@solvenza/cookies-compliance 1.2.0 → 1.5.1

package/dist/audit.cjs

@@ -0,0 +1,811 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/audit/index.ts
+var audit_exports = {};
+__export(audit_exports, {
+  LssiAuditor: () => LssiAuditor
+});
+module.exports = __toCommonJS(audit_exports);
+
+// src/audit/auditor.ts
+var fs = __toESM(require("fs"), 1);
+var path = __toESM(require("path"), 1);
+
+// src/presets/presets-catalog.ts
+var SERVICE_PRESETS = {
+  // --- ANALYTICS ---
+  ga4: {
+    id: "ga4",
+    category: "analytics",
+    label: "Google Analytics 4",
+    provider: "Google LLC",
+    description: "Medici\xF3n de visitas, p\xE1ginas vistas, eventos y comportamiento de navegaci\xF3n del usuario.",
+    policyUrl: "https://policies.google.com/privacy",
+    cookies: [
+      { name: "_ga", duration: "2 a\xF1os", purpose: "Distinguir a los usuarios \xFAnicos en el sitio web." },
+      { name: "_ga_*", duration: "2 a\xF1os", purpose: "Mantener el estado de la sesi\xF3n de Google Analytics 4." },
+      { name: "_gid", duration: "24 horas", purpose: "Distinguir a los usuarios durante un \xFAnico d\xEDa." },
+      { name: "_gat*", duration: "1 minuto", purpose: "Limitar el porcentaje de solicitudes a Google Analytics." }
+    ],
+    storageKeys: ["_ga_*", "google_analytics_*"],
+    localStorage: ["_ga_*", "google_analytics_*"]
+  },
+  google_analytics: {
+    id: "google_analytics",
+    category: "analytics",
+    label: "Google Analytics (Universal / GA4)",
+    provider: "Google LLC",
+    description: "Medici\xF3n de visitas y estad\xEDsticas an\xF3nimas de tr\xE1fico web.",
+    policyUrl: "https://policies.google.com/privacy",
+    cookies: [
+      { name: "_ga", duration: "2 a\xF1os", purpose: "Distinguir usuarios." },
+      { name: "_ga_*", duration: "2 a\xF1os", purpose: "Estado de la sesi\xF3n GA4." },
+      { name: "_gid", duration: "24 horas", purpose: "Identificador diario." }
+    ],
+    storageKeys: ["_ga_*"]
+  },
+  posthog: {
+    id: "posthog",
+    category: "analytics",
+    label: "PostHog Analytics",
+    provider: "PostHog, Inc.",
+    description: "Anal\xEDtica de producto, registro de sesiones, mapas de ruta y embudos de interacci\xF3n.",
+    policyUrl: "https://posthog.com/privacy",
+    cookies: [
+      { name: "ph_*_posthog", duration: "1 a\xF1o", purpose: "Persistencia de usuario e identificaci\xF3n de sesiones en PostHog." }
+    ],
+    storageKeys: ["ph_*_posthog"],
+    localStorage: ["ph_*_posthog"],
+    sessionStorage: ["ph_*_posthog"]
+  },
+  hotjar: {
+    id: "hotjar",
+    category: "analytics",
+    label: "Hotjar Heatmaps & Feedback",
+    provider: "Hotjar Ltd.",
+    description: "Mapas de calor de clics, desplazamientos, grabaciones de comportamiento y encuestas.",
+    policyUrl: "https://www.hotjar.com/legal/policies/privacy/",
+    cookies: [
+      { name: "_hjSession*", duration: "30 minutos", purpose: "Mantener los datos de la sesi\xF3n actual del usuario en Hotjar." },
+      { name: "_hjSessionUser*", duration: "1 a\xF1o", purpose: "Mantener el ID de usuario an\xF3nimo en el navegador." },
+      { name: "_hjIncludedIn*", duration: "Sesi\xF3n", purpose: "Determinar si el usuario est\xE1 incluido en el muestreo de datos." },
+      { name: "_hjAbsoluteCanvasUrl", duration: "Sesi\xF3n", purpose: "Almacenar la URL can\xF3nica de visualizaci\xF3n." },
+      { name: "_hjTLDTest", duration: "Sesi\xF3n", purpose: "Verificar el nivel de dominio para cookies." }
+    ],
+    storageKeys: ["_hj*", "hj*"],
+    localStorage: ["_hj*"],
+    sessionStorage: ["_hj*"]
+  },
+  clarity: {
+    id: "clarity",
+    category: "analytics",
+    label: "Microsoft Clarity",
+    provider: "Microsoft Corporation",
+    description: "Grabaci\xF3n de navegaci\xF3n y mapas t\xE9rmicos de interacci\xF3n sin datos personales.",
+    policyUrl: "https://privacy.microsoft.com/privacystatement",
+    cookies: [
+      { name: "_clck", duration: "1 a\xF1o", purpose: "Persistir el ID de usuario Clarity y sus preferencias de p\xE1gina." },
+      { name: "_clsk", duration: "24 horas", purpose: "Conectar m\xFAltiples visitas de p\xE1gina en una \xFAnica sesi\xF3n." },
+      { name: "CLID", duration: "1 a\xF1o", purpose: "Identificador de navegador para Clarity." },
+      { name: "MUID", duration: "1 a\xF1o", purpose: "Identificador de usuario \xFAnico de Microsoft." }
+    ],
+    storageKeys: ["_cl*"],
