standdown 0.1.0

package/dist/webext.mjs

@@ -0,0 +1,346 @@
+import { verifyPolicyBundle } from './chunk-25A7QG5Z.mjs';
+import { ChromeLocalStateStore } from './chunk-SEZFAOUU.mjs';
+export { ChromeLocalStateStore } from './chunk-SEZFAOUU.mjs';
+import { StanddownSession } from './chunk-SVN6UWA4.mjs';
+
+// src/webext.ts
+var QUERY_MESSAGE_TYPE = "standdown:shouldStandDown";
+var FAIL_CLOSED_BEHAVIORS = [
+  "suppress-prompts",
+  "no-cookie-write",
+  "no-redirect",
+  "no-background-tracking"
+];
+var DEFAULT_REFRESH_INTERVAL_MS = 60 * 60 * 1e3;
+var MAX_ADAPTER_AUDIT_ENTRIES = 1e3;
+function createStanddown(opts) {
+  const chromeApi = opts.chrome ?? currentChrome();
+  const now = opts.now ?? Date.now;
+  const fetchImpl = opts.fetch ?? currentFetch();
+  let activePolicies = opts.policies.map((policy) => clonePolicy(policy));
+  let refreshTimer;
+  const store = opts.store ?? createChromeStore(chromeApi, {
+    sessionId: opts.sessionId,
+    now
+  });
+  const session = new StanddownSession(
+    store,
+    opts.auditLog === void 0 ? void 0 : { auditLog: opts.auditLog }
+  );
+  const redirectChains = /* @__PURE__ */ new Map();
+  const redirectRequestIds = /* @__PURE__ */ new Map();
+  const initiators = /* @__PURE__ */ new Map();
+  const tabHosts = /* @__PURE__ */ new Map();
+  const hasWebRequest = typeof chromeApi?.webRequest?.onBeforeRequest?.addListener === "function";
+  const hasWebNavigation = typeof chromeApi?.webNavigation?.onCommitted?.addListener === "function";
+  if (!hasWebNavigation) {
+    throw new TypeError(
+      "standdown/webext requires chrome.webNavigation.onCommitted"
+    );
+  }
+  const mode = hasWebRequest ? "webRequest" : "webNavigation";
+  const onBeforeRequest = (details) => {
+    if (!isTopLevelTabRequest(details.tabId, details.type, details.frameId)) {
+      return;
+    }
+    const existingRequestId = redirectRequestIds.get(details.tabId);
+    const startsNewRequest = details.requestId !== void 0 && existingRequestId !== void 0 && details.requestId !== existingRequestId;
+    const chain = startsNewRequest ? [] : redirectChains.get(details.tabId) ?? [];
+    if (details.requestId !== void 0) {
+      redirectRequestIds.set(details.tabId, details.requestId);
+    }
+    chain.push(details.url);
+    redirectChains.set(details.tabId, chain.slice(-20));
+    const initiator = details.initiator ?? details.originUrl;
+    if (initiator !== void 0 && !initiators.has(details.tabId)) {
+      initiators.set(details.tabId, initiator);
+    }
+  };
+  const onCommitted = (details) => {
+    if (details.tabId < 0 || (details.frameId ?? 0) !== 0) {
+      return;
+    }
+    void ingestNavigation(details.tabId, details.url);
+  };
+  const onRemoved = (tabId) => {
+    redirectChains.delete(tabId);
+    redirectRequestIds.delete(tabId);
+    initiators.delete(tabId);
+    tabHosts.delete(tabId);
+  };
+  const onMessage = (message, sender, sendResponse) => {
+    if (!isShouldStandDownMessage(message)) {
+      return void 0;
+    }
+    void handleMessage(message, sender).then(sendResponse, () => {
+      sendResponse({
+        ok: false,
+        decision: failClosedDecision("message-handler-error")
+      });
+    });
+    return true;
+  };
+  if (mode === "webRequest") {
+    chromeApi?.webRequest?.onBeforeRequest?.addListener(
+      onBeforeRequest,
+      { urls: ["<all_urls>"], types: ["main_frame"] }
+    );
+  }
+  if (hasWebNavigation) {
+    chromeApi?.webNavigation?.onCommitted?.addListener(onCommitted);
+  }
+  chromeApi?.runtime?.onMessage?.addListener(onMessage);
+  chromeApi?.tabs?.onRemoved?.addListener(onRemoved);
+  if (opts.refresh !== void 0) {
+    if (opts.refresh.intervalMs !== 0) {
+      refreshTimer = setInterval(
+        () => {
+          void refreshNow();
+        },
+        opts.refresh.intervalMs ?? DEFAULT_REFRESH_INTERVAL_MS
+      );
+    }
+  }
+  async function ingestNavigation(tabId, url) {
+    const host = hostFromUrl(url);
+    if (host !== void 0) {
+      tabHosts.set(tabId, host);
+    }
+    const redirectChain = mode === "webRequest" ? redirectChains.get(tabId) : void 0;
+    const initiator = initiators.get(tabId);
+    redirectChains.delete(tabId);
+    redirectRequestIds.delete(tabId);
+    initiators.delete(tabId);
+    const signals = navigationSignals({
+      url,
+      now: now(),
+      redirectChain,
+      initiator,
+      selfPatterns: opts.selfPatterns,
+      publisherSites: opts.publisherSites
+    });
+    return session.ingest(signals, activePolicies);
+  }
+  async function shouldStandDown(tabId, at = now()) {
+    const host = tabHosts.get(tabId) ?? await hostForTab(chromeApi, tabId);
+    if (host === void 0) {
+      return failClosedDecision("missing-tab-url");
+    }
+    return session.shouldStandDown(host, at);
+  }
+  async function shouldStandDownForUrl(url, at = now()) {
+    const host = hostFromUrl(url);
+    if (host === void 0) {
+      return failClosedDecision("invalid-tab-url");
+    }
+    return session.shouldStandDown(host, at);
+  }
+  async function handleMessage(message, sender) {
+    if (!isShouldStandDownMessage(message)) {
+      return void 0;
+    }
+    const senderUrl = sender?.tab?.url ?? sender?.tab?.pendingUrl;
