cuonztech-privacy-chaos-gate 0.2.2 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/README.md +394 -310
  2. package/THIRD_PARTY_NOTICES.md +14 -0
  3. package/action.yml +71 -8
  4. package/dist/{chunk-42D7PLVP.js → chunk-YOWEZW3W.js} +4468 -1542
  5. package/dist/cli.js +11 -8
  6. package/dist/index.d.ts +857 -72
  7. package/dist/index.js +23 -3
  8. package/docs/BRAND-PILOT-EVIDENCE.md +6 -4
  9. package/licenses/Open-Cookie-Database-LICENSE.txt +201 -0
  10. package/package.json +3 -1
package/dist/index.d.ts CHANGED
@@ -3,7 +3,7 @@ import { z } from 'zod';
3
3
  /**
4
4
  * Chaos test scenarios as defined in PRD Section 2B
5
5
  */
6
- declare const ChaosScenarioSchema: z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability"]>;
6
+ declare const ChaosScenarioSchema: z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability", "gpc-signal"]>;
7
7
  type ChaosScenario = z.infer<typeof ChaosScenarioSchema>;
8
8
  /**
9
9
  * Evidence status: «nicht prüfbar» ist bewusst kein grünes Häkchen.
@@ -48,19 +48,23 @@ declare const RequestEventSchema: z.ZodObject<{
48
48
  url: z.ZodString;
49
49
  trackerName: z.ZodOptional<z.ZodString>;
50
50
  trackerCategory: z.ZodOptional<z.ZodString>;
51
- phase: z.ZodEnum<["pre-consent", "post-accept", "post-reject", "post-selection", "post-revoke", "post-wipe", "post-reject-restart", "other"]>;
51
+ phase: z.ZodEnum<["pre-consent", "post-accept", "post-reject", "post-selection", "post-revoke", "post-wipe", "post-tamper", "gpc", "post-reject-restart", "other"]>;
52
+ /** IAB-TCF-String im Request (nur nach einer Ablehnung): «denied» weder Zustimmung noch berechtigtes Interesse, «li» nur berechtigtes Interesse, «granted» Zustimmung */
53
+ tcf: z.ZodOptional<z.ZodEnum<["denied", "li", "granted"]>>;
52
54
  }, "strip", z.ZodTypeAny, {
53
55
  at: string;
54
56
  url: string;
55
- phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-reject-restart" | "other";
57
+ phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-tamper" | "gpc" | "post-reject-restart" | "other";
56
58
  trackerName?: string | undefined;
57
59
  trackerCategory?: string | undefined;
60
+ tcf?: "denied" | "li" | "granted" | undefined;
58
61
  }, {
59
62
  at: string;
60
63
  url: string;
61
- phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-reject-restart" | "other";
64
+ phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-tamper" | "gpc" | "post-reject-restart" | "other";
62
65
  trackerName?: string | undefined;
63
66
  trackerCategory?: string | undefined;
67
+ tcf?: "denied" | "li" | "granted" | undefined;
64
68
  }>;
65
69
  type RequestEvent = z.infer<typeof RequestEventSchema>;
66
70
  /**
@@ -68,9 +72,18 @@ type RequestEvent = z.infer<typeof RequestEventSchema>;
68
72
  * Wird in LeakReport.evidence abgelegt (JSON) und optional als Screenshot gespeichert.
69
73
  */
70
74
  declare const EvidenceRecordSchema: z.ZodObject<{
71
- scenario: z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability"]>;
75
+ scenario: z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability", "gpc-signal"]>;
72
76
  status: z.ZodEnum<["passed", "suspicious", "not-checkable", "not-applicable"]>;
73
77
  note: z.ZodString;
78
+ /** Bei «nicht prüfbar» / «nicht anwendbar»: der Grund in einem Satz (ohne Status-Vorspann). */
79
+ reason: z.ZodOptional<z.ZodString>;
80
+ /**
81
+ * «auffällig» nur wegen beobachteter Tracker-Requests/Cookies (die Aktion selbst lief durch). Der Scanner kennt den
82
+ * Rechtsraum nicht; sind diese Beobachtungen nach dem gewählten Rechtsraum nur Hinweise, gilt das Szenario als bestanden.