+    localStorage: ["_cl*"]
+  },
+  matomo: {
+    id: "matomo",
+    category: "analytics",
+    label: "Matomo Analytics",
+    provider: "InnoCraft Ltd.",
+    description: "Plataforma de anal\xEDtica web local-first y centrada en la privacidad.",
+    policyUrl: "https://matomo.org/privacy-policy/",
+    cookies: [
+      { name: "_pk_id*", duration: "13 meses", purpose: "Almacenar datos de usuario \xFAnicos como el ID de visitante." },
+      { name: "_pk_ses*", duration: "30 minutos", purpose: "Almacenar datos temporales de la sesi\xF3n de navegaci\xF3n." },
+      { name: "_pk_ref*", duration: "6 meses", purpose: "Almacenar la informaci\xF3n de atribuci\xF3n de procedencia." }
+    ],
+    storageKeys: ["_pk_*"],
+    localStorage: ["_pk_*"]
+  },
+  plausible: {
+    id: "plausible",
+    category: "analytics",
+    label: "Plausible Analytics",
+    provider: "Plausible Insights O\xDC",
+    description: "Anal\xEDtica web ligera y respetuosa con la privacidad, 100% libre de cookies.",
+    policyUrl: "https://plausible.io/data-policy",
+    cookies: [],
+    storageKeys: []
+  },
+  // --- MARKETING & ADVERTISING ---
+  meta_pixel: {
+    id: "meta_pixel",
+    category: "marketing",
+    label: "Meta Pixel (Facebook)",
+    provider: "Meta Platforms Ireland Ltd.",
+    description: "Medici\xF3n de conversiones, personalizaci\xF3n y optimizaci\xF3n de campa\xF1as publicitarias en Facebook e Instagram.",
+    policyUrl: "https://www.facebook.com/privacy/policy",
+    cookies: [
+      { name: "_fbp", duration: "90 d\xEDas", purpose: "Almacenar y rastrear visitas en los sitios web para segmentaci\xF3n publicitaria." },
+      { name: "_fbc", duration: "90 d\xEDas", purpose: "Guardar el \xFAltimo clic en un anuncio de Facebook (par\xE1metro fbclid)." },
+      { name: "fr", duration: "90 d\xEDas", purpose: "Cookie de publicidad comportamental de Facebook." },
+      { name: "tr", duration: "Sesi\xF3n", purpose: "P\xEDxel de seguimiento de eventos en tiempo real." },
+      { name: "datr", duration: "2 a\xF1os", purpose: "Identificaci\xF3n del navegador web para seguridad y anal\xEDtica publicitaria." }
+    ],
+    storageKeys: ["_fbp*"],
+    localStorage: ["_fbp*"]
+  },
+  facebook_pixel: {
+    id: "facebook_pixel",
+    category: "marketing",
+    label: "Meta Pixel (Facebook)",
+    provider: "Meta Platforms Ireland Ltd.",
+    description: "Medici\xF3n de conversiones y retargeting en Meta/Facebook.",
+    policyUrl: "https://www.facebook.com/privacy/policy",
+    cookies: [
+      { name: "_fbp", duration: "90 d\xEDas", purpose: "Rastreo de conversiones y atribuci\xF3n de campa\xF1as." },
+      { name: "_fbc", duration: "90 d\xEDas", purpose: "Identificador de clic de anuncio." }
+    ],
+    storageKeys: ["_fbp*"]
+  },
+  google_ads: {
+    id: "google_ads",
+    category: "marketing",
+    label: "Google Ads & Remarketing",
+    provider: "Google LLC",
+    description: "Medici\xF3n de conversiones publicitarias y campa\xF1as de retargeting de Google Ads.",
+    policyUrl: "https://policies.google.com/technologies/ads",
+    cookies: [
+      { name: "_gcl_au", duration: "90 d\xEDas", purpose: "Medici\xF3n de conversiones publicitarias de Google AdSense y Ads." },
+      { name: "_gcl_aw", duration: "90 d\xEDas", purpose: "Conversiones procedentes de clics en anuncios de Google Ads." },
+      { name: "IDE", duration: "1 a\xF1o", purpose: "Publicidad dirigida y medici\xF3n de rendimiento de DoubleClick." },
+      { name: "DSID", duration: "2 semanas", purpose: "Identificar usuario conectado en sitios web ajenos a Google." },
+      { name: "RUL", duration: "1 a\xF1o", purpose: "Audiencias de remarketing de Google Ads." }
+    ],
+    storageKeys: ["_gcl_*"]
+  },
+  tiktok_pixel: {
+    id: "tiktok_pixel",
+    category: "marketing",
+    label: "TikTok Pixel",
+    provider: "TikTok Technology Limited",
+    description: "Medici\xF3n de rendimiento y segmentaci\xF3n de campa\xF1as publicitarias en TikTok.",
+    policyUrl: "https://www.tiktok.com/legal/privacy-policy-eea",
+    cookies: [
+      { name: "_tt_enable_cookie", duration: "13 meses", purpose: "Habilitar la medici\xF3n de conversiones del p\xEDxel de TikTok." },
+      { name: "_ttp", duration: "13 meses", purpose: "Medir y mejorar el rendimiento de las campa\xF1as publicitarias en TikTok." }
+    ],
+    storageKeys: ["tt_*", "_ttp*"]
+  },
