@analitikisler/ai-tag-debugger 0.20.1 → 0.22.0

package/src/checks.js

@@ -4,6 +4,8 @@
 import { messages } from "./i18n.js";
 import { isOwnAddress } from "./redact.js";
 import { campaignParamsIn } from "./campaign.js";
+import { CONSENT_SIGNALS } from "./parsers.js";
+import { duplicateLoads, loadSources, splitLayers } from "./containers.js";
 
 const platformName = (p) => ({ meta: "Meta", tiktok: "TikTok" })[p] ?? p;
 const NON_GOOGLE_AD_PLATFORMS = new Set(["meta", "tiktok"]);
@@ -17,8 +19,10 @@ const EMAIL = /[A-Z0-9._%+-]+(@|%40)[A-Z0-9.-]+\.[A-Z]{2,}/gi;
 const V2_SIGNALS = ["ad_user_data", "ad_personalization"];
 // The signals a "reject all" must keep denied. functionality_storage and security_storage cover what
 // the site needs to work, and personalization_storage its own features, so CMPs grant them on reject too.
-const TRACKING_SIGNALS = ["ad_storage", "analytics_storage", ...V2_SIGNALS];
-const TRACKING_COOKIE = /^(_ga(_.+)?|_gid|_gat(_.+)?|_gcl_.+|_fbp|_fbc|_ttp|_tt_.+|_uet(sid|vid)|_clck|_clsk|_hj.+|_pin_unauth|_scid|IDE|test_cookie|fr|li_.+|_dc_gtm_.+)$/;
+const TRACKING_SIGNALS = CONSENT_SIGNALS;
+/** Whether a Google hit says it was sent with any of the tracking signals granted (from gcs, and gcd for the v2 ones). */
+const claimsGranted = (hit) => TRACKING_SIGNALS.some((k) => hit.consent?.[k] === "granted");
+export const TRACKING_COOKIE = /^(_ga(_.+)?|_gid|_gat(_.+)?|_gcl_.+|_fbp|_fbc|_ttp|_tt_.+|_uet(sid|vid)|_clck|_clsk|_hj.+|_pin_unauth|_scid|IDE|test_cookie|fr|li_.+|_dc_gtm_.+)$/;
 const SEVERITY_ORDER = { broken: 0, risk: 1, warning: 2, info: 3, ok: 4 };
 
 /**
@@ -160,10 +164,17 @@ export function consentGrantedStep(run) {
   const fromUpdate = run.dataLayerLog.find(
     (e) => isConsentCommand(e, "update") && e.value[2]?.ad_storage === "granted",
   );
-  const candidates = [run.consentStep, fromUpdate?.step].filter((s) => s !== null && s !== undefined);
+  // A consent platform's GTM template updates the Google tag without a dataLayer command; the tag's own state shows it.
+  const fromTag = tagConsentStates(run).find((st) => st.entries.ad_storage?.update === "granted");
+  const candidates = [run.consentStep, fromUpdate?.step, fromTag?.step].filter((s) => s !== null && s !== undefined);
   return candidates.length ? Math.min(...candidates) : null;
 }
 
+/** The Google tag's own consent states a run recorded (google_tag_data.ics, kept on the steps where it changed), as { step, ...state }. */
+export function tagConsentStates(run) {
+  return (run.steps ?? []).filter((st) => st.tagConsent).map((st) => ({ step: st.index, ...st.tagConsent }));
+}
+
 /**
  * @param {Plan} plan
  * @param {{ journeyId: string, viewport: string, completed: boolean, note?: string, hits: any[], steps: any[], consentStep: number|null, dataLayerLog: any[] }} run
@@ -191,6 +202,14 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     findings.push({ ...base, severity: "warning", check: "journey_incomplete", detail: d.journeyIncomplete(run.note) });
   }
 