83
+ */
84
+ findingsOnly: z.ZodOptional<z.ZodBoolean>;
85
+ /** Vom Gate gesetzt: so viele Beobachtungen dieses Szenarios sind nach dem Rechtsraum nur Hinweis. */
86
+ hintFindings: z.ZodOptional<z.ZodNumber>;
74
87
  actionSequence: z.ZodArray<z.ZodString, "many">;
75
88
  /** Zeitstempel je Aktion, parallel zu actionSequence */
76
89
  actionTimeline: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -88,19 +101,23 @@ declare const EvidenceRecordSchema: z.ZodObject<{
88
101
  url: z.ZodString;
89
102
  trackerName: z.ZodOptional<z.ZodString>;
90
103
  trackerCategory: z.ZodOptional<z.ZodString>;
91
- phase: z.ZodEnum<["pre-consent", "post-accept", "post-reject", "post-selection", "post-revoke", "post-wipe", "post-reject-restart", "other"]>;
104
+ phase: z.ZodEnum<["pre-consent", "post-accept", "post-reject", "post-selection", "post-revoke", "post-wipe", "post-tamper", "gpc", "post-reject-restart", "other"]>;
105
+ /** IAB-TCF-String im Request (nur nach einer Ablehnung): «denied» weder Zustimmung noch berechtigtes Interesse, «li» nur berechtigtes Interesse, «granted» Zustimmung */
106
+ tcf: z.ZodOptional<z.ZodEnum<["denied", "li", "granted"]>>;
92
107
  }, "strip", z.ZodTypeAny, {
93
108
  at: string;
94
109
  url: string;
95
- phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-reject-restart" | "other";
110
+ phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-tamper" | "gpc" | "post-reject-restart" | "other";
96
111
  trackerName?: string | undefined;
97
112
  trackerCategory?: string | undefined;
113
+ tcf?: "denied" | "li" | "granted" | undefined;
98
114
  }, {
99
115
  at: string;
100
116
  url: string;
101
- phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-reject-restart" | "other";
117
+ phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-tamper" | "gpc" | "post-reject-restart" | "other";
102
118
  trackerName?: string | undefined;
103
119
  trackerCategory?: string | undefined;
120
+ tcf?: "denied" | "li" | "granted" | undefined;
104
121
  }>, "many">;
105
122
  storageBefore: z.ZodObject<{
106
123
  cookies: z.ZodArray<z.ZodString, "many">;
@@ -222,15 +239,16 @@ declare const EvidenceRecordSchema: z.ZodObject<{
222
239
  }, "strip", z.ZodTypeAny, {
223
240
  targetUrl: string;
224
241
  status: "passed" | "suspicious" | "not-checkable" | "not-applicable";
225
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
242
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
226
243
  note: string;
227
244
  actionSequence: string[];
228
245
  requestTimeline: {
229
246
  at: string;
230
247
  url: string;
231
- phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-reject-restart" | "other";
248
+ phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-tamper" | "gpc" | "post-reject-restart" | "other";
232
249
  trackerName?: string | undefined;
233
250
  trackerCategory?: string | undefined;
251
+ tcf?: "denied" | "li" | "granted" | undefined;
234
252
  }[];
235
253
  storageBefore: {
236
254
  cookies: string[];
@@ -251,6 +269,9 @@ declare const EvidenceRecordSchema: z.ZodObject<{
251
269
  }[] | undefined;
252
270
  };
253
271
  checkedAt: string;
272
+ reason?: string | undefined;
273
+ findingsOnly?: boolean | undefined;
274
+ hintFindings?: number | undefined;
254
275
  actionTimeline?: {
255
276
  at: string;
256
277
  action: string;
@@ -275,15 +296,16 @@ declare const EvidenceRecordSchema: z.ZodObject<{
275
296
  }, {
276
297
  targetUrl: string;
277
298
  status: "passed" | "suspicious" | "not-checkable" | "not-applicable";
278
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
299
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
