standdown 0.1.0

package/dist/content.cjs

@@ -0,0 +1,1288 @@
+'use strict';
+
+// src/detect.ts
+var ORGANIC_REFERRER_SUFFIXES = [
+  "google.com",
+  "bing.com",
+  "duckduckgo.com",
+  "yahoo.com",
+  "ecosia.org",
+  "baidu.com",
+  "yandex.com"
+];
+function detect(signals, policies) {
+  const currentUrl = parseUrl(signals.url);
+  if (!currentUrl) {
+    return {
+      matched: [],
+      selfMatch: false,
+      failClosedReason: "invalid-url"
+    };
+  }
+  const advertiserHost = currentUrl.hostname.toLowerCase();
+  const matched = [];
+  let selfMatch = false;
+  for (const policy of policies) {
+    const scopedSelfMatch = hasScopedSelfExemption(
+      currentUrl,
+      signals.selfPatterns,
+      policy
+    );
+    const unscopedSelfMatch = hasUnscopedSelfExemption(
+      currentUrl,
+      signals.selfPatterns
+    );
+    if (scopedSelfMatch || unscopedSelfMatch) {
+      selfMatch = true;
+    }
+    if (scopedSelfMatch) {
+      continue;
+    }
+    matched.push(
+      ...collectPolicyMatches(policy, signals, currentUrl, advertiserHost)
+    );
+  }
+  matched.sort((left, right) => kindPriority(left.kind) - kindPriority(right.kind));
+  const strongest = matched[0] ? {
+    policyId: matched[0].policyId,
+    advertiserHost: matched[0].advertiserHost,
+    reason: matched[0].reason
+  } : void 0;
+  return strongest ? { matched, selfMatch, strongest } : { matched, selfMatch };
+}
+function classifyReferrer(signals, advertiserHost) {
+  const candidate = signals.initiator ?? signals.referrer;
+  if (!candidate) {
+    return "direct";
+  }
+  const referrerHost = hostFromUrl(candidate);
+  if (!referrerHost) {
+    return "other";
+  }
+  if ((signals.publisherSites ?? []).some(
+    (site) => domainSuffixMatches(referrerHost, site)
+  )) {
+    return "own-site";
+  }
+  if (domainSuffixMatches(referrerHost, advertiserHost)) {
+    return "advertiser-internal";
+  }
+  if (ORGANIC_REFERRER_SUFFIXES.some(
+    (suffix) => domainSuffixMatches(referrerHost, suffix)
+  )) {
+    return "organic";
+  }
+  return "other";
+}
+function domainRuleMatchesUrl(rule, value) {
+  const url = parseUrl(value);
+  const host = url?.hostname.toLowerCase() ?? value.toLowerCase();
+  if (rule.kind === "suffix") {
+    return domainSuffixMatches(host, rule.pattern);
+  }
+  try {
+    const regex = new RegExp(rule.pattern, "i");
+    return regex.test(host) || (url ? regex.test(url.href) : regex.test(value));
+  } catch {
+    return false;
+  }
+}
+function collectPolicyMatches(policy, signals, currentUrl, advertiserHost) {
+  const matches = [];
+  const advertiserHostMatches = policy.detection.advertiserHosts === void 0 || policy.detection.advertiserHosts.some(
+    (rule) => domainRuleMatchesUrl(rule, advertiserHost)
+  );
+  if (advertiserHostMatches) {
+    for (const rule of policy.detection.landingParams ?? []) {
+      if (paramRuleMatches(rule, currentUrl.searchParams)) {
+        matches.push(
+          matchedRule(
+            policy,
+            "landing-param",
+            describeParamRule(rule),
+            advertiserHost,
+            rule.reason ?? "landing parameter matched"
+          )
+        );
+      }
+    }
+  }
+  for (const rule of policy.detection.redirectDomains ?? []) {
+    if ((signals.redirectChain ?? []).some((url) => domainRuleMatchesUrl(rule, url))) {
+      matches.push(
+        matchedRule(
+          policy,
+          "redirect-domain",
+          `${rule.kind}:${rule.pattern}`,
+          advertiserHost,
+          rule.comment ?? "redirect domain matched"
+        )
+      );
+    }
+  }
+  if (advertiserHostMatches) {
+    for (const rule of policy.detection.cookiePatterns ?? []) {
+      if (cookieRuleMatches(rule, signals.cookieNames ?? [])) {
+        matches.push(
+          matchedRule(
+            policy,
+            "cookie",
+            `${rule.match}:${rule.name}`,
+            advertiserHost,
+            rule.reason ?? "first-party cookie name matched"
+          )
+        );
+      }
+    }
+  }
+  if (advertiserHostMatches) {
+    for (const rule of policy.detection.initiatorRules ?? []) {
+      if (initiatorRuleMatches(rule, signals, advertiserHost)) {
+        matches.push(
+          matchedRule(
+            policy,
+            "initiator",
+            `referrer-class:${rule.referrerClass}`,
+            advertiserHost,
+            rule.reason ?? "initiator/referrer class matched"
+          )
+        );
+      }
+    }
+  }
+  return matches;
+}
+function matchedRule(policy, kind, rule, advertiserHost, reason) {
+  return {
+    policyId: policy.id,
+    networkId: policy.network.id,
+    networkName: policy.network.name,
+    kind,
+    rule,
+    advertiserHost,
+    reason,
+    sourceUrl: policy.metadata.sourceUrl
+  };
+}
+function kindPriority(kind) {
+  if (kind === "redirect-domain") {
+    return 0;
+  }
+  if (kind === "landing-param") {
+    return 1;
+  }
+  if (kind === "cookie") {
+    return 2;
