standdown 0.1.0

package/dist/index.cjs

@@ -0,0 +1,1375 @@
+'use strict';
+
+// src/validation.ts
+var BEHAVIORS = /* @__PURE__ */ new Set([
+  "suppress-prompts",
+  "no-cookie-write",
+  "no-redirect",
+  "no-background-tracking"
+]);
+var PARAM_MATCHES = /* @__PURE__ */ new Set(["exists", "equals", "contains"]);
+var COOKIE_MATCHES = /* @__PURE__ */ new Set(["exact", "substring"]);
+var DOMAIN_KINDS = /* @__PURE__ */ new Set(["suffix", "regex"]);
+var REFERRER_CLASSES = /* @__PURE__ */ new Set([
+  "own-site",
+  "organic",
+  "direct",
+  "advertiser-internal",
+  "other"
+]);
+var ACTIVATION_REFERRER_CLASSES = /* @__PURE__ */ new Set(["own-site", "organic", "direct"]);
+function validatePolicy(value) {
+  const policy = object(value, "policy");
+  string(policy.id, "policy.id");
+  literal(policy.schemaVersion, 3, "policy.schemaVersion");
+  string(policy.policyVersion, "policy.policyVersion");
+  const network = object(policy.network, "policy.network");
+  string(network.id, "policy.network.id");
+  string(network.name, "policy.network.name");
+  if (network.policyUrl !== void 0) {
+    urlString(network.policyUrl, "policy.network.policyUrl");
+  }
+  const detection = object(policy.detection, "policy.detection");
+  optionalArray(detection.advertiserHosts, "policy.detection.advertiserHosts").forEach(
+    validateDomainRule
+  );
+  optionalArray(detection.landingParams, "policy.detection.landingParams").forEach(
+    validateParamRule
+  );
+  optionalArray(detection.redirectDomains, "policy.detection.redirectDomains").forEach(
+    validateDomainRule
+  );
+  optionalArray(detection.cookiePatterns, "policy.detection.cookiePatterns").forEach(
+    validateCookieRule
+  );
+  optionalArray(detection.initiatorRules, "policy.detection.initiatorRules").forEach(
+    validateInitiatorRule
+  );
+  const standdown = object(policy.standdown, "policy.standdown");
+  literal(standdown.scope, "advertiser", "policy.standdown.scope");
+  if (standdown.sessionRule !== "session-or-min" && standdown.sessionRule !== "inactivity-window") {
+    throw new TypeError("policy.standdown.sessionRule is invalid");
+  }
+  nonNegativeFiniteNumber(
+    standdown.minDurationMs,
+    "policy.standdown.minDurationMs"
+  );
+  if (standdown.inactivityMs !== void 0) {
+    nonNegativeFiniteNumber(
+      standdown.inactivityMs,
+      "policy.standdown.inactivityMs"
+    );
+  }
+  const behaviors = array(standdown.behaviors, "policy.standdown.behaviors");
+  for (const behavior of behaviors) {
+    if (!BEHAVIORS.has(behavior)) {
+      throw new TypeError(`policy.standdown.behaviors contains invalid behavior`);
+    }
+  }
+  const activation = object(policy.activation, "policy.activation");
+  if (activation.mode !== "user-click" && activation.mode !== "never") {
+    throw new TypeError("policy.activation.mode is invalid");
+  }
+  if (activation.maxPromptsPerJourney !== void 0) {
+    nonNegativeFiniteNumber(
+      activation.maxPromptsPerJourney,
+      "policy.activation.maxPromptsPerJourney"
+    );
+  }
+  for (const referrerClass of optionalArray(
+    activation.allowedReferrerClasses,
+    "policy.activation.allowedReferrerClasses"
+  )) {
+    if (!ACTIVATION_REFERRER_CLASSES.has(referrerClass)) {
+      throw new TypeError(
+        "policy.activation.allowedReferrerClasses contains invalid class"
+      );
+    }
+  }
+  const metadata = object(policy.metadata, "policy.metadata");
+  urlString(metadata.sourceUrl, "policy.metadata.sourceUrl");
+  dateString(metadata.lastVerified, "policy.metadata.lastVerified");
+  if (metadata.notes !== void 0) {
+    string(metadata.notes, "policy.metadata.notes");
+  }
+}
+function validatePolicies(values) {
+  values.forEach(validatePolicy);
+}
+function validateParamRule(ruleValue) {
+  const rule = object(ruleValue, "ParamRule");
+  const anyOf = array(rule.anyOf, "ParamRule.anyOf");
+  if (anyOf.length === 0) {
+    throw new TypeError("ParamRule.anyOf must not be empty");
+  }
+  for (const groupValue of anyOf) {
+    const group = object(groupValue, "ParamRule.anyOf[]");
+    const allOf = array(group.allOf, "ParamRule.anyOf[].allOf");
+    if (allOf.length === 0) {
+      throw new TypeError("ParamRule.anyOf[].allOf must not be empty");
+    }
+    allOf.forEach(validateParamMatcher);
+  }
+  if (rule.reason !== void 0) {
+    string(rule.reason, "ParamRule.reason");
+  }
+}
+function validateParamMatcher(matcherValue) {
+  const matcher = object(matcherValue, "ParamMatcher");
+  string(matcher.name, "ParamMatcher.name");
+  if (matcher.name.trim() === "") {
+    throw new TypeError("ParamMatcher.name must not be empty");
+  }
+  if (matcher.value !== void 0) {
+    string(matcher.value, "ParamMatcher.value");
+  }
+  if (matcher.match !== void 0 && !PARAM_MATCHES.has(matcher.match)) {
+    throw new TypeError("ParamMatcher.match is invalid");
+  }
+  if ((matcher.match === "equals" || matcher.match === "contains") && matcher.value === void 0) {
+    throw new TypeError("ParamMatcher.value is required for equals/contains");
+  }
+}
+function validateDomainRule(ruleValue) {
+  const rule = object(ruleValue, "DomainRule");
+  string(rule.pattern, "DomainRule.pattern");
+  if (!DOMAIN_KINDS.has(rule.kind)) {
+    throw new TypeError("DomainRule.kind is invalid");
+  }
+  if (rule.kind === "regex") {
+    try {
+      new RegExp(rule.pattern);
+    } catch {
