@drip-apex/sdk 0.1.0 → 0.3.0

package/src/init-consent.test.ts

@@ -0,0 +1,971 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  RECENT_MONDAY_NOON, documentListeners, windowListeners, appendedAntiFlickerStyle, configPayloadHash, flushDynamicImports, installCookieJar, installMutationObserverStub, makeClassList, makeStorage, readCookieValue, readDecodedDripContext, registerInitTestLifecycle, verifiedHandoverResponse,
+} from "./init-test-helpers";
+
+describe("init consent", () => {
+  registerInitTestLifecycle();
+
+  it("preserves a persisted identity when CookieScript consent is available from its cookie at init", async () => {
+    (globalThis as any).localStorage.setItem("drip_uid", "stored-visitor");
+    (globalThis as any).document.cookie = `CookieScriptConsent=${encodeURIComponent(JSON.stringify({
+      action: "accept",
+      categories: JSON.stringify(["performance"]),
+    }))}`;
+    const { getDiagnostics, init } = await import("./index");
+    const { getUserId } = await import("./hash");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "cookiescript", requiredGroup: "analytics" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+    expect(getUserId()).toBe("stored-visitor");
+    expect((globalThis as any).localStorage.getItem("drip_uid")).toBe("stored-visitor");
+  });
+
+  it("adopts an existing persisted identity when consent resolves after init", async () => {
+    const { init, setConsent } = await import("./index");
+    const { getUserId } = await import("./hash");
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "ephemeral-visitor",
+    });
+    (globalThis as any).localStorage.setItem("drip_uid", "stored-visitor");
+
+    setConsent(true);
+
+    expect(getUserId()).toBe("stored-visitor");
+    expect((globalThis as any).localStorage.getItem("drip_uid")).toBe("stored-visitor");
+  });
+
+  it("persists the in-memory identity when first consent finds no stored identity", async () => {
+    const { init, setConsent } = await import("./index");
+    const { getUserId } = await import("./hash");
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "ephemeral-visitor",
+    });
+
+    setConsent(true);
+
+    expect(getUserId()).toBe("ephemeral-visitor");
+    expect((globalThis as any).localStorage.getItem("drip_uid")).toBe("ephemeral-visitor");
+  });
+
+
+  it("stops tracking and clears consent storage when consent is revoked", async () => {
+    const { flush, init, setConsent, track } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [],
+      hasConsent: true,
+      pageTrigger: { defaultMode: "manual" },
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+    (globalThis as any).localStorage.setItem("drip_cfg:shop_123:production", "{}");
+    setConsent(false);
+    track("after_revoke");
+    await flush();
+
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+    expect((globalThis as any).localStorage.getItem("drip_uid")).toBeNull();
+    expect((globalThis as any).localStorage.getItem("drip_cfg:shop_123:production")).toBeNull();
+    expect((globalThis as any).sessionStorage.getItem("drip_sid")).toBeNull();
+    expect((globalThis as any).document.cookie).toContain("drip_uid=; Max-Age=0");
+  });
+
+
+  it("purges replay sample and progress storage after stopping live capture on consent revoke", async () => {
+    const emptyReplaySignals = () => ({
+      clicks: [],
+      nav: [],
+      errors: [],
+      form_focus: [],
+      form_submit: [],
+      scroll_max_pct: 0,
+    });
+    const stopRecorder = vi.fn();
+    (globalThis as any).__dripReplayRecorder = {
+      version: "2.1.1",
+      start: vi.fn(() => stopRecorder),
+      compress: vi.fn(async (bytes: Uint8Array) => bytes),
+      compressSync: vi.fn((bytes: Uint8Array) => bytes),
+      takeSignals: vi.fn(emptyReplaySignals),
+    };
+    (globalThis as any).sessionStorage.setItem("drip_sid", "session_replay_consent");
+    const { init, setConsent } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_replay_consent",
+        status: "running",
+        trafficAllocation: 1,
+        replayCapture: { enabled: true, sampleRate: 1 },
+        variations: [{ id: "var_replay_consent", weight: 1, mutations: [] }],
+      }],
+      hasConsent: true,
+      replayRecorderUrl: "https://events.test/drip.replay-recorder.js",
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_replay_consent",
+    });
+    await flushDynamicImports();
+