+    const decision = message.url !== void 0 ? await shouldStandDownForUrl(message.url) : senderUrl !== void 0 ? await shouldStandDownForUrl(senderUrl) : await shouldStandDown(message.tabId ?? sender?.tab?.id ?? -1);
+    return { ok: true, decision };
+  }
+  async function refreshNow() {
+    if (opts.refresh === void 0) {
+      return { ok: false, violation: "refresh-not-configured" };
+    }
+    if (fetchImpl === void 0) {
+      const result = { ok: false, violation: "refresh-fetch-unavailable" };
+      await auditRefresh(store, now(), result);
+      return result;
+    }
+    try {
+      const response = await fetchImpl(opts.refresh.url);
+      if (!response.ok) {
+        const result2 = {
+          ok: false,
+          violation: `refresh-fetch-failed:${response.status}`
+        };
+        await auditRefresh(store, now(), result2);
+        return result2;
+      }
+      const bundle = await response.json();
+      const verified = await verifyPolicyBundle(
+        activePolicies,
+        bundle,
+        opts.refresh.publicKeyJwk
+      );
+      if (!verified.ok) {
+        const result2 = { ok: false, violation: verified.violation };
+        await auditRefresh(store, now(), result2);
+        return result2;
+      }
+      activePolicies = verified.policies.map((policy) => clonePolicy(policy));
+      const result = { ok: true, applied: activePolicies.length };
+      await auditRefresh(store, now(), result);
+      return result;
+    } catch (error) {
+      const result = {
+        ok: false,
+        violation: `refresh-error:${messageFromError(error)}`
+      };
+      await auditRefresh(store, now(), result);
+      return result;
+    }
+  }
+  function getPolicies() {
+    return activePolicies.map((policy) => clonePolicy(policy));
+  }
+  function dispose() {
+    if (refreshTimer !== void 0) {
+      clearInterval(refreshTimer);
+    }
+    chromeApi?.webRequest?.onBeforeRequest?.removeListener?.(onBeforeRequest);
+    chromeApi?.webNavigation?.onCommitted?.removeListener?.(onCommitted);
+    chromeApi?.runtime?.onMessage?.removeListener?.(onMessage);
+    chromeApi?.tabs?.onRemoved?.removeListener?.(onRemoved);
+    redirectChains.clear();
+    redirectRequestIds.clear();
+    initiators.clear();
+    tabHosts.clear();
+  }
+  return {
+    mode,
+    session,
+    store,
+    ingestNavigation,
+    shouldStandDown,
+    shouldStandDownForUrl,
+    refreshNow,
+    getPolicies,
+    handleMessage,
+    dispose
+  };
+}
+function createChromeStore(chromeApi, opts) {
+  if (chromeApi?.storage?.local === void 0) {
+    return new UnavailableStateStore();
+  }
+  const storeOptions = { now: opts.now };
+  if (chromeApi.runtime !== void 0) {
+    storeOptions.runtime = chromeApi.runtime;
+  }
+  if (chromeApi.storage.session !== void 0) {
+    storeOptions.sessionStorage = chromeApi.storage.session;
+  }
+  if (opts.sessionId !== void 0) {
+    storeOptions.sessionId = opts.sessionId;
+  }
+  return new ChromeLocalStateStore(chromeApi.storage.local, storeOptions);
+}
+function navigationSignals(value) {
+  const signals = {
+    url: value.url,
+    now: value.now
+  };
+  if (value.redirectChain !== void 0 && value.redirectChain.length > 0) {
+    signals.redirectChain = [...value.redirectChain];
+  }
+  if (value.initiator !== void 0) {
+    signals.initiator = value.initiator;
+  }
+  if (value.selfPatterns !== void 0) {
+    signals.selfPatterns = value.selfPatterns;
+  }
+  if (value.publisherSites !== void 0) {
+    signals.publisherSites = value.publisherSites;
+  }
+  return signals;
+}
+async function hostForTab(chromeApi, tabId) {
+  if (tabId < 0 || chromeApi?.tabs?.get === void 0) {
+    return void 0;
+  }
+  return new Promise((resolve) => {
+    try {
+      const result = chromeApi.tabs?.get?.(tabId, (tab) => {
+        resolve(hostFromUrl(tab?.url ?? tab?.pendingUrl));
+      });
+      if (isPromiseLike(result)) {
+        result.then(
+          (tab) => resolve(hostFromUrl(tab?.url ?? tab?.pendingUrl)),
+          () => resolve(void 0)
+        );
+      }
+    } catch {
+      resolve(void 0);
+    }
+  });
+}
+function isTopLevelTabRequest(tabId, type, frameId) {
+  return tabId >= 0 && (type === void 0 || type === "main_frame") && (frameId ?? 0) === 0;
+}
+function isShouldStandDownMessage(message) {
+  return typeof message === "object" && message !== null && message.type === QUERY_MESSAGE_TYPE;
+}
+function hostFromUrl(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  try {
+    return new URL(value).hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return void 0;
+  }
+}
+function failClosedDecision(reason) {
+  return {
+    standDown: true,
+    reason,
+    behaviors: [...FAIL_CLOSED_BEHAVIORS]
+  };
+}
+function currentChrome() {
+  return globalThis.chrome;
+}
+function currentFetch() {
+  const fetchValue = globalThis.fetch;
+  return typeof fetchValue === "function" ? fetchValue : void 0;
+}
+async function auditRefresh(store, time, result) {
+  const state = await store.load() ?? emptyState();
+  const entry = {
+    time,
+    action: "refresh",
+    decision: {
+      standDown: false,
+      reason: result.ok ? `refresh-applied:${result.applied}` : `refresh-rejected:${result.violation}`,
+      behaviors: []
+    }
+  };
+  state.auditLog.push(entry);
+  if (state.auditLog.length > MAX_ADAPTER_AUDIT_ENTRIES) {