+      throw new TypeError("DomainRule.pattern must be a valid regex");
+    }
+  }
+  if (rule.comment !== void 0) {
+    string(rule.comment, "DomainRule.comment");
+  }
+}
+function validateCookieRule(ruleValue) {
+  const rule = object(ruleValue, "CookieRule");
+  string(rule.name, "CookieRule.name");
+  if (!COOKIE_MATCHES.has(rule.match)) {
+    throw new TypeError("CookieRule.match is invalid");
+  }
+  if (rule.reason !== void 0) {
+    string(rule.reason, "CookieRule.reason");
+  }
+}
+function validateInitiatorRule(ruleValue) {
+  const rule = object(ruleValue, "InitiatorRule");
+  if (!REFERRER_CLASSES.has(rule.referrerClass)) {
+    throw new TypeError("InitiatorRule.referrerClass is invalid");
+  }
+  if (rule.reason !== void 0) {
+    string(rule.reason, "InitiatorRule.reason");
+  }
+}
+function object(value, path) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${path} must be an object`);
+  }
+  return value;
+}
+function string(value, path) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new TypeError(`${path} must be a non-empty string`);
+  }
+}
+function literal(value, expected, path) {
+  if (value !== expected) {
+    throw new TypeError(`${path} must be ${String(expected)}`);
+  }
+}
+function array(value, path) {
+  if (!Array.isArray(value)) {
+    throw new TypeError(`${path} must be an array`);
+  }
+  return value;
+}
+function optionalArray(value, path) {
+  if (value === void 0) {
+    return [];
+  }
+  return array(value, path);
+}
+function nonNegativeFiniteNumber(value, path) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    throw new TypeError(`${path} must be a non-negative finite number`);
+  }
+}
+function urlString(value, path) {
+  string(value, path);
+  try {
+    new URL(value);
+  } catch {
+    throw new TypeError(`${path} must be an absolute URL`);
+  }
+}
+function dateString(value, path) {
+  string(value, path);
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) {
+    throw new TypeError(`${path} must be YYYY-MM-DD`);
+  }
+}
+
+// src/bundle.ts
+var textEncoder = new TextEncoder();
+var MAX_SIGNED_BUNDLE_REGEX_LENGTH = 256;
+async function verifyPolicyBundle(current, update, publicKeyJwk) {
+  try {
+    validatePolicies(current);
+    validatePolicies(update.policies);
+  } catch (error) {
+    return { ok: false, violation: `malformed-policy: ${messageFromError(error)}` };
+  }
+  if (update.schemaVersion !== 1) {
+    return { ok: false, violation: "unsupported-bundle-version" };
+  }
+  const signatureOk = await verifySignature(
+    update.signature.algorithm,
+    publicKeyJwk,
+    update.signature.value,
+    canonicalPolicyBundlePayload(update)
+  );
+  if (!signatureOk) {
+    return { ok: false, violation: "bad-signature" };
+  }
+  const regexViolation = regexComplexityViolation(update.policies);
+  if (regexViolation !== void 0) {
+    return { ok: false, violation: regexViolation };
+  }
+  const monotonicityViolation = checkMonotonicity(current, update.policies);
+  if (monotonicityViolation !== void 0) {
+    return { ok: false, violation: monotonicityViolation };
+  }
+  return { ok: true, policies: update.policies.map(clonePolicy) };
+}
+function canonicalPolicyBundlePayload(bundle) {
+  return canonicalJson({
+    schemaVersion: bundle.schemaVersion,
+    policies: bundle.policies
+  });
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") {
+    if (typeof value === "number" && !Number.isFinite(value)) {
+      throw new TypeError("canonical JSON only supports finite numbers");
+    }
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+  }
+  const record = value;
+  const entries = Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`);
+  return `{${entries.join(",")}}`;
+}
+function checkMonotonicity(current, update) {
+  const updateById = new Map(update.map((policy) => [policy.id, policy]));
+  for (const currentPolicy of current) {
+    const updatedPolicy = updateById.get(currentPolicy.id);
+    if (updatedPolicy === void 0) {
+      return `policy-removed:${currentPolicy.id}`;
+    }
+    const detectionResult = detectionViolation(currentPolicy, updatedPolicy);
+    if (detectionResult !== void 0) {
+      return `${currentPolicy.id}:${detectionResult}`;
+    }
+    const standdownResult = standdownViolation(currentPolicy, updatedPolicy);
+    if (standdownResult !== void 0) {
+      return `${currentPolicy.id}:${standdownResult}`;
+    }
+    if (!sameJson(currentPolicy.activation, updatedPolicy.activation)) {
+      return `${currentPolicy.id}:activation-edited`;
+    }
+  }
+  return void 0;
+}
+function detectionViolation(currentPolicy, updatedPolicy) {
+  if (!domainRulesSurvive(
+    currentPolicy.detection.advertiserHosts,
+    updatedPolicy.detection.advertiserHosts,
+    { advertiserHosts: true }
+  )) {
+    return "advertiser-hosts-narrowed";
+  }
+  if (!paramRulesSurvive(
+    currentPolicy.detection.landingParams,
+    updatedPolicy.detection.landingParams
+  )) {
+    return "landing-params-narrowed";
+  }
+  if (!domainRulesSurvive(
+    currentPolicy.detection.redirectDomains,
+    updatedPolicy.detection.redirectDomains
+  )) {
+    return "redirect-domains-narrowed";
+  }
+  if (!cookieRulesSurvive(
+    currentPolicy.detection.cookiePatterns,
+    updatedPolicy.detection.cookiePatterns
+  )) {
+    return "cookie-patterns-narrowed";
+  }
+  if (!initiatorRulesSurvive(