+    expect((globalThis as any).sessionStorage.getItem("drip_rp:exp_replay_consent:var_replay_consent"))
+      .toBe("1");
+    expect((globalThis as any).sessionStorage.getItem("drip_replay_progress:session_replay_consent"))
+      .not.toBeNull();
+
+    setConsent(false);
+
+    expect(stopRecorder).toHaveBeenCalledTimes(1);
+    const remainingReplayKeys = Array.from(
+      { length: (globalThis as any).sessionStorage.length },
+      (_, index) => (globalThis as any).sessionStorage.key(index),
+    ).filter((key) => key?.startsWith("drip_rp:") || key?.startsWith("drip_replay_progress:"));
+    expect(remainingReplayKeys).toEqual([]);
+  });
+
+
+  it("does not restore replay progress when recorder startup resolves after consent revoke", async () => {
+    const emptyReplaySignals = () => ({
+      clicks: [],
+      nav: [],
+      errors: [],
+      form_focus: [],
+      form_submit: [],
+      scroll_max_pct: 0,
+    });
+    const stopRecorder = vi.fn();
+    const recorder = {
+      version: "2.1.1",
+      start: vi.fn(() => stopRecorder),
+      compress: vi.fn(async (bytes: Uint8Array) => bytes),
+      compressSync: vi.fn((bytes: Uint8Array) => bytes),
+      takeSignals: vi.fn(emptyReplaySignals),
+    };
+    (globalThis as any).sessionStorage.setItem("drip_sid", "session_replay_mid_load");
+    const { init, setConsent } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_replay_mid_load",
+        status: "running",
+        trafficAllocation: 1,
+        replayCapture: { enabled: true, sampleRate: 1 },
+        variations: [{ id: "var_replay_mid_load", weight: 1, mutations: [] }],
+      }],
+      hasConsent: true,
+      replayRecorderUrl: "https://events.test/drip.replay-recorder.js",
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_replay_mid_load",
+    });
+    await vi.dynamicImportSettled();
+
+    const recorderScript = vi.mocked((globalThis as any).document.head.appendChild).mock.calls
+      .map(([element]: [any]) => element)
+      .find((element: any) => element.id === "drip-replay-recorder");
+    expect(recorderScript).toBeDefined();
+
+    (globalThis as any).__dripReplayRecorder = recorder;
+    recorderScript.onload();
+    await Promise.resolve();
+    setConsent(false);
+    await flushDynamicImports();
+
+    expect(stopRecorder).toHaveBeenCalledTimes(1);
+    expect((globalThis as any).sessionStorage.getItem(
+      "drip_replay_progress:session_replay_mid_load",
+    )).toBeNull();
+  });
+
+
+  it("clears drip_ctx when consent is revoked", async () => {
+    let currentCookie = "";
+    const cookieWrites: string[] = [];
+    Object.defineProperty((globalThis as any).document, "cookie", {
+      configurable: true,
+      get: () => currentCookie,
+      set: (value: string) => {
+        currentCookie = value;
+        cookieWrites.push(value);
+      },
+    });
+    (globalThis as any).sessionStorage.setItem("drip_sid", "session_ctx");
+    const { init, setConsent } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_ctx",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_ctx", weight: 1, mutations: [] }],
+        },
+      ],
+      hasConsent: true,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+      userId: "visitor_ctx",
+    });
+    expect(cookieWrites.some((value) => value.startsWith("drip_ctx=") && value.includes("Max-Age=2592000")))
+      .toBe(true);
+
+    setConsent(false);
+
+    expect(cookieWrites.some((value) => value === "drip_ctx=; Max-Age=0; Path=/; SameSite=Lax"))
+      .toBe(true);
+  });
+
+
+  it("separates variation and tracking prerequisite gates", async () => {
+    const { getDiagnostics, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_track_gate",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_track_gate", weight: 1, mutations: [] }],
+        },
+      ],
+      projectPrerequisites: {
+        startTrackingRule: "return false;",
+      },
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    const diagnostics = getDiagnostics();
+    expect(diagnostics.assignments).toHaveLength(1);
+    expect(diagnostics.trackerStarted).toBe(false);
+    expect(diagnostics.trackingPrerequisiteMet).toBe(false);
+    expect(diagnostics.activation.project.gates.find((gate) => gate.id === "tracking")).toMatchObject({
+      status: "failed",
+      reason: "start_tracking_blocked",
+    });
+  });
+
+
+  it("honors Do Not Track without blocking configured rendering", async () => {
