Attribution Reporting

1. Introduction

This section is non-normative

This specification describes how web browsers can provide a mechanism to the web that supports measuring and attributing conversions (e.g. purchases) to ads a user interacted with on another site. This mechanism should remove one need for cross-site identifiers like third-party cookies.

1.1. Overview

Pages/embedded sites are given the ability to register attribution sources and attribution triggers, which can be linked by the User Agent to generate and send attribution reports containing information from both of those events.

A reporter https://reporter.example embedded on https://source.example is able to measure whether an interaction on the page lead to an action on https://destination.example by registering an attribution source with attribution destinations of « https://destination.example ». Reporters are able to register sources through a variety of surfaces, but ultimately the reporter is required to provide the User Agent with an HTTP-response header which allows the source to be eligible for attribution.

At a later point in time, the reporter, now embedded on https://destination.example, may register an attribution trigger. Reporters can register triggers by sending an HTTP-response header containing information about the action/event that occurred. Internally, the User Agent attempts to match the trigger to previously registered source events based on where the sources/triggers were registered and configurations provided by the reporter.

If the User Agent is able to attribute the trigger to a source, it will generate and send an attribution report to the reporter via an HTTP POST request at a later point in time.

2. HTML monkeypatches

2.1. API for elements

interface mixin HTMLAttributionSrcElementUtils {
    [CEReactions, SecureContext] attribute USVString attributionSrc;
};

HTMLAnchorElement includes HTMLAttributionSrcElementUtils;
HTMLAreaElement includes HTMLAttributionSrcElementUtils;
HTMLImageElement includes HTMLAttributionSrcElementUtils;
HTMLScriptElement includes HTMLAttributionSrcElementUtils;

Add the following content attributes:

a

attributionsrc - A string containing zero or more URLs to which a background attributionsrc request will be made when the a is navigated.

area

attributionsrc - A string containing zero or more URLs to which a background attributionsrc request will be made when the area is navigated.

img

attributionsrc - A string containing zero or more URLs to which a background attributionsrc request will be made when set.

script

attributionsrc - A string containing zero or more URLs to which a background attributionsrc request will be made when set.

The IDL attribute attributionSrc must reflect the respective content attribute of the same name.

Whenever an img or a script element is created or element’s attributionSrc attribute is set or changed, run make background attributionsrc requests with element and "event-source-or-trigger" and the current state of element’s referrerpolicy content attribute or referrerpolicy content attribute.

More precisely specify which mutations are relevant for the attributionsrc attribute.

Modify update the image data as follows:

After the step

Set request’s priority to the current state...

add the step

1. If the element has an attributionsrc attribute, set request’s Attribution Reporting Eligibility to "event-source-or-trigger".

A script fetch options has an associated Attribution Reporting eligibility (an eligibility). Unless otherwise stated it is "unset".

Modify prepare the script element as follows:

After the step

Let fetch priority be the current state of el’s fetchpriority content attribute.

add the step

1. Let Attribution Reporting eligibility be "event-source-or-trigger" if el has an attributionsrc content attribute and "unset" otherwise.

Add "and Attribution Reporting eligibility is Attribution Reporting eligibility." to the step

Let options be a script fetch options whose...

Modify set up the classic script request and set up the module script request as follows:

Add "and its Attribution Reporting eligibility is options’s Attribution Reporting eligibility."

Modify follow the hyperlink as follows:

After the step

If subject’s link types includes...

add the steps

1. Let navigationSourceEligible be false.

2. If subject has an attributionsrc attribute:

   1. Set navigationSourceEligible to true.

   2. Make background attributionsrc requests with subject and "navigation-source", and referrerPolicy.

Add "and navigationSourceEligible set to navigationSourceEligible" to the step

Navigate targetNavigable...

2.2. Window open steps

Modify the tokenize the features argument as follows:

Replace the step

Collect a sequence of code points that are not feature separators code points from features given position. Set value to the collected code points, converted to ASCII lowercase.

with

Collect a sequence of code points that are not feature separators code points from features given position. Set value to the collected code points, converted to ASCII lowercase. Set originalCaseValue to the collected code points.

Replace the step

If name is not the empty string, then set tokenizedFeatures[name] to value.

with the steps

1. If name is not the empty string:

   1. Switch on name:

      "attributionsrc"

      Run the following steps:

      1. If tokenizedFeatures[name] does not exist, set tokenizedFeatures[name] to a new list.

      2. Append originalCaseValue to tokenizedFeatures[name].

      Anything else

      Set tokenizedFeatures[name] to value.

Modify the window open steps as follows:

After the step

Let tokenizedFeatures be the result of tokenizing features.

add the steps

1. Let navigationSourceEligible be false.

2. If tokenizedFeatures["attributionsrc"] exists:

   1. Assert: tokenizedFeatures["attributionsrc"] is a list.

   2. Set navigationSourceEligible to true.

   3. Set attributionSrcUrls to a new list.

   4. For each value of tokenizedFeatures["attributionsrc"]:

      1. If value is the empty string, continue.

      2. Let decodedSrcBytes be the result of percent-decoding value.

      3. Let decodedSrc be the UTF-8 decode without BOM of decodedSrcBytes.

      4. Parse decodedSrc relative to the entry settings object, and set urlRecord to the resulting URL record, if any. If parsing failed, continue.

      5. Append urlRecord to attributionSrcUrls.

Use attributionSrcUrls and referrerPolicy with make a background attributionsrc request.

In each step that calls navigate, set navigationSourceEligible to navigationSourceEligible.

2.3. Navigation monkeypatches

Add the following item to navigation params:

navigationSourceEligible

A boolean indicating whether the navigation can register a navigation source in its response. Defaults to false.

Modify navigate as follows:

Add an optional boolean parameter called navigationSourceEligible (default false).

In the step

Set navigationParams to a new navigation params with...

add the property

navigationSourceEligible

navigationSourceEligible

Use/propagate navigationSourceEligible to the navigation request's Attribution Reporting eligibility.

Enforce attribution-scope privacy limits.

3. Network monkeypatches

dictionary AttributionReportingRequestOptions {
  required boolean eventSourceEligible;
  required boolean triggerEligible;
};

partial dictionary RequestInit {
  AttributionReportingRequestOptions attributionReporting;
};

partial interface XMLHttpRequest {
  [SecureContext]
  undefined setAttributionReporting(AttributionReportingRequestOptions options);
};

A request has an associated Attribution Reporting eligibility (an eligibility). Unless otherwise stated it is "unset".

To get an eligibility from AttributionReportingRequestOptions given an AttributionReportingRequestOptions options:

1. Let eventSourceEligible be options’s eventSourceEligible.

2. Let triggerEligible be options’s triggerEligible.

3. If (eventSourceEligible, triggerEligible) is:

   (false, false)

   Return "empty".

   (false, true)

   Return "trigger".

   (true, false)

   Return "event-source".

   (true, true)

   Return "event-source-or-trigger".

Check permissions policy.

"Attribution-Reporting-Eligible" is a Dictionary Structured Header set on a request that indicates which registrations, if any, are allowed on the corresponding response. Its values are not specified and its allowed keys are:

"event-source"

An event source may be registered.

"navigation-source"

A navigation source may be registered.

"trigger"

A trigger may be registered.

"Attribution-Reporting-Support" is a Dictionary Structured Header set on a request that indicates which registrars, if any, the corresponding response can use. Its values are not specified and its allowed keys are the registrars.

To obtain a dictionary structured header value given a list of strings keys and a set of strings allowedKeys:

1. For each key of allowedKeys, optionally append the concatenation of « "not-", key » to keys.

2. Optionally, shuffle keys.

3. Let entries be a new list.

4. For each key of keys:

   1. Let value be true.

   2. Optionally, set value to a token corresponding to one of strings in allowedKeys.

   3. Let params be a new map.

   4. For each key of allowedKeys, optionally set params[key] to an arbitrary bare item.

   5. Append a structured dictionary member with the key key, the value value, and the parameters params to entries.

5. Return a dictionary containing entries.

Note: The user agent MAY "grease" the dictionary structured headers according to the preceding algorithm to help ensure that recipients use a proper structured header parser, rather than naive string equality or contains operations, which makes it easier to introduce backwards-compatible changes to the header definition in the future. Including the allowed keys as dictionary values or parameters helps ensure that only the dictionary’s keys are interpreted by the recipient. Likewise, shuffling the dictionary members helps ensure that, e.g., "key1, key2" is treated equivalently to "key2, key1".

In the following example, only the "trigger" key should be interpreted by the recipient after the header has been parsed as a structured dictionary:

EXAMPLE: Greased Attribution-Reporting-Eligible header
Attribution-Reporting-Eligible: not-event-source, trigger=event-source;navigation-source=3

In the following example, only the "os" key should be interpreted by the recipient after the header has been parsed as a structured dictionary:

EXAMPLE: Greased Attribution-Reporting-Support header
Attribution-Reporting-Support: os=web

To set Attribution Reporting headers given a request request:

1. Let headers be request’s header list.

2. Let eligibility be request’s Attribution Reporting eligibility.

3. Delete "Attribution-Reporting-Eligible" from headers.

4. Delete "Attribution-Reporting-Support" from headers.

5. If eligibility is "unset", return.

6. Let keys be a new list.

7. If eligibility is:

   "empty"

   Do nothing.

   "event-source"

   Append "event-source" to keys.

   "navigation-source"

   Append "navigation-source" to keys.

   "trigger"

   Append "trigger" to keys.

   "event-source-or-trigger"

   Append "event-source" and "trigger" to keys.

8. Let supportedRegistrars be the result of getting supported registrars.

9. If supportedRegistrars is empty, clear keys.

10. Let eligibleDict be the result of obtaining a dictionary structured header value with keys and the set containing all the eligible keys.

11. Set a structured field value given ("Attribution-Reporting-Eligible", eligibleDict) in headers.

12. Let supportDict be the result of obtaining a dictionary structured header value with supportedRegistrars and the set containing all the registrars.

13. Set a structured field value given ("Attribution-Reporting-Support", supportDict) in headers.

3.1. Fetch monkeypatches

Modify fetch as follows:

After the step

If request’s header list does not contain Accept...

add the step

1. Set Attribution Reporting headers with request.

Modify Request(input, init) as follows:

In the step

Set request to a new request with the following properties:

add the property

Attribution Reporting eligibility

request’s Attribution Reporting eligibility.

After the step

If init["priority"] exists, then:

add the step

1. If init["attributionReporting"] exists, then set request’s Attribution Reporting eligibility to the result of get an eligibility from AttributionReportingRequestOptions with it.

3.2. XMLHttpRequest monkeypatches

An XMLHttpRequest object has an associated Attribution Reporting eligibility (an eligibility). Unless otherwise stated it is "unset".

The setAttributionReporting(options) method must run these steps:

1. If this’s state is not opened, then throw an "InvalidStateError" DOMException.

2. If this’s send() flag is set, then throw an "InvalidStateError" DOMException.

3. Set this’s Attribution Reporting eligibility to the result of get an eligibility from AttributionReportingRequestOptions with options.

Modify send(body) as follows:

Add a Document parameter called document.

After the step:

Let req be a new request, initialized as follows...

Add the step:

1. Set req’s Attribution Reporting eligibility to this’s Attribution Reporting eligibility.

2. Set Attribution Reporting headers with req and document’s context origin.

4. Permissions Policy integration

This specification defines a policy-controlled feature identified by the string "attribution-reporting". Its default allowlist is *.