+  }
+  return 3;
+}
+function paramRuleMatches(rule, params) {
+  return rule.anyOf.some(
+    (group) => group.allOf.every((matcher) => paramMatcherMatches(matcher, params))
+  );
+}
+function paramMatcherMatches(matcher, params) {
+  const values = params.getAll(matcher.name);
+  const mode = matcher.match ?? (matcher.value === void 0 ? "exists" : "equals");
+  if (mode === "exists") {
+    return values.length > 0;
+  }
+  const expectedValue = matcher.value;
+  if (expectedValue === void 0) {
+    return false;
+  }
+  if (mode === "equals") {
+    return values.some((value) => value === expectedValue);
+  }
+  return values.some((value) => value.includes(expectedValue));
+}
+function cookieRuleMatches(rule, cookieNames) {
+  if (rule.match === "exact") {
+    return cookieNames.some((name) => name === rule.name);
+  }
+  return cookieNames.some((name) => name.includes(rule.name));
+}
+function initiatorRuleMatches(rule, signals, advertiserHost) {
+  return classifyReferrer(signals, advertiserHost) === rule.referrerClass;
+}
+function hasScopedSelfExemption(currentUrl, selfPatterns, policy) {
+  return (selfPatterns ?? []).some((pattern) => {
+    const scopedToPolicy = pattern.policyId === policy.id;
+    const scopedToNetwork = pattern.networkId === policy.network.id;
+    return (scopedToPolicy || scopedToNetwork) && paramMatcherMatches(pattern, currentUrl.searchParams);
+  });
+}
+function hasUnscopedSelfExemption(currentUrl, selfPatterns) {
+  return (selfPatterns ?? []).some(
+    (pattern) => pattern.policyId === void 0 && pattern.networkId === void 0 && paramMatcherMatches(pattern, currentUrl.searchParams)
+  );
+}
+function domainSuffixMatches(host, pattern) {
+  const normalizedHost = host.toLowerCase().replace(/\.$/, "");
+  const normalizedPattern = pattern.toLowerCase().replace(/^\./, "").replace(/\.$/, "");
+  return normalizedHost === normalizedPattern || normalizedHost.endsWith(`.${normalizedPattern}`);
+}
+function describeParamRule(rule) {
+  return rule.anyOf.map(
+    (group) => group.allOf.map((matcher) => {
+      const mode = matcher.match ?? (matcher.value === void 0 ? "exists" : "equals");
+      return matcher.value === void 0 ? `${matcher.name}:${mode}` : `${matcher.name}:${mode}:${matcher.value}`;
+    }).join("&")
+  ).join("|");
+}
+function parseUrl(value) {
+  try {
+    return new URL(value);
+  } catch {
+    return void 0;
+  }
+}
+function hostFromUrl(value) {
+  return parseUrl(value)?.hostname.toLowerCase();
+}
+
+// src/validation.ts
+var BEHAVIORS = /* @__PURE__ */ new Set([
+  "suppress-prompts",
+  "no-cookie-write",
+  "no-redirect",
+  "no-background-tracking"
+]);
+var PARAM_MATCHES = /* @__PURE__ */ new Set(["exists", "equals", "contains"]);
+var COOKIE_MATCHES = /* @__PURE__ */ new Set(["exact", "substring"]);
+var DOMAIN_KINDS = /* @__PURE__ */ new Set(["suffix", "regex"]);
+var REFERRER_CLASSES = /* @__PURE__ */ new Set([
+  "own-site",
+  "organic",
+  "direct",
+  "advertiser-internal",
+  "other"
+]);
+var ACTIVATION_REFERRER_CLASSES = /* @__PURE__ */ new Set(["own-site", "organic", "direct"]);
+function validatePolicy(value) {
+  const policy = object(value, "policy");
+  string(policy.id, "policy.id");
+  literal(policy.schemaVersion, 3, "policy.schemaVersion");
+  string(policy.policyVersion, "policy.policyVersion");
+  const network = object(policy.network, "policy.network");
+  string(network.id, "policy.network.id");
+  string(network.name, "policy.network.name");
+  if (network.policyUrl !== void 0) {
+    urlString(network.policyUrl, "policy.network.policyUrl");
+  }
+  const detection = object(policy.detection, "policy.detection");
+  optionalArray(detection.advertiserHosts, "policy.detection.advertiserHosts").forEach(
+    validateDomainRule
+  );
+  optionalArray(detection.landingParams, "policy.detection.landingParams").forEach(
+    validateParamRule
+  );
+  optionalArray(detection.redirectDomains, "policy.detection.redirectDomains").forEach(
+    validateDomainRule
+  );
+  optionalArray(detection.cookiePatterns, "policy.detection.cookiePatterns").forEach(
+    validateCookieRule
+  );
+  optionalArray(detection.initiatorRules, "policy.detection.initiatorRules").forEach(
+    validateInitiatorRule
+  );
+  const standdown = object(policy.standdown, "policy.standdown");
+  literal(standdown.scope, "advertiser", "policy.standdown.scope");
+  if (standdown.sessionRule !== "session-or-min" && standdown.sessionRule !== "inactivity-window") {
+    throw new TypeError("policy.standdown.sessionRule is invalid");
+  }
+  nonNegativeFiniteNumber(
+    standdown.minDurationMs,
+    "policy.standdown.minDurationMs"
+  );
+  if (standdown.inactivityMs !== void 0) {
+    nonNegativeFiniteNumber(
+      standdown.inactivityMs,
+      "policy.standdown.inactivityMs"
+    );
+  }
+  const behaviors = array(standdown.behaviors, "policy.standdown.behaviors");
+  for (const behavior of behaviors) {
+    if (!BEHAVIORS.has(behavior)) {
