
+}
+function isBehavior(value) {
+  return value === "suppress-prompts" || value === "no-cookie-write" || value === "no-redirect" || value === "no-background-tracking";
+}
+
+// src/webext.ts
+var QUERY_MESSAGE_TYPE = "standdown:shouldStandDown";
+var FAIL_CLOSED_BEHAVIORS = [
+  "suppress-prompts",
+  "no-cookie-write",
+  "no-redirect",
+  "no-background-tracking"
+];
+var DEFAULT_REFRESH_INTERVAL_MS = 60 * 60 * 1e3;
+var MAX_ADAPTER_AUDIT_ENTRIES = 1e3;
+function createStanddown(opts) {
+  const chromeApi = opts.chrome ?? currentChrome();
+  const now = opts.now ?? Date.now;
+  const fetchImpl = opts.fetch ?? currentFetch();
+  let activePolicies = opts.policies.map((policy) => clonePolicy2(policy));
+  let refreshTimer;
+  const store = opts.store ?? createChromeStore(chromeApi, {
+    sessionId: opts.sessionId,
+    now
+  });
+  const session = new StanddownSession(
+    store,
+    opts.auditLog === void 0 ? void 0 : { auditLog: opts.auditLog }
+  );
+  const redirectChains = /* @__PURE__ */ new Map();
+  const redirectRequestIds = /* @__PURE__ */ new Map();
+  const initiators = /* @__PURE__ */ new Map();
+  const tabHosts = /* @__PURE__ */ new Map();
+  const hasWebRequest = typeof chromeApi?.webRequest?.onBeforeRequest?.addListener === "function";
+  const hasWebNavigation = typeof chromeApi?.webNavigation?.onCommitted?.addListener === "function";
+  if (!hasWebNavigation) {
+    throw new TypeError(
+      "standdown/webext requires chrome.webNavigation.onCommitted"
+    );
+  }
+  const mode = hasWebRequest ? "webRequest" : "webNavigation";
+  const onBeforeRequest = (details) => {
+    if (!isTopLevelTabRequest(details.tabId, details.type, details.frameId)) {
+      return;
+    }
+    const existingRequestId = redirectRequestIds.get(details.tabId);
+    const startsNewRequest = details.requestId !== void 0 && existingRequestId !== void 0 && details.requestId !== existingRequestId;
+    const chain = startsNewRequest ? [] : redirectChains.get(details.tabId) ?? [];
+    if (details.requestId !== void 0) {
+      redirectRequestIds.set(details.tabId, details.requestId);
+    }
+    chain.push(details.url);
+    redirectChains.set(details.tabId, chain.slice(-20));
+    const initiator = details.initiator ?? details.originUrl;
+    if (initiator !== void 0 && !initiators.has(details.tabId)) {
+      initiators.set(details.tabId, initiator);
+    }
+  };
+  const onCommitted = (details) => {
+    if (details.tabId < 0 || (details.frameId ?? 0) !== 0) {
+      return;
+    }
+    void ingestNavigation(details.tabId, details.url);
+  };
+  const onRemoved = (tabId) => {
+    redirectChains.delete(tabId);
+    redirectRequestIds.delete(tabId);
+    initiators.delete(tabId);
+    tabHosts.delete(tabId);
+  };
+  const onMessage = (message, sender, sendResponse) => {
+    if (!isShouldStandDownMessage(message)) {
+      return void 0;
+    }
+    void handleMessage(message, sender).then(sendResponse, () => {
+      sendResponse({
+        ok: false,
+        decision: failClosedDecision2("message-handler-error")
+      });
+    });
+    return true;
+  };
+  if (mode === "webRequest") {
+    chromeApi?.webRequest?.onBeforeRequest?.addListener(
+      onBeforeRequest,
+      { urls: ["<all_urls>"], types: ["main_frame"] }
+    );
+  }
+  if (hasWebNavigation) {
+    chromeApi?.webNavigation?.onCommitted?.addListener(onCommitted);
+  }
+  chromeApi?.runtime?.onMessage?.addListener(onMessage);
+  chromeApi?.tabs?.onRemoved?.addListener(onRemoved);
+  if (opts.refresh !== void 0) {
+    if (opts.refresh.intervalMs !== 0) {
+      refreshTimer = setInterval(
+        () => {
+          void refreshNow();
+        },
+        opts.refresh.intervalMs ?? DEFAULT_REFRESH_INTERVAL_MS
+      );
+    }
+  }
+  async function ingestNavigation(tabId, url) {