279
300
  note: string;
280
301
  actionSequence: string[];
281
302
  requestTimeline: {
282
303
  at: string;
283
304
  url: string;
284
- phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-reject-restart" | "other";
305
+ phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-tamper" | "gpc" | "post-reject-restart" | "other";
285
306
  trackerName?: string | undefined;
286
307
  trackerCategory?: string | undefined;
308
+ tcf?: "denied" | "li" | "granted" | undefined;
287
309
  }[];
288
310
  storageBefore: {
289
311
  cookies: string[];
@@ -304,6 +326,9 @@ declare const EvidenceRecordSchema: z.ZodObject<{
304
326
  }[] | undefined;
305
327
  };
306
328
  checkedAt: string;
329
+ reason?: string | undefined;
330
+ findingsOnly?: boolean | undefined;
331
+ hintFindings?: number | undefined;
307
332
  actionTimeline?: {
308
333
  at: string;
309
334
  action: string;
@@ -330,16 +355,16 @@ type EvidenceRecord = z.infer<typeof EvidenceRecordSchema>;
330
355
  /**
331
356
  * Tracker category classification
332
357
  */
333
- declare const TrackerCategorySchema: z.ZodEnum<["analytics", "marketing", "functional", "unknown"]>;
358
+ declare const TrackerCategorySchema: z.ZodEnum<["analytics", "marketing", "functional", "cookieless-analytics", "unknown"]>;
334
359
  type TrackerCategory = z.infer<typeof TrackerCategorySchema>;
335
360
  /**
336
361
  * Detailed representation of a detected tracker violation (leak)
337
362
  */
338
363
  declare const TrackerViolationSchema: z.ZodObject<{
339
364
  id: z.ZodString;
340
- scenario: z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability"]>;
365
+ scenario: z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability", "gpc-signal"]>;
341
366
  trackerName: z.ZodString;
342
- trackerCategory: z.ZodEnum<["analytics", "marketing", "functional", "unknown"]>;
367
+ trackerCategory: z.ZodEnum<["analytics", "marketing", "functional", "cookieless-analytics", "unknown"]>;
343
368
  requestUrl: z.ZodString;
344
369
  /**
345
370
  * Verletzte Regel — steuert Gate-Wortlaut und Empfehlungen
@@ -348,6 +373,8 @@ declare const TrackerViolationSchema: z.ZodObject<{
348
373
  ruleId: z.ZodOptional<z.ZodString>;
349
374
  /** Hinweis ohne Gate-Wirkung (z. B. rein funktionale Drittanbieter wie Google Fonts) */
350
375
  advisory: z.ZodOptional<z.ZodBoolean>;
376
+ /** IAB-TCF-String des Requests nach einer Ablehnung: «denied» → Hinweis, «li» → bleibt `tracking-after-deny` (mit Angabe), «granted» → Regel `tcf-consent-mismatch` */
377
+ tcf: z.ZodOptional<z.ZodEnum<["denied", "li", "granted"]>>;
351
378
  method: z.ZodDefault<z.ZodString>;
352
379
  timestamp: z.ZodString;
353
380
  domContext: z.ZodOptional<z.ZodObject<{
@@ -366,13 +393,14 @@ declare const TrackerViolationSchema: z.ZodObject<{
366
393
  description: z.ZodString;
367
394
  }, "strip", z.ZodTypeAny, {
368
395
  trackerName: string;
369
- trackerCategory: "unknown" | "analytics" | "marketing" | "functional";
370
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
396
+ trackerCategory: "unknown" | "analytics" | "marketing" | "functional" | "cookieless-analytics";
397
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
371
398
  id: string;
372
399
  requestUrl: string;
373
400
  method: string;
374
401
  timestamp: string;
375
402
  description: string;
403
+ tcf?: "denied" | "li" | "granted" | undefined;
376
404
  ruleId?: string | undefined;
377
405
  advisory?: boolean | undefined;
378
406
  domContext?: {
@@ -382,12 +410,13 @@ declare const TrackerViolationSchema: z.ZodObject<{
382
410
  } | undefined;
383
411
  }, {
384
412
  trackerName: string;