+      throw new TypeError(`policy.standdown.behaviors contains invalid behavior`);
+    }
+  }
+  const activation = object(policy.activation, "policy.activation");
+  if (activation.mode !== "user-click" && activation.mode !== "never") {
+    throw new TypeError("policy.activation.mode is invalid");
+  }
+  if (activation.maxPromptsPerJourney !== void 0) {
+    nonNegativeFiniteNumber(
+      activation.maxPromptsPerJourney,
+      "policy.activation.maxPromptsPerJourney"
+    );
+  }
+  for (const referrerClass of optionalArray(
+    activation.allowedReferrerClasses,
+    "policy.activation.allowedReferrerClasses"
+  )) {
+    if (!ACTIVATION_REFERRER_CLASSES.has(referrerClass)) {
+      throw new TypeError(
+        "policy.activation.allowedReferrerClasses contains invalid class"
+      );
+    }
+  }
+  const metadata = object(policy.metadata, "policy.metadata");
+  urlString(metadata.sourceUrl, "policy.metadata.sourceUrl");
+  dateString(metadata.lastVerified, "policy.metadata.lastVerified");
+  if (metadata.notes !== void 0) {
+    string(metadata.notes, "policy.metadata.notes");
+  }
+}
+function validatePolicies(values) {
+  values.forEach(validatePolicy);
+}
+function validateParamRule(ruleValue) {
+  const rule = object(ruleValue, "ParamRule");
+  const anyOf = array(rule.anyOf, "ParamRule.anyOf");
+  if (anyOf.length === 0) {
+    throw new TypeError("ParamRule.anyOf must not be empty");
+  }
+  for (const groupValue of anyOf) {
+    const group = object(groupValue, "ParamRule.anyOf[]");
+    const allOf = array(group.allOf, "ParamRule.anyOf[].allOf");
+    if (allOf.length === 0) {
+      throw new TypeError("ParamRule.anyOf[].allOf must not be empty");
+    }
+    allOf.forEach(validateParamMatcher);
+  }
+  if (rule.reason !== void 0) {
+    string(rule.reason, "ParamRule.reason");
+  }
+}
+function validateParamMatcher(matcherValue) {
+  const matcher = object(matcherValue, "ParamMatcher");
+  string(matcher.name, "ParamMatcher.name");
+  if (matcher.name.trim() === "") {
+    throw new TypeError("ParamMatcher.name must not be empty");
+  }
+  if (matcher.value !== void 0) {
+    string(matcher.value, "ParamMatcher.value");
+  }
+  if (matcher.match !== void 0 && !PARAM_MATCHES.has(matcher.match)) {
+    throw new TypeError("ParamMatcher.match is invalid");
+  }
+  if ((matcher.match === "equals" || matcher.match === "contains") && matcher.value === void 0) {
+    throw new TypeError("ParamMatcher.value is required for equals/contains");
+  }
+}
+function validateDomainRule(ruleValue) {
+  const rule = object(ruleValue, "DomainRule");
+  string(rule.pattern, "DomainRule.pattern");
+  if (!DOMAIN_KINDS.has(rule.kind)) {
+    throw new TypeError("DomainRule.kind is invalid");
+  }
+  if (rule.kind === "regex") {
+    try {
+      new RegExp(rule.pattern);
+    } catch {
+      throw new TypeError("DomainRule.pattern must be a valid regex");
+    }
+  }
+  if (rule.comment !== void 0) {
+    string(rule.comment, "DomainRule.comment");
+  }
+}
+function validateCookieRule(ruleValue) {
+  const rule = object(ruleValue, "CookieRule");
+  string(rule.name, "CookieRule.name");
+  if (!COOKIE_MATCHES.has(rule.match)) {
+    throw new TypeError("CookieRule.match is invalid");
+  }
+  if (rule.reason !== void 0) {
+    string(rule.reason, "CookieRule.reason");
+  }
+}
+function validateInitiatorRule(ruleValue) {
+  const rule = object(ruleValue, "InitiatorRule");
+  if (!REFERRER_CLASSES.has(rule.referrerClass)) {
+    throw new TypeError("InitiatorRule.referrerClass is invalid");
+  }
+  if (rule.reason !== void 0) {
+    string(rule.reason, "InitiatorRule.reason");
+  }
+}
+function object(value, path) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${path} must be an object`);
+  }
+  return value;
+}
+function string(value, path) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new TypeError(`${path} must be a non-empty string`);
+  }
+}
+function literal(value, expected, path) {
+  if (value !== expected) {
+    throw new TypeError(`${path} must be ${String(expected)}`);
+  }
+}
+function array(value, path) {
+  if (!Array.isArray(value)) {
+    throw new TypeError(`${path} must be an array`);
+  }
+  return value;
+}
+function optionalArray(value, path) {
+  if (value === void 0) {
+    return [];
+  }
+  return array(value, path);
+}
+function nonNegativeFiniteNumber(value, path) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    throw new TypeError(`${path} must be a non-negative finite number`);
+  }
+}
+function urlString(value, path) {
+  string(value, path);
+  try {
+    new URL(value);
+  } catch {
+    throw new TypeError(`${path} must be an absolute URL`);
+  }
+}
+function dateString(value, path) {
+  string(value, path);
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) {
+    throw new TypeError(`${path} must be YYYY-MM-DD`);
+  }
+}
+
+// src/session.ts
+var StanddownSession = class {
+  #store;
+  #auditLog;
+  #maxAuditEntries;