5. Clear Site Data integration

In clear DOM-accessible storage for origin, add the following step:

7. Run clear site data with origin.

To clear site data given an origin origin:

1. For each attribution source source of the attribution source cache:

   1. If source’s reporting origin and origin are same origin, remove source from the attribution source cache.

2. For each event-level report report of the event-level report cache:

   1. If report’s reporting origin and origin are same origin, remove report from the event-level report cache.

3. For each aggregatable attribution report report of the aggregatable attribution report cache:

   1. If report’s reporting origin and origin are same origin, remove report from the aggregatable attribution report cache.

Note: We deliberately do not remove matching entries from the attribution rate-limit cache and aggregatable debug rate-limit cache, as doing so would allow a site to reset and therefore exceed the intended rate limits at will.

6. Structures

6.1. Registration info

A registration info is a struct with the following items:

preferred platform (default null)

Null or a registrar.

report header errors (default false)

A boolean.

6.2. Trigger state

A trigger state is a struct with the following items:

trigger data

A non-negative 64-bit integer.

report window

A report window.

6.3. Randomized response output configuration

A randomized response output configuration is a struct with the following items:

max attributions per source

A positive integer.

trigger specs

A trigger spec map.

6.4. Randomized source response

A randomized source response is null or a list of trigger states.

6.5. Attribution filtering

A filter value is a set of strings.

A filter map is a map whose keys are strings and whose values are filter values.

A filter config is a struct with the following items:

map

A filter map.

lookback window

Null or a positive duration.

6.6. Suitable origin

A suitable origin is an origin that is suitable.

6.7. Source type

A source type is one of the following:

"navigation"

The source was associated with a top-level navigation.

"event"

The source was not associated with a top-level navigation.

6.8. Report window

A report window is a struct with the following items:

start

A moment.

end

A moment, strictly greater than start.

A report window list is a list of report windows. It has the following constraints:

• Elements are in ascending order based on their start.

• Every element’s start is equal to the previous element’s end, if it exists.

• There is at least one element in the list.

A report window list list’s total window is a report window struct with the following fields:

start

The start of list[0].

end

The end of list[list’s size - 1].

Note: The total window is conceptually a union of report windows, because there are no gaps in time between any of the windows.

6.9. Summary operator

A summary operator summarizes the triggers attributed to an attribution source. Its value is one of the following:

"count"

Number of triggers attributed.

"value_sum"

Sum of the value of triggers.

6.10. Summary bucket

A summary bucket is a struct with the following items:

start

An unsigned 32-bit integer.

end

An unsigned 32-bit integer.

A summary bucket list is a list of summary buckets. It has the following constraints:

• Elements are strictly in ascending order based on their start.

• Every element’s end is equal to the next element’s start - 1, if it exists.

• There is at least one element in the list.

6.11. Trigger-data matching mode

A trigger-data matching mode is one of the following:

"exact"

Trigger data must be less than the default trigger data cardinality. Otherwise, no event-level attribution takes place.

"modulus"

Trigger data is taken modulo the default trigger data cardinality.

6.12. Trigger specs

A trigger spec is a struct with the following items:

event-level report windows

A report window list.

A trigger spec map is a map whose keys are unsigned 32-bit integers and values are trigger specs.

To find a matching trigger spec given an attribution source source and an unsigned 64-bit integer triggerData:

1. Let specs be source’s trigger specs.

2. If source’s trigger-data matching mode is:

   "exact"

   Run the following steps:

   1. If specs[triggerData] exists, return its entry.

   2. Return an error.

   "modulus"

   Run the following steps:

   1. If specs is empty, return an error.

   2. Let keys be specs’s keys.

   3. Let index be the remainder when dividing triggerData by keys’s size.

   4. Return the entry for specs[keys[index]].

6.13. Aggregatable debug reporting config

An aggregatable debug reporting config is a struct with the following items:

key piece (default 0)

A non-negative 128-bit integer.

debug data (default an empty map)

A map whose keys are debug data types and whose values are aggregatable contributions.

aggregation coordinator (default default aggregation coordinator)

An aggregation coordinator.

6.14. Attribution scopes

An attribution scopes is a struct with the following items:

limit

A positive 32-bit integer representing the number of distinct values allowed per attribution destination for the source’s reporting origin.

values

A set of strings.

max event states

A positive integer representing the maximum number of trigger states for event sources per attribution destination for the source’s reporting origin.

6.15. Attribution source

An attribution source is a struct with the following items:

internal ID

An internal ID.

source origin

A suitable origin.

event ID

A non-negative 64-bit integer.

attribution destinations

A set of sites.

reporting origin

A suitable origin.

source type

A source type.

expiry

A duration.

trigger specs

A trigger spec map.

aggregatable report window

A report window.

priority

A 64-bit integer.

source time

A moment.

number of event-level reports

Number of event-level reports created for this attribution source.

max number of event-level reports

The maximum number of event-level reports that can be created for this attribution source.

event-level attributable (default true)

A boolean.

dedup keys

A set of dedup keys associated with this attribution source.

randomized response (default null)

A randomized source response.

randomized trigger rate (default 0)

A number between 0 and 1 (both inclusive).

event-level epsilon

A double.

filter data

A filter map.

debug key

Null or a non-negative 64-bit integer.

aggregation keys

A map whose keys are strings and whose values are non-negative 128-bit integers.

remaining aggregatable attribution budget

A non-negative integer.

named budgets

A map whose keys are strings and whose values are non-negative integers.

remaining named budgets

A map whose keys are strings and whose values are non-negative integers.

aggregatable dedup keys

A set of aggregatable dedup key values associated with this attribution source.

debug reporting enabled

A boolean.

number of aggregatable attribution reports

Number of aggregatable attribution reports created for this attribution source.

trigger-data matching mode

A trigger-data matching mode.

cookie-based debug allowed (default false)

A boolean.

fenced

A boolean.

remaining aggregatable debug budget

A non-negative integer.

number of aggregatable debug reports

Number of aggregatable debug reports created for this attribution source.

aggregatable debug reporting config

An aggregatable debug reporting config.

destination limit priority

A 64-bit integer.

attribution scopes (default null)

Null or an attribution scopes.

An attribution source source’s expiry time is source’s source time + source’s expiry.

An attribution source source’s source site is the result of obtaining a site from source’s source origin.

6.16. Aggregatable trigger data

An aggregatable trigger data is a struct with the following items:

key piece

A non-negative 128-bit integer.

source keys

A set of strings.

filters

A list of filter configs.

negated filters

A list of filter configs.

6.17. Aggregatable values configuration

An aggregatable key value is a struct with the following items:

value

A non-negative 32-bit integer.

filtering ID

A non-negative integer.

An aggregatable values configuration is a struct with the following items:

values

A map whose keys are strings and whose values are aggregatable key values.

filters

A list of filter configs.

negated filters

A list of filter configs.

6.18. Aggregatable dedup key

An aggregatable dedup key is a struct with the following items:

dedup key

Null or a non-negative 64-bit integer.

filters

A list of filter configs.

negated filters

A list of filter configs.

6.19. Named budget

A named budget is a struct with the following items:

name

Null or a string.

filters

A list of filter configs.

negated filters

A list of filter configs.

6.20. Event-level trigger configuration

An event-level trigger configuration is a struct with the following items:

trigger data

A non-negative 64-bit integer.

dedup key

Null or a non-negative 64-bit integer.

priority

A 64-bit integer.

filters

A list of filter configs.

negated filters

A list of filter configs.

value

A positive unsigned 32-bit integer.

6.21. Aggregation coordinator

An aggregation coordinator is one of a user-agent-determined set of suitable origins that specifies which aggregation service deployment to use.

6.22. Aggregatable source registration time configuration

An aggregatable source registration time configuration is one of the following:

"exclude"

"source_registration_time" is excluded from an aggregatable attribution report's shared info.

"include"

"source_registration_time" is included in an aggregatable attribution report's shared info.

6.23. Attribution trigger

An attribution trigger is a struct with the following items:

attribution destination

A site.

trigger time

A moment.

reporting origin

A suitable origin.

filters

A list of filter configs.

negated filters

A list of filter configs.

debug key

Null or a non-negative 64-bit integer.

event-level trigger configurations

A set of event-level trigger configuration.

aggregatable trigger data

A list of aggregatable trigger data.

aggregatable values configurations

A list of aggregatable values configuration.

aggregatable dedup keys

A list of aggregatable dedup key.

debug reporting enabled

A boolean.

aggregation coordinator

An aggregation coordinator.

aggregatable source registration time configuration

An aggregatable source registration time configuration.

trigger context ID

Null or a string.

fenced

A boolean.

aggregatable filtering ID max bytes

A positive integer.

aggregatable debug reporting config

An aggregatable debug reporting config.

attribution scopes

A set of strings.

named budgets

A list of named budgets.

6.24. Attribution report

An attribution report is a struct with the following items:

reporting origin

A suitable origin.

report time

A moment.

external ID

A UUID formatted as a string.

internal ID

An internal ID.

An attribution debug info is a tuple with the following items:

source debug key

Null or a non-negative 64-bit integer.

trigger debug key

Null or a non-negative 64-bit integer.

6.25. Event-level report

An event-level report is an attribution report with the following additional items:

event ID

A non-negative 64-bit integer.

source type

A source type.

trigger data

A non-negative 64-bit integer.

randomized trigger rate

A number between 0 and 1 (both inclusive).

trigger priority

A 64-bit integer.

trigger time

A moment.

source ID

A string.

attribution destinations

A set of sites.

attribution debug info

An attribution debug info.

6.26. Aggregatable report

An aggregatable contribution is a struct with the following items:

key

A non-negative 128-bit integer.

value

A non-negative 32-bit integer.

filtering ID

A non-negative integer.

An aggregatable report is an attribution report with the following additional items:

contributions

A list of aggregatable contributions.

effective attribution destination

A site.

aggregation coordinator

An aggregation coordinator.

An aggregatable attribution report is an aggregatable report with the following additional items:

source time

A moment.

source registration time configuration

An aggregatable source registration time configuration.

is null report (default false)

A boolean.

trigger context ID

Null or a string.

filtering ID max bytes

A positive integer.

attribution debug info

An attribution debug info.

source ID

Null or a string.

An aggregatable debug report is an aggregatable report.

6.27. Attribution rate-limits

A rate-limit scope is one of the following:

• "source"
• "event-attribution"
• "aggregatable-attribution"

An attribution rate-limit record is a struct with the following items:

scope

A rate-limit scope.

source site

A site.

attribution destination

A site.

reporting origin

A suitable origin.

time

A moment.

expiry time

Null or a moment.

entity ID

Null for fake reports or an internal ID for an event-level report, aggregatable attribution report, or attribution source.

deactivated for unexpired destination limit (default false)

A boolean.

destination limit priority (default null)

Null or a 64-bit integer.

6.28. Aggregatable debug rate-limits

An aggregatable debug rate-limit record is a struct with the following items:

context site

A site.

reporting site

A site.

time

A moment.

consumed budget

A positive integer.

6.29. Attribution debug data

A debug data type is a non-empty string that specifies the set of data that is contained in a verbose debug report or in an aggregatable debug report.