385
- trackerCategory: "unknown" | "analytics" | "marketing" | "functional";
386
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
413
+ trackerCategory: "unknown" | "analytics" | "marketing" | "functional" | "cookieless-analytics";
414
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
387
415
  id: string;
388
416
  requestUrl: string;
389
417
  timestamp: string;
390
418
  description: string;
419
+ tcf?: "denied" | "li" | "granted" | undefined;
391
420
  ruleId?: string | undefined;
392
421
  advisory?: boolean | undefined;
393
422
  method?: string | undefined;
@@ -401,6 +430,8 @@ type TrackerViolation = z.infer<typeof TrackerViolationSchema>;
401
430
  /**
402
431
  * Complete structured report generated by the chaos scanner
403
432
  */
433
+ declare const BannerKindSchema: z.ZodEnum<["supported-cmp", "unsupported-cmp", "custom", "none"]>;
434
+ type BannerKind = z.infer<typeof BannerKindSchema>;
404
435
  declare const LeakReportSchema: z.ZodObject<{
405
436
  targetUrl: z.ZodString;
406
437
  scannedAt: z.ZodString;
@@ -408,9 +439,9 @@ declare const LeakReportSchema: z.ZodObject<{
408
439
  totalViolations: z.ZodNumber;
409
440
  violations: z.ZodArray<z.ZodObject<{
410
441
  id: z.ZodString;
411
- scenario: z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability"]>;
442
+ scenario: z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability", "gpc-signal"]>;
412
443
  trackerName: z.ZodString;
413
- trackerCategory: z.ZodEnum<["analytics", "marketing", "functional", "unknown"]>;
444
+ trackerCategory: z.ZodEnum<["analytics", "marketing", "functional", "cookieless-analytics", "unknown"]>;
414
445
  requestUrl: z.ZodString;
415
446
  /**
416
447
  * Verletzte Regel — steuert Gate-Wortlaut und Empfehlungen
@@ -419,6 +450,8 @@ declare const LeakReportSchema: z.ZodObject<{
419
450
  ruleId: z.ZodOptional<z.ZodString>;
420
451
  /** Hinweis ohne Gate-Wirkung (z. B. rein funktionale Drittanbieter wie Google Fonts) */
421
452
  advisory: z.ZodOptional<z.ZodBoolean>;
453
+ /** IAB-TCF-String des Requests nach einer Ablehnung: «denied» → Hinweis, «li» → bleibt `tracking-after-deny` (mit Angabe), «granted» → Regel `tcf-consent-mismatch` */
454
+ tcf: z.ZodOptional<z.ZodEnum<["denied", "li", "granted"]>>;
422
455
  method: z.ZodDefault<z.ZodString>;
423
456
  timestamp: z.ZodString;
424
457
  domContext: z.ZodOptional<z.ZodObject<{
@@ -437,13 +470,14 @@ declare const LeakReportSchema: z.ZodObject<{
437
470
  description: z.ZodString;
438
471
  }, "strip", z.ZodTypeAny, {
439
472
  trackerName: string;
440
- trackerCategory: "unknown" | "analytics" | "marketing" | "functional";
441
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
473
+ trackerCategory: "unknown" | "analytics" | "marketing" | "functional" | "cookieless-analytics";
474
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
442
475
  id: string;
443
476
  requestUrl: string;
444
477
  method: string;
445
478
  timestamp: string;
446
479
  description: string;
480
+ tcf?: "denied" | "li" | "granted" | undefined;
447
481
  ruleId?: string | undefined;
448
482
  advisory?: boolean | undefined;
449
483
  domContext?: {
@@ -453,12 +487,13 @@ declare const LeakReportSchema: z.ZodObject<{
453
487
  } | undefined;
454
488
  }, {
455
489
  trackerName: string;
456
- trackerCategory: "unknown" | "analytics" | "marketing" | "functional";
457
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
490
+ trackerCategory: "unknown" | "analytics" | "marketing" | "functional" | "cookieless-analytics";
491
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
458
492
  id: string;
459
493
  requestUrl: string;
