@getquick/content 0.0.0-stage → 0.2.0

package/dist/consent-server.js

@@ -0,0 +1,292 @@
+import { t as bearerMatches } from "./bearer-DMOCoSci.js";
+import { i as DECISION_VALIDITY_MS, l as isConsentId, t as CONSENT_ACTIONS, x as OPTIONAL_CATEGORIES } from "./state-BYWc5TUB.js";
+import { a as parseConsentRecordRequest } from "./records-Dumrz759.js";
+import { t as CONSENT_PATH } from "./paths-Cmzzof3v.js";
+//#region frontend/src/consent/server.ts
+const MAX_RETENTION_DAYS = 1826;
+const DAY_MS = 864e5;
+const MAX_RANGE_DAYS = 366;
+/** The CSV export's columns, in order (documented; stable within the schema version). */
+const CONSENT_EXPORT_COLUMNS = [
+	"recorded_at",
+	"consent_id",
+	"site_id",
+	"action",
+	"config_version",
+	"language",
+	"ui_version",
+	"preferences",
+	"analytics",
+	"marketing",
+	"external_media",
+	"legal_revisions"
+];
+function recordOf(row) {
+	let legalRevisions = {};
+	try {
+		legalRevisions = JSON.parse(row.legal_revisions);
+	} catch {}
+	return {
+		consentId: row.consent_id,
+		siteId: row.site_id,
+		recordedAt: row.recorded_at,
+		configVersion: row.config_version,
+		legalRevisions,
+		decisions: {
+			preferences: row.preferences === 1,
+			analytics: row.analytics === 1,
+			marketing: row.marketing === 1,
+			external_media: row.external_media === 1
+		},
+		action: row.action,
+		language: row.language,
+		uiVersion: row.ui_version
+	};
+}
+const json = (status, body, headers = {}) => Response.json(body, {
+	status,
+	headers: {
+		"Cache-Control": "no-store",
+		...headers
+	}
+});
+/** A UTC day (YYYY-MM-DD) as its first instant, or null. */
+function day(value) {
+	if (!value || !/^\d{4}-\d{2}-\d{2}$/.test(value)) return null;
+	const time = Date.parse(`${value}T00:00:00.000Z`);
+	return Number.isNaN(time) || new Date(time).toISOString().slice(0, 10) !== value ? null : time;
+}
+function csvField(value) {
+	return /[",\r\n]/.test(value) ? `"${value.replaceAll("\"", "\"\"")}"` : value;
+}
+/**
+* The consent endpoints. `handle` routes `/gq/consent` (record writes) and
+* `/gq/consent/records/<id>`, `/gq/consent/export`, `/gq/consent/stats`
+* (authenticated reads), and answers null for any other path. `purge` is the
+* scheduled retention job.
