@dreamdata_io/verify-tracking 0.1.0

package/dist/ai/evidence-view.js

@@ -0,0 +1,143 @@
+import { mentionsDreamdata } from "../evidence/constants.js";
+import { extractMessageId } from "../evidence/network.js";
+function compactPhase(phase) {
+    return {
+        phase: phase.phase,
+        script: {
+            present: phase.script.present,
+            writeKey: phase.script.writeKey,
+            normalSnippet: phase.script.normalSnippet,
+            cookielessSnippet: phase.script.cookielessSnippet,
+            segmentCompatSnippet: phase.script.segmentCompatSnippet,
+            helperScriptOnly: phase.script.helperScriptOnly,
+            matches: phase.script.matches,
+            normalBundleConfigured: phase.script.normalBundleConfigured,
+            normalBundleSignals: phase.script.normalBundleSignals,
+            tagManager: phase.script.tagManager,
+        },
+        network: {
+            cookielessRequestCount: phase.network.cookielessRequestCount,
+            normalRequestCount: phase.network.normalRequestCount,
+            // cookielessRequestSeenFirst is deliberately withheld from the model.
+            // Cookieless is the fallback bundle, not the first mover, so the order
+            // the two modes fired in carries no verdict — but a field named like
+            // that invites one. What matters is whether both fired at all, which
+            // the two counts above already say.
+            dreamdataRequestCounts: phase.network.dreamdataRequestCounts,
+            trackingHosts: phase.network.trackingHosts,
+            observedWriteKeys: phase.network.observedWriteKeys,
+            // The `name@version` builds the requests named themselves. One install
+            // ships every bundle it has at ONE version, so two versions here are
+            // two copies of the script running side by side — each firing its own
+            // page() on load, with its own messageId, doubling the page view.
+            observedLibraries: phase.network.observedLibraries,
+            // True when this phase answered the banner and reloaded, so these
+            // requests cover TWO loads of the entry URL — unanswered, then decided.
+            // Two page events for that URL are the consent upgrade, not a duplicate
+            // loader; page-view-counted-once leaves such a page view unjudged,
+            // unless the events name two different builds — which two loads of one
+            // install cannot produce.
+            spansConsentAnswer: phase.network.spansConsentAnswer,
+            requests: phase.network.requests.map((r) => ({
+                endpointName: r.endpointName,
+                method: r.method,
+                status: r.status,
+                mode: r.mode,
+                identity: r.identity,
+                url: r.url,
+                // The event's own id, not the request's: two requests sharing one
+                // means the SAME event was delivered twice, which no single healthy
+                // instance does. It is the cheapest way to see a second bundle
+                // replaying the buffer the first one already sent.
+                messageId: extractMessageId(r.payload),
+            })),
+        },
+        globals: phase.globals,
+        thirdPartySegment: phase.thirdPartySegment,
+        cookies: phase.cookies,
+        consent: {
+            ...phase.consent,
+            // `raw` is dropped, as it always has been — it is the whole gtag
+            // argument object and nothing readable comes of handing it over. The
+            // typed fields beside it are what used to be locked inside it: the verb
+            // separates the site's configured default from the visitor's decision,
+            // and `region` is what explains a log that reads "granted" on a page
+            // Google resolved to "denied".
+            dataLayerConsentPushes: phase.consent.dataLayerConsentPushes.map((push) => ({
+                verb: push.verb,
+                analyticsStorage: push.analyticsStorage,
+                signals: push.signals,
+                region: push.region,
+                waitForUpdate: push.waitForUpdate,
+                timestamp: push.timestamp,
+            })),
+        },
+        consentAcceptance: phase.consentAcceptance,
+        secondPage: phase.secondPage === null
+            ? null
+            : {
+                attempted: phase.secondPage.attempted,
+                skippedReason: phase.secondPage.skippedReason,
+                toUrl: phase.secondPage.toUrl,
+                linkText: phase.secondPage.linkText,
+                kind: phase.secondPage.kind,
+                urlChanged: phase.secondPage.urlChanged,
+                historyEvents: phase.secondPage.historyEvents.map((event) => event.kind),
+                network: {
+                    cookielessRequestCount: phase.secondPage.network.cookielessRequestCount,
+                    normalRequestCount: phase.secondPage.network.normalRequestCount,
+                    dreamdataRequestCounts: phase.secondPage.network.dreamdataRequestCounts,
+                    requests: phase.secondPage.network.requests.map((r) => ({
+                        endpointName: r.endpointName,
+                        status: r.status,
+                        mode: r.mode,
+                        identity: r.identity,
+                    })),
+                },
+                cookies: phase.secondPage.cookies,
+            },
+        // Same filter buildConsoleCheck applies, for the same reason: a message
+        // that names Dreamdata only inside a CSP policy it prints is not about
+        // this install, and showing it to the model invites a debugging-signals
+        // failure the deterministic layer will not back (idtdna.com).