+    currentPolicy.detection.initiatorRules,
+    updatedPolicy.detection.initiatorRules
+  )) {
+    return "initiator-rules-narrowed";
+  }
+  return void 0;
+}
+function standdownViolation(currentPolicy, updatedPolicy) {
+  if (updatedPolicy.standdown.scope !== currentPolicy.standdown.scope) {
+    return "standdown-scope-edited";
+  }
+  if (updatedPolicy.standdown.sessionRule !== currentPolicy.standdown.sessionRule) {
+    return "session-rule-edited";
+  }
+  if (updatedPolicy.standdown.minDurationMs < currentPolicy.standdown.minDurationMs) {
+    return "min-duration-shortened";
+  }
+  if (currentPolicy.standdown.inactivityMs !== void 0 && (updatedPolicy.standdown.inactivityMs === void 0 || updatedPolicy.standdown.inactivityMs < currentPolicy.standdown.inactivityMs)) {
+    return "inactivity-duration-shortened";
+  }
+  for (const behavior of currentPolicy.standdown.behaviors) {
+    if (!updatedPolicy.standdown.behaviors.includes(behavior)) {
+      return "standdown-behavior-removed";
+    }
+  }
+  return void 0;
+}
+function domainRulesSurvive(current, update, opts = {}) {
+  if (opts.advertiserHosts && current === void 0) {
+    return update === void 0;
+  }
+  if (current === void 0 || current.length === 0) {
+    return true;
+  }
+  if (opts.advertiserHosts && update === void 0) {
+    return true;
+  }
+  if (update === void 0 || update.length === 0) {
+    return false;
+  }
+  return current.every(
+    (rule) => update.some((candidate) => domainRuleCovers(rule, candidate))
+  );
+}
+function regexComplexityViolation(policies) {
+  for (const policy of policies) {
+    for (const [field, rules] of domainRuleEntries(policy)) {
+      for (const rule of rules ?? []) {
+        if (rule.kind === "regex" && isComplexRegex(rule.pattern)) {
+          return `${policy.id}:complex-regex:${field}`;
+        }
+      }
+    }
+  }
+  return void 0;
+}
+function domainRuleEntries(policy) {
+  return [
+    ["detection.advertiserHosts", policy.detection.advertiserHosts],
+    ["detection.redirectDomains", policy.detection.redirectDomains]
+  ];
+}
+function isComplexRegex(pattern) {
+  return pattern.length > MAX_SIGNED_BUNDLE_REGEX_LENGTH || hasRegexBackreference(pattern) || hasRegexLookaround(pattern) || hasNestedUnboundedQuantifier(pattern);
+}
+function hasRegexBackreference(pattern) {
+  return /(^|[^\\])\\[1-9]/.test(pattern);
+}
+function hasRegexLookaround(pattern) {
+  return /\(\?(?:[=!]|<[=!])/.test(pattern);
+}
+function hasNestedUnboundedQuantifier(pattern) {
+  return /\((?:[^()\\]|\\.)*[+*](?:[^()\\]|\\.)*\)(?:[+*]|\{\d*,?\})/.test(
+    pattern
+  );
+}
+function domainRuleCovers(current, update) {
+  if (current.kind === "suffix" && update.kind === "suffix") {
+    return domainSuffixMatches(current.pattern, update.pattern);
+  }
+  return sameJson(current, update);
+}
+function paramRulesSurvive(current, update) {
+  return exactRulesSurvive(current, update);
+}
+function cookieRulesSurvive(current, update) {
+  return exactRulesSurvive(current, update);
+}
+function initiatorRulesSurvive(current, update) {
+  return exactRulesSurvive(current, update);
+}
+function exactRulesSurvive(current, update) {
+  if (current === void 0 || current.length === 0) {
+    return true;
+  }
+  if (update === void 0 || update.length === 0) {
+    return false;
+  }
+  const updatedRules = new Set(update.map((rule) => canonicalJson(rule)));
+  return current.every((rule) => updatedRules.has(canonicalJson(rule)));
+}
+async function verifySignature(algorithm, publicKeyJwk, signatureValue, payload) {
+  try {
+    const publicKey = await importVerificationKey(algorithm, publicKeyJwk);
+    const signature = base64UrlToBytes(signatureValue);
+    const data = bytesToArrayBuffer(textEncoder.encode(payload));
+    if (algorithm === "ECDSA-P256") {
+      return crypto.subtle.verify(
+        { name: "ECDSA", hash: "SHA-256" },
+        publicKey,
+        bytesToArrayBuffer(signature),
+        data
+      );
+    }
+    return crypto.subtle.verify(
+      "Ed25519",
+      publicKey,
+      bytesToArrayBuffer(signature),
+      data
+    );
+  } catch {
+    return false;
+  }
+}
+async function importVerificationKey(algorithm, publicKeyJwk) {
+  if (algorithm === "ECDSA-P256") {
+    return crypto.subtle.importKey(
+      "jwk",
+      publicKeyJwk,
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      ["verify"]
+    );
+  }
+  return crypto.subtle.importKey("jwk", publicKeyJwk, "Ed25519", false, [
+    "verify"
+  ]);
+}
+function base64UrlToBytes(value) {
+  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+}
+function bytesToArrayBuffer(bytes) {
+  return bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength
+  );
+}
+function sameJson(left, right) {
+  return canonicalJson(left) === canonicalJson(right);
+}
+function domainSuffixMatches(host, pattern) {
+  const normalizedHost = host.toLowerCase().replace(/^\./, "").replace(/\.$/, "");
+  const normalizedPattern = pattern.toLowerCase().replace(/^\./, "").replace(/\.$/, "");
+  return normalizedHost === normalizedPattern || normalizedHost.endsWith(`.${normalizedPattern}`);
+}
+function clonePolicy(policy) {
+  return JSON.parse(JSON.stringify(policy));
+}
+function messageFromError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/detect.ts
+var ORGANIC_REFERRER_SUFFIXES = [
+  "google.com",
+  "bing.com",
+  "duckduckgo.com",