+  #readOnlyAuditLog = [];
+  constructor(store, opts) {
+    this.#store = store;
+    this.#auditLog = opts?.auditLog ?? true;
+    this.#maxAuditEntries = Math.max(0, opts?.maxAuditEntries ?? 1e3);
+  }
+  async ingest(signals, policies) {
+    const advertiserHost = hostFromUrl2(signals.url);
+    try {
+      validatePolicies(policies);
+    } catch (error) {
+      return this.#failClosedWithAudit(
+        signals.now,
+        "ingest",
+        advertiserHost,
+        `malformed-policy: ${messageFromError(error)}`
+      );
+    }
+    const detection = detect(signals, policies);
+    if (detection.failClosedReason) {
+      return this.#failClosedWithAudit(
+        signals.now,
+        "ingest",
+        advertiserHost,
+        detection.failClosedReason,
+        detection
+      );
+    }
+    return this.#withState(signals.now, (state) => {
+      pruneExpiredSessions(state, signals.now);
+      if (detection.strongest) {
+        const matchedPolicies = policiesForDetection(policies, detection);
+        if (matchedPolicies.length === 0) {
+          return {
+            decision: failClosedDecision("matched-policy-missing"),
+            detection
+          };
+        }
+        const record = upsertSessionRecord(
+          state,
+          detection.strongest.advertiserHost,
+          detection.strongest.policyId,
+          matchedPolicies,
+          signals.now
+        );
+        return {
+          decision: decisionFromRecord(record, signals.now, {
+            reason: detection.strongest.reason,
+            referrerClass: classifyReferrer(signals, record.advertiserHost)
+          }),
+          detection
+        };
+      }
+      const activeDecision = advertiserHost ? activeDecisionForHost(state, advertiserHost, signals.now) : void 0;
+      return {
+        decision: activeDecision ?? {
+          standDown: false,
+          reason: detection.selfMatch ? "self-exempted-no-active-standdown" : "no-active-standdown",
+          behaviors: [],
+          referrerClass: advertiserHost ? classifyReferrer(signals, advertiserHost) : "other"
+        },
+        detection
+      };
+    }, "ingest");
+  }
+  async shouldStandDown(advertiserHost, now) {
+    return this.#withState(
+      now,
+      (state) => {
+        pruneExpiredSessions(state, now);
+        return {
+          decision: activeDecisionForHost(state, advertiserHost, now) ?? {
+            standDown: false,
+            reason: "no-active-standdown",
+            behaviors: []
+          }
+        };
+      },
+      "shouldStandDown",
+      normalizeHost(advertiserHost),
+      { persist: false }
+    );
+  }
+  async recordActivity(now) {
+    await this.#withState(
+      now,
+      (state) => {
+        pruneExpiredSessions(state, now);
+        for (const record of Object.values(state.sessions)) {
+          if (record.sessionRule === "inactivity-window") {
+            record.lastActivityAt = now;
+            const expiresAt = computeExpiresAt(record);
+            if (expiresAt !== void 0) {
+              record.expiresAt = expiresAt;
+            }
+          }
+        }
+        return {
+          decision: {
+            standDown: false,
+            reason: "activity-recorded",
+            behaviors: []
+          }
+        };
+      },
+      "recordActivity"
+    );
+  }
+  async exportAuditLog() {
+    const state = await this.#loadState();
+    return trimAuditLog(
+      [...state.auditLog, ...this.#readOnlyAuditLog],
+      this.#maxAuditEntries
+    ).map(cloneAuditEntry);
+  }
+  async #withState(now, fn, action, advertiserHost, opts = {}) {
+    let state;
+    try {
+      state = await this.#loadState();
+    } catch {
+      return failClosedDecision("store-error");
+    }
+    const result = fn(state);
+    if (this.#auditLog) {
+      const entry = auditEntry({
+        time: now,
+        action,
+        advertiserHost: advertiserHost ?? result.detection?.strongest?.advertiserHost,
+        detection: result.detection,
+        decision: result.decision
+      });
+      if (opts.persist === false) {
+        appendAuditEntry(this.#readOnlyAuditLog, entry, this.#maxAuditEntries);
+      } else {
+        appendAuditEntry(state.auditLog, entry, this.#maxAuditEntries);
+      }
+    }
+    if (opts.persist === false) {
+      return result.decision;
+    }
+    try {
+      await this.#store.save(state);
+    } catch {
+      return failClosedDecision("store-error");
+    }
+    return result.decision;
+  }
+  async #failClosedWithAudit(now, action, advertiserHost, reason, detection) {
+    const decision = failClosedDecision(reason);
+    if (!this.#auditLog) {
+      return decision;
+    }
+    try {
+      const state = await this.#loadState();
+      appendAuditEntry(
+        state.auditLog,
+        auditEntry({
+          time: now,
+          action,
+          advertiserHost,
+          detection,
+          decision
+        }),
+        this.#maxAuditEntries