+    state.auditLog.splice(0, state.auditLog.length - MAX_ADAPTER_AUDIT_ENTRIES);
+  }
+  await store.save(state);
+}
+function emptyState() {
+  return {
+    sessions: {},
+    auditLog: []
+  };
+}
+function clonePolicy(policy) {
+  return JSON.parse(JSON.stringify(policy));
+}
+function isPromiseLike(value) {
+  return typeof value === "object" && value !== null && typeof value.then === "function";
+}
+function messageFromError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+var UnavailableStateStore = class {
+  async load() {
+    throw new Error("chrome.storage.local unavailable");
+  }
+  async save() {
+    throw new Error("chrome.storage.local unavailable");
+  }
+};
+
+export { createStanddown };
+//# sourceMappingURL=webext.mjs.map
+//# sourceMappingURL=webext.mjs.map

package/dist/webext.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/webext.ts"],"names":["result"],"mappings":";;;;;;AAyBA,IAAM,kBAAA,GAAqB,2BAAA;AAC3B,IAAM,qBAAA,GAAwB;AAAA,EAC5B,kBAAA;AAAA,EACA,iBAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;AACA,IAAM,2BAAA,GAA8B,KAAK,EAAA,GAAK,GAAA;AAC9C,IAAM,yBAAA,GAA4B,GAAA;AA8H3B,SAAS,gBACd,IAAA,EAC2B;AAC3B,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,IAAU,aAAA,EAAc;AAC/C,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,GAAA;AAC7B,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,IAAS,YAAA,EAAa;AAC7C,EAAA,IAAI,cAAA,GAAiB,KAAK,QAAA,CAAS,GAAA,CAAI,CAAC,MAAA,KAAW,WAAA,CAAY,MAAM,CAAC,CAAA;AACtE,EAAA,IAAI,YAAA;AAEJ,EAAA,MAAM,KAAA,GACJ,IAAA,CAAK,KAAA,IACL,iBAAA,CAAkB,SAAA,EAAW;AAAA,IAC3B,WAAW,IAAA,CAAK,SAAA;AAAA,IAChB;AAAA,GACD,CAAA;AACH,EAAA,MAAM,UAAU,IAAI,gBAAA;AAAA,IAClB,KAAA;AAAA,IACA,KAAK,QAAA,KAAa,MAAA,GAAY,SAAY,EAAE,QAAA,EAAU,KAAK,QAAA;AAAS,GACtE;AACA,EAAA,MAAM,cAAA,uBAAqB,GAAA,EAAsB;AACjD,EAAA,MAAM,kBAAA,uBAAyB,GAAA,EAAoB;AACnD,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAoB;AAC3C,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAoB;AACzC,EAAA,MAAM,aAAA,GACJ,OAAO,SAAA,EAAW,UAAA,EAAY,iBAAiB,WAAA,KAAgB,UAAA;AACjE,EAAA,MAAM,gBAAA,GACJ,OAAO,SAAA,EAAW,aAAA,EAAe,aAAa,WAAA,KAAgB,UAAA;AAEhE,EAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,IAAA,MAAM,IAAI,SAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,IAAA,GAA4B,gBAAgB,YAAA,GAAe,eAAA;AAEjE,EAAA,MAAM,eAAA,GAA4C,CAAC,OAAA,KAAY;AAC7D,IAAA,IAAI,CAAC,qBAAqB,OAAA,CAAQ,KAAA,EAAO,QAAQ,IAAA,EAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AACvE,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,iBAAA,GAAoB,kBAAA,CAAmB,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA;AAC9D,IAAA,MAAM,mBACJ,OAAA,CAAQ,SAAA,KAAc,UACtB,iBAAA,KAAsB,MAAA,IACtB,QAAQ,SAAA,KAAc,iBAAA;AACxB,IAAA,MAAM,KAAA,GAAQ,mBACV,EAAC,GACD,eAAe,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA,IAAK,EAAC;AAE1C,IAAA,IAAI,OAAA,CAAQ,cAAc,MAAA,EAAW;AACnC,MAAA,kBAAA,CAAmB,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,OAAA,CAAQ,SAAS,CAAA;AAAA,IACzD;AAEA,IAAA,KAAA,CAAM,IAAA,CAAK,QAAQ,GAAG,CAAA;AACtB,IAAA,cAAA,CAAe,IAAI,OAAA,CAAQ,KAAA,EAAO,KAAA,CAAM,KAAA,CAAM,GAAG,CAAC,CAAA;AAElD,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,OAAA,CAAQ,SAAA;AAE/C,IAAA,IAAI,cAAc,MAAA,IAAa,CAAC,WAAW,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC7D,MAAA,UAAA,CAAW,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,SAAS,CAAA;AAAA,IACzC;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,WAAA,GAA8C,CAAC,OAAA,KAAY;AAC/D,IAAA,IAAI,QAAQ,KAAA,GAAQ,CAAA,IAAA,CAAM,OAAA,CAAQ,OAAA,IAAW,OAAO,CAAA,EAAG;AACrD,MAAA;AAAA,IACF;AAEA,IAAA,KAAK,gBAAA,CAAiB,OAAA,CAAQ,KAAA,EAAO,OAAA,CAAQ,GAAG,CAAA;AAAA,EAClD,CAAA;AAEA,EAAA,MAAM,SAAA,GAAgC,CAAC,KAAA,KAAU;AAC/C,IAAA,cAAA,CAAe,OAAO,KAAK,CAAA;AAC3B,IAAA,kBAAA,CAAmB,OAAO,KAAK,CAAA;AAC/B,IAAA,UAAA,CAAW,OAAO,KAAK,CAAA;AACvB,IAAA,QAAA,CAAS,OAAO,KAAK,CAAA;AAAA,EACvB,CAAA;AAEA,EAAA,MAAM,SAAA,GAAoC,CAAC,OAAA,EAAS,MAAA,EAAQ,YAAA,KAAiB;AAC3E,IAAA,IAAI,CAAC,wBAAA,CAAyB,OAAO,CAAA,EAAG;AACtC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,KAAK,cAAc,OAAA,EAAS,MAAM,CAAA,CAAE,IAAA,CAAK,cAAc,MAAM;AAC3D,MAAA,YAAA,CAAa;AAAA,QACX,EAAA,EAAI,KAAA;AAAA,QACJ,QAAA,EAAU,mBAAmB,uBAAuB;AAAA,OACrD,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAEA,EAAA,IAAI,SAAS,YAAA,EAAc;AACzB,IAAA,SAAA,EAAW,YAAY,eAAA,EAAiB,WAAA;AAAA,MACtC,eAAA;AAAA,MACA,EAAE,MAAM,CAAC,YAAY,GAAG,KAAA,EAAO,CAAC,YAAY,CAAA;AAAE,KAChD;AAAA,EACF;AAEA,EAAA,IAAI,gBAAA,EAAkB;AACpB,IAAA,SAAA,EAAW,aAAA,EAAe,WAAA,EAAa,WAAA,CAAY,WAAW,CAAA;AAAA,EAChE;AAEA,EAAA,SAAA,EAAW,OAAA,EAAS,SAAA,EAAW,WAAA,CAAY,SAAS,CAAA;AACpD,EAAA,SAAA,EAAW,IAAA,EAAM,SAAA,EAAW,WAAA,CAAY,SAAS,CAAA;AAEjD,EAAA,IAAI,IAAA,CAAK,YAAY,MAAA,EAAW;AAC9B,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,UAAA,KAAe,CAAA,EAAG;AACjC,MAAA,YAAA,GAAe,WAAA;AAAA,QACb,MAAM;AACJ,UAAA,KAAK,UAAA,EAAW;AAAA,QAClB,CAAA;AAAA,QACA,IAAA,CAAK,QAAQ,UAAA,IAAc;AAAA,OAC7B;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,gBAAA,CACb,OACA,GAAA,EACmB;AACnB,IAAA,MAAM,IAAA,GAAO,YAAY,GAAG,CAAA;AAE5B,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,QAAA,CAAS,GAAA,CAAI,OAAO,IAAI,CAAA;AAAA,IAC1B;AAEA,IAAA,MAAM,gBAAgB,IAAA,KAAS,YAAA,GAAe,cAAA,CAAe,GAAA,CAAI,KAAK,CAAA,GAAI,MAAA;AAC1E,IAAA,MAAM,SAAA,GAAY,UAAA,CAAW,GAAA,CAAI,KAAK,CAAA;AAEtC,IAAA,cAAA,CAAe,OAAO,KAAK,CAAA;AAC3B,IAAA,kBAAA,CAAmB,OAAO,KAAK,CAAA;AAC/B,IAAA,UAAA,CAAW,OAAO,KAAK,CAAA;AAEvB,IAAA,MAAM,UAAU,iBAAA,CAAkB;AAAA,MAChC,GAAA;AAAA,MACA,KAAK,GAAA,EAAI;AAAA,MACT,aAAA;AAAA,MACA,SAAA;AAAA,MACA,cAAc,IAAA,CAAK,YAAA;AAAA,MACnB,gBAAgB,IAAA,CAAK;AAAA,KACtB,CAAA;AAED,IAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,OAAA,EAAS,cAAc,CAAA;AAAA,EAC/C;AAEA,EAAA,eAAe,eAAA,CACb,KAAA,EACA,EAAA,GAAK,GAAA,EAAI,EACU;AACnB,IAAA,MAAM,IAAA,GAAO,SAAS,GAAA,CAAI,KAAK,KAAM,MAAM,UAAA,CAAW,WAAW,KAAK,CAAA;AAEtE,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAO,mBAAmB,iBAAiB,CAAA;AAAA,IAC7C;AAEA,IAAA,OAAO,OAAA,CAAQ,eAAA,CAAgB,IAAA,EAAM,EAAE,CAAA;AAAA,EACzC;AAEA,EAAA,eAAe,qBAAA,CACb,GAAA,EACA,EAAA,GAAK,GAAA,EAAI,EACU;AACnB,IAAA,MAAM,IAAA,GAAO,YAAY,GAAG,CAAA;AAE5B,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAO,mBAAmB,iBAAiB,CAAA;AAAA,IAC7C;AAEA,IAAA,OAAO,OAAA,CAAQ,eAAA,CAAgB,IAAA,EAAM,EAAE,CAAA;AAAA,EACzC;AAEA,EAAA,eAAe,aAAA,CACb,SACA,MAAA,EAC+C;AAC/C,IAAA,IAAI,CAAC,wBAAA,CAAyB,OAAO,CAAA,EAAG;AACtC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,SAAA,GAAY,MAAA,EAAQ,GAAA,EAAK,GAAA,IAAO,QAAQ,GAAA,EAAK,UAAA;AACnD,IAAA,MAAM,QAAA,GACJ,QAAQ,GAAA,KAAQ,MAAA,GACZ,MAAM,qBAAA,CAAsB,OAAA,CAAQ,GAAG,CAAA,GACvC,SAAA,KAAc,MAAA,GACZ,MAAM,qBAAA,CAAsB,SAAS,IACrC,MAAM,eAAA,CAAgB,QAAQ,KAAA,IAAS,MAAA,EAAQ,GAAA,EAAK,EAAA,IAAM,EAAE,CAAA;AAEpE,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,QAAA,EAAS;AAAA,EAC9B;AAEA,EAAA,eAAe,UAAA,GAA8C;AAC3D,IAAA,IAAI,IAAA,CAAK,YAAY,MAAA,EAAW;AAC9B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,SAAA,EAAW,wBAAA,EAAyB;AAAA,IAC1D;AAEA,IAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,MAAA,MAAM,MAAA,GAAS,EAAE,EAAA,EAAI,KAAA,EAAO,WAAW,2BAAA,EAA4B;AACnE,MAAA,MAAM,YAAA,CAAa,KAAA,EAAO,GAAA,EAAI,EAAG,MAAM,CAAA;AACvC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,IAAA,CAAK,QAAQ,GAAG,CAAA;AAEjD,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAMA,OAAAA,GAAS;AAAA,UACb,EAAA,EAAI,KAAA;AAAA,UACJ,SAAA,EAAW,CAAA,qBAAA,EAAwB,QAAA,CAAS,MAAM,CAAA;AAAA,SACpD;AACA,QAAA,MAAM,YAAA,CAAa,KAAA,EAAO,GAAA,EAAI,EAAGA,OAAM,CAAA;AACvC,QAAA,OAAOA,OAAAA;AAAA,MACT;AAEA,MAAA,MAAM,MAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AACpC,MAAA,MAAM,WAAW,MAAM,kBAAA;AAAA,QACrB,cAAA;AAAA,QACA,MAAA;AAAA,QACA,KAAK,OAAA,CAAQ;AAAA,OACf;AAEA,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAMA,UAAS,EAAE,EAAA,EAAI,KAAA,EAAO,SAAA,EAAW,SAAS,SAAA,EAAU;AAC1D,QAAA,MAAM,YAAA,CAAa,KAAA,EAAO,GAAA,EAAI,EAAGA,OAAM,CAAA;AACvC,QAAA,OAAOA,OAAAA;AAAA,MACT;AAEA,MAAA,cAAA,GAAiB,SAAS,QAAA,CAAS,GAAA,CAAI,CAAC,MAAA,KAAW,WAAA,CAAY,MAAM,CAAC,CAAA;AACtE,MAAA,MAAM,SAAS,EAAE,EAAA,EAAI,IAAA,EAAM,OAAA,EAAS,eAAe,MAAA,EAAO;AAC1D,MAAA,MAAM,YAAA,CAAa,KAAA,EAAO,GAAA,EAAI,EAAG,MAAM,CAAA;AACvC,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,MAAA,GAAS;AAAA,QACb,EAAA,EAAI,KAAA;AAAA,QACJ,SAAA,EAAW,CAAA,cAAA,EAAiB,gBAAA,CAAiB,KAAK,CAAC,CAAA;AAAA,OACrD;AACA,MAAA,MAAM,YAAA,CAAa,KAAA,EAAO,GAAA,EAAI,EAAG,MAAM,CAAA;AACvC,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,SAAS,WAAA,GAA0C;AACjD,IAAA,OAAO,eAAe,GAAA,CAAI,CAAC,MAAA,KAAW,WAAA,CAAY,MAAM,CAAC,CAAA;AAAA,EAC3D;AAEA,EAAA,SAAS,OAAA,GAAgB;AACvB,IAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,MAAA,aAAA,CAAc,YAAY,CAAA;AAAA,IAC5B;AAEA,IAAA,SAAA,EAAW,UAAA,EAAY,eAAA,EAAiB,cAAA,GAAiB,eAAe,CAAA;AACxE,IAAA,SAAA,EAAW,aAAA,EAAe,WAAA,EAAa,cAAA,GAAiB,WAAW,CAAA;AACnE,IAAA,SAAA,EAAW,OAAA,EAAS,SAAA,EAAW,cAAA,GAAiB,SAAS,CAAA;AACzD,IAAA,SAAA,EAAW,IAAA,EAAM,SAAA,EAAW,cAAA,GAAiB,SAAS,CAAA;AACtD,IAAA,cAAA,CAAe,KAAA,EAAM;AACrB,IAAA,kBAAA,CAAmB,KAAA,EAAM;AACzB,IAAA,UAAA,CAAW,KAAA,EAAM;AACjB,IAAA,QAAA,CAAS,KAAA,EAAM;AAAA,EACjB;AAEA,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,qBAAA;AAAA,IACA,UAAA;AAAA,IACA,WAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,iBAAA,CACP,WACA,IAAA,EACY;AACZ,EAAA,IAAI,SAAA,EAAW,OAAA,EAAS,KAAA,KAAU,MAAA,EAAW;AAC3C,IAAA,OAAO,IAAI,qBAAA,EAAsB;AAAA,EACnC;AAEA,EAAA,MAAM,YAAA,GAKF,EAAE,GAAA,EAAK,IAAA,CAAK,GAAA,EAAI;AAEpB,EAAA,IAAI,SAAA,CAAU,YAAY,MAAA,EAAW;AACnC,IAAA,YAAA,CAAa,UAAU,SAAA,CAAU,OAAA;AAAA,EACnC;AAEA,EAAA,IAAI,SAAA,CAAU,OAAA,CAAQ,OAAA,KAAY,MAAA,EAAW;AAC3C,IAAA,YAAA,CAAa,cAAA,GAAiB,UAAU,OAAA,CAAQ,OAAA;AAAA,EAClD;AAEA,EAAA,IAAI,IAAA,CAAK,cAAc,MAAA,EAAW;AAChC,IAAA,YAAA,CAAa,YAAY,IAAA,CAAK,SAAA;AAAA,EAChC;AAEA,EAAA,OAAO,IAAI,qBAAA,CAAsB,SAAA,CAAU,OAAA,CAAQ,OAAO,YAAY,CAAA;AACxE;AAEA,SAAS,kBAAkB,KAAA,EAOf;AACV,EAAA,MAAM,OAAA,GAAmB;AAAA,IACvB,KAAK,KAAA,CAAM,GAAA;AAAA,IACX,KAAK,KAAA,CAAM;AAAA,GACb;AAEA,EAAA,IAAI,MAAM,aAAA,KAAkB,MAAA,IAAa,KAAA,CAAM,aAAA,CAAc,SAAS,CAAA,EAAG;AACvE,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAC,GAAG,KAAA,CAAM,aAAa,CAAA;AAAA,EACjD;AAEA,EAAA,IAAI,KAAA,CAAM,cAAc,MAAA,EAAW;AACjC,IAAA,OAAA,CAAQ,YAAY,KAAA,CAAM,SAAA;AAAA,EAC5B;AAEA,EAAA,IAAI,KAAA,CAAM,iBAAiB,MAAA,EAAW;AACpC,IAAA,OAAA,CAAQ,eAAe,KAAA,CAAM,YAAA;AAAA,EAC/B;AAEA,EAAA,IAAI,KAAA,CAAM,mBAAmB,MAAA,EAAW;AACtC,IAAA,OAAA,CAAQ,iBAAiB,KAAA,CAAM,cAAA;AAAA,EACjC;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,UAAA,CACb,WACA,KAAA,EAC6B;AAC7B,EAAA,IAAI,KAAA,GAAQ,CAAA,IAAK,SAAA,EAAW,IAAA,EAAM,QAAQ,MAAA,EAAW;AACnD,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,SAAA,CAAU,IAAA,EAAM,GAAA,GAAM,KAAA,EAAO,CAAC,GAAA,KAAQ;AACnD,QAAA,OAAA,CAAQ,WAAA,CAAY,GAAA,EAAK,GAAA,IAAO,GAAA,EAAK,UAAU,CAAC,CAAA;AAAA,MAClD,CAAC,CAAA;AAED,MAAA,IAAI,aAAA,CAAc,MAAM,CAAA,EAAG;AACzB,QAAA,MAAA,CAAO,IAAA;AAAA,UACL,CAAC,QAAQ,OAAA,CAAQ,WAAA,CAAY,KAAK,GAAA,IAAO,GAAA,EAAK,UAAU,CAAC,CAAA;AAAA,UACzD,MAAM,QAAQ,KAAA,CAAS;AAAA,SACzB;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAA,CAAQ,MAAS,CAAA;AAAA,IACnB;AAAA,EACF,CAAC,CAAA;AACH;AAEA,SAAS,oBAAA,CACP,KAAA,EACA,IAAA,EACA,OAAA,EACS;AACT,EAAA,OAAO,SAAS,CAAA,KAAM,IAAA,KAAS,UAAa,IAAA,KAAS,YAAA,CAAA,IAAA,CAAkB,WAAW,CAAA,MAAO,CAAA;AAC3F;AAEA,SAAS,yBACP,OAAA,EAC4C;AAC5C,EAAA,OACE,OAAO,OAAA,KAAY,QAAA,IACnB,OAAA,KAAY,IAAA,IACX,QAA+B,IAAA,KAAS,kBAAA;AAE7C;AAEA,SAAS,YAAY,KAAA,EAA+C;AAClE,EAAA,IAAI,UAAU,MAAA,EAAW;AACvB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,IAAI,KAAK,CAAA,CAAE,SAAS,WAAA,EAAY,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,MAAA,EAA0B;AACpD,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,IAAA;AAAA,IACX,MAAA;AAAA,IACA,SAAA,EAAW,CAAC,GAAG,qBAAqB;AAAA,GACtC;AACF;AAEA,SAAS,aAAA,GAAwC;AAC/C,EAAA,OAAQ,UAAA,CAA2D,MAAA;AACrE;AAEA,SAAS,YAAA,GAAsC;AAC7C,EAAA,MAAM,aAAc,UAAA,CACjB,KAAA;AAEH,EAAA,OAAO,OAAO,UAAA,KAAe,UAAA,GAAa,UAAA,GAAa,MAAA;AACzD;AAEA,eAAe,YAAA,CACb,KAAA,EACA,IAAA,EACA,MAAA,EACe;AACf,EAAA,MAAM,KAAA,GAAS,MAAM,KAAA,CAAM,IAAA,MAAW,UAAA,EAAW;AACjD,EAAA,MAAM,KAAA,GAAoB;AAAA,IACxB,IAAA;AAAA,IACA,MAAA,EAAQ,SAAA;AAAA,IACR,QAAA,EAAU;AAAA,MACR,SAAA,EAAW,KAAA;AAAA,MACX,MAAA,EAAQ,OAAO,EAAA,GACX,CAAA,gBAAA,EAAmB,OAAO,OAAO,CAAA,CAAA,GACjC,CAAA,iBAAA,EAAoB,MAAA,CAAO,SAAS,CAAA,CAAA;AAAA,MACxC,WAAW;AAAC;AACd,GACF;AAEA,EAAA,KAAA,CAAM,QAAA,CAAS,KAAK,KAAK,CAAA;AAEzB,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,MAAA,GAAS,yBAAA,EAA2B;AACrD,IAAA,KAAA,CAAM,SAAS,MAAA,CAAO,CAAA,EAAG,KAAA,CAAM,QAAA,CAAS,SAAS,yBAAyB,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,KAAA,CAAM,KAAK,KAAK,CAAA;AACxB;AAEA,SAAS,UAAA,GAA6B;AACpC,EAAA,OAAO;AAAA,IACL,UAAU,EAAC;AAAA,IACX,UAAU;AAAC,GACb;AACF;AAEA,SAAS,YAAY,MAAA,EAA0C;AAC7D,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAC1C;AAEA,SAAS,cAAiB,KAAA,EAAqC;AAC7D,EAAA,OACE,OAAO,KAAA,KAAU,QAAA,IACjB,UAAU,IAAA,IACV,OAAQ,MAA6B,IAAA,KAAS,UAAA;AAElD;AAEA,SAAS,iBAAiB,KAAA,EAAwB;AAChD,EAAA,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAC9D;AAEA,IAAM,wBAAN,MAAkD;AAAA,EAChD,MAAM,IAAA,GAAuB;AAC3B,IAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,EACpD;AAAA,EAEA,MAAM,IAAA,GAAuB;AAC3B,IAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,EACpD;AACF,CAAA","file":"webext.mjs","sourcesContent":["import { verifyPolicyBundle } from './bundle';\nimport { StanddownSession } from './session';\nimport {\n  ChromeLocalStateStore,\n  type ChromeRuntimeLike,\n  type ChromeStorageAreaLike,\n} from './stores';\nimport type {\n  AuditEntry,\n  Behavior,\n  Decision,\n  SelfExemption,\n  Signals,\n  SignedPolicyBundle,\n  StanddownPolicy,\n  StanddownState,\n  StateStore,\n} from './types';\n\nexport {\n  ChromeLocalStateStore,\n  type ChromeRuntimeLike,\n  type ChromeStorageAreaLike,\n} from './stores';\n\nconst QUERY_MESSAGE_TYPE = 'standdown:shouldStandDown';\nconst FAIL_CLOSED_BEHAVIORS = [\n  'suppress-prompts',\n  'no-cookie-write',\n  'no-redirect',\n  'no-background-tracking',\n] as const satisfies readonly Behavior[];\nconst DEFAULT_REFRESH_INTERVAL_MS = 60 * 60 * 1_000;\nconst MAX_ADAPTER_AUDIT_ENTRIES = 1_000;\n\nexport type StanddownWebextMode = 'webRequest' | 'webNavigation';\n\nexport interface StanddownRefreshConfig {\n  readonly url: string;\n  readonly publicKeyJwk: JsonWebKey;\n  /** Set to 0 to disable the periodic timer while keeping refreshNow(). */\n  readonly intervalMs?: number;\n}\n\nexport interface CreateStanddownOptions {\n  readonly policies: readonly StanddownPolicy[];\n  readonly selfPatterns?: readonly SelfExemption[];\n  readonly publisherSites?: readonly string[];\n  readonly refresh?: StanddownRefreshConfig;\n  readonly fetch?: FetchLike;\n  readonly chrome?: ChromeLike;\n  readonly store?: StateStore;\n  readonly sessionId?: string;\n  readonly now?: () => number;\n  readonly auditLog?: boolean;\n}\n\nexport interface StanddownWebextController {\n  readonly mode: StanddownWebextMode;\n  readonly session: StanddownSession;\n  readonly store: StateStore;\n  ingestNavigation(tabId: number, url: string): Promise<Decision>;\n  shouldStandDown(tabId: number, now?: number): Promise<Decision>;\n  shouldStandDownForUrl(url: string, now?: number): Promise<Decision>;\n  refreshNow(): Promise<StanddownRefreshResult>;\n  getPolicies(): readonly StanddownPolicy[];\n  handleMessage(\n    message: unknown,\n    sender?: RuntimeMessageSenderLike,\n  ): Promise<StanddownMessageResponse | undefined>;\n  dispose(): void;\n}\n\nexport interface StanddownShouldStandDownMessage {\n  readonly type: typeof QUERY_MESSAGE_TYPE;\n  readonly tabId?: number;\n  readonly url?: string;\n}\n\nexport interface StanddownMessageResponse {\n  readonly ok: boolean;\n  readonly decision: Decision;\n}\n\nexport type StanddownRefreshResult =\n  | { ok: true; applied: number }\n  | { ok: false; violation: string };\n\nexport type FetchLike = (url: string) => Promise<{\n  ok: boolean;\n  status: number;\n  json(): Promise<unknown>;\n}>;\n\nexport interface ChromeLike {\n  readonly webRequest?: {\n    readonly onBeforeRequest?: ChromeEventLike<WebRequestBeforeListener>;\n  };\n  readonly webNavigation?: {\n    readonly onCommitted?: ChromeEventLike<WebNavigationCommittedListener>;\n  };\n  readonly runtime?: ChromeRuntimeLike & {\n    readonly onMessage?: ChromeEventLike<RuntimeMessageListener>;\n  };\n  readonly storage?: {\n    readonly local?: ChromeStorageAreaLike;\n    readonly session?: ChromeStorageAreaLike;\n  };\n  readonly tabs?: {\n    get?