+  // A page that was a bot challenge or crashed in the browser: the tags there may never have run, so what the run
+  // did not see there is unverified rather than missing.
+  const troubled = (run.steps ?? []).filter((st) => st.pageProblem);
+  const challenge = troubled.find((st) => st.pageProblem.kind === "challenge");
+  if (challenge) findings.push({ ...base, severity: "warning", check: "page_blocked", step: stepLabel(challenge.index), detail: d.pageBlocked(challenge.pageProblem.vendor) });
+  const crash = troubled.find((st) => st.pageProblem.kind === "crash");
+  if (crash) findings.push({ ...base, severity: "warning", check: "page_crashed", step: stepLabel(crash.index), detail: d.pageCrashed(crash.pageProblem.vendor, crash.pageProblem.refusedScripts ?? 0) });
+
   // Expected events that never fired.
   for (const ev of plan.events) {
     if (!expectedIn(ev, run.journeyId)) continue;
@@ -204,11 +223,11 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     const setting = ev.platform === "ga4" && name !== canonicalEvent("page_view") ? GA4_ENHANCED.get(name) : undefined;
     findings.push({
       ...base,
-      severity: run.completed ? "broken" : "info",
+      severity: run.completed && !troubled.length ? "broken" : "info",
       check: "missing_event",
       platform: ev.platform,
       event: ev.name,
-      detail: !run.completed ? d.missingEventEarly(ev.name) : setting ? d.missingEnhanced(ev.name, setting) : d.missingEvent(ev.platform, ev.name),
+      detail: troubled.length ? d.missingEventUnverified(ev.name) : !run.completed ? d.missingEventEarly(ev.name) : setting ? d.missingEnhanced(ev.name, setting) : d.missingEvent(ev.platform, ev.name),
     });
   }
 
@@ -348,6 +367,22 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     }
   }
 
+  // Google containers and how each got onto the page (src/containers.js). Runs saved by older versions have none.
+  const ui = messages(lang).ui.containers;
+  const source = (l) => ui.kinds[l.kind](l.by);
+  for (const dup of duplicateLoads(run).filter((x, i, all) => all.findIndex((y) => y.id === x.id) === i)) {
+    findings.push({ ...base, severity: "warning", check: "container_duplicate", step: stepLabel(dup.loads[1].step), detail: d.containerDuplicate(dup.id, dup.loads.map(source), stepLabel(dup.loads[1].step)), evidence: dup.loads.map((l) => `${l.id} ${l.kind}${l.by ? ` ${l.by}` : ""} ${l.page ?? ""}`).join("\n") });
+  }
+  const loads = loadSources(run);
+  for (const l of loads.filter((x, i, all) => x.environment && all.findIndex((y) => y.environment && y.id === x.id) === i)) {
+    findings.push({ ...base, severity: "warning", check: "container_environment", step: stepLabel(l.step), detail: d.containerEnvironment(l.id, l.environment) });
+  }
+  const split = splitLayers(run)[0];
+  if (split) findings.push({ ...base, severity: "info", check: "datalayer_split", step: stepLabel(split.step), detail: d.dataLayerSplit(split.layers.map((x) => `${x.id} → ${x.layer}`), stepLabel(split.step)) });
+  for (const l of loads.filter((x, i, all) => x.kind === "send_to" && !all.some((y) => y.id === x.id && y.kind !== "send_to") && all.findIndex((y) => y.kind === "send_to" && y.id === x.id) === i)) {
+    findings.push({ ...base, severity: "info", check: "container_send_to_only", platform: l.id.startsWith("G-") ? "ga4" : "google_ads", step: stepLabel(l.step), detail: d.sendToOnly(l.id, l.by) });
+  }
+
   // One event ID on two different events: the platform keeps the first and drops the other as its
   // duplicate, so a real event is lost (usually an ID set once per page instead of once per event).
   const byId = new Map();
@@ -408,31 +443,69 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     }
   }
 