+  linkedin_insight: {
+    id: "linkedin_insight",
+    category: "marketing",
+    label: "LinkedIn Insight Tag",
+    provider: "LinkedIn Ireland Unlimited Company",
+    description: "Informes de conversiones y atribuci\xF3n de campa\xF1as profesionales B2B en LinkedIn.",
+    policyUrl: "https://www.linkedin.com/legal/privacy-policy",
+    cookies: [
+      { name: "li_sugr", duration: "90 d\xEDas", purpose: "Identificador probabil\xEDstico de navegador en LinkedIn." },
+      { name: "bcookie", duration: "1 a\xF1o", purpose: "Identificador de sesi\xF3n de navegador para servicios de LinkedIn." },
+      { name: "lidc", duration: "24 horas", purpose: "Enrutamiento de centros de datos para LinkedIn." },
+      { name: "UserMatchHistory", duration: "30 d\xEDas", purpose: "Sincronizaci\xF3n de identificadores de publicidad de LinkedIn." }
+    ]
+  },
+  twitter_pixel: {
+    id: "twitter_pixel",
+    category: "marketing",
+    label: "X / Twitter Ads Pixel",
+    provider: "X Corp.",
+    description: "Medici\xF3n de conversiones e interacci\xF3n con campa\xF1as publicitarias en X (Twitter).",
+    policyUrl: "https://twitter.com/privacy",
+    cookies: [
+      { name: "personalization_id", duration: "2 a\xF1os", purpose: "Personalizaci\xF3n de publicidad y medici\xF3n de eventos en X." },
+      { name: "muc_ads", duration: "2 a\xF1os", purpose: "Seguimiento de conversiones publicitarias en X." }
+    ]
+  },
+  hubspot: {
+    id: "hubspot",
+    category: "marketing",
+    label: "HubSpot CRM & Tracking",
+    provider: "HubSpot, Inc.",
+    description: "Anal\xEDtica de leads, formularios inteligentes y seguimiento de clientes potenciales.",
+    policyUrl: "https://legal.hubspot.com/privacy-policy",
+    cookies: [
+      { name: "__hstc", duration: "6 meses", purpose: "Rastreo de visitantes \xFAnicos, sesiones y marcas de tiempo." },
+      { name: "hubspotutk", duration: "6 meses", purpose: "Rastreo de identidad de visitante pasado a formularios." },
+      { name: "__hssc", duration: "30 minutos", purpose: "Rastreo de sesiones activas en HubSpot." },
+      { name: "__hssrc", duration: "Sesi\xF3n", purpose: "Determinar si el usuario ha reiniciado su navegador." }
+    ],
+    storageKeys: ["__hs*", "hubspot*"]
+  },
+  // --- EMBEDDED MEDIA ---
+  youtube: {
+    id: "youtube",
+    category: "marketing",
+    label: "YouTube Video Player",
+    provider: "Google LLC",
+    description: "Reproducci\xF3n de contenidos de v\xEDdeo integrados y almacenamiento de preferencias del reproductor.",
+    policyUrl: "https://policies.google.com/privacy",
+    cookies: [
+      { name: "VISITOR_INFO1_LIVE", duration: "6 meses", purpose: "Estimar el ancho de banda del usuario en p\xE1ginas con v\xEDdeos de YouTube." },
+      { name: "YSC", duration: "Sesi\xF3n", purpose: "Registrar estad\xEDsticas de visualizaciones de v\xEDdeo de YouTube." },
+      { name: "PREF", duration: "8 meses", purpose: "Almacenar preferencias de configuraci\xF3n del reproductor." },
+      { name: "GPS", duration: "30 minutos", purpose: "Rastrear ubicaci\xF3n en dispositivos m\xF3viles." }
+    ],
+    storageKeys: ["yt-*", "yt-remote-*"],
+    localStorage: ["yt-*", "yt-remote-*"]
+  },
+  vimeo: {
+    id: "vimeo",
+    category: "marketing",
+    label: "Vimeo Video Player",
+    provider: "Vimeo, Inc.",
+    description: "Reproducci\xF3n de v\xEDdeos interactivos alojados en Vimeo y estad\xEDsticas de visualizaci\xF3n.",
+    policyUrl: "https://vimeo.com/privacy",
+    cookies: [
+      { name: "vuid", duration: "2 a\xF1os", purpose: "Almacenar el historial de reproducciones de v\xEDdeo del usuario en Vimeo." },
+      { name: "player", duration: "1 a\xF1o", purpose: "Guardar las preferencias de volumen y resoluci\xF3n del reproductor." }
+    ],
+    storageKeys: ["vimeo*"]
+  },
+  spotify: {
+    id: "spotify",
+    category: "marketing",
+    label: "Spotify Player",
+    provider: "Spotify AB",
+    description: "Reproducci\xF3n embebida de canciones, podcasts y listas de reproducci\xF3n de Spotify.",
+    policyUrl: "https://www.spotify.com/legal/privacy-policy/",
+    cookies: [
+      { name: "sp_t", duration: "1 a\xF1o", purpose: "Identificador de usuario \xFAnico de Spotify para contenido embebido." },
+      { name: "sp_m", duration: "1 a\xF1o", purpose: "Preferencias de reproducci\xF3n y cookies de sesi\xF3n." }
+    ]
+  },
+  // --- CHAT & CUSTOMER SUPPORT ---