A source debug data type is a debug data type for source registrations. Possible values are:

• "source-channel-capacity-limit"
• "source-destination-global-rate-limit"
• "source-destination-limit"
• "source-destination-limit-replaced"
• "source-destination-per-day-rate-limit"
• "source-destination-rate-limit"
• "source-max-event-states-limit"
• "source-noised"
• "source-reporting-origin-limit"
• "source-reporting-origin-per-site-limit"
• "source-scopes-channel-capacity-limit"
• "source-storage-limit"
• "source-success"
• "source-trigger-state-cardinality-limit"
• "source-unknown-error"

A trigger debug data type is a debug data type for trigger registrations. Possible values are:

• "trigger-aggregate-attributions-per-source-destination-limit"
• "trigger-aggregate-deduplicated"
• "trigger-aggregate-excessive-reports"
• "trigger-aggregate-insufficient-budget"
• "trigger-aggregate-insufficient-named-budget"
• "trigger-aggregate-no-contributions"
• "trigger-aggregate-report-window-passed"
• "trigger-aggregate-storage-limit"
• "trigger-event-attributions-per-source-destination-limit"
• "trigger-event-deduplicated"
• "trigger-event-excessive-reports"
• "trigger-event-low-priority"
• "trigger-event-no-matching-configurations"
• "trigger-event-no-matching-trigger-data"
• "trigger-event-noise"
• "trigger-event-report-window-not-started"
• "trigger-event-report-window-passed"
• "trigger-event-storage-limit"
• "trigger-no-matching-filter-data"
• "trigger-no-matching-source"
• "trigger-reporting-origin-limit"
• "trigger-unknown-error"

An OS debug data type is a debug data type for OS registrations. Possible values are:

• "os-source-delegated"
• "os-trigger-delegated"

A header errors debug data type is a debug data type for registration header errors. Possible values are:

• "header-parsing-error"

6.30. Verbose debug report

A verbose debug data is a struct with the following items:

data type

A debug data type.

body

A map whose fields are determined by the data type.

A verbose debug report is a struct with the following items:

data

A list of verbose debug data.

reporting origin

A suitable origin.

6.31. Triggering result

A triggering status is one of the following:

• "dropped"
• "noised"
• "attributed"

Note: "noised" only applies for triggering event-level attribution when it is attributed successfully but dropped as the noise was applied to the source.

A trigger debug data is a tuple with the following items:

data type

A trigger debug data type.

report

Null or an attribution report.

A triggering result is a tuple with the following items:

status

A triggering status.

debug data

Null or a trigger debug data.

6.32. Destination rate-limit result

A destination rate-limit result is one of the following:

• "allowed"
• "hit global limit"
• "hit reporting limit"

7. Storage

A user agent holds an attribution source cache, which is a set of attribution sources.

A user agent holds an event-level report cache, which is a set of event-level reports.

A user agent holds an aggregatable attribution report cache, which is a set of aggregatable attribution reports.

A user agent holds an attribution rate-limit cache, which is a set of attribution rate-limit records.

A user agent holds an aggregatable debug rate-limit cache, which is a set of aggregatable debug rate-limit records.

The above caches are collectively known as the attribution caches. The attribution caches are shared among all environment settings objects.

Note: This would ideally use storage bottles to provide access to the attribution caches. However attribution data is inherently cross-site, and operations on storage would need to span across all storage bottle maps.

An internal ID is an integer.

To get the next internal ID, return an internal ID strictly greater than any previously returned by this algorithm. The user agent MAY reset this sequence when no attribution cache entry contains an internal ID.

8. Constants

Valid source expiry range is a 2-tuple of positive durations that controls the minimum and maximum value that can be used as an expiry, respectively. Its value is (1 day, 30 days).

Min report window is a positive duration that controls the minimum duration from an attribution source’s source time and any end in aggregatable report window or event-level report windows. Its value is 1 hour.

Max entries per filter data is a positive integer that controls the maximum size of an attribution source's filter data. Its value is 50.

Max values per filter data entry is a positive integer that controls the maximum size of each value of an attribution source's filter data. Its value is 50.

Max length per filter string is a positive integer that controls the maximum length of an attribution source's filter data's keys and its values's items. Its value is 25.

Attribution rate-limit window is a positive duration that controls the rate-limiting window for attribution. Its value is 30 days.

Max destinations per source is a positive integer that controls the maximum size of an attribution source's attribution destinations. Its value is 3.

Max settable event-level attributions per source is a positive integer that controls the maximum value of max number of event-level reports. Its value is 20.

Max settable event-level report windows is a positive integer that controls the maximum size of event-level report windows. Its value is 5.

Default event-level attributions per source is a map that controls how many times a single attribution source can create an event-level report by default. Its value is «[ navigation → 3, event → 1 ]».

Allowed aggregatable budget per source is a positive integer that controls the total required aggregatable budget of all aggregatable reports created for an attribution source. Its value is 65536.

Max aggregation keys per source registration is a positive integer that controls the maximum size of an attribution source's aggregation keys. Its value is 20.

Max length per aggregation key identifier is a positive integer that controls the maximum length of an attribution source's aggregation keys's keys. Its value is 25.

Default trigger data cardinality is a map that controls the valid range of trigger data. Its value is «navigation → 8, event → 2».

Max distinct trigger data per source is a positive integer that controls the maximum size of a trigger spec map for an attribution source. Its value is 32.

Max length per trigger context ID is a positive integer that controls the maximum length of an attribution trigger's trigger context ID. Its value is 64.

Default filtering ID value is a non-negative integer. Its value is 0. It is the default value for flexible contribution filtering of aggregatable reports.

Default filtering ID max bytes is a positive integer that controls the max bytes used if none is explicitly chosen. Its value is 1. The max bytes value limits the size of filtering IDs within an aggregatable attribution report.

Valid filtering ID max bytes range is a set of positive integers that controls the allowable values of max bytes. Its value is the range 1 to 8, inclusive.

Max contributions per aggregatable debug report is a positive integer that controls the maximum size of an aggregatable debug report's contributions. Its value is 2.

Aggregatable debug rate-limit window is a positive duration that controls the rate-limiting window for aggregatable debug reporting. Its value is 1 day.

Max aggregatable debug budget per rate-limit window is a tuple consisting of two positive integers. The first controls the total required aggregatable budget of all aggregatable debug reports with a given context site per aggregatable debug rate-limit window. The second controls the total required aggregatable budget of all aggregatable debug reports with a given (context site, reporting site) per aggregatable debug rate-limit window. Its value is (2²⁰, 65536).

Default max event states is a positive integer that controls the default max event states. Its value is 3.

Max length of attribution scope for source is a positive integer that controls the maximum length of an attribution scope from an attribution source's values. Its value is 50.

Max attribution scopes per source is a positive integer that controls the maximum size of an attribution source's values. Its value is 20.

Max length per budget name for source is a positive integer that controls the maximum length of keys of an attribution source's named budgets and remaining named budgets. Its value is 25.

Max named budgets per source registration is a positive integer that controls the maximum size of an attribution source's remaining named budgets and named budgets. Its value is 25.

9. Vendor-Specific Values

Max pending sources per source origin is a positive integer that controls how many attribution sources can be in the attribution source cache per source origin.

Max settable event-level epsilon is a non-negative double that controls the default and maximum values that a source registration can specify for the epsilon parameter used by compute the channel capacity of a source and obtain a randomized source response.

Max trigger-state cardinality is a positive integer that controls the maximum size of the set of possible trigger states for any one attribution source.

Randomized null attribution report rate excluding source registration time is a double between 0 and 1 (both inclusive) that controls the randomized number of null attribution reports generated for an attribution trigger whose aggregatable source registration time configuration is "exclude". If automation local testing mode is true, this is 0.

Randomized null attribution report rate including source registration time is a double between 0 and 1 (both inclusive) that controls the randomized number of null attribution reports generated for an attribution trigger whose aggregatable source registration time configuration is "include". If automation local testing mode is true, this is 0.

Max event-level reports per attribution destination is a positive integer that controls how many event-level reports can be in the event-level report cache per site in attribution destinations.

Max aggregatable attribution reports per attribution destination is a positive integer that controls how many aggregatable attribution reports can be in the aggregatable attribution report cache per effective attribution destination.

Max event-level channel capacity per source is a map that controls how many bits of information can be exposed associated with a single attribution source. The keys are «navigation, event». The values are non-negative doubles.

Max event-level attribution scopes channel capacity per source is a map that controls how many bits of information can be exposed due to attribution scopes for a single attribution source. The keys are «navigation, event». The values are non-negative doubles.

Max aggregatable reports per source is a tuple consisting of two positive integers. The first controls how many aggregatable attribution reports can be created by attribution triggers attributed to a single attribution source. The second controls how many aggregatable debug reports can be created for an attribution source.

Max destinations covered by unexpired sources is a positive integer that controls the maximum number of distinct sites across all attribution destinations for unexpired attribution sources with a given (source site, reporting origin site).

Destination rate-limit window is a positive duration that controls the rate-limiting window for destinations.

Max destinations per rate-limit window is a tuple consisting of two integers. The first controls the maximum number of distinct sites across all attribution destinations for attribution sources with a given source site per destination rate-limit window. The second controls the maximum number of distinct sites across all attribution destinations for attribution sources with a given (source site, reporting origin site) per destination rate-limit window.

Max destinations per source reporting site per day is an integer that controls the maximum number of distinct sites across all attribution destinations for attribution sources with a given (source site, reporting origin site) per day.

Max source reporting origins per rate-limit window is a positive integer that controls the maximum number of distinct reporting origins for a (source site, attribution destination) that can create attribution sources per attribution rate-limit window.

Max source reporting origins per source reporting site is a positive integer that controls the maximum number of distinct reporting origins for a (source site, reporting origin site) that can create attribution sources per origin rate-limit window.

Origin rate-limit window is a positive duration that controls the rate-limiting window for max source reporting origins per source reporting site.

Max attribution reporting origins per rate-limit window is a positive integer that controls the maximum number of distinct reporting origins for a (source site, attribution destination) that can create event-level reports per attribution rate-limit window.

Max attributions per rate-limit window is a positive integer that controls the maximum number of attributions for a (source site, attribution destination, reporting origin site) per attribution rate-limit window. This attribution limit is separate for event-level and aggregate reporting.

Randomized aggregatable attribution report delay is a positive duration that controls the random delay to deliver an aggregatable attribution report. If automation local testing mode is true, this is 0.

Default aggregation coordinator is the aggregation coordinator that controls how to obtain the public key for encrypting an aggregatable report by default.

10. General Algorithms

10.1. Serialize an integer

To serialize an integer, represent it as a string of the shortest possible decimal number.

This would ideally be replaced by a more descriptive algorithm in Infra. See infra/201

10.2. Parsing JSON fields

Note: The "Attribution-Reporting-Register-Source" and "Attribution-Reporting-Register-Trigger" response headers contain JSON-encoded data, rather than structured values, because of limitations on nesting in the latter. The recursive nature of JSON makes it more amenable to future extensions.

To parse an optional 64-bit signed integer given a map map, a string key, and a possibly null 64-bit signed integer default:

1. If map[key] does not exist, return default.

2. If map[key] is not a string, return an error.

3. Let value be the result of applying the rules for parsing integers to map[key].

4. If value is an error, return an error.

5. If value cannot be represented by a 64-bit signed integer, return an error.

6. Return value.

To parse an optional 64-bit unsigned integer given a map map, a string key, and a possibly null 64-bit unsigned integer default:

1. If map[key] does not exist, return default.

2. If map[key] is not a string, return an error.

3. Let value be the result of applying the rules for parsing non-negative integers to map[key].

4. If value is an error, return an error.

5. If value cannot be represented by a 64-bit unsigned integer, return an error.

6. Return value.

10.3. Serialize attribution destinations

To serialize attribution destinations destinations, run the following steps:

1. Assert: destinations is not empty.

2. Assert: destinations is sorted in ascending order, with a being less than b if a, serialized, is less than b, serialized.

