@dreamdata_io/verify-tracking 0.1.0

package/dist/evidence/heuristic-banner.js

@@ -0,0 +1,107 @@
+export function runHeuristicBanner(args) {
+    const { mode, direction, acceptPhrases, rejectPhrases, preferenceCounterpartPhrases, contextKeywords } = args;
+    const NONE = {
+        detected: false,
+        acceptLabel: null,
+        rejectLabel: null,
+        counterpart: null,
+        preferenceLabel: null,
+        clicked: null,
+    };
+    const normalize = (s) => (s ?? "").replace(/\s+/g, " ").trim().toLowerCase();
+    const isVisible = (el) => {
+        const style = window.getComputedStyle(el);
+        if (style.display === "none" || style.visibility === "hidden" || Number(style.opacity) === 0)
+            return false;
+        const rect = el.getBoundingClientRect();
+        return rect.width > 0 && rect.height > 0;
+    };
+    /**
+     * Every clickable control on the page, INCLUDING the ones inside open
+     * shadow roots.
+     *
+     * egnyte.com runs TrustArc, which renders its whole banner — "Accept All",
+     * "Decline All" and all — inside a shadow root on a
+     * `.trustarc_newcm_container` host. `document.querySelectorAll` does not
+     * cross that boundary, so the run reported "no consent platform was
+     * detected", never answered the banner, and concluded the site tracks
+     * nothing in any phase. A click dispatched on an element inside an open
+     * shadow root works exactly as it does in the light DOM; the only thing
+     * missing was finding it.
+     */
+    const collectControls = () => {
+        const found = [];
+        const walk = (root, depth) => {
+            for (const el of Array.from(root.querySelectorAll("button, a, [role='button']")))
+                found.push(el);
+            if (depth >= 5)
+                return;
+            for (const el of Array.from(root.querySelectorAll("*"))) {
+                const shadow = el.shadowRoot;
+                if (shadow)
+                    walk(shadow, depth + 1);
+            }
+        };
+        walk(document, 0);
+        return found;
+    };
+    /** parentElement, but stepping out of a shadow root onto its host. */
+    const climb = (node) => node.parentElement ?? (node.getRootNode().host ?? null);
+    const candidates = collectControls().filter(isVisible);
+    const findMatch = (phrases) => candidates.find((el) => phrases.includes(normalize(el.textContent))) ?? null;
+    const acceptEl = findMatch(acceptPhrases);
+    const rejectEl = findMatch(rejectPhrases);
+    if (!acceptEl && !rejectEl)
+        return NONE;
+    // Climb from whichever control matched, looking for an ancestor that both
+    // reads like a cookie notice and contains a second consent control. Both
+    // conditions must be satisfied by the SAME ancestor level's subtree.
+    const primary = acceptEl ?? rejectEl;
+    const opposite = acceptEl === primary ? rejectEl : acceptEl;
+    const preferenceEls = candidates.filter((el) => el !== primary && preferenceCounterpartPhrases.includes(normalize(el.textContent)));
+    let container = primary;
+    let contextOk = false;
+    let counterpart = null;
+    let preferenceEl = null;
+    for (let depth = 0; depth < 8 && container && !(contextOk && counterpart !== null); depth++) {
+        const text = normalize(container.textContent);
+        if (!contextOk && contextKeywords.some((k) => text.includes(k)))
+            contextOk = true;
+        // The opposite control is the stronger proof, so it wins when the same
+        // container holds both.
+        if (counterpart === null && opposite && container.contains(opposite))
+            counterpart = "opposite-control";
+        if (counterpart === null) {
+            const found = preferenceEls.find((el) => container.contains(el));
+            if (found) {
+                counterpart = "preference-center";
+                preferenceEl = found;
+            }
+        }
+        container = climb(container);
+    }
+    if (!contextOk || counterpart === null)
+        return NONE;
+    const acceptLabel = acceptEl ? normalize(acceptEl.textContent) : null;
+    const rejectLabel = rejectEl ? normalize(rejectEl.textContent) : null;
+    const preferenceLabel = preferenceEl ? normalize(preferenceEl.textContent) : null;
+    const found = {
+        detected: true,
+        acceptLabel,
+        rejectLabel,
+        counterpart,
+        preferenceLabel,
+        clicked: null,
+    };
+    if (mode === "detect")
+        return found;
+    // Nothing to click in this direction — the banner is real, it just has no
+    // one-click answer here. The caller's next fallback is the preference
+    // centre, which is the only way such a banner can be answered at all.