+  // Cookies that carry the visit from page to page. Captures from before cookies were tracked per step have no cookieChanges.
+  if (run.cookieChanges) {
+    // A Google Ads tag keeps the landing gclid in _gcl_aw, so a later conversion can be tied to the click. GA4 alone
+    // never writes it, and with ad storage denied the cookie is rightly not written: only Ads, with storage granted.
+    const gclid = landing ? campaignParamsIn(landing.final ?? landing.requested).gclid : undefined;
+    const adsTag = run.hits.some((h) => h.platform === "google_ads") || (run.network ?? []).some((c) => c.provider === "google_ads");
+    const googleHits = run.hits.filter((h) => GOOGLE_PLATFORMS.has(h.platform));
+    // Without Consent Mode, no hit carries ad_storage at all, and nothing holds the cookie back.
+    const adStorage = googleHits.some((h) => h.consent?.ad_storage === "granted") || (googleHits.length > 0 && googleHits.every((h) => !h.consent?.ad_storage));
+    if (gclid && adsTag && adStorage && !run.steps.some((st) => st.identity?.gcl_aw === "landing")) {
+      findings.push({ ...base, severity: "warning", check: "gclid_not_stored", platform: "google_ads", step: stepLabel(landing.step), detail: d.gclidNotStored() });
+    }
+    // A GA4 client id that changes mid-visit splits it into two users. A reject in between may rightly clear the cookie.
+    let seen = null;
+    for (const st of run.steps) {
+      const cid = st.identity?.ga_client_id;
+      if (!cid) continue;
+      const rejectedBetween = run.rejectStep != null && run.rejectStep > seen?.step && run.rejectStep <= st.index;
+      if (seen && cid !== seen.cid && !rejectedBetween) {
+        findings.push({ ...base, severity: "warning", check: "client_id_changed", platform: "ga4", step: stepLabel(st.index), detail: d.clientIdChanged(stepLabel(seen.step), stepLabel(st.index)), evidence: `_ga ${seen.cid} -> ${cid}` });
+        break;
+      }
+      seen = { cid, step: st.index };
+    }
+  }
+
   // Consent.
   const granted = consentGrantedStep(run);
   // Consent Mode only governs Google tags. Within one step, the push and hit times decide which came first.
   const firstGoogleHit = run.hits.filter((h) => GOOGLE_PLATFORMS.has(h.platform)).reduce((a, h) => (!a || sentBefore(h, a) ? h : a), null);
+  // The Google tag's own state also counts: a consent platform's GTM template sets the default and the update inside
+  // GTM, where the dataLayer never shows them.
+  const tagStates = tagConsentStates(run);
+  const tagDefault = tagStates.find((st) => st.usedDefault) ?? null;
+  const defaultEntry = run.dataLayerLog.find((e) => isConsentCommand(e, "default"));
   if (plan.consent_mode) {
-    const defaultEntry = run.dataLayerLog.find((e) => isConsentCommand(e, "default"));
-    if (!defaultEntry) {
+    if (!defaultEntry && !tagDefault) {
       findings.push({ ...base, severity: "risk", check: "consent_default_missing", detail: d.consentDefaultMissing() });
-    } else if (firstGoogleHit && sentBefore(firstGoogleHit, defaultEntry)) {
+    } else if ((defaultEntry && firstGoogleHit && sentBefore(firstGoogleHit, defaultEntry)) || tagStates.some((st) => st.wasSetLate)) {
       findings.push({ ...base, severity: "risk", check: "consent_default_late", detail: d.consentDefaultLate() });
     }
   }
+  // A default the page pushed that the Google tag never applied: pushed as a plain array instead of through gtag(), to
+  // another dataLayer, or from a frame. Tag Assistant then says Consent Mode is not configured.
+  if (defaultEntry && tagStates.length && !tagDefault) {
+    findings.push({ ...base, severity: "warning", check: "consent_default_not_applied", step: stepLabel(defaultEntry.step), detail: d.consentDefaultNotApplied() });
+  }
   const defaults = run.dataLayerLog.filter((e) => isConsentCommand(e, "default"));
-  if (plan.consent_mode && defaults.length) {
-    const declared = new Set(defaults.flatMap((e) => Object.keys(e.value[2] ?? {})));
+  const declared = defaults.length
+    ? new Set(defaults.flatMap((e) => Object.keys(e.value[2] ?? {})))
+    : tagDefault ? new Set(Object.entries(tagDefault.entries).filter(([, e]) => e.default).map(([k]) => k)) : null;
+  if (plan.consent_mode && declared) {
     const missing = V2_SIGNALS.filter((k) => !declared.has(k));
     if (missing.length) findings.push({ ...base, severity: "risk", check: "consent_v2_missing", detail: d.consentV2Missing(missing) });
   }
   if (granted !== null) {
     const updates = run.dataLayerLog.filter((e) => isConsentCommand(e, "update"));
-    if (updates.length) {
-      const grantedKeys = new Set(updates.flatMap((e) => Object.entries(e.value[2] ?? {}).filter(([, v]) => v === "granted").map(([k]) => k)));
-      const missing = V2_SIGNALS.filter((k) => !grantedKeys.has(k));
-      if (missing.length) findings.push({ ...base, severity: "warning", check: "consent_v2_update", detail: d.consentV2Update(missing) });
-    }
+    const tagGrant = tagStates.find((st) => st.entries.ad_storage?.update === "granted");
+    const grantedKeys = updates.length
+      ? new Set(updates.flatMap((e) => Object.entries(e.value[2] ?? {}).filter(([, v]) => v === "granted").map(([k]) => k)))
+      : tagGrant ? new Set(Object.entries(tagGrant.entries).filter(([, e]) => e.update === "granted").map(([k]) => k)) : null;
+    const missing = grantedKeys ? V2_SIGNALS.filter((k) => !grantedKeys.has(k)) : [];
+    if (missing.length) findings.push({ ...base, severity: "warning", check: "consent_v2_update", detail: d.consentV2Update(missing) });
   }
 
