@etalon/cli 1.0.0

package/dist/policy-checker-J2WPHGU3.js

@@ -0,0 +1,294 @@
+#!/usr/bin/env node
+import {
+  scanSite
+} from "./chunk-Z6ZQZ5HI.js";
+
+// src/policy-checker.ts
+import { chromium } from "playwright";
+import {
+  VendorRegistry,
+  extractDomain
+} from "@etalon/core";
+var POLICY_PATH_PATTERNS = [
+  /^\/privacy[-_]?policy/i,
+  /^\/privacy/i,
+  /^\/datenschutz/i,
+  /^\/politique[-_]de[-_]confidentialite/i,
+  /^\/informativa[-_]privacy/i,
+  /^\/politica[-_]de[-_]privacidad/i,
+  /^\/legal\/privacy/i,
+  /^\/about\/privacy/i,
+  /^\/cookie[-_]?policy/i
+];
+var POLICY_LINK_TEXT_PATTERNS = [
+  /privacy\s*policy/i,
+  /privacy\s*notice/i,
+  /privacy/i,
+  /datenschutz/i,
+  /cookie\s*policy/i,
+  /data\s*protection/i,
+  /politique\s*de\s*confidentialit[eé]/i
+];
+async function findPolicyPage(page, siteUrl) {
+  const siteDomain = extractDomain(siteUrl);
+  if (!siteDomain) return null;
+  const baseUrl = new URL(siteUrl);
+  const commonPaths = [
+    "/privacy-policy",
+    "/privacy",
+    "/legal/privacy",
+    "/datenschutz",
+    "/cookie-policy",
+    "/about/privacy"
+  ];
+  for (const path of commonPaths) {
+    try {
+      const testUrl = `${baseUrl.origin}${path}`;
+      const response = await page.goto(testUrl, { waitUntil: "domcontentloaded", timeout: 1e4 });
+      if (response && response.status() >= 200 && response.status() < 400) {
+        const bodyText = await page.evaluate(() => globalThis.document.body?.innerText?.trim() ?? "");
+        if (bodyText.length > 200) {
+          return testUrl;
+        }
+      }
+    } catch {
+    }
+  }
+  try {
+    await page.goto(siteUrl, { waitUntil: "domcontentloaded", timeout: 15e3 });
+    await page.waitForTimeout(1e3);
+    const links = await page.$$eval(
+      "a[href]",
+      (anchors) => anchors.map((a) => ({
+        href: a.getAttribute("href") ?? "",
+        text: a.textContent?.trim() ?? ""
+      }))
+    );
+    for (const link of links) {
+      try {
+        const fullUrl = new URL(link.href, siteUrl);
+        const matchesPath = POLICY_PATH_PATTERNS.some((p) => p.test(fullUrl.pathname));
+        const matchesText = POLICY_LINK_TEXT_PATTERNS.some((p) => p.test(link.text));
+        if (matchesPath || matchesText) {
+          if (fullUrl.hostname === baseUrl.hostname || fullUrl.hostname.includes("iubenda")) {
+            return fullUrl.href;
+          }
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+async function extractPolicyText(page, policyUrl) {
+  await page.goto(policyUrl, { waitUntil: "networkidle", timeout: 2e4 });
+  await page.waitForTimeout(1e3);
+  const text = await page.evaluate(() => {
+    const doc = globalThis.document;
+    const elementsToRemove = doc.querySelectorAll("script, style, nav, header, footer, iframe");
+    elementsToRemove.forEach((el) => el.remove());
+    return doc.body?.innerText ?? "";
+  });
+  return text.replace(/\s+/g, " ").trim();
+}
+function matchVendorsInPolicy(policyText, registry) {
+  const mentionedIds = /* @__PURE__ */ new Set();
+  const normalizedText = policyText.toLowerCase();
+  for (const vendor of registry.getAllVendors()) {
+    if (normalizedText.includes(vendor.name.toLowerCase())) {
+      mentionedIds.add(vendor.id);
+      continue;
+    }
+    if (normalizedText.includes(vendor.company.toLowerCase())) {
+      mentionedIds.add(vendor.id);
+      continue;
+    }
+    for (const domain of vendor.domains) {
+      if (normalizedText.includes(domain.toLowerCase())) {
+        mentionedIds.add(vendor.id);
+        break;
+      }
+    }
+  }
+  return mentionedIds;
+}
+function severityForUndisclosed(category, gdprCompliant) {
