@slashgear/gdpr-cookie-scanner 3.6.0 → 3.8.0

package/tests/analyzers/tcf-decoder.test.ts

@@ -0,0 +1,292 @@
+import { describe, it, expect } from "vitest";
+import {
+  decodeTcfConsentString,
+  IAB_PURPOSES,
+  IAB_SPECIAL_FEATURES,
+} from "../../src/analyzers/tcf-decoder.js";
+
+// ── Fixture builder ───────────────────────────────────────────────────────────
+//
+// Encodes an array of [bitCount, value] pairs into a base64url string
+// suitable for passing to decodeTcfConsentString().
+// Uses modulo + Math.floor to avoid 32-bit overflow on large timestamps.
+
+function makeTcfString(fields: Array<[bits: number, value: number]>): string {
+  const totalBits = fields.reduce((s, [b]) => s + b, 0);
+  const buf = Buffer.alloc(Math.ceil(totalBits / 8), 0);
+  let pos = 0;
+  for (const [bits, value] of fields) {
+    const arr: number[] = [];
+    let v = value;
+    for (let i = 0; i < bits; i++) {
+      arr.unshift(v % 2);
+      v = Math.floor(v / 2);
+    }
+    for (const bit of arr) {
+      if (bit) buf[Math.floor(pos / 8)] |= 1 << (7 - (pos % 8));
+      pos++;
+    }
+  }
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+
+/** Encode a 2-char ISO language/country code into 12 bits (A=0). */
+function langBits(code: string): number {
+  return ((code.charCodeAt(0) - 65) << 6) | (code.charCodeAt(1) - 65);
+}
+
+/** Encode a list of purpose IDs (1-based) into a 24-bit bitfield. */
+function purposeBits(ids: number[]): number {
+  return ids.reduce((acc, id) => acc | (1 << (24 - id)), 0);
+}
+
+/** Encode a list of special feature IDs (1-based) into a 12-bit bitfield. */
+function specialFeatureBits(ids: number[]): number {
+  return ids.reduce((acc, id) => acc | (1 << (12 - id)), 0);
+}
+
+// 2020-01-01T00:00:00.000Z in deciseconds
+const EPOCH_2020_DS = 15778368000;
+
+function makeTcfV2(
+  opts: {
+    cmpId?: number;
+    cmpVersion?: number;
+    consentLanguage?: string;
+    vendorListVersion?: number;
+    tcfPolicyVersion?: number;
+    isServiceSpecific?: boolean;
+    specialFeatures?: number[];
+    purposesConsent?: number[];
+    purposesLI?: number[];
+    publisherCC?: string;
+  } = {},
+): string {
+  const {
+    cmpId = 28,
+    cmpVersion = 1,
+    consentLanguage = "EN",
+    vendorListVersion = 65,
+    tcfPolicyVersion = 2,
+    isServiceSpecific = false,
+    specialFeatures = [],
+    purposesConsent = [],
+    purposesLI = [],
+    publisherCC = "DE",
+  } = opts;
+
+  return makeTcfString([
+    [6, 2], // version = 2
+    [36, EPOCH_2020_DS], // created
+    [36, EPOCH_2020_DS], // lastUpdated
+    [12, cmpId],
+    [12, cmpVersion],
+    [6, 0], // consentScreen
+    [12, langBits(consentLanguage)],
+    [12, vendorListVersion],
+    [6, tcfPolicyVersion],
+    [1, isServiceSpecific ? 1 : 0],
+    [1, 0], // useNonStandardStacks
+    [12, specialFeatureBits(specialFeatures)],
+    [24, purposeBits(purposesConsent)],
+    [24, purposeBits(purposesLI)],
+    [1, 0], // purposeOneTreatment
+    [12, langBits(publisherCC)],
+  ]);
+}
+
+function makeTcfV1(
+  opts: {