+*/
+function createConsentServer(config) {
+	const siteId = config.siteId.trim();
+	if (!siteId) throw new Error("A nonempty Site identity is required");
+	const retentionDays = config.retentionDays ?? 1826;
+	if (!Number.isInteger(retentionDays) || retentionDays < 1 || retentionDays > 1826) throw new Error(`retentionDays must be a whole number of days from 1 to ${MAX_RETENTION_DAYS}`);
+	const now = config.now ?? Date.now;
+	const origins = new Set((config.siteOrigins ?? []).map((origin) => new URL(origin).origin));
+	/** CN-R9: same-origin only. A browser's cross-site post carries its Origin. */
+	function sameOrigin(request) {
+		const origin = request.headers.get("Origin");
+		const site = request.headers.get("Sec-Fetch-Site");
+		if (site && site !== "same-origin") return false;
+		if (!origin) return false;
+		if (origin === new URL(request.url).origin || origins.has(origin)) return true;
+		try {
+			return new URL(origin).host === request.headers.get("Host");
+		} catch {
+			return false;
+		}
+	}
+	async function readBody(request) {
+		if (Number(request.headers.get("Content-Length") ?? "0") > 2048) return null;
+		if (!request.body) return "";
+		const reader = request.body.getReader();
+		const chunks = [];
+		let size = 0;
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			size += value.byteLength;
+			if (size > 2048) {
+				await reader.cancel();
+				return null;
+			}
+			chunks.push(value);
+		}
+		const bytes = new Uint8Array(size);
+		let offset = 0;
+		for (const chunk of chunks) {
+			bytes.set(chunk, offset);
+			offset += chunk.byteLength;
+		}
+		return new TextDecoder().decode(bytes);
+	}
+	async function insert(db, request) {
+		const recordedAt = now();
+		return (await db.prepare(`INSERT OR IGNORE INTO consent_records (consent_id, site_id, recorded_at, decided_at, expires_at,
+          config_version, legal_revisions, preferences, analytics, marketing, external_media, action,
+          language, ui_version) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(request.consentId, siteId, new Date(recordedAt).toISOString(), request.decidedAt, new Date(recordedAt + DECISION_VALIDITY_MS).toISOString(), request.configVersion, JSON.stringify(request.legalRevisions), ...OPTIONAL_CATEGORIES.map((category) => request.decisions[category] ? 1 : 0), request.action, request.language, request.uiVersion).run()).meta.changes > 0;
+	}
+	/** `POST /gq/consent`: appends one decision (CN-R7–R9). */
+	async function handleRecord(request) {
+		if (request.method !== "POST") return json(405, { error: "Record decisions with POST." }, { Allow: "POST" });
+		if (!sameOrigin(request)) return json(403, { error: "Consent records are accepted from this Site only." });
+		if (!/^application\/json\b/i.test(request.headers.get("Content-Type") ?? "")) return json(415, { error: "Send the record as application/json." });
+		const bindings = await config.bindings();
+		const limiter = bindings.CONSENT_RATE_LIMITER;
+		if (limiter) {
+			const key = request.headers.get("CF-Connecting-IP") ?? "unknown";
+			const { success } = await limiter.limit({ key });
+			if (!success) return json(429, { error: "Too many consent records; try again later." });
+		}
+		const text = await readBody(request);
+		if (text === null) return json(413, { error: "The record is too large." });
+		let value;
+		try {
+			value = JSON.parse(text);
+		} catch {
+			return json(400, { error: "The record is not JSON." });
+		}
+		const parsed = parseConsentRecordRequest(value);
+		if (!parsed.ok) return json(400, { error: `Invalid record: ${parsed.error}.` });
+		const db = bindings.CONSENT_DB;
+		if (!db) return json(503, { error: "Consent records are not configured (CONSENT_DB)." });
+		try {
+			const appended = await insert(db, parsed.request);
+			return json(appended ? 201 : 200, {
+				recorded: true,
+				duplicate: !appended
+			});
+		} catch (error) {
+			console.error(`Consent: a record couldn't be written: ${error.message}`);
+			return json(503, { error: "The consent record couldn't be stored; try again." });
+		}
+	}
+	async function authorizedDb(request) {
+		const bindings = await config.bindings();
+		const token = bindings.CONSENT_READ_TOKEN?.trim() ?? "";
+		if (token.length < 32 || !bindings.CONSENT_DB) return { response: json(503, { error: "Consent reads are not configured (CONSENT_DB, CONSENT_READ_TOKEN)." }) };