   // Declining: nothing may be sent or stored for ads after the visitor said no.
@@ -441,14 +514,13 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     const reject = run.steps.find((s) => s.index === rejectStep);
     const regranted = run.dataLayerLog.find(
       (e) => e.step >= rejectStep && isConsentCommand(e, "update") && TRACKING_SIGNALS.some((k) => e.value[2]?.[k] === "granted"),
-    );
+    ) ?? tagStates.find((st) => st.step >= rejectStep && TRACKING_SIGNALS.some((k) => st.entries[k]?.update === "granted"));
     if (regranted) findings.push({ ...base, severity: "broken", check: "reject_ignored", step: stepLabel(regranted.step), detail: d.rejectIgnored() });
     else if (reject?.bannerOpenAfter) findings.push({ ...base, severity: "broken", check: "reject_button_failed", step: stepLabel(rejectStep), detail: d.rejectButtonFailed() });
     const afterReject = new Map();
     for (const hit of run.hits) {
       if (hit.step < rejectStep) continue;
-      const claimsGranted = hit.consent?.ad_storage === "granted" || hit.consent?.analytics_storage === "granted";
-      if (NON_GOOGLE_AD_PLATFORMS.has(hit.platform) || claimsGranted) {
+      if (NON_GOOGLE_AD_PLATFORMS.has(hit.platform) || claimsGranted(hit)) {
         const k = key(hit.platform, hit.name);
         if (!afterReject.has(k)) afterReject.set(k, hit);
       }
@@ -480,8 +552,7 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     const early = granted === null || hit.step < granted;
     if (!early) continue;
     const adPlatform = NON_GOOGLE_AD_PLATFORMS.has(hit.platform);
-    const googleClaimsGranted = hit.consent?.ad_storage === "granted" || hit.consent?.analytics_storage === "granted";
-    if (adPlatform || googleClaimsGranted) {
+    if (adPlatform || claimsGranted(hit)) {
       const k = key(hit.platform, hit.name);
       if (!beforeConsent.has(k)) beforeConsent.set(k, hit);
     }

package/src/cli.js

@@ -32,6 +32,7 @@ async function main(args = process.argv.slice(2)) {
       providers: { type: "string", multiple: true },
       "allow-host": { type: "string", multiple: true },
       "allow-private-network": { type: "boolean", default: false },
+      "allow-live": { type: "boolean", default: false },
       scripted: { type: "boolean", default: false },
       "no-ai": { type: "boolean", default: false },
       provider: { type: "string" },
@@ -79,7 +80,7 @@ async function main(args = process.argv.slice(2)) {
   }
   if (command === "mcp" && !values.help) {
     const { startMcp } = await import("./mcp.js");
-    await startMcp({ http: values.http, port: values.port ? Number(values.port) : undefined, host: values.host, token: values.token, reportsDir: values.reports, publicUrl: values["public-url"], allowPrivateNetwork: values["allow-private-network"] });
+    await startMcp({ http: values.http, port: values.port ? Number(values.port) : undefined, host: values.host, token: values.token, reportsDir: values.reports, publicUrl: values["public-url"], allowPrivateNetwork: values["allow-private-network"], allowLive: values["allow-live"] });
     return;
   }
   if (command === "replay" && !values.help) {