+      );
+      await this.#store.save(state);
+    } catch {
+      return failClosedDecision("store-error");
+    }
+    return decision;
+  }
+  async #loadState() {
+    return await this.#store.load() ?? { sessions: {}, auditLog: [] };
+  }
+};
+function appendAuditEntry(auditLog, entry, maxEntries) {
+  if (maxEntries === 0) {
+    auditLog.length = 0;
+    return;
+  }
+  auditLog.push(entry);
+  if (auditLog.length > maxEntries) {
+    auditLog.splice(0, auditLog.length - maxEntries);
+  }
+}
+function trimAuditLog(auditLog, maxEntries) {
+  if (maxEntries === 0) {
+    return [];
+  }
+  return auditLog.slice(Math.max(0, auditLog.length - maxEntries));
+}
+function upsertSessionRecord(state, advertiserHost, primaryPolicyId, policies, now) {
+  const key = normalizeHost(advertiserHost);
+  const existing = state.sessions[key];
+  const startedAt = existing?.startedAt ?? now;
+  const lastActivityAt = now;
+  const sessionRule = existing?.sessionRule === "session-or-min" || policies.some((policy) => policy.standdown.sessionRule === "session-or-min") ? "session-or-min" : "inactivity-window";
+  const baseRecord = {
+    advertiserHost: key,
+    policyId: primaryPolicyId,
+    startedAt,
+    lastActivityAt,
+    sessionRule,
+    minDurationMs: Math.max(
+      existing?.minDurationMs ?? 0,
+      ...policies.map((policy) => policy.standdown.minDurationMs)
+    ),
+    behaviors: unionBehaviors([
+      ...existing?.behaviors ?? [],
+      ...policies.flatMap((policy) => policy.standdown.behaviors)
+    ])
+  };
+  if (sessionRule === "inactivity-window") {
+    const inactivityMs = Math.max(
+      existing?.inactivityMs ?? 0,
+      ...policies.flatMap(
+        (policy) => policy.standdown.inactivityMs === void 0 ? [] : [policy.standdown.inactivityMs]
+      )
+    );
+    if (inactivityMs > 0) {
+      baseRecord.inactivityMs = inactivityMs;
+    }
+  }
+  const computedExpiresAt = computeExpiresAt(baseRecord);
+  if (computedExpiresAt !== void 0) {
+    baseRecord.expiresAt = Math.max(existing?.expiresAt ?? 0, computedExpiresAt);
+  }
+  state.sessions[key] = baseRecord;
+  return baseRecord;
+}
+function policiesForDetection(policies, detection) {
+  if (detection.strongest === void 0) {
+    return [];
+  }
+  const matchingPolicyIds = new Set(
+    detection.matched.filter(
+      (match) => match.advertiserHost === detection.strongest?.advertiserHost
+    ).map((match) => match.policyId)
+  );
+  return policies.filter((policy) => matchingPolicyIds.has(policy.id));
+}
+function unionBehaviors(behaviors) {
+  return [...new Set(behaviors)];
+}
+function activeDecisionForHost(state, advertiserHost, now) {
+  const record = state.sessions[normalizeHost(advertiserHost)];
+  if (!record || !isActive(record, now)) {
+    return void 0;
+  }
+  return decisionFromRecord(record, now);
+}
+function decisionFromRecord(record, now, overrides) {
+  const expiresAt = computeExpiresAt(record);
+  const decision = {
+    standDown: true,
+    policyId: record.policyId,
+    reason: overrides?.reason ?? `active-standdown:${record.policyId}`,
+    behaviors: [...record.behaviors]
+  };
+  if (expiresAt !== void 0) {
+    decision.expiresAt = expiresAt;
+  }
+  if (overrides?.referrerClass !== void 0) {
+    decision.referrerClass = overrides.referrerClass;
+  }
+  if (!isActive({ ...record, ...expiresAt === void 0 ? {} : { expiresAt } }, now)) {
+    return {
+      standDown: false,
+      reason: "standdown-expired",
+      behaviors: []
+    };
+  }
+  return decision;
+}
+function computeExpiresAt(record) {
+  if (record.sessionRule === "inactivity-window" && record.inactivityMs !== void 0) {
+    return Math.max(
+      record.startedAt + record.minDurationMs,
+      record.lastActivityAt + record.inactivityMs
+    );
+  }
+  return record.expiresAt;
+}
+function isActive(record, now) {
+  if (record.sessionRule === "session-or-min") {
+    return true;
+  }
+  const expiresAt = computeExpiresAt(record);
+  return expiresAt === void 0 ? false : now < expiresAt;
+}
+function pruneExpiredSessions(state, now) {
+  for (const [host, record] of Object.entries(state.sessions)) {
+    if (!isActive(record, now)) {
+      delete state.sessions[host];
+    }
+  }
+}
+function failClosedDecision(reason) {
+  return {
+    standDown: true,
+    reason,
+    behaviors: [
+      "suppress-prompts",
+      "no-cookie-write",
+      "no-redirect",
+      "no-background-tracking"
+    ]
+  };
+}
+function auditEntry(value) {
+  const entry = {
+    time: value.time,
+    action: value.action
+  };
+  if (value.advertiserHost !== void 0) {
+    entry.advertiserHost = value.advertiserHost;
+  }
+  if (value.detection !== void 0) {
+    entry.detection = value.detection;
+  }
+  if (value.decision !== void 0) {
+    entry.decision = value.decision;
+  }
+  return entry;
+}
+function cloneAuditEntry(entry) {
+  const cloned = {
+    time: entry.time,
+    action: entry.action
+  };