3. Let destinationStrings be a list.

4. For each destination in destinations:

   1. Assert: destination is not an opaque origin.

   2. Append destination serialized to destinationStrings.

5. If destinationStrings’s size is equal to 1, return destinationStrings[0].

6. Return destinationStrings.

Note: destinations is required to be sorted to avoid revealing extra information about the original source registration, namely the order of the "destination" field in the original JSON registration, which can be used to distinguish semantically equivalent registrations.

To check if a scheme is suitable given a string scheme:

1. If scheme is "http" or "https", return true.

2. Return false.

To check if an origin is suitable given an origin origin:

1. If origin is not a potentially trustworthy origin, return false.

2. If origin’s scheme is not suitable, return false.

3. Return true.

10.4. Parsing filter data

To parse filter values given a value:

1. If value is not a map, return an error.

2. Let result be a new filter map.

3. For each filter → data of value:

   1. If filter starts with "_", return an error.

   2. If data is not a list, return an error.

   3. Let set be a new set.

   4. For each d of data:

      1. If d is not a string, return an error.

      2. Append d to set.

   5. Set result[filter] to set.

4. Return result.

To parse filter data given a value:

1. Let map be the result of running parse filter values with value.

2. If map is an error, return it.

3. If map’s size is greater than the max entries per filter data, return an error.

4. For each filter → set of map:

   1. If filter’s length is greater than the max length per filter string, return an error.

   2. If set’s size is greater than the max values per filter data entry, return an error.

   3. For each s of set:

      1. If s’s length is greater than the max length per filter string, return an error.

5. Return map.

To parse filter config given a value:

1. If value is not a map, return an error.

2. Let lookbackWindow be null.

3. If value["_lookback_window"] exists:

   1. If value["_lookback_window"] is not a positive integer, return an error.

   2. Set lookbackWindow to the duration of value["_lookback_window"] seconds.

   3. Remove value["_lookback_window"].

4. Let map be the result of running parse filter values with value.

5. If map is an error, return it.

6. Let filter be a filter config with the items:

   map

   map

   lookback window

   lookbackWindow

7. Return filter.

10.5. Parsing filters

To parse filters given a value:

1. Let filtersList be a new list.

2. If value is a map, then:

   1. Let filterConfig be the result of running parse filter config with value.

   2. If filterConfig is an error, return it.

   3. Append filterConfig to filtersList.

   4. Return filtersList.

3. If value is not a list, return an error.

4. For each data of value:

   1. Let filterConfig be the result of running parse filter config with data.

   2. If filterConfig is an error, return it.

   3. Append filterConfig to filtersList.

5. Return filtersList.

To parse a filter pair given a map map:

1. Let positive be a list of filter configs, initially empty.

2. If map["filters"] exists, set positive to the result of running parse filters with map["filters"].

3. If positive is an error, return it.

4. Let negative be a list of filter configs, initially empty.

5. If map["not_filters"] exists, set negative to the result of running parse filters with map["not_filters"].

6. If negative is an error, return it.

7. Return the tuple (positive, negative).

10.6. Parsing aggregation coordinator

To parse an aggregation coordinator given value:

1. If value is not a string, return an error.

2. Let url be the result of running the URL parser on value.

3. If url is failure or null, return an error.

4. If url’s origin is not an aggregation coordinator, return an error.

5. Return url’s origin.

10.7. Parsing aggregatable debug reporting config

An aggregatable-debug-reporting JSON key is one of the following:

• "aggregation_coordinator_origin"
• "debug_data"
• "key_piece"
• "types"
• "value"

To parse aggregatable debug reporting data given a dataList, a positive integer maxValue, and a set of debug data types supportedTypes:

1. Assert: maxValue is less than or equal to allowed aggregatable budget per source.

2. If dataList is not a list, return an error.

3. Let debugDataMap be a new map.

4. Let unknownTypes be a new set.

5. Let unspecifiedContribution be null.

6. For each data of dataList:

   1. If data is not a map, return an error.

   2. If data["key_piece"] does not exist, return an error.

   3. If data["key_piece"] is not a string, return an error.

   4. Let dataKeyPiece be the result of running parse an aggregation key piece with data["key_piece"].

   5. If dataKeyPiece is an error, return an error.

   6. If data["value"] does not exist, return an error.

   7. If data["value"] is not an integer or is less than or equal to 0 or is greater than maxValue, return an error.

   8. Let contribution be a new aggregatable contribution with the items:

      key

      dataKeyPiece

      value

      data["value"]

      filtering ID

      default filtering ID value

   9. If data["types"] does not exist, return an error.

   10. Let dataTypes be data["types"].

   11. If dataTypes is not a list or is empty, return an error.

   12. For each type of dataTypes:

       1. If type is not a string, return an error.

       2. If type is "unspecified":

          1. If unspecifiedContribution is not null, return an error.

          2. Set unspecifiedContribution to contribution.

          3. Continue.

       3. If supportedTypes contains type:

          1. If debugDataMap[type] exists, return an error.

          2. Set debugDataMap[type] to contribution.

       4. Otherwise:

          1. If unknownTypes contains type, return an error.

          2. Append type to unknownTypes.

7. If unspecifiedContribution is null, return debugDataMap.

8. For each type of supportedTypes:

   1. If debugDataMap[type] does not exist, set debugDataMap[type] to unspecifiedContribution.

9. Return debugDataMap.

To parse an aggregatable debug reporting config given a map map, a positive integer maxValue, a set of debug data types supportedTypes, and an aggregatable debug reporting config default:

1. If map["key_piece"] does not exist, return default.

2. If map["key_piece"] is not a string, return default.

3. Let keyPiece be the result of running parse an aggregation key piece with map["key_piece"].

4. If keyPiece is an error, return default.

5. Let debugDataMap be a new map.

6. If map["debug_data"] exists:

   1. Set debugDataMap to the result of running parse aggregatable debug reporting data with map["debug_data"], maxValue, and supportedTypes.

   2. If debugDataMap is an error, return default.

7. Let aggregationCoordinator be default aggregation coordinator.

8. If map["aggregation_coordinator_origin"] exists:

   1. Set aggregationCoordinator to the result of parsing an aggregation coordinator.

   2. If aggregationCoordinator is an error, return default.

9. Let aggregatableDebugReportingConfig be a new aggregatable debug reporting config with the items:

   key piece

   keyPiece

   debug data

   debugDataMap

   aggregation coordinator

   aggregationCoordinator

10. Return aggregatableDebugReportingConfig.

Note: The parsing errors are intentionally ignored in this algorithm with default returned to avoid data loss from the optional debug reporting feature.

10.8. Getting registration info

To get registration info from a header list given a header list headers:

1. If headers does not contain "Attribution-Reporting-Info", return a new registration info.

2. Let map be the result of getting "Attribution-Reporting-Info" from headers with a type of "dictionary".

3. If map is not a map, return an error.

4. Let preferredPlatform be null.

5. If map["preferred-platform"] exists:

   1. Let preferredPlatformValue be map["preferred-platform"][0].

   2. If preferredPlatformValue is not a registrar, return an error.

   3. Set preferredPlatform to preferredPlatformValue.

6. Let reportHeaderErrors be false.

7. If map["report-header-errors"] exists:

   1. Let reportHeaderErrorsValue be map["report-header-errors"][0].

   2. If reportHeaderErrorsValue is not a boolean, return an error.

   3. Set reportHeaderErrors to reportHeaderErrorsValue.

8. Let registrationInfo be a new registration info struct whose items are:

   preferred platform

   preferredPlatform

   report header errors

   reportHeaderErrors

9. Return registrationInfo.

Require preferredPlatformValue to be a token.

10.9. Cookie-based debugging

To check if cookie-based debugging is allowed given a suitable origin reportingOrigin and a site contextSite:

1. Assert: contextSite is not an opaque origin.

2. Let domain be the canonicalized domain name of reportingOrigin’s host.

3. Let contextDomain be the canonicalized domain name of contextSite’s host.

4. If the User Agent’s cookie policy or user controls do not allow cookie access for domain on contextDomain within a third-party context, return blocked.

5. Return allowed.

10.10. Obtaining context origin

To obtain the context origin of a node node, return node’s node navigable's top-level traversable's active document's origin.

10.11. Obtaining a randomized response

To obtain a randomized response given trueValue, a set possibleValues, and a double randomPickRate:

1. Assert: randomPickRate is between 0 and 1 (both inclusive).

2. Let r be a random double between 0 (inclusive) and 1 (exclusive) with uniform probability.

3. If r is less than randomPickRate, return a random item from possibleValues with uniform probability.

4. Otherwise, return trueValue.

10.12. Parsing aggregation key piece

To parse an aggregation key piece given a string input, perform the following steps. This algorithm will return either a non-negative 128-bit integer or an error.

1. If input’s code point length is not between 3 and 34 (both inclusive), return an error.

2. If the first character is not a U+0030 DIGIT ZERO (0), return an error.

3. If the second character is not a U+0058 LATIN CAPITAL LETTER X character (X) and not a U+0078 LATIN SMALL LETTER X character (x), return an error.

4. Let value be the code point substring from 2 to the end of input.

5. If the characters within value are not all ASCII hex digits, return an error.

6. Interpret value as a hexadecimal number and return as a non-negative 128-bit integer.

10.13. Should processing be blocked by reporting-origin limit

Given an attribution rate-limit record newRecord:

1. Let max be max source reporting origins per rate-limit window.

2. Let scopeSet be « "source" ».

3. If newRecord’s scope is "event-attribution" or "aggregatable-attribution":

   1. Set max to max attribution reporting origins per rate-limit window.

   2. Set scopeSet to « "event-attribution", "aggregatable-attribution" ».

4. Let matchingRateLimitRecords be all attribution rate-limit records record in the attribution rate-limit cache where all of the following are true:

   • scopeSet contains record’s scope

   • record’s source site and newRecord’s source site are equal

   • record’s attribution destination and newRecord’s attribution destination are equal

   • The duration from record’s time and newRecord’s time is <= attribution rate-limit window

5. Let distinctReportingOrigins be the set of all reporting origin in matchingRateLimitRecords, unioned with «newRecord’s reporting origin».

6. If distinctReportingOrigins’s size is greater than max, return blocked.

7. Return allowed.

10.14. Can attribution rate-limit record be removed

Given an attribution rate-limit record record and a moment now:

1. If the duration from record’s time and now is <= attribution rate-limit window , return false.

2. If record’s scope is "event-attribution" or "aggregatable-attribution", return true.

3. If record’s expiry time is after now, return false.

4. Return true.

10.15. Obtaining and delivering a verbose debug report

To obtain and deliver a verbose debug report given a list of verbose debug data data, a suitable origin reportingOrigin, and a boolean fenced:

1. If fenced is true, return.

2. Let debugReport be a verbose debug report with the items:

   data

   data

   reporting origin

   reportingOrigin

3. Queue a task to attempt to deliver a verbose debug report with debugReport.

10.16. Making a background attributionsrc request

An eligibility is one of the following:

"unset"

Depending on context, a trigger may or may not be registered.

"empty"

Neither a source nor a trigger may be registered.

"event-source"

An event source may be registered.

"navigation-source"

A navigation source may be registered.

"trigger"

A trigger may be registered.

"event-source-or-trigger"

An event source or a trigger may be registered.