+        console: {
+            errors: phase.console.errors.filter(mentionsDreamdata),
+            warnings: phase.console.warnings.filter(mentionsDreamdata),
+        },
+        collectionErrors: phase.collectionErrors,
+    };
+}
+/**
+ * The one thing the model is asked for beyond the checklist, and only when
+ * there is something to ask about.
+ *
+ * Kept in the USER prompt rather than the system prompt so SYSTEM_PROMPT stays
+ * byte-stable — the replay harness accounts for its size, and a prompt that
+ * changes shape per run makes that accounting meaningless. Naming the specific
+ * checks is what keeps the ask narrow: without them the model reliably
+ * volunteers a second opinion on findings that are already decided.
+ */
+function unexplainedChecksAsk(analysis) {
+    const unexplained = analysis.diagnosis.unexplainedChecks;
+    if (unexplained.length === 0)
+        return undefined;
+    return (`These checks are failing and no catalogued root cause accounts for them: ${unexplained.join(", ")}. ` +
+        "Return an \"unexplainedObservation\": ONE plain sentence on what their evidence shows and why the catalogue may not cover it. " +
+        "No URL, no link, no documentation path, no proposed fix. Omit the key if you have nothing to add.");
+}
+export function buildPromptPayload(evidence, analysis) {
+    return JSON.stringify({
+        unexplainedChecksAsk: unexplainedChecksAsk(analysis),
+        url: evidence.url,
+        timestamp: evidence.timestamp,
+        browser: evidence.browser,
+        // What the same URL serves a plain HTTP GET, with no browser involved.
+        // Executes nothing, so it answers no behavioural question — its whole
+        // job is to say whether the browser was shown this site's page at all.
+        // deployment.pageReadability is the resolved form of that comparison.
+        httpProbe: evidence.httpProbe,
+        deployment: analysis,
+        phases: evidence.phases.map(compactPhase),
+    }, null, 2);
+}
+//# sourceMappingURL=evidence-view.js.map

package/dist/ai/evidence-view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-view.js","sourceRoot":"","sources":["../../src/ai/evidence-view.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,SAAS,YAAY,CAAC,KAAqB;IACzC,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE;YACN,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;YACzC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB;YACjD,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACvD,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB;YAC/C,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7B,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,sBAAsB;YAC3D,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB;YACrD,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;SACpC;QACD,OAAO,EAAE;YACP,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,sBAAsB;YAC5D,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;YACpD,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,qEAAqE;YACrE,oCAAoC;YACpC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,sBAAsB;YAC5D,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;YAC1C,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;YAClD,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,kEAAkE;YAClE,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;YAClD,kEAAkE;YAClE,wEAAwE;YACxE,wEAAwE;YACxE,mEAAmE;YACnE,uEAAuE;YACvE,0BAA0B;YAC1B,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB;YACpD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,kEAAkE;gBAClE,oEAAoE;gBACpE,+DAA+D;gBAC/D,mDAAmD;gBACnD,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;aACvC,CAAC,CAAC;SACJ;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE;YACP,GAAG,KAAK,CAAC,OAAO;YAChB,iEAAiE;YACjE,qEAAqE;YACrE,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,+BAA+B;YAC/B,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC1E,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;SACJ;QACD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,UAAU,EACR,KAAK,CAAC,UAAU,KAAK,IAAI;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;gBACrC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa;gBAC7C,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK;gBAC7B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;gBACnC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;gBAC3B,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU;gBACvC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;gBACxE,OAAO,EAAE;oBACP,sBAAsB,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,sBAAsB;oBACvE,kBAAkB,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,kBAAkB;oBAC/D,sBAAsB,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,sBAAsB;oBACvE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACtD,YAAY,EAAE,CAAC,CAAC,YAAY;wBAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;qBACrB,CAAC,CAAC;iBACJ;gBACD,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO;aAClC;QACP,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE;YACP,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACtD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAC3D;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,QAA4B;IACxD,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC,iBAAiB,CAAC;IACzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,CACL,4EAA4E,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACtG,gIAAgI;QAChI,mGAAmG,CACpG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAA4B,EAAE,QAA4B;IAC3F,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,oBAAoB,EAAE,oBAAoB,CAAC,QAAQ,CAAC;QACpD,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;KAC1C,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/ai/local-cli.js