package/src/cmp.js

@@ -0,0 +1,166 @@
+// Which consent platform a page runs and how it is set up, read from the platform's own objects in the page,
+// so a report can say what the agent otherwise has to dig out of the platform's bundle by hand.
+
+/**
+ * Runs in the page. Efilli in full: its site bundle and the date it was compiled, the language in force,
+ * whether its own Consent Mode integration is on with the category each signal maps to, auto-blocking and TCF.
+ * The other platforms by name only. Null when none is found.
+ * @returns {null | { vendor: string, built?: string|null, script?: string|null, language?: string|null, categories?: string[],
+ *   consentMode?: { active: boolean, mapping: Record<string,string>|null, urlPassthrough: boolean, adsDataRedaction: boolean },
+ *   autoBlocking?: boolean, blockingRules?: number|null, tcf?: boolean }}
+ */
+export function detectCmpInPage() {
+  const w = window;
+  try {
+    const efilli = w.efilliSdk;
+    if (efilli?.consentManager) {
+      // getLanguage() is the language the page matched: Efilli keeps a whole setup, mapping included, per language.
+      const lang = efilli.configManager?.getLanguage?.() ?? {};
+      const mode = lang.consentMode ?? {};
+      return {
+        vendor: "Efilli",
+        built: typeof w.efilliBundleCompileDate === "string" ? w.efilliBundleCompileDate : null,
+        script: [...document.scripts].map((s) => s.src).find((src) => /^https:\/\/bundles\.efilli\.com\//.test(src)) ?? null,
+        language: typeof lang.name === "string" ? lang.name : null,
+        categories: Object.keys(efilli.consentManager.getCategories?.() ?? {}),
+        consentMode: {
+          active: Boolean(mode.active),
+          mapping: mode.mapping && typeof mode.mapping === "object" ? { ...mode.mapping } : null,
+          urlPassthrough: Boolean(mode.url_passthrough),
+          adsDataRedaction: Boolean(mode.ads_data_redaction),
+        },
+        autoBlocking: Boolean(lang.autoBlocking ?? efilli.configManager?.isAutoBlockingEnabled?.()),
+        blockingRules: Array.isArray(lang.blockingRules) ? lang.blockingRules.length : null,
+        tcf: Boolean(lang.tcf?.active),
+      };
+    }
+    const cky = w.cookieyes?._ckyStore;
+    if (cky && Array.isArray(cky._categories)) {
+      return {
+        vendor: "CookieYes",
+        script: [...document.scripts].map((s) => s.src).find((src) => /^https:\/\/cdn-cookieyes\.com\/client_data\/[^/]+\/script\.js/.test(src)) ?? null,
+        law: typeof cky._bannerConfig?.activeLaw === "string" ? cky._bannerConfig.activeLaw : null,
+        categories: cky._categories.map((c) => c.slug).filter((s) => typeof s === "string"),
+        // CookieYes fixes the mapping in its code rather than its setup; read off its consent updates in November 2026.
+        consentMode: { fixed: true, mapping: { ad_storage: "advertisement", ad_user_data: "advertisement", ad_personalization: "advertisement", analytics_storage: "analytics", functionality_storage: "functional", personalization_storage: "functional", security_storage: "necessary" } },
+        autoBlocking: Array.isArray(cky._providersToBlock) && cky._providersToBlock.length > 0,
+        blockingRules: Array.isArray(cky._providersToBlock) ? cky._providersToBlock.length : null,
+      };
+    }
+    const domain = w.OneTrust?.GetDomainData?.();
+    if (domain && typeof domain === "object") {
+      // GoogleConsent names, per signal, the consent group that grants it; the groups carry their names.
+      const gc = domain.GoogleConsent ?? {};
+      const groups = Object.fromEntries((domain.Groups ?? []).map((g) => [String(g.OptanonGroupId), g.GroupName]));
