standdown v0.5.0

Minor release. Policies can now check the shape of a param's value with match: 'pattern'. Rakuten uses it to stand down on real Rakuten site IDs only. Impact stand-downs last at least 30 minutes, as Impact's policy asks, and afsrc=1 is handled as the shared signal it is. Signed policy refresh is stricter, and the relay holds on to earlier referrals more reliably. No exports were removed, and code written for 0.4.0 still type-checks.

Upgrading from 0.4.x

• Rakuten counts a plain siteID only in Rakuten's site-ID shape (11 characters, a hyphen, 22 characters). It stands down on real Rakuten site IDs and leaves the unrelated siteID params many sites use alone. ranMID, ranEAID and ranSiteID work as before.
• An Impact stand-down lasts at least 30 minutes, so it survives a quick browser restart.
• Your own click accounts for afsrc=1 in the same URL. When a scoped selfPatterns match is in the URL, an afsrc=1 in that same URL no longer stands you down. afsrc=1 on its own still stands down everywhere it did.
• Signed policy refresh is stricter. A bundle may only reuse regex patterns the client already ships, and it can't remove disableHosts or trackingHosts. New domains go in as suffix rules. Serve these policies to 0.5.0 clients: 0.4.0 doesn't know match: 'pattern'.
• Saved state gains optional fields that 0.4.0 ignores, so rolling back keeps working.

Added

• match: 'pattern' on ParamMatcher: an anchored regular expression, kept fast by accepting only a small subset (single characters or classes with counts, at most one of them variable-length, no groups or |). Works in detection, every adapter, and selfPatterns. An optional example documents a matching value.
• shared: true on ParamMatcher and DomainRule, for a signal several networks append. The bundled cj, impact and universal policies mark afsrc=1 this way.
• Decision.matchedParams and Decision.sharedOnly: a fresh stand-down names the params that triggered it (names only, never values), and says when only a shared signal was behind it.

Changed

• rakutenPolicy 0.2.0, impactPolicy 0.2.0 (30-minute minimum, citing Impact's stand-down announcement), cjPolicy 0.3.0 and universalPolicy 0.2.0 (afsrc=1 marked shared).
• selfClickLift can lift a competitor's same-network click that also carried afsrc=1. A stand-down where any landing carried afsrc=1 alone is never lifted.

Fixed

• Relay: a referral from an earlier landing in the tab stands down no matter when the shop strips your own click's param, and param names a page writes into the capture's copy can't push out a real referral.
• Signed bundles can't add a new regex rule or remove disableHosts / trackingHosts.

Tooling (repo-only, not shipped in the npm package)

• The relay-e2e browser check gains Rakuten siteID and shared afsrc=1 cases.

The published package ships only dist, README.md, LICENSE, POLICIES.md and ADOPTING.md. Full details are in CHANGELOG.md.

Full diff: v0.4.0...v0.5.0