@@ -0,0 +1,58 @@
+import { spawn } from "node:child_process";
+import { AIError } from "../utils/errors.js";
+import { parseCustomCliCmd, resolveCliPresetTemplate } from "./cli-presets.js";
+function resolveTemplate(config) {
+    if (config.cliCmd) {
+        const parsed = parseCustomCliCmd(config.cliCmd);
+        return {
+            command: parsed.command,
+            args: parsed.args.map((a) => a.replace("{model}", config.model)),
+            promptVia: parsed.promptVia,
+        };
+    }
+    if (config.cliPreset) {
+        const preset = resolveCliPresetTemplate(config.cliPreset, config.model);
+        if (!preset) {
+            throw new AIError(`Unknown CLI preset "${config.cliPreset}". Pass --cli-cmd with a custom command template instead.`);
+        }
+        return preset;
+    }
+    throw new AIError("--backend local-cli requires either --cli-preset or --cli-cmd.");
+}
+export async function callLocalCli(config, prompt) {
+    const template = resolveTemplate(config);
+    const args = template.args.map((a) => (a === "{prompt}" ? prompt : a));
+    return new Promise((resolve, reject) => {
+        const child = spawn(template.command, args, { stdio: ["pipe", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => (stdout += chunk.toString()));
+        child.stderr.on("data", (chunk) => (stderr += chunk.toString()));
+        child.on("error", (err) => {
+            reject(new AIError(`Failed to run CLI "${template.command}": ${err.message}`, err));
+        });
+        child.on("close", (code) => {
+            if (code !== 0) {
+                reject(new AIError(`CLI "${template.command}" exited with code ${code}: ${stderr.slice(0, 500)}`));
+                return;
+            }
+            // An exit code of 0 is not proof of an answer. The Claude CLI reports a
+            // model it will not serve on stdout and still exits 0, so the refusal
+            // used to travel on as the model's reply and surface as an unparseable
+            // verdict inside an otherwise complete report. A reply carrying no JSON
+            // object at all is a failure of the CLI, not a judgement, and is worth
+            // saying so here where the raw text is still in hand.
+            if (!stdout.includes("{")) {
+                reject(new AIError(`CLI "${template.command}" exited 0 without returning a verdict. ` +
+                    `Output: ${(stdout.trim() || stderr.trim() || "(empty)").slice(0, 500)}`));
+                return;
+            }
+            resolve(stdout);
+        });
+        if (template.promptVia === "stdin") {
+            child.stdin.write(prompt);
+        }
+        child.stdin.end();
+    });
+}
+//# sourceMappingURL=local-cli.js.map

package/dist/ai/local-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-cli.js","sourceRoot":"","sources":["../../src/ai/local-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAG/E,SAAS,eAAe,CAAC,MAAuB;IAC9C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAChE,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,OAAO,CACf,uBAAuB,MAAM,CAAC,SAAS,2DAA2D,CACnG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,IAAI,OAAO,CAAC,gEAAgE,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAuB,EAAE,MAAc;IACxE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAEjF,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEjE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,MAAM,CAAC,IAAI,OAAO,CAAC,sBAAsB,QAAQ,CAAC,OAAO,MAAM,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,QAAQ,CAAC,OAAO,sBAAsB,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnG,OAAO;YACT,CAAC;YACD,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,sDAAsD;YACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CACJ,IAAI,OAAO,CACT,QAAQ,QAAQ,CAAC,OAAO,0CAA0C;oBAChE,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC3E,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YACnC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/ai/openai-compatible.js

@@ -0,0 +1,78 @@
+import OpenAI from "openai";
+import { AIError } from "../utils/errors.js";
+/**
+ * Bun's fetch closes a connection that has been idle for 5 minutes
+ * (BUN_CONFIG_HTTP_IDLE_TIMEOUT), and the timer only resets on bytes. A
+ * non-streaming completion sends none until it is finished, so any model
+ * slower than that dies on the socket regardless of what timeout the SDK was
+ * given — which is how a 30-minute deadline produced three five-minute
+ * attempts. Disabling the idle timer leaves the SDK's own timeout as the one
+ * deadline, which is the one the caller set.