+    Object.defineProperty(globalThis, "navigator", {
+      configurable: true,
+      value: { userAgent: "Mozilla/5.0", doNotTrack: "1" },
+    });
+    (globalThis as any).localStorage.setItem("drip_uid", "stale-visitor");
+    (globalThis as any).sessionStorage.setItem("drip_sid", "stale-session");
+    const { flush, getDiagnostics, init, track } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      dataProtection: { respectDoNotTrack: true, storageMode: "localStorage" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_dnt",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_dnt", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    track("dnt_probe");
+    await flush();
+
+    const diagnostics = getDiagnostics();
+    expect(diagnostics.assignments).toHaveLength(1);
+    expect(diagnostics.trackingDisabledByDnt).toBe(true);
+    expect(diagnostics.trackingBlocked).toBe(true);
+    expect(diagnostics.trackerStarted).toBe(false);
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+    expect((globalThis as any).localStorage.getItem("drip_uid")).toBeNull();
+    expect((globalThis as any).sessionStorage.getItem("drip_sid")).toBeNull();
+  });
+
+
+  it("returns no order attribution while tracking is blocked", async () => {
+    Object.defineProperty(globalThis, "navigator", {
+      configurable: true,
+      value: { userAgent: "Mozilla/5.0", doNotTrack: "1" },
+    });
+    const { getRuntimeValue, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      dataProtection: { respectDoNotTrack: true, storageMode: "localStorage" },
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_dnt_attr",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_dnt_attr", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getRuntimeValue("orderAttribution")).toEqual({
+      visitorId: "",
+      assignments: [],
+    });
+  });
+
+
+  it("redacts consent diagnostics unless SDK debug mode is enabled", async () => {
+    const { getDiagnostics, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true },
+      endpoint: "https://events.test",
+      experiments: [],
+      hasConsent: false,
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    const diagnostics = getDiagnostics();
+
+    expect(diagnostics.mode).toBe("public");
+    expect("consentRequired" in diagnostics).toBe(false);
+    expect("consentGranted" in diagnostics).toBe(false);
+    expect("consentModeEnabled" in diagnostics).toBe(false);
+    expect("trackingBlocked" in diagnostics).toBe(false);
+    expect("trackingPrerequisiteMet" in diagnostics).toBe(false);
+    expect("trackingDisabledByDnt" in diagnostics).toBe(false);
+  });
+
+
+  it("reactivates consent and Shopify assignment sync from OneTrust-style changes", async () => {
+    const shopifyPublish = vi.fn();
+    (globalThis as any).window.Shopify = { analytics: { publish: shopifyPublish } };
+    (globalThis as any).Shopify = (globalThis as any).window.Shopify;
+    (globalThis as any).window.OnetrustActiveGroups = ",C0001,";
+    (globalThis as any).OnetrustActiveGroups = ",C0001,";
+
+    const { flush, getDiagnostics, init, track } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "onetrust", requiredGroup: "C0004" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_consent_provider",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_consent_provider", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+    expect(shopifyPublish).not.toHaveBeenCalled();
+
+    (globalThis as any).window.OnetrustActiveGroups = ",C0001,C0004,";
+    (globalThis as any).OnetrustActiveGroups = ",C0001,C0004,";
+    windowListeners.OptanonConsentChanged?.forEach((handler) => handler());
+    track("after_onetrust_grant");
+    await flush();
+
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+    expect(globalThis.fetch).toHaveBeenCalled();
+    expect(shopifyPublish).toHaveBeenCalledWith("drip_assignment_sync", expect.any(Object));
+    await vi.waitFor(() => {
+      expect(getDiagnostics().spa.lastShopifyAssignmentSync).toMatchObject({ status: "sent" });
+    });
+  });
+
+
+  it("reactivates consent from Usercentrics service changes", async () => {
+    let apexConsent = false;
+    const services = () => [
+      { name: "Essential", consent: { status: true } },
+      { name: "Apex", consent: { status: apexConsent } },
+    ];
+    (globalThis as any).window.UC_UI = { getServicesBaseInfo: services };
