@dreamdata_io/verify-tracking 0.1.0

package/dist/evidence/constants.js

@@ -0,0 +1,615 @@
+export const DREAMDATA_CDN_HOST = "cdn.dreamdata.cloud";
+// The cookieless bundle is served from a distinct CDN host; event delivery
+// (the POST requests) from either bundle still targets DREAMDATA_CDN_HOST by
+// default — these hosts only matter for detecting the <script> tag itself.
+export const DREAMDATA_COOKIELESS_SCRIPT_HOST = "cdn.drda.io";
+export const DEFAULT_SCRIPT_HOSTS = [DREAMDATA_CDN_HOST, DREAMDATA_COOKIELESS_SCRIPT_HOST];
+/**
+ * Hostnames Dreamdata serves from: the shared CDNs plus per-tenant subdomains
+ * of the first-party zones (api.s.dreamdata.io, evs.s.dreamdata.io, …). Fully
+ * anchored and requiring at least one subdomain label, so the bare
+ * dreamdata.io apex does not match — it shows up in unrelated referer strings.
+ *
+ * Tested against a URL's *hostname*, never the whole URL, so a third party's
+ * `?referer=dreamdata.io` query string cannot trigger it.
+ */
+export const DREAMDATA_HOST_PATTERN = /^(?:[a-z0-9-]+\.)+(?:dreamdata\.(?:io|cloud)|drda\.io)$/i;
+/** Matches a Dreamdata-owned origin written out inside an inline snippet. */
+export const DREAMDATA_ORIGIN_IN_SNIPPET = /https?:\/\/(?:[a-z0-9-]+\.)+(?:dreamdata\.(?:io|cloud)|drda\.io)/i;
+/**
+ * Hosts that receive event requests. Installs that front Dreamdata with a
+ * first-party CNAME (e.g. evs.s.dreamdata.io on dreamdata.io itself) deliver
+ * to their own host instead, so this is configurable via --tracking-host.
+ */
+export const DEFAULT_TRACKING_HOSTS = [DREAMDATA_CDN_HOST];
+/**
+ * Real Segment's own CDN — a `<script src>` pointing here is Segment's
+ * actual analytics.js/analytics-next library, NOT a Dreamdata bundle, even
+ * though the site may still be forwarding events to Dreamdata behind the
+ * scenes. See ThirdPartySegmentEvidence for why this harness can only ever
+ * report that this script exists, never whether Dreamdata receives anything.
+ */
+export const THIRD_PARTY_SEGMENT_SCRIPT_HOST = "cdn.segment.com";
+/**
+ * Segment's own event-collection endpoint. A request here proves the site is
+ * instrumented with real Segment and actively sending it events — nothing
+ * more. Whether Segment then forwards a copy to Dreamdata is a server-side
+ * destination/connection this harness cannot observe.
+ */
+export const THIRD_PARTY_SEGMENT_TRACKING_HOST = "api.segment.io";
+/**
+ * Event endpoints appear as /api/v1/<letter> on the shared CDN and as plain
+ * /v1/<letter> on first-party delivery hosts (e.g. api.s.dreamdata.io/v1/p),
+ * so the /api/ segment is optional.
+ */
+export const ENDPOINT_REGEX = /\/(?:api\/)?v1\/([a-z])(?:[/?]|$)/;
+// The single most reliable per-request signal for which bundle sent an
+// event: the delivery plugin stamps this into every payload's context.
+export const COOKIELESS_LIBRARY_NAME_MARKER = "cookieless";
+export const COOKIELESS_GLOBAL_KEY = "dreamdata-cl";
+/**
+ * Segment-compatible installs expose the queue/SDK as window.analytics
+ * rather than window.dreamdata. Both are valid Dreamdata deployments.
+ */
+export const SEGMENT_COMPAT_GLOBAL_KEY = "analytics";
+// Matches the writeKey segment out of the installed script's src, e.g.
+// https://cdn.dreamdata.cloud/scripts/analytics.js/v1/{writeKey}/analytics.min.js
+// or .../analytics/js/v1/{writeKey}/analytics...
+export const WRITE_KEY_FROM_SCRIPT_SRC = /\/analytics(?:\.js|\/js)\/v1\/([^/]+)/i;
+/**
+ * Segment-style snippets assign the key instead of putting it in the src:
+ * `analytics._writeKey="…"` or `writeKey: "…"`. The `=` is why the older
+ * colon/quote-only pattern missed real installs.