+ *
+ * `timeout` is Bun-specific; Node's fetch ignores the unknown property, so the
+ * built CLI behaves the same on either runtime.
+ */
+const fetchWithoutIdleTimeout = (input, init) => fetch(input, { ...init, timeout: false });
+/**
+ * The SDK's APIConnectionTimeoutError never sets `.name`, so it reads as a
+ * plain "Error" — checking the name matched the underlying DOMException a
+ * socket abort carries, and missed the SDK's own timeout entirely, which is
+ * the one case the message below exists for. The class is the reliable test.
+ */
+function isTimeout(err) {
+    if (err instanceof OpenAI.APIConnectionTimeoutError)
+        return true;
+    const causeName = (err?.cause)?.name;
+    return causeName === "TimeoutError";
+}
+export async function callOpenAICompatible(config, systemPrompt, userPrompt) {
+    const client = new OpenAI({
+        baseURL: config.baseUrl,
+        apiKey: config.apiKey || "not-required",
+        ...(config.timeoutMs === undefined ? {} : { timeout: config.timeoutMs }),
+        // One retry, not the SDK's two. A retry earns its keep against a hosted
+        // endpoint's 429 or a dropped connection; against a local model every
+        // attempt costs another full inference, and retrying a timeout three
+        // times turns a 30-minute deadline into a 90-minute one.
+        maxRetries: 1,
+        fetch: fetchWithoutIdleTimeout,
+    });
+    try {
+        const completion = await client.chat.completions.create({
+            model: config.model,
+            response_format: { type: "json_object" },
+            // Scoring a checklist against fixed evidence is not a task with a
+            // creative range: the same evidence should produce the same verdicts.
+            // Left unset, Ollama samples at 0.8, and two replays of one archive
+            // disagreed on two of seven items — which makes the golden-set
+            // comparison unable to tell a model regression from a dice roll. The
+            // seed pins what temperature 0 alone does not on every runtime.
+            temperature: 0,
+            seed: 0,
+            messages: [
+                { role: "system", content: systemPrompt },
+                { role: "user", content: userPrompt },
+            ],
+        });
+        const content = completion.choices[0]?.message?.content;
+        if (!content) {
+            throw new AIError("Model returned an empty response.");
+        }
+        return content;
+    }
+    catch (err) {
+        if (err instanceof AIError)
+            throw err;
+        // A client-side abort is not "the endpoint failed" — the model may well
+        // still be generating — and the fix is a number the caller controls, so
+        // say that rather than handing back an SDK stack trace.
+        if (isTimeout(err)) {
+            const waited = config.timeoutMs === undefined ? "the client default" : `${Math.round(config.timeoutMs / 1000)}s`;
+            throw new AIError(`${config.model} at ${config.baseUrl} did not answer within ${waited}. A local model that does not fit in ` +
+                `RAM spills onto the CPU and can take far longer than this for one run — check \`ollama ps\` for a ` +
+                `CPU/GPU split, and either raise --ai-timeout (AI_TIMEOUT_MS) or use a model that fits.`, err);
+        }
+        throw new AIError(`OpenAI-compatible request to ${config.baseUrl} failed: ${err.message}`, err);
+    }
+}
+//# sourceMappingURL=openai-compatible.js.map

package/dist/ai/openai-compatible.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-compatible.js","sourceRoot":"","sources":["../../src/ai/openai-compatible.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG7C;;;;;;;;;;;GAWG;AACH,MAAM,uBAAuB,GAAG,CAAC,KAA6B,EAAE,IAAkB,EAAqB,EAAE,CACvG,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAwC,CAAC,CAAC;AAElF;;;;;GAKG;AACH,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,GAAG,YAAY,MAAM,CAAC,yBAAyB;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,SAAS,GAAG,CAAE,GAA4C,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;IAC/E,OAAO,SAAS,KAAK,cAAc,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAuB,EACvB,YAAoB,EACpB,UAAkB;IAElB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,cAAc;QACvC,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,yDAAyD;QACzD,UAAU,EAAE,CAAC;QACb,KAAK,EAAE,uBAAuB;KAC/B,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YACtD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,eAAe,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;YACxC,kEAAkE;YAClE,sEAAsE;YACtE,oEAAoE;YACpE,+DAA+D;YAC/D,qEAAqE;YACrE,gEAAgE;YAChE,WAAW,EAAE,CAAC;YACd,IAAI,EAAE,CAAC;YACP,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;gBACzC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;aACtC;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,OAAO,CAAC,mCAAmC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,OAAO;YAAE,MAAM,GAAG,CAAC;QACtC,wEAAwE;QACxE,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;YACjH,MAAM,IAAI,OAAO,CACf,GAAG,MAAM,CAAC,KAAK,OAAO,MAAM,CAAC,OAAO,0BAA0B,MAAM,uCAAuC;gBACzG,oGAAoG;gBACpG,wFAAwF,EAC1F,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,gCAAgC,MAAM,CAAC,OAAO,YAAa,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC"}

package/dist/ai/response-parser.js

@@ -0,0 +1,105 @@
+import { CORRECTNESS_CHECKLIST } from "./checklist.js";
+/**
+ * The model's note on an unexplained check, or nothing.