+    (globalThis as any).UC_UI = (globalThis as any).window.UC_UI;
+
+    const { flush, getDiagnostics, init, track } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "usercentrics", requiredGroup: "Apex" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_usercentrics",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_usercentrics", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+
+    apexConsent = true;
+    windowListeners.UC_UI_CMP_EVENT?.forEach((handler) => handler());
+    track("after_usercentrics_grant");
+    await flush();
+
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+    expect(globalThis.fetch).toHaveBeenCalled();
+  });
+
+
+  it("reactivates consent from Cookiebot category changes", async () => {
+    (globalThis as any).window.Cookiebot = {
+      consent: {
+        necessary: true,
+        preferences: false,
+        statistics: false,
+        marketing: false,
+      },
+    };
+    (globalThis as any).Cookiebot = (globalThis as any).window.Cookiebot;
+
+    const { flush, getDiagnostics, init, track } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "cookiebot", requiredGroup: "statistics" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_cookiebot",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_cookiebot", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+
+    (globalThis as any).window.Cookiebot.consent.statistics = true;
+    windowListeners.CookiebotOnAccept?.forEach((handler) => handler());
+    track("after_cookiebot_grant");
+    await flush();
+
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+    expect(globalThis.fetch).toHaveBeenCalled();
+  });
+
+
+  it("grants configured consent from accepted CCM19 embeddings", async () => {
+    (globalThis as any).window.CCM = {
+      acceptedEmbeddings: [{ id: "x", name: "Apex" }],
+    };
+    (globalThis as any).CCM = (globalThis as any).window.CCM;
+
+    const { flush, getDiagnostics, init, track } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "ccm19", requiredGroup: "apex" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_ccm19",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_ccm19", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+    track("after_ccm19_grant");
+    await flush();
+    expect(globalThis.fetch).toHaveBeenCalled();
+  });
+
+
+  it("falls back to the stored consent cookie when CCM19 embeddings are unavailable", async () => {
+    (globalThis as any).document.cookie = "drip_consent=1";
+    (globalThis as any).window.CCM = {};
+    (globalThis as any).CCM = (globalThis as any).window.CCM;
+
+    const { getDiagnostics, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "ccm19", requiredGroup: "Apex" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+  });
+
+
+  it("reactivates consent from CCM19 embedding changes", async () => {
+    (globalThis as any).window.CCM = {
+      acceptedEmbeddings: [],
+    };
+    (globalThis as any).CCM = (globalThis as any).window.CCM;
+
+    const { flush, getDiagnostics, init, track } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "ccm19", requiredGroup: "apex-embedding" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_ccm19_event",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_ccm19_event", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+
+    (globalThis as any).window.CCM.acceptedEmbeddings = [{ id: "apex-embedding", name: "Apex Embed" }];
+    windowListeners.ccm19EmbeddingAccepted?.forEach((handler) => handler());
+    track("after_ccm19_event_grant");
+    await flush();
+
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+    expect(globalThis.fetch).toHaveBeenCalled();
+  });
+
+
+  it("renders variants without storage or tracking until Pandectes grants analytics consent", async () => {
+    let granted = false;
+    (globalThis as any).window.Pandectes = { analyticsProcessingAllowed: () => granted };
+    (globalThis as any).Pandectes = (globalThis as any).window.Pandectes;
+    const { flush, getAssignments, getDiagnostics, init, track } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "pandectes" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [{ id: "exp_pandectes", status: "running", trafficAllocation: 1, variations: [{ id: "var_pandectes", weight: 1, mutations: [] }] }],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getAssignments()).toHaveLength(1);
+    expect((globalThis as any).localStorage.length).toBe(0);
+    track("denied");
+    await flush();