+  "yahoo.com",
+  "ecosia.org",
+  "baidu.com",
+  "yandex.com"
+];
+function detect(signals, policies) {
+  const currentUrl = parseUrl(signals.url);
+  if (!currentUrl) {
+    return {
+      matched: [],
+      selfMatch: false,
+      failClosedReason: "invalid-url"
+    };
+  }
+  const advertiserHost = currentUrl.hostname.toLowerCase();
+  const matched = [];
+  let selfMatch = false;
+  for (const policy of policies) {
+    const scopedSelfMatch = hasScopedSelfExemption(
+      currentUrl,
+      signals.selfPatterns,
+      policy
+    );
+    const unscopedSelfMatch = hasUnscopedSelfExemption(
+      currentUrl,
+      signals.selfPatterns
+    );
+    if (scopedSelfMatch || unscopedSelfMatch) {
+      selfMatch = true;
+    }
+    if (scopedSelfMatch) {
+      continue;
+    }
+    matched.push(
+      ...collectPolicyMatches(policy, signals, currentUrl, advertiserHost)
+    );
+  }
+  matched.sort((left, right) => kindPriority(left.kind) - kindPriority(right.kind));
+  const strongest = matched[0] ? {
+    policyId: matched[0].policyId,
+    advertiserHost: matched[0].advertiserHost,
+    reason: matched[0].reason
+  } : void 0;
+  return strongest ? { matched, selfMatch, strongest } : { matched, selfMatch };
+}
+function classifyReferrer(signals, advertiserHost) {
+  const candidate = signals.initiator ?? signals.referrer;
+  if (!candidate) {
+    return "direct";
+  }
+  const referrerHost = hostFromUrl(candidate);
+  if (!referrerHost) {
+    return "other";
+  }
+  if ((signals.publisherSites ?? []).some(
+    (site) => domainSuffixMatches2(referrerHost, site)
+  )) {
+    return "own-site";
+  }
+  if (domainSuffixMatches2(referrerHost, advertiserHost)) {
+    return "advertiser-internal";
+  }
+  if (ORGANIC_REFERRER_SUFFIXES.some(
+    (suffix) => domainSuffixMatches2(referrerHost, suffix)
+  )) {
+    return "organic";
+  }
+  return "other";
+}
+function domainRuleMatchesUrl(rule, value) {
+  const url = parseUrl(value);
+  const host = url?.hostname.toLowerCase() ?? value.toLowerCase();
+  if (rule.kind === "suffix") {
+    return domainSuffixMatches2(host, rule.pattern);
+  }
+  try {
+    const regex = new RegExp(rule.pattern, "i");
+    return regex.test(host) || (url ? regex.test(url.href) : regex.test(value));
+  } catch {
+    return false;
+  }
+}
+function collectPolicyMatches(policy, signals, currentUrl, advertiserHost) {
+  const matches = [];
+  const advertiserHostMatches = policy.detection.advertiserHosts === void 0 || policy.detection.advertiserHosts.some(
+    (rule) => domainRuleMatchesUrl(rule, advertiserHost)
+  );
+  if (advertiserHostMatches) {
+    for (const rule of policy.detection.landingParams ?? []) {
+      if (paramRuleMatches(rule, currentUrl.searchParams)) {
+        matches.push(
+          matchedRule(
+            policy,
+            "landing-param",
+            describeParamRule(rule),
+            advertiserHost,
+            rule.reason ?? "landing parameter matched"
+          )
+        );
+      }
+    }
+  }
+  for (const rule of policy.detection.redirectDomains ?? []) {
+    if ((signals.redirectChain ?? []).some((url) => domainRuleMatchesUrl(rule, url))) {
+      matches.push(
+        matchedRule(
+          policy,
+          "redirect-domain",
+          `${rule.kind}:${rule.pattern}`,
+          advertiserHost,
+          rule.comment ?? "redirect domain matched"
+        )
+      );
+    }
+  }
+  if (advertiserHostMatches) {
+    for (const rule of policy.detection.cookiePatterns ?? []) {
+      if (cookieRuleMatches(rule, signals.cookieNames ?? [])) {
+        matches.push(
+          matchedRule(
+            policy,
+            "cookie",
+            `${rule.match}:${rule.name}`,
+            advertiserHost,
+            rule.reason ?? "first-party cookie name matched"
+          )
+        );
+      }
+    }
+  }
+  if (advertiserHostMatches) {
+    for (const rule of policy.detection.initiatorRules ?? []) {
+      if (initiatorRuleMatches(rule, signals, advertiserHost)) {
+        matches.push(
+          matchedRule(
+            policy,
+            "initiator",
+            `referrer-class:${rule.referrerClass}`,
+            advertiserHost,
+            rule.reason ?? "initiator/referrer class matched"
+          )
+        );
+      }
+    }
+  }
+  return matches;
+}
+function matchedRule(policy, kind, rule, advertiserHost, reason) {
+  return {
+    policyId: policy.id,
+    networkId: policy.network.id,
+    networkName: policy.network.name,
+    kind,
+    rule,
+    advertiserHost,
+    reason,
+    sourceUrl: policy.metadata.sourceUrl
+  };
+}
+function kindPriority(kind) {
+  if (kind === "redirect-domain") {
+    return 0;
+  }
+  if (kind === "landing-param") {
+    return 1;
+  }
+  if (kind === "cookie") {
+    return 2;
+  }
+  return 3;
+}
+function paramRuleMatches(rule, params) {
+  return rule.anyOf.some(
+    (group) => group.allOf.every((matcher) => paramMatcherMatches(matcher, params))
+  );
+}
+function paramMatcherMatches(matcher, params) {
+  const values = params.getAll(matcher.name);
+  const mode = matcher.match ?? (matcher.value === void 0 ? "exists" : "equals");
+  if (mode === "exists") {
+    return values.length > 0;
+  }
+  const expectedValue = matcher.value;
+  if (expectedValue === void 0) {
+    return false;
+  }
+  if (mode === "equals") {
+    return values.some((value) => value === expectedValue);
