@dreamdata_io/verify-tracking 0.1.0

package/dist/analysis/diagnosis/rules.js

@@ -0,0 +1,656 @@
+import { combinedBundleTags, tagsGatedOnWrongSignal } from "../deployment.js";
+const CONSENT_LEAK_CHECKS = [
+    "clean-before-consent",
+    "reject-blocks-normal",
+    "reject-writes-no-identity",
+    "second-page-honours-consent",
+];
+/** Whether a phase saw any Dreamdata request at all, on either page view. */
+function silent(phase) {
+    const second = phase.secondPage;
+    return (phase.normalRequests === 0 &&
+        phase.cookielessRequests === 0 &&
+        (second === null || (second.normalRequests === 0 && second.cookielessRequests === 0)));
+}
+/** Whether the normal bundle sent anything in a phase, on either page view. */
+function normalFired(phase) {
+    return phase.normalRequests > 0 || (phase.secondPage?.normalRequests ?? 0) > 0;
+}
+/** Consent Mode read as permissive before the visitor had answered. */
+function permissiveBeforeAnswer(phase) {
+    return phase.analyticsStorageSource === "implicit-default" || phase.analyticsStorage === "granted";
+}
+/** A phase where the banner was driven, so its consent state means something. */
+function drivenPhases(facts) {
+    return facts.observed.filter((phase) => phase.phase !== "clean" && phase.consentDriven);
+}
+function hasDuplicateKind(facts, kind) {
+    return facts.duplicates.some((duplicate) => duplicate.kind === kind);
+}
+/**
+ * Every remaining unhealthy check. Used only by the rules that genuinely
+ * account for the whole run — nothing is installed, or nothing is delivered —
+ * where reporting a second cause would be describing a consequence of the
+ * first as though it were separate.
+ */
+function everythingElse(facts) {
+    return facts.unhealthy;
+}
+export const CAUSE_RULES = [
+    // ── Not a verdict about the site. These pre-empt everything. ─────────────
+    {
+        id: "page-unreadable",
+        kind: "not-a-verdict",
+        trigger: [],
+        triggerMode: "any",
+        // Reached with every check already voided to inconclusive by voidChecks,
+        // so there is nothing to claim — the gate is pageReadability itself.
+        match: (facts) => (facts.analysis.pageReadability.unreadable ? { claims: everythingElse(facts), preempt: true } : null),
+    },
+    {
+        id: "third-party-segment",
+        kind: "not-a-verdict",
+        trigger: [],
+        triggerMode: "any",
+        match: (facts) => facts.analysis.shape === "third-party-segment-undetermined"
+            ? { claims: everythingElse(facts), preempt: true }
+            : null,
+    },
+    {
+        id: "banner-undrivable",
+        kind: "not-a-verdict",
+        trigger: [],
+        triggerMode: "any",
+        // Gates on the SHAPE, not on consentGateUndetermined alone: that flag can
+        // be true beside a concluded shape (see DeploymentAnalysis), and there
+        // the checks resting on the undriven phase are already inconclusive, so
+        // they never enter the ledger and no rule can misfire on them.
+        match: (facts) => (facts.analysis.shape === "undetermined" ? { claims: everythingElse(facts), preempt: true } : null),
+    },
+    // ── Blocking: data is being lost right now. ─────────────────────────────
+    {
+        id: "not-installed",
+        kind: "blocking",
+        trigger: ["script-installed"],
+        triggerMode: "any",
+        // Claims everything: with no script on the page, every other failing
+        // check is a restatement of the same fact.
+        match: (facts) => facts.analysis.shape === "nothing-installed" || facts.analysis.shape === "helper-only"
+            ? { claims: everythingElse(facts) }
+            : null,
+    },
+    {
+        id: "requests-never-reach-dreamdata",
+        kind: "blocking",
+        trigger: ["grant-enables-normal", "cookieless-covers-unconsented"],
+        triggerMode: "any",
+        /**
+         * The rocketbots_io signature: a bundle demonstrably ran — it is in the
+         * DOM and it wrote an identity cookie — and yet not one request left the
+         * browser in any phase. Every request-side field looks healthy, which is
+         * why this needs its own cause rather than reading as a consent problem.
