cuonztech-privacy-chaos-gate 0.2.0 → 0.2.2

package/dist/chunk-T5D6BUAC.js

@@ -1,4514 +0,0 @@
-// src/types/index.ts
-import { z } from "zod";
-var ChaosScenarioSchema = z.enum([
-  "happy-path-denied",
-  "happy-path-accepted",
-  "fast-click",
-  "state-manipulation",
-  "network-drop",
-  "consent-revoked",
-  "category-selective",
-  "consent-persistence",
-  "banner-ignored",
-  "subpage-spa",
-  "cmp-failure",
-  "embed-leaks",
-  "consent-mode-v2",
-  "duplicate-events",
-  "mobile-usability"
-]);
-var EvidenceStatusSchema = z.enum(["passed", "suspicious", "not-checkable", "not-applicable"]);
-var StorageSnapshotSchema = z.object({
-  cookies: z.array(z.string()),
-  localStorageKeys: z.array(z.string()),
-  sessionStorageKeys: z.array(z.string()),
-  /** Consent-relevante Einträge mit Wert — zeigt erlaubt/abgelehnt */
-  localStorageEntries: z.array(z.object({ key: z.string(), value: z.string() })).optional()
-});
-var RequestEventSchema = z.object({
-  at: z.string(),
-  url: z.string(),
-  trackerName: z.string().optional(),
-  trackerCategory: z.string().optional(),
-  phase: z.enum([
-    "pre-consent",
-    "post-accept",
-    "post-reject",
-    "post-selection",
-    "post-revoke",
-    "post-wipe",
-    "post-reject-restart",
-    "other"
-  ])
-});
-var EvidenceRecordSchema = z.object({
-  scenario: ChaosScenarioSchema,
-  status: EvidenceStatusSchema,
-  note: z.string(),
-  actionSequence: z.array(z.string()),
-  /** Zeitstempel je Aktion, parallel zu actionSequence */
-  actionTimeline: z.array(z.object({ at: z.string(), action: z.string() })).optional(),
-  requestTimeline: z.array(RequestEventSchema),
-  storageBefore: StorageSnapshotSchema,
-  storageAfter: StorageSnapshotSchema,
-  /** Storage-Höhepunkt nach Accept (vor Widerruf) für den echten Widerruf-Diff */
-  storageAfterAccept: StorageSnapshotSchema.optional(),
-  residualAfterRevoke: z.array(z.string()).optional(),
-  /** Pfade zu Screenshots (Auswahl, Banner, nach Aktion) */
-  screenshots: z.array(z.object({ label: z.string(), path: z.string(), at: z.string() })).optional(),
-  screenshotPath: z.string().optional(),
-  targetUrl: z.string(),
-  checkedAt: z.string()
-});
-var TrackerCategorySchema = z.enum([
-  "analytics",
-  "marketing",
-  "functional",
-  "unknown"
-]);
-var TrackerViolationSchema = z.object({
-  id: z.string(),
-  scenario: ChaosScenarioSchema,
-  trackerName: z.string(),
-  trackerCategory: TrackerCategorySchema,
-  requestUrl: z.string(),
-  /** Verletzte Regel — steuert Gate-Wortlaut und Empfehlungen */
-  ruleId: z.string().optional(),
-  method: z.string().default("GET"),
-  timestamp: z.string(),
-  domContext: z.object({
-    triggerElement: z.string().optional(),
-    consentBannerVisible: z.boolean().optional(),
-    scriptsFound: z.array(z.string()).optional()
-  }).optional(),
-  description: z.string()
-});
-var LeakReportSchema = z.object({
-  targetUrl: z.string().url(),
-  scannedAt: z.string(),
-  durationMs: z.number(),
-  totalViolations: z.number(),
-  violations: z.array(TrackerViolationSchema),
-  passedScenarios: z.array(ChaosScenarioSchema),
-  failedScenarios: z.array(ChaosScenarioSchema),
-  summary: z.string(),
-  evidence: z.array(EvidenceRecordSchema).optional()
-});
-var FilePatchSchema = z.object({
-  filePath: z.string(),
-  originalContent: z.string().optional(),
-  patchedContent: z.string(),
-  diff: z.string().optional(),
-  explanation: z.string()
-});
-var ReviewVerdictSchema = z.object({
-  passed: z.boolean(),
-  score: z.number().min(0).max(100),
-  comments: z.array(z.string()),
-  approvedPatches: z.array(FilePatchSchema),
-  rejectedPatches: z.array(FilePatchSchema)
-});
-var PullRequestResultSchema = z.object({
-  branchName: z.string(),
-  title: z.string(),
-  body: z.string(),
-  prNumber: z.number().optional(),
-  prUrl: z.string().optional(),
-  simulated: z.boolean().default(false)
-});
-var RemediationResultSchema = z.object({
-  success: z.boolean(),
-  patches: z.array(FilePatchSchema),
-  reviewVerdict: ReviewVerdictSchema.optional(),
-  commitHash: z.string().optional(),
-  commitMessage: z.string().optional(),
-  pullRequest: PullRequestResultSchema.optional(),
-  error: z.string().optional()
-});
-var GateConfigSchema = z.object({
-  targetUrl: z.string().url({ message: "Invalid target URL" }),
-  apiKey: z.string().optional(),
-  llmProvider: z.enum(["openai", "anthropic", "gemini"]).default("openai"),
-  llmModel: z.string().default("gpt-4o"),
-  autoFix: z.boolean().default(true),
-  failOnLeak: z.boolean().default(true),
-  reportOutput: z.string().default("reports/privacy-chaos-report.json"),
-  sourceDir: z.string().default("."),
-  gitCommit: z.boolean().default(false),
-  createPr: z.boolean().default(false),
-  githubToken: z.string().optional(),
-  baseBranch: z.string().optional(),
-  branchPrefix: z.string().default("fix/cpcg-privacy"),
-  /** Optional: nur diese Szenarien ausführen (leer = alle). Für Tests/CI gezielt. */
-  scenarios: z.array(ChaosScenarioSchema).optional(),
-  /** Demo-Lauf mit synthetischen Testdaten — Report wird gekennzeichnet */
-  demo: z.boolean().optional(),
-  /** Deluxe-PDF (Deckblatt + Evidence) nach dem Scan erzeugen */
-  reportPdf: z.boolean().optional(),
-  /** Kundenname für das PDF-Deckblatt */
-  clientName: z.string().optional(),
-  headless: z.boolean().default(true),
-  timeoutMs: z.number().default(3e4)
-});
-
-// src/config/index.ts
-import { config as loadDotenv } from "dotenv";
-loadDotenv();
-function parseBoolean(val, defaultVal) {
-  if (typeof val === "boolean") return val;
-  if (typeof val === "string") {
-    const lower = val.toLowerCase().trim();
-    if (lower === "true" || lower === "1" || lower === "yes") return true;
-    if (lower === "false" || lower === "0" || lower === "no") return false;
-  }
-  return defaultVal;
-}
-function resolveGateConfig(cliOptions) {
-  const merged = {
-    targetUrl: cliOptions.url || process.env.CPCG_TARGET_URL || process.env.STAGING_URL || "",
-    apiKey: cliOptions.apiKey || process.env.CPCG_LLM_API_KEY || process.env.OPENAI_API_KEY || process.env.ANTHROPIC_API_KEY || process.env.GEMINI_API_KEY || "",
-    llmProvider: cliOptions.llmProvider || process.env.CPCG_LLM_PROVIDER || "openai",
-    llmModel: cliOptions.llmModel || process.env.CPCG_LLM_MODEL || "gpt-4o",
-    autoFix: parseBoolean(
-      cliOptions.autoFix ?? process.env.CPCG_AUTO_FIX,
-      true
-    ),
-    failOnLeak: parseBoolean(
-      cliOptions.failOnLeak ?? process.env.CPCG_FAIL_ON_LEAK,
-      true
-    ),
-    reportOutput: cliOptions.reportOutput || process.env.CPCG_REPORT_OUTPUT || "reports/privacy-chaos-report.json",
-    sourceDir: cliOptions.sourceDir || process.env.CPCG_SOURCE_DIR || ".",
-    gitCommit: parseBoolean(
-      cliOptions.gitCommit ?? process.env.CPCG_GIT_COMMIT,
-      false
-    ),
-    createPr: parseBoolean(
-      cliOptions.createPr ?? process.env.CPCG_CREATE_PR,
-      false
-    ),
-    reportPdf: parseBoolean(cliOptions.reportPdf ?? process.env.CPCG_REPORT_PDF, false),
-    demo: parseBoolean(cliOptions.demo ?? process.env.CPCG_DEMO, false),
-    clientName: cliOptions.client || process.env.CPCG_CLIENT_NAME || void 0,
-    githubToken: cliOptions.githubToken || process.env.GITHUB_TOKEN || process.env.GH_TOKEN || "",
-    branchPrefix: cliOptions.branchPrefix || process.env.CPCG_BRANCH_PREFIX || "fix/cpcg-privacy",
-    baseBranch: cliOptions.baseBranch || process.env.CPCG_BASE_BRANCH || void 0,
-    headless: parseBoolean(
-      cliOptions.headless ?? process.env.CPCG_HEADLESS,
-      true
-    ),
-    timeoutMs: cliOptions.timeoutMs ? Number(cliOptions.timeoutMs) : process.env.CPCG_TIMEOUT_MS ? Number(process.env.CPCG_TIMEOUT_MS) : 3e4
-  };
-  const parsed = GateConfigSchema.safeParse(merged);
-  if (!parsed.success) {
-    const errorDetails = parsed.error.issues.map((i) => `  - ${i.path.join(".")}: ${i.message}`).join("\n");
-    throw new Error(`Invalid Configuration:
-${errorDetails}`);
-  }
-  return parsed.data;
-}
-
-// src/core/scanner/index.ts
-import { chromium } from "playwright";
-import fs from "fs/promises";
-import path from "path";
-
-// src/core/scanner/trackerDatabase.ts
-var KNOWN_TRACKERS = [
-  {
-    name: "Google Analytics 4",
-    category: "analytics",
-    patterns: [
-      /google-analytics\.com\/g\/collect/i,
-      /analytics\.google\.com\/g\/collect/i,
-      /google-analytics\.com\/j\/collect/i,
-      /google-analytics\.com\/collect/i
-    ]
-  },
-  {
-    name: "Google Tag Manager",
-    category: "analytics",
-    patterns: [
-      /googletagmanager\.com\/gtm\.js/i,
-      /googletagmanager\.com\/gtag\/js/i
-    ]
-  },
-  {
-    name: "Meta (Facebook) Pixel",
-    category: "marketing",
-    patterns: [
-      /connect\.facebook\.net\/.*\/fbevents\.js/i,
-      /facebook\.com\/tr(\/|\?)/i
-    ]
-  },
-  {
-    name: "TikTok Pixel",
-    category: "marketing",
-    patterns: [
-      /analytics\.tiktok\.com\/i18n\/pixel/i,
-      /analytics\.tiktok\.com\/api\/v2\/pixel/i
-    ]
-  },
-  {
-    name: "Criteo OneTag",
-    category: "marketing",
-    patterns: [
-      /static\.criteo\.net\/js\/ld\/ld\.js/i,
-      /gum\.criteo\.com\/sync/i
-    ]
-  },
-  {
-    name: "Hotjar",
-    category: "analytics",
-    patterns: [
-      /static\.hotjar\.com\/c\/hotjar-/i,
-      /script\.hotjar\.com\/modules\./i
-    ]
-  },
-  {
-    name: "LinkedIn Insight Tag",
-    category: "marketing",
-    patterns: [
-      /snap\.licdn\.com\/li\.lms-analytics\/insight\.min\.js/i,
-      /px\.ads\.linkedin\.com\/collect/i
-    ]
-  },
-  {
-    name: "Marketo Munchkin",
-    category: "marketing",
-    patterns: [
-      /munchkin\.marketo\.net\/munchkin\.js/i,
-      /munchkin\.marketo\.net\/munchkin/i
-    ]
-  },
-  {
-    name: "HubSpot",
-    category: "marketing",
-    patterns: [
-      /js\.hs-scripts\.com/i,
-      /js\.hs-analytics\.net/i,
-      /hubspot\.com\/_hcms\//i
-    ]
-  },
-  {
-    name: "Matomo",
-    category: "analytics",
-    patterns: [
-      /matomo\.php\?/i,
-      /matomo\.js/i,
-      /piwik\.php\?/i
-    ]
-  },
-  {
-    name: "YouTube Embed",
-    category: "marketing",
-    patterns: [
-      /youtube\.com\/embed\//i,
-      /youtube-nocookie\.com\/embed\//i,
-      /i\.ytimg\.com\/vi\//i
-    ]
-  },
-  {
-    name: "Google Maps Embed",
-    category: "functional",
-    patterns: [
-      /google\.com\/maps/i,
-      /maps\.googleapis\.com\//i,
-      /maps\.gstatic\.com\//i
-    ]
-  },
-  {
-    name: "Facebook Social Embed",
-    category: "marketing",
-    patterns: [
-      /facebook\.com\/plugins\//i,
-      /facebook\.com\/tr\?/i
-    ]
-  },
-  {
-    name: "Twitter/X Embed",
-    category: "marketing",
-    patterns: [
-      /platform\.twitter\.com\//i,
-      /syndication\.twitter\.com\//i
-    ]
-  }
-];
-function identifyTracker(url) {
-  for (const tracker of KNOWN_TRACKERS) {
-    for (const pattern of tracker.patterns) {
-      if (pattern.test(url)) {
-        return {
-          name: tracker.name,
-          category: tracker.category
-        };
-      }
-    }
-  }
-  return null;
-}
-
-// src/core/scanner/bannerLocators.ts
-var ACCEPT_SELECTORS = [
-  // OneTrust
-  "#onetrust-accept-btn-handler",
-  "#accept-recommended-btn-handler",
-  // Cookiebot
-  "#CybotCookiebotDialogBodyButtonAccept",
-  "#CybotCookiebotDialogBodyLevelButtonLevelOptinAllowAll",
-  // Usercentrics (incl. shadow-host button via text)
-  "#usercentrics-root [data-testid='uc-accept-all-button']",
-  "button[data-testid='uc-accept-all-button']",
-  // Consentmanager / Borlabs / Klaro
-  "#cmpbox-acceptall",
-  ".cmpboxbtn.cmpboxbtnyes",
-  "#BorlabsCookieBox .btn-accept-all",
-  "#klaro .klaro .confirm-button",
-  // Tealium (utag consent)
-  "#tealium-consent-banner .consent-accept",
-  ".tealium-consent-accept",
-  "button[data-tealium-consent='accept']",
-  // iubenda
-  "#iubenda-cs-banner .iubenda-cs-accept-btn",
-  ".iubenda-cs-accept-btn",
-  "#iubenda-cs-customize-btn + .iubenda-cs-accept-btn",
-  // etracker
-  "#ec-js-etracker-cmp .ec-cmp-accept",
-  "#etrackerCookieConsent .accept",
-  "button[data-et-consent='accept']",
-  // JustRelate
-  "#justrelate-consent .jr-accept",
-  ".justrelate-consent-accept",
-  "button[data-jr-consent='accept']",
-  // Didomi / Axeptio
-  "#didomi-notice-agree-button",
-  "#axeptio_btn_acceptAll",
-  // Generic
-  "#btn-accept",
-  "#accept-all",
-  "#cookie-accept",
-  "button[data-action='accept']",
-  "button:has-text('Alle akzeptieren')",
-  "button:has-text('Akzeptieren')",
-  "button:has-text('Accept all')",
-  "button:has-text('Accept')",
-  "button:has-text('Zustimmen')",
-  ".btn-accept"
-];
-var REJECT_SELECTORS = [
-  // OneTrust
-  "#onetrust-reject-all-handler",
-  // Cookiebot
-  "#CybotCookiebotDialogBodyButtonDecline",
-  "#CybotCookiebotDialogBodyLevelButtonLevelOptinDeclineAll",
-  // Usercentrics
-  "#usercentrics-root [data-testid='uc-deny-all-button']",
-  "button[data-testid='uc-deny-all-button']",
-  // Consentmanager / Borlabs / Klaro
-  "#cmpbox-createnecessary",
-  ".cmpboxbtn.cmpboxbtndeny",
-  "#BorlabsCookieBox .btn-only-essential",
-  "#klaro .klaro .decline-button",
-  // Tealium / iubenda / etracker / JustRelate
-  ".tealium-consent-reject",
-  "#tealium-consent-banner .consent-reject",
-  ".iubenda-cs-reject-btn",
-  "#ec-js-etracker-cmp .ec-cmp-reject",
-  "button[data-et-consent='reject']",
-  ".justrelate-consent-reject",
-  "button[data-jr-consent='reject']",
-  // Didomi / Axeptio
-  "#didomi-notice-disagree-button",
-  "#axeptio_btn_dismiss",
-  // Generic
-  "#btn-reject",
-  "#btn-revoke",
-  // Sourcepoint
-  ".sp_choice_type_12",
-  ".sp_choice_type_13",
-  "button[title='Ablehnen']",
-  "button[title='Einstellungen']",
-  "#btn-revoke",
-  // Sourcepoint (Axel Springer, viele DACH-Publisher)
-  ".sp_choice_type_11",
-  "button[title='Alle akzeptieren']",
-  "[aria-label='Alle akzeptieren']",
-  // Generic text fallbacks handled below
-  "#reject-all",
-  "#cookie-reject",
-  "button[data-action='reject']",
-  "button:has-text('Ablehnen')",
-  "button:has-text('Reject all')",
-  "button:has-text('Reject')",
-  "button:has-text('Nur notwendige')",
-  "button:has-text('Essential only')",
-  ".btn-reject"
-];
-async function clickFirstMatching(page, selectors, timeoutMs = 1500) {
-  const perSelector = Math.max(250, timeoutMs / selectors.length);
-  for (const selector of selectors) {
-    try {
-      const locator = page.locator(selector).first();
-      const isVisible = await locator.isVisible({ timeout: perSelector }).catch(() => false);
-      if (isVisible) {
-        await locator.click({ timeout: 1e3 }).catch(() => {
-        });
-        return true;
-      }
-    } catch {
-    }
-  }
-  return false;
-}
-
-// src/core/scanner/index.ts
-function isOnTargetOrigin(pageUrl, targetOrigin) {
-  if (!pageUrl || pageUrl === "about:blank") return true;
-  try {
-    return new URL(pageUrl).origin === targetOrigin;
-  } catch {
-    return false;
-  }
-}
-async function clickFirstSameOriginLink(page, targetOrigin) {
-  return page.evaluate((origin) => {
-    const anchors = Array.from(document.querySelectorAll("a[href]"));
-    for (const a of anchors) {
-      const href = a.getAttribute("href");
-      if (!href || href.startsWith("#")) continue;
-      try {
-        const resolved = new URL(href, location.href);
-        if (resolved.origin === origin) {
-          a.click();
-          return true;
-        }
-      } catch {
-      }
-    }
-    return false;
-  }, targetOrigin);
-}
-var ChaosScanner = class {
-  async scan(config) {
-    const startTime = Date.now();
-    const violations = [];
-    const passedScenarios = [];
-    const failedScenarios = [];
-    const evidence = [];
-    const targetOrigin = new URL(config.targetUrl).origin;
-    const want = (s) => !config.scenarios?.length || config.scenarios.includes(s);
-    let browser = null;
-    try {
-      try {
-        const preflight = await fetch(config.targetUrl, { method: "HEAD", signal: AbortSignal.timeout(3e3) });
-      } catch (connErr) {
-        try {
-          await fetch(config.targetUrl, { method: "GET", signal: AbortSignal.timeout(3e3) });
-        } catch {
-          throw new Error(
-            `Target URL is unreachable: ${config.targetUrl}. Please ensure your server or local fixture is running (e.g. 'pnpm run serve:fixture').`
-          );
-        }
-      }
-      browser = await chromium.launch({
-        headless: config.headless
-      });
-      if (want("happy-path-denied")) await this.runScenario(
-        "happy-path-denied",
-        browser,
-        config,
-        targetOrigin,
-        async (page, _captured, ctx) => {
-          ctx.log("goto");
-          await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-          if (_captured.length > 0) {
-            ctx.log(`pre-consent-leak-on-load(${_captured.length})`);
-          }
-          const denied = await clickFirstMatching(page, REJECT_SELECTORS, 2e3);
-          ctx.log(denied ? "click:reject" : "click:reject-missing");
-          if (!denied) return "not-checkable";
-          ctx.setPhase("post-reject");
-          ctx.log("phase:post-reject");
-          await page.waitForTimeout(500);
-          return _captured.length === 0;
-        },
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("happy-path-accepted")) await this.runScenario(
-        "happy-path-accepted",
-        browser,
-        config,
-        targetOrigin,
-        async (page, _captured, ctx) => {
-          ctx.log("goto");
-          await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-          if (_captured.length > 0) {
-            ctx.log(`pre-consent-leak-on-load(${_captured.length})`);
-          }
-          const preConsentHits = _captured.length;
-          const accepted = await clickFirstMatching(page, ACCEPT_SELECTORS, 2e3);
-          ctx.log(accepted ? "click:accept" : "click:accept-missing");
-          if (!accepted) return "not-checkable";
-          ctx.setPhase("post-accept");
-          ctx.log("phase:post-accept");
-          await page.waitForTimeout(1200);
-          await page.evaluate(() => {
-            window.dispatchEvent(new Event("scroll"));
-            window.dispatchEvent(new Event("click"));
-          });
-          await page.waitForTimeout(800);
-          return preConsentHits === 0;
-        },
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("fast-click")) await this.runScenario(
-        "fast-click",
-        browser,
-        config,
-        targetOrigin,
-        async (page, _captured, ctx) => {
-          ctx.log("goto:commit");
-          await page.goto(config.targetUrl, { waitUntil: "commit", timeout: config.timeoutMs });
-          await page.waitForSelector("a[href]", { timeout: 2e3 }).catch(() => {
-          });
-          const clicked = await clickFirstSameOriginLink(page, targetOrigin);
-          ctx.log(clicked ? "click:same-origin-link" : "click:link-missing");
-          if (!clicked) return "not-checkable";
-          await page.waitForTimeout(500);
-          return _captured.length === 0;
-        },
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("state-manipulation")) await this.runScenario(
-        "state-manipulation",
-        browser,
-        config,
-        targetOrigin,
-        async (page, _captured, ctx) => {
-          ctx.log("goto");
-          await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-          await page.waitForTimeout(300);
-          if (_captured.length > 0) {
-            ctx.log(`pre-consent-leak-on-load(${_captured.length})`);
-          }
-          const preConsentHits = _captured.length;
-          const accepted = await clickFirstMatching(page, ACCEPT_SELECTORS, 1500);
-          ctx.log(accepted ? "click:accept" : "click:accept-missing");
-          if (!accepted) return "not-checkable";
-          ctx.setPhase("post-accept");
-          ctx.log("phase:post-accept");
-          await page.waitForTimeout(600);
-          await page.evaluate(() => {
-            localStorage.clear();
-            sessionStorage.clear();
-          });
-          const context = page.context();
-          await context.clearCookies();
-          ctx.setPhase("post-wipe");
-          ctx.log("wipe:storage+cookies phase:post-wipe");
-          await page.reload({ waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-          ctx.log("reload:post-wipe");
-          await page.waitForTimeout(400);
-          await page.evaluate(() => {
-            window.dispatchEvent(new Event("scroll"));
-            window.dispatchEvent(new Event("click"));
-            document.body?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
-          });
-          ctx.log("events:post-wipe");
-          await page.waitForTimeout(800);
-          return preConsentHits === 0;
-        },
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("network-drop")) await this.runScenario(
-        "network-drop",
-        browser,
-        config,
-        targetOrigin,
-        async (page, _captured, ctx) => {
-          let cmpBlocked = false;
-          await page.route(
-            (url) => {
-              const href = url.href;
-              if (href === config.targetUrl) return false;
-              if (/\.html?([?#]|$)/i.test(href)) return false;
-              return /consent|cookiebot|onetrust|klaro|usercentrics/i.test(href);
-            },
-            (route) => {
-              cmpBlocked = true;
-              return route.abort();
-            }
-          );
-          ctx.log("goto:cmp-blocked");
-          await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-          await page.waitForTimeout(600);
-          if (!cmpBlocked) {
-            ctx.log("cmp-script-not-found");
-            return "not-checkable";
-          }
-          return _captured.length === 0;
-        },
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("consent-revoked")) await this.runRevocationScenario(
-        browser,
-        config,
-        targetOrigin,
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("category-selective")) await this.runCategorySelectiveScenario(
-        browser,
-        config,
-        targetOrigin,
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("consent-persistence")) await this.runPersistenceScenario(
-        browser,
-        config,
-        targetOrigin,
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("banner-ignored")) await this.runBannerIgnoredScenario(
-        browser,
-        config,
-        targetOrigin,
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("subpage-spa")) await this.runSubpageSpaScenario(
-        browser,
-        config,
-        targetOrigin,
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("cmp-failure")) await this.runCmpFailureScenario(
-        browser,
-        config,
-        targetOrigin,
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("embed-leaks")) await this.runEmbedScenario(
-        browser,
-        config,
-        targetOrigin,
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("consent-mode-v2")) await this.runConsentModeV2Scenario(
-        browser,
-        config,
-        targetOrigin,
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("duplicate-events")) await this.runDuplicateEventsScenario(
-        browser,
-        config,
-        targetOrigin,
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-      if (want("mobile-usability")) await this.runMobileUsabilityScenario(
-        browser,
-        config,
-        targetOrigin,
-        violations,
-        passedScenarios,
-        failedScenarios,
-        evidence
-      );
-    } finally {
-      if (browser) {
-        await browser.close().catch(() => {
-        });
-      }
-    }
-    const durationMs = Date.now() - startTime;
-    const allClean = violations.length === 0 && failedScenarios.length === 0;
-    const naCount = evidence.filter((e) => e.status === "not-applicable").length;
-    const summary = allClean ? `Clean: ${passedScenarios.length} scenario(s) passed${naCount ? `, ${naCount} not applicable` : ""} for ${config.targetUrl}. No privacy leaks detected.` : `Privacy issues: ${violations.length} tracker leak(s), ${failedScenarios.length} scenario(s) not clean.`;
-    return {
-      targetUrl: config.targetUrl,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      durationMs,
-      totalViolations: violations.length,
-      violations,
-      passedScenarios,
-      failedScenarios,
-      summary,
-      evidence
-    };
-  }
-  async snapshotStorage(page) {
-    const cookies = (await page.context().cookies().catch(() => [])).map((c) => `${c.name}@${c.domain}`);
-    const local = await page.evaluate(() => Object.keys(localStorage)).catch(() => []);
-    const session = await page.evaluate(() => Object.keys(sessionStorage)).catch(() => []);
-    const localStorageEntries = await page.evaluate(() => {
-      const out = [];
-      const interesting = /consent|cookie|cpcg|optanon|usercentrics|didomi|category|purpose|analytics|marketing|statistic/i;
-      for (const key of Object.keys(localStorage)) {
-        if (!interesting.test(key)) continue;
-        const v = localStorage.getItem(key) ?? "";
-        out.push({ key, value: v.length > 120 ? v.slice(0, 120) + "\u2026" : v });
-      }
-      return out;
-    }).catch(() => []);
-    return {
-      cookies,
-      localStorageKeys: local,
-      sessionStorageKeys: session,
-      localStorageEntries: localStorageEntries.length ? localStorageEntries : void 0
-    };
-  }
-  /**
-   * Fünf Kern-Chaos-Szenarien mit vollständigem Evidence-Record.