+  if (!gdprCompliant) return "critical";
+  if (category === "advertising" || category === "social") return "critical";
+  if (category === "analytics" || category === "heatmaps" || category === "ab_testing") return "high";
+  if (category === "tag_manager" || category === "chat") return "medium";
+  return "low";
+}
+function crossReference(mentionedVendorIds, detectedVendors, registry) {
+  const undisclosed = [];
+  const overclaimed = [];
+  const disclosed = [];
+  const detectedIds = new Set(detectedVendors.map((v) => v.vendor.id));
+  for (const dv of detectedVendors) {
+    const v = dv.vendor;
+    if (mentionedVendorIds.has(v.id)) {
+      disclosed.push({
+        vendorId: v.id,
+        vendorName: v.name,
+        category: v.category,
+        gdprCompliant: v.gdpr_compliant,
+        severity: "info",
+        message: `${v.name} is both detected on site and disclosed in privacy policy`
+      });
+    } else {
+      const skipCategories = ["cdn", "consent", "security", "payments", "fonts"];
+      if (skipCategories.includes(v.category)) continue;
+      const severity = severityForUndisclosed(v.category, v.gdpr_compliant);
+      undisclosed.push({
+        vendorId: v.id,
+        vendorName: v.name,
+        category: v.category,
+        gdprCompliant: v.gdpr_compliant,
+        severity,
+        message: `${v.name} (${v.category}) detected on site but NOT disclosed in privacy policy`
+      });
+    }
+  }
+  for (const vendorId of mentionedVendorIds) {
+    if (!detectedIds.has(vendorId)) {
+      const v = registry.getById(vendorId);
+      if (v) {
+        overclaimed.push({
+          vendorId: v.id,
+          vendorName: v.name,
+          category: v.category,
+          gdprCompliant: v.gdpr_compliant,
+          severity: "info",
+          message: `${v.name} is mentioned in privacy policy but was not detected during scan`
+        });
+      }
+    }
+  }
+  const severityOrder = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+  undisclosed.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
+  return { undisclosed, overclaimed, disclosed };
+}
+var CATEGORY_LABELS = {
+  analytics: "website analytics",
+  advertising: "advertising and conversion tracking",
+  social: "social media integration",
+  tag_manager: "tag management",
+  heatmaps: "heatmap and session recording",
+  ab_testing: "A/B testing",
+  error_tracking: "error monitoring",
+  chat: "live chat and customer support",
+  video: "video embedding",
+  cdn: "content delivery",
+  payments: "payment processing",
+  consent: "cookie consent management",
+  security: "security",
+  fonts: "web fonts",
+  other: "third-party services"
+};
+function generateDisclosures(undisclosed, registry) {
+  const disclosures = [];
+  for (const mismatch of undisclosed) {
+    const vendor = registry.getById(mismatch.vendorId);
+    if (!vendor) continue;
+    const categoryLabel = CATEGORY_LABELS[vendor.category] ?? vendor.category;
+    const dataList = vendor.data_collected.length > 0 ? vendor.data_collected.join(", ") : "usage data";
+    let snippet = `We use ${vendor.name}`;
+    if (vendor.company && vendor.company !== vendor.name) {
+      snippet += ` (provided by ${vendor.company})`;
+    }
+    snippet += ` for ${categoryLabel}.`;
+    snippet += ` This service may collect ${dataList}.`;
+    if (vendor.retention_period) {
+      snippet += ` Data is retained for ${vendor.retention_period}.`;
+    }
+    if (!vendor.gdpr_compliant) {
+      snippet += ` Please note that this service may transfer data outside the EU/EEA.`;
+    }
+    if (vendor.privacy_policy) {