+		if (!await bearerMatches(request, token)) return { response: json(401, { error: "A valid bearer token is required." }, { "WWW-Authenticate": "Bearer" }) };
+		return { db: bindings.CONSENT_DB };
+	}
+	function range(url) {
+		const from = day(url.searchParams.get("from"));
+		const to = day(url.searchParams.get("to"));
+		if (from === null || to === null || to < from || (to - from) / DAY_MS >= MAX_RANGE_DAYS) return null;
+		return {
+			from: url.searchParams.get("from"),
+			to: url.searchParams.get("to"),
+			start: new Date(from).toISOString(),
+			end: new Date(to + DAY_MS).toISOString()
+		};
+	}
+	const columns = `consent_id, site_id, recorded_at, config_version, legal_revisions, preferences,
+    analytics, marketing, external_media, action, language, ui_version`;
+	/** Authenticated reads (CN-R11). */
+	async function handleRead(request) {
+		if (request.method !== "GET") return json(405, { error: "Read consent records with GET." }, { Allow: "GET" });
+		const authorized = await authorizedDb(request);
+		if ("response" in authorized) return authorized.response;
+		const { db } = authorized;
+		const url = new URL(request.url);
+		const path = url.pathname.replace(/\/+$/, "");
+		try {
+			if (path.startsWith(`/gq/consent/records/`)) {
+				const consentId = path.slice(`${CONSENT_PATH}/records/`.length);
+				if (!isConsentId(consentId)) return json(400, { error: "Not a consent ID." });
+				const { results } = await db.prepare(`SELECT ${columns} FROM consent_records WHERE consent_id = ? ORDER BY id`).bind(consentId).all();
+				if (!results.length) return json(404, { error: "No records for this consent ID." });
+				return json(200, {
+					consentId,
+					records: results.map(recordOf)
+				});
+			}
+			if (path === `/gq/consent/export` || path === `/gq/consent/stats`) {
+				const window = range(url);
+				if (!window) return json(400, { error: `from and to must be UTC days (YYYY-MM-DD), from ≤ to, at most ${MAX_RANGE_DAYS} days.` });
+				if (path.endsWith("/export")) {
+					const { results } = await db.prepare(`SELECT ${columns} FROM consent_records WHERE recorded_at >= ? AND recorded_at < ? ORDER BY recorded_at, id`).bind(window.start, window.end).all();
+					const lines = [CONSENT_EXPORT_COLUMNS.join(",")];
+					for (const row of results) {
+						const record = recordOf(row);
+						lines.push([
+							record.recordedAt,
+							record.consentId,
+							record.siteId,
+							record.action,
+							record.configVersion,
+							record.language,
+							record.uiVersion,
+							...OPTIONAL_CATEGORIES.map((category) => String(record.decisions[category])),
+							JSON.stringify(record.legalRevisions)
+						].map(csvField).join(","));
+					}
+					return new Response(lines.join("\r\n") + "\r\n", { headers: {
+						"Content-Type": "text/csv; charset=utf-8",
+						"Content-Disposition": `attachment; filename="consent-${window.from}-${window.to}.csv"`,
+						"Cache-Control": "no-store"
+					} });
+				}
+				const counts = await db.prepare(`SELECT action, COUNT(*) AS total, SUM(preferences) AS preferences, SUM(analytics) AS analytics,
+              SUM(marketing) AS marketing, SUM(external_media) AS external_media
+              FROM consent_records WHERE recorded_at >= ? AND recorded_at < ? GROUP BY action`).bind(window.start, window.end).all();
+				const byAction = Object.fromEntries(CONSENT_ACTIONS.map((action) => [action, 0]));
+				const byCategory = Object.fromEntries(OPTIONAL_CATEGORIES.map((category) => [category, {
+					granted: 0,
+					denied: 0
+				}]));
+				let total = 0;
+				for (const row of counts.results) {
+					const count = Number(row.total ?? 0);
+					total += count;
+					byAction[row.action] = count;
+					for (const category of OPTIONAL_CATEGORIES) {
+						const granted = Number(row[category] ?? 0);
+						byCategory[category].granted += granted;
+						byCategory[category].denied += count - granted;
+					}
+				}
+				return json(200, {
+					from: window.from,
+					to: window.to,
+					total,
+					byAction,
+					byCategory
+				});
+			}
+			return json(404, { error: "Not a consent endpoint." });
+		} catch (error) {
+			console.error(`Consent: a read failed: ${error.message}`);
+			return json(503, { error: "Consent records couldn't be read; try again." });
+		}
+	}
+	/**
+	* CN-R10: deletes records whose decision stopped being in force (superseded
+	* by a later one, or expired) more than the retention period ago.