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+
+    granted = true;
+    windowListeners.PandectesInitialized?.forEach((handler) => handler());
+    track("granted");
+    await flush();
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+    expect((globalThis as any).localStorage.length).toBeGreaterThan(0);
+    expect(globalThis.fetch).toHaveBeenCalled();
+  });
+
+
+  it("reactivates Pandectes consent from document visitorConsentCollected", async () => {
+    let granted = false;
+    (globalThis as any).window.Pandectes = { analyticsProcessingAllowed: () => granted };
+    const { getDiagnostics, init } = await import("./index");
+    init({ antiFlickerMode: "off", consentMode: { enabled: true, provider: "pandectes" }, debug: { enabled: true, restrictMode: "always" }, endpoint: "https://events.test", experiments: [], shopId: "shop_123", trackingStart: "immediate" });
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+    granted = true;
+    documentListeners.visitorConsentCollected?.forEach((handler) => handler());
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+  });
+
+
+  it("falls back to Shopify Customer Privacy for Pandectes consent", async () => {
+    (globalThis as any).window.Shopify = { customerPrivacy: { analyticsProcessingAllowed: () => true } };
+    const { getDiagnostics, init } = await import("./index");
+    init({ antiFlickerMode: "off", consentMode: { enabled: true, provider: "pandectes" }, debug: { enabled: true, restrictMode: "always" }, endpoint: "https://events.test", experiments: [], shopId: "shop_123", trackingStart: "immediate" });
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+  });
+
+
+  it("routes Pandectes marketing consent to marketingAllowed", async () => {
+    const analyticsProcessingAllowed = vi.fn(() => false);
+    const marketingAllowed = vi.fn(() => true);
+    (globalThis as any).window.Pandectes = { analyticsProcessingAllowed, marketingAllowed };
+    const { getDiagnostics, init } = await import("./index");
+    init({ antiFlickerMode: "off", consentMode: { enabled: true, provider: "pandectes", requiredGroup: " marketing " }, debug: { enabled: true, restrictMode: "always" }, endpoint: "https://events.test", experiments: [], shopId: "shop_123", trackingStart: "immediate" });
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+    expect(marketingAllowed).toHaveBeenCalled();
+    expect(analyticsProcessingAllowed).not.toHaveBeenCalled();
+  });
+
+
+  it.each([
+    ["analytics", "analyticsProcessingAllowed"],
+    ["statistics", "analyticsProcessingAllowed"],
+    ["statistic", "analyticsProcessingAllowed"],
+    ["stats", "analyticsProcessingAllowed"],
+    ["marketing", "marketingAllowed"],
+    ["preferences", "preferencesProcessingAllowed"],
+    ["preference", "preferencesProcessingAllowed"],
+    ["sale_of_data", "saleOfDataAllowed"],
+    ["saleofdata", "saleOfDataAllowed"],
+    ["sale-of-data", "saleOfDataAllowed"],
+    ["sale", "saleOfDataAllowed"],
+  ])("maps Pandectes purpose %s to %s", async (requiredGroup, expectedMethod) => {
+    const methods = {
+      analyticsProcessingAllowed: vi.fn(() => true),
+      marketingAllowed: vi.fn(() => true),
+      preferencesProcessingAllowed: vi.fn(() => true),
+      saleOfDataAllowed: vi.fn(() => true),
+    };
+    (globalThis as any).window.Pandectes = methods;
+    const { getDiagnostics, init } = await import("./index");
+    init({ antiFlickerMode: "off", consentMode: { enabled: true, provider: "pandectes", requiredGroup }, debug: { enabled: true, restrictMode: "always" }, endpoint: "https://events.test", experiments: [], shopId: "shop_123", trackingStart: "immediate" });
+
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+    expect(methods[expectedMethod as keyof typeof methods]).toHaveBeenCalled();
+  });
+
+
+  it("denies unknown Pandectes purposes without falling back to analytics", async () => {
+    const analyticsProcessingAllowed = vi.fn(() => true);
+    (globalThis as any).window.Pandectes = { analyticsProcessingAllowed };
+    const { getDiagnostics, init } = await import("./index");
+    init({ antiFlickerMode: "off", consentMode: { enabled: true, provider: "pandectes", requiredGroup: "markting" }, debug: { enabled: true, restrictMode: "always" }, endpoint: "https://events.test", experiments: [], shopId: "shop_123", trackingStart: "immediate" });
+