-   * Phasen statt Capture-Wipe: Pre-Consent-Funde bleiben immer erhalten.
-   * Ergebnis: passed nur bei ausgeführter Aktion und null Illegal-Funden.
-   */
-  async runScenario(scenario, browser, _config, targetOrigin, runner, violations, passedScenarios, failedScenarios, evidence) {
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    const scenarioViolations = [];
-    const timeline = [];
-    const actionSequence = [];
-    const phaseById = /* @__PURE__ */ new Map();
-    let phase = "pre-consent";
-    page.on("request", (req) => {
-      const frameUrl = req.frame()?.url() || page.url();
-      if (!isOnTargetOrigin(frameUrl, targetOrigin)) {
-        return;
-      }
-      const url = req.url();
-      const tracker = identifyTracker(url);
-      timeline.push({
-        at: (/* @__PURE__ */ new Date()).toISOString(),
-        url,
-        trackerName: tracker?.name,
-        trackerCategory: tracker?.category,
-        phase
-      });
-      if (tracker) {
-        const ruleId = phase === "post-wipe" ? "tracking-without-consent" : phase === "post-reject" || phase === "post-reject-restart" ? "tracking-after-deny" : phase === "post-revoke" ? "tracking-after-revoke" : "pre-consent-tracking";
-        const violation = {
-          id: `${scenario}-${Date.now()}-${Math.random().toString(36).substring(2, 6)}`,
-          ruleId,
-          scenario,
-          trackerName: tracker.name,
-          trackerCategory: tracker.category,
-          requestUrl: url,
-          method: req.method(),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          description: `Unauthorized ${tracker.name} (${tracker.category}) request triggered during scenario '${scenario}'.`
-        };
-        scenarioViolations.push(violation);
-        phaseById.set(violation.id, phase);
-      }
-    });
-    const storageBefore = await this.snapshotStorage(page);
-    let outcome = false;
-    try {
-      outcome = await runner(page, scenarioViolations, {
-        setPhase: (p) => {
-          phase = p;
-        },
-        log: (a) => actionSequence.push(a)
-      });
-    } catch (err) {
-      outcome = false;
-      actionSequence.push(`error:${String(err).slice(0, 80)}`);
-    }
-    const storageAfter = await this.snapshotStorage(page).catch(() => storageBefore);
-    await context.close().catch(() => {
-    });
-    const illegal = scenarioViolations.filter((v) => {
-      const p = phaseById.get(v.id) ?? "pre-consent";
-      return p === "pre-consent" || p === "post-wipe" || p === "post-revoke" || p === "post-reject" || p === "post-reject-restart";
-    });
-    const postAccept = scenarioViolations.length - illegal.length;
-    let status;
-    if (outcome === "not-checkable") {
-      status = "not-checkable";
-      failedScenarios.push(scenario);
-      violations.push(...illegal);
-    } else if (illegal.length > 0 || outcome === false) {
-      status = "suspicious";
-      failedScenarios.push(scenario);
-      violations.push(...illegal);
-    } else {
-      status = "passed";
-      passedScenarios.push(scenario);
-    }
-    const note = illegal.length > 0 ? actionSequence.some((a) => a.startsWith("pre-consent-leak-on-load")) ? `Pre-Consent-Leak bereits beim Seitenaufruf (${illegal.filter((v) => (phaseById.get(v.id) ?? "") === "pre-consent").length} Request(s)). Szenario wurde trotzdem ausgef\xFChrt und vollst\xE4ndig dokumentiert.` : `${illegal.length} Tracker-Request(s) in unzul\xE4ssiger Phase (pre-consent/post-reject/post-wipe/post-revoke).` : status === "passed" ? `Aktion ausgef\xFChrt, keine Tracker-Requests vor der Zustimmung.${postAccept ? ` ${postAccept} post-accept Request(s) (Re-Activation, legal).` : ""}` : status === "not-checkable" ? "Szenario nicht pr\xFCfbar  \u2014  erforderliche Aktion (Button/Link) nicht ausf\xFChrbar (kein gr\xFCnes H\xE4kchen)." : "Szenario ohne sauberen Nachweis abgeschlossen.";
-    evidence.push({
-      scenario,
-      status,
-      note,
-      actionSequence,
-      requestTimeline: timeline,
-      storageBefore,
-      storageAfter,
-      targetUrl: _config.targetUrl,
-      checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-  }
-  async snap(page, scenario, label, shots, acts, actionSequence) {
-    const dir = path.resolve("reports/evidence");
-    await fs.mkdir(dir, { recursive: true });
-    const at = (/* @__PURE__ */ new Date()).toISOString();
-    const file = path.join(dir, `${scenario}-${label}-${Date.now()}.png`);
-    await page.screenshot({ path: file, fullPage: true }).catch(() => {
-    });
-    shots.push({ label, path: file, at });
-    actionSequence.push(`screenshot:${label}`);
-    acts.push({ at, action: `screenshot:${label}` });
-  }
-  logAct(acts, actionSequence, action) {
-    const at = (/* @__PURE__ */ new Date()).toISOString();
-    actionSequence.push(action);
-    acts.push({ at, action });
-  }
-  /**
-   * Widerruf: erst akzeptieren, dann widerrufen. Prüft (a) keine neuen Tracker-Requests
-   * nach Widerruf, (b) ob Tracking-IDs in Cookies/Storage zurückbleiben.
-   * Kein Widerruf-Button — status «not-checkable» (nie grün).
-   */
-  /**
-   * Kategorien-Granularität: Statistik erlaubt, Marketing abgelehnt.
-   * Marketing-Tracker (Meta, TikTok, LinkedIn, Criteo ⬦) dürfen danach NICHT feuern.
-   * Keine Kategorie-UI — status «not-checkable».
-   */
-  async runCategorySelectiveScenario(browser, config, targetOrigin, violations, passedScenarios, failedScenarios, evidence) {
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    const timeline = [];
-    const actionSequence = [];
-    let phase = "pre-consent";
-    page.on("request", (req) => {
-      const frameUrl = req.frame()?.url() || page.url();
-      if (!isOnTargetOrigin(frameUrl, targetOrigin)) return;
-      const hit = identifyTracker(req.url());
-      timeline.push({ at: (/* @__PURE__ */ new Date()).toISOString(), url: req.url(), trackerName: hit?.name, trackerCategory: hit?.category, phase });
-      if (hit && phase === "post-selection" && hit.category === "marketing") {
-        violations.push({
-          id: `category-selective-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
-          ruleId: "tracking-declined-category",
-          scenario: "category-selective",
-          trackerName: hit.name,
-          trackerCategory: hit.category,
-          requestUrl: req.url(),
-          method: req.method(),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          description: `${hit.name} feuert, obwohl Marketing-Kategorie abgelehnt wurde.`
-        });
-      }
-    });
-    try {
-      await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-      actionSequence.push("goto");
-      const storageBefore = await this.snapshotStorage(page);
-      await clickFirstMatching(page, ["#btn-settings", "button[data-action='settings']", ".open-prefs"], 1200);
-      actionSequence.push("click:settings");
-      await page.waitForTimeout(200);
-      const marketingOff = await page.evaluate(() => {
-        const boxes = Array.from(
-          document.querySelectorAll('input[type="checkbox"]')
-        );
-        let touched = 0;
-        for (const box of boxes) {
-          const label = (box.id + " " + box.name + " " + (box.closest("label")?.textContent || "") + " " + (box.getAttribute("aria-label") || "")).toLowerCase();
-          if (/marketing|advertising|werbung|ads/.test(label)) {
-            if (box.checked) box.click();
-            touched++;
-          }
-          if (/statistic|analytics|statistik|messung/.test(label)) {
-            if (!box.checked) box.click();
-            touched++;
-          }
-        }
-        return touched;
-      }).catch(() => 0);
-      if (marketingOff === 0) {
-        const storageAfter2 = await this.snapshotStorage(page);
-        evidence.push({
-          scenario: "category-selective",
-          status: "not-checkable",
-          note: "Keine Kategorie-Auswahl (Statistik/Marketing) im Banner gefunden \u2014 nicht pr\xFCfbar.",
-          actionSequence,
-          requestTimeline: timeline,
-          storageBefore,
-          storageAfter: storageAfter2,
-          targetUrl: config.targetUrl,
-          checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-        failedScenarios.push("category-selective");
-        return;
-      }
-      phase = "post-selection";
-      actionSequence.push(`categories:marketing-off(${marketingOff})`);
-      const saved = await clickFirstMatching(page, ["#btn-save", "button[data-action='save']", ".save-settings"], 1500) || await clickFirstMatching(page, ACCEPT_SELECTORS, 1500);
-      actionSequence.push(saved ? "click:save-choices" : "click:save-missing");
-      if (!saved) {
-        const storageAfterNoSave = await this.snapshotStorage(page);
-        evidence.push({
-          scenario: "category-selective",
-          status: "not-checkable",
-          note: "Kategorie-Auswahl konnte nicht gespeichert werden \u2014 kein Save/Accept-Button (kein gr\xFCnes H\xE4kchen).",
-          actionSequence,
-          requestTimeline: timeline,
-          storageBefore,
-          storageAfter: storageAfterNoSave,
-          targetUrl: config.targetUrl,
-          checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-        failedScenarios.push("category-selective");
-        return;
-      }
-      await page.waitForTimeout(1800);
-      const storageAfter = await this.snapshotStorage(page);
-      const decisionPhase = "post-selection";
-      const marketingLeaks = timeline.filter(
-        (e) => e.phase === decisionPhase && e.trackerName && e.trackerCategory === "marketing"
-      );
-      const preConsentLeaks = timeline.filter(
-        (e) => e.phase === "pre-consent" && e.trackerName
-      );
-      const analyticsOk = timeline.filter(
-        (e) => e.phase === decisionPhase && e.trackerName && e.trackerCategory === "analytics"
-      );
-      const catValues = (storageAfter.localStorageEntries ?? []).filter((e) => /analytics|marketing|consent|category/i.test(e.key)).map((e) => `${e.key}=${e.value}`).join(", ");
-      const decisionRequests = timeline.filter((e) => e.phase === "post-selection" && e.trackerName);
-      const status = marketingLeaks.length > 0 ? "suspicious" : "passed";
-      evidence.push({
-        scenario: "category-selective",
-        status,
-        note: status === "passed" ? [
-          preConsentLeaks.length > 0 ? `Kategorie-Auswahl bestanden (keine Marketing-Tracker nach \xABnur Statistik\xBB); zus\xE4tzlich ${preConsentLeaks.length} Pre-Consent-Request(s) vor der Auswahl dokumentiert.` : "Nach \xABnur Statistik\xBB keine Marketing-Tracker-Requests beobachtet.",
-          analyticsOk.length > 0 ? `Erlaubtes Analytics-Tracking nach Freigabe belegt (${analyticsOk.length} Request(s), Phase post-selection).` : "Erlaubtes Analytics-Tracking nach Freigabe nicht beobachtet.",
-          catValues ? `Gespeicherte Kategorien: ${catValues}.` : "",
-          `Pr\xFCfumfang: Klick auf \xABAuswahl speichern\xBB (Marketing aus, Statistik an), danach 1,8 s Beobachtungsfenster mit ${decisionRequests.length} Tracker-Request(s) in Phase post-selection. Interaktionen: Settings \xF6ffnen, Checkboxen setzen, Speichern.`
-        ].filter(Boolean).join(" ") : `${marketingLeaks.length} Marketing-Tracker trotz abgelehnter Kategorie aktiv.`,
-        actionSequence,
-        requestTimeline: timeline,
-        storageBefore,
-        storageAfter,
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      if (status === "passed") passedScenarios.push("category-selective");
-      else failedScenarios.push("category-selective");
-    } catch (err) {
-      evidence.push({
-        scenario: "category-selective",
-        status: "not-checkable",
-        note: `Szenario mit Fehler abgebrochen: ${String(err).slice(0, 120)}`,
-        actionSequence: [],
-        requestTimeline: [],
-        storageBefore: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        storageAfter: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      failedScenarios.push("category-selective");
-    } finally {
-      await context.close().catch(() => {
-      });
-    }
-  }
-  /**
-   * Entscheidung merken: nach «Ablehnen» Reload, Unterseiten-URL und Browser-Neustart
-   * (storageState). Tracker müssen ausbleiben, die Entscheidung muss erhalten bleiben.
-   */
-  async runPersistenceScenario(browser, config, targetOrigin, violations, passedScenarios, failedScenarios, evidence) {
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    const timeline = [];
-    const actionSequence = [];
-    let phase = "pre-consent";
-    let denied = false;
-    const onReq = (req) => {
-      const frameUrl = req.frame()?.url() || page.url();
-      if (!isOnTargetOrigin(frameUrl, targetOrigin)) return;
-      const hit = identifyTracker(req.url());
-      timeline.push({ at: (/* @__PURE__ */ new Date()).toISOString(), url: req.url(), trackerName: hit?.name, trackerCategory: hit?.category, phase });
-      if (hit && denied && (phase === "post-reject" || phase === "post-reject-restart")) {
-        violations.push({
-          id: `consent-persistence-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
-          ruleId: "tracking-after-deny",
-          scenario: "consent-persistence",
-          trackerName: hit.name,
-          trackerCategory: hit.category,
-          requestUrl: req.url(),
-          method: req.method(),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          description: `${hit.name} feuert, obwohl Ablehnung gespeichert sein sollte.`
-        });
-      }
-    };
-    page.on("request", onReq);
-    try {
-      await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-      actionSequence.push("goto");
-      const storageBefore = await this.snapshotStorage(page);
-      denied = await clickFirstMatching(page, REJECT_SELECTORS, 2500);
-      actionSequence.push(denied ? "click:reject" : "click:reject-missing");
-      if (!denied) {
-        const storageAfter2 = await this.snapshotStorage(page);
-        evidence.push({
-          scenario: "consent-persistence",
-          status: "not-checkable",
-          note: "Kein Ablehnen-Button \u2014 Persistenz der Entscheidung nicht pr\xFCfbar.",
-          actionSequence,
-          requestTimeline: timeline,
-          storageBefore,
-          storageAfter: storageAfter2,
-          targetUrl: config.targetUrl,
-          checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-        failedScenarios.push("consent-persistence");
-        return;
-      }
-      await page.waitForTimeout(600);
-      const consentStillSet = await page.evaluate(() => {
-        const keys = ["cpcg_consent", "OptanonConsent", "CookieConsent", "usercentrics-consent", "consent"];
-        const ls = keys.filter((k) => {
-          const v = localStorage.getItem(k);
-          return v && v !== "accepted";
-        }).length;
-        const cookieKeys = /OptanonConsent|CookieConsent|usercentrics|consent/i;
-        const ck = document.cookie.split(";").map((c) => c.trim().split("=")[0]).filter((name) => cookieKeys.test(name)).length;
-        return ls + ck;
-      }).catch(() => 0);
-      phase = "post-reject";
-      await page.reload({ waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-      actionSequence.push("reload");
-      await page.waitForTimeout(500);
-      await page.goto(`${targetOrigin}/subpage-persistence-check`, {
-        waitUntil: "domcontentloaded",
-        timeout: config.timeoutMs
-      }).catch(() => {
-      });
-      actionSequence.push("goto:subpage");
-      await page.waitForTimeout(400);
-      const storageAtRestart = await this.snapshotStorage(page);
-      const state = await context.storageState();
-      await context.close();
-      const ctx2 = await browser.newContext({ storageState: state });
-      const page2 = await ctx2.newPage();
-      page2.on("request", (req) => {
-        const frameUrl = req.frame()?.url() || page2.url();
-        if (!isOnTargetOrigin(frameUrl, targetOrigin)) return;
-        const hit = identifyTracker(req.url());
-        timeline.push({
-          at: (/* @__PURE__ */ new Date()).toISOString(),
-          url: req.url(),
-          trackerName: hit?.name,
-          trackerCategory: hit?.category,
-          phase: "post-reject-restart"
-        });
-        if (hit && denied) {
-          violations.push({
-            id: `consent-persistence-restart-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
-            ruleId: "tracking-after-deny",
-            scenario: "consent-persistence",
-            trackerName: hit.name,
-            trackerCategory: hit.category,
-            requestUrl: req.url(),
-            method: req.method(),
-            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-            description: `${hit.name} feuert nach Ablehnung und Browser-Neustart.`
-          });
-        }
-      });
-      await page2.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-      actionSequence.push("restart:storageState");
-      await page2.waitForTimeout(800);
-      await ctx2.close();
-      const storageAfter = await this.snapshotStorage(page2).catch(() => storageAtRestart);
-      const leaks = timeline.filter((e) => e.trackerName && (e.phase === "post-reject" || e.phase === "post-reject-restart"));
-      const deniedPersists = consentStillSet > 0;
-      const status = leaks.length > 0 ? "suspicious" : !deniedPersists ? "not-checkable" : "passed";
-      evidence.push({
-        scenario: "consent-persistence",
-        status,
-        note: status === "passed" ? "Ablehnung \xFCberlebt Reload, Unterseite und Neustart; kein Tracking ohne erneute Zustimmung." : status === "suspicious" ? `${leaks.length} Tracker-Request(s) trotz gespeicherter Ablehnung.` : "Keine konsistente Entscheidung im Storage gefunden \u2014 nicht pr\xFCfbar.",
-        actionSequence,
-        requestTimeline: timeline,
-        storageBefore,
-        storageAfter,
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      if (status === "passed") passedScenarios.push("consent-persistence");
-      else failedScenarios.push("consent-persistence");
-    } catch (err) {
-      evidence.push({
-        scenario: "consent-persistence",
-        status: "not-checkable",
-        note: `Szenario mit Fehler abgebrochen: ${String(err).slice(0, 120)}`,
-        actionSequence: [],
-        requestTimeline: [],
-        storageBefore: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        storageAfter: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      failedScenarios.push("consent-persistence");
-    } finally {
-      await context.close().catch(() => {
-      });
-    }
-  }
-  /**
-   * Banner ignorieren: kein Klick, nur warten, scrollen, Navigation.
-   * Tracker dürfen nicht über Timer/Scroll/Input allein starten.
-   */
-  /**
-   * Unterseiten & SPA: Direkteinstieg auf Subpage, dann Client-Navigation ohne Reload.
-   * Consent-Schutz muss auch dort greifen.
-   */
-  /**
-   * CMP langsam oder defekt: CMP-Skripte verzögern/abbringen, dann beobachten,
-   * ob im Zeitfenster Tracker starten (Default-State-Leak).
-   */
-  /**
-   * Eingebettete Inhalte (YouTube, Maps, Social, Chat): Drittanbieter-Requests
-   * vor Consent-Freigabe des Embeds. Inklusive iframe-src und nachgeladenen SDKs.
-   */
-  /**
-   * Consent Mode v2: dataLayer-Konsens-Zustände (ad_storage, analytics_storage, ⬦)
-   * gegen tatsächliche Google-Requests und Cookies trennen.
-   * Bei Basic dürfen nach Ablehnung keine Nutzungsdaten laufen; bei Advanced
-   * sind cookielose Pings möglich — beides wird getrennt ausgewiesen.
-   */
-  /**
-   * Doppelte Events: ein Seitenaufruf nach Consent darf page_view nicht doppelt zählen
-   * (Plugin + GTM parallel). First-Party-Heuristik: verdächtige same-origin Endpunkte
-   * (collect, pixel, track) werden markiert — Server-zu-Server ist von aussen begrenzt beweisbar.
-   */
-  /**
-   * Mobile: iPhone-Viewport. Reject und Settings müssen sichtbar und klickbar sein.
-   * Nur Accept bedienbar — suspicious (Dark Pattern); keine Buttons — not-checkable.
-   */
-  async runMobileUsabilityScenario(browser, config, targetOrigin, _violations, passedScenarios, failedScenarios, evidence) {
-    const context = await browser.newContext({
-      viewport: { width: 390, height: 844 },
-      isMobile: true,
-      hasTouch: true,
-      userAgent: "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"
-    });
-    const page = await context.newPage();
-    const actionSequence = [];
-    const actionTimeline = [];
-    const screenshots = [];
-    const timeline = [];
-    try {
-      await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-      this.logAct(actionTimeline, actionSequence, "goto:mobile-390x844");
-      const storageBefore = await this.snapshotStorage(page);
-      await this.snap(page, "mobile-usability", "01-mobile-banner", screenshots, actionTimeline, actionSequence);
-      const probe = async (selectors) => {
-        for (const sel of selectors) {
-          const loc = page.locator(sel).first();
-          const visible = await loc.isVisible({ timeout: 400 }).catch(() => false);
-          if (visible) {
-            const box = await loc.boundingBox().catch(() => null);
-            const w = Math.round(box?.width ?? 0);
-            const h = Math.round(box?.height ?? 0);
-            return { found: true, selector: sel, visible: true, touchOk: w >= 24 && h >= 24, width: w, height: h };
-          }
-        }
-        return { found: false, selector: "", visible: false, touchOk: false, width: 0, height: 0 };
-      };
-      const accept = await probe(ACCEPT_SELECTORS);
-      const reject = await probe(REJECT_SELECTORS);
-      const describe = (p) => `${p.found ? "gefunden" : "fehlt"} sichtbar=${p.visible ? "ja" : "nein"} ${p.width}x${p.height}px touch=${p.touchOk ? "ok" : "zu-klein"}`;
-      this.logAct(actionTimeline, actionSequence, `probe:accept ${describe(accept)}`);
-      this.logAct(actionTimeline, actionSequence, `probe:reject ${describe(reject)}`);
-      let rejectTapOk = false;
-      if (reject.found) {
-        const loc = page.locator(reject.selector).first();
-        rejectTapOk = await loc.tap({ timeout: 2e3 }).then(() => true).catch(() => loc.click({ timeout: 2e3 }).then(() => true).catch(() => false));
-        this.logAct(actionTimeline, actionSequence, `tap:reject=${rejectTapOk ? "ok" : "failed"}`);
-      }
-      await page.waitForTimeout(400);
-      const storageAfter = await this.snapshotStorage(page);
-      const acceptUsable = accept.found && accept.visible && accept.touchOk;
-      const rejectUsable = reject.found && reject.visible && reject.touchOk;
-      const status = !accept.found && !reject.found ? "not-checkable" : acceptUsable && rejectUsable && rejectTapOk ? "passed" : acceptUsable && reject.found && !rejectUsable ? "suspicious" : "not-checkable";
-      const probeSummary = `Accept: ${describe(accept)} \xB7 Reject: ${describe(reject)} \xB7 Tap-Reject: ${rejectTapOk ? "ok" : "failed/keiner"}`;
-      evidence.push({
-        scenario: "mobile-usability",
-        status,
-        note: status === "passed" ? `Accept und Reject im Mobile-Viewport bedienbar. ${probeSummary}` : status === "suspicious" ? `Nur \xABAkzeptieren\xBB ist bedienbar, \xABAblehnen\xBB nicht (Dark-Pattern-Verdacht). ${probeSummary}` : `Ohne eindeutigen Nachweis nicht pr\xFCfbar. ${probeSummary}`,
-        actionSequence,
-        actionTimeline,
-        requestTimeline: timeline,
-        storageBefore,
-        storageAfter,
-        screenshots,
-        screenshotPath: screenshots[0]?.path,
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      if (status === "passed") passedScenarios.push("mobile-usability");
-      else failedScenarios.push("mobile-usability");
-    } catch (err) {
-      evidence.push({
-        scenario: "mobile-usability",
-        status: "not-checkable",
-        note: `Szenario mit Fehler abgebrochen: ${String(err).slice(0, 120)}`,
-        actionSequence: [],
-        requestTimeline: [],
-        storageBefore: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        storageAfter: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      failedScenarios.push("mobile-usability");
-      await context.close().catch(() => {
-      });
-    } finally {
-      await context.close().catch(() => {
-      });
-    }
-  }
-  async runDuplicateEventsScenario(browser, config, targetOrigin, violations, passedScenarios, failedScenarios, evidence) {
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    const timeline = [];
-    const actionSequence = [];
-    const actionTimeline = [];
-    const screenshots = [];
-    const pageviews = [];
-    const firstPartySuspicious = [];
-    let phase = "pre-consent";
-    page.on("request", (req) => {
-      const url = req.url();
-      const hit = identifyTracker(url);
-      timeline.push({ at: (/* @__PURE__ */ new Date()).toISOString(), url, trackerName: hit?.name, phase: "post-accept" });
-      if (/\/(collect|pixel|track|beacon|analytics\.php)/i.test(url) && /page_view|pageview|en=page/i.test(url)) {
-        pageviews.push(url);
-      }
-      try {
-        if (url.startsWith(targetOrigin) && /\/(collect|pixel|track|beacon|_stm|_paq)/i.test(url)) {
-          firstPartySuspicious.push(url);
-        }
-      } catch {
-      }
-    });
-    try {
-      await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-      this.logAct(actionTimeline, actionSequence, "goto");
-      const storageBefore = await this.snapshotStorage(page);
-      const accepted = await clickFirstMatching(page, ACCEPT_SELECTORS, 2e3);
-      this.logAct(actionTimeline, actionSequence, accepted ? "click:accept" : "click:accept-missing");
-      phase = "post-accept";
-      await page.waitForTimeout(800);
-      pageviews.length = 0;
-      firstPartySuspicious.length = 0;
-      await page.reload({ waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-      this.logAct(actionTimeline, actionSequence, "reload:after-consent");
-      await page.waitForTimeout(1500);
-      await this.snap(page, "duplicate-events", "01-after-reload", screenshots, actionTimeline, actionSequence);
-      const storageAfter = await this.snapshotStorage(page);
-      const duplicates = pageviews.length > 1;
-      const status = pageviews.length === 0 ? "not-checkable" : duplicates ? "suspicious" : "passed";
-      evidence.push({
-        scenario: "duplicate-events",
-        status,
-        note: [
-          `page_view-Beacons nach Consent-Reload: ${pageviews.length}`,
-          pageviews.length === 0 ? "Keine page_view-Beacons erfasst \u2014 Szenario nicht pr\xFCfbar (keine Analytics-Installation sichtbar)." : duplicates ? "Doppelte Events m\xF6glich (Plugin + GTM parallel)." : "Keine doppelten page_view-Events beobachtet.",
-          firstPartySuspicious.length ? `First-Party-Verdacht: ${firstPartySuspicious.length} same-origin Tracking-Pfad(e) \u2014 Server-zu-Server nur begrenzt beweisbar.` : "Keine verd\xE4chtigen First-Party-Tracking-Pfade."