+	*/
+	async function purge() {
+		const db = (await config.bindings()).CONSENT_DB;
+		if (!db) throw new Error("Consent records are not configured (CONSENT_DB)");
+		const cutoff = (/* @__PURE__ */ new Date(now() - retentionDays * DAY_MS)).toISOString();
+		return { deleted: (await db.prepare(`DELETE FROM consent_records WHERE id IN (
+          SELECT r.id FROM consent_records r WHERE MIN(
+            r.expires_at,
+            COALESCE((SELECT MIN(n.recorded_at) FROM consent_records n
+              WHERE n.consent_id = r.consent_id AND n.id > r.id), r.expires_at)
+          ) < ?)`).bind(cutoff).run()).meta.changes };
+	}
+	/** What is configured, for readiness: never values. */
+	async function check() {
+		const bindings = await config.bindings();
+		return {
+			records: Boolean(bindings.CONSENT_DB),
+			reads: Boolean(bindings.CONSENT_DB) && (bindings.CONSENT_READ_TOKEN?.trim().length ?? 0) >= 32,
+			rateLimit: Boolean(bindings.CONSENT_RATE_LIMITER),
+			retentionDays
+		};
+	}
+	/** Routes a consent request; null when the path isn't a consent endpoint. */
+	async function handle(request) {
+		const path = new URL(request.url).pathname.replace(/\/+$/, "");
+		if (path === "/gq/consent") return handleRecord(request);
+		if (path.startsWith(`/gq/consent/`)) return handleRead(request);
+		return null;
+	}
+	return {
+		handle,
+		handleRecord,
+		handleRead,
+		purge,
+		check
+	};
+}
+//#endregion
+export { CONSENT_EXPORT_COLUMNS, CONSENT_PATH, MAX_RETENTION_DAYS, createConsentServer };

package/dist/consent-testing.d.ts

@@ -0,0 +1,96 @@
+import { s as ConsentState } from "./state-Dzd52F3c.js";
+//#region frontend/src/consent/testing.d.ts
+export interface ScanOptions {
+  /** The Site's origin; relative URLs and this host are first party. */
+  siteOrigin: string;
+  /** Further first-party hosts (the Site's own CMS/media origin). */
+  firstPartyHosts?: readonly string[];
+}
+export interface LiveSource {
+  tag: string;
+  attribute: string;
+  url: string;
+}
+export interface HtmlScan {
+  /** Third-party URLs the HTML would load without any script running. */
+  liveThirdParty: LiveSource[];
+  /** Placeholders blocked for good (unknown hosts, inactive services, scripts): the diagnostic report. */
+  blocked: Array<{
+    host: string;
+    tag: string;
+  }>;
+  /** Consent placeholders by service. */
+  placeholders: string[];
+}
+/** Whether a request URL leaves the Site (data:, blob: and the Site's own hosts don't). */
+export declare function isThirdPartyUrl(value: string, options: ScanOptions): boolean;
+/**
+ * Raw HTML, as fetched without JavaScript (CN-R1, CN-R13): every third-party
+ * URL an element would load, the blocked-embed diagnostics, and placeholders.
+ * `<link>` counts only for stylesheets, preloads, icons and fonts.