+  intercom: {
+    id: "intercom",
+    category: "marketing",
+    label: "Intercom Messenger",
+    provider: "Intercom R&D Unlimited Company",
+    description: "Widget de mensajer\xEDa, soporte al cliente en tiempo real y asistencia guiada.",
+    policyUrl: "https://www.intercom.com/legal/privacy",
+    cookies: [
+      { name: "intercom-id-*", duration: "9 meses", purpose: "Identificador an\xF3nimo de visitante para conversaciones en Intercom." },
+      { name: "intercom-session-*", duration: "7 d\xEDas", purpose: "Persistir la sesi\xF3n de chat activa." },
+      { name: "intercom-device-id-*", duration: "9 meses", purpose: "Identificador del dispositivo del visitante." }
+    ],
+    storageKeys: ["intercom*"]
+  },
+  crisp: {
+    id: "crisp",
+    category: "marketing",
+    label: "Crisp Live Chat",
+    provider: "Crisp IM SARL",
+    description: "Chat en vivo de soporte y mensajer\xEDa multicanal para visitantes.",
+    policyUrl: "https://crisp.chat/privacy",
+    cookies: [
+      { name: "crisp-client/*", duration: "6 meses", purpose: "Identificador de sesi\xF3n de chat en Crisp." }
+    ],
+    storageKeys: ["crisp-client*"]
+  },
+  // --- NECESSARY / TECHNICAL / SECURITY ---
+  gtm: {
+    id: "gtm",
+    category: "necessary",
+    label: "Google Tag Manager",
+    provider: "Google LLC",
+    description: "Contenedor t\xE9cnico para la inyecci\xF3n y gesti\xF3n centralizada de scripts del sitio web.",
+    policyUrl: "https://policies.google.com/privacy",
+    cookies: [
+      { name: "_gtm_*", duration: "Sesi\xF3n", purpose: "Depuraci\xF3n t\xE9cnica de contenedores de Google Tag Manager." }
+    ]
+  },
+  google_recaptcha: {
+    id: "google_recaptcha",
+    category: "necessary",
+    label: "Google reCAPTCHA",
+    provider: "Google LLC",
+    description: "Protecci\xF3n contra bots automatizados, ataques de fuerza bruta y spam en formularios.",
+    policyUrl: "https://policies.google.com/privacy",
+    cookies: [
+      { name: "_GRECAPTCHA", duration: "6 meses", purpose: "Evaluaci\xF3n de riesgo de bots para protecci\xF3n de formularios." },
+      { name: "rc::a", duration: "Persistente", purpose: "Distinguir entre humanos y bots automatizados." },
+      { name: "rc::b", duration: "Sesi\xF3n", purpose: "Distinguir entre humanos y bots automatizados." },
+      { name: "rc::c", duration: "Sesi\xF3n", purpose: "Distinguir entre humanos y bots automatizados." }
+    ]
+  },
+  cloudflare: {
+    id: "cloudflare",
+    category: "necessary",
+    label: "Cloudflare Security & Turnstile",
+    provider: "Cloudflare, Inc.",
+    description: "Mitigaci\xF3n de ataques DDoS, balanceo de carga CDN y validaci\xF3n de seguridad Turnstile.",
+    policyUrl: "https://www.cloudflare.com/privacypolicy/",
+    cookies: [
+      { name: "__cf_bm", duration: "30 minutos", purpose: "Gesti\xF3n de bots y mitigaci\xF3n de tr\xE1fico malicioso en Cloudflare." },
+      { name: "cf_clearance", duration: "1 a\xF1o", purpose: "Autorizaci\xF3n de paso tras superar desaf\xEDo de seguridad Turnstile/Cloudflare." }
+    ]
+  },
+  stripe: {
+    id: "stripe",
+    category: "necessary",
+    label: "Stripe Payments & Fraud Prevention",
+    provider: "Stripe, Inc.",
+    description: "Procesamiento seguro de transacciones bancarias, tarjetas y prevenci\xF3n de fraude financiero.",
+    policyUrl: "https://stripe.com/privacy",
+    cookies: [
+      { name: "__stripe_mid", duration: "1 a\xF1o", purpose: "Prevenci\xF3n de fraude y autenticaci\xF3n de pagos en Stripe." },
+      { name: "__stripe_sid", duration: "30 minutos", purpose: "Identificador de sesi\xF3n de transacci\xF3n en Stripe." },
+      { name: "m", duration: "2 a\xF1os", purpose: "Detecci\xF3n de fraude financiero en la pasarela de pagos Stripe." }
+    ],
+    storageKeys: ["__stripe_*"],
+    localStorage: ["__stripe_*"]
+  },
+  paypal: {
+    id: "paypal",
+    category: "necessary",
+    label: "PayPal Checkout",
+    provider: "PayPal (Europe) S.\xE0 r.l. et Cie, S.C.A.",
+    description: "Procesamiento de pagos y pasarela de cobro segura de PayPal.",
+    policyUrl: "https://www.paypal.com/webapps/mpp/ua/privacy-full",
+    cookies: [
+      { name: "ts", duration: "3 a\xF1os", purpose: "Gesti\xF3n segura de pagos y prevenci\xF3n de fraude en PayPal." },
+      { name: "ts_c", duration: "3 a\xF1os", purpose: "Autenticaci\xF3n segura de usuario en la pasarela PayPal." }