+    const target = direction === "accept" ? acceptEl : rejectEl;
+    if (!target)
+        return found;
+    target.click();
+    return { ...found, clicked: direction === "accept" ? acceptLabel : rejectLabel };
+}
+//# sourceMappingURL=heuristic-banner.js.map

package/dist/evidence/heuristic-banner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"heuristic-banner.js","sourceRoot":"","sources":["../../src/evidence/heuristic-banner.ts"],"names":[],"mappings":"AAyDA,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,4BAA4B,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAC9G,MAAM,IAAI,GAA0B;QAClC,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,eAAe,EAAE,IAAI;QACrB,OAAO,EAAE,IAAI;KACd,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,CAA4B,EAAU,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEhH,MAAM,SAAS,GAAG,CAAC,EAAW,EAAW,EAAE;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3G,MAAM,IAAI,GAAG,EAAE,CAAC,qBAAqB,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,MAAM,eAAe,GAAG,GAAkB,EAAE;QAC1C,MAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,IAA2B,EAAE,KAAa,EAAQ,EAAE;YAChE,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAc,4BAA4B,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9G,IAAI,KAAK,IAAI,CAAC;gBAAE,OAAO;YACvB,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAc,GAAG,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM,MAAM,GAAI,EAAuD,CAAC,UAAU,CAAC;gBACnF,IAAI,MAAM;oBAAE,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACtC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,sEAAsE;IACtE,MAAM,KAAK,GAAG,CAAC,IAAa,EAAkB,EAAE,CAC9C,IAAI,CAAC,aAAa,IAAI,CAAE,IAAI,CAAC,WAAW,EAAiB,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IAE1E,MAAM,UAAU,GAAG,eAAe,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,CAAC,OAA0B,EAAsB,EAAE,CACnE,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAE/E,MAAM,QAAQ,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAExC,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAS,CAAC;IACtC,MAAM,QAAQ,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5D,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CACrC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,IAAI,4BAA4B,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAC3F,CAAC;IAEF,IAAI,SAAS,GAAmB,OAAO,CAAC;IACxC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,WAAW,GAAyC,IAAI,CAAC;IAC7D,IAAI,YAAY,GAAuB,IAAI,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,WAAW,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5F,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS,GAAG,IAAI,CAAC;QAClF,uEAAuE;QACvE,wBAAwB;QACxB,IAAI,WAAW,KAAK,IAAI,IAAI,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,WAAW,GAAG,kBAAkB,CAAC;QACvG,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAClE,IAAI,KAAK,EAAE,CAAC;gBACV,WAAW,GAAG,mBAAmB,CAAC;gBAClC,YAAY,GAAG,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QACD,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEpD,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,eAAe,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,MAAM,KAAK,GAA0B;QACnC,QAAQ,EAAE,IAAI;QACd,WAAW;QACX,WAAW;QACX,WAAW;QACX,eAAe;QACf,OAAO,EAAE,IAAI;KACd,CAAC;IAEF,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEpC,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,MAAM,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACnF,CAAC"}

package/dist/evidence/http-probe.js

@@ -0,0 +1,139 @@
+/**
+ * What the site serves to something that is not a browser.
+ *
+ * A bot wall does not refuse the request — it answers it with a different
+ * document. The browser gets a challenge interstitial (a press-and-hold
+ * control, a spinner, a "verify you are human" page), and every field a phase
+ * collects from that page is empty: no script tags, no GTM container id, no
+ * consent banner, no requests, not even a same-origin link to walk to. That
+ * emptiness is indistinguishable from a site with nothing installed, and it
+ * is the shape a report is most dangerous in — zoominfo.com was reported as
+ * "nothing-installed" with "install the script" as the advice, while its GTM
+ * container shipped both bundles all along.
+ *
+ * A plain HTTP GET carries none of the fingerprints those walls key on, so it
+ * is usually served the real markup. It cannot answer a single behavioural
+ * question — nothing executes, no request is sent, no consent is answered — but
+ * it answers two the run otherwise loses entirely: what is installed, and
+ * whether the browser was shown the same page at all.
+ *
+ * Never fails the run. Every failure mode is recorded and handed on as
+ * "we could not corroborate", which is what it is.
+ */
+import { logger } from "../utils/logger.js";
+import { CMP_MARKUP_MARKERS, CSR_FRAMEWORK_MARKERS } from "./constants.js";
+import { gtmContainerIdsFromText, readScriptPresenceFromHtml } from "./script.js";
+/**
+ * An honest client identity, deliberately not a browser's.