460
494
  timestamp: string;
461
495
  description: string;
496
+ tcf?: "denied" | "li" | "granted" | undefined;
462
497
  ruleId?: string | undefined;
463
498
  advisory?: boolean | undefined;
464
499
  method?: string | undefined;
@@ -468,13 +503,22 @@ declare const LeakReportSchema: z.ZodObject<{
468
503
  scriptsFound?: string[] | undefined;
469
504
  } | undefined;
470
505
  }>, "many">;
471
- passedScenarios: z.ZodArray<z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability"]>, "many">;
472
- failedScenarios: z.ZodArray<z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability"]>, "many">;
506
+ passedScenarios: z.ZodArray<z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability", "gpc-signal"]>, "many">;
507
+ failedScenarios: z.ZodArray<z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability", "gpc-signal"]>, "many">;
473
508
  summary: z.ZodString;
474
509
  evidence: z.ZodOptional<z.ZodArray<z.ZodObject<{
475
- scenario: z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability"]>;
510
+ scenario: z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability", "gpc-signal"]>;
476
511
  status: z.ZodEnum<["passed", "suspicious", "not-checkable", "not-applicable"]>;
477
512
  note: z.ZodString;
513
+ /** Bei «nicht prüfbar» / «nicht anwendbar»: der Grund in einem Satz (ohne Status-Vorspann). */
514
+ reason: z.ZodOptional<z.ZodString>;
515
+ /**
516
+ * «auffällig» nur wegen beobachteter Tracker-Requests/Cookies (die Aktion selbst lief durch). Der Scanner kennt den
517
+ * Rechtsraum nicht; sind diese Beobachtungen nach dem gewählten Rechtsraum nur Hinweise, gilt das Szenario als bestanden.
518
+ */
519
+ findingsOnly: z.ZodOptional<z.ZodBoolean>;
520
+ /** Vom Gate gesetzt: so viele Beobachtungen dieses Szenarios sind nach dem Rechtsraum nur Hinweis. */
521
+ hintFindings: z.ZodOptional<z.ZodNumber>;
478
522
  actionSequence: z.ZodArray<z.ZodString, "many">;
479
523
  /** Zeitstempel je Aktion, parallel zu actionSequence */
480
524
  actionTimeline: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -492,19 +536,23 @@ declare const LeakReportSchema: z.ZodObject<{
492
536
  url: z.ZodString;
493
537
  trackerName: z.ZodOptional<z.ZodString>;
494
538
  trackerCategory: z.ZodOptional<z.ZodString>;
495
- phase: z.ZodEnum<["pre-consent", "post-accept", "post-reject", "post-selection", "post-revoke", "post-wipe", "post-reject-restart", "other"]>;
539
+ phase: z.ZodEnum<["pre-consent", "post-accept", "post-reject", "post-selection", "post-revoke", "post-wipe", "post-tamper", "gpc", "post-reject-restart", "other"]>;
540
+ /** IAB-TCF-String im Request (nur nach einer Ablehnung): «denied» weder Zustimmung noch berechtigtes Interesse, «li» nur berechtigtes Interesse, «granted» Zustimmung */
541
+ tcf: z.ZodOptional<z.ZodEnum<["denied", "li", "granted"]>>;
496
542
  }, "strip", z.ZodTypeAny, {
497
543
  at: string;
498
544
  url: string;
499
- phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-reject-restart" | "other";
545
+ phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-tamper" | "gpc" | "post-reject-restart" | "other";
500
546
  trackerName?: string | undefined;
501
547
  trackerCategory?: string | undefined;
548
+ tcf?: "denied" | "li" | "granted" | undefined;
502
549
  }, {
503
550
  at: string;
504
551
  url: string;
505
- phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-reject-restart" | "other";
552
+ phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-tamper" | "gpc" | "post-reject-restart" | "other";
506
553
  trackerName?: string | undefined;
507
554
  trackerCategory?: string | undefined;
555