+    const host = hostFromUrl3(url);
+    if (host !== void 0) {
+      tabHosts.set(tabId, host);
+    }
+    const redirectChain = mode === "webRequest" ? redirectChains.get(tabId) : void 0;
+    const initiator = initiators.get(tabId);
+    redirectChains.delete(tabId);
+    redirectRequestIds.delete(tabId);
+    initiators.delete(tabId);
+    const signals = navigationSignals({
+      url,
+      now: now(),
+      redirectChain,
+      initiator,
+      selfPatterns: opts.selfPatterns,
+      publisherSites: opts.publisherSites
+    });
+    return session.ingest(signals, activePolicies);
+  }
+  async function shouldStandDown(tabId, at = now()) {
+    const host = tabHosts.get(tabId) ?? await hostForTab(chromeApi, tabId);
+    if (host === void 0) {
+      return failClosedDecision2("missing-tab-url");
+    }
+    return session.shouldStandDown(host, at);
+  }
+  async function shouldStandDownForUrl(url, at = now()) {
+    const host = hostFromUrl3(url);
+    if (host === void 0) {
+      return failClosedDecision2("invalid-tab-url");
+    }
+    return session.shouldStandDown(host, at);
+  }
+  async function handleMessage(message, sender) {
+    if (!isShouldStandDownMessage(message)) {
+      return void 0;
+    }
+    const senderUrl = sender?.tab?.url ?? sender?.tab?.pendingUrl;
+    const decision = message.url !== void 0 ? await shouldStandDownForUrl(message.url) : senderUrl !== void 0 ? await shouldStandDownForUrl(senderUrl) : await shouldStandDown(message.tabId ?? sender?.tab?.id ?? -1);
+    return { ok: true, decision };
+  }
+  async function refreshNow() {
+    if (opts.refresh === void 0) {
+      return { ok: false, violation: "refresh-not-configured" };
+    }
+    if (fetchImpl === void 0) {
+      const result = { ok: false, violation: "refresh-fetch-unavailable" };
+      await auditRefresh(store, now(), result);
+      return result;
+    }
+    try {
+      const response = await fetchImpl(opts.refresh.url);
+      if (!response.ok) {
+        const result2 = {
+          ok: false,
+          violation: `refresh-fetch-failed:${response.status}`
+        };
+        await auditRefresh(store, now(), result2);
+        return result2;
+      }
+      const bundle = await response.json();
+      const verified = await verifyPolicyBundle(
+        activePolicies,
+        bundle,
+        opts.refresh.publicKeyJwk
+      );
+      if (!verified.ok) {
+        const result2 = { ok: false, violation: verified.violation };
+        await auditRefresh(store, now(), result2);
+        return result2;
+      }
+      activePolicies = verified.policies.map((policy) => clonePolicy2(policy));
+      const result = { ok: true, applied: activePolicies.length };
+      await auditRefresh(store, now(), result);
+      return result;
+    } catch (error) {
+      const result = {
+        ok: false,
+        violation: `refresh-error:${messageFromError3(error)}`
+      };
+      await auditRefresh(store, now(), result);
+      return result;
+    }
+  }
+  function getPolicies() {
+    return activePolicies.map((policy) => clonePolicy2(policy));
+  }
+  function dispose() {
+    if (refreshTimer !== void 0) {
+      clearInterval(refreshTimer);
+    }
+    chromeApi?.webRequest?.onBeforeRequest?.removeListener?.(onBeforeRequest);
+    chromeApi?.webNavigation?.onCommitted?.removeListener?.(onCommitted);
+    chromeApi?.runtime?.onMessage?.removeListener?.(onMessage);
+    chromeApi?.tabs?.onRemoved?.removeListener?.(onRemoved);
+    redirectChains.clear();
+    redirectRequestIds.clear();
+    initiators.clear();
+    tabHosts.clear();
+  }
+  return {
+    mode,
+    session,
+    store,
+    ingestNavigation,
+    shouldStandDown,
+    shouldStandDownForUrl,
+    refreshNow,
+    getPolicies,