+  }
+  return values.some((value) => value.includes(expectedValue));
+}
+function cookieRuleMatches(rule, cookieNames) {
+  if (rule.match === "exact") {
+    return cookieNames.some((name) => name === rule.name);
+  }
+  return cookieNames.some((name) => name.includes(rule.name));
+}
+function initiatorRuleMatches(rule, signals, advertiserHost) {
+  return classifyReferrer(signals, advertiserHost) === rule.referrerClass;
+}
+function hasScopedSelfExemption(currentUrl, selfPatterns, policy) {
+  return (selfPatterns ?? []).some((pattern) => {
+    const scopedToPolicy = pattern.policyId === policy.id;
+    const scopedToNetwork = pattern.networkId === policy.network.id;
+    return (scopedToPolicy || scopedToNetwork) && paramMatcherMatches(pattern, currentUrl.searchParams);
+  });
+}
+function hasUnscopedSelfExemption(currentUrl, selfPatterns) {
+  return (selfPatterns ?? []).some(
+    (pattern) => pattern.policyId === void 0 && pattern.networkId === void 0 && paramMatcherMatches(pattern, currentUrl.searchParams)
+  );
+}
+function domainSuffixMatches2(host, pattern) {
+  const normalizedHost = host.toLowerCase().replace(/\.$/, "");
+  const normalizedPattern = pattern.toLowerCase().replace(/^\./, "").replace(/\.$/, "");
+  return normalizedHost === normalizedPattern || normalizedHost.endsWith(`.${normalizedPattern}`);
+}
+function describeParamRule(rule) {
+  return rule.anyOf.map(
+    (group) => group.allOf.map((matcher) => {
+      const mode = matcher.match ?? (matcher.value === void 0 ? "exists" : "equals");
+      return matcher.value === void 0 ? `${matcher.name}:${mode}` : `${matcher.name}:${mode}:${matcher.value}`;
+    }).join("&")
+  ).join("|");
+}
+function parseUrl(value) {
+  try {
+    return new URL(value);
+  } catch {
+    return void 0;
+  }
+}
+function hostFromUrl(value) {
+  return parseUrl(value)?.hostname.toLowerCase();
+}
+
+// src/guard.ts
+function guardActivation(req) {
+  try {
+    validatePolicy(req.policy);
+  } catch {
+    return { allowed: false, reason: "malformed-policy" };
+  }
+  if (req.policy.activation.mode === "never") {
+    return { allowed: false, reason: "policy-never-activates" };
+  }
+  if (req.decision.standDown) {
+    return { allowed: false, reason: "active-standdown" };
+  }
+  if (!isGenuineGesture(req.userGesture)) {
+    return { allowed: false, reason: "missing-trusted-user-gesture" };
+  }
+  if (req.benefit.description.trim() === "") {
+    return { allowed: false, reason: "missing-user-benefit" };
+  }
+  const maxPrompts = req.policy.activation.maxPromptsPerJourney;
+  if (maxPrompts !== void 0 && (req.decision.promptCount ?? 0) >= maxPrompts) {
+    return { allowed: false, reason: "max-prompts-exhausted" };
+  }
+  const allowedReferrerClasses = req.policy.activation.allowedReferrerClasses;
+  if (allowedReferrerClasses !== void 0) {
+    if (req.decision.referrerClass === void 0) {
+      return { allowed: false, reason: "missing-referrer-class" };
+    }
+    if (!isActivationReferrerClass(req.decision.referrerClass)) {
+      return { allowed: false, reason: "referrer-class-disallowed" };
+    }
+    if (!allowedReferrerClasses.includes(req.decision.referrerClass)) {
+      return { allowed: false, reason: "referrer-class-disallowed" };
+    }
+  }
+  return { allowed: true, reason: "allowed" };
+}
+function isActivationReferrerClass(value) {
+  return value === "own-site" || value === "organic" || value === "direct";
+}
+function isGenuineGesture(gesture) {
+  return gesture.isTrusted === true && gesture.type.trim() !== "" && Number.isFinite(gesture.timeStamp);
+}
+
+// src/rakuten.ts
+var DEFAULT_RAKUTEN_SESSION_MS = 18e5;
+var DEFAULT_SOURCE_URL = "https://github.com/rakutenrewards/PublisherStandown-SDK";
+var LAST_VERIFIED = "2026-07-10";
+var STANDDOWN_BEHAVIORS = [
+  "suppress-prompts",
+  "no-cookie-write",
+  "no-redirect",
+  "no-background-tracking"
+];
+function fromRakutenPolicy(policy) {
+  if (policy.schemaVersion !== 2) {
+    throw new TypeError("Rakuten policy schemaVersion must be 2");
+  }
+  const detection = {};
+  const landingParams = landingParamsFromRakutenRules(policy.rules);
+  const redirectDomains = redirectDomainsFromRakutenRules(policy.rules);
+  if (landingParams !== void 0) {
+    detection.landingParams = landingParams;
+  }
+  if (redirectDomains !== void 0) {
+    detection.redirectDomains = redirectDomains;
+  }
+  const nativePolicy = {
+    id: policy.id,
+    schemaVersion: 3,
+    policyVersion: policy.policyVersion,
+    network: {
+      id: policy.network.id,
+      name: policy.network.name,
+      policyUrl: DEFAULT_SOURCE_URL
+    },
+    detection,
+    standdown: {
+      scope: "advertiser",
+      sessionRule: "session-or-min",
+      minDurationMs: policy.network.sessionDuration ?? DEFAULT_RAKUTEN_SESSION_MS,
+      behaviors: STANDDOWN_BEHAVIORS
+    },
+    activation: { mode: "user-click" },
+    metadata: {
+      sourceUrl: DEFAULT_SOURCE_URL,
+      lastVerified: LAST_VERIFIED,
+      notes: "Converted from Rakuten NetworkPolicy schemaVersion 2. Lossy mapping: Rakuten paths/patterns are represented as redirect-domain regex rules; Rakuten has no native fields for cookies, initiator rules, activation guard details, stand-down behaviors, citations, or audit semantics. Emitting back to Rakuten drops multi-group anyOf param rules and match:contains params."