+    cmpId?: number;
+    cmpVersion?: number;
+    consentLanguage?: string;
+    vendorListVersion?: number;
+    purposesAllowed?: number[];
+  } = {},
+): string {
+  const {
+    cmpId = 10,
+    cmpVersion = 1,
+    consentLanguage = "FR",
+    vendorListVersion = 12,
+    purposesAllowed = [],
+  } = opts;
+
+  return makeTcfString([
+    [6, 1], // version = 1
+    [36, EPOCH_2020_DS], // created
+    [36, EPOCH_2020_DS], // lastUpdated
+    [12, cmpId],
+    [12, cmpVersion],
+    [6, 0], // consentScreen
+    [12, langBits(consentLanguage)],
+    [12, vendorListVersion],
+    [24, purposeBits(purposesAllowed)],
+  ]);
+}
+
+// ── TCF v2 ────────────────────────────────────────────────────────────────────
+
+describe("decodeTcfConsentString — TCF v2", () => {
+  it("decodes version 2", () => {
+    expect(decodeTcfConsentString(makeTcfV2())?.version).toBe(2);
+  });
+
+  it("decodes CMP ID and version", () => {
+    const result = decodeTcfConsentString(makeTcfV2({ cmpId: 28, cmpVersion: 3 }));
+    expect(result?.cmpId).toBe(28);
+    expect(result?.cmpVersion).toBe(3);
+  });
+
+  it("decodes consent language", () => {
+    expect(decodeTcfConsentString(makeTcfV2({ consentLanguage: "FR" }))?.consentLanguage).toBe(
+      "FR",
+    );
+  });
+
+  it("decodes timestamps as Date objects", () => {
+    const result = decodeTcfConsentString(makeTcfV2());
+    expect(result?.created).toEqual(new Date(EPOCH_2020_DS * 100));
+    expect(result?.lastUpdated).toEqual(new Date(EPOCH_2020_DS * 100));
+  });
+
+  it("decodes purposesConsent", () => {
+    const result = decodeTcfConsentString(makeTcfV2({ purposesConsent: [1, 2, 7] }));
+    expect(result?.purposesConsent).toEqual([1, 2, 7]);
+  });
+
+  it("decodes purposesLegitimateInterest", () => {
+    const result = decodeTcfConsentString(makeTcfV2({ purposesLI: [2, 4, 9] }));
+    expect(result?.purposesLegitimateInterest).toEqual([2, 4, 9]);
+  });
+
+  it("decodes specialFeatureOptins", () => {
+    const result = decodeTcfConsentString(makeTcfV2({ specialFeatures: [1, 2] }));
+    expect(result?.specialFeatureOptins).toEqual([1, 2]);
+  });
+
+  it("returns empty arrays when nothing is set", () => {
+    const result = decodeTcfConsentString(
+      makeTcfV2({ purposesConsent: [], purposesLI: [], specialFeatures: [] }),
+    );
+    expect(result?.purposesConsent).toEqual([]);
+    expect(result?.purposesLegitimateInterest).toEqual([]);
+    expect(result?.specialFeatureOptins).toEqual([]);
+  });
+
+  it("decodes publisherCC", () => {
+    expect(decodeTcfConsentString(makeTcfV2({ publisherCC: "FR" }))?.publisherCC).toBe("FR");
+  });
+
+  it("decodes isServiceSpecific", () => {
+    expect(decodeTcfConsentString(makeTcfV2({ isServiceSpecific: true }))?.isServiceSpecific).toBe(
+      true,
+    );
+  });
+
+  it("decodes tcfPolicyVersion", () => {
+    expect(decodeTcfConsentString(makeTcfV2({ tcfPolicyVersion: 4 }))?.tcfPolicyVersion).toBe(4);
+  });
+
+  it("decodes vendorListVersion", () => {
+    expect(decodeTcfConsentString(makeTcfV2({ vendorListVersion: 130 }))?.vendorListVersion).toBe(