(\n      tabId: number,\n      callback?: (tab: TabLike | undefined) => void,\n    ): undefined | Promise<TabLike | undefined>;\n    readonly onRemoved?: ChromeEventLike<TabRemovedListener>;\n  };\n}\n\nexport interface ChromeEventLike<TListener> {\n  addListener(listener: TListener, ...args: unknown[]): void;\n  removeListener?(listener: TListener): void;\n}\n\nexport interface WebRequestBeforeDetails {\n  readonly tabId: number;\n  readonly requestId?: string;\n  readonly url: string;\n  readonly type?: string;\n  readonly frameId?: number;\n  readonly initiator?: string;\n  readonly originUrl?: string;\n}\n\nexport interface WebNavigationCommittedDetails {\n  readonly tabId: number;\n  readonly url: string;\n  readonly frameId?: number;\n}\n\nexport interface RuntimeMessageSenderLike {\n  readonly tab?: TabLike;\n}\n\nexport interface TabLike {\n  readonly id?: number;\n  readonly url?: string;\n  readonly pendingUrl?: string;\n}\n\ntype WebRequestBeforeListener = (details: WebRequestBeforeDetails) => void;\ntype WebNavigationCommittedListener = (\n  details: WebNavigationCommittedDetails,\n) => void;\ntype TabRemovedListener = (tabId: number) => void;\ntype RuntimeMessageListener = (\n  message: unknown,\n  sender: RuntimeMessageSenderLike,\n  sendResponse: (response: StanddownMessageResponse | undefined) => void,\n) => boolean | undefined;\n\nexport function createStanddown(\n  opts: CreateStanddownOptions,\n): StanddownWebextController {\n  const chromeApi = opts.chrome ?? currentChrome();\n  const now = opts.now ?? Date.now;\n  const fetchImpl = opts.fetch ?? currentFetch();\n  let activePolicies = opts.policies.map((policy) => clonePolicy(policy));\n  let refreshTimer: ReturnType<typeof setInterval> | undefined;\n\n  const store =\n    opts.store ??\n    createChromeStore(chromeApi, {\n      sessionId: opts.sessionId,\n      now,\n    });\n  const session = new StanddownSession(\n    store,\n    opts.auditLog === undefined ? undefined : { auditLog: opts.auditLog },\n  );\n  const redirectChains = new Map<number, string[]>();\n  const redirectRequestIds = new Map<number, string>();\n  const initiators = new Map<number, string>();\n  const tabHosts = new Map<number, string>();\n  const hasWebRequest =\n    typeof chromeApi?.webRequest?.onBeforeRequest?.addListener === 'function';\n  const hasWebNavigation =\n    typeof chromeApi?.webNavigation?.onCommitted?.addListener === 'function';\n\n  if (!hasWebNavigation) {\n    throw new TypeError(\n      'standdown/webext requires chrome.webNavigation.onCommitted',\n    );\n  }\n\n  const mode: StanddownWebextMode = hasWebRequest ? 'webRequest' : 'webNavigation';\n\n  const onBeforeRequest: WebRequestBeforeListener = (details) => {\n    if (!isTopLevelTabRequest(details.tabId, details.type, details.frameId)) {\n      return;\n    }\n\n    const existingRequestId = redirectRequestIds.get(details.tabId);\n    const startsNewRequest =\n      details.requestId !== undefined &&\n      existingRequestId !== undefined &&\n      details.requestId !== existingRequestId;\n    const chain = startsNewRequest\n      ? []\n      : redirectChains.get(details.tabId) ?? [];\n\n    if (details.requestId !== undefined) {\n      redirectRequestIds.set(details.tabId, details.requestId);\n    }\n\n    chain.push(details.url);\n    redirectChains.set(details.tabId, chain.slice(-20));\n\n    const initiator = details.initiator ?? details.originUrl;\n\n    if (initiator !== undefined && !initiators.has(details.tabId)) {\n      initiators.set(details.tabId, initiator);\n    }\n  };\n\n  const onCommitted: WebNavigationCommittedListener = (details) => {\n    if (details.tabId < 0 || (details.frameId ?? 0) !== 0) {\n      return;\n    }\n\n    void ingestNavigation(details.tabId, details.url);\n  };\n\n  const onRemoved: TabRemovedListener = (tabId) => {\n    redirectChains.delete(tabId);\n    redirectRequestIds.delete(tabId);\n    initiators.delete(tabId);\n    tabHosts.delete(tabId);\n  };\n\n  const onMessage: RuntimeMessageListener = (message, sender, sendResponse) => {\n    if (!isShouldStandDownMessage(message)) {\n      return undefined;\n    }\n\n    void handleMessage(message, sender).then(sendResponse, () => {\n      sendResponse({\n        ok: false,\n        decision: failClosedDecision('message-handler-error'),\n      });\n    });\n\n    return true;\n  };\n\n  if (mode === 'webRequest') {\n    chromeApi?.webRequest?.onBeforeRequest?.addListener(\n      onBeforeRequest,\n      { urls: ['<all_urls>'], types: ['main_frame'] },\n    );\n  }\n\n  if (hasWebNavigation) {\n    chromeApi?.webNavigation?.onCommitted?.addListener(onCommitted);\n  }\n\n  chromeApi?.runtime?.onMessage?.addListener(onMessage);\n  chromeApi?.tabs?.onRemoved?.addListener(onRemoved);\n\n  if (opts.refresh !== undefined) {\n    if (opts.refresh.intervalMs !== 0) {\n      refreshTimer = setInterval(\n        () => {\n          void refreshNow();\n        },\n        opts.refresh.intervalMs ?? DEFAULT_REFRESH_INTERVAL_MS,\n      );\n    }\n  }\n\n  async function ingestNavigation(\n    tabId: number,\n    url: string,\n  ): Promise<Decision> {\n    const host = hostFromUrl(url);\n\n    if (host !