+ */
+export declare function scanConsentHtml(html: string, options: ScanOptions): HtmlScan;
+/** The Playwright surface the suite uses. */
+export interface BrowserContextLike {
+  newPage(): Promise<PageLike>;
+  cookies(): Promise<Array<{
+    name: string;
+    value: string;
+  }>>;
+  close(): Promise<void>;
+}
+export interface BrowserLike {
+  newContext(options?: {
+    javaScriptEnabled?: boolean;
+  }): Promise<BrowserContextLike>;
+}
+export interface PageLike {
+  goto(url: string, options?: {
+    waitUntil?: "load" | "networkidle";
+  }): Promise<unknown>;
+  on(event: "request", listener: (request: {
+    url(): string;
+  }) => void): unknown;
+  evaluate<T>(script: () => T | Promise<T>): Promise<T>;
+  click(selector: string): Promise<void>;
+  waitForTimeout(ms: number): Promise<void>;
+  keyboard: {
+    press(key: string): Promise<void>;
+  };
+}
+export interface Capture {
+  route: string;
+  requests: string[];
+  thirdParty: string[];
+  cookies: string[];
+  localStorage: string[];
+  sessionStorage: string[];
+  consent: ConsentState | null;
+}
+/** Records every request and the storage a page holds after it settles. */
+export declare function capture(context: BrowserContextLike, page: PageLike, route: string, options: ScanOptions, act?: (page: PageLike) => Promise<void>): Promise<Capture>;
+export interface AcceptanceCheck {
+  criterion: string;
+  route: string;
+  passed: boolean;
+  detail: string;
+}
+export interface AcceptanceOptions extends ScanOptions {
+  routes: readonly string[];
+  /** Third-party hosts allowed without consent (necessary services on this route); none by default. */
+  necessaryHosts?: readonly string[];
+  /** Cookies allowed without consent besides gq_consent (necessary storage the Site declares). */
+  necessaryCookies?: readonly string[];
+  /** Fetches raw HTML (defaults to global fetch). */
+  fetch?: typeof globalThis.fetch;
+}
+/**
+ * The provider/adapter acceptance run (CONSENT-1 acceptance evidence 1 and 2):
+ * for each route, raw HTML without JavaScript, a visit with no interaction,
+ * and a visit after Reject all, each captured; plus first-layer presentation.
+ * Returns every check; a compliant Site has none failing.
+ */
+export declare function runConsentAcceptance(browser: BrowserLike, options: AcceptanceOptions): Promise<AcceptanceCheck[]>;
+/** The checks that failed. */
+export declare function failures(checks: readonly AcceptanceCheck[]): AcceptanceCheck[];
+//#endregion

package/dist/consent-testing.js

@@ -0,0 +1,188 @@
+import { D as hostMatches, f as readConsentCookie, n as CONSENT_COOKIE } from "./state-BYWc5TUB.js";
+//#region frontend/src/consent/testing.ts
+function firstParty(url, options) {
+	const site = new URL(options.siteOrigin);
+	return url.host === site.host || (options.firstPartyHosts ?? []).some((host) => hostMatches(url.hostname, host));
+}
+/** Whether a request URL leaves the Site (data:, blob: and the Site's own hosts don't). */
+function isThirdPartyUrl(value, options) {
+	let url;
+	try {
+		url = new URL(value, options.siteOrigin);
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+	return !firstParty(url, options);
+}
+const LOADING = [
+	["iframe", "src"],
+	["script", "src"],
+	["img", "src"],
+	["img", "srcset"],
+	["source", "src"],
+	["source", "srcset"],
+	["video", "src"],
+	["video", "poster"],
+	["audio", "src"],
+	["embed", "src"],
+	["object", "data"],
+	["link", "href"],
+	["track", "src"]
+];
+/**
+* Raw HTML, as fetched without JavaScript (CN-R1, CN-R13): every third-party
+* URL an element would load, the blocked-embed diagnostics, and placeholders.
+* `<link>` counts only for stylesheets, preloads, icons and fonts.