+      130,
+    );
+  });
+
+  it("preserves the raw string", () => {
+    const str = makeTcfV2();
+    expect(decodeTcfConsentString(str)?.raw).toBe(str);
+  });
+
+  it("ignores vendor segments after '~'", () => {
+    const str = makeTcfV2({ cmpId: 5 });
+    const result = decodeTcfConsentString(`${str}~someVendorSegment~anotherSegment`);
+    expect(result?.version).toBe(2);
+    expect(result?.cmpId).toBe(5);
+  });
+});
+
+// ── TCF v1 ────────────────────────────────────────────────────────────────────
+
+describe("decodeTcfConsentString — TCF v1", () => {
+  it("decodes version 1", () => {
+    expect(decodeTcfConsentString(makeTcfV1())?.version).toBe(1);
+  });
+
+  it("decodes purposesAllowed as purposesConsent", () => {
+    const result = decodeTcfConsentString(makeTcfV1({ purposesAllowed: [1, 3, 5] }));
+    expect(result?.purposesConsent).toEqual([1, 3, 5]);
+  });
+
+  it("returns empty legitimateInterest and specialFeatures for v1", () => {
+    const result = decodeTcfConsentString(makeTcfV1());
+    expect(result?.purposesLegitimateInterest).toEqual([]);
+    expect(result?.specialFeatureOptins).toEqual([]);
+  });
+
+  it("decodes CMP ID", () => {
+    expect(decodeTcfConsentString(makeTcfV1({ cmpId: 42 }))?.cmpId).toBe(42);
+  });
+
+  it("decodes consent language", () => {
+    expect(decodeTcfConsentString(makeTcfV1({ consentLanguage: "DE" }))?.consentLanguage).toBe(
+      "DE",
+    );
+  });
+
+  it("decodes timestamps as Date objects", () => {
+    const result = decodeTcfConsentString(makeTcfV1());
+    expect(result?.created).toEqual(new Date(EPOCH_2020_DS * 100));
+  });
+});
+
+// ── Edge cases ────────────────────────────────────────────────────────────────
+
+describe("decodeTcfConsentString — edge cases", () => {
+  it("returns null for an empty string", () => {
+    expect(decodeTcfConsentString("")).toBeNull();
+  });
+
+  it("returns null for a garbage base64 string", () => {
+    expect(decodeTcfConsentString("aaaa")).toBeNull();
+  });
+
+  it("returns null for an unsupported version (v3)", () => {
+    const str = makeTcfString([
+      [6, 3], // version = 3, unsupported
+      [36, 0],
+      [36, 0],
+      [12, 1],
+      [12, 1],
+      [6, 0],
+      [12, langBits("EN")],
+      [12, 1],
+    ]);
+    expect(decodeTcfConsentString(str)).toBeNull();
+  });
+});
+
+// ── IAB constants ─────────────────────────────────────────────────────────────
+
+describe("IAB_PURPOSES", () => {
+  it("contains all 11 standard purposes", () => {
+    for (let i = 1; i <= 11; i++) {
+      expect(IAB_PURPOSES[i], `purpose ${i}`).toBeDefined();
+    }
+  });
+
+  it("purpose 1 is about device storage", () => {
+    expect(IAB_PURPOSES[1]).toMatch(/store/i);
+  });
+});
+
+describe("IAB_SPECIAL_FEATURES", () => {
+  it("contains exactly 2 special features", () => {
+    expect(Object.keys(IAB_SPECIAL_FEATURES)).toHaveLength(2);
+  });
+
+  it("feature 1 is about geolocation", () => {
+    expect(IAB_SPECIAL_FEATURES[1]).toMatch(/geolocation/i);
+  });
+});