+      const bySignal = { ad_storage: gc.GCAdStorage, analytics_storage: gc.GCAnalyticsStorage, ad_user_data: gc.GCAdUserData, ad_personalization: gc.GCAdPersonalization, functionality_storage: gc.GCFunctionalityStorage, personalization_storage: gc.GCPersonalizationStorage, security_storage: gc.GCSecurityStorage };
+      const mapping = Object.fromEntries(Object.entries(bySignal).filter(([, id]) => id !== undefined && id !== null && id !== "").map(([k, id]) => [k, groups[id] ? `${groups[id]} (${id})` : String(id)]));
+      const scripts = [...document.scripts];
+      // The site's own setup file, /consent/<id>/<id>.js: its date is when the setup was last published.
+      const id = scripts.find((s) => /\/otSDKStub\.js/.test(s.src))?.getAttribute("data-domain-script");
+      const geo = w.OneTrust.getGeolocationData?.();
+      const model = domain.ConsentModel?.Name ?? domain.ConsentModel;
+      return {
+        vendor: "OneTrust",
+        version: scripts.map((s) => s.src.match(/\/scripttemplates\/(\d+\.\d+\.\d+)\/otBannerSdk\.js/)?.[1]).find(Boolean) ?? null,
+        script: id ? scripts.map((s) => s.src).find((src) => src.endsWith(`/consent/${id}/${id}.js`)) ?? `https://cdn.cookielaw.org/consent/${id}/${id}.js` : null,
+        categories: Object.values(groups),
+        consentModel: typeof model === "string" ? model : null,
+        // Opt-out, implied and notice-only models let tags run before the visitor chooses.
+        impliedConsent: typeof model === "string" && /opt-?out|implied|notice/i.test(model),
+        region: geo?.country ? [geo.country, geo.state].filter(Boolean).join("-") : null,
+        consentMode: { active: Boolean(gc.GCEnable), mapping: Object.keys(mapping).length ? mapping : null, urlPassthrough: false, adsDataRedaction: Boolean(gc.GCRedactEnable) },
+        tcf: Boolean(domain.IsIabEnabled),
+      };
+    }
+    // Cookiebot's newer script names its object CookieConsent only.
+    const cb = w.Cookiebot ?? w.CookieConsent;
+    if (cb && typeof cb.submitCustomConsent === "function") {
+      return {
+        vendor: "Cookiebot",
+        version: cb.version !== undefined && cb.version !== null ? String(cb.version) : null,
+        // The banner setup, /consentconfig/<cbid>/settings.json: its date is when the setup was last published.
+        script: typeof cb.serial === "string" ? `https://consentcdn.cookiebot.com/consentconfig/${cb.serial}/settings.json` : null,
+        categories: ["necessary", "preferences", "statistics", "marketing"],
+        consentModel: typeof cb.responseMode === "string" ? cb.responseMode : null,
+        region: typeof cb.userCountry === "string" ? cb.userCountry : null,
+        impliedConsent: cb.consent?.method === "implied",
+        // Cookiebot fixes the mapping in its code; read off its consent updates in November 2026.
+        consentMode: {
+          fixed: true, active: !cb.consentModeDisabled,
+          mapping: { ad_storage: "marketing", ad_user_data: "marketing", ad_personalization: "marketing", analytics_storage: "statistics", functionality_storage: "preferences", personalization_storage: "preferences", security_storage: "necessary" },
+          redaction: typeof cb.consentModeDataRedaction === "string" ? cb.consentModeDataRedaction : cb.consentModeDataRedaction ? "true" : "false",
+        },
+        autoBlocking: Boolean(cb.autoblock),
+        tcf: Boolean(cb.framework),
+      };
+    }
+    if (w.OneTrust || w.OptanonWrapper) return { vendor: "OneTrust" };
+    if (w.UC_UI || w.UC_UI_IS_RENDERED !== undefined) return { vendor: "Usercentrics" };
+    if (w.Didomi) return { vendor: "Didomi" };
+  } catch {