+ */
+export const WRITE_KEY_FROM_SNIPPET = /\b_?writeKey["']?\s*[:=]\s*["']([\w-]+)["']/i;
+/** `analytics.load("{writeKey}")` — the last-resort snippet fallback. */
+export const WRITE_KEY_FROM_LOAD_CALL = /\.load\(\s*["']([\w-]+)["']/i;
+/**
+ * Dreamdata ships auxiliary scripts (e.g. the identify-form helper) from the
+ * same CDN. They are not tracking bundles, so matching one must not count as
+ * "the script is installed".
+ */
+export const HELPER_SCRIPT_PATH_MARKERS = ["/scripts/identify-form/"];
+export const ENDPOINT_NAMES = {
+    p: "page",
+    i: "identify",
+    t: "track",
+    a: "alias",
+    g: "group",
+    s: "screen",
+    b: "batch",
+};
+export const DD_COOKIE_NAMES = [
+    "dd_anonymous_id",
+    "dd_user_id",
+    "dd_user_traits",
+    "dd_group_id",
+    "dd_group_properties",
+];
+export const AJS_COOKIE_PREFIX = "ajs_";
+/** Segment-compatibility equivalents of DD_COOKIE_NAMES, same order. */
+export const AJS_COOKIE_NAMES = [
+    "ajs_anonymous_id",
+    "ajs_user_id",
+    "ajs_user_traits",
+    "ajs_group_id",
+    "ajs_group_properties",
+];
+export const MESSAGE_ID_PATTERN = /^ajs-next-/;
+export const DREAMDATA_METHODS = [
+    "page",
+    "track",
+    "identify",
+    "group",
+    "alias",
+    "screen",
+    "ready",
+    "setAnonymousId",
+    "trackForm",
+    "trackLink",
+];
+/**
+ * How long a parsed document is given to go quiet before a run carries on.
+ *
+ * A bounded settle, not a completion condition. Waiting on `networkidle` for
+ * a whole navigation timeout reads as "wait until the page has finished", but
+ * a page that keeps a socket open — a chat widget, an analytics heartbeat, a
+ * bot wall polling its own challenge endpoint — never reaches idle at all, so
+ * such a wait always runs to the full timeout. A page that does go quiet is
+ * waited for exactly as before; one that never does costs this much and no
+ * more, and that is not an error.
+ */
+export const NETWORK_SETTLE_MS = 5_000;
+/**
+ * How long an interaction-gated banner is given to mount after the nudge that
+ * should reveal it. It is a synchronous DOM build in every case seen so far —
+ * this is slack for a framework's render tick, not a wait for a timer.
+ */
+export const BANNER_REVEAL_SETTLE_MS = 750;
+/**
+ * How far the nudge scrolls. Enough to cross a scroll-depth trigger's first
+ * threshold — catonetworks.com's GTM tags need one — and small enough that the
+ * page is still showing what it shows on arrival. Restored to 0 straight after.
+ */
+export const BANNER_REVEAL_SCROLL_PX = 300;
+/**
+ * CMP vendors we can detect and, where possible, drive programmatically.
+ * `globalKey` is probed on window; order is most-specific first.
+ */
+export const CMP_VENDORS = [
+    { id: "cookiebot", globalKey: "Cookiebot" },
+    { id: "onetrust", globalKey: "OneTrust" },
+    { id: "onetrust", globalKey: "OptanonActiveGroups" },
+    { id: "onetrust", globalKey: "OnetrustActiveGroups" },
+    { id: "usercentrics", globalKey: "UC_UI" },
+    { id: "cookieyes", globalKey: "getCkyConsent" },
+    { id: "generic-cookieconsent", globalKey: "CookieConsent" },
+    { id: "iab-tcf", globalKey: "__tcfapi" },
+    { id: "iab-cmp", globalKey: "__cmp" },
+    { id: "osano", globalKey: "Osano" },
+    { id: "complianz", globalKey: "complianz" },
+];
+export const KNOWN_CMP_GLOBALS = CMP_VENDORS.map((v) => v.globalKey);
+/**
+ * Fallback used only when no named vendor/DOM banner matched: a bespoke,
+ * hand-rolled banner exposes no global and no recognisable id/class, so the
+ * only thing left to go on is a clickable control's own text. Kept to exact
+ * phrases actually seen on cookie banners, not "contains accept", so an
+ * unrelated page control (a signup form's "Accept" button) is never matched
+ * on text alone — see heuristic-banner.ts for the container check that is
+ * the real safeguard against a false match.
+ */
+export const GENERIC_ACCEPT_PHRASES = [
+    "accept all",
+    "accept all cookies",
+    "allow all",
+    "allow all cookies",
+    "i accept",
+    "agree",
+    "agree to all",
+    "accept cookies",
+    "allow cookies",
+    // A banner with no reject button often has no "all" to accept either, so
+    // its one control just says what happens next. meteomatics.com's
+    // "Accept and continue" is the case this list was missing: nothing matched
+    // it, so the banner was reported as absent and all three phases measured
+    // the same unanswered page.