package/tests/analyzers/wording.test.ts

@@ -84,6 +84,44 @@ describe("analyzeButtonWording", () => {
     });
   });
 
+  describe("indirect reject — refusal implied, not stated", () => {
+    it.each([
+      "Continuer sans accepter",
+      "Continue without accepting",
+      "Continue without consent",
+      "Proceed without accepting",
+      "Continuar sin aceptar",
+      "Continua senza accettare",
+      "Weiter ohne akzeptieren",
+    ])('flags "%s" as indirect reject (warning)', (text) => {
+      const buttons = [makeButton("accept", "Accept all"), makeButton("reject", text)];
+      const result = analyzeButtonWording(buttons);
+      expect(result.hasIndirectRejectLabel).toBe(true);
+      const issue = result.issues.find(
+        (i) => i.type === "misleading-wording" && i.severity === "warning",
+      );
+      expect(issue).toBeDefined();
+    });
+
+    it("does NOT flag an explicit Reject button as indirect", () => {
+      const buttons = [makeButton("accept", "Accept all"), makeButton("reject", "Reject all")];
+      const result = analyzeButtonWording(buttons);
+      expect(result.hasIndirectRejectLabel).toBe(false);
+    });
+
+    it("does NOT flag 'Tout refuser' as indirect", () => {
+      const buttons = [makeButton("accept", "Tout accepter"), makeButton("reject", "Tout refuser")];
+      const result = analyzeButtonWording(buttons);
+      expect(result.hasIndirectRejectLabel).toBe(false);
+    });
+
+    it("returns hasIndirectRejectLabel: false when there is no reject button", () => {
+      const buttons = [makeButton("accept", "Accept all")];
+      const result = analyzeButtonWording(buttons);
+      expect(result.hasIndirectRejectLabel).toBe(false);
+    });
+  });
+
   describe("fake reject — close/dismiss button disguised as reject", () => {
     it.each(["×", "✕", "close", "Fermer", "dismiss", "skip"])(
       'flags "%s" reject button as misleading (fake reject)',

package/tests/scanner/button-classification.test.ts

@@ -191,6 +191,38 @@ describe("classifyButtonText — null (unknown language)", () => {
   });
 });
 
+// ── "Continue without accepting" dark pattern ─────────────────────────────────
+//
+// Some sites hide their reject action behind a phrase that contains the word
+// "accept" or an equivalent, making automated classifiers misread it as an
+// accept button. These must be classified as "reject".
+
+describe('classifyButtonText — "continue without accepting" dark pattern', () => {
+  it('FR: "Continuer sans accepter" → reject', () => {
+    expect(classifyButtonText("Continuer sans accepter", "fr")).toBe("reject");
+  });
+
+  it('EN: "Continue without accepting" → reject', () => {
+    expect(classifyButtonText("Continue without accepting", "en")).toBe("reject");
+  });
+
+  it('EN: "Continue without consent" → reject', () => {
+    expect(classifyButtonText("Continue without consent", "en")).toBe("reject");
+  });
+
+  it('ES: "Continuar sin aceptar" → reject', () => {
+    expect(classifyButtonText("Continuar sin aceptar", "es")).toBe("reject");
+  });
+
+  it('FR: "Accepter" alone → still accept (no regression)', () => {
+    expect(classifyButtonText("Accepter", "fr")).toBe("accept");
+  });
+
+  it('FR: "Tout accepter" → still accept (no regression)', () => {
+    expect(classifyButtonText("Tout accepter", "fr")).toBe("accept");
+  });
+});
+
 // ── BCP 47 subtag normalisation (sanity) ─────────────────────────────────────
 
 describe("classifyButtonText — full BCP 47 tags should be pre-normalised", () => {

package/website/Dockerfile

@@ -0,0 +1,55 @@
+# Build context: repo root (docker build -f website/Dockerfile .)
+
+# ── Stage 1: build ────────────────────────────────────────────────────────────
+FROM node:24-slim AS builder
+WORKDIR /app
+
+# Install compression tools (brotli, zstd, zopfli)
+RUN apt-get update && apt-get install -y --no-install-recommends brotli zstd zopfli \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN npm install -g pnpm@latest
+
+# Copy workspace manifests for layer caching
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY website/package.json ./website/
+
+# Install website deps only (no playwright, no CLI deps)
+RUN pnpm install --frozen-lockfile --filter @slashgear/gdpr-website
+
+# Copy source and compile
+COPY website/tsconfig.json ./website/
+COPY website/src ./website/src
+RUN pnpm --filter @slashgear/gdpr-website build
+
+# Copy static assets and precompress them
+COPY website/public ./website/public
+RUN find /app/website/public -type f \( -name "*.html" -o -name "*.css" -o -name "*.js" -o -name "*.json" -o -name "*.svg" \) | \
+    while read f; do \
+      brotli --best -k "$f"; \
+      zstd --ultra -22 -k "$f"; \
+      zopfli --gzip "$f"; \
+    done
+
+# ── Stage 2: runtime ──────────────────────────────────────────────────────────
+FROM node:24-slim
+WORKDIR /app
+ENV NODE_ENV=production
+
+RUN npm install -g pnpm@latest
+
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY website/package.json ./website/
+RUN pnpm install --prod --frozen-lockfile --filter @slashgear/gdpr-website
+
+# Static assets with precompressed variants (.br, .zst, .gz)
+COPY --from=builder /app/website/public ./website/public
+
+# Compiled server
+COPY --from=builder /app/website/dist ./website/dist
+
+WORKDIR /app/website
+ENV PORT=8080
+EXPOSE 8080
+
+CMD ["node", "dist/index.js"]