-        ].join(" \xB7 "),
-        actionSequence,
-        actionTimeline,
-        requestTimeline: timeline,
-        storageBefore,
-        storageAfter,
-        screenshots,
-        screenshotPath: screenshots[0]?.path,
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      if (status === "passed") {
-        passedScenarios.push("duplicate-events");
-      } else if (status === "suspicious") {
-        failedScenarios.push("duplicate-events");
-        violations.push({
-          id: `duplicate-events-${Date.now()}`,
-          ruleId: "duplicate-events",
-          scenario: "duplicate-events",
-          trackerName: "Analytics page_view",
-          trackerCategory: "analytics",
-          requestUrl: pageviews[0] || config.targetUrl,
-          method: "GET",
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          description: `Mehrere page_view-Beacons pro Aufruf (${pageviews.length}).`
-        });
-      } else {
-        failedScenarios.push("duplicate-events");
-      }
-    } catch (err) {
-      evidence.push({
-        scenario: "duplicate-events",
-        status: "not-checkable",
-        note: `Szenario mit Fehler abgebrochen: ${String(err).slice(0, 120)}`,
-        actionSequence: [],
-        requestTimeline: [],
-        storageBefore: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        storageAfter: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      failedScenarios.push("duplicate-events");
-    } finally {
-      await context.close().catch(() => {
-      });
-    }
-  }
-  async runConsentModeV2Scenario(browser, config, targetOrigin, violations, passedScenarios, failedScenarios, evidence) {
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    const timeline = [];
-    const actionSequence = [];
-    const actionTimeline = [];
-    const screenshots = [];
-    const googleRequests = [];
-    let phase = "pre-consent";
-    page.on("request", (req) => {
-      const url = req.url();
-      const isGoogle = /google-analytics\.com|googletagmanager\.com|doubleclick\.net|googleadservices\.com/i.test(url);
-      timeline.push({ at: (/* @__PURE__ */ new Date()).toISOString(), url, trackerName: identifyTracker(url)?.name, trackerCategory: identifyTracker(url)?.category, phase });
-      if (isGoogle) googleRequests.push(url);
-    });
-    const readConsent = async () => {
-      return page.evaluate(() => {
-        const out = {};
-        try {
-          const dl = window.dataLayer;
-          if (Array.isArray(dl)) {
-            for (const entry of dl) {
-              const arr = entry;
-              if (arr && arr[0] === "consent" && (arr[1] === "default" || arr[1] === "update")) {
-                const v = arr[2];
-                if (v && typeof v === "object") {
-                  for (const k of ["ad_storage", "analytics_storage", "ad_user_data", "ad_personalization"]) {
-                    if (v[k]) out[k] = v[k];
-                  }
-                }
-              }
-            }
-          }
-        } catch {
-        }
-        return out;
-      }).catch(() => ({}));
-    };
-    try {
-      await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-      this.logAct(actionTimeline, actionSequence, "goto");
-      const storageBefore = await this.snapshotStorage(page);
-      const defaults = await readConsent();
-      this.logAct(actionTimeline, actionSequence, `consent:default(${Object.keys(defaults).join(",") || "none"})`);
-      const denied = await clickFirstMatching(page, REJECT_SELECTORS, 2e3);
-      this.logAct(actionTimeline, actionSequence, denied ? "click:reject" : "click:accept-or-none");
-      if (!denied) await clickFirstMatching(page, ACCEPT_SELECTORS, 1500);
-      phase = "post-accept";
-      await page.waitForTimeout(1200);
-      const after = await readConsent();
-      this.logAct(actionTimeline, actionSequence, `consent:after(${Object.keys(after).join(",") || "none"})`);
-      await this.snap(page, "consent-mode-v2", "01-after-choice", screenshots, actionTimeline, actionSequence);
-      const storageAfter = await this.snapshotStorage(page);
-      const hasConsentMode = Object.keys(defaults).length > 0 || Object.keys(after).length > 0;
-      const gaCookies = storageAfter.cookies.filter((c) => /^_ga|_gid|_gat|_gcl/i.test(c));
-      const analyticsState = after.analytics_storage ?? defaults.analytics_storage ?? "unset";
-      const adState = after.ad_storage ?? defaults.ad_storage ?? "unset";
-      const mismatch = analyticsState === "denied" && gaCookies.length > 0 || adState === "denied" && googleRequests.some((u) => /doubleclick|googleadservices/i.test(u));
-      const noteParts = [
-        `consent-mode states: analytics_storage=${analyticsState}, ad_storage=${adState}, ad_user_data=${after.ad_user_data ?? defaults.ad_user_data ?? "unset"}, ad_personalization=${after.ad_personalization ?? defaults.ad_personalization ?? "unset"}`,
-        `google requests: ${googleRequests.length}`,
-        `ga cookies: ${gaCookies.length || "none"}`,
-        hasConsentMode ? mismatch ? "Zustand und Verhalten widersprechen sich." : "Zustand und Verhalten stimmen \xFCberein." : "Kein Consent Mode (dataLayer) gefunden \u2014 nicht pr\xFCfbar."
-      ];
-      evidence.push({
-        scenario: "consent-mode-v2",
-        status: !hasConsentMode ? "not-checkable" : mismatch ? "suspicious" : "passed",
-        note: noteParts.join(" \xB7 "),
-        actionSequence,
-        actionTimeline,
-        requestTimeline: timeline,
-        storageBefore,
-        storageAfter,
-        screenshots,
-        screenshotPath: screenshots[0]?.path,
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      if (!hasConsentMode) {
-        failedScenarios.push("consent-mode-v2");
-      } else if (mismatch) {
-        violations.push({
-          id: `consent-mode-v2-${Date.now()}`,
-          ruleId: "consent-mode-mismatch",
-          scenario: "consent-mode-v2",
-          trackerName: "Google Consent Mode",
-          trackerCategory: "analytics",
-          requestUrl: googleRequests[0] || config.targetUrl,
-          method: "GET",
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          description: "Consent-Mode-Zustand und tats\xE4chliche Google-Requests/Cookies widersprechen sich."
-        });
-        failedScenarios.push("consent-mode-v2");
-      } else {
-        passedScenarios.push("consent-mode-v2");
-      }
-    } catch (err) {
-      evidence.push({
-        scenario: "consent-mode-v2",
-        status: "not-checkable",
-        note: `Szenario mit Fehler abgebrochen: ${String(err).slice(0, 120)}`,
-        actionSequence: [],
-        requestTimeline: [],
-        storageBefore: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        storageAfter: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      failedScenarios.push("consent-mode-v2");
-    } finally {
-      await context.close().catch(() => {
-      });
-    }
-  }
-  async runEmbedScenario(browser, config, targetOrigin, violations, passedScenarios, failedScenarios, evidence) {
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    const timeline = [];
-    const actionSequence = [];
-    const actionTimeline = [];
-    const screenshots = [];
-    page.on("request", (req) => {
-      const hit = identifyTracker(req.url());
-      timeline.push({
-        at: (/* @__PURE__ */ new Date()).toISOString(),
-        url: req.url(),
-        trackerName: hit?.name,
-        phase: "pre-consent"
-      });
-      if (hit && /youtube|maps|facebook|twitter|embed|chat|widget/i.test(hit.name)) {
-        violations.push({
-          id: `embed-leaks-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
-          ruleId: "pre-consent-embed",
-          scenario: "embed-leaks",
-          trackerName: hit.name,
-          trackerCategory: hit.category,
-          requestUrl: req.url(),
-          method: req.method(),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          description: `${hit.name} (Embed) kontaktiert Dritte vor Consent-Freigabe.`
-        });
-      }
-    });
-    try {
-      await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-      this.logAct(actionTimeline, actionSequence, "goto");
-      const storageBefore = await this.snapshotStorage(page);
-      const EMBED_SCOPE = "iframe, [data-src*='youtube'], [data-src*='maps'], .fb-video, .twitter-tweet";
-      const embedsEval = await page.evaluate(() => {
-        const nodes = Array.from(
-          document.querySelectorAll("iframe, [data-src*='youtube'], [data-src*='maps'], .fb-video, .twitter-tweet")
-        );
-        return nodes.map((n) => {
-          const el = n;
-          return {
-            tag: el.tagName.toLowerCase(),
-            src: el.getAttribute("src") || el.getAttribute("data-src") || "",
-            visible: !!(el.offsetParent || el.getClientRects().length)
-          };
-        });
-      }).catch(() => null);
-      const embeds = embedsEval ?? [];
-      const embedsEvalOk = embedsEval !== null;
-      this.logAct(actionTimeline, actionSequence, `embeds:found(${embeds.length})`);
-      await page.waitForTimeout(1500);
-      await page.evaluate(() => window.scrollTo(0, document.body.scrollHeight / 2)).catch(() => {
-      });
-      this.logAct(actionTimeline, actionSequence, "scroll:half");
-      await page.waitForTimeout(1500);
-      await this.snap(page, "embed-leaks", "01-embeds", screenshots, actionTimeline, actionSequence);
-      const storageAfter = await this.snapshotStorage(page);
-      const embedLeaks = timeline.filter((e) => e.trackerName && /youtube|maps|facebook|twitter/i.test(e.trackerName));
-      if (embeds.length === 0 && embedLeaks.length === 0) {
-        const status2 = embedsEvalOk ? "not-applicable" : "not-checkable";
-        evidence.push({
-          scenario: "embed-leaks",
-          status: status2,
-          note: embedsEvalOk ? `Nicht anwendbar: keine eingebetteten Inhalte im Suchumfang vorhanden (${EMBED_SCOPE}).` : `DOM-Auswertung der Embeds fehlgeschlagen \u2014 Erkennung nicht pr\xFCfbar (Suchumfang: ${EMBED_SCOPE}).`,
-          actionSequence,
-          actionTimeline,
-          requestTimeline: timeline,
-          storageBefore,
-          storageAfter,
-          screenshots,
-          screenshotPath: screenshots[0]?.path,
-          targetUrl: config.targetUrl,
-          checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-        if (!embedsEvalOk) failedScenarios.push("embed-leaks");
-        return;
-      }
-      const status = embedLeaks.length > 0 ? "suspicious" : "passed";
-      evidence.push({
-        scenario: "embed-leaks",
-        status,
-        note: status === "passed" ? `${embeds.length} Embed(s) gefunden, keine Drittanbieter-Requests vor Freigabe.` : `${embedLeaks.length} Embed-/Widget-Request(s) vor Consent-Freigabe.`,
-        actionSequence,
-        actionTimeline,
-        requestTimeline: timeline,
-        storageBefore,
-        storageAfter,
-        screenshots,
-        screenshotPath: screenshots[0]?.path,
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      if (status === "passed") passedScenarios.push("embed-leaks");
-      else failedScenarios.push("embed-leaks");
-    } catch (err) {
-      evidence.push({
-        scenario: "embed-leaks",
-        status: "not-checkable",
-        note: `Szenario mit Fehler abgebrochen: ${String(err).slice(0, 120)}`,
-        actionSequence: [],
-        requestTimeline: [],
-        storageBefore: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        storageAfter: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      failedScenarios.push("embed-leaks");
-    } finally {
-      await context.close().catch(() => {
-      });
-    }
-  }
-  async runCmpFailureScenario(browser, config, targetOrigin, violations, passedScenarios, failedScenarios, evidence) {
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    const timeline = [];
-    const actionSequence = [];
-    const actionTimeline = [];
-    const screenshots = [];
-    page.on("request", (req) => {
-      const frameUrl = req.frame()?.url() || page.url();
-      if (!isOnTargetOrigin(frameUrl, targetOrigin)) return;
-      const hit = identifyTracker(req.url());
-      timeline.push({ at: (/* @__PURE__ */ new Date()).toISOString(), url: req.url(), trackerName: hit?.name, phase: "pre-consent" });
-      if (hit) {
-        violations.push({
-          id: `cmp-failure-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
-          ruleId: "pre-consent-tracking",
-          scenario: "cmp-failure",
-          trackerName: hit.name,
-          trackerCategory: hit.category,
-          requestUrl: req.url(),
-          method: req.method(),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          description: `${hit.name} startet, obwohl das CMP nicht verf\xFCgbar/verz\xF6gert ist.`
-        });
-      }
-    });
-    try {
-      await page.route(
-        (url) => {
-          const href = url.href;
-          if (href.startsWith(targetOrigin)) return false;
-          return /cookiebot|onetrust|cookielaw|usercentrics|iubenda|didomi|axept|tealium|consentmanager|borlabs|klaro|etracker/i.test(
-            href
-          );
-        },
-        async (route) => {
-          await new Promise((r) => setTimeout(r, 2500));
-          await route.continue().catch(() => route.abort().catch(() => {
-          }));
-        }
-      );
-      this.logAct(actionTimeline, actionSequence, "route:cmp-delay-2500ms");
-      await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-      this.logAct(actionTimeline, actionSequence, "goto");
-      const storageBefore = await this.snapshotStorage(page);
-      await page.waitForTimeout(2e3);
-      this.logAct(actionTimeline, actionSequence, "wait:window-2000ms");
-      await this.snap(page, "cmp-failure", "01-delay-window", screenshots, actionTimeline, actionSequence);
-      await page.unrouteAll().catch(() => {
-      });
-      await page.route(
-        (url) => {
-          const href = url.href;
-          if (href.startsWith(targetOrigin)) return false;
-          return /cookiebot|onetrust|cookielaw|usercentrics|iubenda|didomi|axept|tealium|consentmanager|borlabs|klaro|etracker/i.test(
-            href
-          );
-        },
-        (route) => route.abort()
-      );
-      this.logAct(actionTimeline, actionSequence, "route:cmp-abort");
-      await page.reload({ waitUntil: "domcontentloaded", timeout: config.timeoutMs }).catch(() => {
-      });
-      await page.waitForTimeout(1800);
-      this.logAct(actionTimeline, actionSequence, "reload:without-cmp");
-      await this.snap(page, "cmp-failure", "02-cmp-abort", screenshots, actionTimeline, actionSequence);
-      const storageAfter = await this.snapshotStorage(page);
-      const leaks = timeline.filter((e) => e.trackerName);
-      const status = leaks.length > 0 ? "suspicious" : "passed";
-      evidence.push({
-        scenario: "cmp-failure",
-        status,
-        note: status === "passed" ? "Kein Tracking im Zeitfenster bei verz\xF6gertem oder ausgefallenem CMP." : `${leaks.length} Tracker im Zeitfenster bei verz\xF6gertem/defektem CMP.`,
-        actionSequence,
-        actionTimeline,
-        requestTimeline: timeline,
-        storageBefore,
-        storageAfter,
-        screenshots,
-        screenshotPath: screenshots[0]?.path,
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      if (status === "passed") passedScenarios.push("cmp-failure");
-      else failedScenarios.push("cmp-failure");
-    } catch (err) {
-      evidence.push({
-        scenario: "cmp-failure",
-        status: "not-checkable",
-        note: `Szenario mit Fehler abgebrochen: ${String(err).slice(0, 120)}`,
-        actionSequence: [],
-        requestTimeline: [],
-        storageBefore: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        storageAfter: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      failedScenarios.push("cmp-failure");
-    } finally {
-      await context.close().catch(() => {
-      });
-    }
-  }
-  async runSubpageSpaScenario(browser, config, targetOrigin, violations, passedScenarios, failedScenarios, evidence) {
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    const timeline = [];
-    const actionSequence = [];
-    const actionTimeline = [];
-    const screenshots = [];
-    const storageBefore = await this.snapshotStorage(page);
-    const capture = (phase, req) => {
-      const frameUrl = req.frame()?.url() || page.url();
-      if (!isOnTargetOrigin(frameUrl, targetOrigin)) return;
-      const hit = identifyTracker(req.url());
-      timeline.push({ at: (/* @__PURE__ */ new Date()).toISOString(), url: req.url(), trackerName: hit?.name, trackerCategory: hit?.category, phase });
-      if (hit && phase === "pre-consent") {
-        violations.push({
-          id: `subpage-spa-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
-          ruleId: "pre-consent-tracking",
-          scenario: "subpage-spa",
-          trackerName: hit.name,
-          trackerCategory: hit.category,
-          requestUrl: req.url(),
-          method: req.method(),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          description: `${hit.name} feuert auf Unterseite/SPA-Navigation ohne Consent.`
-        });
-      }
-    };
-    page.on("request", (req) => capture("pre-consent", req));
-    try {
-      const subpaths = ["/blog/", "/kontakt.html", "/shop/", "/impressum.html"];
-      for (const p of subpaths) {
-        await page.goto(`${targetOrigin}${p}`, { waitUntil: "domcontentloaded", timeout: config.timeoutMs }).catch(() => {
-        });
-        this.logAct(actionTimeline, actionSequence, `goto:subpage${p}`);
-        await page.waitForTimeout(600);
-      }
-      await this.snap(page, "subpage-spa", "01-subpages", screenshots, actionTimeline, actionSequence);
-      await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-      this.logAct(actionTimeline, actionSequence, "goto:root");
-      await page.evaluate(() => {
-        history.pushState({}, "", "/spa-route-1");
-        window.dispatchEvent(new PopStateEvent("popstate"));
-      }).catch(() => {
-      });
-      this.logAct(actionTimeline, actionSequence, "spa:pushState");
-      await page.waitForTimeout(800);
-      const clicked = await page.evaluate(() => {
-        const a = Array.from(document.querySelectorAll("a[href]")).find((el) => {
-          try {
-            const u = new URL(el.getAttribute("href") || "", location.href);
-            return u.origin === location.origin && !u.hash;
-          } catch {
-            return false;
-          }
-        });
-        if (a) {
-          a.click();
-          return true;
-        }
-        return false;
-      }).catch(() => false);
-      this.logAct(actionTimeline, actionSequence, clicked ? "spa:click-internal" : "spa:no-internal-link");
-      await page.waitForTimeout(1e3);
-      await this.snap(page, "subpage-spa", "02-after-spa", screenshots, actionTimeline, actionSequence);
-      const storageAfter = await this.snapshotStorage(page);
-      const leaks = timeline.filter((e) => e.trackerName && e.phase === "pre-consent");
-      const status = leaks.length > 0 ? "suspicious" : "passed";
-      evidence.push({
-        scenario: "subpage-spa",
-        status,
-        note: status === "passed" ? "Kein unconsent-Tracking auf Unterseiten oder bei SPA-Navigation." : `${leaks.length} Tracker auf Unterseite/SPA ohne Consent.`,
-        actionSequence,
-        actionTimeline,
-        requestTimeline: timeline,
-        storageBefore,
-        storageAfter,
-        screenshots,
-        screenshotPath: screenshots[0]?.path,
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      if (status === "passed") passedScenarios.push("subpage-spa");
-      else failedScenarios.push("subpage-spa");
-    } catch (err) {
-      evidence.push({
-        scenario: "subpage-spa",
-        status: "not-checkable",
-        note: `Szenario mit Fehler abgebrochen: ${String(err).slice(0, 120)}`,
-        actionSequence: [],
-        requestTimeline: [],
-        storageBefore: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        storageAfter: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      failedScenarios.push("subpage-spa");
-    } finally {
-      await context.close().catch(() => {
-      });
-    }
-  }
-  async runBannerIgnoredScenario(browser, config, targetOrigin, violations, passedScenarios, failedScenarios, evidence) {
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    const timeline = [];
-    const actionSequence = [];
-    const actionTimeline = [];
-    const screenshots = [];
-    const phase = "pre-consent";
-    page.on("request", (req) => {
-      const frameUrl = req.frame()?.url() || page.url();
-      if (!isOnTargetOrigin(frameUrl, targetOrigin)) return;
-      const hit = identifyTracker(req.url());
-      timeline.push({ at: (/* @__PURE__ */ new Date()).toISOString(), url: req.url(), trackerName: hit?.name, trackerCategory: hit?.category, phase });
-      if (hit) {
-        violations.push({
-          id: `banner-ignored-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
-          ruleId: "pre-consent-tracking",
-          scenario: "banner-ignored",
-          trackerName: hit.name,
-          trackerCategory: hit.category,
-          requestUrl: req.url(),
-          method: req.method(),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          description: `${hit.name} startet ohne Consent-Klick (Timer/Scroll/Interaktion).`
-        });
-      }
-    });
-    try {
-      await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-      this.logAct(actionTimeline, actionSequence, "goto");
-      const storageBefore = await this.snapshotStorage(page);
-      await this.snap(page, "banner-ignored", "01-loaded", screenshots, actionTimeline, actionSequence);
-      await page.waitForTimeout(2500);
-      this.logAct(actionTimeline, actionSequence, "wait:2500ms");
-      await page.evaluate(() => window.scrollTo(0, document.body.scrollHeight)).catch(() => {
-      });
-      this.logAct(actionTimeline, actionSequence, "scroll:bottom");
-      await page.waitForTimeout(1200);
-      await page.mouse.move(120, 200).catch(() => {
-      });
-      await page.mouse.click(120, 200).catch(() => {
-      });
-      this.logAct(actionTimeline, actionSequence, "click:page-body");
-      await page.waitForTimeout(1500);
-      await page.keyboard.type("test").catch(() => {
-      });
-      this.logAct(actionTimeline, actionSequence, "type:test");
-      await page.waitForTimeout(800);
-      await this.snap(page, "banner-ignored", "02-after-interact", screenshots, actionTimeline, actionSequence);
-      const storageAfter = await this.snapshotStorage(page);
-      const leaks = timeline.filter((e) => e.trackerName);
-      const status = leaks.length > 0 ? "suspicious" : "passed";
-      evidence.push({
-        scenario: "banner-ignored",
-        status,
-        note: status === "passed" ? "Kein Tracking allein durch Warten, Scrollen, Klick auf die Seite oder Tippen." : `${leaks.length} Tracker ohne Consent-Klick aktiv (Timer/Scroll/Interaktion).`,
-        actionSequence,
-        actionTimeline,
-        requestTimeline: timeline,
-        storageBefore,
-        storageAfter,
-        screenshots,
-        screenshotPath: screenshots[0]?.path,
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      if (status === "passed") passedScenarios.push("banner-ignored");
-      else failedScenarios.push("banner-ignored");
-    } catch (err) {
-      evidence.push({
-        scenario: "banner-ignored",
-        status: "not-checkable",
-        note: `Szenario mit Fehler abgebrochen: ${String(err).slice(0, 120)}`,
-        actionSequence: [],
-        requestTimeline: [],
-        storageBefore: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        storageAfter: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      failedScenarios.push("banner-ignored");
-    } finally {
-      await context.close().catch(() => {
-      });
-    }
-  }
-  async runRevocationScenario(browser, config, targetOrigin, violations, passedScenarios, failedScenarios, evidence) {
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    const timeline = [];
-    const actionSequence = [];
-    const actionTimeline = [];
-    const screenshots = [];
-    let phase = "pre-consent";
-    const identify = (url) => identifyTracker(url);
-    page.on("request", (req) => {
-      const frameUrl = req.frame()?.url() || page.url();
-      if (!isOnTargetOrigin(frameUrl, targetOrigin)) return;
-      const hit = identify(req.url());
-      timeline.push({
-        at: (/* @__PURE__ */ new Date()).toISOString(),
-        url: req.url(),
-        trackerName: hit?.name,
-        phase
-      });
-      if (hit) {
-        const violation = {
-          id: `consent-revoked-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
-          ruleId: phase === "post-revoke" ? "tracking-after-revoke" : "pre-consent-tracking",
-          scenario: "consent-revoked",
-          trackerName: hit.name,
-          trackerCategory: hit.category,
-          requestUrl: req.url(),
-          method: req.method(),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          description: phase === "post-revoke" ? `${hit.name} feuert nach Widerruf der Einwilligung.` : `Unauthorized ${hit.name} during consent-revoked scenario (${phase}).`
-        };
-        if (phase === "post-revoke") {
-          violations.push(violation);
-        }
-      }
-    });
-    try {
-      await page.goto(config.targetUrl, { waitUntil: "domcontentloaded", timeout: config.timeoutMs });
-      this.logAct(actionTimeline, actionSequence, "goto");
-      const storageBefore = await this.snapshotStorage(page);
-      await this.snap(page, "consent-revoked", "01-banner", screenshots, actionTimeline, actionSequence);
-      const accepted = await clickFirstMatching(page, ACCEPT_SELECTORS, 2500);
-      this.logAct(actionTimeline, actionSequence, accepted ? "click:accept" : "click:accept-missing");
-      phase = "post-accept";
-      await page.waitForTimeout(800);
-      await page.waitForTimeout(400);
-      const storageAfterAccept = await this.snapshotStorage(page);
-      this.logAct(actionTimeline, actionSequence, "snapshot:after-accept");
-      await this.snap(page, "consent-revoked", "02-after-accept", screenshots, actionTimeline, actionSequence);
-      let revokeTargetVisible = false;
-      for (const sel of REJECT_SELECTORS) {
-        const vis = await page.locator(sel).first().isVisible({ timeout: 300 }).catch(() => false);
-        if (vis) {
-          revokeTargetVisible = true;
-          break;
-        }
-      }
-      if (revokeTargetVisible) {
-        phase = "post-revoke";
-        this.logAct(actionTimeline, actionSequence, "phase:post-revoke");
-      }
-      const revoked = await clickFirstMatching(page, REJECT_SELECTORS, 2500);
-      this.logAct(actionTimeline, actionSequence, revoked ? "click:revoke" : "click:revoke-missing");
-      if (!revoked && !accepted) {
-        const storageAfter2 = await this.snapshotStorage(page);
-        evidence.push({
-          scenario: "consent-revoked",
-          status: "not-checkable",
-          note: "Weder Accept- noch Revoke-Button auffindbar \u2014 Widerruf nicht pr\xFCfbar (kein gr\xFCnes H\xE4kchen).",
-          actionSequence,