+         */
+        match: (facts) => {
+            const everySilent = facts.observed.length > 0 && facts.observed.every(silent);
+            const bundlePresent = facts.observed.some((phase) => phase.normalBundleInDom || phase.cookielessBundleInDom);
+            const wroteIdentity = facts.observed.some((phase) => phase.identityCookiesSet.length > 0);
+            if (!everySilent || !bundlePresent || !wroteIdentity)
+                return null;
+            return {
+                claims: [
+                    "second-page-keeps-tracking",
+                    "soft-nav-keeps-tracking",
+                    "request-delivery-accepted",
+                    "request-payload-complete",
+                    "global-handoff",
+                ],
+            };
+        },
+    },
+    {
+        id: "cookieless-not-installed",
+        kind: "blocking",
+        trigger: ["cookieless-covers-unconsented"],
+        triggerMode: "all",
+        match: (facts) => (facts.analysis.cookielessBundleConfigured ? null : { claims: [] }),
+    },
+    {
+        id: "cookieless-shares-normal-gate",
+        kind: "blocking",
+        trigger: ["cookieless-covers-unconsented"],
+        triggerMode: "all",
+        /**
+         * The most common cause in the corpus (7 of 25 sites), and it reads
+         * straight off the DOM: on gong_io, nteams_com, smartbear_com and
+         * team_wrike_com the cookieless bundle is absent from the page in clean
+         * and reject but present after a grant. A tag that only appears once
+         * consent is given is a tag sharing the normal bundle's consent gate,
+         * which defeats the entire point of having a cookieless fallback.
+         */
+        match: (facts) => {
+            if (!facts.analysis.cookielessBundleConfigured)
+                return null;
+            const failing = facts.failingPhases("cookieless-covers-unconsented");
+            if (failing.length === 0)
+                return null;
+            const absentWhereItFailed = failing.every((name) => {
+                const phase = facts.phase(name);
+                return phase !== undefined && !phase.cookielessBundleInDom && phase.cookielessRequests === 0;
+            });
+            const presentSomewhere = facts.observed.some((phase) => phase.cookielessBundleInDom);
+            return absentWhereItFailed && presentSomewhere ? { claims: [] } : null;
+        },
+    },
+    {
+        id: "consent-not-persisted-across-reload",
+        kind: "blocking",
+        trigger: ["consent-mode-signal"],
+        triggerMode: "all",
+        /**
+         * paytronix_com: the update DID fire while the banner was being answered
+         * (consentSignalConfirmed true) but after the post-consent reload
+         * analytics_storage reads its default again. The visitor's decision does
+         * not survive a page load, so on the page they actually browse every
+         * gated tag is still blocked — which is also why grant-enables-normal
+         * fails here and is claimed rather than reported separately.
+         */
+        match: (facts) => {
+            const stranded = drivenPhases(facts).some((phase) => phase.consentSignalConfirmed === true && phase.analyticsStorageSource !== "update");
+            if (!stranded)
+                return null;
+            return { claims: ["grant-enables-normal", "grant-sets-identity-cookies", "second-page-honours-consent"] };
+        },
+    },
+    {
+        id: "consent-mode-not-wired",
+        kind: "blocking",
+        trigger: ["clean-consent-mode-default", "consent-mode-signal"],
+        triggerMode: "all",
+        /**
+         * The composite that collapses nextecgroup_com from six failing checks to
+         * one root cause, and cmic_ca from three to two. BOTH halves must be
+         * failing: no denied default AND no update ever emitted. That conjunction
+         * is what separates it from nice_com, where the same leak checks fail but
+         * Consent Mode signals correctly and the bundle simply ignores them —
+         * a different cause with a different fix, handled below.
+         */
+        match: (facts) => {
+            const clean = facts.phase("clean");
+            const defaultPermissive = clean !== undefined && permissiveBeforeAnswer(clean);
+            const neverUpdated = drivenPhases(facts).some((phase) => phase.analyticsStorageSource !== "update");
+            if (!defaultPermissive || !neverUpdated)
+                return null;
+            return {
+                claims: [
+                    ...CONSENT_LEAK_CHECKS,
+                    "grant-enables-normal",
+                    "grant-sets-identity-cookies",
+                    "cookieless-covers-unconsented",
+                    // Claimed so consent-mode-never-called below does not fire again
+                    // saying a narrower version of the same thing. This cause is the
+                    // fuller story: it has both halves of the evidence, not just the
+                    // ics flag.