+  if (entry.advertiserHost !== void 0) {
+    cloned.advertiserHost = entry.advertiserHost;
+  }
+  if (entry.detection !== void 0) {
+    const detection = {
+      matched: entry.detection.matched.map((match) => ({ ...match })),
+      selfMatch: entry.detection.selfMatch
+    };
+    if (entry.detection.strongest !== void 0) {
+      detection.strongest = { ...entry.detection.strongest };
+    }
+    if (entry.detection.failClosedReason !== void 0) {
+      detection.failClosedReason = entry.detection.failClosedReason;
+    }
+    cloned.detection = detection;
+  }
+  if (entry.decision !== void 0) {
+    cloned.decision = {
+      ...entry.decision,
+      behaviors: [...entry.decision.behaviors]
+    };
+  }
+  return cloned;
+}
+function normalizeHost(host) {
+  return host.toLowerCase().replace(/\.$/, "");
+}
+function hostFromUrl2(value) {
+  try {
+    return normalizeHost(new URL(value).hostname);
+  } catch {
+    return void 0;
+  }
+}
+function messageFromError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/stores.ts
+var DEFAULT_STATE_KEY = "standdown:state:v1";
+var DEFAULT_SESSION_ID_KEY = "standdown:session-id:v1";
+var SessionStorageStateStore = class {
+  #storage;
+  #key;
+  constructor(storage, opts = {}) {
+    this.#storage = storage;
+    this.#key = opts.key ?? DEFAULT_STATE_KEY;
+  }
+  async load() {
+    const raw = this.#storage.getItem(this.#key);
+    if (raw === null) {
+      return void 0;
+    }
+    return cloneState(parseState(JSON.parse(raw)));
+  }
+  async save(state) {
+    this.#storage.setItem(this.#key, JSON.stringify(cloneState(state)));
+  }
+};
+var LocalStorageTtlStateStore = class {
+  #localStorage;
+  #identityStorage;
+  #key;
+  #identityKey;
+  #ttlMs;
+  #fixedSessionId;
+  #now;
+  #createSessionId;
+  #cachedSessionId;
+  constructor(localStorage, opts) {
+    this.#localStorage = localStorage;
+    this.#identityStorage = opts.identityStorage ?? localStorage;
+    this.#key = opts.key ?? DEFAULT_STATE_KEY;
+    this.#identityKey = opts.identityKey ?? DEFAULT_SESSION_ID_KEY;
+    this.#ttlMs = opts.ttlMs;
+    this.#fixedSessionId = opts.sessionId;
+    this.#now = opts.now ?? Date.now;
+    this.#createSessionId = opts.createSessionId ?? createSessionId;
+  }
+  async load() {
+    const sessionId = this.#currentSessionId();
+    const raw = this.#localStorage.getItem(this.#key);
+    if (raw === null) {
+      return void 0;
+    }
+    const persisted = parsePersistedState(JSON.parse(raw));
+    const state = cloneState(persisted.state);
+    if (this.#now() - persisted.savedAt >= this.#ttlMs) {
+      return {
+        sessions: {},
+        auditLog: state.auditLog
+      };
+    }
+    if (sessionIdentityMismatch(persisted.sessionId, sessionId)) {
+      return dropSessionBoundRecords(state, this.#now());
+    }
+    return state;
+  }
+  async save(state) {
+    const sessionId = this.#currentSessionId();
+    this.#localStorage.setItem(
+      this.#key,
+      JSON.stringify({
+        schemaVersion: 1,
+        sessionId,
+        savedAt: this.#now(),
+        state: cloneState(state)
+      })
+    );
+  }
+  #currentSessionId() {
+    if (this.#fixedSessionId !== void 0) {
+      return this.#fixedSessionId;
+    }
+    if (this.#cachedSessionId !== void 0) {
+      return this.#cachedSessionId;
+    }
+    const existing = this.#identityStorage.getItem(this.#identityKey);
+    if (existing !== null && existing.length > 0) {
+      this.#cachedSessionId = existing;
+      return existing;
+    }
+    const next = this.#createSessionId();
+    this.#identityStorage.setItem(this.#identityKey, next);
+    this.#cachedSessionId = next;
+    return next;
+  }
+};
+function dropSessionBoundRecords(state, now) {
+  const next = cloneState(state);
+  for (const [host, record] of Object.entries(next.sessions)) {
+    if (record.sessionRule === "session-or-min" && now >= record.startedAt + record.minDurationMs) {
+      delete next.sessions[host];
+    }
+  }
+  return next;
+}
+function createSessionId() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  return `session-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
+function parsePersistedState(value) {
+  if (!isRecord(value)) {
+    throw new Error("invalid persisted state");
+  }
+  const sessionId = value.sessionId;
+  const savedAt = value.savedAt ?? 0;
+  const state = value.state;
+  if (sessionId !== void 0 && typeof sessionId !== "string" || typeof savedAt !== "number") {
+    throw new Error("invalid persisted state envelope");
+  }
+  return {
+    sessionId,
+    savedAt,
+    state: parseState(state)
+  };
+}
+function parseState(value) {
+  if (!isRecord(value) || !isRecord(value.sessions) || !Array.isArray(value.auditLog)) {
+    throw new Error("invalid standdown state");
+  }
+  const sessions = {};
+  for (const [host, record] of Object.entries(value.sessions)) {
+    sessions[host] = parseSessionRecord(record);
+  }
+  return {
+    sessions,