-          actionTimeline,
-          requestTimeline: timeline,
-          storageBefore,
-          storageAfter: storageAfter2,
-          screenshots,
-          screenshotPath: screenshots[0]?.path,
-          targetUrl: config.targetUrl,
-          checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-        failedScenarios.push("consent-revoked");
-        return;
-      }
-      if (!revoked) {
-        actionSequence.push("fallback:storage-wipe-skipped");
-        const storageAfter2 = await this.snapshotStorage(page);
-        evidence.push({
-          scenario: "consent-revoked",
-          status: "not-checkable",
-          note: "Kein Widerruf-Button \u2014 Persistenz/Widerruf nicht pr\xFCfbar.",
-          actionSequence,
-          actionTimeline,
-          requestTimeline: timeline,
-          storageBefore,
-          storageAfter: storageAfter2,
-          screenshots,
-          screenshotPath: screenshots[0]?.path,
-          targetUrl: config.targetUrl,
-          checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-        failedScenarios.push("consent-revoked");
-        return;
-      }
-      if (!accepted) {
-        const storageAfter2 = await this.snapshotStorage(page);
-        evidence.push({
-          scenario: "consent-revoked",
-          status: "not-checkable",
-          note: "Widerruf nicht pr\xFCfbar \u2014 keine vorherige Einwilligung erteilt (Accept-Button fehlte).",
-          actionSequence,
-          actionTimeline,
-          requestTimeline: timeline,
-          storageBefore,
-          storageAfter: storageAfter2,
-          storageAfterAccept,
-          screenshots,
-          screenshotPath: screenshots[0]?.path,
-          targetUrl: config.targetUrl,
-          checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-        failedScenarios.push("consent-revoked");
-        return;
-      }
-      await page.waitForTimeout(300);
-      const observationMs = 2e3;
-      await page.goto(`${targetOrigin}/after-revoke`, { waitUntil: "domcontentloaded", timeout: config.timeoutMs }).catch(() => {
-      });
-      this.logAct(actionTimeline, actionSequence, "post-revoke:goto");
-      await page.evaluate(() => {
-        window.dispatchEvent(new Event("scroll"));
-        window.dispatchEvent(new Event("click"));
-        document.body?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
-      }).catch(() => {
-      });
-      this.logAct(actionTimeline, actionSequence, `post-revoke:events observe=${observationMs}ms`);
-      await page.waitForTimeout(observationMs);
-      const storageAfter = await this.snapshotStorage(page);
-      await this.snap(page, "consent-revoked", "03-after-revoke", screenshots, actionTimeline, actionSequence);
-      const RESIDUAL_COOKIE = /^(_ga|_gid|_gat|_gcl|_fbp|_fbc|_tt|_ttp|_uetsid|_uetsid|li_s|li_at|hjSessionUser_|hjSession_|mkto_trk|hubspotutk|__hssc|__hstc|_opt_out)/i;
-      const RESIDUAL_LS = /^(_ga|_gid|_gat|_gcl|_fbp|_fbc|_tt|_ttp|_hs|_hs_|mkto_|hubspot|munchkin|_gcl_)[A-Z0-9_.-]*$/i;
-      const residual = [
-        ...storageAfter.cookies.filter((c) => RESIDUAL_COOKIE.test(c.split("@")[0])),
-        ...storageAfter.localStorageKeys.filter((k) => RESIDUAL_LS.test(k))
-      ];
-      const postRevokeTrackers = timeline.filter((e) => e.phase === "post-revoke" && e.trackerName);
-      const status = postRevokeTrackers.length > 0 || residual.length > 0 ? "suspicious" : "passed";
-      const removedIds = [
-        ...storageAfterAccept.cookies.filter((c) => !storageAfter.cookies.includes(c)),
-        ...storageAfterAccept.localStorageKeys.filter((k) => !storageAfter.localStorageKeys.includes(k))
-      ];
-      const keptIds = [
-        ...storageAfter.cookies.filter((c) => storageAfterAccept.cookies.includes(c)),
-        ...storageAfter.localStorageKeys.filter((k) => storageAfterAccept.localStorageKeys.includes(k))
-      ];
-      evidence.push({
-        scenario: "consent-revoked",
-        status,
-        note: (status === "passed" ? `Keine Tracker-Requests nach Widerruf (Beobachtungsfenster ${observationMs} ms mit Seitenwechsel und Events); keine auff\xE4lligen Tracking-IDs zur\xFCckgeblieben.` : `Nach Widerruf (Beobachtungsfenster ${observationMs} ms, Seitenwechsel + Events): ${postRevokeTrackers.length} Tracker-Request(s), ${residual.length} Rest-ID(s).`) + ` Widerruf-Diff: ${removedIds.length} Storage-Eintrag(e) entfernt, ${keptIds.length} verblieben (Peak nach Accept \u2192 Endzustand).`,
-        actionSequence,
-        actionTimeline,
-        requestTimeline: timeline,
-        storageBefore,
-        storageAfter,
-        storageAfterAccept,
-        residualAfterRevoke: residual,
-        screenshots,
-        screenshotPath: screenshots[0]?.path,
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      if (status === "passed") {
-        passedScenarios.push("consent-revoked");
-      } else {
-        failedScenarios.push("consent-revoked");
-      }
-    } catch (err) {
-      evidence.push({
-        scenario: "consent-revoked",
-        status: "not-checkable",
-        note: `Szenario mit Fehler abgebrochen: ${String(err).slice(0, 120)}`,
-        actionSequence: [],
-        requestTimeline: [],
-        storageBefore: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        storageAfter: { cookies: [], localStorageKeys: [], sessionStorageKeys: [] },
-        targetUrl: config.targetUrl,
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      failedScenarios.push("consent-revoked");
-    } finally {
-      await context.close().catch(() => {
-      });
-    }
-  }
-};
-
-// src/core/remediation/index.ts
-import fs2 from "fs/promises";
-import path2 from "path";
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-
-// src/core/remediation/reviewer.ts
-import ts from "typescript";
-
-// src/core/legal/disclaimer.ts
-var LEGAL_DISCLAIMER = "\u26A0\uFE0F **Hinweis / Disclaimer:** CPCG ist ein technisches Hilfsmittel zur Unterst\xFCtzung bei der Implementierung von Consent-L\xF6sungen \u2014 **keine Rechtsberatung** und keine Garantie f\xFCr DSGVO-/TTDSG-Konformit\xE4t. Bitte lassen Sie die endg\xFCltige Umsetzung anwaltlich pr\xFCfen. / CPCG is a technical aid, **not legal advice** and no guarantee of GDPR/ePrivacy compliance. Have the final implementation reviewed by counsel.";
-
-// src/core/remediation/reviewer.ts
-var CONSENT_GUARD = /(getItem\(\s*['"`][^'"`]*consent[^'"`]*['"`]\s*\)|\bhasConsent\b|\bconsentGiven\b|\bisConsented\b|\bcookiecategory\b|\bgetConsent\w*\()/i;
-var TRACKER_MARKERS = [
-  {
-    match: (n) => /google|gtm|analytics/i.test(n),
-    // gtag('consent'|'set'...) is Consent Mode API, not a tracker fire; function gtag(){} is the helper
-    code: /googletagmanager\.com|google-analytics\.com|\bgtag\s*\(\s*['"](?!(?:consent|set)['"])|\bga\s*\(/i
-  },
-  { match: (n) => /meta|facebook/i.test(n), code: /connect\.facebook\.net|facebook\.com\/tr|\bfbq\s*\(/i },
-  { match: (n) => /tiktok/i.test(n), code: /analytics\.tiktok\.com|\bttq\b/i },
-  { match: (n) => /criteo/i.test(n), code: /criteo\.(net|com)/i },
-  { match: (n) => /hotjar/i.test(n), code: /hotjar\.com|\bhj\s*\(/i },
-  { match: (n) => /linkedin/i.test(n), code: /licdn\.com|ads\.linkedin\.com|_linkedin_partner_id/i }
-];
-var JS_EXT = /\.(js|mjs|cjs|jsx|ts|tsx)$/i;
-var HTML_EXT = /\.(html|htm)$/i;
-function stripComments(code) {
-  return code.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:\\'"`])\/\/.*$/gm, "$1");
-}
-function syntaxErrors(code, fileName) {
-  const out = ts.transpileModule(code, {
-    fileName,
-    reportDiagnostics: true,
-    compilerOptions: { jsx: ts.JsxEmit.Preserve, target: ts.ScriptTarget.ES2022 }
-  });
-  return (out.diagnostics ?? []).filter((d) => d.category === ts.DiagnosticCategory.Error).map((d) => {
-    const msg = ts.flattenDiagnosticMessageText(d.messageText, " ");
-    const pos = d.file && d.start !== void 0 ? d.file.getLineAndCharacterOfPosition(d.start) : void 0;
-    return `[Syntax] ${fileName}${pos ? `:${pos.line + 1}:${pos.character + 1}` : ""} ${msg}`;
-  });
-}
-function extractScripts(html) {
-  const blocks = [];
-  const re = /<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi;
-  let m;
-  while ((m = re.exec(html)) !== null) {
-    blocks.push({ attrs: m[1] ?? "", body: m[2] ?? "" });
-  }
-  return blocks;
-}
-function isExecutableJs(attrs) {
-  const type = /\btype\s*=\s*["']?([^"'\s>]+)/i.exec(attrs)?.[1]?.toLowerCase();
-  return !type || type === "module" || type.includes("javascript");
-}
-function isBlockedByType(attrs) {
-  return /\btype\s*=\s*["']?text\/plain/i.test(attrs);
-}
-function findUnguardedTrackerUsages(code, fileName, marker) {
-  const sf = ts.createSourceFile(fileName, code, ts.ScriptTarget.ES2022, true);
-  const unguarded = [];
-  const exitsEarly = (s) => {
-    if (ts.isReturnStatement(s) || ts.isThrowStatement(s)) return true;
-    if (ts.isBlock(s)) return s.statements.some(exitsEarly);
-    return false;
-  };
-  const isGuarded = (node) => {
-    let child = node;
-    for (let p = node.parent; p; child = p, p = p.parent) {
-      if (ts.isIfStatement(p) && CONSENT_GUARD.test(p.expression.getText(sf)) && child === p.thenStatement) {
-        return true;
-      }
-      if (ts.isBinaryExpression(p) && p.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken && child === p.right && CONSENT_GUARD.test(p.left.getText(sf))) {
-        return true;
-      }
-      if (ts.isConditionalExpression(p) && child === p.whenTrue && CONSENT_GUARD.test(p.condition.getText(sf))) {
-        return true;
-      }
-      if (ts.isBlock(p) || ts.isSourceFile(p)) {
-        const stmts = p.statements;
-        const idx = stmts.indexOf(child);
-        for (let i = 0; i < idx; i++) {
-          const s = stmts[i];
-          if (ts.isIfStatement(s) && CONSENT_GUARD.test(s.expression.getText(sf)) && exitsEarly(s.thenStatement)) {
-            return true;
-          }
-        }
-      }
-    }
-    return false;
-  };
-  const visit = (node) => {
-    let isUsage = false;
-    if (ts.isCallExpression(node)) {
-      const callee = node.expression.getText(sf);
-      const firstStr = node.arguments.find(
-        (a) => ts.isStringLiteral(a) || ts.isNoSubstitutionTemplateLiteral(a)
-      );
-      const head = firstStr ? `${callee}(${firstStr.getText(sf)}` : `${callee}(`;
-      isUsage = marker.test(head);
-    } else if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
-      isUsage = marker.test(node.text);
-    }
-    if (isUsage && !isGuarded(node)) {
-      unguarded.push(sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1);
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(sf);
-  return unguarded;
-}
-var CodeReviewer = class {
-  async review(patches, report, config) {
-    const comments = [];
-    const approvedPatches = [];
-    const rejectedPatches = [];
-    if (patches.length === 0) {
-      return {
-        passed: false,
-        score: 0,
-        comments: ["No patches provided for review."],
-        approvedPatches: [],
-        rejectedPatches: []
-      };
-    }
-    for (const patch of patches) {
-      const errors = this.reviewPatch(patch, report);
-      if (errors.length === 0) {
-        approvedPatches.push(patch);
-        comments.push(`\u2714 [APPROVED] ${patch.filePath}: valid syntax, structure preserved, trackers consent-gated.`);
-      } else {
-        rejectedPatches.push(patch);
-        comments.push(`\u2716 [REJECTED] ${patch.filePath}:
-  ${errors.join("\n  ")}`);
-      }
-    }
-    if (config.apiKey && rejectedPatches.length === 0) {
-      comments.push(...await this.runLlmPeerReview(approvedPatches, config));
-    }
-    return {
-      passed: rejectedPatches.length === 0 && approvedPatches.length > 0,
-      score: Math.round(approvedPatches.length / patches.length * 100),
-      comments: [...comments, LEGAL_DISCLAIMER],
-      approvedPatches,
-      rejectedPatches
-    };
-  }
-  reviewPatch(patch, report) {
-    const errors = [];
-    const content = patch.patchedContent;
-    const isHtml = HTML_EXT.test(patch.filePath);
-    const isJs = JS_EXT.test(patch.filePath);
-    if (!content || content.trim().length === 0) {
-      return [`[Syntax] Patched content is empty.`];
-    }
-    if (patch.originalContent === void 0) {
-      errors.push("[Integrity] originalContent missing; cannot verify the patch against the original.");
-    } else {
-      if (patch.originalContent === content) {
-        errors.push("[Compliance] Patch is identical to the original file; nothing was fixed.");
-      }
-      const origLines = patch.originalContent.split("\n").length;
-      const newLines = content.split("\n").length;
-      if (origLines > 10 && newLines < origLines * 0.5) {
-        errors.push(
-          `[Regression] File shrank from ${origLines} to ${newLines} lines (suspected code loss).`
-        );
-      }
-      if (isHtml) {
-        for (const tag of ["</body>", "</html>"]) {
-          if (patch.originalContent.includes(tag) && !content.includes(tag)) {
-            errors.push(`[Integrity] Essential closing tag '${tag}' was removed.`);
-          }
-        }
-      }
-    }
-    if (isHtml) {
-      const markup = content.replace(/(<script\b[^>]*>)[\s\S]*?(<\/script\s*>)/gi, "$1$2");
-      const opens = (markup.match(/<script\b[^>]*>/gi) ?? []).length;
-      const closes = (markup.match(/<\/script\s*>/gi) ?? []).length;
-      if (opens !== closes) {
-        errors.push(`[Syntax] Unbalanced <script> tags: ${opens} opened vs ${closes} closed.`);
-      }
-      extractScripts(content).forEach((b, i) => {
-        if (isExecutableJs(b.attrs) && b.body.trim()) {
-          errors.push(...syntaxErrors(b.body, `inline-script-${i + 1}.js`));
-        }
-      });
-    } else if (isJs) {
-      errors.push(...syntaxErrors(content, patch.filePath));
-    }
-    errors.push(...this.checkPrivacyCompliance(patch, report));
-    return errors;
-  }
-  /**
-   * For every tracker family that leaked, each script block / source file that references it must be gated:
-   * blocked via type="text/plain" / data-cookiecategory, or guarded by real (non-comment) consent code.
-   */
-  checkPrivacyCompliance(patch, report) {
-    const errors = [];
-    const markers = /* @__PURE__ */ new Set();
-    for (const v of report.violations) {
-      for (const m of TRACKER_MARKERS) {
-        if (m.match(v.trackerName)) markers.add(m);
-      }
-    }
-    if (markers.size === 0) return errors;
-    const isHtml = HTML_EXT.test(patch.filePath);
-    const isJs = JS_EXT.test(patch.filePath);
-    const units = isHtml ? extractScripts(patch.patchedContent).map((b, i) => ({
-      attrs: b.attrs,
-      code: b.body,
-      label: `<script> #${i + 1}`,
-      fileName: `inline-script-${i + 1}.js`
-    })) : [{ attrs: "", code: patch.patchedContent, label: "file", fileName: patch.filePath }];
-    for (const marker of markers) {
-      for (const u of units) {
-        if (isBlockedByType(u.attrs)) continue;
-        if (marker.code.test(u.attrs)) {
-          errors.push(`[Compliance] ${u.label} loads a tracker without type="text/plain" (still executes before consent).`);
-          continue;
-        }
-        const executable = isHtml ? isExecutableJs(u.attrs) && u.code.trim().length > 0 : true;
-        if (!executable) continue;
-        if (isHtml || isJs) {
-          for (const line of findUnguardedTrackerUsages(u.code, u.fileName, marker.code)) {
-            errors.push(`[Compliance] ${u.label} line ${line}: tracker usage is not inside/after a consent guard.`);
-          }
-        } else {
-          const code = stripComments(u.code);
-          if (marker.code.test(code) && !CONSENT_GUARD.test(code)) {
-            errors.push(`[Compliance] ${u.label} references a tracker without any consent guard (heuristic).`);
-          }
-        }
-      }
-    }
-    return errors;
-  }
-  async runLlmPeerReview(patches, config) {
-    if (config.llmProvider !== "openai") return [];
-    try {
-      const response = await fetch("https://api.openai.com/v1/chat/completions", {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${config.apiKey}`
-        },
-        signal: AbortSignal.timeout(2e4),
-        body: JSON.stringify({
-          model: config.llmModel || "gpt-4o",
-          messages: [
-            {
-              role: "system",
-              content: "You are an expert Code Reviewer. Inspect the provided code patches for privacy fixes. Respond in 1 concise sentence verifying code safety."
-            },
-            {
-              role: "user",
-              content: `Review these patches:
-${patches.map((p) => p.patchedContent).join("\n---\n")}`
-            }
-          ],
-          temperature: 0.1,
-          max_tokens: 150
-        })
-      });
-      if (response.ok) {
-        const json = await response.json();
-        const reply = json.choices?.[0]?.message?.content?.trim();
-        if (reply) return [`\u{1F916} [LLM Peer Reviewer]: ${reply}`];
-      }
-    } catch {
-    }
-    return [];
-  }
-};
-
-// src/core/remediation/pullRequest.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-var BRANCH_PREFIX_RE = /^[A-Za-z0-9._/-]+$/;
-function validateBranchPrefix(prefix) {
-  if (!BRANCH_PREFIX_RE.test(prefix) || prefix.includes("..") || prefix.startsWith("-") || prefix.startsWith("/") || prefix.endsWith("/") || prefix.endsWith(".lock") || prefix.includes("//")) {
-    throw new Error(`Invalid branch prefix '${prefix}'. Allowed: letters, digits, '.', '_', '/', '-'.`);
-  }
-}
-function redactSecrets(text, token) {
-  let out = text.replace(/\/\/[^@/\s]+@/g, "//***@");
-  if (token) out = out.split(token).join("***");
-  return out;
-}
-function parseGitHubRepo(url) {
-  if (!url) return null;
-  const m = url.trim().match(/^(?:https?:\/\/(?:[^@/]+@)?github\.com\/|ssh:\/\/git@github\.com\/|git@github\.com:)([^/]+)\/([^/]+?)(?:\.git)?\/?$/i);
-  return m ? { owner: m[1], repo: m[2] } : null;
-}
-function escapeCell(s) {
-  return s.replace(/\|/g, "\\|").replace(/\r?\n/g, " ");
-}
-function tokenArgs(token) {
-  if (!token) return [];
-  const basic = Buffer.from(`x-access-token:${token}`).toString("base64");
-  return ["-c", `http.extraheader=AUTHORIZATION: basic ${basic}`];
-}
-var PullRequestEngine = class {
-  async git(args, token) {
-    try {
-      const { stdout } = await execFileAsync("git", args, {
-        maxBuffer: 10 * 1024 * 1024,
-        env: process.env
-      });
-      return stdout.trim();
-    } catch (err) {
-      const e = err;
-      throw new Error(
-        `git ${args[0]} failed: ${redactSecrets((e.stderr || e.message || String(err)).trim(), token)}`
-      );
-    }
-  }
-  /**
-   * Creates a fix branch, commits only the given files, pushes and opens a PR when a remote + token exist.
-   * Always returns to the starting branch. Throws on any git/API failure (caller restores the working tree).
-   */
-  async createPullRequest(patches, report, reviewVerdict, config) {
-    validateBranchPrefix(config.branchPrefix);
-    const startBranch = await this.git(["rev-parse", "--abbrev-ref", "HEAD"]);
-    if (startBranch === "HEAD") {
-      throw new Error("Detached HEAD: cannot create a fix branch.");
-    }
-    const branchName = `${config.branchPrefix}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-    const title = `fix(privacy): remediate ${report.totalViolations} unauthorized tracker leak(s)`;
-    const body = this.buildPrDescription(report, reviewVerdict, patches, config);
-    const files = patches.map((p) => p.filePath);
-    await this.git(["checkout", "-b", branchName]);
-    let keepBranch = false;
-    try {
-      await this.git(["add", "--", ...files]);
-      await this.git(["commit", "-m", title, "--", ...files]);
-      let remoteUrl = "";
-      try {
-        remoteUrl = await this.git(["config", "--get", "remote.origin.url"]);
-      } catch {
-      }
-      const repo = parseGitHubRepo(remoteUrl);
-      if (!config.githubToken || !repo) {
-        keepBranch = true;
-        return { branchName, title, body, simulated: true };
-      }
-      const baseBranch = config.baseBranch || await this.resolveBaseBranch(startBranch);
-      await this.git([...tokenArgs(config.githubToken), "push", "-u", "origin", branchName], config.githubToken);
-      keepBranch = true;
-      const res = await fetch(`https://api.github.com/repos/${repo.owner}/${repo.repo}/pulls`, {
-        method: "POST",
-        headers: {
-          Accept: "application/vnd.github+json",
-          Authorization: `Bearer ${config.githubToken}`,
-          "Content-Type": "application/json"
-        },
-        signal: AbortSignal.timeout(15e3),
-        body: JSON.stringify({ title, head: branchName, base: baseBranch, body })
-      });
-      if (!res.ok) {
-        const text = redactSecrets(await res.text().catch(() => ""), config.githubToken);
-        throw new Error(`GitHub PR creation failed (HTTP ${res.status}): ${text.slice(0, 500)}`);
-      }
-      const pr = await res.json();
-      return { branchName, title, body, prNumber: pr.number, prUrl: pr.html_url, simulated: false };
-    } finally {
-      if (!keepBranch) {
-        await this.git(["reset", "-q", "--", ...files]).catch(() => void 0);
-      }
-      await this.git(["checkout", startBranch]).catch(() => void 0);
-      if (!keepBranch) {
-        await this.git(["branch", "-D", branchName]).catch(() => void 0);
-      }
-    }
-  }
-  async resolveBaseBranch(fallback) {
-    try {
-      const ref = await this.git(["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]);
-      return ref.replace(/^origin\//, "") || fallback;
-    } catch {
-      return fallback;
-    }
-  }
-  buildPrDescription(report, reviewVerdict, patches, config) {
-    const lines = [
-      "## \u{1F6E1}\uFE0F Cuonztech Privacy Chaos Gate (CPCG) - Auto-Remediation PR",
-      "",
-      `This Pull Request was automatically generated to remediate **${report.totalViolations} unauthorized tracker leak(s)** detected during Privacy Chaos Engineering tests on \`${config.targetUrl}\`.`,
-      "",
-      "### \u{1F50D} Review Agent Verdict",
-      `- **Score:** \`${reviewVerdict.score}/100\``,
-      `- **Status:** ${reviewVerdict.passed ? "\u2705 **APPROVED (No defects detected)**" : "\u26A0\uFE0F **REVIEW COMMENTS**"}`
-    ];
-    for (const comment of reviewVerdict.comments) {
-      lines.push(`  * ${comment.replace(/\r?\n\s*/g, " ")}`);
-    }
-    lines.push("", "### \u{1F6A8} Fixed Privacy Violations");
-    lines.push("| Scenario | Tracker | Category | Intercepted Request |");
-    lines.push("| :--- | :--- | :--- | :--- |");
-    for (const v of report.violations) {
-      lines.push(
-        `| \`${escapeCell(v.scenario)}\` | **${escapeCell(v.trackerName)}** | \`${escapeCell(v.trackerCategory)}\` | \`${escapeCell(v.requestUrl)}\` |`
-      );
-    }
-    lines.push("", "### \u{1F4C1} Modified Files");
-    for (const patch of patches) {
-      lines.push(`* **\`${patch.filePath}\`**: ${patch.explanation}`);
-    }
-    lines.push(
-      "",
-      "### \u{1F9EA} Verification",
-      "Run the Privacy Chaos Gate locally to verify all chaos scenarios pass:",
-      "```bash",
-      `npx @cuonztech/privacy-chaos-gate --url "${config.targetUrl}"`,
-      "```",
-      "",
-      "---",
-      "_Generated by Cuonztech Privacy Chaos Gate Auto-Remediation Engine & Review Agent._"
-    );
-    lines.push("", LEGAL_DISCLAIMER);
-    return lines.join("\n");
-  }
-};
-
-// src/core/remediation/index.ts
-var execFileAsync2 = promisify2(execFile2);
-var CONSENT_ACTIVATION_RUNTIME = `<script data-cpcg="consent-activation">
-(function () {
-  if (window.__cpcgConsentRuntime) return;
-  window.__cpcgConsentRuntime = true;
-  window.__cpcgInits = window.__cpcgInits || [];
-
-  function cpcgHasConsent() {
-    try {
-      var raw;
-      // Explicit hook for custom CMPs
-      if (window.__cpcgConsentGranted === true) return true;
-      // Our own / simple stores
-      raw = localStorage.getItem("cpcg_consent");
-      if (raw === "accepted") return true;
-      raw = localStorage.getItem("consent");
-      if (raw === "accepted") return true;
-      raw = localStorage.getItem("usercentrics-consent");
-      if (raw === "accepted") return true;
-      // OneTrust: OptanonConsent is a URL-encoded query string (has consentId, groups=\u2026)
-      raw = localStorage.getItem("OptanonConsent");
-      if (raw) {
-        if (raw === "accepted") return true;
-        try {
-          var q = new URLSearchParams(raw);
-          if (q.get("status") === "accepted" || q.get("groups") && q.get("groups").indexOf(":1") !== -1) return true;
-          if (q.has("consentId") && !/isIabGlobal=false;status=-1/.test(raw)) return true;
-        } catch (e) {}
-      }
-      // Cookiebot: JSON with consented / stamp
-      raw = localStorage.getItem("CookieConsent");
-      if (raw) {
-        if (raw === "accepted" || raw === "true") return true;
-        try {
-          var cb = JSON.parse(raw);
-          if (cb && (cb.consented === true || cb.necessary === true || cb.stamp)) return true;
-        } catch (e) {}
-      }
-      // OneTrust OptanonConsent cookie fallback
-      if (/(^|;s*)OptanonConsent=/.test(document.cookie)) return true;
-      return false;
-    } catch (_) {
-      return false;
-    }
-  }
-
-  function cpcgActivateDeferred() {
-    if (!cpcgHasConsent()) return false;
-    document.querySelectorAll('script[type="text/plain"][data-src]').forEach(function (old) {
-      if (old.getAttribute("data-cpcg-activated") === "1") return;
-      old.setAttribute("data-cpcg-activated", "1");
-      var s = document.createElement("script");
-      s.src = old.getAttribute("data-src");
-      s.async = old.async !== false;
-      if (old.getAttribute("data-cookiecategory")) {
-        s.setAttribute("data-cookiecategory", old.getAttribute("data-cookiecategory"));
-      }
-      old.parentNode.insertBefore(s, old.nextSibling);
-    });
-    (window.__cpcgInits || []).forEach(function (fn) {
-      try { fn(); } catch (e) { /* init failed */ }
-    });
-    window.__cpcgInits = [];
-    return true;
-  }
-
-  window.cpcgActivateTrackers = cpcgActivateDeferred;
-  window.cpcgGrantConsent = function () {
-    window.__cpcgConsentGranted = true;
-    return cpcgActivateDeferred();
-  };
-
-  ["click", "storage", "consent", "usercentrics-consent", "OneTrustLoaded"].forEach(function (evt) {
-    window.addEventListener(evt, function () {
-      setTimeout(cpcgActivateDeferred, 50);
-    }, true);
-  });
-  document.addEventListener("click", function () {
-    setTimeout(cpcgActivateDeferred, 50);
-  }, true);
-
-  // Late accept: poll briefly while the page is open
-  var tries = 0;
-  var timer = setInterval(function () {
-    tries += 1;
-    if (cpcgActivateDeferred() || tries > 40) clearInterval(timer);
-  }, 500);
-
-  if (document.readyState === "loading") {
-    document.addEventListener("DOMContentLoaded", cpcgActivateDeferred);
-  } else {
-    cpcgActivateDeferred();
-  }
-})();
-</script>`;
-var RemediationEngine = class {
-  reviewer;
-  prEngine;
-  constructor(reviewer, prEngine) {
-    this.reviewer = reviewer ?? new CodeReviewer();
-    this.prEngine = prEngine ?? new PullRequestEngine();
-  }
-  async remediate(report, config) {
-    if (report.totalViolations === 0) {
-      return {
-        success: true,
-        patches: [],
-        commitMessage: "No violations to remediate."