+    "accept and continue",
+    "accept & continue",
+    "agree and continue",
+    "agree & continue",
+    "accept and close",
+    "agree and close",
+    "accept and proceed",
+    "agree and proceed",
+];
+/** Reject-side equivalents of GENERIC_ACCEPT_PHRASES. */
+export const GENERIC_REJECT_PHRASES = [
+    "necessary only",
+    "only necessary",
+    "essential only",
+    "only essential",
+    "reject all",
+    "decline all",
+    "reject",
+    "decline",
+    "deny",
+    "refuse all",
+    // Osano's own reject button says what it rejects rather than "all":
+    // achievers.com offers "Accept All" and "Reject Non-Essential", so nothing
+    // here matched, the banner failed the counterpart test in
+    // heuristic-banner.ts, and a banner sitting in plain markup went unseen.
+    "reject non-essential",
+    "reject non-essential cookies",
+    "decline non-essential",
+    "decline non-essential cookies",
+];
+/**
+ * A matched accept/reject control only counts as a real banner when some
+ * ancestor's text also mentions one of these — otherwise text matching alone
+ * would happily click an unrelated "Accept"/"Decline" button elsewhere on
+ * the page.
+ */
+export const BANNER_CONTEXT_KEYWORDS = ["cookie", "consent", "privacy", "gdpr"];
+/**
+ * Banners recognised by a DOM element rather than a window global.
+ *
+ * HubSpot's banner is the reason this list exists: window._hsp is present on
+ * every HubSpot-tracked page whether or not a banner is shown, so probing it
+ * would invent a consent gate on sites that deliberately have none. The
+ * banner element only exists when the banner is actually rendered.
+ */
+export const DOM_ONLY_CMP_VENDORS = [
+    { id: "hubspot", bannerElementId: "hs-eu-cookie-confirmation", responseCookiePrefix: "__hs_cookie_cat_pref" },
+    // Salesforce Pardot's standard tracking-code opt-in snippet. piEnableTracking
+    // and piDisableTracking are defined on window as part of every Pardot
+    // tracking snippet whether or not a banner is ever shown to this visitor
+    // (much like HubSpot's window._hsp), so probing for those globals the way
+    // CMP_VENDORS does would invent a consent gate on any Pardot-tracked page.
+    // The banner div only exists when the banner is actually rendered.
+    { id: "pardot", bannerElementId: "pi_tracking_opt_in_div", responseCookiePrefix: "pi_opt_in987432" },
+];
+/**
+ * True when a URL's host belongs to Dreamdata, or is one the operator named
+ * explicitly via --tracking-host (needed for a fully custom CNAME).
+ */
+export function isDreamdataUrl(url, extraHosts = []) {
+    if (extraHosts.some((host) => url.includes(host)))
+        return true;
+    try {
+        return DREAMDATA_HOST_PATTERN.test(new URL(url).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Path fragments a second-page probe refuses to follow.
+ *
+ * These pages are the ones most likely to sit outside the site's own tracking
+ * setup — a separate template, a third-party host, an auth redirect — so a
+ * missing request there would say nothing about the install, and a consent
+ * banner's own "privacy policy" link is exactly the kind of link that would
+ * otherwise get picked.
+ */
+export const SECOND_PAGE_PATH_DENYLIST = [
+    "privacy",
+    "cookie",
+    "legal",
+    "terms",
+    "gdpr",
+    "imprint",
+    "login",
+    "signin",
+    "sign-in",
+    "signup",
+    "sign-up",
+    "register",
+    "logout",
+    "account",
+    "checkout",
+    "cart",
+    "search",
+];
+/** Extensions that are a download or an asset rather than a tracked page view. */
+export const SECOND_PAGE_ASSET_EXTENSIONS = [
+    ".pdf",
+    ".zip",
+    ".dmg",
+    ".exe",
+    ".csv",
+    ".xlsx",
+    ".doc",
+    ".docx",
+    ".ppt",
+    ".pptx",
+    ".jpg",
+    ".jpeg",
+    ".png",
+    ".gif",
+    ".svg",
+    ".webp",
+    ".mp4",
+    ".mp3",
+    ".xml",
+    ".json",
+    ".rss",
+];
+/** Attribute stamped on the link the second-page probe decided to follow. */
+export const SECOND_PAGE_LINK_ATTRIBUTE = "data-dd-second-page-link";
+/**
+ * How many ranked links the probe keeps in reserve, and how many of them it is
+ * willing to walk past when they land on a page with no install on it.