+ *
+ * Claiming to be Chrome was tried and is worse on both counts. It is a
+ * disguise, which is the line this tool does not cross — and on zoominfo.com
+ * it is also what gets the request refused: a Chrome UA is answered HTTP 403
+ * with a 5 KB challenge body, while this one is served the full 428 KB page,
+ * because what the wall is defending against is browsers it cannot fingerprint.
+ * Chasing the header combination that slips past a given WAF is an arms race
+ * with no end and a silent failure mode, so the probe does not play it: it says
+ * what it is, and a refusal is reported as a refusal (see
+ * assessPageReadability, which treats a non-2xx here as a finding in its own
+ * right rather than as an absence of evidence).
+ */
+const PROBE_USER_AGENT = "dreamdata-tracking-verification/0.1 (+https://dreamdata.io)";
+const PROBE_ACCEPT = "text/html,*/*;q=0.8";
+/** Enough markup to read the head and the nav; whole pages can be megabytes. */
+const MAX_BYTES = 3_000_000;
+/**
+ * Same-origin links, counted the way the second-page probe looks for one.
+ *
+ * Deliberately crude — this is a corroboration signal, not a navigation
+ * target. What matters is the difference between "the document has a site's
+ * worth of links in it" and "the document has none", because the second is
+ * what an interstitial looks like and the first is what the same URL serves
+ * over plain HTTP when a wall turned the browser away.
+ */
+function countSameOriginLinks(html, baseUrl) {
+    let origin;
+    try {
+        origin = new URL(baseUrl).origin;
+    }
+    catch {
+        return 0;
+    }
+    const hrefs = [...html.matchAll(/<a[^>]*\shref=["']([^"']+)["']/gi)].map((m) => m[1]);
+    const sameOrigin = new Set();
+    for (const href of hrefs) {
+        if (href.startsWith("#") || /^(?:mailto|tel|javascript):/i.test(href))
+            continue;
+        try {
+            const resolved = new URL(href, baseUrl);
+            if (resolved.origin === origin)
+                sameOrigin.add(resolved.href.replace(/#.*$/, ""));
+        }
+        catch {
+            // A malformed href is not a link.
+        }
+    }
+    return sameOrigin.size;
+}
+function cmpMarkersIn(html) {
+    return [...new Set(CMP_MARKUP_MARKERS.filter((m) => m.pattern.test(html)).map((m) => m.vendor))];
+}
+/**
+ * Corroboration only, and the weakest kind. A framework name cannot say how
+ * the site navigates — see CSR_FRAMEWORK_MARKERS — but it is the only routing
+ * hint a run has left when a wall turned the browser away.
+ */
+function frameworkMarkersIn(html) {
+    return [...new Set(CSR_FRAMEWORK_MARKERS.filter((m) => m.pattern.test(html)).map((m) => m.framework))];
+}
+export async function probeServedMarkup(url, timeoutMs, extraHosts = []) {
+    const controller = new AbortController();
+    const deadline = setTimeout(() => controller.abort(), Math.min(20_000, Math.max(5_000, timeoutMs)));
+    try {
+        const response = await fetch(url, {
+            redirect: "follow",
+            signal: controller.signal,
+            headers: {
+                "user-agent": PROBE_USER_AGENT,
+                accept: PROBE_ACCEPT,
+                "accept-language": "en-US,en;q=0.9",
+            },
+        });
+        const body = await response.text();
+        const html = body.length > MAX_BYTES ? body.slice(0, MAX_BYTES) : body;
+        const finalUrl = response.url || url;
+        return {
+            attempted: true,
+            status: response.status,
+            finalUrl,
+            bytes: body.length,
+            truncated: body.length > MAX_BYTES,
+            failedReason: null,
+            sameOriginLinkCount: countSameOriginLinks(html, finalUrl),
+            tagManagerContainerIds: gtmContainerIdsFromText(html),
+            cmpMarkers: cmpMarkersIn(html),
+            frameworkMarkers: frameworkMarkersIn(html),
+            script: readScriptPresenceFromHtml(html, finalUrl, extraHosts),
+        };
+    }
+    catch (err) {
+        const reason = err.name === "AbortError" ? `timed out after ${timeoutMs}ms` : err.message;
+        logger.debug(`Plain-HTTP probe of ${url} failed`, err);
+        return {
+            attempted: true,
+            status: null,
+            finalUrl: null,
+            bytes: null,
+            truncated: false,
+            failedReason: reason,
+            sameOriginLinkCount: 0,
+            tagManagerContainerIds: [],
+            cmpMarkers: [],
+            frameworkMarkers: [],
+            script: null,
+        };
+    }
+    finally {
+        clearTimeout(deadline);
+    }
+}
+//# sourceMappingURL=http-probe.js.map