-      };
-    }
-    try {
-      const candidateFiles = await this.findCandidateSourceFiles(config.sourceDir);
-      if (candidateFiles.length === 0) {
-        return {
-          success: false,
-          patches: [],
-          error: `No candidate source files found in source directory: ${config.sourceDir}`
-        };
-      }
-      let candidatePatches = [];
-      if (config.apiKey) {
-        candidatePatches = await this.remediateWithLlm(report, candidateFiles, config);
-      }
-      if (candidatePatches.length === 0) {
-        candidatePatches = await this.remediateWithRuleEngine(report, candidateFiles);
-      }
-      if (candidatePatches.length === 0) {
-        return {
-          success: false,
-          patches: [],
-          error: "Could not identify and patch the leaking code in candidate source files."
-        };
-      }
-      const reviewVerdict = await this.reviewer.review(candidatePatches, report, config);
-      if (!reviewVerdict.passed) {
-        return {
-          success: false,
-          patches: [],
-          reviewVerdict,
-          error: `Review Agent rejected candidate patches (Score: ${reviewVerdict.score}/100):
-${reviewVerdict.comments.join("\n")}`
-        };
-      }
-      const approvedPatches = reviewVerdict.approvedPatches;
-      const originals = /* @__PURE__ */ new Map();
-      for (const patch of approvedPatches) {
-        originals.set(patch.filePath, patch.originalContent ?? await fs2.readFile(patch.filePath, "utf-8"));
-      }
-      const rollback = async () => {
-        for (const [file, content] of originals) {
-          await fs2.writeFile(file, content, "utf-8").catch(() => void 0);
-        }
-      };
-      for (const patch of approvedPatches) {
-        await fs2.writeFile(patch.filePath, patch.patchedContent, "utf-8");
-      }
-      let commitHash;
-      let pullRequest;
-      const commitMessage = `fix(privacy): auto-remediate ${report.totalViolations} tracker leak(s) via CPCG`;
-      try {
-        if (config.createPr) {
-          pullRequest = await this.prEngine.createPullRequest(
-            approvedPatches,
-            report,
-            reviewVerdict,
-            config
-          );
-          await rollback();
-        } else if (config.gitCommit) {
-          const files = approvedPatches.map((p) => p.filePath);
-          await execFileAsync2("git", ["add", "--", ...files]);
-          const { stdout } = await execFileAsync2("git", ["commit", "-m", commitMessage, "--", ...files]);
-          const hashMatch = stdout.match(/\[.*?\s+([a-f0-9]+)\]/);
-          commitHash = hashMatch ? hashMatch[1] : "committed";
-        }
-      } catch (gitErr) {
-        await rollback();
-        await execFileAsync2("git", ["reset", "-q", "--", ...originals.keys()]).catch(() => void 0);
-        return {
-          success: false,
-          patches: [],
-          reviewVerdict,
-          error: `Git/PR step failed; working-tree changes were rolled back and the index was reset: ${redactSecrets(
-            gitErr instanceof Error ? gitErr.message : String(gitErr),
-            config.githubToken
-          )}`
-        };
-      }
-      return {
-        success: true,
-        patches: approvedPatches,
-        reviewVerdict,
-        commitHash,
-        commitMessage,
-        pullRequest
-      };
-    } catch (err) {
-      return {
-        success: false,
-        patches: [],
-        error: err instanceof Error ? err.message : String(err)
-      };
-    }
-  }
-  async findCandidateSourceFiles(dir) {
-    const candidates = [];
-    const allowedExtensions = /* @__PURE__ */ new Set([".html", ".htm", ".jsx", ".tsx", ".js", ".ts", ".vue", ".svelte"]);
-    async function walk(currentDir) {
-      const entries = await fs2.readdir(currentDir, { withFileTypes: true }).catch(() => []);
-      for (const entry of entries) {
-        const fullPath = path2.join(currentDir, entry.name);
-        if (entry.isDirectory()) {
-          if (entry.name === "node_modules" || entry.name === ".git" || entry.name === "dist" || entry.name === "reports" || entry.name === "test-fixtures" || entry.name === "tests") {
-            continue;
-          }
-          await walk(fullPath);
-        } else if (entry.isFile() && allowedExtensions.has(path2.extname(entry.name).toLowerCase())) {
-          candidates.push(fullPath);
-        }
-      }
-    }
-    await walk(path2.resolve(dir));
-    return candidates;
-  }
-  /**
-   * Deterministic Privacy Patcher: Analyzes violations and injects consent gates or CMP categorization attributes
-   */
-  async remediateWithRuleEngine(report, candidateFiles) {
-    const patches = [];
-    for (const filePath of candidateFiles) {
-      const content = await fs2.readFile(filePath, "utf-8");
-      let updatedContent = content;
-      let fileModified = false;
-      for (const violation of report.violations) {
-        if (violation.trackerName.includes("Google") && (updatedContent.includes("googletagmanager.com") || updatedContent.includes("google-analytics.com") || updatedContent.includes("gtag("))) {
-          const externalGtagRegex = /<script\s+async\s+src="https:\/\/www\.googletagmanager\.com\/gtag\/js\?id=([^"]+)">\s*<\/script>/gi;
-          if (externalGtagRegex.test(updatedContent)) {
-            updatedContent = updatedContent.replace(
-              externalGtagRegex,
-              `<script type="text/plain" data-cookiecategory="analytics" data-src="https://www.googletagmanager.com/gtag/js?id=$1"></script>`
-            );
-            fileModified = true;
-          }
-          const inlineGtagRegex = /<script>[\s\S]*?gtag\(\s*['"]config['"]\s*,\s*['"]([^'"]+)['"][\s\S]*?<\/script>/i;
-          const inlineMatch = inlineGtagRegex.exec(updatedContent);
-          if (inlineMatch && !updatedContent.includes('data-cpcg="deferred-init"')) {
-            const measurementId = inlineMatch[1];
-            const inlineBeacon = /fetch\("([^"]*google-analytics\.com\/g\/collect[^"]*)"/.exec(inlineMatch[0])?.[1];
-            updatedContent = updatedContent.replace(
-              inlineMatch[0],
-              `<script data-cpcg="deferred-init">
-    // [CPCG Auto-Remediation]: run after explicit consent, including late accept
-    window.__cpcgInits = window.__cpcgInits || [];
-    window.__cpcgInits.push(function initAnalytics() {
-      if (localStorage.getItem('cpcg_consent') !== 'accepted') return;
-      window.dataLayer = window.dataLayer || [];
-      function gtag(){dataLayer.push(arguments);}
-      gtag('js', new Date());
-      gtag('config', '${measurementId}');
-      ${inlineBeacon ? `fetch(${JSON.stringify(inlineBeacon)}).catch(function () {});` : ""}
-    });
-    if (localStorage.getItem('cpcg_consent') === 'accepted' && window.cpcgActivateTrackers) {
-      window.cpcgActivateTrackers();
-    }
-  </script>`
-            );
-            fileModified = true;
-          }
-          const beaconRe = /fetch\("(https:\/\/www\.google-analytics\.com\/g\/collect[^"]*)"\)\.catch\(\s*(?:\(\)\s*=>\s*\{\}|function\s*\(\)\s*\{\s*\})\s*\);?/g;
-          let beaconFound = false;
-          let capturedBeaconUrl = "";
-          updatedContent = updatedContent.replace(beaconRe, (_m, url) => {
-            beaconFound = true;
-            if (!capturedBeaconUrl) capturedBeaconUrl = url;
-            return `/* [CPCG Remediation]: beacon deferred to consent runtime */`;
-          });
-          if (beaconFound) {
-            const beaconUrl = capturedBeaconUrl || "https://www.google-analytics.com/g/collect?v=2&en=page_view";
-            updatedContent = updatedContent.replace(
-              "</body>",
-              `  <script data-cpcg="deferred-beacon">
-    window.__cpcgInits = window.__cpcgInits || [];
-    window.__cpcgInits.push(function () {
-      if (localStorage.getItem('cpcg_consent') !== 'accepted') return;
-      fetch(${JSON.stringify(beaconUrl)}).catch(function () {});
-    });
-  </script>
-</body>`
-            );
-            fileModified = true;
-          }
-        }
-        if (violation.trackerName.includes("Meta") && (updatedContent.includes("connect.facebook.net") || updatedContent.includes("fbq("))) {
-          const metaRegex = /<script([^>]*)src="https:\/\/connect\.facebook\.net\/([^"]*)"([^>]*)><\/script>/gi;
-          if (metaRegex.test(updatedContent)) {
-            updatedContent = updatedContent.replace(
-              metaRegex,
-              (_m, pre, src, post) => `<script${pre} type="text/plain" data-cookiecategory="marketing" data-src="https://connect.facebook.net/${src}"${post}></script>`
-            );
-            fileModified = true;
-          }
-          if (updatedContent.includes("fbq(") && !updatedContent.includes('data-cpcg="deferred-fbq"')) {
-            updatedContent = updatedContent.replace(
-              /<script>\s*(!function\(f,b,e,v,n,t,s\)[\s\S]*?fbq\([\s\S]*?)<\/script>/i,
-              `<script data-cpcg="deferred-fbq">
-    window.__cpcgInits = window.__cpcgInits || [];
-    window.__cpcgInits.push(function () {
-      if (localStorage.getItem('cpcg_consent') !== 'accepted' && localStorage.getItem('OptanonConsent') !== 'accepted') return;
-      $1
-    });
-  </script>`
-            );
-            if (updatedContent.includes('data-cpcg="deferred-fbq"')) fileModified = true;
-          }
-        }
-        if (violation.trackerName.includes("Google") || violation.trackerName.includes("Tag Manager") || updatedContent.includes("googletagmanager.com/gtm.js")) {
-          const gtmScriptRegex = /<script\s+async\s+src="https:\/\/www\.googletagmanager\.com\/gtm\.js\?id=([^"]+)">\s*<\/script>/gi;
-          if (gtmScriptRegex.test(updatedContent)) {
-            updatedContent = updatedContent.replace(
-              gtmScriptRegex,
-              `<script type="text/plain" data-cookiecategory="analytics" data-src="https://www.googletagmanager.com/gtm.js?id=$1"></script>`
-            );
-            fileModified = true;
-          }
-          const gtmIifeScriptRegex = /<script>\s*\(function\(w,d,s,l,i\)\{[\s\S]*?\}\)\(window,document,'script','dataLayer','([^']+)'\);?\s*<\/script>/i;
-          if (gtmIifeScriptRegex.test(updatedContent) && !updatedContent.includes('data-cpcg="deferred-gtm"')) {
-            updatedContent = updatedContent.replace(
-              gtmIifeScriptRegex,
-              `<script data-cpcg="deferred-gtm">
-    // [CPCG]: Google Consent Mode v2 \u2014 default denied, granted after accept
-    window.dataLayer = window.dataLayer || [];
-    function gtag(){dataLayer.push(arguments);}
-    gtag('consent', 'default', {
-      ad_storage: 'denied',
-      ad_user_data: 'denied',
-      ad_personalization: 'denied',
-      analytics_storage: 'denied',
-      wait_for_update: 500
-    });
-    window.__cpcgInits = window.__cpcgInits || [];
-    window.__cpcgInits.push(function () {
-      if (localStorage.getItem('cpcg_consent') !== 'accepted') return;
-      gtag('consent', 'update', {
-        ad_storage: 'granted',
-        ad_user_data: 'granted',
-        ad_personalization: 'granted',
-        analytics_storage: 'granted'
-      });
-      (function(w,d,s,l,i){var f=d.getElementsByTagName(s)[0],j=d.createElement(s);j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','$1');
-    });
-  </script>`
-            );
-            if (updatedContent.includes('data-cpcg="deferred-gtm"')) fileModified = true;
-          }
-        }
-        if (/\.(jsx|tsx|js|ts|vue|svelte)$/i.test(filePath) || updatedContent.includes("ReactGA") || updatedContent.includes("react-ga")) {
-          const reactGaInit = /ReactGA\.initialize\s*\(\s*['"`]([^'"`]+)['"`]\s*\)\s*;?/g;
-          if (reactGaInit.test(updatedContent) && !updatedContent.includes("deferred-reactga")) {
-            updatedContent = updatedContent.replace(
-              reactGaInit,
-              `/* data-cpcg="deferred-reactga" */
-  if (typeof window !== 'undefined' && localStorage.getItem('cpcg_consent') === 'accepted') {
-    ReactGA.initialize('$1');
-  } else {
-    window.__cpcgInits = window.__cpcgInits || [];
-    window.__cpcgInits.push(function(){ ReactGA.initialize('$1'); });
-  }`
-            );
-            fileModified = true;
-          }
-          if (/\bgtag\s*\(\s*['"]config['"]/.test(updatedContent) && !updatedContent.includes("cpcgHasConsent") && !updatedContent.includes('data-cpcg="deferred-init"')) {
-            updatedContent = updatedContent.replace(
-              /(\bgtag\s*\(\s*['"]config['"]\s*,\s*['"`][^'"`]+['"`]\s*\)\s*;?)/g,
-              `if (typeof window !== 'undefined' && localStorage.getItem('cpcg_consent') === 'accepted') { $1 }`
-            );
-            fileModified = true;
-          }
-        }
-      }
-      if (updatedContent.includes('type="text/plain"') && !updatedContent.includes("cpcgConsentRuntime")) {
-        updatedContent = updatedContent.replace(
-          /(<\/head>)/i,
-          `${CONSENT_ACTIVATION_RUNTIME}
-$1`
-        );
-        if (!updatedContent.includes("cpcgConsentRuntime")) {
-          updatedContent = CONSENT_ACTIVATION_RUNTIME + "\n" + updatedContent;
-        }
-        fileModified = true;
-      }
-      if (fileModified && updatedContent !== content) {
-        patches.push({
-          filePath,
-          originalContent: content,
-          patchedContent: updatedContent,
-          explanation: `Applied privacy remediation for: ${report.violations.map((v) => v.trackerName).join(", ")}. Deferred tracker execution (incl. GTM/React) until explicit consent with post-accept re-activation.`
-        });
-      }
-    }
-    return patches;
-  }
-  /**
-   * LLM API Remediation: Queries OpenAI/Anthropic/Gemini to generate surgical code patches
-   */
-  async remediateWithLlm(report, candidateFiles, config) {
-    const filesData = [];
-    for (const f of candidateFiles.slice(0, 3)) {
-      const content = await fs2.readFile(f, "utf-8");
-      filesData.push({ path: f, content });
-    }
-    const systemPrompt = `You are the Cuonztech Privacy Auto-Remediation Agent.
-Your job is to fix privacy leaks detected by the Privacy Chaos Scanner.
-Return ONLY valid JSON matching this structure:
-{
-  "patches": [
-    {
-      "filePath": "string",
-      "patchedContent": "string",
-      "explanation": "string"
-    }
-  ]
-}
-Make minimal, surgical changes (e.g. wrap tracking code in consent checks, add data-cookiecategory attributes). Do NOT remove functional UI code.`;
-    const userPrompt = `A privacy leak was detected:
-Violations: ${JSON.stringify(report.violations, null, 2)}
-
-Source Files:
-${filesData.map((f) => `--- File: ${f.path} ---
-${f.content}
-`).join("\n")}
-
-Generate the patched content to eliminate all unconsented tracker executions.`;
-    try {
-      if (config.llmProvider && config.llmProvider !== "openai") {
-        throw new Error(
-          `LLM-Provider '${config.llmProvider}' ist noch nicht implementiert (nur openai). Deterministische Regel-Engine greift stattdessen.`
-        );
-      }
-      if (config.llmProvider === "openai" || !config.llmProvider) {
-        const response = await fetch("https://api.openai.com/v1/chat/completions", {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${config.apiKey}`
-          },
-          signal: AbortSignal.timeout(6e4),
-          body: JSON.stringify({
-            model: config.llmModel || "gpt-4o",
-            response_format: { type: "json_object" },
-            messages: [
-              { role: "system", content: systemPrompt },
-              { role: "user", content: userPrompt }
-            ],
-            temperature: 0.1
-          })
-        });
-        if (response.ok) {
-          const json = await response.json();
-          const reply = json.choices?.[0]?.message?.content;
-          if (reply) {
-            const parsed = JSON.parse(reply);
-            if (Array.isArray(parsed.patches)) {
-              return await this.sanitizeLlmPatches(parsed.patches, candidateFiles);
-            }
-          }
-        }
-      }
-    } catch (llmErr) {
-      console.warn("\u26A0 LLM request failed, falling back to rule engine: " + String(llmErr));
-    }
-    return [];
-  }
-  /**
-   * LLM output is untrusted: validate against the schema, restrict to known candidate files
-   * (no path traversal / arbitrary writes) and fill originalContent from disk for the Review Agent.
-   */
-  async sanitizeLlmPatches(raw, candidateFiles) {
-    const allowed = new Map(candidateFiles.map((f) => [path2.resolve(f), f]));
-    const result = [];
-    for (const item of raw) {
-      const parsed = FilePatchSchema.safeParse(item);
-      if (!parsed.success) continue;
-      const resolved = path2.resolve(parsed.data.filePath);
-      const known = allowed.get(resolved);
-      if (!known) {
-        console.warn(`\u26A0 Ignoring LLM patch for unknown/out-of-scope file: ${parsed.data.filePath}`);
-        continue;
-      }
-      const originalContent = await fs2.readFile(known, "utf-8");
-      result.push({ ...parsed.data, filePath: known, originalContent });
-    }
-    return result;
-  }
-};
-
-// src/core/legal/jurisdictions.ts
-var JURISDICTIONS = {
-  CH: {
-    code: "CH",
-    label: "Schweiz",
-    frameworks: ["revDSG (nDSG)", "FDPIC-Richtlinien", "UWG (irref\xFChrende Praktiken)"],
-    priorOptInRequired: true,
-    consentModeV2: "recommended",
-    summary: "Schweizer Datenschutz (revDSG) ist prinzipienbasiert. Der ED\xD6B beschreibt insbesondere Konstellationen personalisierter Werbung (Profiling, Marketing-Tracker), in denen eine Einwilligung erforderlich ist. F\xFCr \xFCbriges Tracking gelten Transparenz- und Informationspflichten; die Grenzen sind einzelfallabh\xE4ngig. Da viele CH-Seiten auch EU-Nutzer erreichen, empfiehlt sich h\xE4ufig die strengere EU-Linie.",
-    note: "Einordnung nach revDSG und ED\xD6B-Cookie-Guidance. Ob Einwilligung erforderlich ist, h\xE4ngt vom Zweck der Verarbeitung ab (personalisierte Werbung: ja). Keine Rechtsberatung \u2014 bei EU-Zielgruppe zus\xE4tzlich EU-Profil nutzen."
-  },
-  EU: {
-    code: "EU",
-    label: "Europ\xE4ische Union",
-    frameworks: ["GDPR/DSGVO", "ePrivacy-Richtlinie", "TTDSG (DE)", "Google Consent Mode v2 (EEA)"],
-    priorOptInRequired: true,
-    consentModeV2: "required",
-    summary: "In der EU gilt f\xFCr nicht-essenzielle Tracker (Analytics, Marketing, Hotjar, TikTok \u2026) grunds\xE4tzlich vorheriges Opt-In (GDPR, ePrivacy, TTDSG). Ein vor der Einwilligung beobachteter Request ist ein starker Hinweis \u2014 ob ein Rechtsverstoss vorliegt, h\xE4ngt vom Zweck, der Technologie und dem dokumentierten Consent-Zustand ab und ist im Einzelfall zu pr\xFCfen. Google Consent Mode v2 ist f\xFCr Google-Produkte im EEA vorgeschrieben; er ist eine technische Implementierung, keine Rechtsgrundlage.",
-    note: "Technischer Befund mit regulatorischem Kontext, keine Rechtsberatung. Verbindliche Einstufung durch Datenschutzbeauftragte/n oder Anwalt/Anw\xE4ltin."
-  },
-  UK: {
-    code: "UK",
-    label: "Vereinigtes K\xF6nigreich",
-    frameworks: ["UK GDPR", "PECR"],
-    priorOptInRequired: true,
-    consentModeV2: "required",
-    summary: "UK GDPR + PECR entsprechen der EU-ePrivacy-Linie: Opt-In vor nicht-essenziellem Tracking. Auch hier ist ein beobachteter Request ein Hinweis \u2014 die rechtliche Einstufung erfolgt im Einzelfall.",
-    note: "Bewertung nach UK GDPR/PECR. Keine Rechtsberatung."
-  },
-  "US-CA": {
-    code: "US-CA",
-    label: "USA \u2014 Kalifornien (CCPA/CPRA)",
-    frameworks: ["CCPA/CPRA", "Do Not Sell / Share", "Global Privacy Control (GPC)", "Opt-out model"],
-    priorOptInRequired: false,
-    consentModeV2: "recommended",
-    summary: "CCPA/CPRA sind prim\xE4r opt-out-basiert (Do Not Sell or Share). Pre-Consent-Tracking ist nicht per se verboten, verlangt aber klare Opt-out-Mechanismen und Offenlegung. Diese Bewertung gilt als unvollst\xE4ndig, solange Sale/Sharing-Opt-out und das Global Privacy Control (GPC) nicht gepr\xFCft sind \u2014 erfasste Unternehmen m\xFCssen GPC als wirksamen Opt-out ber\xFCcksichtigen.",
-    note: "Technische Beobachtung, keine Rechtsberatung. Ohne GPC- und Sale/Sharing-Pr\xFCfung keine abschliessende CCPA-Bewertung. F\xFCr gemischte CA/EU-Traffic EU-Profil anwenden."
-  },
-  BR: {
-    code: "BR",
-    label: "Brasilien (LGPD)",
-    frameworks: ["LGPD"],
-    priorOptInRequired: true,
-    consentModeV2: "recommended",
-    summary: "LGPD verlangt eine Rechtsgrundlage; Consent ist f\xFCr Marketing-Tracking \xFCblich und sicher. Die konkrete Einstufung eines Pre-Consent-Requests erfordert die Pr\xFCfung von Zweck und Technologie.",
-    note: "Bewertung nach LGPD-Praxis. Keine Rechtsberatung."
-  },
-  ROW: {
-    code: "ROW",
-    label: "Rest der Welt",
-    frameworks: ["Landesspezifisch (z. B. PIPEDA, PDPA, APPs)"],
-    priorOptInRequired: false,
-    consentModeV2: "recommended",
-    summary: "Nicht bewertet \u2014 l\xE4nderspezifische Pr\xFCfung erforderlich. CPCG dokumentiert Pre-Consent-Tracking hier neutral als technischen Befund. F\xFCr konkrete Ziell\xE4nder gelten unterschiedliche Regeln (PIPEDA, PDPA, APPs, u. a.), die lokal zu pr\xFCfen sind.",
-    note: "Keine globale Opt-in-/Opt-out-Regel unterstellt. F\xFCr konkrete M\xE4rkte Juristin/Jurist beiziehen."