+ *
+ * Drops the WHOLE field rather than scrubbing a URL out of it: a note that
+ * tried to link ignored the one constraint it was given, and half of such a
+ * note is worse than none — it would read as vetted prose while having
+ * already demonstrated it was not following the contract. The length and
+ * newline limits keep it to the one sentence it is meant to be, so it cannot
+ * become a second remediation section nobody asked for.
+ *
+ * Exported so the replay harness's fence-regression check can ask THIS
+ * function rather than re-stating its rules: a second copy of the pattern
+ * drifted from this one the moment the bare-domain clause was added here, and
+ * a check that is weaker than the fence it guards reports no regression.
+ */
+export function sanitizeObservation(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const text = value.trim();
+    if (text.length === 0 || text.length > 400)
+        return undefined;
+    if (/[\r\n]/.test(text))
+        return undefined;
+    if (/https?:\/\/|www\.|\bdreamdata\.io\b|\]\(/i.test(text))
+        return undefined;
+    return text;
+}
+function normalizePassed(value) {
+    if (value === true || value === false)
+        return value;
+    if (value === "not_applicable" || value === "n/a" || value === "na")
+        return "not_applicable";
+    return "inconclusive";
+}
+function extractJsonBlock(text) {
+    const fencedMatch = /```json\s*([\s\S]*?)```/i.exec(text) ?? /```\s*([\s\S]*?)```/.exec(text);
+    if (fencedMatch)
+        return fencedMatch[1];
+    const braceStart = text.indexOf("{");
+    const braceEnd = text.lastIndexOf("}");
+    if (braceStart >= 0 && braceEnd > braceStart)
+        return text.slice(braceStart, braceEnd + 1);
+    return null;
+}
+function buildInconclusiveVerdicts(rawResponse) {
+    return CORRECTNESS_CHECKLIST.map((item) => ({
+        id: item.id,
+        title: item.title,
+        passed: "inconclusive",
+        evidenceQuote: "",
+        feedback: `Could not parse a structured verdict from the model response. Raw response: ${rawResponse.slice(0, 500)}`,
+    }));
+}
+export function parseAIResponse(rawResponse) {
+    const jsonBlock = extractJsonBlock(rawResponse);
+    if (!jsonBlock) {
+        return {
+            verdicts: buildInconclusiveVerdicts(rawResponse),
+            overallPass: false,
+            remediationAdvice: "The AI response was not structured JSON; manual review of the raw output is recommended.",
+            rawResponse,
+            parseFailed: true,
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(jsonBlock);
+    }
+    catch {
+        return {
+            verdicts: buildInconclusiveVerdicts(rawResponse),
+            overallPass: false,
+            remediationAdvice: "The AI response contained malformed JSON; manual review of the raw output is recommended.",
+            rawResponse,
+            parseFailed: true,
+        };
+    }
+    const verdictsById = new Map((parsed.verdicts ?? []).map((v) => [v.id, v]));
+    const verdicts = CORRECTNESS_CHECKLIST.map((item) => {
+        const raw = verdictsById.get(item.id);
+        return {
+            id: item.id,
+            title: item.title,
+            passed: normalizePassed(raw?.passed),
+            evidenceQuote: typeof raw?.evidenceQuote === "string" ? raw.evidenceQuote : "",
+            feedback: typeof raw?.feedback === "string" ? raw.feedback : "No feedback returned for this item.",
+        };
+    });
+    // Derived, not taken from the model. The exit code rides on this, so it has
+    // to follow deterministically from the per-item verdicts: a "not_applicable"
+    // or "inconclusive" item must not sink the run (a cookieless-only install
+    // legitimately has several), while an all-inconclusive run is not a pass
+    // either — nothing was actually confirmed.