+ *
+ * Each retry costs a navigation back to the first page plus a navigation out
+ * again, three times a run. Three is enough to clear a site with two or three
+ * separately-built sections near the top of the nav (whereby.com's Gatsby blog
+ * being the case this exists for) without letting a site with nothing
+ * instrumented anywhere spend the whole budget proving it.
+ */
+export const SECOND_PAGE_MAX_RETRIES = 3;
+/** Ranked links kept per page — enough to survive the retries above. */
+export const SECOND_PAGE_MAX_CANDIDATES = 12;
+/** Filenames the two bundles are served under, used to classify a tag by src. */
+export const DREAMDATA_NORMAL_SCRIPT_FILE = "dreamdata.min.js";
+export const DREAMDATA_COOKIELESS_SCRIPT_FILE = "dreamdata.cl.min.js";
+/** Element ids the loader snippets stamp onto the <script> tags they inject. */
+export const NORMAL_BUNDLE_ELEMENT_ID = "dreamdata-analytics";
+export const COOKIELESS_BUNDLE_ELEMENT_ID = "dreamdata-analytics-cl";
+/**
+ * The cookieless loader names its normal-bundle companion by element id
+ * (`getElementById("dreamdata-analytics")`) so it can stand down when the
+ * normal bundle is unblocked. That reference is the strongest in-page proof
+ * that a normal bundle belongs to the deployment even when consent has kept
+ * it out of the DOM entirely.
+ *
+ * Quoted deliberately: the cookieless tag's own id is "dreamdata-analytics-cl",
+ * which an unanchored substring match would happily mistake for the companion.
+ */
+export const NORMAL_COMPANION_REFERENCE = /["']dreamdata-analytics["']|data-global-dreamdata-analytics-key/;
+/**
+ * How CMPs neutralise a tag they are gating. A tag matching any of these is
+ * installed but deliberately not executing — the opposite of "not installed",
+ * and the distinction the cookieless-by-design verdict hinges on.
+ */
+export const CMP_SCRIPT_BLOCK_MARKERS = [
+    { pattern: /type=["']text\/plain["']/i, vendor: "generic (type=text/plain)" },
+    { pattern: /type=["']text\/gtmscript["']/i, vendor: "google-tag-manager" },
+    { pattern: /optanon-category/i, vendor: "onetrust" },
+    { pattern: /data-ot-ignore/i, vendor: "onetrust" },
+    { pattern: /data-cookieconsent=/i, vendor: "cookiebot" },
+    { pattern: /cmplz-script|data-cmplz/i, vendor: "complianz" },
+    { pattern: /data-cookieyes|class=["'][^"']*cky-/i, vendor: "cookieyes" },
+    { pattern: /data-usercentrics/i, vendor: "usercentrics" },
+];
+/**
+ * Which consent platform a document is wired to, read off the raw markup
+ * alone — the script the CMP loads, not a window global or a rendered banner.
+ *
+ * Used only by the plain-HTTP probe, which executes nothing and so can never
+ * see a global or a banner element. Its job there is corroboration: a served
+ * document that loads OneTrust, next to a rendered page where
+ * consent.cmpDetected came back false in every phase, is the browser having
+ * been shown a different document — not a site without a banner.
+ */
+export const CMP_MARKUP_MARKERS = [
+    { pattern: /cdn\.cookielaw\.org|otSDKStub|optanon/i, vendor: "onetrust" },
+    { pattern: /consent\.cookiebot\.com|Cookiebot/i, vendor: "cookiebot" },
+    { pattern: /app\.usercentrics\.eu|usercentrics/i, vendor: "usercentrics" },
+    { pattern: /cdn-cookieyes\.com|cookieyes/i, vendor: "cookieyes" },
+    { pattern: /cmp\.osano\.com|osano/i, vendor: "osano" },
+    { pattern: /consent\.trustarc\.com|trustarc/i, vendor: "trustarc" },
+    { pattern: /app\.termly\.io|termly/i, vendor: "termly" },
+    { pattern: /global\.ketchcdn\.com|ketch/i, vendor: "ketch" },
+    { pattern: /cookie-?script\.com/i, vendor: "cookiescript" },
+    { pattern: /cmplz-|complianz/i, vendor: "complianz" },
+    { pattern: /hs-eu-cookie-confirmation/i, vendor: "hubspot" },
+    { pattern: /pi_tracking_opt_in_div/i, vendor: "pardot" },
+];
+/**
+ * Markup that names a framework shipping a client-side router.