+    ]
+  }
+};
+
+// src/presets/index.ts
+function hasPreset(presetId) {
+  return Object.prototype.hasOwnProperty.call(SERVICE_PRESETS, presetId);
+}
+function resolveConfigPresets(config) {
+  if (!config || !config.services || typeof config.services !== "object") {
+    return config;
+  }
+  const hydratedServices = {};
+  for (const [serviceKey, serviceDef] of Object.entries(config.services)) {
+    if (!serviceDef || typeof serviceDef !== "object") {
+      hydratedServices[serviceKey] = serviceDef;
+      continue;
+    }
+    const presetName = serviceDef.preset || (hasPreset(serviceKey) && !serviceDef.category ? serviceKey : void 0);
+    if (presetName && hasPreset(presetName)) {
+      const preset = SERVICE_PRESETS[presetName];
+      hydratedServices[serviceKey] = __spreadValues({
+        category: serviceDef.category || preset.category,
+        label: serviceDef.label || preset.label,
+        provider: serviceDef.provider || preset.provider,
+        policyUrl: serviceDef.policyUrl || preset.policyUrl,
+        description: serviceDef.description || preset.description,
+        cookies: serviceDef.cookies || (preset.cookies ? [...preset.cookies] : void 0),
+        storageKeys: serviceDef.storageKeys || (preset.storageKeys ? [...preset.storageKeys] : void 0),
+        localStorage: serviceDef.localStorage || (preset.localStorage ? [...preset.localStorage] : void 0),
+        sessionStorage: serviceDef.sessionStorage || (preset.sessionStorage ? [...preset.sessionStorage] : void 0)
+      }, serviceDef);
+    } else {
+      hydratedServices[serviceKey] = serviceDef;
+    }
+  }
+  return __spreadProps(__spreadValues({}, config), {
+    services: hydratedServices
+  });
+}
+
+// src/audit/auditor.ts
+var KNOWN_TRACKER_PATTERNS = [
+  { domain: "googletagmanager.com/gtm.js", name: "Google Tag Manager", category: "necessary_or_analytics" },
+  { domain: "googletagmanager.com/gtag", name: "Google Analytics / Ads Gtag", category: "analytics" },
+  { domain: "google-analytics.com/analytics.js", name: "Google Universal Analytics", category: "analytics" },
+  { domain: "connect.facebook.net", name: "Meta / Facebook Pixel", category: "marketing" },
+  { domain: "static.hotjar.com", name: "Hotjar Heatmaps & Feedback", category: "analytics" },
+  { domain: "clarity.ms/tag", name: "Microsoft Clarity", category: "analytics" },
+  { domain: "analytics.tiktok.com", name: "TikTok Pixel", category: "marketing" },
+  { domain: "snap.licdn.com/insight", name: "LinkedIn Insight Tag", category: "marketing" },
+  { domain: "cdn.segment.com/analytics", name: "Segment Analytics", category: "analytics" },
+  { domain: "app.posthog.com/static", name: "PostHog Analytics", category: "analytics" },
+  { domain: "mc.yandex.ru/metrika", name: "Yandex Metrika", category: "analytics" }
+];
+var LssiAuditor = class {
+  /**
+   * Run complete compliance audit on configuration, source code, and/or live URL.
+   */
+  static async audit(options) {
+    const findings = [];
+    let scannedFilesCount = 0;
+    let resolvedConfig = null;
+    if (options.config) {
+      if (typeof options.config === "string") {
+        try {
+          const raw = fs.readFileSync(path.resolve(options.config), "utf8");
+          resolvedConfig = resolveConfigPresets(JSON.parse(raw));
+        } catch (err) {
+          findings.push({
+            id: "CONFIG_FILE_ERROR",
+            rule: "LSSI-CONFIG-001",
+            severity: "CRITICAL",
+            category: "CONFIG",
+            message: `No se pudo leer el archivo de configuraci\xF3n: ${err.message}`,
+            remediation: "Verifica que la ruta al archivo consent.json sea v\xE1lida y contenga JSON bien formado."
+          });
+        }
+      } else {
+        resolvedConfig = resolveConfigPresets(options.config);
+      }
+    } else if (options.configPath) {
+      try {
+        const raw = fs.readFileSync(path.resolve(options.configPath), "utf8");
+        resolvedConfig = resolveConfigPresets(JSON.parse(raw));
+      } catch (err) {
+        findings.push({
+          id: "CONFIG_FILE_ERROR",
+          rule: "LSSI-CONFIG-001",
+          severity: "CRITICAL",
+          category: "CONFIG",
+          message: `No se pudo leer el archivo de configuraci\xF3n en '${options.configPath}': ${err.message}`,
+          remediation: "Especifica una ruta v\xE1lida con --config <ruta>."