+    auditLog: value.auditLog.map(parseAuditEntry)
+  };
+}
+function parseSessionRecord(value) {
+  if (!isRecord(value)) {
+    throw new Error("invalid session record");
+  }
+  const {
+    advertiserHost,
+    policyId,
+    startedAt,
+    lastActivityAt,
+    expiresAt,
+    sessionRule,
+    minDurationMs,
+    inactivityMs,
+    behaviors
+  } = value;
+  if (typeof advertiserHost !== "string" || typeof policyId !== "string" || typeof startedAt !== "number" || typeof lastActivityAt !== "number" || expiresAt !== void 0 && typeof expiresAt !== "number" || sessionRule !== "session-or-min" && sessionRule !== "inactivity-window" || typeof minDurationMs !== "number" || inactivityMs !== void 0 && typeof inactivityMs !== "number" || !Array.isArray(behaviors) || !behaviors.every(isBehavior)) {
+    throw new Error("invalid session record");
+  }
+  const record = {
+    advertiserHost,
+    policyId,
+    startedAt,
+    lastActivityAt,
+    sessionRule,
+    minDurationMs,
+    behaviors
+  };
+  if (expiresAt !== void 0) {
+    record.expiresAt = expiresAt;
+  }
+  if (inactivityMs !== void 0) {
+    record.inactivityMs = inactivityMs;
+  }
+  return record;
+}
+function parseAuditEntry(value) {
+  if (!isRecord(value)) {
+    throw new Error("invalid audit entry");
+  }
+  const { time, action, advertiserHost, detection, decision } = value;
+  if (typeof time !== "number" || action !== "ingest" && action !== "shouldStandDown" && action !== "recordActivity" && action !== "refresh" || advertiserHost !== void 0 && typeof advertiserHost !== "string") {
+    throw new Error("invalid audit entry");
+  }
+  const entry = { time, action };
+  if (advertiserHost !== void 0) {
+    entry.advertiserHost = advertiserHost;
+  }
+  if (detection !== void 0) {
+    entry.detection = detection;
+  }
+  if (decision !== void 0) {
+    entry.decision = decision;
+  }
+  return entry;
+}
+function cloneState(state) {
+  return {
+    sessions: Object.fromEntries(
+      Object.entries(state.sessions).map(([host, record]) => [
+        host,
+        cloneSessionRecord(record)
+      ])
+    ),
+    auditLog: state.auditLog.map(cloneAuditEntry2)
+  };
+}
+function cloneSessionRecord(record) {
+  const next = {
+    advertiserHost: record.advertiserHost,
+    policyId: record.policyId,
+    startedAt: record.startedAt,
+    lastActivityAt: record.lastActivityAt,
+    sessionRule: record.sessionRule,
+    minDurationMs: record.minDurationMs,
+    behaviors: [...record.behaviors]
+  };
+  if (record.expiresAt !== void 0) {
+    next.expiresAt = record.expiresAt;
+  }
+  if (record.inactivityMs !== void 0) {
+    next.inactivityMs = record.inactivityMs;
+  }
+  return next;
+}
+function cloneAuditEntry2(entry) {
+  const next = {
+    time: entry.time,
+    action: entry.action
+  };
+  if (entry.advertiserHost !== void 0) {
+    next.advertiserHost = entry.advertiserHost;
+  }
+  if (entry.detection !== void 0) {
+    next.detection = {
+      matched: entry.detection.matched.map((match) => ({ ...match })),
+      selfMatch: entry.detection.selfMatch
+    };
+    if (entry.detection.strongest !== void 0) {
+      next.detection.strongest = { ...entry.detection.strongest };
+    }
+    if (entry.detection.failClosedReason !== void 0) {
+      next.detection.failClosedReason = entry.detection.failClosedReason;
+    }
+  }
+  if (entry.decision !== void 0) {
+    next.decision = {
+      ...entry.decision,
+      behaviors: [...entry.decision.behaviors]
+    };
+  }
+  return next;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function sessionIdentityMismatch(persistedSessionId, currentSessionId) {
+  return persistedSessionId !== void 0 && currentSessionId !== void 0 && persistedSessionId !== currentSessionId;
+}
+function isBehavior(value) {
+  return value === "suppress-prompts" || value === "no-cookie-write" || value === "no-redirect" || value === "no-background-tracking";
+}
+
+// src/content.ts
+var DEFAULT_LOCAL_STORAGE_TTL_MS = 24 * 60 * 60 * 1e3;
+var FAIL_CLOSED_BEHAVIORS = [
+  "suppress-prompts",
+  "no-cookie-write",
+  "no-redirect",
+  "no-background-tracking"
+];
+function createContentStanddown(opts) {
+  const windowLike = opts.window ?? currentWindow();
+  const now = opts.now ?? Date.now;
+  const store = opts.store ?? createContentStore(windowLike, opts, now);
+  const session = new StanddownSession(
+    store,
+    opts.auditLog === void 0 ? void 0 : { auditLog: opts.auditLog }
+  );
+  let disposed = false;
+  let pending = false;
+  const restoreHistory = patchHistory(windowLike, scheduleEvaluation);
+  const onPopState = () => {
+    scheduleEvaluation();
+  };
+  windowLike?.addEventListener?.("popstate", onPopState);
+  async function evaluate() {
+    let signals;
+    try {
+      const signalOptions = { now };
+      if (windowLike !== void 0) {
+        signalOptions.window = windowLike;
+      }
+      if (opts.selfPatterns !== void 0) {
+        signalOptions.selfPatterns = opts.selfPatterns;