+                    "consent-mode-v2-enabled",
+                ],
+            };
+        },
+    },
+    {
+        /**
+         * The half of F1 the rule above cannot see, and the most expensive
+         * failure in the catalog because nothing about it is visible from
+         * analytics_storage alone.
+         *
+         * A Google tag loads, creates all seven consent entries, and nothing
+         * ever calls gtag('consent', …). analytics_storage therefore reads
+         * `denied` off gtag.js's own fallback — which makes
+         * clean-consent-mode-default PASS, which is why consent-mode-not-wired
+         * (needing a permissive default) never fires. ics.active is the only
+         * field that tells this apart from a site that deliberately declared a
+         * denied default, and until it was collected this case reached a report
+         * as a silence nobody could explain.
+         *
+         * It matters because a consent-gated bundle in this state never
+         * initialises at all: it waits for a signal that no CMP is going to
+         * send, with no error and no request.
+         */
+        id: "consent-mode-never-called",
+        kind: "blocking",
+        trigger: ["consent-mode-v2-enabled"],
+        triggerMode: "all",
+        match: (facts) => facts.analysis.consentModeV2.outcome === "not-installed"
+            ? {
+                claims: ["grant-enables-normal", "cookieless-covers-unconsented"].filter((id) => facts.failingPhases(id).length > 0),
+            }
+            : null,
+    },
+    {
+        /**
+         * F6. The consent platform declares its defaults after tags have already
+         * run (ics.wasSetLate), so anything that fired first saw no consent
+         * state at all — a load-order fault, and one that changes with the
+         * visitor's network speed rather than with anything in the container.
+         *
+         * Read from either the settled read or the pre-decision one: on a driven
+         * phase the post-consent reload carries the CMP's own cookie and can
+         * declare earlier than a first visit does, so the fault hides in the
+         * settled read alone.
+         */
+        id: "consent-mode-set-late",
+        kind: "blocking",
+        trigger: ["consent-mode-v2-enabled"],
+        triggerMode: "all",
+        match: (facts) => {
+            if (!facts.analysis.consentModeV2.causes.includes("set-late"))
+                return null;
+            // Only the leak checks a late gate actually accounts for: a phase that
+            // leaked for some other reason belongs to another cause.
+            return { claims: CONSENT_LEAK_CHECKS.filter((id) => facts.failingPhases(id).length > 0) };
+        },
+    },
+    {
+        /**
+         * The tag requires a consent signal that is not analytics_storage, and
+         * the signal it requires is never granted here — so the tag is inert and
+         * the account records nothing at all, in every phase.
+         *
+         * telaid_com is the case: its standard-bundle tags require
+         * `targeted_advertising`, which is not one of Consent Mode's seven
+         * signals and which nothing on that page ever sets, so all three phases
+         * are silent and the run produced no cause whatsoever. The container is
+         * the only place this is visible — from behaviour alone it is
+         * indistinguishable from a trigger that never matched.
+         *
+         * Trigger-less and gated entirely in `match` (like the not-a-verdict
+         * rules) because there is no check whose failure means "gated on the
+         * wrong signal": the checks see silence, and silence has many causes.
+         * `normalFired` in no phase is what separates this from the hardening
+         * variant below, and it is what keeps this rule off any site whose tag
+         * actually works.
+         */
+        id: "consent-gate-wrong-signal",
+        kind: "blocking",
+        trigger: [],
+        triggerMode: "all",
+        match: (facts) => {
+            if (tagsGatedOnWrongSignal(facts.analysis.install.tagManagerContainers).length === 0)
+                return null;
+            if (facts.observed.some(normalFired))
+                return null;
+            return {
+                claims: ["grant-enables-normal", "cookieless-covers-unconsented", "core-tracking"].filter((id) => facts.failingPhases(id).length > 0),
+            };
+        },
+    },
+    {
+        id: "normal-bundle-never-fires",
+        kind: "blocking",
+        trigger: ["grant-enables-normal"],
+        triggerMode: "all",
+        // The bundle is on the page after the grant and still sends nothing —
+        // reached only when the total-silence signature above did not hold, so
+        // this is specifically "the identified bundle alone is broken".