+      snippet += ` For more information, see ${vendor.company || vendor.name}'s privacy policy at ${vendor.privacy_policy}.`;
+    }
+    disclosures.push({
+      vendorId: vendor.id,
+      vendorName: vendor.name,
+      company: vendor.company,
+      category: vendor.category,
+      snippet,
+      dataCollected: vendor.data_collected,
+      privacyPolicyUrl: vendor.privacy_policy,
+      dpaUrl: vendor.dpa_url
+    });
+  }
+  return disclosures;
+}
+async function checkPolicy(url, options = {}) {
+  const timeout = options.timeout ?? 3e4;
+  const registry = VendorRegistry.load();
+  const scanReport = await scanSite(url, { timeout, deep: false });
+  const detectedVendors = scanReport.vendors;
+  let browser = null;
+  try {
+    browser = await chromium.launch({ headless: true });
+    const context = await browser.newContext({
+      userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36",
+      viewport: { width: 1920, height: 1080 }
+    });
+    const page = await context.newPage();
+    let policyUrl = options.policyUrl ?? null;
+    if (!policyUrl) {
+      policyUrl = await findPolicyPage(page, url);
+    }
+    if (!policyUrl) {
+      const result2 = crossReference(/* @__PURE__ */ new Set(), detectedVendors, registry);
+      const disclosures2 = generateDisclosures(result2.undisclosed, registry);
+      return {
+        url,
+        policyUrl: null,
+        policyFound: false,
+        mentionedVendors: [],
+        detectedVendors: detectedVendors.map((dv) => ({
+          vendorId: dv.vendor.id,
+          vendorName: dv.vendor.name,
+          category: dv.vendor.category
+        })),
+        ...result2,
+        disclosures: disclosures2,
+        pass: false
+      };
+    }
+    const policyText = await extractPolicyText(page, policyUrl);
+    const mentionedVendorIds = matchVendorsInPolicy(policyText, registry);
+    const result = crossReference(mentionedVendorIds, detectedVendors, registry);
+    const disclosures = generateDisclosures(result.undisclosed, registry);
+    const mentionedVendors = [];
+    for (const id of mentionedVendorIds) {
+      const v = registry.getById(id);
+      if (v) {
+        mentionedVendors.push({
+          vendorId: v.id,
+          vendorName: v.name,
+          category: v.category
+        });
+      }
+    }
+    return {
+      url,
+      policyUrl,
+      policyFound: true,
+      mentionedVendors,
+      detectedVendors: detectedVendors.map((dv) => ({
+        vendorId: dv.vendor.id,
+        vendorName: dv.vendor.name,
+        category: dv.vendor.category
+      })),
+      ...result,
+      disclosures,
+      pass: result.undisclosed.length === 0
+    };
+  } finally {
+    await browser?.close();
+  }
+}
+export {
+  checkPolicy
+};

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@etalon/cli",
+  "version": "1.0.0",
+  "description": "ETALON \u2014 Privacy audit tool for websites. Scan any site for trackers and GDPR compliance.",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "type": "module",
+  "bin": {
+    "etalon": "./dist/index.js"
+  },
+  "scripts": {
+    "build": "tsup",
+    "clean": "rm -rf dist",
+    "postinstall": "npx playwright install chromium || true"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "dependencies": {
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "ora": "^8.0.0",
+    "playwright": "^1.42.0",
+    "yaml": "^2.3.0",
+    "@etalon/core": "*"
+  },
+  "keywords": [
+    "privacy",
+    "gdpr",
+    "tracker",
+    "audit",
+    "scanner",
+    "compliance",
+    "cookies",
+    "mcp"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/NMA-vc/etalon"
+  }
+}