== undefined) {\n      tabHosts.set(tabId, host);\n    }\n\n    const redirectChain = mode === 'webRequest' ? redirectChains.get(tabId) : undefined;\n    const initiator = initiators.get(tabId);\n\n    redirectChains.delete(tabId);\n    redirectRequestIds.delete(tabId);\n    initiators.delete(tabId);\n\n    const signals = navigationSignals({\n      url,\n      now: now(),\n      redirectChain,\n      initiator,\n      selfPatterns: opts.selfPatterns,\n      publisherSites: opts.publisherSites,\n    });\n\n    return session.ingest(signals, activePolicies);\n  }\n\n  async function shouldStandDown(\n    tabId: number,\n    at = now(),\n  ): Promise<Decision> {\n    const host = tabHosts.get(tabId) ?? (await hostForTab(chromeApi, tabId));\n\n    if (host === undefined) {\n      return failClosedDecision('missing-tab-url');\n    }\n\n    return session.shouldStandDown(host, at);\n  }\n\n  async function shouldStandDownForUrl(\n    url: string,\n    at = now(),\n  ): Promise<Decision> {\n    const host = hostFromUrl(url);\n\n    if (host === undefined) {\n      return failClosedDecision('invalid-tab-url');\n    }\n\n    return session.shouldStandDown(host, at);\n  }\n\n  async function handleMessage(\n    message: unknown,\n    sender?: RuntimeMessageSenderLike,\n  ): Promise<StanddownMessageResponse | undefined> {\n    if (!isShouldStandDownMessage(message)) {\n      return undefined;\n    }\n\n    const senderUrl = sender?.tab?.url ?? sender?.tab?.pendingUrl;\n    const decision =\n      message.url !== undefined\n        ? await shouldStandDownForUrl(message.url)\n        : senderUrl !== undefined\n          ? await shouldStandDownForUrl(senderUrl)\n          : await shouldStandDown(message.tabId ?? sender?.tab?.id ?? -1);\n\n    return { ok: true, decision };\n  }\n\n  async function refreshNow(): Promise<StanddownRefreshResult> {\n    if (opts.refresh === undefined) {\n      return { ok: false, violation: 'refresh-not-configured' };\n    }\n\n    if (fetchImpl === undefined) {\n      const result = { ok: false, violation: 'refresh-fetch-unavailable' } as const;\n      await auditRefresh(store, now(), result);\n      return result;\n    }\n\n    try {\n      const response = await fetchImpl(opts.refresh.url);\n\n      if (!response.ok) {\n        const result = {\n          ok: false,\n          violation: `refresh-fetch-failed:${response.status}`,\n        } as const;\n        await auditRefresh(store, now(), result);\n        return result;\n      }\n\n      const bundle = (await response.json()) as SignedPolicyBundle;\n      const verified = await verifyPolicyBundle(\n        activePolicies,\n        bundle,\n        opts.refresh.publicKeyJwk,\n      );\n\n      if (!verified.ok) {\n        const result = { ok: false, violation: verified.violation } as const;\n        await auditRefresh(store, now(), result);\n        return result;\n      }\n\n      activePolicies = verified.policies.map((policy) => clonePolicy(policy));\n      const result = { ok: true, applied: activePolicies.length } as const;\n      await auditRefresh(store, now(), result);\n      return result;\n    } catch (error) {\n      const result = {\n        ok: false,\n        violation: `refresh-error:${messageFromError(error)}`,\n      } as const;\n      await auditRefresh(store, now(), result);\n      return result;\n    }\n  }\n\n  function getPolicies(): readonly StanddownPolicy[] {\n    return activePolicies.map((policy) => clonePolicy(policy));\n  }\n\n  function dispose(): void {\n    if (refreshTimer !== undefined) {\n      clearInterval(refreshTimer);\n    }\n\n    chromeApi?.webRequest?.onBeforeRequest?.removeListener?.(onBeforeRequest);\n    chromeApi?.webNavigation?.onCommitted?.removeListener?.(onCommitted);\n    chromeApi?.runtime?.onMessage?.removeListener?.(onMessage);\n    chromeApi?.tabs?.onRemoved?.removeListener?.(onRemoved);\n    redirectChains.clear();\n    redirectRequestIds.clear();\n    initiators.clear();\n    tabHosts.clear();\n  }\n\n  return {\n    mode,\n    session,\n    store,\n    ingestNavigation,\n    shouldStandDown,\n    shouldStandDownForUrl,\n    refreshNow,\n    getPolicies,\n    handleMessage,\n    dispose,\n  };\n}\n\nfunction createChromeStore(\n  chromeApi: ChromeLike | undefined,\n  opts: { sessionId: string | undefined; now: () => number },\n): StateStore {\n  if (chromeApi?.storage?.local === undefined) {\n    return new UnavailableStateStore();\n  }\n\n  const storeOptions: {\n    runtime?: ChromeRuntimeLike;\n    sessionStorage?: ChromeStorageAreaLike;\n    sessionId?: string;\n    now: () => number;\n  } = { now: opts.now };\n\n  if (chromeApi.runtime !== undefined) {\n    storeOptions.runtime = chromeApi.runtime;\n  }\n\n  if (chromeApi.storage.session !== undefined) {\n    storeOptions.sessionStorage = chromeApi.storage.session;\n  }\n\n  if (opts.sessionId !== undefined) {\n    storeOptions.sessionId = opts.sessionId;\n  }\n\n  return new ChromeLocalStateStore(chromeApi.storage.local, storeOptions);\n}\n\nfunction navigationSignals(value: {\n  url: string;\n  now: number;\n  redirectChain: readonly string[] | undefined;\n  initiator: string | undefined;\n  selfPatterns: readonly SelfExemption[] | undefined;\n  publisherSites: readonly string[] | undefined;\n}): Signals {\n  const signals: Signals = {\n    url: value.url,\n    now: value.now,\n  };\n\n  if (value.redirectChain !