+    const overallPass = verdicts.some((v) => v.passed === true) && verdicts.every((v) => v.passed !== false);
+    return {
+        verdicts,
+        overallPass,
+        remediationAdvice: typeof parsed.remediationAdvice === "string" ? parsed.remediationAdvice : "",
+        rawResponse,
+        parseFailed: false,
+        unexplainedObservation: sanitizeObservation(parsed.unexplainedObservation),
+    };
+}
+//# sourceMappingURL=response-parser.js.map

package/dist/ai/response-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-parser.js","sourceRoot":"","sources":["../../src/ai/response-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAiBvD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,KAAK,KAAK,gBAAgB,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,gBAAgB,CAAC;IAC7F,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,WAAW,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9F,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,UAAU,IAAI,CAAC,IAAI,QAAQ,GAAG,UAAU;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IAC1F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,WAAmB;IACpD,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,cAAuB;QAC/B,aAAa,EAAE,EAAE;QACjB,QAAQ,EAAE,+EAA+E,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;KACrH,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,MAAM,SAAS,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,QAAQ,EAAE,yBAAyB,CAAC,WAAW,CAAC;YAChD,WAAW,EAAE,KAAK;YAClB,iBAAiB,EAAE,0FAA0F;YAC7G,WAAW;YACX,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAmB,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,QAAQ,EAAE,yBAAyB,CAAC,WAAW,CAAC;YAChD,WAAW,EAAE,KAAK;YAClB,iBAAiB,EAAE,2FAA2F;YAC9G,WAAW;YACX,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAuB,qBAAqB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACtE,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC;YACpC,aAAa,EAAE,OAAO,GAAG,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAC9E,QAAQ,EAAE,OAAO,GAAG,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,qCAAqC;SACnG,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,2CAA2C;IAC3C,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;IAEzG,OAAO;QACL,QAAQ;QACR,WAAW;QACX,iBAAiB,EAAE,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;QAC/F,WAAW;QACX,WAAW,EAAE,KAAK;QAClB,sBAAsB,EAAE,mBAAmB,CAAC,MAAM,CAAC,sBAAsB,CAAC;KAC3E,CAAC;AACJ,CAAC"}

package/dist/ai/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/ai/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/ai/types.ts"],"names":[],"mappings":""}

package/dist/analysis/consent-mode.js

@@ -0,0 +1,225 @@
+/**
+ * The one question a customer asks about consent that no existing check
+ * answers: *is Google Consent Mode v2 correctly enabled on my site?*
+ *
+ * It is a separate module and a pure function of `phase.consent` alone — no
+ * network, no cookies, no script, no tag manager — so it is a leaf that
+ * deployment.ts and diagnosis/rules.ts can both read, and so its decision
+ * table can be walked by a unit test without constructing a whole run.
+ *
+ * THREE INVARIANTS, each verified against live gtag.js, hold this file
+ * together. Every one of them is a rule that a previous version of this
+ * codebase (and of the tracking snippet the CLI verifies) got wrong:
+ *
+ * 1. `ics.active === true` is the ONLY proof Consent Mode is installed.
+ *    `ics.entries` carrying signal keys proves nothing — gtag/GTM creates
+ *    them itself as soon as a container loads (verified live: a page with no
+ *    Consent Mode at all reported four of them), so a site whose CMP never
+ *    calls gtag('consent', …) still has a readable analytics_storage state.
+ *
+ * 2. Resolution is always `update ?? default`, and `default` is ALREADY
+ *    region-resolved by gtag.js. This module therefore never re-resolves a
+ *    region itself; the push log is read only to EXPLAIN a resolved state
+ *    that a raw reader would have misread (see F4).