+ *
+ * A marker is NOT evidence of client-side routing, and nothing may read this
+ * list as if it were. yougov.com serves ng-version, ships the Angular router,
+ * and loaded a new document for every link the run followed; Astro and Gatsby
+ * ship routers and are routinely deployed as plain multi-page sites. What a
+ * marker buys is the one case where behaviour is unavailable: zoominfo.com's
+ * bot wall left secondPage.kind null in all three phases, and its served
+ * markup names Next.js 115 times over — the only routing hint that survived
+ * the wall. See RoutingMode, where a marker can reach "suspected" and never
+ * an observed mode.
+ *
+ * Deliberately excludes the root-container markers (id="root", id="app"):
+ * jumpcloud.com is WordPress and has id="app", which makes that pattern a
+ * false-positive generator rather than a signal. Excludes data-reactroot for
+ * the same reason at one remove — it says the document was server-rendered by
+ * React, which is an argument about how the page arrived, not about how it
+ * navigates. Excludes astro-island, which argues against client routing.
+ *
+ * Case-sensitive on purpose: __NEXT_DATA__ and __NUXT__ are exact
+ * identifiers, and a case-insensitive /next/ matches ordinary prose.
+ */
+export const CSR_FRAMEWORK_MARKERS = [
+    { pattern: /__NEXT_DATA__|\/_next\/static\//, framework: "next" },
+    { pattern: /id="__nuxt"|__NUXT__|\/_nuxt\//, framework: "nuxt" },
+    { pattern: /__remixContext/, framework: "remix" },
+    { pattern: /__sveltekit_|data-sveltekit-/, framework: "sveltekit" },
+    { pattern: /page-data\/app-data\.json|\/page-data\//, framework: "gatsby" },
+    { pattern: /\sng-version="/, framework: "angular" },
+];
+/**
+ * Tag managers inject the bundle at runtime, so a consent-gated normal bundle
+ * never reaches the DOM to be found. Reading the published container is the
+ * only way to see that it exists at all.
+ */
+export const GTM_CONTAINER_ID_PATTERN = /^GTM-[A-Z0-9]+$/;
+/**
+ * The same id lifted out of page markup, for sites that keep it in config and
+ * load GTM later (or not at all under automation) — window.google_tag_manager
+ * is empty exactly when the container is what we most need to read.
+ */
+export const GTM_CONTAINER_ID_IN_TEXT = /GTM-[A-Z0-9]{4,10}/g;
+export function gtmContainerUrl(containerId) {
+    return `https://www.googletagmanager.com/gtm.js?id=${encodeURIComponent(containerId)}`;
+}
+/**
+ * Banners that offer no "Reject all" at all — only "Accept all" and a
+ * settings/preferences link — are common enough that refusing them is a
+ * distinct flow rather than an edge case: open the preference centre, leave
+ * every non-essential category off, and save. These are the vendor controls
+ * that open that panel. Kept vendor-namespaced so a wrong guess simply
+ * matches nothing rather than clicking an unrelated page control.
+ */
+export const PREFERENCE_CENTER_OPEN_SELECTORS = [
+    ".cky-btn-customize",
+    "#onetrust-pc-btn-handler",
+    ".ot-sdk-show-settings",
+    ".optanon-toggle-display",
+    "#usercentrics-root >>> button[data-testid='uc-more-button']",
+    "#usercentrics-root >>> button[data-testid='uc-customize-anchor']",
+    "#CybotCookiebotDialogBodyLevelButtonLevelOptinShowDetails",
+    "#CybotCookiebotDialogBodyButtonDetails",
+    ".osano-cm-manage",
+    ".cmplz-manage-options",
+    "#cookiescript_manage",
+    ".iubenda-cs-customize-btn",
+    ".t-preference-button",
+    "#hs-eu-cookie-settings-button",
+];
+/**
+ * The "commit what the toggles now say" control inside that panel — NOT an
+ * accept-all/reject-all shortcut, which would discard the toggle states we
+ * just set.
+ */
+export const PREFERENCE_CENTER_SAVE_SELECTORS = [
+    ".cky-btn-preferences",
+    ".save-preference-btn-handler",
+    "#usercentrics-root >>> button[data-testid='uc-save-button']",
+    "#CybotCookiebotDialogBodyLevelButtonLevelOptinAllowallSelection",
+    "#CybotCookiebotDialogBodyButtonAcceptSelected",
+    ".osano-cm-save",
+    ".cmplz-save-preferences",
+    "#cookiescript_save",
+    ".iubenda-cs-save-btn",
+    ".t-saveButton",
+];
+/**
+ * Text fallback for the same two controls on a banner with no recognised
+ * vendor. Ordered most-specific-first: the least ambiguous phrase that
+ * matches wins, so a panel containing both "Save my preferences" and a bare
+ * "Save" never picks the vague one. The bare entries at the tail are only
+ * safe because both searches are scoped to a container that mentions cookies
+ * and holds the consent toggles — see preference-center.ts.