+    // A platform object that throws when read is the same as none.
+  }
+  return null;
+}
+
+/** The consent platform's script dates from the run's network calls: each consent script's Last-Modified header, once per address. */
+export function cmpScriptDates(run) {
+  return (run.network ?? [])
+    .filter((c) => c.provider === "consent" && c.lastModified)
+    .map((c) => ({ url: c.url, lastModified: c.lastModified }))
+    .filter((c, i, list) => list.findIndex((x) => x.url === c.url) === i);
+}
+
+const day = (d) => {
+  const t = Date.parse(d);
+  return Number.isNaN(t) ? String(d) : new Date(t).toISOString().slice(0, 10);
+};
+const hostPath = (url) => {
+  try {
+    const u = new URL(url);
+    return `${u.hostname}${u.pathname}`;
+  } catch {
+    return String(url);
+  }
+};
+
+/**
+ * The consent platform of a set of runs as { vendor, facts }: one sentence per fact, in the report's language.
+ * Null when no run saw a consent platform. The same sentences go to the HTML report, report.md and MCP.
+ */
+export function cmpFacts(m, runs) {
+  const cmp = runs.map((r) => r.cmp).find(Boolean) ?? null;
+  const dates = runs.flatMap(cmpScriptDates);
+  if (!cmp && !dates.length) return null;
+  const c = m.ui.cmp;
+  const vendor = cmp?.vendor ?? c.unknown;
+  const facts = [];
+  // The platform's own script or setup file when it is known; on the vendor's own site every first-party file looks
+  // like the platform's. OneTrust and Cookiebot name a setup file, whose date is when the site last published its setup.
+  const setupFile = ["OneTrust", "Cookiebot"].includes(cmp?.vendor);
+  // OneTrust serves its setup as <id>.js or <id>.json, whichever its script asks for.
+  const base = (url) => String(url).replace(/\.(js|json)$/, "");
+  const own = cmp?.script ? dates.find((d) => base(d.url) === base(cmp.script)) : null;
+  // A known setup file without a date gets none, rather than the date of some other file.
+  const dated = own ?? (setupFile && cmp?.script ? null : dates[0]);
+  if (cmp?.built) facts.push(c.built(day(cmp.built)));
+  else if (dated) facts.push(own && setupFile ? c.published(day(dated.lastModified), hostPath(dated.url)) : c.scriptDated(day(dated.lastModified), hostPath(dated.url)));
+  if (cmp?.version) facts.push(c.version(cmp.version));
+  if (cmp?.script) facts.push(setupFile ? c.setupFile(cmp.script) : c.script(cmp.script));
+  if (cmp?.consentModel) facts.push(c.model(cmp.consentModel, cmp.region ?? null));
+  if (cmp?.impliedConsent) facts.push(c.implied);
+  if (cmp?.language) facts.push(c.language(cmp.language));
+  if (cmp?.law) facts.push(c.law(cmp.law));
+  if (cmp?.categories?.length) facts.push(c.categories(cmp.categories));
+  if (cmp?.consentMode) {
+    const mapping = cmp.consentMode.mapping ? c.mapping(Object.entries(cmp.consentMode.mapping)) : "";
+    if (cmp.consentMode.active === false) facts.push(c.modeOff(vendor, mapping));
+    else if (cmp.consentMode.fixed) facts.push(c.modeFixed(vendor, mapping));
+    else if (cmp.vendor === "OneTrust") facts.push(c.modeOn(vendor, mapping), c.redaction(cmp.consentMode.adsDataRedaction ? "on" : "off"));
+    else facts.push(c.modeOn(vendor, mapping), c.passthrough(cmp.consentMode.urlPassthrough, cmp.consentMode.adsDataRedaction));
+    if (cmp.consentMode.redaction && cmp.consentMode.active !== false) facts.push(c.redaction(cmp.consentMode.redaction));
+  }
+  if (typeof cmp?.autoBlocking === "boolean") facts.push(cmp.vendor === "CookieYes" ? c.providerBlocking(cmp.blockingRules ?? 0) : c.autoBlocking(cmp.autoBlocking, cmp.blockingRules ?? 0));
+  if (typeof cmp?.tcf === "boolean") facts.push(c.tcf(cmp.tcf));
+  return { vendor, facts };
+}