+        match: (facts) => {
+            const grant = facts.phase("grant");
+            if (grant === undefined || !grant.normalBundleInDom || normalFired(grant))
+                return null;
+            return { claims: ["grant-sets-identity-cookies"] };
+        },
+    },
+    {
+        id: "router-no-page-call",
+        kind: "blocking",
+        trigger: ["soft-nav-keeps-tracking"],
+        triggerMode: "all",
+        /**
+         * Gated on the run-level reconciliation rather than on a re-scan of the
+         * phases — same set (summarizeSecondPage copies kind verbatim), one
+         * definition of "a soft navigation happened".
+         *
+         * softPhases, deliberately, and never mode: "client-routed-suspected" is
+         * a regex over served markup, and a regex must not be able to fire a
+         * blocking cause that tells a customer their site is a single-page app.
+         */
+        match: (facts) => {
+            const routing = facts.analysis.routing;
+            if (routing.softPhases.length === 0)
+                return null;
+            return { claims: [], vars: { navKind: "soft", framework: routing.frameworkMarkers[0] } };
+        },
+    },
+    {
+        id: "entry-page-only",
+        kind: "blocking",
+        trigger: ["second-page-keeps-tracking"],
+        triggerMode: "all",
+        match: (facts) => {
+            if (!facts.observed.some((phase) => phase.secondPage?.kind === "hard"))
+                return null;
+            const gtm = facts.analysis.install;
+            return {
+                claims: [],
+                vars: {
+                    navKind: "hard",
+                    // Read from the phases this check actually failed in, so a page that
+                    // tracked in some other phase cannot soften the sentence.
+                    secondPageStillTracked: facts
+                        .failingPhases("second-page-keeps-tracking")
+                        .map((name) => facts.phase(name)?.secondPage)
+                        .some((second) => second !== undefined && second !== null && (second.normalRequests > 0 || second.cookielessRequests > 0)),
+                    // Only true when the container was read and actually lists
+                    // exceptions. Everything else — not scanned, parse failed, no
+                    // exceptions — leaves the fix telling the reader to go and look
+                    // rather than telling them what they will find.
+                    tagHasBlockingTriggers: (gtm.tagManagerNormalBlockingTriggers?.length ?? 0) > 0,
+                },
+            };
+        },
+    },
+    // ── Leaking: visitors tracked who did not agree. ────────────────────────
+    {
+        id: "consent-default-not-denied",
+        kind: "leaking",
+        trigger: ["clean-consent-mode-default"],
+        triggerMode: "all",
+        /**
+         * aikido_dev: analytics_storage already reads granted before the banner
+         * is answered, so the gate never closes in the first place. Claims only
+         * the leak checks whose failing phases are ones where storage actually
+         * read permissive — a leak in a phase this cause cannot account for
+         * belongs to another cause.
+         */
+        match: (facts) => {
+            const clean = facts.phase("clean");
+            if (clean === undefined || !permissiveBeforeAnswer(clean))
+                return null;
+            const permissivePhases = new Set(facts.observed.filter(permissiveBeforeAnswer).map((phase) => phase.phase));
+            const claims = ["clean-before-consent", "second-page-honours-consent", "grant-sets-identity-cookies"].filter((id) => {
+                const failing = facts.failingPhases(id);
+                return failing.length > 0 && failing.every((phase) => permissivePhases.has(phase));
+            });
+            return { claims };
+        },
+    },
+    {
+        /**
+         * meteomatics_com. Consent Mode IS wired — the grant phase emitted
+         * `update: granted` and consentSignalConfirmed was true — but the refusal,
+         * which this run had to make through the preference centre, emitted
+         * nothing at all. analytics_storage stayed on its declared default, which
+         * happens to be `denied`, so the refusal produced the right end state and
+         * nothing leaked.