+ *
+ * 3. `usedUpdate === false` is what separates "correctly installed, this
+ *    visitor has not answered yet" from "not installed at all". Never infer
+ *    the latter from `entries.analytics_storage.update === undefined`: on
+ *    most page loads, of most correctly configured sites, that field is
+ *    absent because nobody has clicked anything yet.
+ *
+ * Scope boundary: this asks whether the MECHANISM is installed, complete and
+ * correctly ordered. Whether an unanswered visitor is actually covered is a
+ * different question, asked by the cookieless-covers-unconsented check — a
+ * site can legitimately pass here while every unconsented visit goes
+ * untracked, because the standard bundle's loader correctly declines to
+ * initialise and no cookieless bundle was installed behind it.
+ */
+import { consentModeVersionFromKeys } from "../evidence/consent.js";
+/**
+ * Fixed emission order, so the same evidence always produces the same
+ * sequence of causes. Roughly severity: not installed, then incomplete, then
+ * mis-ordered, then misleading, then timing, then the benign one.
+ */
+const CAUSE_ORDER = [
+    "no-consent-mode",
+    "v1-only",
+    "set-late",
+    "region-shadowed-default",
+    "wait-period-timed-out",
+    "not-yet-answered",
+];
+/** True when at least one phase saw a Google tag, whatever it did with it. */
+export function sawGoogleTag(phases) {
+    return phases.some((phase) => phase.consent.googleTagDataExists);
+}
+/**
+ * F4 — a global default and a region-scoped default disagree.
+ *
+ * The shape: a CMP declares `analytics_storage: granted` globally (for
+ * visitors it does not have to ask), then `denied` for a list of regions.
+ * gtag.js resolves it correctly, so nothing leaks; what breaks is every
+ * consumer that reads the raw push log, which sees the global `granted` and
+ * takes it for a decision. That includes Dreamdata's own GTM snippet, which
+ * is why this is worth reporting even though the site's end state is right.
+ *
+ * Requires the disagreement AND a region scope: two plain global defaults
+ * that disagree are a CMP correcting itself, and the later one simply wins
+ * for everyone.
+ */
+function regionShadowedDefault(phase) {
+    const defaults = phase.consent.dataLayerConsentPushes.filter((push) => push.verb === "default" && push.analyticsStorage !== undefined);
+    if (defaults.length < 2)
+        return false;
+    const values = new Set(defaults.map((push) => push.analyticsStorage));
+    if (values.size < 2)
+        return false;
+    return defaults.some((push) => push.region !== null && push.region !== undefined);
+}
+/** true from either the settled read or the pre-decision one — see IcsSnapshot. */
+function setLate(ics, before) {
+    return ics.wasSetLate === true || before?.wasSetLate === true;
+}
+/**
+ * Whether every flag this verdict needs read back as null — a gtag.js build
+ * that exposes an `ics` object and none of its diagnostics. The verdict has
+ * nothing to stand on, and says so rather than guessing.
+ */
+function flagsUnreadable(ics) {
+    return ics.active === null && ics.usedDefault === null && ics.usedUpdate === null;
+}
+export function judgePhaseConsentMode(phase) {
+    const consent = phase.consent;
+    const ics = consent.ics;
+    const name = phase.phase;
+    const base = `${name}.consent.googleTagDataExists: ${consent.googleTagDataExists}`;
+    // Row 0 — evidence predating this check, or a read that threw in the page.
+    if (ics === null || ics === undefined) {
+        return {
+            phase: name,
+            outcome: "unreadable",
+            version: consent.googleTagDataExists ? "unknown" : "none",
+            causes: [],
+            evidence: `${base}, ${name}.consent.ics: null`,
+        };
+    }
+    const version = consentModeVersionFromKeys(ics.entryKeys);
+    const keys = `${name}.consent.ics.entryKeys: [${ics.entryKeys.join(", ")}]`;
+    // Row 1 — no Google tag at all. Nothing to hold to Consent Mode: this is a
+    // not_applicable, never a failure. A site can be perfectly compliant
+    // without gtag.js on it.
+    if (!ics.present && !consent.googleTagDataExists) {
+        return { phase: name, outcome: "unreadable", version: "none", causes: [], evidence: `${base}, ics absent` };
+    }
+    if (flagsUnreadable(ics)) {
+        return {
+            phase: name,
+            outcome: "unreadable",
+            version: "unknown",
+            causes: [],
+            evidence: `${base}, ${keys}, every ics diagnostic flag read as null`,
+        };
+    }
+    // Row 2 — F1. The entries exist because a container created them; nothing
+    // ever called gtag('consent', …). This is the expensive case: the site
+    // looks like it has Consent Mode to anything reading entries.