-  }
-};
-function resolveJurisdiction(code) {
-  const key = (code ?? "CH").toUpperCase().replace("_", "-");
-  if (key in JURISDICTIONS) return JURISDICTIONS[key];
-  return JURISDICTIONS.ROW;
-}
-function severityForPreConsentLeak(profile) {
-  if (profile.code === "ROW") {
-    return {
-      severity: "P2",
-      framing: "Nicht bewertet \u2014 l\xE4nderspezifische Pr\xFCfung erforderlich. Reiner technischer Befund."
-    };
-  }
-  if (profile.priorOptInRequired && profile.consentModeV2 === "required") {
-    return {
-      severity: "P0",
-      framing: "Opt-In-Pflicht f\xFCr nicht-essenzielle Tracker. Ein vor der Einwilligung beobachteter Request ist ein schwerwiegender Compliance-Hinweis \u2014 die rechtliche Einstufung als Versto\xDF erfordert die Pr\xFCfung von Zweck, Technologie und Consent-Zustand."
-    };
-  }
-  if (profile.priorOptInRequired) {
-    return {
-      severity: "P1",
-      framing: "In diesem Rechtsraum gilt f\xFCr personalisierte Werbung in der Praxis h\xE4ufig eine Einwilligungsl\xF6sung (vergleichbare Aufsichtspraxis); Pre-Consent-Tracking ist ein Risiko, nicht zwingend ein klarer Rechtsbruch. Zweck und Technologie mit einbeziehen."
-    };
-  }
-  return {
-    severity: "P2",
-    framing: "Opt-out-Modell: technischer Befund ohne per-se-Versto\xDF. Offenlegung, Opt-out-Wege und GPC-Unterst\xFCtzung pr\xFCfen."
-  };
-}
-
-// src/core/report/evidenceReport.ts
-import fs3 from "fs";
-import path3 from "path";
-function statusLabelOf(s) {
-  return s === "passed" ? "bestanden" : s === "suspicious" ? "auff\xE4llig" : s === "not-applicable" ? "nicht anwendbar" : "nicht pr\xFCfbar";
-}
-var CODE_SOLUTIONS = {
-  "pre-consent-tracking": {
-    title: "Tracker erst nach Einwilligung laden (Defer-Muster)",
-    lang: "html",
-    code: `<!-- Vorher: feuert sofort im <head> -->
-<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>
-<script>
-  window.dataLayer = window.dataLayer || [];
-  function gtag(){ dataLayer.push(arguments); }
-  gtag('js', new Date());
-  gtag('config', 'G-XXXX');
-</script>
-
-<!-- Nachher: Blockiert bis die CMP die Kategorie freigibt -->
-<script type="text/plain" data-cookiecategory="analytics"
-        data-src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>
-<script type="text/plain" data-cookiecategory="analytics">
-  window.dataLayer = window.dataLayer || [];
-  function gtag(){ dataLayer.push(arguments); }
-  gtag('js', new Date());
-  gtag('config', 'G-XXXX');
-</script>
-
-<!-- CMP-Callback: bei Akzeptieren Typ umschreiben und ausf\xFChren -->
-<script>
-  window.addEventListener('consent-given', (e) => {
-    if (!e.detail?.analytics) return;
-    document.querySelectorAll('script[data-cookiecategory="analytics"]').forEach((s) => {
-      const t = document.createElement('script');
-      t.type = 'text/javascript';
-      if (s.dataset.src) t.src = s.dataset.src;
-      else t.text = s.text;
-      s.replaceWith(t);
-    });
-  });
-</script>`
-  },
-  "tracking-without-consent": {
-    title: "Auch nach Widerruf-Reset keine Tracker ohne erneute Zustimmung",
-    lang: "html",
-    code: `<!-- Consent-Status ist die einzige Eintrittskontrolle -->
-<script>
-  function trackerAllowed(category) {
-    const c = window.__consent; // von der CMP gesetzt
-    return !!(c && c[category] === true);
-  }
-
-  // Kein direkter Aufruf von gtag/pixel/fbq ohne diesen Check.
-  if (trackerAllowed('analytics')) {
-    gtag('config', 'G-XXXX');
-  }
-</script>`
-  },
-  "pre-consent-embed": {
-    title: "Externe Embeds hinter eine Consent-Fassade legen",
-    lang: "html",
-    code: `<!-- Vorher: iframe l\xE4dt Drittinhalte ohne Einwilligung -->
-<iframe src="https://www.youtube-nocookie.com/embed/VIDEO_ID"></iframe>
-
-<!-- Nachher: Fassade, iFrame erst nach Klick -->
-<div class="embed-gate" data-embed="https://www.youtube-nocookie.com/embed/VIDEO_ID">
-  <button type="button" class="embed-gate__load">Video laden (setzt Cookies von YouTube)</button>
-</div>
-<script>
-  document.querySelectorAll('.embed-gate').forEach((gate) => {
-    gate.querySelector('button').addEventListener('click', () => {
-      const src = gate.dataset.embed;
-      gate.innerHTML = '';
-      const iframe = document.createElement('iframe');
-      iframe.src = src;
-      iframe.allow = 'accelerometer; autoplay; encrypted-media; picture-in-picture';
-      iframe.allowFullscreen = true;
-      gate.appendChild(iframe);
-    });
-  });
-</script>`
-  },
-  "tracking-after-revoke": {
-    title: "Nach Widerruf: Tracker stoppen und Rest-IDs bereinigen",
-    lang: "js",
-    code: `// Schematisches Muster \u2014 an die eigene CMP/Tracker anpassen.
-// In den Revoke-Handler der CMP einh\xE4ngen.
-function onConsentRevoked() {
-  // 1. Laufende Tracker abschalten
-  window['ga-disable-G-XXXX'] = true;
-  if (window.gtag) {
-    gtag('consent', 'update', {
-      ad_storage: 'denied',
-      analytics_storage: 'denied',
-      ad_user_data: 'denied',
-      ad_personalization: 'denied',
-    });
-  }
-
-  // 2. Tracker-Cookies l\xF6schen (nur IDs, die der Scan als Residual gemeldet hat)
-  const names = ['_ga', '_gid', '_gat', '_fbp', '_fbc', 'fr'];
-  for (const name of names) {
-    for (const path of ['/', '/blog', '/shop']) {
-      document.cookie = name + '=; Max-Age=0; path=' + path + '; SameSite=Lax';
-      document.cookie = name + '=; Max-Age=0; path=' + path +
-        '; domain=.' + location.hostname.replace(/^www\\./, '') + '; SameSite=Lax';
-    }
-  }
-
-  // 3. Tracker-Residual aus localStorage/sessionStorage entfernen.
-  // WICHTIG: CMP-Entscheidungsspeicher (OptanonConsent, CookieConsent,
-  // usercentrics-consent) NICHT l\xF6schen \u2014 dort steht die Ablehnung.
-  const residualPrefixes = ['_ga', '_gid', '_gat', '_fbp', '_fbc'];
-  for (const store of [localStorage, sessionStorage]) {
-    for (const key of Object.keys(store)) {
-      if (residualPrefixes.some((p) => key === p || key.startsWith(p + '.'))) {
-        store.removeItem(key);
-      }
-    }
-  }
-}`
-  },
-  "tracking-after-deny": {
-    title: "Ablehnung respektieren: kein Tracking ohne Opt-In",
-    lang: "js",
-    code: `// CMP: Choice speichern und Tracker erst bei explizitem Accept aktivieren
-function onConsentChoice(choice) {
-  // choice = { analytics: boolean, marketing: boolean }
-  if (!choice.analytics) {
-    window['ga-disable-G-XXXX'] = true;
-    window.gtag?.('consent', 'update', { analytics_storage: 'denied' });
-    return; // keine Analytics-Requests
-  }
-  window['ga-disable-G-XXXX'] = false;
-  window.gtag?.('consent', 'update', { analytics_storage: 'granted' });
-  gtag('config', 'G-XXXX');
-}`
-  },
-  "tracking-declined-category": {
-    title: "Kategorie-Selektivit\xE4t: abgelehnte Kategorien bleiben blockiert",
-    lang: "js",
-    code: `// CMP gibt Kategorie-Flags zur\xFCck \u2014 nur freigegebene Kategorien starten Tracker
-function activateFor(consent) {
-  if (consent.analytics) {
-    loadScript('https://www.googletagmanager.com/gtag/js?id=G-XXXX');
-    gtag('config', 'G-XXXX');
-  }
-  if (consent.marketing) {
-    // Meta Pixel, LinkedIn Insight etc. erst hier
-    !function(f,b,e,v,n,t,s){/* fbq init */}(window,document,'script');
-  }
-  // Kategorie "functional" l\xE4dt keine Tracker
-}`
-  },
-  "duplicate-events": {
-    title: "Doppelte Analytics-Eintr\xE4ge vermeiden (ein Tag-Manager)",
-    lang: "html",
-    code: `<!-- Vorher: Plugin UND GTM senden beide page_view -->
-<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>
-<script>gtag('config', 'G-XXXX');</script>
-<!-- PLUS GTM-Container, der dasselbe Event noch einmal sendet -->
-
-<!-- Nachher: genau eine Quelle. Entweder gtag ODER GTM \u2014 nicht beide. -->
-<!-- Variante A: nur gtag -->
-<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>
-<script>
-  gtag('js', new Date());
-  gtag('config', 'G-XXXX'); // sendet page_view genau einmal
-</script>
-
-<!-- Variante B: nur GTM-Container (dataLayer statt zus\xE4tzlichem gtag-config) -->
-<script>
-  window.dataLayer = window.dataLayer || [];
-  window.dataLayer.push({ event: 'page_view' });
-</script>`
-  },
-  "consent-mode-mismatch": {
-    title: "Google Consent Mode v2 konsistent setzen",
-    lang: "js",
-    code: `// Schematisches Muster \u2014 vor jedem Google-Tag ausf\xFChren.
-// Default: alles denied \u2014 BEVOR irgendein Google-Tag l\xE4dt.
-window.dataLayer = window.dataLayer || [];
-function gtag(){ dataLayer.push(arguments); }
-gtag('js', new Date());
-
-gtag('consent', 'default', {
-  ad_storage: 'denied',
-  ad_user_data: 'denied',
-  ad_personalization: 'denied',
-  analytics_storage: 'denied',
-  wait_for_update: 500,
-});
-
-// CMP-Update: nur die tats\xE4chlich erteilten Kategorien auf granted
-function onConsentUpdate(consent) {
-  gtag('consent', 'update', {
-    analytics_storage: consent.analytics ? 'granted' : 'denied',
-    ad_storage: consent.marketing ? 'granted' : 'denied',
-    ad_user_data: consent.marketing ? 'granted' : 'denied',
-    ad_personalization: consent.marketing ? 'granted' : 'denied',
-  });
-}`
-  }
-};
-function codeSolutionsFor(report) {
-  const ruleIds = [...new Set(report.violations.map((v) => v.ruleId ?? "pre-consent-tracking"))];
-  const out = [];
-  for (const id of ruleIds) {
-    const sol = CODE_SOLUTIONS[id];
-    if (sol) out.push({ ruleId: id, ...sol });
-  }
-  return out;
-}
-function deriveReportFacts(report) {
-  const evidence = report.evidence ?? [];
-  const passed = evidence.filter((e) => e.status === "passed").length;
-  const flagged = evidence.filter((e) => e.status === "suspicious").length;
-  const uncheckable = evidence.filter((e) => e.status === "not-checkable").length;
-  const notApplicable = evidence.filter((e) => e.status === "not-applicable").length;
-  let observedCount = 0;
-  for (const e of evidence) {
-    for (const r of e.requestTimeline) {
-      if (r.trackerName) observedCount++;
-    }
-  }
-  const findings = report.totalViolations;
-  return {
-    evidenceCount: evidence.length,
-    passed,
-    flagged,
-    uncheckable,
-    notApplicable,
-    incomplete: uncheckable + notApplicable,
-    findings,
-    observedCount,
-    gate: findings === 0 ? "PASS" : "BLOCKED",
-    findingsText: findingsCountText(findings),
-    gateDisclaimer: "Eine rechtliche Gesamtbewertung erfolgt nicht.",
-    problemCount: groupFindings(report.violations ?? []).length,
-    problemsText: problemsTextOf(groupFindings(report.violations ?? []).length)
-  };
-}
-function findingsCountText(n) {
-  return n === 1 ? "1 dokumentierte Befund-Zeile" : `${n} dokumentierte Befund-Zeilen`;
-}
-function problemsTextOf(n) {
-  return n === 0 ? "Keine offenen Befundgruppen" : n === 1 ? "1 Befundgruppe" : `${n} Befundgruppen`;
-}
-function groupFindings(violations) {
-  const map = /* @__PURE__ */ new Map();
-  for (const v of violations) {
-    const ruleId = v.ruleId ?? "pre-consent-tracking";
-    const key = `${ruleId}|${v.trackerName}`;
-    const cur = map.get(key);
-    if (cur) cur.count++;
-    else map.set(key, { key, ruleId, trackerName: v.trackerName, count: 1 });
-  }
-  return [...map.values()].sort((a, b) => b.count - a.count);
-}
-function reproductionText(count) {
-  return count === 1 ? "1 Request" : `${count} Requests`;
-}
-function buildEvidenceMarkdown(report, title = "Evidence Report", options = {}) {
-  const evidence = report.evidence ?? [];
-  const demoLine = options.demo ? "> **Demo-Report** \xB7 synthetische Testdaten \u2014 keine realen Kundendaten.\n\n" : "";
-  const facts = deriveReportFacts(report);
-  const icon = statusLabelOf;
-  const lines = [
-    `# CuonzTech Privacy Chaos Gate \u2014 ${title}`,
-    "",
-    `**Ziel:** \`${report.targetUrl}\`  `,
-    `**Scan:** ${report.scannedAt}  `,
-    `**Technisches Gate:** ${facts.gate} \xB7 ${facts.findingsText} \xB7 ${facts.gateDisclaimer}`,
-    "",
-    "> **Hinweis:** Technisches Hilfsmittel, keine Rechtsberatung. / Technical aid, not legal advice.",
-    "",
-    "## Szenarien",
-    "",
-    "| Szenario | Status | Bemerkung |",
-    "|----------|--------|-----------|"
-  ];
-  for (const e of evidence) {
-    const note = e.note.replace(/\|/g, "\\|").replace(/`/g, "'").replace(/\s*\n\s*/g, " ");
-    lines.push(`| \`${e.scenario}\` | **${icon(e.status)}** | ${note} |`);
-  }
-  if (report.violations.length > 0) {
-    lines.push("", "## Befunde", "", "| Szenario | Tracker | Request |", "|----------|---------|---------|");
-    for (const v of report.violations) {
-      const url = v.requestUrl.slice(0, 80).replace(/\|/g, "\\|").replace(/`/g, "'");
-      lines.push(
-        `| \`${v.scenario}\` | ${v.trackerName} | \`${url}\` |`
-      );
-    }
-    const solutions = codeSolutionsFor(report);
-    if (solutions.length > 0) {
-      lines.push("", "## Code-L\xF6sungen", "");
-      for (const s of solutions) {
-        lines.push(`### ${s.title}`, "", `\`${s.ruleId}\``, "", "```" + s.lang, s.code, "```", "");
-      }
-    }
-  }
-  lines.push("", "## Beweis", "");
-  for (const e of evidence) {
-    if (!e.screenshots?.length && !e.screenshotPath) continue;
-    lines.push(`### ${e.scenario}`, "");
-    for (const s of e.screenshots ?? []) {
-      lines.push(`- **${s.label}** (${s.at}): \`evidence/${path3.basename(s.path)}\``);
-    }
-    if (e.storageAfter?.cookies?.length) {
-      lines.push(`- Cookies nachher: ${e.storageAfter.cookies.slice(0, 8).join(", ")}`);
-    }
-    if (e.residualAfterRevoke?.length) {
-      lines.push(`- Residual nach Widerruf: ${e.residualAfterRevoke.join(", ")}`);
-    }
-    lines.push("");
-  }
-  lines.push("---", "*\xA9 CuonzTech \xB7 Privacy Chaos Gate*");
-  return lines.join("\n");
-}
-var esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-var statusLabel = statusLabelOf;
-var statusClass = (s) => s === "passed" ? "ok" : s === "suspicious" ? "warn" : "skip";
-var fmtTime = (iso) => {
-  const d = new Date(iso);
-  return isNaN(d.getTime()) ? iso : d.toLocaleString("de-CH", { dateStyle: "medium", timeStyle: "medium" });
-};
-var fmtDuration = (ms) => ms >= 6e4 ? `${Math.round(ms / 6e4)} min` : `${(ms / 1e3).toFixed(1)} s`;
-function shotSrc(p) {
-  try {
-    const buf = fs3.readFileSync(p);
-    const ext = path3.extname(p).toLowerCase().replace(".", "");
-    const mime = ext === "jpg" ? "jpeg" : ext === "jpeg" ? "jpeg" : "png";
-    return `data:image/${mime};base64,${buf.toString("base64")}`;
-  } catch {
-    return "";
-  }
-}
-function buildEvidenceHtml(report, title = "Evidence Report", options = {}) {
-  const evidence = report.evidence ?? [];
-  const facts = deriveReportFacts(report);
-  const passed = facts.passed;
-  const flagged = facts.flagged;
-  const uncheckable = facts.uncheckable;
-  const notApplicable = facts.notApplicable;
-  const observed = [];
-  for (const e of evidence) {
-    for (const r of e.requestTimeline) {
-      if (r.trackerName) {
-        observed.push({
-          scenario: e.scenario,
-          at: r.at,
-          url: r.url,
-          trackerName: r.trackerName,
-          phase: r.phase
-        });
-      }
-    }
-  }
-  const kpis = [
-    { label: "Szenarien gepr\xFCft", value: String(evidence.length), tone: "gold" },
-    { label: "bestanden", value: String(passed), tone: "ok" },
-    { label: "auff\xE4llig", value: String(flagged), tone: flagged > 0 ? "warn" : "ok" },
-    {
-      label: "nicht pr\xFCfbar",
-      value: `${uncheckable + notApplicable}`,
-      tone: "skip"
-    },
-    { label: "Befunde (Leaks)", value: String(report.totalViolations), tone: report.totalViolations > 0 ? "warn" : "ok" },
-    { label: "beobachtete Requests", value: String(observed.length), tone: "gold" }
-  ];
-  const incomplete = uncheckable + notApplicable;
-  const RULE_LABELS = {
-    "pre-consent-tracking": "Keine Analytics-Requests vor Zustimmung",
-    "pre-consent-embed": "Keine Drittanbieter-Embeds vor Zustimmung",
-    "tracking-without-consent": "Kein Tracking ohne g\xFCltige Einwilligung",
-    "tracking-after-revoke": "Kein Tracking nach Widerruf",
-    "tracking-after-deny": "Kein Tracking nach gespeicherter Ablehnung",
-    "tracking-declined-category": "Kein Tracking abgelehnter Kategorien",
-    "duplicate-events": "Keine doppelten Analytics-Events",
-    "consent-mode-mismatch": "Consent-Mode-Zustand deckt sich mit Verhalten"
-  };
-  const violatedRules = [...new Set(report.violations.map((v) => v.ruleId ?? "pre-consent-tracking"))];
-  const ruleText = violatedRules.length === 0 ? "Die konfigurierten Regeln wurden nicht verletzt." : `Verletzt: ${violatedRules.map((r) => `\xAB${RULE_LABELS[r] ?? r}\xBB`).join(", ")}.`;
-  const gateClass = report.totalViolations === 0 ? "" : "blocked";
-  const gateTitle = report.totalViolations === 0 ? "Technisches Gate: PASS" : "Technisches Gate: BLOCKED";
-  const gateDetail = `${ruleText} ` + (incomplete > 0 ? `${incomplete === 1 ? "1 Szenario" : `${incomplete} Szenarien`} konnten nicht abschliessend bewertet werden. ` : "") + `Eine rechtliche Gesamtbewertung erfolgt nicht.`;
-  const ranList = evidence.map((e) => `<code>${esc(e.scenario)}</code>`).join(", ") || "\u2014";
-  const summaryHtml = `
-    <p>Der Scan f\xFChrte <strong>${evidence.length === 1 ? "1 Szenario" : `${evidence.length} Szenarien`}</strong> aus: ${ranList}.
-    Ergebnis: ${passed} bestanden \xB7 ${flagged} auff\xE4llig \xB7 ${uncheckable} nicht pr\xFCfbar \xB7 ${notApplicable} nicht anwendbar.</p>
-    <p>Gef\xFChrt werden <strong>${esc(findingsCountText(report.totalViolations))}</strong> und
-    <strong>${observed.length === 1 ? "1 beobachteter Request" : `${observed.length} beobachtete Requests`}</strong> mit erkanntem Tracker
-    (Timelines aller Szenarien \u2014 auch dort, wo keine Violation-Row entstand).</p>`;
-  const jCodes = ["CH", "EU", "UK", "US-CA", "BR", "ROW"];
-  const hasPreConsentFinding = report.violations.some(
-    (v) => (v.ruleId ?? "pre-consent-tracking").startsWith("pre-consent") || (v.ruleId ?? "") === "tracking-without-consent"
-  );
-  const jCards = jCodes.map((code) => {
-    const profile = JURISDICTIONS[code];
-    const { severity, framing } = severityForPreConsentLeak(profile);
-    const tone = severity === "P0" ? "warn" : severity === "P1" ? "gold" : "skip";
-    const framingText = hasPreConsentFinding ? framing : `Falls ein Pre-Consent-Request beobachtet wird: ${framing} Derzeit kein solcher Befund.`;
-    return `<article class="jcard">
-        <header><span class="sev sev-${tone}">${severity}</span><h3>${esc(profile.label)}</h3></header>
-        <p class="jframe">${esc(framingText)}</p>
-        <p class="jfw">${profile.frameworks.map(esc).join(" \xB7 ")}</p>
-      </article>`;
-  }).join("\n");
-  const cards = evidence.map((e) => {
-    const chips = e.actionSequence.map((a) => `<span class="chip">${esc(a)}</span>`).join("");
-    const actionRows = (e.actionTimeline ?? []).slice(0, 12).map(
-      (a) => `<tr><td class="ts">${esc(fmtTime(a.at))}</td><td><code>${esc(a.action)}</code></td></tr>`
-    ).join("");
-    const reqRows = e.requestTimeline.filter((r) => r.trackerName).slice(0, 10).map(
-      (r) => `<tr>
-              <td class="ts">${esc(fmtTime(r.at))}</td>
-              <td>${esc(r.trackerName ?? "")}</td>
-              <td><span class="phase phase-${r.phase.replace(/[^a-z]/g, "")}">${esc(r.phase)}</span></td>
-              <td><code>${esc(r.url.slice(0, 90))}</code></td>
-            </tr>`
-    ).join("");
-    const diff = (before, after, label) => {
-      const added = after.filter((x) => !before.includes(x));
-      const removed = before.filter((x) => !after.includes(x));
-      if (!added.length && !removed.length) return "";
-      return `<p class="diff"><strong>${label}:</strong>
-          ${added.map((a) => `<span class="add">+ ${esc(a)}</span>`).join(" ")}
-          ${removed.map((r) => `<span class="del">\u2212 ${esc(r)}</span>`).join(" ")}
-        </p>`;
-    };
-    const entriesDiff = (before, after, label) => {
-      const b = new Map((before ?? []).map((e2) => [e2.key, e2.value]));
-      const a = new Map((after ?? []).map((e2) => [e2.key, e2.value]));
-      const rows = [];
-      for (const [key, val] of a) {
-        const prev = b.get(key);
-        if (prev === void 0) rows.push(`<span class="add">+ ${esc(key)} = ${esc(val)}</span>`);
-        else if (prev !== val) rows.push(`<span class="add">~ ${esc(key)} = ${esc(val)}</span> <span class="del">vorher: ${esc(prev)}</span>`);
-      }
-      for (const [key, val] of b) {
-        if (!a.has(key)) rows.push(`<span class="del">\u2212 ${esc(key)} = ${esc(val)}</span>`);
-      }
-      if (!rows.length) return "";
-      return `<p class="diff"><strong>${label}:</strong> ${rows.join(" ")}</p>`;
-    };
-    const storageDiff = [
-      diff(e.storageBefore.cookies, e.storageAfter.cookies, "Cookies"),
-      diff(e.storageBefore.localStorageKeys, e.storageAfter.localStorageKeys, "localStorage"),
-      diff(e.storageBefore.sessionStorageKeys, e.storageAfter.sessionStorageKeys, "sessionStorage"),
-      entriesDiff(e.storageBefore.localStorageEntries, e.storageAfter.localStorageEntries, "Consent-Werte")
-    ].join("");
-    const peakDiff = e.storageAfterAccept ? [
-      diff(e.storageAfterAccept.cookies, e.storageAfter.cookies, "Widerruf-Diff Cookies"),
-      diff(e.storageAfterAccept.localStorageKeys, e.storageAfter.localStorageKeys, "Widerruf-Diff localStorage"),
-      entriesDiff(e.storageAfterAccept.localStorageEntries, e.storageAfter.localStorageEntries, "Widerruf-Diff Consent-Werte")
-    ].join("") : "";
-    const residual = e.residualAfterRevoke?.length ? `<p class="residual"><strong>Residual nach Widerruf:</strong>
-            ${e.residualAfterRevoke.map((r) => `<code>${esc(r)}</code>`).join(" ")}
-            <span class="warn-text">\u2014 diese IDs bleiben zur\xFCck</span></p>` : e.residualAfterRevoke ? `<p class="muted-line">Keine Residual-IDs nach Widerruf.</p>` : "";
-    const shots = e.screenshots ?? (e.screenshotPath ? [{ label: "Screenshot", path: e.screenshotPath, at: e.checkedAt }] : []);
-    const gallery = shots.length ? `<div class="shots">${shots.map((s) => {
-      const src = shotSrc(s.path);
-      const media = src ? `<img class="shot" src="${src}" alt="${esc(s.label)}" loading="lazy">` : `<code class="shot-path">evidence/${esc(path3.basename(s.path))}</code>`;
-      return `<figure>
-                <figcaption><span class="shot-label">${esc(s.label)}</span>
-                <span class="ts">${esc(fmtTime(s.at))}</span></figcaption>
-                ${media}
-              </figure>`;
-    }).join("")}</div>` : "";
-    return `<article class="scard s-${statusClass(e.status)}">
-        <header class="shead">
-          <div class="stitle"><code class="sname">${esc(e.scenario)}</code>
-            <span class="badge ${statusClass(e.status)}">${statusLabel(e.status)}</span>
-          </div>
-          <p class="snote">${esc(e.note)}</p>
-        </header>
-
-        <div class="sbody">
-          <h4>Ablauf</h4>
-          <div class="chips">${chips || '<span class="chip muted">keine Aktionen protokolliert</span>'}</div>
-          ${actionRows ? `<details open><summary>Aktions-Zeitlinie (${(e.actionTimeline ?? []).length})</summary>
-            <table class="mini"><tbody>${actionRows}</tbody></table></details>` : ""}
-
-          ${reqRows ? `<h4>Tracker-Requests</h4>
-            <table class="mini">
-              <thead><tr><th>Zeit</th><th>Tracker</th><th>Phase</th><th>Request</th></tr></thead>
-              <tbody>${reqRows}</tbody>
-            </table>` : `<p class="muted-line">Keine Tracker-Requests in diesem Szenario erfasst.</p>`}
-
-          ${peakDiff ? `<h4>Storage-Diff Widerruf (Peak nach Accept \u2192 Endzustand)</h4>${peakDiff}` : ""}
-          ${storageDiff ? `<h4>Storage-Diff</h4>${storageDiff}` : ""}
-          ${residual}
-          ${gallery}
-        </div>
-        <footer class="sfoot">gepr\xFCft ${esc(fmtTime(e.checkedAt))} \xB7 <code>${esc(e.targetUrl)}</code></footer>
-      </article>`;
-  }).join("\n");
-  const recs = [];
-  const ruleSet = new Set(report.violations.map((v) => v.ruleId ?? "pre-consent-tracking"));
-  if (ruleSet.has("pre-consent-tracking") || ruleSet.has("pre-consent-embed") || ruleSet.has("tracking-without-consent")) {
-    recs.push(
-      "Alle Pre-Consent-Tracker und -Embeds bis zur Einwilligung abschalten (Defer-Muster) oder in die CMP-Steuerung h\xE4ngen \u2014 belegt durch die Befunde im Register."