+    }
+  };
+  try {
+    validatePolicy(nativePolicy);
+  } catch (error) {
+    throw new TypeError(
+      `Converted Rakuten policy is invalid: ${messageFromError2(error)}`
+    );
+  }
+  return nativePolicy;
+}
+function toRakutenPolicy(policy) {
+  return {
+    id: policy.id,
+    schemaVersion: 2,
+    policyVersion: policy.policyVersion,
+    network: {
+      id: policy.network.id,
+      name: policy.network.name,
+      description: "Converted from standdown.js. Lossy mapping: cookies, initiator rules, advertiserHosts, activation guard details, behaviors, metadata, citations, audit semantics, multi-group anyOf param rules, and match:contains params are not representable in Rakuten NetworkPolicy v2. The bundled rakuten policy intentionally does not round-trip exactly.",
+      sessionDuration: policy.standdown.minDurationMs
+    },
+    rules: rakutenRulesFromPolicy(policy)
+  };
+}
+function landingParamsFromRakutenRules(rules) {
+  const paramRules = rules.flatMap((rule) => {
+    const matchers = paramMatchersFromRakutenParams(rule.params);
+    if (matchers.length === 0) {
+      return [];
+    }
+    return [
+      {
+        anyOf: [{ allOf: matchers }],
+        ...rule.reason === void 0 ? {} : { reason: rule.reason }
+      }
+    ];
+  });
+  return paramRules.length === 0 ? void 0 : paramRules;
+}
+function redirectDomainsFromRakutenRules(rules) {
+  const domainRules = [];
+  for (const rule of rules) {
+    if (rule.pattern !== void 0) {
+      domainRules.push({
+        pattern: rule.pattern,
+        kind: "regex",
+        ...rule.reason === void 0 ? {} : { comment: rule.reason }
+      });
+      continue;
+    }
+    if (rule.domain === void 0) {
+      continue;
+    }
+    if (rule.paths !== void 0 && rule.paths.length > 0) {
+      domainRules.push({
+        pattern: domainAndPathsPattern(rule.domain, rule.paths),
+        kind: "regex",
+        ...rule.reason === void 0 ? {} : { comment: rule.reason }
+      });
+      continue;
+    }
+    domainRules.push({
+      pattern: rule.domain,
+      kind: "suffix",
+      ...rule.reason === void 0 ? {} : { comment: rule.reason }
+    });
+  }
+  return domainRules.length === 0 ? void 0 : domainRules;
+}
+function rakutenRulesFromPolicy(policy) {
+  const rules = [];
+  for (const rule of policy.detection.redirectDomains ?? []) {
+    if (rule.kind === "suffix") {
+      rules.push({
+        domain: rule.pattern,
+        ...rule.comment === void 0 ? {} : { reason: rule.comment }
+      });
+      continue;
+    }
+    rules.push({
+      pattern: rule.pattern,
+      ...rule.comment === void 0 ? {} : { reason: rule.comment }
+    });
+  }
+  for (const rule of policy.detection.landingParams ?? []) {
+    const params = rakutenParamsFromParamRule(rule);
+    if (params !== void 0) {
+      rules.push({
+        params,
+        ...rule.reason === void 0 ? {} : { reason: rule.reason }
+      });
+    }
+  }
+  return rules;
+}
+function paramMatchersFromRakutenParams(params) {
+  if (params === void 0) {
+    return [];
+  }
+  if (Array.isArray(params)) {
+    return params.map((name) => ({ name }));
+  }
+  return Object.entries(params).map(([name, value]) => ({
+    name,
+    value,
+    match: "equals"
+  }));
+}
+function rakutenParamsFromParamRule(rule) {
+  if (rule.anyOf.length !== 1) {
+    return void 0;
+  }
+  const group = rule.anyOf[0];
+  if (group === void 0) {
+    return void 0;
+  }
+  const params = [];
+  const valuedParams = {};
+  let hasValue = false;
+  for (const matcher of group.allOf) {
+    const mode = matcher.match ?? (matcher.value === void 0 ? "exists" : "equals");
+    if (mode === "exists" && matcher.value === void 0) {
+      params.push(matcher.name);
+      continue;
+    }
+    if (mode === "equals" && matcher.value !== void 0) {
+      valuedParams[matcher.name] = matcher.value;
+      hasValue = true;
+      continue;
+    }
+    return void 0;
+  }
+  return hasValue ? valuedParams : params;
+}
+function domainAndPathsPattern(domain, paths) {
+  const escapedDomain = escapeRegex(domain);
+  const escapedPaths = paths.map((path) => escapeRegex(path)).join("|");
+  return `^https?://([^/]+\\.)?${escapedDomain}(${escapedPaths})([/?#]|$)`;
+}
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function messageFromError2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/session.ts
+var MemoryStateStore = class {
+  #state;
+  constructor(initialState) {
+    this.#state = initialState ? cloneState(initialState) : void 0;
+  }
+  async load() {
+    return this.#state ? cloneState(this.#state) : void 0;
+  }
+  async save(state) {
+    this.#state = cloneState(state);
+  }
+};
+var StanddownSession = class {
+  #store;
+  #auditLog;
+  #maxAuditEntries;
+  #readOnlyAuditLog = [];
+  constructor(store, opts) {
+    this.#store = store;
+    this.#auditLog = opts?.auditLog ?? true;
+    this.#maxAuditEntries = Math.max(0, opts?.maxAuditEntries ?? 1e3);
+  }
+  async ingest(signals, policies) {
+    const advertiserHost = hostFromUrl2(signals.url);
+    try {
+      validatePolicies(policies);
+    } catch (error) {
+      return this.#failClosedWithAudit(
+        signals.now,
+        "ingest",
+        advertiserHost,
+        `malformed-policy: ${messageFromError3(error)}`
+      );
+    }
+    const detection = detect(signals, policies);
+    if (detection.failClosedReason) {
+      return this.#failClosedWithAudit(
+        signals.now,
+        "ingest",
+        advertiserHost,
+        detection.failClosedReason,
+        detection
+      );
+    }