+    if (ics.active !== true) {
+        return {
+            phase: name,
+            outcome: "not-installed",
+            version,
+            causes: ["no-consent-mode"],
+            evidence: `${name}.consent.ics.active: ${ics.active}, ${keys}`,
+        };
+    }
+    // Row 3 — F2. Reported before the ordering and timing faults because it is
+    // a gap in what the site declares at all, not in how it behaves.
+    if (version === "v1") {
+        return {
+            phase: name,
+            outcome: "misconfigured",
+            version,
+            causes: ["v1-only"],
+            evidence: `${keys} (ad_user_data/ad_personalization missing)`,
+        };
+    }
+    const causes = [];
+    let outcome = "enabled";
+    // Row 4 — F6. The one fault here that is unambiguously the customer's, and
+    // the one nothing else in the run observes.
+    if (setLate(ics, consent.icsBeforeDecision)) {
+        causes.push("set-late");
+        outcome = "misconfigured";
+    }
+    // Row 5 — F4.
+    if (regionShadowedDefault(phase)) {
+        causes.push("region-shadowed-default");
+        outcome = "misconfigured";
+    }
+    // Row 6 / 6b — F5. A visitor who never answers legitimately lets the window
+    // close, so in the clean phase this is descriptive. On a phase where the
+    // banner WAS answered it means the answer arrived after the window, which
+    // is a real fault.
+    if (ics.waitPeriodTimedOut === true) {
+        causes.push("wait-period-timed-out");
+        if (name !== "clean")
+            outcome = "misconfigured";
+    }
+    // Rows 7 and 8 — F3 versus a carried decision. Only reached when nothing
+    // above downgraded the outcome, so a misconfiguration is never relabelled
+    // as "just unanswered".
+    if (ics.usedUpdate !== true) {
+        causes.push("not-yet-answered");
+        if (outcome === "enabled")
+            outcome = "enabled-not-yet-answered";
+    }
+    return {
+        phase: name,
+        outcome,
+        version,
+        causes: orderCauses(causes),
+        evidence: `${name}.consent.ics.active: true, ${keys}, ` +
+            `usedDefault: ${ics.usedDefault}, usedUpdate: ${ics.usedUpdate}, ` +
+            `wasSetLate: ${ics.wasSetLate}, waitPeriodTimedOut: ${ics.waitPeriodTimedOut}`,
+    };
+}
+function orderCauses(causes) {
+    const present = new Set(causes);
+    return CAUSE_ORDER.filter((id) => present.has(id));
+}
+export function judgeConsentModeV2(phases) {
+    const perPhase = phases.map(judgePhaseConsentMode);
+    const readable = perPhase.filter((entry) => entry.outcome !== "unreadable");
+    const causes = orderCauses(perPhase.flatMap((entry) => entry.causes));
+    // A v1 reading anywhere wins: it is a statement about what the container
+    // declares, which does not change between phases, and the phase that saw
+    // fewer keys is the one that caught the container mid-load.
+    const version = readable.some((entry) => entry.version === "v1")
+        ? "v1"
+        : readable.some((entry) => entry.version === "v2")
+            ? "v2"
+            : perPhase.some((entry) => entry.version === "unknown")
+                ? "unknown"
+                : "none";
+    const outcome = readable.length === 0
+        ? "unreadable"
+        : readable.every((entry) => entry.outcome === "not-installed")
+            ? "not-installed"
+            : readable.some((entry) => entry.outcome === "misconfigured")
+                ? "misconfigured"
+                : // One phase seeing an update carry is enough: it is positive proof
+                    // the mechanism works, and it is normally the grant phase that
+                    // provides it. The other phases reading "not yet answered" is
+                    // exactly what they are supposed to read.
+                    readable.some((entry) => entry.outcome === "enabled")
+                        ? "enabled"
+                        : "enabled-not-yet-answered";
+    return {
+        outcome,
+        version,
+        causes,
+        perPhase,
+        evidence: perPhase.map((entry) => entry.evidence).join(" | "),
+    };
+}
+//# sourceMappingURL=consent-mode.js.map