+ */
+export const GENERIC_PREFERENCE_OPEN_PHRASES = [
+    "cookie settings",
+    "cookies settings",
+    "cookie preferences",
+    "cookies preferences",
+    // Osano's drawer link. Names the storage it governs rather than cookies
+    // outright, which is specific enough to prove a banner is one.
+    "storage preferences",
+    "manage cookies",
+    "manage preferences",
+    "manage options",
+    "manage choices",
+    "manage settings",
+    "customize settings",
+    "customise settings",
+    "customize cookies",
+    "customise cookies",
+    "cookie options",
+    "let me choose",
+    "more options",
+    "customize",
+    "customise",
+    "preferences",
+    "settings",
+];
+/**
+ * The cookie-explicit half of GENERIC_PREFERENCE_OPEN_PHRASES, used where a
+ * settings link has to stand in for the missing reject button rather than
+ * merely be clicked once a banner is already established.
+ *
+ * heuristic-banner.ts proves a banner is a banner by finding the
+ * OPPOSITE-direction control next to the one it matched. A banner offering
+ * only "Accept and continue" and "Cookie Settings" has no opposite control at
+ * all, so that test failed and the whole banner went unseen — including by
+ * the preference-centre flow written for exactly this shape. A settings link
+ * is allowed to play the counterpart's part, but only when it names cookies
+ * outright: the vaguer tail of the open list ("settings", "preferences",
+ * "customize") sits in far too many page footers to prove anything.
+ */
+export const PREFERENCE_CENTER_COUNTERPART_PHRASES = [
+    "cookie settings",
+    "cookies settings",
+    "cookie preferences",
+    "cookies preferences",
+    "storage preferences",
+    "cookie options",
+    "manage cookies",
+    "customize cookies",
+    "customise cookies",
+    "manage preferences",
+    "manage choices",
+    "manage options",
+    "let me choose",
+];
+/**
+ * Context keywords for the CATEGORY TOGGLES inside a preference centre —
+ * deliberately narrower than BANNER_CONTEXT_KEYWORDS, which keeps "privacy".
+ *
+ * Nearly every marketing form on the web has a "I agree to the Terms and
+ * Privacy Policy" checkbox, so "privacy" alone pulls unrelated form controls
+ * into the toggle set; the panel is then computed as the smallest element
+ * containing all of them, which is the whole page, and the save-button search
+ * is scoped to the whole page with it. A consent category names cookies or
+ * consent.
+ */
+export const PREFERENCE_PANEL_CONTEXT_KEYWORDS = ["cookie", "consent", "gdpr"];
+/**
+ * How much text a container may hold and still count as the panel a toggle
+ * lives in. A preference centre's own copy is a few hundred to a few thousand
+ * characters; the <main> that happens to contain both a newsletter form and a
+ * cookie banner is one to two orders of magnitude larger (168k on
+ * meteomatics.com). Without this bound the keyword narrowing above is not
+ * enough on its own, since a page-level ancestor mentions cookies via the
+ * banner it contains.
+ */
+export const PREFERENCE_PANEL_MAX_CONTEXT_CHARS = 6000;
+/** Save-side equivalents of GENERIC_PREFERENCE_OPEN_PHRASES. */
+export const GENERIC_SAVE_PREFERENCES_PHRASES = [
+    "save my preferences",
+    "save my choices",
+    "save my settings",
+    "save preferences",
+    "save settings",
+    "save choices",
+    "save selection",
+    "allow selection",
+    "confirm my choices",
+    "confirm my preferences",
+    "confirm choices",
+    "confirm selection",
+    "save and close",
+    "save & close",
+    "save and exit",
+    "save & exit",
+    "save and accept",
+    "save",
+    "confirm",
+    "apply",
+    "done",
+];
+/**
+ * A category toggle matching any of these is the always-on essential bucket.
+ * Turning it off is not something a visitor can do, and attempting it is how
+ * a panel ends up in a state it refuses to save.
+ */
+export const ESSENTIAL_CATEGORY_PATTERN = /necessar|essential|strictly|required|mandatory|always active|always on/i;
+/**
+ * Everything after "Content Security Policy directive:" in a CSP violation
+ * message — the site's whole policy, reproduced verbatim by the browser.