+      }
+      if (opts.publisherSites !== void 0) {
+        signalOptions.publisherSites = opts.publisherSites;
+      }
+      signals = collectContentSignals(signalOptions);
+    } catch {
+      const decision2 = failClosedDecision2("signal-collection-error");
+      opts.onDecision?.(decision2, {
+        url: "",
+        now: now()
+      });
+      return decision2;
+    }
+    const decision = await session.ingest(signals, opts.policies);
+    opts.onDecision?.(decision, signals);
+    return decision;
+  }
+  function scheduleEvaluation() {
+    if (disposed || pending) {
+      return;
+    }
+    pending = true;
+    const run = () => {
+      pending = false;
+      if (!disposed) {
+        void evaluate();
+      }
+    };
+    if (windowLike?.setTimeout !== void 0) {
+      windowLike.setTimeout(run, 0);
+      return;
+    }
+    queueMicrotask(run);
+  }
+  async function shouldStandDown(advertiserHost, at = now()) {
+    const host = advertiserHost ?? (windowLike === void 0 ? void 0 : hostFromUrl3(windowLike.location.href));
+    if (host === void 0) {
+      return failClosedDecision2("missing-advertiser-host");
+    }
+    return session.shouldStandDown(host, at);
+  }
+  function dispose() {
+    disposed = true;
+    restoreHistory();
+    windowLike?.removeEventListener?.("popstate", onPopState);
+  }
+  const ready = evaluate();
+  return {
+    session,
+    store,
+    ready,
+    evaluate,
+    shouldStandDown,
+    dispose
+  };
+}
+function collectContentSignals(opts = {}) {
+  const windowLike = opts.window ?? currentWindow();
+  const now = opts.now ?? Date.now;
+  if (windowLike === void 0) {
+    throw new Error("content window unavailable");
+  }
+  const signals = {
+    url: windowLike.location.href,
+    now: now()
+  };
+  const referrer = windowLike.document.referrer;
+  const cookieNames = cookieNamesFromString(windowLike.document.cookie);
+  if (referrer !== void 0 && referrer.length > 0) {
+    signals.referrer = referrer;
+  }
+  if (cookieNames.length > 0) {
+    signals.cookieNames = cookieNames;
+  }
+  if (opts.selfPatterns !== void 0) {
+    signals.selfPatterns = opts.selfPatterns;
+  }
+  if (opts.publisherSites !== void 0) {
+    signals.publisherSites = opts.publisherSites;
+  }
+  return signals;
+}
+function cookieNamesFromString(cookie) {
+  if (cookie.trim().length === 0) {
+    return [];
+  }
+  return cookie.split(";").map((part) => part.trim()).filter((part) => part.length > 0).map((part) => part.split("=")[0]?.trim() ?? "").filter((name) => name.length > 0);
+}
+function createContentStore(windowLike, opts, now) {
+  if (windowLike === void 0) {
+    return new UnavailableStateStore("content window unavailable");
+  }
+  if (opts.storage === "local-ttl") {
+    if (windowLike.localStorage === void 0) {
+      return new UnavailableStateStore("localStorage unavailable");
+    }
+    const storeOptions = {
+      ttlMs: opts.ttlMs ?? DEFAULT_LOCAL_STORAGE_TTL_MS,
+      now
+    };
+    if (windowLike.sessionStorage !== void 0) {
+      storeOptions.sessionStorage = windowLike.sessionStorage;
+    }
+    return new LocalStorageTtlStateStore(windowLike.localStorage, storeOptions);
+  }
+  if (windowLike.sessionStorage === void 0) {
+    return new UnavailableStateStore("sessionStorage unavailable");
+  }
+  return new SessionStorageStateStore(windowLike.sessionStorage);
+}
+function patchHistory(windowLike, onNavigation) {
+  const history = windowLike?.history;
+  if (history === void 0) {
+    return () => {
+    };
+  }
+  const originalPushState = history.pushState.bind(history);
+  const originalReplaceState = history.replaceState.bind(history);
+  history.pushState = (...args) => {
+    originalPushState(...args);
+    onNavigation();
+  };
+  history.replaceState = (...args) => {
+    originalReplaceState(...args);
+    onNavigation();
+  };
+  return () => {
+    history.pushState = originalPushState;
+    history.replaceState = originalReplaceState;
+  };
+}
+function currentWindow() {
+  const value = globalThis.window;
+  return value;
+}
+function hostFromUrl3(value) {
+  try {
+    return new URL(value).hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return void 0;
+  }
+}
+function failClosedDecision2(reason) {
+  return {
+    standDown: true,
+    reason,
+    behaviors: [...FAIL_CLOSED_BEHAVIORS]
+  };
+}
+var UnavailableStateStore = class {
+  #reason;
+  constructor(reason) {
+    this.#reason = reason;
+  }
+  async load() {
+    throw new Error(this.#reason);
+  }
+  async save() {
+    throw new Error(this.#reason);
+  }
+};
+
+exports.LocalStorageTtlStateStore = LocalStorageTtlStateStore;
+exports.SessionStorageStateStore = SessionStorageStateStore;
+exports.collectContentSignals = collectContentSignals;
+exports.cookieNamesFromString = cookieNamesFromString;
+exports.createContentStanddown = createContentStanddown;
+//# sourceMappingURL=content.cjs.map
+//# sourceMappingURL=content.cjs.map