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+    expect(analyticsProcessingAllowed).not.toHaveBeenCalled();
+  });
+
+
+  it("keeps polling when Pandectes is absent or throws and grants later without an event", async () => {
+    (globalThis as any).window.Pandectes = { analyticsProcessingAllowed: () => { throw new Error("not ready"); } };
+    const { getDiagnostics, init } = await import("./index");
+    init({ antiFlickerMode: "off", consentMode: { enabled: true, provider: "pandectes" }, debug: { enabled: true, restrictMode: "always" }, endpoint: "https://events.test", experiments: [], shopId: "shop_123", trackingStart: "immediate" });
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+    delete (globalThis as any).window.Pandectes;
+    await vi.advanceTimersByTimeAsync(1_000);
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+    (globalThis as any).window.Pandectes = { analyticsProcessingAllowed: () => true };
+    await vi.advanceTimersByTimeAsync(1_000);
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+  });
+
+
+  it("renders variants without storage or tracking until CookieScript grants performance consent", async () => {
+    (globalThis as any).document.cookie = "drip_consent=1";
+    const currentState = vi.fn(() => ({ action: "accept", categories: ["strict"] }));
+    (globalThis as any).window.CookieScript = {
+      instance: {
+        currentState,
+      },
+    };
+    const { flush, getAssignments, getDiagnostics, init, track } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "cookiescript" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_cookiescript",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_cookiescript", weight: 1, mutations: [] }],
+      }],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getAssignments()).toHaveLength(1);
+    expect(currentState).toHaveBeenCalled();
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+    expect((globalThis as any).localStorage.length).toBe(0);
+    track("cookiescript_performance_denied");
+    await flush();
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
+
+  it("starts storage and tracking when CookieScriptAccept grants performance consent", async () => {
+    let currentState = { action: "accept", categories: ["strict"] };
+    (globalThis as any).window.CookieScript = {
+      instance: {
+        currentState: () => currentState,
+      },
+    };
+    const { flush, getDiagnostics, init, track } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "cookiescript" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [{
+        id: "exp_cookiescript_event",
+        status: "running",
+        trafficAllocation: 1,
+        variations: [{ id: "var_cookiescript_event", weight: 1, mutations: [] }],
+      }],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+    currentState = { action: "accept", categories: ["strict", "performance"] };
+    windowListeners.CookieScriptAccept?.forEach((handler) => handler());
+    track("cookiescript_performance_granted");
+    await flush();
+
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+    expect((globalThis as any).localStorage.length).toBeGreaterThan(0);
+    expect(globalThis.fetch).toHaveBeenCalled();
+  });
+
+
+  it("reactivates rejected CookieScript consent from CookieScriptAcceptAll", async () => {
+    let currentState: { action: string; categories?: string[] } = { action: "reject" };
+    (globalThis as any).window.CookieScript = {
+      instance: {
+        currentState: () => currentState,
+      },
+    };
+    const { getDiagnostics, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "cookiescript" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+    currentState = { action: "accept", categories: ["performance"] };
+    windowListeners.CookieScriptAcceptAll?.forEach((handler) => handler());
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+  });
+
+
+  it("ignores the cached consent cookie when CookieScript is absent and grants on a later poll", async () => {
+    (globalThis as any).document.cookie = "drip_consent=1";
+    const { getDiagnostics, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "cookiescript" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+    (globalThis as any).window.CookieScript = {
+      instance: {
+        currentState: () => ({
+          action: "accept",
+          categories: ["performance"],
+        }),
+      },
+    };
+    await vi.advanceTimersByTimeAsync(1_000);