+ tcf?: "denied" | "li" | "granted" | undefined;
508
556
  }>, "many">;
509
557
  storageBefore: z.ZodObject<{
510
558
  cookies: z.ZodArray<z.ZodString, "many">;
@@ -626,15 +674,16 @@ declare const LeakReportSchema: z.ZodObject<{
626
674
  }, "strip", z.ZodTypeAny, {
627
675
  targetUrl: string;
628
676
  status: "passed" | "suspicious" | "not-checkable" | "not-applicable";
629
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
677
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
630
678
  note: string;
631
679
  actionSequence: string[];
632
680
  requestTimeline: {
633
681
  at: string;
634
682
  url: string;
635
- phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-reject-restart" | "other";
683
+ phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-tamper" | "gpc" | "post-reject-restart" | "other";
636
684
  trackerName?: string | undefined;
637
685
  trackerCategory?: string | undefined;
686
+ tcf?: "denied" | "li" | "granted" | undefined;
638
687
  }[];
639
688
  storageBefore: {
640
689
  cookies: string[];
@@ -655,6 +704,9 @@ declare const LeakReportSchema: z.ZodObject<{
655
704
  }[] | undefined;
656
705
  };
657
706
  checkedAt: string;
707
+ reason?: string | undefined;
708
+ findingsOnly?: boolean | undefined;
709
+ hintFindings?: number | undefined;
658
710
  actionTimeline?: {
659
711
  at: string;
660
712
  action: string;
@@ -679,15 +731,16 @@ declare const LeakReportSchema: z.ZodObject<{
679
731
  }, {
680
732
  targetUrl: string;
681
733
  status: "passed" | "suspicious" | "not-checkable" | "not-applicable";
682
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
734
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
683
735
  note: string;
684
736
  actionSequence: string[];
685
737
  requestTimeline: {
686
738
  at: string;
687
739
  url: string;
688
- phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-reject-restart" | "other";
740
+ phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-tamper" | "gpc" | "post-reject-restart" | "other";
689
741
  trackerName?: string | undefined;
690
742
  trackerCategory?: string | undefined;
743
+ tcf?: "denied" | "li" | "granted" | undefined;
691
744
  }[];
692
745
  storageBefore: {
693
746
  cookies: string[];
@@ -708,6 +761,9 @@ declare const LeakReportSchema: z.ZodObject<{
708
761
  }[] | undefined;
709
762
  };
710
763
  checkedAt: string;
764
+ reason?: string | undefined;
765
+ findingsOnly?: boolean | undefined;
766
+ hintFindings?: number | undefined;
711
767
  actionTimeline?: {
712
768
  at: string;
713
769
  action: string;
@@ -734,16 +790,16 @@ declare const LeakReportSchema: z.ZodObject<{
734
790
  ignored: z.ZodOptional<z.ZodArray<z.ZodObject<{
735
791
  trackerName: z.ZodString;
736
792
  requestUrl: z.ZodString;
737
- scenario: z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability"]>;
793
+ scenario: z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability", "gpc-signal"]>;
738
794
  pattern: z.ZodString;
739
795
  }, "strip", z.ZodTypeAny, {
740
796
  trackerName: string;
741
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
797
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
742
798
  requestUrl: string;
743
799
  pattern: string;
744
800
  }, {
745
801
  trackerName: string;
746
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
802
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
747
803
  requestUrl: string;
748
804
  pattern: string;
749
805
  }>, "many">>;
@@ -752,6 +808,199 @@ declare const LeakReportSchema: z.ZodObject<{
752
808
  * erkannt wurden)? `false` = Suche endete vollständig ohne Banner-Hinweis; `undefined` = nicht ermittelt.