To validate a background attributionsrc eligibility given an eligibility eligibility:

1. Assert: eligibility is "navigation-source" or "event-source-or-trigger".

To make a background attributionsrc request given a URL url, an origin contextOrigin, an eligibility eligibility, a boolean fenced, a Document document, and a referrer policy referrerPolicy:

1. Validate eligibility.

2. If url’s origin is not suitable, return.

3. If contextOrigin is not suitable, return.

4. Let context be document’s relevant settings object.

5. If context is not a secure context, return.

6. If document is not allowed to use the "attribution-reporting" feature, return.

7. Let supportedRegistrars be the result of getting supported registrars.

8. If supportedRegistrars is empty, return.

9. Let request be a new request with the following properties:

   method

   "GET"

   URL

   url

   keepalive

   true

   Attribution Reporting eligibility

   eligibility

   referrer policy

   referrerPolicy

10. Fetch request with processResponse being process an attributionsrc response with contextOrigin, eligibility, and fenced.

Audit other properties on request and set them properly.

Support header-processing on redirects. Due to atomic HTTP redirect handling, we cannot process registrations through integration with fetch. [Issue #839]

Check for transient activation with "navigation-source".

To make background attributionsrc requests given an HTMLAttributionSrcElementUtils element, an eligibility eligibility, and a referrer policy referrerPolicy:

1. Let attributionSrc be element’s attributionSrc.

2. Let tokens be the result of splitting attributionSrc on ASCII whitespace.

3. For each token of tokens:

   1. Parse token, relative to element’s node document. If that is not successful, continue. Otherwise, let url be the resulting URL record.

   2. Let fenced be true if element’s node navigable is a fenced navigable, false otherwise.

   3. Run make a background attributionsrc request with url, element’s context origin, eligibility, fenced, element’s node document, and referrerPolicy.

Consider allowing the user agent to limit the size of tokens.

To process an attributionsrc response given a suitable origin contextOrigin, an eligibility eligibility, a boolean fenced, and a response response:

1. Validate eligibility.

2. Run process an attribution eligible response with contextOrigin, eligibility, fenced, and response.

To get the registration platform given a header value or null webHeader, a header value or null osHeader, and a registrar or null preferredPlatform:

1. If webHeader and osHeader are both null, return null.

2. If preferredPlatform is null:

   1. If webHeader and osHeader are both not null, return null.

   2. If webHeader is not null and the user agent supports web registrations, return "web".

   3. If osHeader is not null and the user agent supports OS registrations, return "os".

   4. Return null.

3. If preferredPlatform is:

   "web"

   1. If webHeader is null, return null.

   2. If the user agent supports web registrations, return "web".

   3. If osHeader is not null and the user agent supports OS registrations, return "os".

   4. Return null.

   "os"

   1. If osHeader is null, return null.

   2. If the user agent supports OS registrations, return "os".

   3. If webHeader is not null and the user agent supports web registrations, return "web".

   4. Return null.

To process an attribution source response given a suitable origin contextOrigin, a suitable origin reportingOrigin, a source type sourceType, a header value or null webSourceHeader, a header value or null osSourceHeader, a registration info registrationInfo, and a boolean fenced:

1. Let platform be the result of get the registration platform with webSourceHeader, osSourceHeader, and registrationInfo’s preferred platform.

2. If platform is null, return.

3. Let reportHeaderErrors be registrationInfo’s report header errors.

4. If platform is:

   "web"

   1. Let source be the result of running parse source-registration JSON with webSourceHeader, contextOrigin, reportingOrigin, sourceType, current wall time, and fenced.

   2. If source is an error:

      1. If reportHeaderErrors is true, run obtain and deliver debug reports on registration header errors with "Attribution-Reporting-Register-Source", webSourceHeader, reportingOrigin, contextOrigin, and fenced.

      2. Return.

   3. If sourceType is "navigation", enforce the attribution-scope privacy limit.

   4. Process source.

   "os"

   1. Let osSourceRegistrations be the result of running get OS registrations from a header value with osSourceHeader.

   2. If osSourceRegistrations is an error:

      1. If reportHeaderErrors is true, run obtain and deliver debug reports on registration header errors with "Attribution-Reporting-Register-OS-Source", osSourceHeader, reportingOrigin, contextOrigin, and fenced.

      2. Return.

   3. Process osSourceRegistrations according to an implementation-defined algorithm.

   4. Run obtain and deliver debug reports on OS registrations with "os-source-delegated", osSourceRegistrations, contextOrigin, and fenced.

To process an attribution trigger response given a suitable origin contextOrigin, a suitable origin reportingOrigin, a response response, a header value or null webTriggerHeader, a header value or null osTriggerHeader, a registration info registrationInfo, and a boolean fenced:

1. Let platform be the result of get the registration platform with webTriggerHeader, osTriggerHeader, and registrationInfo’s preferred platform.

2. If platform is null, return.

3. Let reportHeaderErrors be registrationInfo’s report header errors.

4. If platform is:

   "web"

   1. Let destinationSite be the result of obtaining a site from contextOrigin.

   2. Let trigger be the result of running create an attribution trigger with webTriggerHeader destinationSite, reportingOrigin, current wall time, and fenced.

   3. If trigger is an error:

      1. If reportHeaderErrors is true, run obtain and deliver debug reports on registration header errors with "Attribution-Reporting-Register-Trigger", webTriggerHeader, reportingOrigin, contextOrigin, and fenced.

      2. Return.

   4. Maybe defer and then complete trigger attribution with trigger.

   "os"

   1. Let osTriggerRegistrations be the result of running get OS registrations from a header value with osTriggerHeader.

   2. If osTriggerRegistrations is an error:

      1. If reportHeaderErrors is true, run obtain and deliver debug reports on registration header errors with "Attribution-Reporting-Register-OS-Trigger", osTriggerHeader, reportingOrigin, contextOrigin, and fenced.

      2. Return.

   3. Process osTriggerRegistrations according to an implementation-defined algorithm.

   4. Run obtain and deliver debug reports on OS registrations with "os-trigger-delegated", osTriggerRegistrations, contextOrigin, and fenced.

To process an attribution eligible response given a suitable origin contextOrigin, an eligibility eligibility, a boolean fenced, and a response response:

1. The user-agent MAY ignore the response; if so, return.

   Note: The user-agent may prevent attribution for a number of reasons, such as user opt-out. In these cases, it is preferred to abort the API flow at response time rather than at request time so this state is not immediately detectable. Attribution may also be blocked if the reporting origin is not enrolled.

2. Queue a task on the networking task source to proceed with the following steps.

   Note: This algorithm can be invoked from while in parallel.

3. Assert: eligibility is "navigation-source" or "event-source" or "event-source-or-trigger".

4. Let reportingOrigin be response’s URL's origin.

5. If reportingOrigin is not suitable, return.

6. Let sourceHeader be the result of getting "Attribution-Reporting-Register-Source" from response’s header list.

7. Let triggerHeader be the result of getting "Attribution-Reporting-Register-Trigger" from response’s header list.

8. Let osSourceHeader be the result of getting "Attribution-Reporting-Register-OS-Source" from response’s header list.

9. Let osTriggerHeader be the result of getting "Attribution-Reporting-Register-OS-Trigger" from response’s header list.

10. Let registrationInfo be the result of getting registration info from response’s header list.

11. If registrationInfo is an error, return.

12. If eligibility is:

    "navigation-source"

    "event-source"

    Run the following steps:

    1. Let sourceType be "navigation".

    2. If eligibility is "event-source", set sourceType to "event".

    3. Run process an attribution source response with contextOrigin, reportingOrigin, sourceType, sourceHeader, osSourceHeader, and registrationInfo.

    "event-source-or-trigger"

    Run the following steps:

    1. Let hasSourceRegistration be false.

    2. If sourceHeader or osSourceHeader is not null, set hasSourceRegistration to true.

    3. Let hasTriggerRegistration be false.

    4. If triggerHeader or osTriggerHeader is not null, set hasTriggerRegistration to true.

    5. If both hasSourceRegistration and hasTriggerRegistration are true, return.

    6. If hasSourceRegistration is true:

       1. Run process an attribution source response with contextOrigin, reportingOrigin, "event", sourceHeader, osSourceHeader, registrationInfo, and fenced.

    7. If hasTriggerRegistration is true:

       1. Run process an attribution trigger response with contextOrigin, reportingOrigin, response, triggerHeader, osTriggerHeader, registrationInfo, and fenced.

To obtain and deliver debug reports on registration header errors given a header name headerName, a header value headerValue, a suitable origin reportingOrigin, a suitable origin contextOrigin, and a boolean fenced:

1. Let contextSite be the result of obtaining a site from contextOrigin.

2. Let body be a new map with the following key/value pairs:

   "context_site"

   contextSite, serialized.

   "header"

   headerName.

   "value"

   headerValue.

3. Let data be a new verbose debug data with the items:

   data type

   "header-parsing-error"

   body

   body

4. Run obtain and deliver a verbose debug report with « data », reportingOrigin, and fenced.

Note: The user agent may optionally include error details of any type in body["error"].

10.17. Attribution debugging

To check if attribution debugging can be enabled given an attribution debug info debugInfo:

1. If debugInfo’s source debug key is null, return false.

2. If debugInfo’s trigger debug key is null, return false.

3. Return true.

To serialize an attribution debug info given a map data and an attribution debug info debugInfo:

1. If the result of checking if attribution debugging can be enabled with debugInfo is false, return.

2. Set data["source_debug_key"] to debugInfo’s source debug key, serialized.

3. Set data["trigger_debug_key"] to debugInfo’s trigger debug key, serialized.

Note: We require both source and trigger debug keys to be present to avoid a privacy leak from one-sided third-party cookie access.

10.18. Obtaining and delivering an aggregatable debug report

To check if aggregatable debug reporting should be blocked by rate-limit given an aggregatable debug rate-limit record newRecord:

1. Let matchingRecords be all aggregatable debug rate-limit records record of aggregatable debug rate-limit cache where all of the following are true:

   • record’s context site and newRecord’s context site are equal

   • The duration from record’s time and newRecord’s time is <= aggregatable debug rate-limit window

2. Let totalBudget be newRecord’s consumed budget.

3. Let totalSameReportingBudget be totalBudget.

4. For each record of matchingRecords:

   1. Increment totalBudget value by record’s consumed budget.

   2. If record’s reporting site and newRecord’s reporting site are equal, increment totalSameReportingBudget by record’s consumed budget.

5. If totalBudget is greater than max aggregatable debug budget per rate-limit window[0], return blocked.

6. If totalSameReportingBudget is greater than max aggregatable debug budget per rate-limit window[1], return blocked.

7. Return allowed.

To obtain and deliver an aggregatable debug report given a list of aggregatable contributions contributions, a suitable origin reportingOrigin, a site effectiveDestination, an aggregation coordinator aggregationCoordinator, and a moment now:

1. Assert: effectiveDestination is not an opaque origin.

2. Let report be a new aggregatable debug report with the items:

   reporting origin

   reportingOrigin

   effective attribution destination

   effectiveDestination

   report time

   now

   external ID

   The result of generating a random UUID

   internal ID

   The result of getting the next internal ID

   contributions

   contributions

   aggregation coordinator

   aggregationCoordinator

3. Queue a task to attempt to deliver an aggregatable debug report with report.

To obtain and deliver an aggregatable debug report on registration given a list contributions, a site contextSite, an origin reportingOrigin, a possibly null attribution source source, a site effectiveDestination, an aggregation coordinator aggregationCoordinator, and a moment now:

1. If contributions is empty:

   1. Run obtain and deliver an aggregatable debug report with «», contextSite, reportingOrigin, effectiveDestination, aggregationCoordinator, and now.