package/dist/evidence/http-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-probe.js","sourceRoot":"","sources":["../../src/evidence/http-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAGlF;;;;;;;;;;;;;GAaG;AACH,MAAM,gBAAgB,GAAG,6DAA6D,CAAC;AAEvF,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAE3C,gFAAgF;AAChF,MAAM,SAAS,GAAG,SAAS,CAAC;AAE5B;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,OAAe;IACzD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAChF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;gBAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,SAAiB,EACjB,aAAgC,EAAE;IAElC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAEpG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,YAAY,EAAE,gBAAgB;gBAC9B,MAAM,EAAE,YAAY;gBACpB,iBAAiB,EAAE,gBAAgB;aACpC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,IAAI,GAAG,CAAC;QAErC,OAAO;YACL,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ;YACR,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,SAAS,EAAE,IAAI,CAAC,MAAM,GAAG,SAAS;YAClC,YAAY,EAAE,IAAI;YAClB,mBAAmB,EAAE,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC;YACzD,sBAAsB,EAAE,uBAAuB,CAAC,IAAI,CAAC;YACrD,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC;YAC9B,gBAAgB,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAC1C,MAAM,EAAE,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC;SAC/D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAI,GAAa,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,mBAAmB,SAAS,IAAI,CAAC,CAAC,CAAE,GAAa,CAAC,OAAO,CAAC;QAChH,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,MAAM;YACpB,mBAAmB,EAAE,CAAC;YACtB,sBAAsB,EAAE,EAAE;YAC1B,UAAU,EAAE,EAAE;YACd,gBAAgB,EAAE,EAAE;YACpB,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/evidence/init-script.js

@@ -0,0 +1,112 @@
+/**
+ * Injected via page.addInitScript before any page script runs, so it can
+ * observe dataLayer.push(['consent', ...]) calls and window.gtag(...) calls
+ * even if the site never leaves those values inspectable afterwards.
+ *
+ * A site that reassigns window.dataLayer to a brand new array (some CMP
+ * snippets do) is covered: the accessor below re-wraps whatever is assigned.
+ * Still best-effort rather than a hard guarantee — a snippet that captures a
+ * direct reference to the array before this script runs can push through it
+ * without going past the wrapper.
+ */
+export function installEvidenceHooks() {
+    const w = window;
+    w.__ddEvidence = {
+        consentPushes: [],
+        gtagCalls: [],
+        historyEvents: [],
+        // This script re-runs on every document, so a changed id after following
+        // a link means a new document was loaded and an unchanged one means the
+        // site's own router handled it without one — the difference between "the
+        // whole install re-ran" and "nothing re-ran", which is invisible from the
+        // URL alone.
+        documentId: `${Date.now()}-${Math.random().toString(36).slice(2)}`,
+    };
+    // A soft navigation leaves no trace in the network log or the DOM; the
+    // History API call is the only evidence that the site navigated at all.
+    const recordHistory = (kind, url) => {
+        w.__ddEvidence.historyEvents.push({
+            kind,
+            url: typeof url === "string" ? url : null,
+            timestamp: Date.now(),
+        });
+    };
+    for (const method of ["pushState", "replaceState"]) {
+        const original = history[method].bind(history);
+        history[method] = function patched(...args) {
+            recordHistory(method, args[2]);
+            return original(...args);
+        };
+    }
+    window.addEventListener("popstate", () => recordHistory("popstate", location.href));
+    /**
+     * Marks an array whose push is already wrapped. It has to live on the array
+     * itself, not in a flag in this closure: the accessor below re-wraps on
+     * every assignment to window.dataLayer, and a site that genuinely swaps in a
+     * new array still needs that one wrapped.
+     */
+    const WRAPPED_MARKER = "__ddPushWrapped";
+    const wrapDataLayer = (arr) => {
+        // The near-universal `window.dataLayer = window.dataLayer || []` snippet
+        // assigns the SAME array back, so without this guard every such
+        // assignment stacked another wrapper on it and one real push was recorded
+        // once per layer — 13 identical entries, same millisecond, for a single
+        // gtag('consent', ...) call.
+        if (arr[WRAPPED_MARKER])
+            return;
+        Object.defineProperty(arr, WRAPPED_MARKER, { value: true, enumerable: false, configurable: true });
+        const originalPush = arr.push.bind(arr);
+        arr.push = ((...items) => {
+            for (const item of items) {
+                // gtag.js's own `gtag(){dataLayer.push(arguments)}` pushes an
+                // arguments object, not a real Array — Array.isArray on it is
+                // always false, so array-likes must be normalized before the
+                // consent-tuple check or every gtag('consent', ...) call is missed.