-    );
-  }
-  if (ruleSet.has("tracking-after-revoke") || ruleSet.has("tracking-after-deny")) {
-    recs.push(
-      "Tracking nach Widerruf/Ablehnung stoppen: Consent-Status server- und clientseitig respektieren \u2014 belegt durch die Befunde im Register."
-    );
-  }
-  if (ruleSet.has("tracking-declined-category")) {
-    recs.push(
-      "Kategorie-Selektivit\xE4t der CMP umsetzen: abgelehnte Kategorien (Marketing) d\xFCrfen keine Tracker starten \u2014 belegt durch die Befunde im Register."
-    );
-  }
-  if (ruleSet.has("duplicate-events")) {
-    recs.push(
-      "Doppelte Analytics-Eintr\xE4ge vermeiden: genau eine Tracking-Quelle betreiben (z. B. nur gtag oder nur Tag-Manager) \u2014 belegt durch die Befunde im Register."
-    );
-  }
-  if (ruleSet.has("consent-mode-mismatch")) {
-    recs.push(
-      "Consent Mode v2 konsistent implementieren: Zust\xE4nde und tats\xE4chliche Google-Requests/Cookies m\xFCssen zusammenpassen \u2014 belegt durch die Befunde im Register."
-    );
-  }
-  const residualEvidence = evidence.some((e) => (e.residualAfterRevoke?.length ?? 0) > 0);
-  if (residualEvidence) {
-    recs.push(
-      "Widerruf muss die gefundenen Tracker-Cookies und -IDs bereinigen \u2014 im Bericht sind Residual-IDs nach Widerruf dokumentiert. CMP-Entscheidungsspeicher (z. B. OptanonConsent) davon unterscheiden und nicht l\xF6schen."
-    );
-  }
-  const darkPattern = evidence.some(
-    (e) => e.scenario === "mobile-usability" && e.status === "suspicious"
-  );
-  if (darkPattern) {
-    recs.push(
-      "Mobile Banner-Bedienung anpassen: \xABAblehnen\xBB ist im Test nicht gleichwertig bedienbar wie \xABAkzeptieren\xBB (Dark-Pattern-Verdacht, siehe Szenario mobile-usability)."
-    );
-  }
-  if (flagged > 0 && recs.length === 0) {
-    recs.push(
-      "Auff\xE4llige Szenarien pr\xFCfen und die genannten Beobachtungen im Detail bewerten (siehe Szenario-Karten)."
-    );
-  }
-  if (uncheckable > 0 || notApplicable > 0) {
-    recs.push(
-      "Nicht abschliessend bewertete Szenarien manuell pr\xFCfen, bevor das Ergebnis gewertet wird \u2014 ein fehlendes Pr\xFCfmerkmal ist kein gr\xFCnes H\xE4kchen."
-    );
-  }
-  if (recs.length === 0) {
-    recs.push(
-      "Keine offenen technischen Befunde. Empfehlung: Scan als Gate in die CI aufnehmen, um Regressionen zu verhindern."
-    );
-  }
-  const recItems = recs.map((r) => `<li>${esc(r)}</li>`).join("");
-  const solutions = codeSolutionsFor(report);
-  const problemGroups = groupFindings(report.violations ?? []);
-  const problemRows = problemGroups.map(
-    (g, i) => `<tr>
-      <td class="nr">${i + 1}</td>
-      <td><strong>${esc(g.trackerName)}</strong></td>
-      <td><code>${esc(g.ruleId)}</code></td>
-      <td>${esc(reproductionText(g.count))}</td>
-    </tr>`
-  ).join("");
-  const solutionCards = solutions.map(
-    (s) => `<article class="solution">
-    <h3>${esc(s.title)}</h3>
-    <span class="rule">${esc(s.ruleId)}</span>
-    <pre><code>${esc(s.code)}</code></pre>
-  </article>`
-  ).join("\n");
-  const leakRows = report.violations.map(
-    (v) => `<tr>
-      <td><code>${esc(v.scenario)}</code></td>
-      <td><strong>${esc(v.trackerName)}</strong><div class="muted-line">${esc(v.trackerCategory)}</div></td>
-      <td><code title="${esc(v.requestUrl)}">${esc(v.requestUrl.slice(0, 120))}${v.requestUrl.length > 120 ? "\u2026" : ""}</code><div class="muted-line full-url">${esc(v.requestUrl)}</div></td>
-      <td class="ts">${esc(fmtTime(v.timestamp))}</td>
-    </tr>`
-  ).join("\n");
-  const observedRows = observed.map(
-    (o) => `<tr>
-      <td><code>${esc(o.scenario)}</code></td>
-      <td class="ts">${esc(fmtTime(o.at))}</td>
-      <td>${esc(o.trackerName)}</td>
-      <td><span class="phase phase-${o.phase.replace(/[^a-z]/g, "")}">${esc(o.phase)}</span></td>
-      <td><code>${esc(o.url.slice(0, 100))}</code></td>
-    </tr>`
-  ).join("\n");
-  const demoBanner = options.demo ? `<div class="demo-banner"><strong>Demo-Report</strong> \xB7 synthetische Testdaten \u2014 keine realen Kundendaten.</div>` : "";
-  return `<!DOCTYPE html>
-<html lang="de-CH">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>CuonzTech \xB7 ${esc(title)}</title>
-<style>
-  :root {
-    --bg: #05070D; --bg2: #070B13; --panel: #0C111D;
-    --gold: #D6B56D; --gold-hell: #F4DDA0; --bronze: #A8966A;
-    --text: #F5F2EA; --soft: #D9D2BF; --muted: #9A9384;
-    --ok: #7EE7B6; --warn: #FF7777; --skip: #9A9384;
-    --cyan: #67E8F9; --violet: #8B5CF6;
-    --serif: "Cormorant Garamond", Georgia, serif;
-    --sans: Inter, "Segoe UI", system-ui, sans-serif;
-    --mono: ui-monospace, "Cascadia Code", Consolas, monospace;
-  }
-  * { box-sizing: border-box; -webkit-print-color-adjust: exact; print-color-adjust: exact; }
-  html { background: var(--bg); }
-  body {
-    margin: 0; background: var(--bg); color: var(--text); font: 16px/1.65 var(--sans);
-    background-image: radial-gradient(ellipse 90% 42% at 50% -12%, rgba(214,181,109,0.16), transparent);
-  }
-  code { font: 13px/1.5 var(--mono); color: var(--gold-hell); background: rgba(214,181,109,0.09); padding: 2px 6px; border-radius: 4px; word-break: break-all; }
-
-  .demo-banner {
-    background: #2A2416; border-bottom: 1px solid var(--gold);
-    color: var(--gold-hell); text-align: center; padding: 10px 16px;
-    font: 600 12px/1.5 var(--sans); letter-spacing: 0.12em; text-transform: uppercase;
-  }
-
-  .hero {
-    padding: 64px 24px 40px; text-align: center;
-    border-bottom: 1px solid rgba(214,181,109,0.28);
-    background-color: var(--bg);
-    background-image: linear-gradient(180deg, rgba(12,17,29,0.95), transparent);
-  }
-  .marke { font: 600 12px/1 var(--sans); letter-spacing: 0.34em; color: var(--gold); text-transform: uppercase; }
-  .hero h1 {
-    font: 500 clamp(32px, 6vw, 52px)/1.1 var(--serif); color: var(--gold-hell);
-    margin: 18px auto 10px; max-width: 20ch;
-  }
-  .hero .lede { max-width: 62ch; margin: 0 auto; color: var(--soft); font-size: 17px; }
-  .hero-meta { display: flex; flex-wrap: wrap; gap: 10px 22px; justify-content: center; margin: 22px 0 6px; color: var(--muted); font-size: 13px; }
-  .hero-meta code { font-size: 12px; }
-  .gate {
-    display: inline-block; margin-top: 18px; padding: 14px 22px; border-radius: 12px;
-    border: 1px solid var(--gold); color: var(--gold); max-width: 62ch; text-align: left;
-    background: rgba(214,181,109,0.06);
-  }
-  .gate.blocked { border-color: var(--warn); color: var(--warn); box-shadow: 0 0 24px rgba(255,119,119,0.18); }
-  .gate .gtitle { font: 600 13px/1.4 var(--sans); letter-spacing: 0.14em; text-transform: uppercase; }
-  .gate .gdetail { display: block; margin-top: 8px; font-size: 13px; color: var(--soft); letter-spacing: 0; text-transform: none; }
-
-  main { max-width: 1080px; margin: 0 auto; padding: 36px 22px 80px; background: var(--bg); }
-  h2 {
-    font: 500 30px/1.2 var(--serif); color: var(--gold); margin: 52px 0 8px;
-    padding-bottom: 10px; border-bottom: 1px solid rgba(214,181,109,0.22);
-  }
-  h2 .num { color: var(--bronze); font-size: 0.7em; letter-spacing: 0.12em; margin-right: 12px; vertical-align: middle; }
-  .sub { color: var(--muted); font-size: 14px; margin: 0 0 22px; max-width: 70ch; }
-
-  .kpis { display: grid; grid-template-columns: repeat(auto-fit, minmax(148px, 1fr)); gap: 12px; margin: 26px 0 8px; }
-  .kpi {
-    background: var(--panel); border: 1px solid rgba(214,181,109,0.18); border-radius: 12px;
-    padding: 18px 16px; text-align: center;
-  }
-  .kpi .val { font: 600 34px/1.1 var(--serif); display: block; }
-  .kpi .lab { font: 600 10px/1.4 var(--sans); letter-spacing: 0.16em; text-transform: uppercase; color: var(--muted); margin-top: 6px; }
-  .kpi.gold .val { color: var(--gold-hell); }
-  .kpi.ok .val { color: var(--ok); }
-  .kpi.warn .val { color: var(--warn); }
-  .kpi.skip .val { color: var(--skip); }
-
-  .note {
-    margin: 26px 0; padding: 16px 20px; border-left: 3px solid var(--gold);
-    background: rgba(214,181,109,0.09); color: var(--soft); font-size: 14px; border-radius: 0 10px 10px 0;
-  }
-  .jgrid { display: grid; grid-template-columns: repeat(auto-fit, minmax(230px, 1fr)); gap: 14px; }
-  .jcard {
-    background: var(--panel); border: 1px solid rgba(214,181,109,0.16); border-radius: 12px; padding: 18px;
-  }
-  .jcard h3 { margin: 0; font: 600 18px/1.3 var(--serif); color: var(--text); display: inline; margin-left: 8px; }
-  .jcard header { display: flex; align-items: center; margin-bottom: 10px; }
-  .jframe { color: var(--soft); font-size: 13px; margin: 0 0 10px; }
-  .jfw { color: var(--muted); font-size: 11px; margin: 0; letter-spacing: 0.04em; }
-  .sev {
-    font: 700 11px/1 var(--sans); letter-spacing: 0.1em; padding: 5px 9px; border-radius: 6px;
-  }
-  .sev-gold { background: rgba(214,181,109,0.16); color: var(--gold); border: 1px solid rgba(214,181,109,0.45); }
-  .sev-warn { background: rgba(255,119,119,0.16); color: var(--warn); border: 1px solid rgba(255,119,119,0.45); }
-  .sev-skip { background: rgba(154,147,132,0.16); color: var(--skip); border: 1px solid rgba(154,147,132,0.45); }
-
-  .scard {
-    background: var(--panel); border: 1px solid rgba(214,181,109,0.16); border-radius: 14px;
-    margin: 18px 0; overflow: hidden;
-  }
-  .scard.s-ok { border-left: 4px solid var(--ok); }
-  .scard.s-warn { border-left: 4px solid var(--warn); }
-  .scard.s-skip { border-left: 4px solid var(--skip); }
-  .shead { padding: 20px 22px 14px; border-bottom: 1px solid rgba(214,181,109,0.12); background: rgba(214,181,109,0.04); }
-  .stitle { display: flex; align-items: center; gap: 14px; flex-wrap: wrap; }
-  .sname { font-size: 15px; padding: 5px 10px; }
-  .snote { margin: 10px 0 0; color: var(--soft); font-size: 15px; }
-  .sbody { padding: 18px 22px; }
-  .sbody h4 {
-    font: 600 11px/1 var(--sans); letter-spacing: 0.18em; text-transform: uppercase;
-    color: var(--muted); margin: 20px 0 10px;
-  }
-  .sbody h4:first-child { margin-top: 0; }
-  .sfoot { padding: 12px 22px; border-top: 1px solid rgba(214,181,109,0.12); color: var(--muted); font-size: 11px; }
-  .sfoot code { font-size: 11px; }
-
-  .badge {
-    display: inline-block; padding: 5px 14px; border-radius: 999px;
-    font: 600 11px/1.3 var(--sans); letter-spacing: 0.1em; text-transform: uppercase;
-  }
-  .badge.ok   { background: rgba(126,231,182,0.15); color: var(--ok); border: 1px solid rgba(126,231,182,0.42); }
-  .badge.warn { background: rgba(255,119,119,0.15); color: var(--warn); border: 1px solid rgba(255,119,119,0.42); }
-  .badge.skip { background: rgba(154,147,132,0.15); color: var(--skip); border: 1px solid rgba(154,147,132,0.42); }
-
-  .chips { display: flex; flex-wrap: wrap; gap: 8px; }
-  .chip {
-    font: 500 12px/1 var(--mono); color: var(--cyan); background: rgba(103,232,249,0.1);
-    border: 1px solid rgba(103,232,249,0.28); padding: 6px 10px; border-radius: 999px;
-  }
-  .chip.muted { color: var(--muted); background: rgba(154,147,132,0.1); border-color: rgba(154,147,132,0.28); }
-
-  table.mini { width: 100%; border-collapse: collapse; font-size: 13px; margin: 4px 0 8px; }
-  table.mini th {
-    text-align: left; font: 600 10px/1 var(--sans); letter-spacing: 0.14em; text-transform: uppercase;
-    color: var(--muted); padding: 8px 10px; border-bottom: 1px solid rgba(214,181,109,0.28);
-  }
-  table.mini td { padding: 8px 10px; border-bottom: 1px solid rgba(214,181,109,0.1); color: var(--soft); vertical-align: top; }
-  .ts { white-space: nowrap; color: var(--muted); font-size: 11px; }
-  .phase { font: 600 10px/1 var(--sans); letter-spacing: 0.08em; text-transform: uppercase; padding: 4px 8px; border-radius: 5px; }
-  .phase-preconsent { background: rgba(255,119,119,0.14); color: var(--warn); }
-  .phase-postaccept { background: rgba(126,231,182,0.14); color: var(--ok); }
-  .phase-postreject, .phase-postrejectrestart { background: rgba(255,119,119,0.14); color: var(--warn); }
-  .phase-postselection { background: rgba(126,231,182,0.14); color: var(--ok); }
-  .phase-postrevoke { background: rgba(255,119,119,0.14); color: var(--warn); }
-  .phase-postwipe { background: rgba(255,119,119,0.14); color: var(--warn); }
-  .phase-other { background: rgba(154,147,132,0.14); color: var(--skip); }
-
-  .diff { font-size: 13px; color: var(--soft); }
-  .add { color: var(--ok); font-family: var(--mono); margin-right: 8px; }
-  .del { color: var(--warn); font-family: var(--mono); margin-right: 8px; }
-  .residual { font-size: 13px; color: var(--soft); }
-  .warn-text { color: var(--warn); }
-  .muted-line { color: var(--muted); font-size: 12px; margin-top: 2px; }
-  .full-url { display: none; font-family: var(--mono); font-size: 10px; word-break: break-all; }
-  @media print {
-    .full-url { display: block; }
-  }
-
-  .sname {
-    overflow-wrap: normal;
-    word-break: keep-all;
-  }
-
-  .shots { display: grid; grid-template-columns: repeat(auto-fill, minmax(220px, 1fr)); gap: 12px; margin-top: 8px; }
-  .shots figure {
-    margin: 0; background: var(--bg2); border: 1px solid rgba(214,181,109,0.18); border-radius: 10px; padding: 12px;
-    break-inside: avoid; page-break-inside: avoid;
-  }
-  .shots figcaption { display: flex; justify-content: space-between; gap: 8px; margin-bottom: 8px; }
-  .shot-label { font: 600 11px/1.3 var(--sans); letter-spacing: 0.08em; text-transform: uppercase; color: var(--gold); }
-  .shot-path { display: block; font-size: 11px; color: var(--muted); background: none; padding: 0; }
-  .shot { width: 100%; border-radius: 6px; border: 1px solid rgba(214,181,109,0.2); }
-
-  details { margin: 8px 0; }
-  summary { cursor: pointer; color: var(--gold); font-size: 12px; letter-spacing: 0.06em; }
-
-  .recs { counter-reset: rec; list-style: none; padding: 0; margin: 18px 0; }
-  .recs li {
-    counter-increment: rec; position: relative; padding: 16px 18px 16px 62px;
-    background: var(--panel); border: 1px solid rgba(214,181,109,0.16); border-radius: 12px;
-    margin: 10px 0; color: var(--soft); font-size: 15px;
-  }
-  .recs li::before {
-    content: counter(rec, decimal-leading-zero); position: absolute; left: 18px; top: 16px;
-    font: 600 18px/1 var(--serif); color: var(--gold);
-  }
-
-  .solutions { display: grid; gap: 14px; margin: 18px 0; }
-  .solution {
-    background: var(--panel); border: 1px solid rgba(214,181,109,0.18); border-radius: 12px; padding: 16px 18px;
-  }
-  .solution h3 { margin: 0 0 4px; font: 600 17px/1.3 var(--serif); color: var(--gold-hell); }
-  .solution .rule { font: 11px/1 var(--mono); color: var(--gold); letter-spacing: 0.04em; margin-bottom: 10px; display: block; }
-  .solution pre {
-    margin: 10px 0 0; padding: 14px 16px; overflow-x: auto;
-    background: var(--bg2); border: 1px solid rgba(214,181,109,0.12); border-radius: 8px;
-    font: 12px/1.55 var(--mono); color: var(--soft); white-space: pre;
-  }
-
-  .fuss {
-    text-align: center; color: var(--muted); font-size: 12px; padding: 28px;
-    border-top: 1px solid rgba(214,181,109,0.2); margin-top: 40px;
-  }
-  .fuss .claim { font: 500 16px/1.4 var(--serif); color: var(--gold); display: block; margin-bottom: 6px; }
-
-  @media print {
-    html, body { background: var(--bg); color: var(--text); }
-    .scard, .kpi, .jcard, .recs li, .solution, .shots figure { break-inside: avoid; page-break-inside: avoid; }
-    .hero, main, .fuss, .demo-banner { break-inside: avoid; }
-    /* \xDCberschrift mit Folgeinhalt halten (Jurisdictions \u2192 Karten) */
-    h2, h3, h4, .stitle { break-after: avoid; page-break-after: avoid; }
-    .shead { break-inside: avoid; }
-    .jgrid { break-inside: avoid; }
-    /* Fusszeile (gepr\xFCft \xB7 URL) beim Szenario halten */
-    .sfoot { break-before: avoid; page-break-before: avoid; break-inside: avoid; }
-    .sbody { break-inside: auto; }
-    /* Technische Szenarionamen nicht mitten im Wort trennen */
-    .sname, code { overflow-wrap: normal; word-break: keep-all; }
-    details[open] > summary, details:not([open]) > summary { list-style: none; display: none; }
-    details { display: block; }
-    details > *:not(summary) { display: block !important; }
-  }
-</style>
-</head>
-<body>
-${demoBanner}
-<header class="hero">
-  <div class="marke">CuonzTech \xB7 Privacy Chaos Gate</div>
-  <h1>${esc(title)}</h1>
-  <p class="lede">Aggressiver Consent-Stresstest: ${evidence.length} ausgef\xFChrte Chaos-Szenarien, ${findingsCountText(report.totalViolations)}, ${observed.length} beobachtete Tracker-Requests. Beweise mit Zeitlinie und Storage-Vergleich.</p>
-  <p class="lede problems" id="problem-summary"><strong>${facts.problemsText}</strong> \u2014 aus ${findingsCountText(report.totalViolations)} destilliert.${solutions.length > 0 ? " Was zuerst zu beheben ist, steht unter Code-L\xF6sungen." : ""}</p>
-  <div class="hero-meta">
-    <span>Ziel: <code>${esc(report.targetUrl)}</code></span>
-    <span>Scan: ${esc(fmtTime(report.scannedAt))}</span>
-    <span>Dauer: ${esc(fmtDuration(report.durationMs))}</span>
-  </div>
-  <div class="gate ${gateClass}">
-    <span class="gtitle">${esc(gateTitle)}</span>
-    <span class="gdetail">${esc(gateDetail)}</span>
-  </div>
-</header>
-<main>
-  <h2><span class="num">01</span>Executive Summary</h2>
-  <p class="sub">Ausschliesslich abgeleitet aus den tats\xE4chlich ausgef\xFChrten Szenarien dieses Scans.</p>
-  <div id="summary">${summaryHtml}</div>
-  <div class="kpis">
-    ${kpis.map((k) => `<div class="kpi ${k.tone}"><span class="val">${esc(k.value)}</span><span class="lab">${esc(k.label)}</span></div>`).join("\n    ")}
-  </div>
-
-  <div class="note"><strong>Hinweis:</strong> Technisches Hilfsmittel, keine Rechtsberatung. / Technical aid, not legal advice. Die Schweregrad-Einstufung je Rechtsraum ist eine technisch-juristische Einordnungshilfe und ersetzt keine Beratung.</div>
-
-  <h2><span class="num">02</span>Jurisdictions</h2>
-  <p class="sub">Dieselben technischen Fakten, unterschiedliche Konsequenz. Die Einstufung erfolgt je Rechtsraum \u2014 eine globale Compliance-Aussage w\xE4re unseri\xF6s.</p>
-  <div class="jgrid">
-    ${jCards}
-  </div>
-
-  <h2><span class="num">03</span>Szenarien &amp; Beweise</h2>
-  <p class="sub">Jedes ausgef\xFChrte Szenario mit Status, Ablauf, Tracker-Requests, Storage-Diff und Screenshots. Ein nicht gefundenes Merkmal ergibt kein gr\xFCnes H\xE4kchen \u2014 sondern \xABnicht pr\xFCfbar\xBB.</p>
-  ${cards}
-
-  ${report.violations.length > 0 ? `<h2><span class="num">04</span>Befunde (Regelverst\xF6sse)</h2>
-  <p class="sub">Vollst\xE4ndige Liste der dokumentierten Tracker-Requests ohne g\xFCltige Einwilligung \u2014 verletzt die konfigurierte Regel \xABKeine Analytics-Requests vor Zustimmung\xBB.</p>
-  <table class="mini">
-    <thead><tr><th>Szenario</th><th>Tracker</th><th>Request</th><th>Zeit</th></tr></thead>
-    <tbody>${leakRows}</tbody>
-  </table>` : ""}
-
-  ${problemGroups.length > 0 ? `<h2><span class="num">05</span>Was zuerst beheben</h2>
-  <p class="sub">${esc(facts.problemsText)} \u2014 gruppiert aus ${esc(findingsCountText(report.totalViolations))}. \xABN Requests\xBB z\xE4hlt die dokumentierten Zeilen derselben Ursache, nicht unabh\xE4ngige Testl\xE4ufe.</p>
-  <table class="mini">
-    <thead><tr><th>#</th><th>Tracker</th><th>Regel</th><th>Reproduktion</th></tr></thead>
-    <tbody>${problemRows}</tbody>
-  </table>` : ""}
-
-  ${observed.length > 0 ? `<h2><span class="num">06</span>Beobachtete Tracker-Requests</h2>
-  <p class="sub">Alle erfassten Tracker-Requests aus den Szenario-Timelines \u2014 auch solche, die keine eigene Violation-Row erzeugt haben. ${esc(findingsCountText(report.totalViolations))} gegen\xFCber ${observed.length === 1 ? "1 Beobachtung" : `${observed.length} Beobachtungen`}.</p>
-  <table class="mini">
-    <thead><tr><th>Szenario</th><th>Zeit</th><th>Tracker</th><th>Phase</th><th>Request</th></tr></thead>
-    <tbody>${observedRows}</tbody>
-  </table>` : ""}
-
-  <h2><span class="num">07</span>Empfehlungen</h2>
-  <p class="sub">Ausschliesslich aus belegten Befunden dieses Scans abgeleitet \u2014 Beobachtung und Massnahme getrennt.</p>
-  <ol class="recs" id="recommendations">
-    ${recItems}
-  </ol>
-  ${solutions.length > 0 ? `<h2><span class="num">08</span>Code-L\xF6sungen</h2>
-  <p class="sub">Schematische Umsetzungsmuster zu den verletzten Regeln dieses Scans \u2014 an die eigene CMP/Tracker-Stack anpassen, kein Copy-Paste-Fix.</p>
-  <div class="solutions" id="code-solutions">
-    ${solutionCards}
-  </div>` : ""}
-</main>
-<footer class="fuss">
-  <span class="claim">KI-Systeme, die bleiben.</span>
-  \xA9 CuonzTech \xB7 Privacy Chaos Gate \xB7 Technisches Hilfsmittel, keine Rechtsberatung.