+        });
+      }
+    }
+    if (resolvedConfig) {
+      this.auditConfig(resolvedConfig, findings);
+    }
+    if (options.srcDir && fs.existsSync(path.resolve(options.srcDir))) {
+      scannedFilesCount = this.auditSourceDirectory(path.resolve(options.srcDir), findings);
+    }
+    if (options.url) {
+      await this.auditLiveUrl(options.url, findings);
+    }
+    const criticalCount = findings.filter((f) => f.severity === "CRITICAL").length;
+    const warningCount = findings.filter((f) => f.severity === "WARNING").length;
+    const infoCount = findings.filter((f) => f.severity === "INFO").length;
+    const penalty = criticalCount * 25 + warningCount * 10 + infoCount * 2;
+    const score = Math.max(0, 100 - penalty);
+    const compliant = criticalCount === 0;
+    return {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      compliant,
+      score,
+      summary: {
+        critical: criticalCount,
+        warnings: warningCount,
+        info: infoCount,
+        totalPassed: Math.max(0, 10 - criticalCount - warningCount)
+      },
+      findings,
+      scannedFilesCount
+    };
+  }
+  /**
+   * Validate consent configuration against LSSI art. 22.2 and AEPD guidelines.
+   */
+  static auditConfig(config, findings) {
+    var _a, _b, _c;
+    if (!config.categories || typeof config.categories !== "object") {
+      findings.push({
+        id: "CONFIG_NO_CATEGORIES",
+        rule: "AEPD-CATEGORIES-001",
+        severity: "CRITICAL",
+        category: "CONFIG",
+        message: "No se encontraron categor\xEDas de consentimiento definidas.",
+        remediation: "Declara al menos la categor\xEDa 'necessary' y las categor\xEDas opcionales ('analytics', 'marketing')."
+      });
+      return;
+    }
+    const nec = config.categories["necessary"];
+    if (!nec) {
+      findings.push({
+        id: "CONFIG_MISSING_NECESSARY",
+        rule: "LSSI-NECESSARY-001",
+        severity: "CRITICAL",
+        category: "CONFIG",
+        message: "Falta la categor\xEDa obligatoria 'necessary' (cookies t\xE9cnicas y de seguridad).",
+        remediation: `A\xF1ade 'necessary: { required: true, label: "Necesarias", description: "..." }'.`
+      });
+    } else if (nec.required !== true) {
+      findings.push({
+        id: "CONFIG_NECESSARY_NOT_REQUIRED",
+        rule: "LSSI-NECESSARY-002",
+        severity: "CRITICAL",
+        category: "CONFIG",
+        message: "La categor\xEDa 'necessary' debe tener siempre 'required: true'.",
+        remediation: "Establece required: true en la categor\xEDa necessary."
+      });
+    }
+    for (const [catId, cat] of Object.entries(config.categories)) {
+      if (catId !== "necessary" && !cat.required) {
+        if (cat.default === true) {
+          findings.push({
+            id: "CONFIG_PRECHECKED_OPTIONAL",
+            rule: "AEPD-PRECHECK-001",
+            severity: "CRITICAL",
+            category: "LEGAL",
+            message: `Violaci\xF3n AEPD: La categor\xEDa opcional '${catId}' tiene default: true (casilla pre-marcada).`,
+            details: "Las directrices de la AEPD y el RGPD proh\xEDben taxativamente las casillas preactivadas por defecto.",
+            remediation: "Establece default: false en todas las categor\xEDas opcionales."
+          });
+        }
+      }
+    }
+    const hasPrivacy = !!(((_a = config.policy) == null ? void 0 : _a.privacyUrl) || config.translations && Object.values(config.translations).some((t) => {
+      var _a2;
+      return (_a2 = t.policy) == null ? void 0 : _a2.privacyUrl;
+    }));
+    const hasCookies = !!(((_b = config.policy) == null ? void 0 : _b.cookiesUrl) || config.translations && Object.values(config.translations).some((t) => {
+      var _a2;
+      return (_a2 = t.policy) == null ? void 0 : _a2.cookiesUrl;
+    }));
+    if (!hasPrivacy) {
+      findings.push({
+        id: "CONFIG_MISSING_PRIVACY_URL",
+        rule: "RGPD-POLICY-001",
+        severity: "WARNING",
+        category: "LEGAL",
+        message: "No se ha configurado un enlace a la Pol\xEDtica de Privacidad ('policy.privacyUrl').",
+        remediation: "A\xF1ade policy.privacyUrl: '/politica-privacidad' en consent.json."
+      });
+    }
+    if (!hasCookies) {
+      findings.push({
+        id: "CONFIG_MISSING_COOKIES_URL",
+        rule: "LSSI-POLICY-001",
+        severity: "WARNING",
+        category: "LEGAL",
+        message: "No se ha configurado un enlace a la Pol\xEDtica de Cookies ('policy.cookiesUrl').",
+        remediation: "A\xF1ade policy.cookiesUrl: '/politica-cookies' en consent.json."