package/website/node_modules/.bin/oxfmt

@@ -0,0 +1,21 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*|*MINGW*|*MSYS*)
+        if command -v cygpath > /dev/null 2>&1; then
+            basedir=`cygpath -w "$basedir"`
+        fi
+    ;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/oxfmt@0.34.0/node_modules/oxfmt/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/oxfmt@0.34.0/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/oxfmt@0.34.0/node_modules/oxfmt/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/oxfmt@0.34.0/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../oxfmt/bin/oxfmt" "$@"
+else
+  exec node  "$basedir/../oxfmt/bin/oxfmt" "$@"
+fi

package/website/node_modules/.bin/oxlint

@@ -0,0 +1,21 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*|*MINGW*|*MSYS*)
+        if command -v cygpath > /dev/null 2>&1; then
+            basedir=`cygpath -w "$basedir"`
+        fi
+    ;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/oxlint@1.49.0/node_modules/oxlint/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/oxlint@1.49.0/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/oxlint@1.49.0/node_modules/oxlint/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/oxlint@1.49.0/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../oxlint/bin/oxlint" "$@"
+else
+  exec node  "$basedir/../oxlint/bin/oxlint" "$@"
+fi

package/website/node_modules/.bin/tsc

@@ -0,0 +1,21 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*|*MINGW*|*MSYS*)
+        if command -v cygpath > /dev/null 2>&1; then
+            basedir=`cygpath -w "$basedir"`
+        fi
+    ;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/typescript@5.9.3/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/typescript@5.9.3/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../typescript/bin/tsc" "$@"
+else
+  exec node  "$basedir/../typescript/bin/tsc" "$@"
+fi

package/website/node_modules/.bin/tsserver

@@ -0,0 +1,21 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*|*MINGW*|*MSYS*)
+        if command -v cygpath > /dev/null 2>&1; then
+            basedir=`cygpath -w "$basedir"`
+        fi
+    ;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/typescript@5.9.3/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/typescript@5.9.3/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../typescript/bin/tsserver" "$@"
+else
+  exec node  "$basedir/../typescript/bin/tsserver" "$@"
+fi

package/website/node_modules/.bin/tsx

@@ -0,0 +1,21 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*|*MINGW*|*MSYS*)
+        if command -v cygpath > /dev/null 2>&1; then
+            basedir=`cygpath -w "$basedir"`
+        fi
+    ;;
+esac
+
+if [ -z "$NODE_PATH" ]; then
+  export NODE_PATH="/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/tsx@4.21.0/node_modules/tsx/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/tsx@4.21.0/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/node_modules"
+else
+  export NODE_PATH="/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/tsx@4.21.0/node_modules/tsx/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/tsx@4.21.0/node_modules:/home/runner/work/gdpr-cookie-scanner/gdpr-cookie-scanner/node_modules/.pnpm/node_modules:$NODE_PATH"
+fi
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../tsx/dist/cli.mjs" "$@"
+else
+  exec node  "$basedir/../tsx/dist/cli.mjs" "$@"
+fi

package/website/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@slashgear/gdpr-website",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Web interface for gdpr-cookie-scanner",
+  "type": "module",
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/index.ts",
+    "start": "node dist/index.js",
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint .",
+    "format": "oxfmt ."
+  },
+  "dependencies": {
+    "@hono/node-server": "^1.14.0",
+    "hono": "^4.7.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "oxfmt": "^0.34.0",
+    "oxlint": "^1.48.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.5.0"
+  },
+  "engines": {
+    "node": ">=24.0.0"
+  }
+}