-</footer>
-</body>
-</html>`;
-}
-
-// src/core/report/deluxePdf.ts
-import path4 from "path";
-import fs4 from "fs/promises";
-var esc2 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-var FONT_LINKS = `<link rel="preconnect" href="https://fonts.googleapis.com">
-<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-<link href="https://fonts.googleapis.com/css2?family=Cormorant+Garamond:wght@500;600;700&family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">`;
-function buildCoverHtml(report, options = {}) {
-  const client = options.clientName ?? "pilot-kunde.ch";
-  const issued = options.issuedAt ?? report.scannedAt;
-  const gate = report.totalViolations === 0 ? "PASS" : "BLOCKED";
-  const gateTone = report.totalViolations === 0 ? "ok" : "blocked";
-  const scenarios = report.evidence?.length ?? 0;
-  const demoBadge = options.demo ? `<div class="demo-badge">Demo-Report \xB7 synthetische Testdaten \u2014 keine realen Kundendaten</div>` : "";
-  return `<!DOCTYPE html>
-<html lang="de-CH">
-<head>
-<meta charset="utf-8">
-<title>CuonzTech \xB7 Pr\xFCfbericht</title>
-${FONT_LINKS}
-<style>
-  :root {
-    --bg: #05070D; --panel: #0C111D; --gold: #D6B56D; --gold-hell: #F4DDA0;
-    --text: #F5F2EA; --soft: #D9D2BF; --muted: #9A9384;
-    --ok: #7EE7B6; --warn: #FF7777;
-    --serif: "Cormorant Garamond", "Times New Roman", Georgia, serif;
-    --sans: Inter, "Segoe UI", system-ui, sans-serif;
-    --mono: ui-monospace, Consolas, monospace;
-  }
-  * { box-sizing: border-box; }
-  html, body { margin: 0; padding: 0; background: var(--bg); }
-  .cover {
-    width: 100%; min-height: 297mm; padding: 26mm 24mm 22mm;
-    background: var(--bg); color: var(--text);
-    background-image:
-      radial-gradient(ellipse 90% 45% at 50% -12%, rgba(214,181,109,0.18), transparent),
-      linear-gradient(180deg, rgba(214,181,109,0.06) 0, transparent 28%);
-    font-family: var(--sans);
-    page-break-after: always;
-    display: flex; flex-direction: column;
-  }
-  .cover::before {
-    content: ""; display: block; height: 3px; margin: -26mm -24mm 18mm;
-    background: linear-gradient(90deg, var(--gold) 0%, rgba(214,181,109,0.15) 70%, transparent);
-  }
-  .marke {
-    font: 600 11px/1 var(--sans); letter-spacing: 0.34em;
-    color: var(--gold); text-transform: uppercase;
-    display: flex; align-items: center; gap: 12px;
-  }
-  .marke .dot { width: 7px; height: 7px; border-radius: 50%; background: var(--gold); flex: 0 0 auto; }
-  h1 {
-    font: 600 54px/1.05 var(--serif); color: var(--gold-hell);
-    margin: 14mm 0 6mm; max-width: 14ch;
-  }
-  .lede { color: var(--soft); font-size: 15px; max-width: 54ch; line-height: 1.75; margin: 0; }
-  .rule {
-    height: 1px; margin: 12mm 0 10mm; border: 0;
-    background: linear-gradient(90deg, rgba(214,181,109,0.55), rgba(214,181,109,0.08));
-  }
-  .fakten { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; }
-  .fakt {
-    background: var(--panel); border: 1px solid rgba(214,181,109,0.22);
-    border-radius: 10px; padding: 16px 18px;
-  }
-  .fakt .lab {
-    font: 600 9px/1.4 var(--sans); letter-spacing: 0.16em;
-    text-transform: uppercase; color: var(--muted);
-  }
-  .fakt .val { font: 600 22px/1.25 var(--serif); color: var(--gold-hell); margin-top: 6px; word-break: break-word; }
-  .fakt .val.sm { font-size: 15px; font-family: var(--sans); font-weight: 500; color: var(--text); }
-  .fakt.wide { grid-column: 1 / -1; }
-  .gate {
-    margin-top: 12mm; padding: 18px 22px; border-radius: 12px;
-    border: 1px solid var(--gold); background: rgba(214,181,109,0.07);
-  }
-  .gate .gtitle {
-    font: 600 13px/1 var(--sans); letter-spacing: 0.16em; text-transform: uppercase;
-    color: var(--gold);
-  }
-  .gate.blocked { border-color: var(--warn); background: rgba(255,119,119,0.08); }
-  .gate.blocked .gtitle { color: var(--warn); }
-  .gate .gdetail { margin: 10px 0 0; font-size: 13px; line-height: 1.65; color: var(--soft); }
-  .stats {
-    display: flex; gap: 28px; margin-top: 10mm; color: var(--muted);
-    font: 500 12px/1.4 var(--sans); letter-spacing: 0.06em;
-  }
-  .stats b { display: block; font: 600 28px/1.1 var(--serif); color: var(--gold-hell); letter-spacing: 0; }
-  .sign {
-    margin-top: auto; padding-top: 8mm;
-    display: flex; justify-content: space-between; align-items: flex-end; gap: 24px;
-  }
-  .sign .line {
-    width: 62mm; border-top: 1px solid rgba(214,181,109,0.45); padding-top: 8px;
-    color: var(--muted); font-size: 10px; letter-spacing: 0.12em; text-transform: uppercase;
-  }
-  .legal {
-    margin-top: 8mm; padding-top: 10px;
-    color: var(--muted); font-size: 10px; line-height: 1.65;
-    border-top: 1px solid rgba(214,181,109,0.25);
-    max-width: 100%;
-  }
-  .demo-badge {
-    display: inline-block; margin: 0 0 8mm; padding: 10px 14px;
-    border: 1px solid var(--gold); border-radius: 4px;
-    color: var(--gold-hell); background: rgba(214,181,109,0.12);
-    font: 600 12px/1.4 var(--sans); letter-spacing: 0.08em; text-transform: uppercase;
-  }
-</style>
-</head>
-<body>
-<div class="cover">
-  <div class="marke"><span class="dot"></span>CuonzTech \xB7 Privacy Chaos Gate</div>
-  ${demoBadge}
-  <h1>Consent-Pr\xFCfbericht</h1>
-  <p class="lede">Dieser Bericht fasst zusammen, ob Tracking vor der Einwilligung ausbleibt,
-  ob erlaubtes Tracking danach korrekt startet und ob Widerruf sowie Kategorie-Auswahl
-  zuverl\xE4ssig funktionieren. Grundlage ist ein automatisierter Stresstest mit
-  ${scenarios} Chaos-Szenarien.</p>
-
-  <hr class="rule">
-
-  <div class="fakten">
-    <div class="fakt"><div class="lab">Kunde</div><div class="val">${esc2(client)}</div></div>
-    <div class="fakt"><div class="lab">Scan-Datum</div><div class="val sm">${esc2(new Date(issued).toLocaleDateString("de-CH", { dateStyle: "long" }))}</div></div>
-    <div class="fakt wide"><div class="lab">Gepr\xFCftes System</div><div class="val sm">${esc2(report.targetUrl)}</div></div>
-  </div>
-
-  <div class="gate ${gateTone}">
-    <div class="gtitle">Technisches Gate: ${gate}</div>
-    <p class="gdetail">${report.totalViolations === 0 ? "Keine dokumentierten Tracker-Funde in den ausgef\xFChrten Szenarien. Eine rechtliche Gesamtbewertung erfolgt nicht." : `${report.totalViolations === 1 ? "1 dokumentierte Befund-Zeile" : `${report.totalViolations} dokumentierte Befund-Zeilen`} in den ausgef\xFChrten Szenarien. Eine rechtliche Gesamtbewertung erfolgt nicht.`}</p>
-  </div>
-
-  <div class="stats">
-    <div><b>${scenarios}</b>Szenarien</div>
-    <div><b>${report.totalViolations}</b>Befunde</div>
-    <div><b>${(report.evidence ?? []).reduce((n, e) => n + e.requestTimeline.filter((r) => r.trackerName).length, 0)}</b>Tracker-Requests</div>
-  </div>
-
-  <div class="sign">
-    <div class="line">Ort, Datum \xB7 Empfangsbest\xE4tigung Kunde</div>
-    <div class="line">Ausgestellt von CuonzTech</div>
-  </div>
-
-  <div class="legal">
-    Technisches Hilfsmittel, keine Rechtsberatung. / Technical aid, not legal advice.
-    Die Rechtsraum-Einordnung im Bericht ist eine technisch-juristische Hilfestellung
-    und ersetzt keine Beratung durch eine Fachperson. Automatisierte Pr\xFCfung \u2014
-    ein nicht gefundenes Merkmal ergibt kein gr\xFCnes H\xE4kchen.
-  </div>
-</div>
-</body>
-</html>`;
-}
-function extractStyles(html) {
-  return [...html.matchAll(/<style>([\s\S]*?)<\/style>/g)].map((m) => m[1]).join("\n");
-}
-function extractBody(html) {
-  return html.match(/<body>([\s\S]*)<\/body>/)?.[1] ?? html;
-}
-async function renderDeluxeCombined(coverHtml, evidenceHtmlPath, outPath, previewDir) {
-  const { chromium: chromium2 } = await import("playwright");
-  const evidenceHtml = await fs4.readFile(evidenceHtmlPath, "utf-8");
-  const styles = [extractStyles(coverHtml), extractStyles(evidenceHtml)].join("\n");
-  const evidenceBody = extractBody(evidenceHtml).replace(/<div class="demo-banner">[\s\S]*?<\/div>\s*/, "").replace(
-    /<header class="hero">[\s\S]*?<\/header>/,
-    ""
-  );
-  const combined = `<!DOCTYPE html>
-<html lang="de-CH">
-<head>
-<meta charset="utf-8">
-<title>CuonzTech \xB7 Consent-Pr\xFCfbericht</title>
-${FONT_LINKS}
-<style>
-html, body { margin: 0; padding: 0; background: #05070D; }
-  * { -webkit-print-color-adjust: exact !important; print-color-adjust: exact !important; }
-${styles}
-</style>
-</head>
-<body>
-${extractBody(coverHtml)}
-${evidenceBody}
-</body>
-</html>`;
-  const browser = await chromium2.launch({ headless: true });
-  try {
-    const page = await browser.newPage();
-    await page.setContent(combined, { waitUntil: "networkidle" });
-    await page.evaluate(() => document.fonts?.ready ?? Promise.resolve());
-    await page.emulateMedia({ media: "print" });
-    await page.waitForTimeout(400);
-    if (previewDir) {
-      await fs4.mkdir(previewDir, { recursive: true });
-      const size = { width: 794, height: 1123 };
-      await page.setViewportSize(size);
-      const pages = await page.evaluate(() => {
-        const el = document.querySelector(".cover") ?? document.body;
-        const h = Math.max(
-          document.documentElement.scrollHeight,
-          el.scrollHeight
-        );
-        return Math.ceil(h / 1123);
-      });
-      for (let i = 0; i < Math.min(pages, 4); i++) {
-        await page.evaluate((y) => window.scrollTo(0, y), i * 1123);
-        await page.waitForTimeout(150);
-        await page.screenshot({
-          path: path4.join(previewDir, `p${String(i + 1).padStart(2, "0")}.png`)
-        });
-      }
-    }
-    const pdf = await page.pdf({ format: "A4", printBackground: true });
-    await fs4.mkdir(path4.dirname(outPath), { recursive: true });
-    await fs4.writeFile(outPath, pdf);
-    return outPath;
-  } finally {
-    await browser.close().catch(() => {
-    });
-  }
-}
-async function renderDeluxePdf(coverHtml, evidenceHtmlPath, outPath) {
-  return renderDeluxeCombined(coverHtml, evidenceHtmlPath, outPath);
-}
-
-// src/core/orchestrator.ts
-import fs5 from "fs/promises";
-import path5 from "path";
-import pc from "picocolors";
-var PrivacyChaosGate = class {
-  scanner;
-  remediationEngine;
-  constructor(scanner, remediationEngine) {
-    this.scanner = scanner ?? new ChaosScanner();
-    this.remediationEngine = remediationEngine ?? new RemediationEngine();
-  }
-  async run(config) {
-    console.log(pc.bold(pc.cyan("\n=======================================================")));
-    console.log(pc.bold(pc.cyan("       CUONZTECH PRIVACY CHAOS GATE (CPCG)             ")));
-    console.log(pc.bold(pc.cyan("=======================================================\n")));
-    console.log(pc.blue("\xB9 Target URL:        "), pc.white(config.targetUrl));
-    console.log(pc.blue("\xB9 Auto-Fix Enabled:  "), pc.white(String(config.autoFix)));
-    console.log(pc.blue("\xB9 Fail on Leak:      "), pc.white(String(config.failOnLeak)));
-    console.log(pc.blue("\xB9 Report Output:     "), pc.white(config.reportOutput));
-    console.log("");
-    console.log(pc.bold(pc.yellow("\u2013\xB6 Phase 1: Scanning with Privacy Chaos Routines...")));
-    const report = await this.scanner.scan(config);
-    console.log(
-      pc.green(`\u0153 Scan complete in ${report.durationMs}ms. Found ${report.totalViolations} leak(s).`)
-    );
-    console.log(pc.bold(pc.yellow("\n\u2013\xB6 Phase 2: Analyzing Privacy Chaos Results...")));
-    if (report.totalViolations > 0) {
-      console.log(pc.red(`\u0153\u2013 Detected ${report.totalViolations} unauthorized tracker leak(s)!`));
-      for (const violation of report.violations) {
-        console.log(
-          pc.red(`   [${violation.scenario}] ${violation.trackerName} (${violation.trackerCategory}): ${violation.requestUrl}`)
-        );
-      }
-    } else {
-      console.log(pc.green("\u0153 All privacy chaos tests passed! Zero tracker leaks detected."));
-    }
-    let remediation;
-    if (report.totalViolations > 0 && config.autoFix) {
-      console.log(pc.bold(pc.yellow("\n\u2013\xB6 Phase 3: Triggering Agentic Auto-Remediation & Review Agent...")));
-      remediation = await this.remediationEngine.remediate(report, config);
-      if (remediation.reviewVerdict) {
-        console.log(pc.bold(pc.magenta("\u2013\xB6 Review Agent Evaluation:")));
-        console.log(pc.cyan(`  Score: ${remediation.reviewVerdict.score}/100 | Passed: ${remediation.reviewVerdict.passed}`));
-        for (const comment of remediation.reviewVerdict.comments) {
-          console.log(pc.dim(`  ${comment}`));
-        }
-      }
-      if (remediation.success) {
-        console.log(pc.green("\u0153 Auto-remediation approved and applied successfully!"));
-        if (remediation.commitHash) {
-          console.log(pc.green(`\u0153 Git commit created: ${remediation.commitHash}`));
-        }
-        if (remediation.pullRequest) {
-          if (remediation.pullRequest.prUrl) {
-            console.log(pc.bold(pc.green(`\u0153 GitHub Pull Request: ${remediation.pullRequest.prUrl}`)));
-          } else {
-            console.log(pc.bold(pc.cyan(`\u0153 Fix committed locally on branch '${remediation.pullRequest.branchName}' (no remote/token: no PR opened)`)));
-          }
-        }
-      } else {
-        console.log(pc.red(`\u0153\u2013 Auto-remediation failed: ${remediation.error ?? "Unknown error"}`));
-      }
-    }
-    await this.saveReport(report, config.reportOutput, config.demo === true, config.reportPdf === true, config.clientName);
-    let status = "clean";
-    let exitCode = 0;
-    if (report.totalViolations > 0) {
-      if (remediation?.success) {
-        status = "remediated";
-        exitCode = 0;
-      } else {
-        status = "blocked";
-        exitCode = config.failOnLeak ? 1 : 0;
-      }
-    }
-    await this.writeGitHubOutputs({
-      leaksFound: report.totalViolations > 0,
-      leaksCount: report.totalViolations,
-      patchApplied: remediation?.success ?? false,
-      reportPath: path5.resolve(config.reportOutput)
-    });
-    await this.writeGitHubSummary(config, report, status, remediation);
-    console.log(pc.bold(pc.cyan("\n-------------------------------------------------------")));
-    if (status === "clean") {
-      console.log(pc.bold(pc.green("\u0153 GATE RESULT: PASS (No privacy leaks)")));
-    } else if (status === "remediated") {
-      console.log(pc.bold(pc.green("\u0153 GATE RESULT: PASS (Leaks automatically remediated)")));
-    } else {
-      console.log(pc.bold(pc.red(`\u0153\u2013 GATE RESULT: BLOCKED (${report.totalViolations} unpatched leaks)`)));
-    }
-    console.log(pc.bold(pc.cyan("-------------------------------------------------------\n")));
-    console.log(pc.dim(LEGAL_DISCLAIMER));
-    console.log("");
-    return {
-      report,
-      remediation,
-      status,
-      exitCode
-    };
-  }
-  async saveReport(report, outputPath, demo = false, reportPdf = false, clientName) {
-    const resolvedPath = path5.resolve(outputPath);
-    const dir = path5.dirname(resolvedPath);
-    await fs5.mkdir(dir, { recursive: true });
-    const portable = {
-      ...report,
-      evidence: (report.evidence ?? []).map((e) => ({
-        ...e,
-        screenshots: e.screenshots?.map((s) => ({ ...s, path: `evidence/${path5.basename(s.path)}` })),
-        screenshotPath: e.screenshotPath ? `evidence/${path5.basename(e.screenshotPath)}` : e.screenshotPath
-      }))
-    };
-    await fs5.writeFile(resolvedPath, JSON.stringify(portable, null, 2), "utf-8");
-    console.log(pc.dim("Leak report saved to: " + resolvedPath));
-    const evidenceDir = path5.join(dir, "evidence");
-    const shots = [];
-    for (const e of report.evidence ?? []) {
-      for (const s of e.screenshots ?? []) shots.push(s);
-      if (e.screenshotPath && !(e.screenshots ?? []).length) {
-        shots.push({ label: "screenshot", path: e.screenshotPath, at: e.checkedAt });
-      }
-    }
-    if (shots.length) {
-      await fs5.mkdir(evidenceDir, { recursive: true });
-      for (const s of shots) {
-        try {
-          const dest = path5.join(evidenceDir, path5.basename(s.path));
-          await fs5.copyFile(s.path, dest).catch(() => {
-          });
-        } catch {
-        }
-      }
-      console.log(pc.dim("Evidence screenshots copied to: " + evidenceDir));
-    }
-    const base = resolvedPath.replace(/\.json$/i, "");
-    const mdPath = base + "-evidence.md";
-    await fs5.writeFile(mdPath, buildEvidenceMarkdown(report, "Evidence Report", { demo }), "utf-8");
-    console.log(pc.dim("Evidence report saved to: " + mdPath));
-    const htmlPath = base + "-evidence.html";
-    await fs5.writeFile(
-      htmlPath,
-      buildEvidenceHtml(report, "Evidence Report", { demo }),
-      "utf-8"
-    );
-    console.log(pc.dim("Evidence HTML saved to: " + htmlPath));
-    if (reportPdf) {
-      try {
-        const cover = buildCoverHtml(report, {
-          clientName: clientName ?? "pilot-kunde.ch",
-          issuedAt: report.scannedAt,
-          demo
-        });
-        const pdfPath = base + "-deluxe.pdf";
-        await renderDeluxeCombined(cover, htmlPath, pdfPath);
-        console.log(pc.dim("Deluxe PDF saved to: " + pdfPath));
-      } catch (err) {
-        console.log(pc.dim("PDF generation skipped: " + String(err).slice(0, 100)));
-      }
-    }
-  }
-  async writeGitHubOutputs(outputs) {
-    const githubOutputPath = process.env.GITHUB_OUTPUT;
-    if (!githubOutputPath) return;
-    const lines = [
-      `leaks_found=${outputs.leaksFound}`,
-      `leaks_count=${outputs.leaksCount}`,
-      `patch_applied=${outputs.patchApplied}`,
-      `report_path=${outputs.reportPath}`
-    ].join("\n");
-    try {
-      await fs5.appendFile(githubOutputPath, `${lines}
-`, "utf-8");
-    } catch (err) {
-      console.warn(pc.yellow("\u0161 Could not write to GITHUB_OUTPUT: " + String(err)));
-    }
-  }
-  async writeGitHubSummary(config, report, status, remediation) {
-    const summaryPath = process.env.GITHUB_STEP_SUMMARY;
-    if (!summaryPath) return;
-    const statusBadge = status === "clean" ? "### \xF0\u0178\u203A\xA1\xEF\xB8 Cuonztech Privacy Chaos Gate: **PASSED (Clean)**" : status === "remediated" ? "### \xF0\u0178\u203A\xA1\xEF\xB8 Cuonztech Privacy Chaos Gate: **PASSED (Auto-Remediated)**" : "### \xF0\u0178\u203A\u2018 Cuonztech Privacy Chaos Gate: **BLOCKED (Privacy Leaks Found)**";
-    const lines = [
-      statusBadge,
-      "",
-      "| Metric | Value |",
-      "| :--- | :--- |",
-      `| **Target URL** | \`${config.targetUrl}\` |`,
-      `| **Duration** | \`${report.durationMs}ms\` |`,
-      `| **Total Violations** | \`${report.totalViolations}\` |`,
-      `| **Passed Scenarios** | ${report.passedScenarios.map((s) => `\`${s}\``).join(", ") || "None"} |`,
-      `| **Failed Scenarios** | ${report.failedScenarios.map((s) => `\`${s}\``).join(", ") || "None"} |`,
-      ""
-    ];
-    if (report.violations.length > 0) {
-      lines.push("#### \xF0\u0178\u0161\xA8 Detected Privacy Leaks");
-      lines.push("| Scenario | Tracker | Category | Intercepted Request |");
-      lines.push("| :--- | :--- | :--- | :--- |");
-      for (const v of report.violations) {
-        lines.push(
-          `| \`${escapeCell(v.scenario)}\` | **${escapeCell(v.trackerName)}** | \`${escapeCell(v.trackerCategory)}\` | \`${escapeCell(v.requestUrl)}\` |`
-        );
-      }
-      lines.push("");
-    }
-    if (remediation) {
-      lines.push("#### \xF0\u0178\xA7 Agentic Auto-Remediation");
-      if (remediation.success) {
-        lines.push(`> **Status:** Patches successfully generated and applied.`);
-        if (remediation.commitHash) {
-          lines.push(`> **Git Commit:** \`${remediation.commitHash}\``);
-        }
-        for (const patch of remediation.patches) {
-          lines.push(`* **Patched:** \`${patch.filePath}\` - ${patch.explanation}`);
-        }
-        if (remediation.pullRequest) {
-          lines.push(
-            remediation.pullRequest.prUrl ? `> **Pull Request:** ${remediation.pullRequest.prUrl}` : `> **Fix committed locally on branch (no remote/token, no PR opened):** \`${remediation.pullRequest.branchName}\``
-          );
-        }
-      } else {
-        lines.push(`> \u0161\xEF\xB8 **Status:** Auto-remediation failed: ${remediation.error}`);
-      }
-      if (remediation.reviewVerdict) {
-        lines.push("", "#### \xF0\u0178\u017D Review Agent Verdict");
-        lines.push(`> **Score:** \`${remediation.reviewVerdict.score}/100\` | **Passed:** \`${remediation.reviewVerdict.passed}\``);
-        for (const c of remediation.reviewVerdict.comments) {
-          lines.push(`* ${c.replace(/\n/g, " ")}`);
-        }
-      }
-      lines.push("");
-    }
-    try {
-      await fs5.appendFile(summaryPath, lines.join("\n") + "\n", "utf-8");
-    } catch (err) {
-      console.warn(pc.yellow("\u0161 Could not write to GITHUB_STEP_SUMMARY: " + String(err)));
-    }
-  }
-};
-
-export {
-  ChaosScenarioSchema,
-  EvidenceStatusSchema,
-  StorageSnapshotSchema,
-  RequestEventSchema,
-  EvidenceRecordSchema,
-  TrackerCategorySchema,
-  TrackerViolationSchema,
-  LeakReportSchema,
-  FilePatchSchema,
-  ReviewVerdictSchema,
-  PullRequestResultSchema,
-  RemediationResultSchema,
-  GateConfigSchema,
-  resolveGateConfig,
-  isOnTargetOrigin,
-  clickFirstSameOriginLink,
-  ChaosScanner,
-  CONSENT_ACTIVATION_RUNTIME,
-  RemediationEngine,
-  resolveJurisdiction,
-  statusLabelOf,
-  codeSolutionsFor,
-  deriveReportFacts,
-  findingsCountText,
-  problemsTextOf,
-  groupFindings,
-  reproductionText,
-  buildEvidenceMarkdown,
-  buildEvidenceHtml,
-  buildCoverHtml,
-  renderDeluxeCombined,
-  renderDeluxePdf,
-  PrivacyChaosGate
-};
-//# sourceMappingURL=chunk-T5D6BUAC.js.map