+         *
+         * Right by accident is what `hardening` means, and it is why this cannot
+         * be cmp-signal-not-emitted: that cause says the banner "never passes the
+         * choice on to Consent Mode" and links to how to turn Consent Mode ON,
+         * which is plainly untrue here and sends the reader to configure something
+         * already configured. What is actually broken is narrower and worse than
+         * it looks — a visitor who grants and later revokes leaves
+         * analytics_storage on `granted` from the earlier update, because the
+         * revocation emits nothing to override it. This run cannot see that: each
+         * phase is a fresh context that never granted first.
+         */
+        id: "refusal-not-passed-to-consent-mode",
+        kind: "hardening",
+        trigger: ["consent-mode-signal"],
+        triggerMode: "all",
+        match: (facts) => {
+            const driven = drivenPhases(facts);
+            const wired = driven.some((phase) => phase.consentSignalConfirmed === true || phase.analyticsStorageSource === "update");
+            const silent = driven.filter((phase) => phase.consentSignalConfirmed !== true && phase.analyticsStorageSource !== "update");
+            if (!wired || silent.length === 0)
+                return null;
+            // Only "held in check" while the default denies AND nothing ran anyway.
+            // Either failing makes this a real leak, which is the next rule's.
+            const heldByDefault = silent.every((phase) => phase.analyticsStorage === "denied" && !normalFired(phase));
+            return heldByDefault ? { claims: [] } : null;
+        },
+    },
+    {
+        id: "cmp-signal-not-emitted",
+        kind: "leaking",
+        trigger: ["consent-mode-signal"],
+        triggerMode: "all",
+        /**
+         * meteomatics_com's reject phase: the banner recorded the refusal but
+         * never emitted the Consent Mode update, so anything gated on it stayed
+         * on whatever it was. Distinguished from the reload case above by
+         * consentSignalConfirmed being false rather than true.
+         */
+        match: (facts) => {
+            const neverEmitted = drivenPhases(facts).some((phase) => phase.consentSignalConfirmed !== true && phase.analyticsStorageSource !== "update");
+            if (!neverEmitted)
+                return null;
+            const leaked = new Set(facts.observed.filter(normalFired).map((phase) => phase.phase));
+            const claims = ["reject-blocks-normal", "clean-before-consent", "grant-enables-normal"].filter((id) => {
+                const failing = facts.failingPhases(id);
+                return failing.length > 0 && failing.some((phase) => leaked.has(phase));
+            });
+            return { claims };
+        },
+    },
+    {
+        /**
+         * The snippet's own consent gate let the standard bundle through, on an
+         * install where the container has no gate to fall back on.
+         *
+         * A combined tag — both bundles in one Custom HTML tag — is NOT the
+         * defect and must never be reported as one: it is the install the
+         * documentation currently prescribes, and it behaves correctly whenever
+         * the snippet's gate does. This rule therefore requires an OBSERVED leak
+         * (normalFired in a phase that was not the grant), not merely the shape.
+         * sovos_com and tumodo_io both have a combined tag and neither fires
+         * this, which is the intended behaviour, not a gap.
+         *
+         * What the combined tag contributes once the gate has failed is the
+         * absence of a second line of defence. A GTM tag has one `consent` field
+         * and one trigger set, so the two bundles cannot be held to opposite
+         * consent states however it is configured — which is why the fix here is
+         * "split the tag", a different instruction from
+         * no-consent-gate-on-bundle's "add a consent requirement", and one the
+         * customer cannot carry out until the tag is split.
+         *
+         * Placed before no-consent-gate-on-bundle (array order is precedence) so
+         * that where the container shows the combined tag, the actionable
+         * instruction is the one reported. Where it does not — a hardcoded
+         * install, or evidence collected before TagManagerScan.containers
+         * existed — this returns null and the existing cause is unaffected.
+         *
+         * On getworkflex_com the failure is not a race, and the distinction
+         * decides what gets fixed: the clean phase leaked while
+         * analytics_storage resolved to `denied` from a `default` with no update
+         * anywhere in the run, so there was nothing for the bundle to race. The
+         * snippet's dataLayer.push wrapper reads neither raw[1] (default vs
+         * update) nor raw[2].region, so the CMP's global `granted` default —
+         * declared for visitors in regions this one was not in — read as the
+         * visitor's own consent.