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+  });
+
+
+  it("ignores the cached consent cookie when CookieScript throws and grants on a later poll", async () => {
+    (globalThis as any).document.cookie = "drip_consent=1";
+    (globalThis as any).window.CookieScript = {
+      instance: {
+        currentState: () => { throw new Error("not ready"); },
+      },
+    };
+    const { getDiagnostics, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "cookiescript" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+
+    (globalThis as any).window.CookieScript.instance.currentState = () => ({
+      action: "accept",
+      categories: ["performance"],
+    });
+    await vi.advanceTimersByTimeAsync(1_000);
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+  });
+
+
+  it("routes CookieScript required groups to aliased and custom categories", async () => {
+    const trackingBlockedFor = async (requiredGroup: string, categories: string[]) => {
+      vi.clearAllTimers();
+      vi.resetModules();
+      delete (globalThis as any).__drip;
+      (globalThis as any).window.CookieScript = {
+        instance: {
+          currentState: () => ({ action: "accept", categories }),
+        },
+      };
+      const { getDiagnostics, init } = await import("./index");
+
+      init({
+        antiFlickerMode: "off",
+        consentMode: { enabled: true, provider: "cookiescript", requiredGroup },
+        debug: { enabled: true, restrictMode: "always" },
+        endpoint: "https://events.test",
+        experiments: [],
+        shopId: "shop_123",
+        trackingStart: "immediate",
+      });
+
+      return getDiagnostics().trackingBlocked;
+    };
+
+    expect(await trackingBlockedFor("marketing", ["targeting"])).toBe(false);
+    expect(await trackingBlockedFor("marketing", ["performance"])).toBe(true);
+    expect(await trackingBlockedFor("myCustomCat", ["mycustomcat"])).toBe(false);
+  });
+
+
+  it("keeps unanswered CookieScript consent blocked and polls for a later grant", async () => {
+    let currentState: { action?: string; categories?: string[] } = { categories: [] };
+    const currentStateReader = vi.fn(() => currentState);
+    (globalThis as any).window.CookieScript = {
+      instance: {
+        currentState: currentStateReader,
+      },
+    };
+    const { getDiagnostics, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: { enabled: true, provider: "cookiescript" },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(currentStateReader).toHaveBeenCalled();
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+
+    const callsBeforePoll = currentStateReader.mock.calls.length;
+    currentState = { action: "accept", categories: ["performance"] };
+    await vi.advanceTimersByTimeAsync(1_000);
+
+    expect(currentStateReader.mock.calls.length).toBeGreaterThan(callsBeforePoll);
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+  });
+
+
+  it("polls custom consent getters so tracking starts after consent without navigation", async () => {
+    const { flush, getDiagnostics, init } = await import("./index");
+
+    init({
+      antiFlickerMode: "off",
+      consentMode: {
+        enabled: true,
+        provider: "custom",
+        getter: "dr_cookiebanner_options.dr_acceptedCategories",
+        requiredGroup: "statistics",
+      },
+      debug: { enabled: true, restrictMode: "always" },
+      endpoint: "https://events.test",
+      experiments: [
+        {
+          id: "exp_custom_poll",
+          status: "running",
+          trafficAllocation: 1,
+          variations: [{ id: "var_custom_poll", weight: 1, mutations: [] }],
+        },
+      ],
+      shopId: "shop_123",
+      trackingStart: "immediate",
+    });
+
+    expect(getDiagnostics().trackingBlocked).toBe(true);
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+
+    (globalThis as any).dr_cookiebanner_options = { dr_acceptedCategories: ["essential", "statistics"] };
+    await vi.advanceTimersByTimeAsync(1000);
+    await flush();
+
+    expect(getDiagnostics().trackingBlocked).toBe(false);
+    const eventsCall = vi.mocked(globalThis.fetch).mock.calls.find((call) => call[0] === "https://events.test/v1/events");
+    expect(eventsCall).toBeDefined();
+    const body = JSON.parse(String(eventsCall?.[1]?.body));
+    expect(body.events.map((event: { type: string }) => event.type)).toEqual(
+      expect.arrayContaining(["experiment_viewed", "pageview"]),
+    );
+  });
+});