+ *
+ * It is quoted evidence about the SITE, not about the resource that was
+ * blocked, and matching against it is how idtdna.com got a failing
+ * console-clean check for a blocked ad.doubleclick.net request: the policy it
+ * violated happens to allow cdn.dreamdata.cloud, so the word "dreamdata"
+ * appeared in a message that has nothing to do with Dreamdata. The blocked
+ * URL always precedes this clause, so a CSP error that really does block
+ * Dreamdata still matches on the part that names it.
+ */
+const CSP_POLICY_CLAUSE = /Content Security Policy directive:[\s\S]*/i;
+/**
+ * Is this console message ABOUT Dreamdata, rather than merely containing the
+ * word somewhere?
+ */
+export function mentionsDreamdata(text) {
+    return /dreamdata/i.test(text.replace(CSP_POLICY_CLAUSE, ""));
+}
+/**
+ * The vocabulary a console message uses when something actually went wrong.
+ *
+ * Matched against the message the SITE wrote, not the browser's own wrapper,
+ * so it stays deliberately plain: the words a developer reaches for when
+ * reporting a failure, not a catalogue of Dreamdata error strings.
+ */
+const FAILURE_VOCABULARY = /\b(fail(ed|s|ure)?|error|refus(ed|es)|block(ed|s)|denied|reject(ed|s)|unable|cannot|can't|couldn't|invalid|missing|not found|undefined is not|is not a function|null is not|exception|uncaught|unhandled|timed? ?out|timeout|retry|retrying|abort(ed)?|crash(ed)?|unsupported|deprecated|twice|duplicate snippet|conflict)\b/i;
+/**
+ * Is this console.error a real failure report, or a debug line the site chose
+ * to print at error level?
+ *
+ * blackline.com's Nuxt plugin logs "🔌 [DREAMDATA] Plugin loaded - YOU SHOULD
+ * SEE THIS IN PRODUCTION" through console.error on every page load. Nothing
+ * went wrong — the plugin is announcing itself — but console-clean read the
+ * severity the site picked and sank an otherwise clean run. Severity alone is
+ * not the site's report of a failure; the words are.
+ *
+ * Judged from the message and nothing else. Whether the events were delivered
+ * is a different check's business, and letting it gate this one would make a
+ * console message mean different things on different runs.
+ */
+export function describesFailure(text) {
+    return FAILURE_VOCABULARY.test(text.replace(CSP_POLICY_CLAUSE, ""));
+}
+//# sourceMappingURL=constants.js.map

package/dist/evidence/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/evidence/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAExD,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG,aAAa,CAAC;AAE9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,kBAAkB,EAAE,gCAAgC,CAAU,CAAC;AAEpG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,0DAA0D,CAAC;AAEjG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,mEAAmE,CAAC;AAE/G;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,kBAAkB,CAAU,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,iBAAiB,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,gBAAgB,CAAC;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,mCAAmC,CAAC;AAElE,uEAAuE;AACvE,uEAAuE;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CAAC;AAE3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAErD,uEAAuE;AACvE,kFAAkF;AAClF,iDAAiD;AACjD,MAAM,CAAC,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAElF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,8CAA8C,CAAC;AAErF,yEAAyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAEvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,yBAAyB,CAAU,CAAC;AAE/E,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,OAAO;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,qBAAqB;CACb,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,kBAAkB;IAClB,aAAa;IACb,iBAAiB;IACjB,cAAc;IACd,sBAAsB;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAE/C,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM;IACN,OAAO;IACP,UAAU;IACV,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,gBAAgB;IAChB,WAAW;IACX,WAAW;CACH,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE;IAC3C,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE;IACzC,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,qBAAqB,EAAE;IACpD,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,sBAAsB,EAAE;IACrD,EAAE,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE;IAC1C,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE;IAC/C,EAAE,EAAE,EAAE,uBAAuB,EAAE,SAAS,EAAE,eAAe,EAAE;IAC3D,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE;IACxC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE;IACrC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;IACnC,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE;CACnC,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,YAAY;IACZ,oBAAoB;IACpB,WAAW;IACX,mBAAmB;IACnB,UAAU;IACV,OAAO;IACP,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