+         */
+        id: "combined-tag-gate-failed",
+        kind: "leaking",
+        trigger: ["clean-before-consent", "reject-blocks-normal"],
+        triggerMode: "any",
+        match: (facts) => {
+            if (combinedBundleTags(facts.analysis.install.tagManagerContainers).length === 0)
+                return null;
+            // Same phase-awareness as no-consent-gate-on-bundle, and for the same
+            // reason: the mechanism named here is "the normal bundle ran when it
+            // should not have", so a leak check that failed in a phase where it
+            // sent nothing belongs to another cause.
+            const ranWithoutGrant = new Set(facts.observed
+                .filter((phase) => phase.phase !== "grant" && normalFired(phase))
+                .map((phase) => phase.phase));
+            if (ranWithoutGrant.size === 0)
+                return null;
+            return {
+                claims: CONSENT_LEAK_CHECKS.filter((id) => {
+                    const failing = facts.failingPhases(id);
+                    return failing.length > 0 && failing.some((phase) => ranWithoutGrant.has(phase));
+                }),
+            };
+        },
+    },
+    {
+        id: "no-consent-gate-on-bundle",
+        kind: "leaking",
+        trigger: ["clean-before-consent", "reject-blocks-normal"],
+        triggerMode: "any",
+        /**
+         * nice_com and manatal_com: Consent Mode reports the decision CORRECTLY
+         * (source "update", the right value) and the script runs anyway. Nothing
+         * is gating it. The gate on the two Consent Mode checks not failing is
+         * what keeps this apart from consent-mode-not-wired.
+         *
+         * The claim predicate is phase-aware on purpose, and this is where
+         * over-collapse is prevented: the mechanism named here is "the normal
+         * bundle ran", so a leak check that failed in a phase where the normal
+         * bundle sent nothing is not this cause's business. That is why
+         * getmoss_com's reject-writes-no-identity (reject sent no normal request)
+         * falls through to its own cause, and why manatal keeps three causes
+         * rather than collapsing to one.
+         */
+        match: (facts) => {
+            if (facts.statusOf("clean-consent-mode-default") === "fail")
+                return null;
+            if (facts.statusOf("consent-mode-signal") === "fail")
+                return null;
+            const ranWithoutGrant = new Set(facts.observed
+                .filter((phase) => phase.phase !== "grant" && normalFired(phase))
+                .map((phase) => phase.phase));
+            if (ranWithoutGrant.size === 0)
+                return null;
+            const claims = CONSENT_LEAK_CHECKS.filter((id) => {
+                const failing = facts.failingPhases(id);
+                return failing.length > 0 && failing.some((phase) => ranWithoutGrant.has(phase));
+            });
+            return { claims };
+        },
+    },
+    {
+        id: "navigation-treated-as-consent",
+        kind: "leaking",
+        trigger: ["second-page-honours-consent"],
+        triggerMode: "all",
+        // moxo_com. Reached only when no broader consent cause claimed it, which
+        // is exactly when the entry page behaved and the navigation did not.
+        match: () => ({ claims: [] }),
+    },
+    {
+        id: "reject-writes-identity",
+        kind: "leaking",
+        trigger: ["reject-writes-no-identity"],
+        triggerMode: "all",
+        match: () => ({ claims: [] }),
+    },
+    // ── Duplicate counting. ────────────────────────────────────────────────
+    // All four share one trigger, so the ledger guarantees exactly one fires.
+    // Ordered most-structural first; page-view-counted-once's own detail still
+    // lists every duplicate found, so nothing is hidden by picking one.
+    {
+        id: "duplicate-two-builds",
+        kind: "duplicate-counting",
+        trigger: ["page-view-counted-once"],
+        triggerMode: "all",
+        match: (facts) => hasDuplicateKind(facts, "two-builds") ? { claims: [], vars: { duplicateKind: "two-builds" } } : null,
+    },
+    {
+        id: "duplicate-replayed-buffer",
+        kind: "duplicate-counting",
+        trigger: ["page-view-counted-once"],
+        triggerMode: "all",
+        match: (facts) => hasDuplicateKind(facts, "replayed-buffer") ? { claims: [], vars: { duplicateKind: "replayed-buffer" } } : null,
+    },
+    {
+        id: "duplicate-same-build",
+        kind: "duplicate-counting",
+        trigger: ["page-view-counted-once"],
+        triggerMode: "all",
+        match: (facts) => hasDuplicateKind(facts, "same-build") ? { claims: [], vars: { duplicateKind: "same-build" } } : null,
+    },
+    {
+        id: "snippet-order",
+        kind: "duplicate-counting",
+        trigger: ["page-view-counted-once"],
+        triggerMode: "all",
+        // The one duplicate kind page-view-counted-once warns about rather than
+        // failing, because ingest collapses the pair (see isCollapsedByIngest).