   2. Return.

2. Let remainingBudget be allowed aggregatable budget per source.

3. Let numReports be 0.

4. If source is not null:

   1. Set remainingBudget to source’s remaining aggregatable debug budget.

   2. Set numReports to source’s number of aggregatable debug reports.

5. Let requiredBudget be the total value of contributions.

6. If requiredBudget is greater than remainingBudget:

   1. Run obtain and deliver an aggregatable debug report with «», reportingOrigin, effectiveDestination, aggregationCoordinator, and now.

   2. Return.

7. If numReports is equal to max aggregatable reports per source[1]:

   1. Run obtain and deliver an aggregatable debug report with «», reportingOrigin, effectiveDestination, aggregationCoordinator, and now.

   2. Return.

8. Let rateLimitRecord be a new aggregatable debug rate-limit record with the items:

   context site

   contextSite

   reporting site

   The result of obtaining a site from reportingOrigin

   time

   now

   consumed budget

   requiredBudget

9. If the result of running check if aggregatable debug reporting should be blocked by rate-limit with rateLimitRecord is blocked:

   1. Run obtain and deliver an aggregatable debug report with «», reportingOrigin, effectiveDestination, aggregationCoordinator, and now.

   2. Return.

10. Run obtain and deliver an aggregatable debug report with contributions, reportingOrigin, effectiveDestination, aggregationCoordinator, and now.

11. If source is not null:

    1. Decrement source’s remaining aggregatable debug budget value by requiredBudget.

    2. Increment source’s number of aggregatable debug reports value by 1.

12. Append rateLimitRecord to the aggregatable debug rate-limit cache.

13. Remove all aggregatable debug rate-limit records entry from the aggregatable debug rate-limit cache if the duration from entry’s time and now is > aggregatable debug rate-limit window.

11. Source Algorithms

11.1. Obtaining a randomized source response

To obtain a set of possible trigger states given a randomized response output configuration config:

1. Let possibleTriggerStates be a new set.

2. For each triggerData → spec of config’s trigger specs:

   1. For each reportWindow of spec’s event-level report windows:

      1. Let state be a new trigger state with the items:

         trigger data

         triggerData

         report window

         reportWindow

      2. Append state to possibleTriggerStates.

3. Let possibleValues be a new set.

4. For each integer attributions of the range 0 to config’s max attributions per source, inclusive:

   1. Append to possibleValues all distinct attributions-size combinations of possibleTriggerStates with repetition.

5. Return possibleValues.

To obtain a randomized source response pick rate given a positive integer states and a double epsilon:

1. Return states / (states - 1 + e^epsilon).

To obtain a randomized source response given a set of possible trigger states possibleValues and a double epsilon:

1. Let pickRate be the result of obtaining a randomized source response pick rate with possibleValues’s size and epsilon.

2. Return the result of obtaining a randomized response with null, possibleValues, and pickRate.

11.2. Computing channel capacity

To compute the channel capacity of a source given a positive integer states and a double epsilon:

1. If states is 1, return 0.

2. If states is greater than the user agent’s max trigger-state cardinality, return an error.

3. Let pickRate be the randomized response pick rate with states and epsilon.

4. Let p be pickRate * (states - 1) / states.

5. Return log2(states) - h(p) - p * log2(states - 1) where h is the binary entropy function [BIN-ENT].

Note: This algorithm computes the channel capacity [CHAN] of a q-ary symmetric channel [Q-SC].

To compute the scopes channel capacity of a source given a positive integer numTriggerStates, a positive integer attributionScopeLimit, and a positive integer maxEventStates:

1. Let totalStates be numTriggerStates + maxEventStates * (attributionScopeLimit - 1).

2. Return log2(totalStates).

11.3. Parsing source-registration JSON

A source-registration JSON key is one of the following:

• "aggregatable_debug_reporting"
• "aggregatable_report_window"
• "aggregation_keys"
• "attribution_scopes"
• "budget"
• "debug_key"
• "debug_reporting"
• "destination"
• "destination_limit_priority"
• "end_times"
• "event_level_epsilon"
• "event_report_window"
• "event_report_windows"
• "expiry"
• "filter_data"
• "limit"
• "max_event_level_reports"
• "max_event_states"
• "named_budgets"
• "priority"
• "source_event_id"
• "start_time"
• "summary_buckets"
• "summary_operator"
• "trigger_data"
• "trigger_data_matching"
• "trigger_specs"
• "values"

To parse an attribution destination from a string str:

1. Let url be the result of running the URL parser on the value of the str.

2. If url is failure or null, return an error.

3. If url’s origin is not suitable, return an error.

4. Return the result of obtaining a site from url’s origin.

To parse attribution destinations from a map map:

1. If map["destination"] does not exist, return an error.

2. Let val be map["destination"].

3. If val is a string, set val to « val ».

4. If val is not a list, return an error.

5. Let result be a set.

6. For each value of val:

   1. If value is not a string, return an error.

   2. Let destination be the result of parse an attribution destination with value.

   3. If destination is an error, return it.

   4. Append destination to result.

7. If result is empty or its size is greater than the max destinations per source, return an error.

8. Sort result in ascending order, with a being less than b if a, serialized, is less than b, serialized.

9. Return result.

Note: Sorting result helps ensure that registrations with the same set of destinations are equivalent, regardless of the order of sites in the registration JSON.

To parse a duration given a map map, a string key, and a tuple of durations (clampStart, clampEnd):

1. Assert: clampStart < clampEnd.

2. Let seconds be null.

3. If map[key] exists and is a non-negative integer, set seconds to map[key].

4. Otherwise, set seconds to the result of running parse an optional 64-bit unsigned integer with map, key, and null.

5. If seconds is an error, return an error.

6. If seconds is null, return clampEnd.

7. Let duration be the duration of seconds seconds.

8. If duration is less than clampStart, return clampStart.

9. If duration is greater than clampEnd, return clampEnd.

10. Return duration.

Consider rejecting out-of-bounds values instead of silently clamping.

To parse aggregation keys given a map map:

1. Let aggregationKeys be a new map.

2. If map["aggregation_keys"] does not exist, return aggregationKeys.

3. Let values be map["aggregation_keys"].

4. If values is not an map, return an error.

5. If values’s size is greater than the max aggregation keys per source registration, return an error.

6. For each key → value of values:

   1. If key’s length is greater than the max length per aggregation key identifier, return an error.

   2. If value is not a string, return an error.

   3. Let keyPiece be the result of running parse an aggregation key piece with value.

   4. If keyPiece is an error, return it.

   5. Set aggregationKeys[key] to keyPiece.

7. Return aggregationKeys.

To parse named budgets for source given a map map:

1. Let namedBudgets be a new map.

2. If map["named_budgets"] does not exist, return namedBudgets.

3. Let values be map["named_budgets"].

4. If values is not a map, return an error.

5. If values’s size is greater than the max named budgets per source registration, return an error.

6. For each key → value of values:

   1. If key’s length is greater than the max length per budget name for source, return an error.

   2. If value is not an integer or is less than 0 or is greater than allowed aggregatable budget per source, return an error.

   3. Set namedBudgets[key] to value.

7. Return namedBudgets.

To obtain default effective windows given a source type sourceType, a moment sourceTime, and a duration eventReportWindow:

1. Let deadlines be «» if sourceType is "event", else « 2 days, 7 days ».

2. Remove all elements in deadlines that are greater than or equal to eventReportWindow.

3. Append eventReportWindow to deadlines.

4. Let lastEnd be sourceTime.

5. Let windows be «».

6. For each deadline of deadlines:

   1. Let window be a new report window whose items are

      start

      lastEnd

      end

      lastEnd + deadline

   2. Append window to windows.

   3. Set lastEnd to lastEnd + deadline.

7. Return windows.

To parse top-level report windows given a map map, a moment sourceTime, a source type sourceType, and a duration expiry:

1. If map["event_report_window"] exists and map["event_report_windows"] exists, return an error.

2. If map["event_report_window"] exists:

   1. Let eventReportWindow be the result of running parse a duration with map, "event_report_window", and (min report window, expiry).

   2. If eventReportWindow is an error, return eventReportWindow.

   3. Return the result of obtaining default effective windows given sourceType, sourceTime, and eventReportWindow.

3. If map["event_report_windows"] does not exist, return the result of obtaining default effective windows given sourceType, sourceTime, and expiry.

4. Return the result of parsing report windows with map["event_report_windows"], sourceTime, and expiry.

To parse report windows given a value, a moment sourceTime, and a duration expiry:

1. If value is not a map, return an error.

2. Let startDuration be 0 seconds.

3. If value["start_time"] exists:

   1. Let start be value["start_time"].

   2. If start is not a non-negative integer, return an error.

   3. Set startDuration to start seconds.

   4. If startDuration is greater than expiry, return an error.

4. If value["end_times"] does not exist or is not a list, return an error.

5. Let endDurations be value["end_times"].

6. If the size of endDurations is greater than max settable event-level report windows, return an error.

7. If endDurations is empty, return an error.

8. Let windows be a new list.

9. For each end of endDurations:

   1. If end is not a positive integer, return an error.

   2. Let endDuration be end seconds.

   3. If endDuration is greater than expiry, set endDuration to expiry.

   4. If endDuration is less than min report window, set endDuration to min report window.

   5. If endDuration is less than or equal to startDuration, return an error.

   6. Let window be a new report window whose items are

      start

      sourceTime + startDuration

      end

      sourceTime + endDuration

   7. Append window to windows.

   8. Set startDuration to endDuration.

10. Return windows.

The user-agent has an associated boolean experimental Flexible Event support (default false) that exposes non-normative behavior described in the Flexible event-level configurations proposal.

To parse summary operator given a map map:

1. Let value be "count".

2. If map["summary_operator"] exists:

   1. If map["summary_operator"] is not a string, return an error.

   2. If map["summary_operator"] is not a summary operator, return an error.

   3. Set value to map["summary_operator"].

3. Return value.

To parse summary buckets given a map map and an integer maxEventLevelReports:

1. Let values be the range 1 to maxEventLevelReports, inclusive.

2. If map["summary_buckets"] exists:

   1. If map["summary_buckets"] is not a list, is empty, or its size is greater than maxEventLevelReports, return an error.

   2. Set values to map["summary_buckets"].

3. Let prev be 0.

4. Let summaryBuckets be a new list.

5. For each item of values:

   1. If item is not an integer or cannot be represented by an unsigned 32-bit integer, or is less than or equal to prev, return an error.

   2. Let summaryBucket be a new summary bucket whose items are

      start

      prev

      end

      item - 1

   3. Append summaryBucket to summaryBuckets.

   4. Set prev to item.

6. Return summaryBuckets.

To parse trigger data into a trigger spec map given a triggerDataList, a trigger spec spec, a trigger spec map specs, and a boolean allowEmpty:

1. If triggerDataList is not a list or its size is greater than max distinct trigger data per source, return false.

2. If allowEmpty is false and triggerDataList is empty, return false.

3. For each triggerData of triggerDataList:

   1. If triggerData is not an integer or cannot be represented by an unsigned 32-bit integer, or specs[triggerData] exists, return false.

   2. Set specs[triggerData] to spec.

   3. If specs’s size is greater than max distinct trigger data per source, return false.

4. Return true.

To parse trigger specs given a map map, a moment sourceTime, a source type sourceType, a duration expiry, and a trigger-data matching mode matchingMode:

1. Let defaultReportWindows be the result of parsing top-level report windows with map, sourceTime, sourceType, and expiry.