+*/
+function scanConsentHtml(html, options) {
+	const liveThirdParty = [];
+	for (const match of html.matchAll(/<([a-z][a-z0-9-]*)\b([^>]*)>/gi)) {
+		const tag = match[1].toLowerCase();
+		const attributes = match[2];
+		if (tag === "link" && !/\brel\s*=\s*["']?[^"'>]*(stylesheet|preload|icon|modulepreload|preconnect|dns-prefetch)/i.test(attributes)) continue;
+		for (const [element, attribute] of LOADING) {
+			if (element !== tag) continue;
+			const value = new RegExp(`(?:^|\\s)${attribute}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, "i").exec(attributes);
+			if (!value) continue;
+			const raw = (value[1] ?? value[2] ?? value[3] ?? "").replaceAll("&amp;", "&");
+			const urls = attribute === "srcset" ? raw.split(",").map((each) => each.trim().split(/\s+/)[0] ?? "") : [raw];
+			for (const url of urls) if (url && isThirdPartyUrl(url, options)) liveThirdParty.push({
+				tag,
+				attribute,
+				url
+			});
+		}
+	}
+	return {
+		liveThirdParty,
+		blocked: [...html.matchAll(/data-gq-consent-blocked="([^"]*)"[^>]*?data-gq-tag="([^"]*)"/g)].map((match) => ({
+			host: match[1],
+			tag: match[2]
+		})),
+		placeholders: [...html.matchAll(/data-gq-consent-embed="([^"]+)"/g)].map((match) => match[1])
+	};
+}
+/** Records every request and the storage a page holds after it settles. */
+async function capture(context, page, route, options, act) {
+	const requests = [];
+	page.on("request", (request) => requests.push(request.url()));
+	await page.goto(new URL(route, options.siteOrigin).href, { waitUntil: "networkidle" });
+	if (act) {
+		await act(page);
+		await page.waitForTimeout(500);
+	}
+	const storage = await page.evaluate(() => ({
+		local: Object.keys(localStorage),
+		session: Object.keys(sessionStorage)
+	}));
+	const cookies = await context.cookies();
+	const consent = cookies.find((cookie) => cookie.name === CONSENT_COOKIE);
+	return {
+		route,
+		requests,
+		thirdParty: requests.filter((url) => isThirdPartyUrl(url, options)),
+		cookies: cookies.map((cookie) => cookie.name),
+		localStorage: storage.local,
+		sessionStorage: storage.session,
+		consent: consent ? readConsentCookie(`${CONSENT_COOKIE}=${consent.value}`) : null
+	};
+}
+function allowed(url, hosts) {
+	try {
+		const host = new URL(url).hostname;
+		return hosts.some((each) => hostMatches(host, each));
+	} catch {
+		return false;
+	}
+}
+/**
+* The provider/adapter acceptance run (CONSENT-1 acceptance evidence 1 and 2):
+* for each route, raw HTML without JavaScript, a visit with no interaction,
+* and a visit after Reject all, each captured; plus first-layer presentation.
+* Returns every check; a compliant Site has none failing.