== undefined && value.redirectChain.length > 0) {\n    signals.redirectChain = [...value.redirectChain];\n  }\n\n  if (value.initiator !== undefined) {\n    signals.initiator = value.initiator;\n  }\n\n  if (value.selfPatterns !== undefined) {\n    signals.selfPatterns = value.selfPatterns;\n  }\n\n  if (value.publisherSites !== undefined) {\n    signals.publisherSites = value.publisherSites;\n  }\n\n  return signals;\n}\n\nasync function hostForTab(\n  chromeApi: ChromeLike | undefined,\n  tabId: number,\n): Promise<string | undefined> {\n  if (tabId < 0 || chromeApi?.tabs?.get === undefined) {\n    return undefined;\n  }\n\n  return new Promise((resolve) => {\n    try {\n      const result = chromeApi.tabs?.get?.(tabId, (tab) => {\n        resolve(hostFromUrl(tab?.url ?? tab?.pendingUrl));\n      });\n\n      if (isPromiseLike(result)) {\n        result.then(\n          (tab) => resolve(hostFromUrl(tab?.url ?? tab?.pendingUrl)),\n          () => resolve(undefined),\n        );\n      }\n    } catch {\n      resolve(undefined);\n    }\n  });\n}\n\nfunction isTopLevelTabRequest(\n  tabId: number,\n  type: string | undefined,\n  frameId: number | undefined,\n): boolean {\n  return tabId >= 0 && (type === undefined || type === 'main_frame') && (frameId ?? 0) === 0;\n}\n\nfunction isShouldStandDownMessage(\n  message: unknown,\n): message is StanddownShouldStandDownMessage {\n  return (\n    typeof message === 'object' &&\n    message !== null &&\n    (message as { type?: unknown }).type === QUERY_MESSAGE_TYPE\n  );\n}\n\nfunction hostFromUrl(value: string | undefined): string | undefined {\n  if (value === undefined) {\n    return undefined;\n  }\n\n  try {\n    return new URL(value).hostname.toLowerCase().replace(/\\.$/, '');\n  } catch {\n    return undefined;\n  }\n}\n\nfunction failClosedDecision(reason: string): Decision {\n  return {\n    standDown: true,\n    reason,\n    behaviors: [...FAIL_CLOSED_BEHAVIORS],\n  };\n}\n\nfunction currentChrome(): ChromeLike | undefined {\n  return (globalThis as typeof globalThis & { chrome?: ChromeLike }).chrome;\n}\n\nfunction currentFetch(): FetchLike | undefined {\n  const fetchValue = (globalThis as typeof globalThis & { fetch?: FetchLike })\n    .fetch;\n\n  return typeof fetchValue === 'function' ? fetchValue : undefined;\n}\n\nasync function auditRefresh(\n  store: StateStore,\n  time: number,\n  result: StanddownRefreshResult,\n): Promise<void> {\n  const state = (await store.load()) ?? emptyState();\n  const entry: AuditEntry = {\n    time,\n    action: 'refresh',\n    decision: {\n      standDown: false,\n      reason: result.ok\n        ? `refresh-applied:${result.applied}`\n        : `refresh-rejected:${result.violation}`,\n      behaviors: [],\n    },\n  };\n\n  state.auditLog.push(entry);\n\n  if (state.auditLog.length > MAX_ADAPTER_AUDIT_ENTRIES) {\n    state.auditLog.splice(0, state.auditLog.length - MAX_ADAPTER_AUDIT_ENTRIES);\n  }\n\n  await store.save(state);\n}\n\nfunction emptyState(): StanddownState {\n  return {\n    sessions: {},\n    auditLog: [],\n  };\n}\n\nfunction clonePolicy(policy: StanddownPolicy): StanddownPolicy {\n  return JSON.parse(JSON.stringify(policy)) as StanddownPolicy;\n}\n\nfunction isPromiseLike<T>(value: unknown): value is Promise<T> {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { then?: unknown }).then === 'function'\n  );\n}\n\nfunction messageFromError(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nclass UnavailableStateStore implements StateStore {\n  async load(): Promise<never> {\n    throw new Error('chrome.storage.local unavailable');\n  }\n\n  async save(): Promise<never> {\n    throw new Error('chrome.storage.local unavailable');\n  }\n}\n"]}

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "standdown",
+  "version": "0.1.0",
+  "description": "Affiliate stand-down, done right, for browser extensions.",
+  "author": "Dupe (https://dupe.com)",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dupe-com/standdown.git"
+  },
+  "homepage": "https://github.com/dupe-com/standdown#readme",
+  "bugs": "https://github.com/dupe-com/standdown/issues",
+  "keywords": [
+    "affiliate",
+    "stand-down",
+    "standdown",
+    "browser-extension",
+    "compliance",
+    "attribution",
+    "mv3",
+    "affiliate-marketing",
+    "cookie-stuffing"
+  ],
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "POLICIES.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs"
+    },
+    "./policies": {
+      "types": "./dist/policies.d.ts",
+      "import": "./dist/policies.mjs",
+      "require": "./dist/policies.cjs"
+    },
+    "./webext": {
+      "types": "./dist/webext.d.ts",
+      "import": "./dist/webext.mjs",
+      "require": "./dist/webext.cjs"
+    },
+    "./content": {
+      "types": "./dist/content.d.ts",
+      "import": "./dist/content.mjs",
+      "require": "./dist/content.cjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check .",
+    "build": "tsup",
+    "test": "vitest run",
+    "policies-cite-check": "node scripts/policies-cite-check.mjs"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@biomejs/biome": "2.5.1",
+    "@types/chrome": "^0.2.2",
+    "@types/node": "^24.0.14",
+    "tsup": "^8.5.0",
+    "typescript": "^5.8.3",
+    "vitest": "^3.2.4"
+  }
+}