2. If defaultReportWindows is an error, return an error.

3. Let specs be a new trigger spec map.

4. If experimental Flexible Event support is true and map["trigger_specs"] exists:

   1. If map["trigger_data"] exists, return an error.

   2. If map["trigger_specs"] is not a list or its size is greater than max distinct trigger data per source, return an error.

   3. For each item of map["trigger_specs"]:

      1. If item is not a map, return an error.

      2. Let spec be a new trigger spec with the following items:

         event-level report windows

         defaultReportWindows

      3. If item["event_report_windows"] exists:

         1. Let reportWindows be the result of parsing report windows with item["event_report_windows"], sourceTime, and expiry.

         2. If reportWindows is an error, return it.

         3. Set spec’s event-level report windows to reportWindows.

      4. If item["trigger_data"] does not exist, return an error.

      5. Let allowEmpty be false.

      6. If the result of running parse trigger data into a trigger spec map with item["trigger_data"], spec, specs, and allowEmpty is false, return an error.

5. Otherwise:

   1. Let spec be a new trigger spec with the following items:

      event-level report windows

      defaultReportWindows

   2. If map["trigger_data"] exists:

      1. Let allowEmpty be true.

      2. If the result of running parse trigger data into a trigger spec map with map["trigger_data"], spec, specs, and allowEmpty is false, return an error.

   3. Otherwise:

      1. For each integer triggerData of the range 0 to default trigger data cardinality[sourceType], exclusive:

         1. Set specs[triggerData] to spec.

6. If matchingMode is "modulus":

   1. Let i be 0.

   2. For each triggerData of specs’s keys:

      1. If triggerData does not equal i, return an error.

      2. Set i to i + 1.

7. Return specs.

Invoke parse summary buckets and parse summary operator from this algorithm.

To parse a source aggregatable debug reporting config given value, a non-negative integer defaultBudget, and an aggregatable debug reporting config defaultConfig:

1. If value is not a map, return the tuple (defaultBudget, defaultConfig).

2. If value["budget"] does not exist, return the tuple (defaultBudget, defaultConfig).

3. Let budget be value["budget"].

4. If budget is not an integer or is less than or equal to 0 or is greater than allowed aggregatable budget per source, return the tuple (defaultBudget, defaultConfig).

5. Let supportedTypes be the set of all source debug data types.

6. Let config be the result of running parse an aggregatable debug reporting config with value, budget, supportedTypes, and defaultConfig.

7. Return the tuple (budget, config).

To parse attribution scopes from a map map:

1. If map["attribution_scopes"] does not exist, return null.

2. Let value be map["attribution_scopes"].

3. If value is not a map, return an error.

4. If value["limit"] does not exist, return an error.

5. Set limit to value["limit"].

6. If limit is not an integer, cannot be represented by an unsigned 32-bit integer, or is less than or equal to zero, return an error.

7. Let maxEventStates be the result of running parse max event states with value.

8. If maxEventStates is an error, return an error.

9. Let values be the result of running parse attribution scope values for source with value and limit.

10. If values is an error, return an error.

11. Let attributionScopes be a new attribution scopes with the items:

    limit

    limit

    values

    values

    max event states

    maxEventStates

12. Return attributionScopes.

To parse max event states from a map map:

1. If map["max_event_states"] does not exist, return default max event states.

2. Let maxEventStates be map["max_event_states"].

3. If maxEventStates is not an integer or is less than or equal to 0, return an error.

4. If maxEventStates is greater than the user agent’s max trigger-state cardinality, return an error.

5. Return maxEventStates.

To parse attribution scope values for source from a map map and a 32-bit positive integer limit:

1. If map["values"] does not exist, return an error.

2. Let result be a new set.

3. Let values be map["values"].

4. If values is not a list, return an error.

5. If values is empty, return an error.

6. For each value of values:

   1. If value is not a string, return an error.

   2. If value’s length is greater than max length of attribution scope for source, return an error.

   3. Append value to result.

7. If result’s size is greater than limit or max attribution scopes per source, return an error.

8. Return result.

Note: Empty attribution scopes are not allowed if limit is set, to prevent the selection of both sources with and without scopes, which would effectively result in limit + 1 scopes.

To parse source-registration JSON given a byte sequence json, a suitable origin sourceOrigin, a suitable origin reportingOrigin, a source type sourceType, a moment sourceTime, and a boolean fenced:

1. Let value be the result of running parse JSON bytes to an Infra value with json.

2. If value is not a map, return an error.

3. Let attributionDestinations be the result of running parse attribution destinations with value.

4. If attributionDestinations is an error, return it.

5. Let sourceEventId be the result of running parse an optional 64-bit unsigned integer with value, "source_event_id", and 0.

6. If sourceEventId is an error, return it.

7. Let expiry be the result of running parse a duration with value, "expiry", and valid source expiry range.

8. If expiry is an error, return it.

9. If sourceType is "event", round expiry away from zero to the nearest day (86400 seconds).

10. Let priority be the result of running parse an optional 64-bit signed integer with value, "priority", and

11. If priority is an error, return it.

12. Let destinationLimitPriority be the result of running parse an optional 64-bit signed integer with value, "destination_limit_priority", and 0.

13. If destinationLimitPriority is an error, return it.

14. Let filterData be a new filter map.

15. If value["filter_data"] exists:

    1. Set filterData to the result of running parse filter data with value["filter_data"].

    2. If filterData is an error, return it.

    3. If filterData["source_type"] exists, return an error.

16. Set filterData["source_type"] to « sourceType ».

17. Let debugKey be the result of running parse an optional 64-bit unsigned integer with value, "debug_key", and null.

18. If debugKey is an error, set debugKey to null.

19. Let cookieBasedDebugAllowed be false.

20. Let sourceSite be the result of obtaining a site from sourceOrigin.

21. If the result of running check if cookie-based debugging is allowed with reportingOrigin and sourceSite is allowed, set cookieBasedDebugAllowed to true.

22. If cookieBasedDebugAllowed is false, set debugKey to null.

23. Let aggregationKeys be the result of running parse aggregation keys with value.

24. If aggregationKeys is an error, return it.

25. Let maxAttributionsPerSource be default event-level attributions per source[sourceType].

26. Set maxAttributionsPerSource to value["max_event_level_reports"] if it exists.

27. If maxAttributionsPerSource is not a non-negative integer, or is greater than max settable event-level attributions per source, return an error.

28. Let aggregatableReportWindowEnd be the result of running parse a duration with value, "aggregatable_report_window", and (min report window, expiry).

29. If aggregatableReportWindowEnd is an error, return it.

30. Let debugReportingEnabled be false.

31. If value["debug_reporting"] exists and is a boolean, set debugReportingEnabled to value["debug_reporting"].

32. Let aggregatableReportWindow be a new report window with the following items:

    start

    sourceTime

    end

    sourceTime + aggregatableReportWindowEnd

33. Let triggerDataMatchingMode be "modulus".

34. If value["trigger_data_matching"] exists:

    1. If value["trigger_data_matching"] is not a string, return an error.

    2. If value["trigger_data_matching"] is not a trigger-data matching mode, return an error.

    3. Set triggerDataMatchingMode to value["trigger_data_matching"].

35. Let triggerSpecs be the result of parsing trigger specs with value, sourceTime, sourceType, expiry, and triggerDataMatchingMode.

36. If triggerSpecs is an error, return it.

37. Let attributionScopes be the result of running parse attribution scopes with value.

38. If attributionScopes is an error, return it.

39. Let epsilon be the user agent’s max settable event-level epsilon.

40. Set epsilon to value["event_level_epsilon"] if it exists:

41. If epsilon is not a double, is less than 0, or is greater than the user agent’s max settable event-level epsilon, return an error.

42. Let aggregatableDebugBudget be 0.

43. Let aggregatableDebugReportingConfig be a new aggregatable debug reporting config.

44. If value["aggregatable_debug_reporting"] exists:

    1. Set (aggregatableDebugBudget, aggregatableDebugReportingConfig) to the result of running parse a source aggregatable debug reporting config with value["aggregatable_debug_reporting"], aggregatableDebugBudget, and aggregatableDebugReportingConfig.

45. Let aggregatableAttributionBudget be allowed aggregatable budget per source - aggregatableDebugBudget.

46. Let namedBudgets be the result of parsing named budgets for source with value.

47. If namedBudgets is an error, return it.

48. If automation local testing mode is true, set epsilon to ∞.

49. Let source be a new attribution source struct whose items are:

    internal ID

    The result of getting the next internal ID

    source origin

    sourceOrigin

    event ID

    sourceEventId

    attribution destinations

    attributionDestinations

    reporting origin

    reportingOrigin

    expiry

    expiry

    trigger specs

    triggerSpecs

    aggregatable report window

    aggregatableReportWindow

    priority

    priority

    source time

    sourceTime

    source type

    sourceType

    number of event-level reports

    0

    max number of event-level reports

    maxAttributionsPerSource

    event-level epsilon

    epsilon

    filter data

    filterData

    debug key

    debugKey

    aggregation keys

    aggregationKeys

    remaining aggregatable attribution budget

    aggregatableAttributionBudget

    named budgets

    namedBudgets

    remaining named budgets

    namedBudgets

    debug reporting enabled

    debugReportingEnabled

    trigger-data matching mode

    triggerDataMatchingMode

    cookie-based debug allowed

    cookieBasedDebugAllowed

    fenced

    fenced

    remaining aggregatable debug budget

    aggregatableDebugBudget

    aggregatable debug reporting config

    aggregatableDebugReportingConfig

    destination limit priority

    destinationLimitPriority

    attribution scopes

    attributionScopes

50. Return source.

Determine proper charset-handling for the JSON header value.

11.4. Processing an attribution source

To check if an attribution source exceeds the time-based destination limits given an attribution source source, run the following steps:

1. Let matchingSources be all attribution rate-limit records record in the attribution rate-limit cache where all of the following are true:

   • record’s scope is "source"

   • record’s source site and source’s source site are equal

   • record’s expiry time is greater than source’s source time

   • The duration from record’s time and source’s source time is less than destination rate-limit window

2. Let matchingSameReportingSources be all the records in matchingSources whose associated reporting origin is same site with source’s reporting origin.

3. Let destinations be the set of every attribution destination in matchingSources, unioned with source’s attribution destinations.

4. Let sameReportingDestinations be the set of every attribution destination in matchingSameReportingSources, unioned with source’s attribution destinations.

5. Let hitRateLimit be whether destinations’s size is greater than max destinations per rate-limit window[0].

6. Let hitSameReportingRateLimit be whether sameReportingDestinations’s size is greater than max destinations per rate-limit window[1].

7. If (hitRateLimit, hitSameReportingRateLimit) is

   (false, false)

   Return "allowed".

   (false, true)

   Return "hit reporting limit".

   (true, false)

   Return "hit global limit".

   (true, true)

   Return "hit reporting limit".

Note: When both limits are hit, we interpret it as "hit reporting limit" for debug reporting.

To check if an attribution source exceeds the per day destination limits given an attribution source source, run the following steps:

1. Let matchingSources be all attribution rate-limit records record in the attribution rate-limit cache where all of the following are true:

   • record’s scope is "source"

   • record’s source site and source’s source site are equal

   • record’s reporting origin is same site with source’s reporting origin

   • record’s expiry time is greater than source’s source time

   • The duration from record’s time and source’s source time is less than 1 day

2. Let destinations be the set of all attribution destination in matchingSources, unioned with source’s attribution destinations.