+    return this.#withState(signals.now, (state) => {
+      pruneExpiredSessions(state, signals.now);
+      if (detection.strongest) {
+        const matchedPolicies = policiesForDetection(policies, detection);
+        if (matchedPolicies.length === 0) {
+          return {
+            decision: failClosedDecision("matched-policy-missing"),
+            detection
+          };
+        }
+        const record = upsertSessionRecord(
+          state,
+          detection.strongest.advertiserHost,
+          detection.strongest.policyId,
+          matchedPolicies,
+          signals.now
+        );
+        return {
+          decision: decisionFromRecord(record, signals.now, {
+            reason: detection.strongest.reason,
+            referrerClass: classifyReferrer(signals, record.advertiserHost)
+          }),
+          detection
+        };
+      }
+      const activeDecision = advertiserHost ? activeDecisionForHost(state, advertiserHost, signals.now) : void 0;
+      return {
+        decision: activeDecision ?? {
+          standDown: false,
+          reason: detection.selfMatch ? "self-exempted-no-active-standdown" : "no-active-standdown",
+          behaviors: [],
+          referrerClass: advertiserHost ? classifyReferrer(signals, advertiserHost) : "other"
+        },
+        detection
+      };
+    }, "ingest");
+  }
+  async shouldStandDown(advertiserHost, now) {
+    return this.#withState(
+      now,
+      (state) => {
+        pruneExpiredSessions(state, now);
+        return {
+          decision: activeDecisionForHost(state, advertiserHost, now) ?? {
+            standDown: false,
+            reason: "no-active-standdown",
+            behaviors: []
+          }
+        };
+      },
+      "shouldStandDown",
+      normalizeHost(advertiserHost),
+      { persist: false }
+    );
+  }
+  async recordActivity(now) {
+    await this.#withState(
+      now,
+      (state) => {
+        pruneExpiredSessions(state, now);
+        for (const record of Object.values(state.sessions)) {
+          if (record.sessionRule === "inactivity-window") {
+            record.lastActivityAt = now;
+            const expiresAt = computeExpiresAt(record);
+            if (expiresAt !== void 0) {
+              record.expiresAt = expiresAt;
+            }
+          }
+        }
+        return {
+          decision: {
+            standDown: false,
+            reason: "activity-recorded",
+            behaviors: []
+          }
+        };
+      },
+      "recordActivity"
+    );
+  }
+  async exportAuditLog() {
+    const state = await this.#loadState();
+    return trimAuditLog(
+      [...state.auditLog, ...this.#readOnlyAuditLog],
+      this.#maxAuditEntries
+    ).map(cloneAuditEntry);
+  }
+  async #withState(now, fn, action, advertiserHost, opts = {}) {
+    let state;
+    try {
+      state = await this.#loadState();
+    } catch {
+      return failClosedDecision("store-error");
+    }
+    const result = fn(state);
+    if (this.#auditLog) {
+      const entry = auditEntry({
+        time: now,
+        action,
+        advertiserHost: advertiserHost ?? result.detection?.strongest?.advertiserHost,
+        detection: result.detection,
+        decision: result.decision
+      });
+      if (opts.persist === false) {
+        appendAuditEntry(this.#readOnlyAuditLog, entry, this.#maxAuditEntries);
+      } else {
+        appendAuditEntry(state.auditLog, entry, this.#maxAuditEntries);
+      }
+    }
+    if (opts.persist === false) {
+      return result.decision;
+    }
+    try {
+      await this.#store.save(state);
+    } catch {
+      return failClosedDecision("store-error");
+    }
+    return result.decision;
+  }
+  async #failClosedWithAudit(now, action, advertiserHost, reason, detection) {
+    const decision = failClosedDecision(reason);
+    if (!this.#auditLog) {
+      return decision;
+    }
+    try {
+      const state = await this.#loadState();
+      appendAuditEntry(
+        state.auditLog,
+        auditEntry({
+          time: now,
+          action,
+          advertiserHost,
+          detection,
+          decision
+        }),
+        this.#maxAuditEntries
+      );
+      await this.#store.save(state);
+    } catch {
+      return failClosedDecision("store-error");
+    }
+    return decision;
+  }
+  async #loadState() {
+    return await this.#store.load() ?? { sessions: {}, auditLog: [] };
+  }
+};
+function appendAuditEntry(auditLog, entry, maxEntries) {
+  if (maxEntries === 0) {
+    auditLog.length = 0;
+    return;
+  }
+  auditLog.push(entry);
+  if (auditLog.length > maxEntries) {
+    auditLog.splice(0, auditLog.length - maxEntries);
+  }
+}
+function trimAuditLog(auditLog, maxEntries) {
+  if (maxEntries === 0) {
+    return [];
+  }
+  return auditLog.slice(Math.max(0, auditLog.length - maxEntries));
+}
+function upsertSessionRecord(state, advertiserHost, primaryPolicyId, policies, now) {
+  const key = normalizeHost(advertiserHost);
+  const existing = state.sessions[key];
+  const startedAt = existing?.startedAt ?? now;
+  const lastActivityAt = now;
+  const sessionRule = existing?.sessionRule === "session-or-min" || policies.some((policy) => policy.standdown.sessionRule === "session-or-min") ? "session-or-min" : "inactivity-window";
+  const baseRecord = {
+    advertiserHost: key,
+    policyId: primaryPolicyId,
+    startedAt,
+    lastActivityAt,
+    sessionRule,
+    minDurationMs: Math.max(
+      existing?.minDurationMs ?? 0,
+      ...policies.map((policy) => policy.standdown.minDurationMs)
+    ),