,yEAAyE;IACzE,iEAAiE;IACjE,2EAA2E;IAC3E,yEAAyE;IACzE,4BAA4B;IAC5B,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,oBAAoB;IACpB,mBAAmB;CACX,CAAC;AAEX,yDAAyD;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,SAAS;IACT,MAAM;IACN,YAAY;IACZ,oEAAoE;IACpE,2EAA2E;IAC3E,0DAA0D;IAC1D,yEAAyE;IACzE,sBAAsB;IACtB,8BAA8B;IAC9B,uBAAuB;IACvB,+BAA+B;CACvB,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAU,CAAC;AAEzF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,EAAE,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,sBAAsB,EAAE;IAC7G,8EAA8E;IAC9E,sEAAsE;IACtE,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE;CAC5F,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,aAAgC,EAAE;IAC5E,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,SAAS;IACT,QAAQ;IACR,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;IACP,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,SAAS;IACT,UAAU;IACV,QAAQ;IACR,SAAS;IACT,UAAU;IACV,MAAM;IACN,QAAQ;CACA,CAAC;AAEX,kFAAkF;AAClF,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;CACE,CAAC;AAEX,6EAA6E;AAC7E,MAAM,CAAC,MAAM,0BAA0B,GAAG,0BAA0B,CAAC;AAErE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAEzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAC/D,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC;AAEtE,gFAAgF;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAC9D,MAAM,CAAC,MAAM,4BAA4B,GAAG,wBAAwB,CAAC;AAErE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,iEAAiE,CAAC;AAE5G;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAmD;IACtF,EAAE,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,2BAA2B,EAAE;IAC7E,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,oBAAoB,EAAE;IAC1E,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,UAAU,EAAE;IACpD,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,EAAE;IAClD,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,WAAW,EAAE;IACxD,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,WAAW,EAAE;IAC5D,EAAE,OAAO,EAAE,sCAAsC,EAAE,MAAM,EAAE,WAAW,EAAE;IACxE,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,cAAc,EAAE;CACjD,CAAC;AAEX;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAmD;IAChF,EAAE,OAAO,EAAE,wCAAwC,EAAE,MAAM,EAAE,UAAU,EAAE;IACzE,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,WAAW,EAAE;IACtE,EAAE,OAAO,EAAE,qCAAqC,EAAE,MAAM,EAAE,cAAc,EAAE;IAC1E,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,WAAW,EAAE;IACjE,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,OAAO,EAAE;IACtD,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,UAAU,EAAE;IACnE,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACxD,EAAE,OAAO,EAAE,8BAA8B,EAAE,MAAM,EAAE,OAAO,EAAE;IAC5D,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,cAAc,EAAE;IAC3D,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,WAAW,EAAE;IACrD,EAAE,OAAO,EAAE,4BAA4B,EAAE,MAAM,EAAE,SAAS,EAAE;IAC5D,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,QAAQ,EAAE;CAChD,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsD;IACtF,EAAE,OAAO,EAAE,iCAAiC,EAAE,SAAS,EAAE,MAAM,EAAE;IACjE,EAAE,OAAO,EAAE,gCAAgC,EAAE,SAAS,EAAE,MAAM,EAAE;IAChE,EAAE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE;IACjD,EAAE,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,WAAW,EAAE;IACnE,EAAE,OAAO,EAAE,yCAAyC,EAAE,SAAS,EAAE,QAAQ,EAAE;IAC3E,EAAE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE;CAC3C,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,OAAO,8CAA8C,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,oBAAoB;IACpB,0BAA0B;IAC1B,uBAAuB;IACvB,yBAAyB;IACzB,6DAA6D;IAC7D,kEAAkE;IAClE,2DAA2D;IAC3D,wCAAwC;IACxC,kBAAkB;IAClB,uBAAuB;IACvB,sBAAsB;IACtB,2BAA2B;IAC3B,sBAAsB;IACtB,+BAA+B;CACvB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,sBAAsB;IACtB,8BAA8B;IAC9B,6DAA6D;IAC7D,iEAAiE;IACjE,+CAA+C;IAC/C,gBAAgB;IAChB,yBAAyB;IACzB,oBAAoB;IACpB,sBAAsB;IACtB,eAAe;CACP,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;IACrB,wEAAwE;IACxE,+DAA+D;IAC/D,qBAAqB;IACrB,gBAAgB;IAChB,oBAAoB;IACpB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,mBAAmB;IACnB,gBAAgB;IAChB,eAAe;IACf,cAAc;IACd,WAAW;IACX,WAAW;IACX,aAAa;IACb,UAAU;CACF,CAAC;AAEX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;CACP,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAU,CAAC;AAExF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AAEvD,gEAAgE;AAChE,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,qBAAqB;IACrB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,wBAAwB;IACxB,iBAAiB;IACjB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,aAAa;IACb,iBAAiB;IACjB,MAAM;IACN,SAAS;IACT,OAAO;IACP,MAAM;CACE,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,yEAAyE,CAAC;AAEpH;;;;;;;;;;;GAWG;AACH,MAAM,iBAAiB,GAAG,4CAA4C,CAAC;AAEvE;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAkB,GACtB,+TAA+T,CAAC;AAElU;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC"}