+      });
+    }
+    const badge = (_c = config.ui) == null ? void 0 : _c.floatingBadge;
+    if (badge === false) {
+      findings.push({
+        id: "CONFIG_FLOATING_BADGE_DISABLED",
+        rule: "AEPD-REVOCATION-001",
+        severity: "WARNING",
+        category: "LEGAL",
+        message: "El bot\xF3n flotante de revocaci\xF3n ('ui.floatingBadge') est\xE1 desactivado.",
+        details: "La AEPD exige que retirar el consentimiento sea tan f\xE1cil como otorgarlo.",
+        remediation: "Mant\xE9n el floatingBadge activado o aseg\xFArate de incluir un bot\xF3n persistente [data-consent-open] en el footer."
+      });
+    }
+  }
+  /**
+   * Scan source code directory for unblocked third-party scripts.
+   */
+  static auditSourceDirectory(dirPath, findings) {
+    let count = 0;
+    const files = this.walkDir(dirPath);
+    const validExtensions = /* @__PURE__ */ new Set([".html", ".htm", ".jsx", ".tsx", ".vue", ".php", ".js", ".ts", ".mjs"]);
+    for (const filePath of files) {
+      const ext = path.extname(filePath).toLowerCase();
+      if (!validExtensions.has(ext)) continue;
+      if (filePath.includes("node_modules") || filePath.includes("dist") || filePath.includes(".git") || filePath.includes("/audit/") || filePath.includes("\\audit\\") || filePath.includes("/presets/") || filePath.includes("\\presets\\") || filePath.includes("tests/") || filePath.includes("tests\\")) {
+        continue;
+      }
+      count++;
+      try {
+        const content = fs.readFileSync(filePath, "utf8");
+        const scriptTagRegex = /<\s*script\b([^>]*)>/gi;
+        let match;
+        while ((match = scriptTagRegex.exec(content)) !== null) {
+          const tagAttributes = match[1];
+          const fullTag = match[0];
+          const offset = match.index;
+          const lineNumber = content.substring(0, offset).split("\n").length;
+          for (const tracker of KNOWN_TRACKER_PATTERNS) {
+            if (tagAttributes.includes(tracker.domain) || fullTag.includes(tracker.domain)) {
+              const isBlocked = tagAttributes.includes('type="text/plain"') || tagAttributes.includes("type='text/plain'") || tagAttributes.includes("data-consent") || tagAttributes.includes("data-src");
+              if (!isBlocked) {
+                findings.push({
+                  id: "SRC_UNBLOCKED_TRACKER",
+                  rule: "LSSI-SCRIPT-ISOLATION-001",
+                  severity: "CRITICAL",
+                  category: "SOURCE_CODE",
+                  message: `Script de seguimiento no bloqueado detectado (${tracker.name}): '${tracker.domain}'`,
+                  file: path.relative(process.cwd(), filePath),
+                  line: lineNumber,
+                  details: fullTag.replace(/\s+/g, " ").trim(),
+                  remediation: `Modifica el script para usar type="text/plain" data-src="..." data-consent="${tracker.category}" o envu\xE9lvelo en un <ConsentGate>.`
+                });
+              }
+            }
+          }
+        }
+        const sanitizedContent = content.replace(/<\s*script\b[^>]*type=["']text\/plain["'][^>]*>[\s\S]*?<\s*\/\s*script\s*>/gi, "");
+        const lines = sanitizedContent.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+          const rawLine = lines[i];
+          const line = rawLine.trim();
+          if (line.startsWith("//") || line.startsWith("*") || line.startsWith("/*") || line.includes("lssi-ignore") || line.includes("<script") || line.includes("data-src") || line.includes('type="text/plain"') || line.includes("type='text/plain'")) {
+            continue;
+          }
+          for (const tracker of KNOWN_TRACKER_PATTERNS) {
+            if (line.includes(tracker.domain)) {
+              const isBlocked = line.includes("ConsentGate") || line.includes("consentGate") || line.includes("useConsent") || line.includes("useConsentService") || line.includes("data-consent") || line.includes("text/plain");
+              if (!isBlocked) {
+                findings.push({
+                  id: "SRC_UNBLOCKED_TRACKER",
+                  rule: "LSSI-SCRIPT-ISOLATION-001",
+                  severity: "CRITICAL",
+                  category: "SOURCE_CODE",
+                  message: `Referencia a rastreador sin control de consentimiento detectada (${tracker.name}): '${tracker.domain}'`,
+                  file: path.relative(process.cwd(), filePath),
+                  line: i + 1,
+                  details: line.trim(),
+                  remediation: `Envuelve la invocaci\xF3n en un bloque condicional 'useConsent("${tracker.category}")' o componente <ConsentGate>.`
+                });
+              }
+            }
+          }
+        }
+      } catch (e) {
+      }
+    }
+    return count;
+  }
+  /**
+   * Audit live URL by fetching HTML and verifying pre-consent isolation.