+    handleMessage,
+    dispose
+  };
+}
+function createChromeStore(chromeApi, opts) {
+  if (chromeApi?.storage?.local === void 0) {
+    return new UnavailableStateStore();
+  }
+  const storeOptions = { now: opts.now };
+  if (chromeApi.runtime !== void 0) {
+    storeOptions.runtime = chromeApi.runtime;
+  }
+  if (chromeApi.storage.session !== void 0) {
+    storeOptions.sessionStorage = chromeApi.storage.session;
+  }
+  if (opts.sessionId !== void 0) {
+    storeOptions.sessionId = opts.sessionId;
+  }
+  return new ChromeLocalStateStore(chromeApi.storage.local, storeOptions);
+}
+function navigationSignals(value) {
+  const signals = {
+    url: value.url,
+    now: value.now
+  };
+  if (value.redirectChain !== void 0 && value.redirectChain.length > 0) {
+    signals.redirectChain = [...value.redirectChain];
+  }
+  if (value.initiator !== void 0) {
+    signals.initiator = value.initiator;
+  }
+  if (value.selfPatterns !== void 0) {
+    signals.selfPatterns = value.selfPatterns;
+  }
+  if (value.publisherSites !== void 0) {
+    signals.publisherSites = value.publisherSites;
+  }
+  return signals;
+}
+async function hostForTab(chromeApi, tabId) {
+  if (tabId < 0 || chromeApi?.tabs?.get === void 0) {
+    return void 0;
+  }
+  return new Promise((resolve) => {
+    try {
+      const result = chromeApi.tabs?.get?.(tabId, (tab) => {
+        resolve(hostFromUrl3(tab?.url ?? tab?.pendingUrl));
+      });
+      if (isPromiseLike2(result)) {
+        result.then(
+          (tab) => resolve(hostFromUrl3(tab?.url ?? tab?.pendingUrl)),
+          () => resolve(void 0)
+        );
+      }
+    } catch {
+      resolve(void 0);
+    }
+  });
+}
+function isTopLevelTabRequest(tabId, type, frameId) {
+  return tabId >= 0 && (type === void 0 || type === "main_frame") && (frameId ?? 0) === 0;
+}
+function isShouldStandDownMessage(message) {
+  return typeof message === "object" && message !== null && message.type === QUERY_MESSAGE_TYPE;
+}
+function hostFromUrl3(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  try {
+    return new URL(value).hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return void 0;
+  }
+}
+function failClosedDecision2(reason) {
+  return {
+    standDown: true,
+    reason,
+    behaviors: [...FAIL_CLOSED_BEHAVIORS]
+  };
+}
+function currentChrome() {
+  return globalThis.chrome;
+}
+function currentFetch() {
+  const fetchValue = globalThis.fetch;
+  return typeof fetchValue === "function" ? fetchValue : void 0;
+}
+async function auditRefresh(store, time, result) {
+  const state = await store.load() ?? emptyState();
+  const entry = {
+    time,
+    action: "refresh",
+    decision: {
+      standDown: false,
+      reason: result.ok ? `refresh-applied:${result.applied}` : `refresh-rejected:${result.violation}`,
+      behaviors: []
+    }
+  };
+  state.auditLog.push(entry);
+  if (state.auditLog.length > MAX_ADAPTER_AUDIT_ENTRIES) {
+    state.auditLog.splice(0, state.auditLog.length - MAX_ADAPTER_AUDIT_ENTRIES);
+  }
+  await store.save(state);
+}
+function emptyState() {
+  return {
+    sessions: {},
+    auditLog: []
+  };
+}
+function clonePolicy2(policy) {
+  return JSON.parse(JSON.stringify(policy));
+}
+function isPromiseLike2(value) {
+  return typeof value === "object" && value !== null && typeof value.then === "function";
+}
+function messageFromError3(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+var UnavailableStateStore = class {
+  async load() {
+    throw new Error("chrome.storage.local unavailable");
+  }
+  async save() {
+    throw new Error("chrome.storage.local unavailable");
+  }
+};
+
+exports.ChromeLocalStateStore = ChromeLocalStateStore;
+exports.createStanddown = createStanddown;
+//# sourceMappingURL=webext.cjs.map
+//# sourceMappingURL=webext.cjs.map