+    behaviors: unionBehaviors([
+      ...existing?.behaviors ?? [],
+      ...policies.flatMap((policy) => policy.standdown.behaviors)
+    ])
+  };
+  if (sessionRule === "inactivity-window") {
+    const inactivityMs = Math.max(
+      existing?.inactivityMs ?? 0,
+      ...policies.flatMap(
+        (policy) => policy.standdown.inactivityMs === void 0 ? [] : [policy.standdown.inactivityMs]
+      )
+    );
+    if (inactivityMs > 0) {
+      baseRecord.inactivityMs = inactivityMs;
+    }
+  }
+  const computedExpiresAt = computeExpiresAt(baseRecord);
+  if (computedExpiresAt !== void 0) {
+    baseRecord.expiresAt = Math.max(existing?.expiresAt ?? 0, computedExpiresAt);
+  }
+  state.sessions[key] = baseRecord;
+  return baseRecord;
+}
+function policiesForDetection(policies, detection) {
+  if (detection.strongest === void 0) {
+    return [];
+  }
+  const matchingPolicyIds = new Set(
+    detection.matched.filter(
+      (match) => match.advertiserHost === detection.strongest?.advertiserHost
+    ).map((match) => match.policyId)
+  );
+  return policies.filter((policy) => matchingPolicyIds.has(policy.id));
+}
+function unionBehaviors(behaviors) {
+  return [...new Set(behaviors)];
+}
+function activeDecisionForHost(state, advertiserHost, now) {
+  const record = state.sessions[normalizeHost(advertiserHost)];
+  if (!record || !isActive(record, now)) {
+    return void 0;
+  }
+  return decisionFromRecord(record, now);
+}
+function decisionFromRecord(record, now, overrides) {
+  const expiresAt = computeExpiresAt(record);
+  const decision = {
+    standDown: true,
+    policyId: record.policyId,
+    reason: overrides?.reason ?? `active-standdown:${record.policyId}`,
+    behaviors: [...record.behaviors]
+  };
+  if (expiresAt !== void 0) {
+    decision.expiresAt = expiresAt;
+  }
+  if (overrides?.referrerClass !== void 0) {
+    decision.referrerClass = overrides.referrerClass;
+  }
+  if (!isActive({ ...record, ...expiresAt === void 0 ? {} : { expiresAt } }, now)) {
+    return {
+      standDown: false,
+      reason: "standdown-expired",
+      behaviors: []
+    };
+  }
+  return decision;
+}
+function computeExpiresAt(record) {
+  if (record.sessionRule === "inactivity-window" && record.inactivityMs !== void 0) {
+    return Math.max(
+      record.startedAt + record.minDurationMs,
+      record.lastActivityAt + record.inactivityMs
+    );
+  }
+  return record.expiresAt;
+}
+function isActive(record, now) {
+  if (record.sessionRule === "session-or-min") {
+    return true;
+  }
+  const expiresAt = computeExpiresAt(record);
+  return expiresAt === void 0 ? false : now < expiresAt;
+}
+function pruneExpiredSessions(state, now) {
+  for (const [host, record] of Object.entries(state.sessions)) {
+    if (!isActive(record, now)) {
+      delete state.sessions[host];
+    }
+  }
+}
+function failClosedDecision(reason) {
+  return {
+    standDown: true,
+    reason,
+    behaviors: [
+      "suppress-prompts",
+      "no-cookie-write",
+      "no-redirect",
+      "no-background-tracking"
+    ]
+  };
+}
+function auditEntry(value) {
+  const entry = {
+    time: value.time,
+    action: value.action
+  };
+  if (value.advertiserHost !== void 0) {
+    entry.advertiserHost = value.advertiserHost;
+  }
+  if (value.detection !== void 0) {
+    entry.detection = value.detection;
+  }
+  if (value.decision !== void 0) {
+    entry.decision = value.decision;
+  }
+  return entry;
+}
+function cloneState(state) {
+  return {
+    sessions: Object.fromEntries(
+      Object.entries(state.sessions).map(([host, record]) => [
+        host,
+        {
+          ...record,
+          behaviors: [...record.behaviors]
+        }
+      ])
+    ),
+    auditLog: state.auditLog.map(cloneAuditEntry)
+  };
+}
+function cloneAuditEntry(entry) {
+  const cloned = {
+    time: entry.time,
+    action: entry.action
+  };
+  if (entry.advertiserHost !== void 0) {
+    cloned.advertiserHost = entry.advertiserHost;
+  }
+  if (entry.detection !== void 0) {
+    const detection = {
+      matched: entry.detection.matched.map((match) => ({ ...match })),
+      selfMatch: entry.detection.selfMatch
+    };
+    if (entry.detection.strongest !== void 0) {
+      detection.strongest = { ...entry.detection.strongest };
+    }
+    if (entry.detection.failClosedReason !== void 0) {
+      detection.failClosedReason = entry.detection.failClosedReason;
+    }
+    cloned.detection = detection;
+  }
+  if (entry.decision !== void 0) {
+    cloned.decision = {
+      ...entry.decision,
+      behaviors: [...entry.decision.behaviors]
+    };
+  }
+  return cloned;
+}
+function normalizeHost(host) {
+  return host.toLowerCase().replace(/\.$/, "");
+}
+function hostFromUrl2(value) {
+  try {
+    return normalizeHost(new URL(value).hostname);
+  } catch {
+    return void 0;
+  }
+}
+function messageFromError3(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+exports.MemoryStateStore = MemoryStateStore;
+exports.StanddownSession = StanddownSession;
+exports.canonicalJson = canonicalJson;
+exports.canonicalPolicyBundlePayload = canonicalPolicyBundlePayload;
+exports.classifyReferrer = classifyReferrer;
+exports.detect = detect;
+exports.domainRuleMatchesUrl = domainRuleMatchesUrl;
+exports.fromRakutenPolicy = fromRakutenPolicy;
+exports.guardActivation = guardActivation;
+exports.toRakutenPolicy = toRakutenPolicy;
+exports.validatePolicies = validatePolicies;
+exports.validatePolicy = validatePolicy;
+exports.verifyPolicyBundle = verifyPolicyBundle;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map