3. Return whether destinations’s size is greater than max destinations per source reporting site per day.

To delete sources for unexpired destination limit given a set of internal IDs sourcesToDelete and a moment now:

1. If sourcesToDelete is empty, return.

2. For each attribution source source of the attribution source cache:

   1. Remove source from the attribution source cache if sourcesToDelete contains source’s internal ID.

3. Let deletedEventLevelReports be a new set.

4. For each event-level report report of the event-level report cache:

   1. If sourcesToDelete contains report’s source ID and report’s trigger time is greater than or equal to now:

      1. Append report’s internal ID to deletedEventLevelReports.

      2. Remove report from the event-level report cache.

   Note: Leaking browsing history of destinations deactivated for unexpired destination limit from event-level reports whose trigger time is earlier than now is mitigated by the presence of fake reports. Event-level reports whose trigger time is greater than or equal to now must be deleted to avoid exposing whether an attribution source has a randomized response.

5. Let deletedAggregatableReports be a new set.

6. For each aggregatable attribution report report of the aggregatable attribution report cache:

   1. If report’s source ID is not null and sourcesToDelete contains report’s source ID:

      1. Append report’s internal ID to deletedAggregatableReports.

      2. Remove report from the aggregatable attribution report cache.

7. For each attribution rate-limit record record of the attribution rate-limit cache:

   1. If record’s scope is:

      "source"

      Set record’s deactivated for unexpired destination limit to true if sourcesToDelete contains record’s entity ID.

      "event-attribution"

      Remove record from the attribution rate-limit cache if deletedEventLevelReports contains record’s entity ID.

      "aggregatable-attribution"

      Remove record from the attribution rate-limit cache if deletedAggregatableReports contains record’s entity ID.

A destination limit record is a struct with the following items:

attribution destination

A site.

priority

A 64-bit integer.

time

A moment

source ID

An internal ID.

To get sources to delete for the unexpired destination limit given an attribution source source, run the following steps:

1. Let destinationRecords be a new list.

2. For each attribution rate-limit record record of the attribution rate-limit cache:

   1. If record’s scope is not "source", continue.

   2. If record’s deactivated for unexpired destination limit is true, continue.

   3. If record’s source site and source’s source site are not equal, continue.

   4. If record’s reporting origin and source’s reporting origin are not same site, continue.

   5. If record’s expiry time is less than or equal to source’s source time, continue.

   6. Assert: record’s destination limit priority is not null.

   7. Assert: record’s entity ID is not null.

   8. Let destinationRecord be a new destination limit record struct whose items are:

      attribution destination

      record’s attribution destination

      priority

      record’s destination limit priority

      time

      record’s time

      source ID

      record’s entity ID

   9. Append destinationRecord to destinationRecords.

3. For each site destination of source’s attribution destinations:

   1. Let destinationRecord be a new destination limit record struct whose items are:

      attribution destination

      destination

      priority

      source’s destination limit priority

      time

      source’s source time

      source ID

      source’s internal ID

   2. Append destinationRecord to destinationRecords.

4. Sort destinationRecords in descending order, with a less than b if the following steps return true:

   1. If a’s priority is less than b’s priority, return true.

   2. If a’s priority is greater than b’s priority, return false.

   3. If a’s time is less than b’s time, return true.

   4. If a’s time is greater than b’s time, return false.

   5. If a’s serialized attribution destination is less than b’s serialized attribution destination, return true.

   6. Return false.

5. Let sourcesToDelete be a new set.

6. Let newDestinations be a new set.

7. For each destination limit record record of destinationRecords:

   1. Let destination be record’s attribution destination.

   2. If newDestinations’s size is less than the user agent’s max destinations covered by unexpired sources, append destination to newDestinations.

   3. Otherwise, if newDestinations does not contain destination:

      1. Append record’s source ID to sourcesToDelete.

8. Return sourcesToDelete.

To check if an attribution source should be blocked by reporting-origin per site limit given an attribution source source:

1. Let matchingRateLimitRecords be all attribution rate-limit records record in the attribution rate-limit cache where all of the following are true:

   • record’s scope is "source"

   • record’s source site and source’s source site are equal

   • The duration from record’s time and source’s source time is <= origin rate-limit window

2. Let distinctReportingOrigins be the set of all reporting origin in matchingRateLimitRecords, unioned with «source’s reporting origin».

3. If distinctReportingOrigins’s size is greater than max source reporting origins per source reporting site, return blocked.

4. Return allowed.

To obtain a fake report given an attribution source source and a trigger state triggerState:

1. Let specEntry be the entry for source’s trigger specs[triggerState’s trigger data].

2. Let triggerTime be triggerState’s report window's start.

3. Let priority be 0.

4. Let fakeReport be the result of running obtain an event-level report with source, triggerTime, triggerDebugKey set to null, priority, and specEntry.

5. Assert: fakeReport’s report time is equal to triggerState’s report window's end.

6. Return fakeReport.

To obtain and deliver a verbose debug report on source registration given a source debug data types dataType, an attribution source source, a boolean isNoised, and a boolean destinationLimitReplaced:

1. If source’s debug reporting enabled is false, return.

2. If source’s cookie-based debug allowed is false, return.

3. Let body be a new map with the following key/value pairs:

   "attribution_destination"

   source’s attribution destinations, serialized.

   "source_event_id"

   source’s event ID, serialized.

   "source_site"

   source’s source site, serialized.

4. If source’s debug key is not null, set body["source_debug_key"] to source’s debug key, serialized.

5. Let dataTypeToReport be dataType.

6. If dataType is:

   "source-destination-global-rate-limit"

   "source-reporting-origin-limit"

   Set dataTypeToReport to "source-success".

7. If dataTypeToReport is "source-success" and isNoised is true, set dataTypeToReport to "source-noised".

8. If dataTypeToReport is:

   "source-destination-limit"

   Set body["limit"] to the user agent’s max destinations covered by unexpired sources, serialized.

   "source-destination-rate-limit"

   Set body["limit"] to the user agent’s max destinations per rate-limit window[1], serialized.

   "source-destination-per-day-rate-limit"

   Set body["limit"] to the user agent’s max destinations per source reporting site per day, serialized.

   "source-storage-limit"

   Set body["limit"] to the user agent’s max pending sources per source origin, serialized.

   "source-channel-capacity-limit"

   1. Let sourceType be source’s source type.

   2. Set body["limit"] to the user agent’s max event-level channel capacity per source[sourceType].

   "source-scopes-channel-capacity-limit"

   1. Assert: source’s attribution scopes is not null.

   2. Let sourceType be source’s source type.

   3. Set body["limit"] to the user agent’s max event-level attribution scopes channel capacity per source[sourceType].

   "source-trigger-state-cardinality-limit"

   Set body["limit"] to the user agent’s max trigger-state cardinality, serialized.

   "source-reporting-origin-per-site-limit"

   Set body["limit"] to the user agent’s max source reporting origins per source reporting site, serialized.

   "source-max-event-states-limit"

   1. Assert: source’s attribution scopes is not null.

   2. Set body["limit"] to source’s attribution scopes's max event states.

9. If destinationLimitReplaced is true, set body["source_destination_limit"] to the user agent’s max destinations covered by unexpired sources, serialized.

Note: The "source_destination_limit" field may be included to indicate that max destinations covered by unexpired sources was hit, which is not reported as "source-destination-limit" to prevent side-channel leakage of cross-origin data.

1. Let data be a new verbose debug data with the items:

   data type

   dataTypeToReport

   body

   body

2. Run obtain and deliver a verbose debug report with « data », source’s reporting origin, and source’s fenced.

To obtain and deliver an aggregatable debug report on source registration given a source debug data type dataType, an attribution source source, a boolean isNoised, and a boolean destinationLimitReplaced:

1. If source’s fenced is true, return.

2. Let config be source’s aggregatable debug reporting config.

3. Let debugDataMap be config’s debug data.

4. If debugDataMap is empty, return.

5. Let dataTypesToReport be a new set.

6. If dataType is "source-success" and isNoised is true, append "source-noised" to dataTypesToReport.

7. Otherwise, append dataType to dataTypesToReport.

8. If destinationLimitReplaced is true, append "source-destination-limit-replaced" to dataTypesToReport.

9. Let contributions be a new list.

10. For each dataTypeToReport of dataTypesToReport:

    1. If debugDataMap[dataTypeToReport] exists:

       1. Let contribution be a new aggregatable contribution with items:

          key

          debugDataMap[dataTypeToReport]'s key bitwise-OR config’s key piece

          value

          debugDataMap[dataTypeToReport]'s value

          filtering ID

          default filtering ID value

       2. Append contribution to contributions.

11. Run obtain and deliver an aggregatable debug report on registration with contributions, source’s source site, source’s reporting origin, source, source’s attribution destinations[0], config’s aggregation coordinator, and source’s source time.

To obtain and deliver debug reports on source registration given a source debug data type dataType, an attribution source source, an optional boolean isNoised (default false), and an optional boolean destinationLimitReplaced (default false):

1. Run obtain and deliver a verbose debug report on source registration with dataTypes, source, isNoised, and destinationLimitReplaced.

2. Run obtain and deliver an aggregatable debug report on source registration with dataTypes, source, isNoised, and destinationLimitReplaced.

To delete expired sources given a moment now:

1. For each source of the attribution source cache:

   1. If source’s expiry time is less than now, remove source from the attribution source cache.

To find sources with common destinations and reporting origin given an attribution source pendingSource:

1. Let matchingSources be a new list.

2. For each source of the user agent’s attribution source cache:

   1. Let commonDestinations be the intersection of source’s attribution destinations and pendingSource’s attribution destinations.

   2. If commonDestinations is empty, continue.

   3. If source’s reporting origin and pendingSource’s reporting origin are not same origin, continue.

   4. Append source to matchingSources.

3. Return matchingSources.

To remove associated event-level reports and rate-limit records given an internal ID sourceId and a moment minTriggerTime:

1. For each event-level report report of the event-level report cache:

   1. If report’s source ID is not equal to sourceId, continue.

   2. If report’s trigger time is less than minTriggerTime, continue.

   3. Remove report from the event-level report cache.

   4. Remove all attribution rate-limit records entry from the attribution rate-limit cache where entry’s entity ID is equal to report’s internal ID.

To remove sources with unselected attribution scopes for destination given a site destination and an attribution source pendingSource:

1. Let scopeRecords be a new list.

2. Let scopes be pendingSource’s attribution scopes's values.

3. For each source of the attribution source cache:

   1. If source’s reporting origin and pendingSource’s reporting origin are not same origin, continue.

   2. If source’s attribution destinations does not contain destination, continue.

   3. If source’s attribution scopes's is null, continue.

   4. For each scope in source’s attribution scopes's values:

      1. Append the tuple (scope, source) to scopeRecords.

4. Sort scopeRecords in ascending order with a being less than b if any of the following are true:

   • a[1]'s source time is greater than b[1]'s source time.

   • a[1]'s source time is equal to b[1]'s source time and a[0] is greater than b[0].

5. Let selectedScopes be scopes, cloned.

6. Let sourcesToRemove be a new set.

7. For each record of scopeRecords:

   1. If selectedScopes’s size is less than pendingSource’s attribution scopes's limit, append record[0] to selectedScopes.

   2. Otherwise, if selectedScopes does not contain record[0], append record[1] to sourcesToRemove.

8. For each source of the sourcesToRemove:

   1. Remove associated event-level reports and rate-limit records with source’s internal ID and pendingSource’s source time.

   2. Remove source from the attribution source cache.