+        // The race that produced it is identical either way, so the cause and the
+        // fix are the same and must still be given.
+        triggerOn: "unhealthy",
+        match: (facts) => hasDuplicateKind(facts, "mixed-modes") ? { claims: [], vars: { duplicateKind: "mixed-modes" } } : null,
+    },
+    // ── Hardening: correct today, but only by accident. ────────────────────
+    {
+        /**
+         * F2. Consent Mode is genuinely in use, but only v1: ad_user_data and
+         * ad_personalization are not among the declared signals.
+         *
+         * `hardening` rather than `blocking` because analytics_storage — the only
+         * signal Dreamdata's own gating reads — still works, so nothing about
+         * this run's tracking is wrong. What it costs the customer is on the ads
+         * side, which is worth telling them once and not failing them over.
+         *
+         * triggerOn "unhealthy": the check reports v1 as a `fail`, but a run that
+         * has v1 AND something the check downgraded lands on `warn`, and it is
+         * the same missing signals either way.
+         */
+        id: "consent-mode-v1-only",
+        kind: "hardening",
+        trigger: ["consent-mode-v2-enabled"],
+        triggerMode: "all",
+        triggerOn: "unhealthy",
+        match: (facts) => (facts.analysis.consentModeV2.causes.includes("v1-only") ? { claims: [] } : null),
+    },
+    {
+        /**
+         * F4, and the only cause here that is about how the install can be READ
+         * rather than how it behaves.
+         *
+         * The consent platform declares a permissive global default for
+         * analytics_storage and then overrides it for a list of regions. gtag.js
+         * resolves that correctly — `entries[k].default` is the region-resolved
+         * value — so the visitor's end state is right and nothing leaks, which is
+         * what makes it hardening.
+         *
+         * It is still worth a customer's attention, because everything that reads
+         * the dataLayer consent commands directly rather than the resolved state
+         * sees the global `granted` and takes it for a decision. Dreamdata's own
+         * GTM snippet was one of those readers, which is how this shape was
+         * found.
+         */
+        id: "consent-mode-region-shadowed",
+        kind: "hardening",
+        trigger: ["consent-mode-v2-enabled"],
+        triggerMode: "all",
+        triggerOn: "unhealthy",
+        match: (facts) => facts.analysis.consentModeV2.causes.includes("region-shadowed-default") ? { claims: [] } : null,
+    },
+    {
+        /**
+         * The tag is gated on a consent signal other than analytics_storage, and
+         * it does fire — so it works today, for a reason that is not the one the
+         * customer configured.
+         *
+         * tumodo_io requires `ad_storage`. That holds only because Cookiebot
+         * grants advertising and statistics from the same click; a visitor who
+         * accepts statistics and declines marketing gets no identified tracking,
+         * and a visitor who accepts marketing and declines statistics gets it
+         * against their choice. Neither shows up in a run that answers the banner
+         * with all-accept or all-reject, which is what every phase here does —
+         * so behaviour can never find this and the container is the only witness.
+         *
+         * `hardening` and claims nothing: nothing in this run failed because of
+         * it. Trigger-less for the same reason as the blocking variant above, and
+         * mutually exclusive with it on `normalFired`.
+         */
+        id: "consent-gate-broad-signal",
+        kind: "hardening",
+        trigger: [],
+        triggerMode: "all",
+        match: (facts) => {
+            if (tagsGatedOnWrongSignal(facts.analysis.install.tagManagerContainers).length === 0)
+                return null;
+            return facts.observed.some(normalFired) ? { claims: [] } : null;
+        },
+    },
+];
+//# sourceMappingURL=rules.js.map