+   */
+  static async auditLiveUrl(url, findings) {
+    try {
+      const res = await fetch(url, { headers: { "User-Agent": "Solvenza-LSSI-Auditor/1.5.1" } });
+      if (!res.ok) {
+        findings.push({
+          id: "URL_FETCH_FAILED",
+          rule: "LSSI-URL-001",
+          severity: "WARNING",
+          category: "LIVE_URL",
+          message: `No se pudo conectar a la URL '${url}' (HTTP ${res.status}).`
+        });
+        return;
+      }
+      const html = await res.text();
+      for (const tracker of KNOWN_TRACKER_PATTERNS) {
+        const regex = new RegExp(`<script[^>]*src=["'][^"']*${tracker.domain.replace(".", "\\.")}[^"']*["'][^>]*>`, "gi");
+        const matches = html.match(regex);
+        if (matches) {
+          for (const match of matches) {
+            if (!match.includes('type="text/plain"') && !match.includes("data-consent")) {
+              findings.push({
+                id: "URL_RAW_TRACKER_LEAK",
+                rule: "LSSI-LEAK-001",
+                severity: "CRITICAL",
+                category: "LIVE_URL",
+                message: `Fuga de rastreador en tiempo de ejecuci\xF3n: script '${tracker.name}' cargado antes del consentimiento.`,
+                details: match,
+                remediation: `Aseg\xFArate de que '${tracker.name}' se inyecte con type="text/plain" data-consent="...".`
+              });
+            }
+          }
+        }
+      }
+    } catch (err) {
+      findings.push({
+        id: "URL_CONNECT_ERROR",
+        rule: "LSSI-URL-002",
+        severity: "WARNING",
+        category: "LIVE_URL",
+        message: `Error al escanear la URL '${url}': ${err.message}`
+      });
+    }
+  }
+  /**
+   * Generate GitHub Actions markdown step summary.
+   */
+  static formatGitHubSummary(report) {
+    const statusEmoji = report.compliant ? "\u2705" : "\u274C";
+    const statusText = report.compliant ? "**APROBADO (Cumplimiento LSSI / AEPD / RGPD Correcto)**" : "**RECHAZADO (Violaciones Cr\xEDticas de Privacidad Detectadas)**";
+    let md = `## ${statusEmoji} Auditor\xEDa de Cumplimiento LSSI & AEPD - Solvenza Cookies Compliance
+
+`;
+    md += `> **Resultado:** ${statusText}  
+`;
+    md += `> **Puntuaci\xF3n de Cumplimiento:** **${report.score} / 100**  
+`;
+    md += `> **Archivos Escaneados:** ${report.scannedFilesCount} | **Fecha:** ${new Date(report.timestamp).toUTCString()}
+
+`;
+    md += `### \u{1F4CA} Resumen de Hallazgos:
+
+`;
+    md += `| Gravedad | Cantidad | Descripci\xF3n |
+`;
+    md += `|---|---|---|
+`;
+    md += `| \u{1F534} **CR\xCDTICO** | **${report.summary.critical}** | Violaciones legales directas (riesgo de sanci\xF3n AEPD) |
+`;
+    md += `| \u{1F7E1} **ADVERTENCIA** | **${report.summary.warnings}** | Recomendaciones t\xE9cnicas y mejores pr\xE1cticas |
+`;
+    md += `| \u{1F535} **INFO** | **${report.summary.info}** | Sugerencias de optimizaci\xF3n |
+
+`;
+    if (report.findings.length > 0) {
+      md += `### \u{1F50D} Detalle de Hallazgos:
+
+`;
+      md += `| Regla | Gravedad | Categor\xEDa | Archivo/L\xEDnea | Mensaje | Soluci\xF3n |
+`;
+      md += `|---|---|---|---|---|---|
+`;
+      for (const f of report.findings) {
+        const sevBadge = f.severity === "CRITICAL" ? "\u{1F534} CR\xCDTICO" : f.severity === "WARNING" ? "\u{1F7E1} ADVERTENCIA" : "\u{1F535} INFO";
+        const location = f.file ? `\`${f.file}${f.line ? `:${f.line}` : ""}\`` : "-";
+        const remediation = f.remediation ? f.remediation.replace(/\|/g, "\\|") : "-";
+        const message = f.message.replace(/\|/g, "\\|");
+        md += `| \`${f.rule}\` | ${sevBadge} | ${f.category} | ${location} | ${message} | ${remediation} |
+`;
+      }
+      md += `
+`;
+    } else {
+      md += `\u{1F389} **No se encontraron violaciones ni fugas de privacidad.** Todos los recursos de terceros cumplen con el aislamiento previo al consentimiento (LSSI art. 22.2).
+
+`;
+    }
+    return md;
+  }
+  static walkDir(dir) {
+    let results = [];
+    try {
+      const list = fs.readdirSync(dir);
+      for (const file of list) {
+        const fullPath = path.join(dir, file);
+        const stat = fs.statSync(fullPath);
+        if (stat && stat.isDirectory()) {
+          results = results.concat(this.walkDir(fullPath));
+        } else {
+          results.push(fullPath);
+        }
+      }
+    } catch (e) {
+    }
+    return results;
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  LssiAuditor
+});
+//# sourceMappingURL=audit.cjs.map