+                const normalized = item !== null &&
+                    typeof item === "object" &&
+                    !Array.isArray(item) &&
+                    typeof item.length === "number"
+                    ? Array.from(item)
+                    : item;
+                const isConsentTuple = Array.isArray(normalized) && normalized[0] === "consent";
+                const isConsentEvent = normalized !== null &&
+                    typeof normalized === "object" &&
+                    !Array.isArray(normalized) &&
+                    normalized.event === "consent";
+                if (isConsentTuple || isConsentEvent) {
+                    w.__ddEvidence.consentPushes.push({ raw: normalized, timestamp: Date.now() });
+                }
+            }
+            return originalPush(...items);
+        });
+    };
+    if (Array.isArray(w.dataLayer)) {
+        wrapDataLayer(w.dataLayer);
+    }
+    let currentDataLayer = w.dataLayer;
+    Object.defineProperty(w, "dataLayer", {
+        configurable: true,
+        get() {
+            return currentDataLayer;
+        },
+        set(value) {
+            currentDataLayer = value;
+            if (Array.isArray(value))
+                wrapDataLayer(value);
+        },
+    });
+    let currentGtag = w.gtag;
+    Object.defineProperty(w, "gtag", {
+        configurable: true,
+        get() {
+            return currentGtag;
+        },
+        set(fn) {
+            currentGtag = (...args) => {
+                w.__ddEvidence.gtagCalls.push({ args, timestamp: Date.now() });
+                return fn(...args);
+            };
+        },
+    });
+}
+//# sourceMappingURL=init-script.js.map

package/dist/evidence/init-script.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-script.js","sourceRoot":"","sources":["../../src/evidence/init-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,CAAC,GAAG,MAST,CAAC;IAEF,CAAC,CAAC,YAAY,GAAG;QACf,aAAa,EAAE,EAAE;QACjB,SAAS,EAAE,EAAE;QACb,aAAa,EAAE,EAAE;QACjB,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,aAAa;QACb,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;KACnE,CAAC;IAEF,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,GAAY,EAAQ,EAAE;QACzD,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC;YAChC,IAAI;YACJ,GAAG,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACzC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,cAAc,CAAU,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,GAAG,SAAS,OAAO,CAAgB,GAAG,IAAsC;YACzF,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3B,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAEpF;;;;;OAKG;IACH,MAAM,cAAc,GAAG,iBAAiB,CAAC;IAEzC,MAAM,aAAa,GAAG,CAAC,GAAc,EAAQ,EAAE;QAC7C,yEAAyE;QACzE,gEAAgE;QAChE,0EAA0E;QAC1E,wEAAwE;QACxE,6BAA6B;QAC7B,IAAK,GAA0C,CAAC,cAAc,CAAC;YAAE,OAAO;QACxE,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAEnG,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAgB,EAAE,EAAE;YAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,8DAA8D;gBAC9D,8DAA8D;gBAC9D,6DAA6D;gBAC7D,oEAAoE;gBACpE,MAAM,UAAU,GACd,IAAI,KAAK,IAAI;oBACb,OAAO,IAAI,KAAK,QAAQ;oBACxB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;oBACpB,OAAQ,IAA6B,CAAC,MAAM,KAAK,QAAQ;oBACvD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAA0B,CAAC;oBACxC,CAAC,CAAC,IAAI,CAAC;gBACX,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;gBAChF,MAAM,cAAc,GAClB,UAAU,KAAK,IAAI;oBACnB,OAAO,UAAU,KAAK,QAAQ;oBAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;oBACzB,UAAiC,CAAC,KAAK,KAAK,SAAS,CAAC;gBACzD,IAAI,cAAc,IAAI,cAAc,EAAE,CAAC;oBACrC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;YACD,OAAO,YAAY,CAAC,GAAI,KAAiB,CAAC,CAAC;QAC7C,CAAC,CAAoB,CAAC;IACxB,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,gBAAgB,GAAG,CAAC,CAAC,SAAS,CAAC;IACnC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,WAAW,EAAE;QACpC,YAAY,EAAE,IAAI;QAClB,GAAG;YACD,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,GAAG,CAAC,KAAgB;YAClB,gBAAgB,GAAG,KAAK,CAAC;YACzB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IACzB,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE;QAC/B,YAAY,EAAE,IAAI;QAClB,GAAG;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,GAAG,CAAC,EAAgC;YAClC,WAAW,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;gBACnC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/D,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}