+*/
+async function runConsentAcceptance(browser, options) {
+	const checks = [];
+	const record = (criterion, route, passed, detail) => checks.push({
+		criterion,
+		route,
+		passed,
+		detail
+	});
+	const necessaryHosts = options.necessaryHosts ?? [];
+	const necessaryCookies = [CONSENT_COOKIE, ...options.necessaryCookies ?? []];
+	const violations = (result) => [
+		...result.thirdParty.filter((url) => !allowed(url, necessaryHosts)).map((url) => `request ${url}`),
+		...result.cookies.filter((name) => !necessaryCookies.includes(name)).map((name) => `cookie ${name}`),
+		...result.localStorage.map((key) => `localStorage ${key}`),
+		...result.sessionStorage.map((key) => `sessionStorage ${key}`)
+	];
+	for (const route of options.routes) {
+		const scan = scanConsentHtml(await (await (options.fetch ?? fetch)(new URL(route, options.siteOrigin))).text(), options);
+		const live = scan.liveThirdParty.filter((source) => !allowed(source.url, necessaryHosts));
+		record("CN-R13", route, live.length === 0, live.length ? `live third-party sources: ${live.map((each) => each.url).join(", ")}` : `no live third-party src; ${scan.placeholders.length} placeholder(s), ${scan.blocked.length} blocked`);
+		const fresh = await browser.newContext();
+		try {
+			const page = await fresh.newPage();
+			const result = await capture(fresh, page, route, options);
+			const found = violations(result);
+			if (result.cookies.includes("gq_consent")) found.push("consent cookie written without a decision");
+			record("CN-R1", route, found.length === 0, found.join("; ") || "no third-party request or optional storage without interaction");
+			const presentation = await page.evaluate(() => {
+				const banner = document.getElementById("gq-consent-banner");
+				if (!banner || banner.hidden) return { banner: false };
+				const accept = banner.querySelector("[data-gq-consent-accept-all]");
+				const reject = banner.querySelector("[data-gq-consent-reject-all]");
+				const style = (element) => {
+					if (!element) return null;
+					const computed = getComputedStyle(element);
+					const box = element.getBoundingClientRect();
+					return {
+						name: (element.getAttribute("aria-label") ?? element.textContent ?? "").trim(),
+						font: `${computed.fontSize} ${computed.fontWeight}`,
+						colors: `${computed.color} ${computed.backgroundColor} ${computed.borderColor}`,
+						height: Math.round(box.height),
+						visible: box.width > 0 && box.height > 0
+					};
+				};
+				return {
+					banner: true,
+					accept: style(accept),
+					reject: style(reject),
+					customise: Boolean(banner.querySelector("[data-gq-consent-customise]")),
+					policy: Boolean(banner.querySelector("a[href]")),
+					checked: [...document.querySelectorAll("input[data-gq-consent-category]")].filter((input) => input.checked).length,
+					settings: Boolean(document.querySelector("[data-gq-consent-open]")),
+					label: banner.getAttribute("aria-labelledby") ? document.getElementById(banner.getAttribute("aria-labelledby"))?.textContent ?? "" : ""
+				};
+			});
+			if (presentation.banner) {
+				const { accept, reject } = presentation;
+				const equal = Boolean(accept && reject && accept.visible && reject.visible) && accept.font === reject.font && accept.colors === reject.colors && Math.abs(accept.height - reject.height) <= 1;
+				record("CN-R4", route, equal && Boolean(accept.name) && Boolean(reject.name), `Accept all and Reject all ${equal ? "have" : "lack"} equal prominence`);
+				record("CN-R4", route, presentation.customise && presentation.policy, "a route to per-category choices and the cookie policy link are on the first layer");
+				record("CN-R4", route, presentation.checked === 0, `${presentation.checked} pre-ticked category control(s)`);
+				record("CN-R4", route, Boolean(presentation.label.trim()), "the banner has an accessible name");
+			}
+			record("CN-R6", route, presentation.banner ? presentation.settings : await page.evaluate(() => Boolean(document.querySelector("[data-gq-consent-open]"))), "a persistent Cookie settings control is on the page");
+			if (presentation.banner) {
+				await page.click("#gq-consent-banner [data-gq-consent-reject-all]");
+				await page.waitForTimeout(300);
+				const rejected = await capture(fresh, await fresh.newPage(), route, options);
+				const after = violations(rejected);
+				const denied = rejected.consent !== null && Object.values(rejected.consent.decisions).every((value) => !value);
+				record("CN-R1", route, after.length === 0 && denied, after.join("; ") || (denied ? "after Reject all: nothing loads, the consent cookie records the rejection" : "the consent cookie doesn't record the rejection"));
+			}
+		} finally {
+			await fresh.close();
+		}
+	}
+	return checks;
+}
+/** The checks that failed. */
+function failures(checks) {
+	return checks.filter((check) => !check.passed);
+}
+//#endregion
+export { capture, failures, isThirdPartyUrl, runConsentAcceptance, scanConsentHtml };