753
809
  */
754
810
  bannerObserved: z.ZodOptional<z.ZodBoolean>;
811
+ /** Scanner: Version des Browsers, mit dem gescannt wurde (für die Herkunftsangabe). */
812
+ browserVersion: z.ZodOptional<z.ZodString>;
813
+ /** `--har`: in diesem Lauf geschriebene HAR-Dateien, relativ zum Report-Ordner (eigener Unterordner je Lauf). */
814
+ harFiles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
815
+ /** Herkunft des Laufs: Version, Scan-Konfiguration ohne Geheimnisse und deren SHA-256 (`provenance.ts`). */
816
+ provenance: z.ZodOptional<z.ZodObject<{
817
+ tool: z.ZodLiteral<"cpcg">;
818
+ version: z.ZodString;
819
+ configHash: z.ZodString;
820
+ config: z.ZodRecord<z.ZodString, z.ZodUnknown>;
821
+ browser: z.ZodOptional<z.ZodString>;
822
+ node: z.ZodString;
823
+ platform: z.ZodString;
824
+ }, "strip", z.ZodTypeAny, {
825
+ tool: "cpcg";
826
+ version: string;
827
+ configHash: string;
828
+ config: Record<string, unknown>;
829
+ node: string;
830
+ platform: string;
831
+ browser?: string | undefined;
832
+ }, {
833
+ tool: "cpcg";
834
+ version: string;
835
+ configHash: string;
836
+ config: Record<string, unknown>;
837
+ node: string;
838
+ platform: string;
839
+ browser?: string | undefined;
840
+ }>>;
841
+ /** Vergleich mit einem Vorlauf (`--baseline`): neue, weggefallene und gleich gebliebene Befunde. */
842
+ comparison: z.ZodOptional<z.ZodObject<{
843
+ baselineScannedAt: z.ZodOptional<z.ZodString>;
844
+ baselineVersion: z.ZodOptional<z.ZodString>;
845
+ sameTarget: z.ZodBoolean;
846
+ sameConfig: z.ZodOptional<z.ZodBoolean>;
847
+ sameVersion: z.ZodOptional<z.ZodBoolean>;
848
+ notRechecked: z.ZodOptional<z.ZodArray<z.ZodObject<{
849
+ ruleId: z.ZodString;
850
+ trackerName: z.ZodString;
851
+ host: z.ZodString;
852
+ scenarios: z.ZodArray<z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability", "gpc-signal"]>, "many">;
853
+ count: z.ZodNumber;
854
+ advisory: z.ZodBoolean;
855
+ }, "strip", z.ZodTypeAny, {
856
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
857
+ trackerName: string;
858
+ ruleId: string;
859
+ advisory: boolean;
860
+ host: string;
861
+ count: number;
862
+ }, {
863
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
864
+ trackerName: string;
865
+ ruleId: string;
866
+ advisory: boolean;
867
+ host: string;
868
+ count: number;
869
+ }>, "many">>;
870
+ newFindings: z.ZodArray<z.ZodObject<{
871
+ ruleId: z.ZodString;
872
+ trackerName: z.ZodString;
873
+ host: z.ZodString;
874
+ scenarios: z.ZodArray<z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability", "gpc-signal"]>, "many">;
875
+ count: z.ZodNumber;
876
+ advisory: z.ZodBoolean;
877
+ }, "strip", z.ZodTypeAny, {
878
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
879
+ trackerName: string;
880
+ ruleId: string;
881
+ advisory: boolean;
882
+ host: string;
883
+ count: number;
884
+ }, {
885
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
886
+ trackerName: string;
887
+ ruleId: string;
888
+ advisory: boolean;
889
+ host: string;
890
+ count: number;
891
+ }>, "many">;
892
+ resolvedFindings: z.ZodArray<z.ZodObject<{
893
+ ruleId: z.ZodString;
894
+ trackerName: z.ZodString;
895
+ host: z.ZodString;
896
+ scenarios: z.ZodArray<z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability", "gpc-signal"]>, "many">;
897
+ count: z.ZodNumber;
898
+ advisory: z.ZodBoolean;
899
+ }, "strip", z.ZodTypeAny, {
900
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
901
+ trackerName: string;
902
+ ruleId: string;
903
+ advisory: boolean;
904
+ host: string;
905
+ count: number;
906
+ }, {
907
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
908
+ trackerName: string;
909
+ ruleId: string;
910
+ advisory: boolean;
911
+ host: string;
912
+ count: number;
913
+ }>, "many">;
914
+ unchangedFindings: z.ZodNumber;
915
+ scenarioChanges: z.ZodArray<z.ZodObject<{
916
+ scenario: z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability", "gpc-signal"]>;
917
+ before: z.ZodEnum<["passed", "suspicious", "not-checkable", "not-applicable"]>;
918
+ after: z.ZodEnum<["passed", "suspicious", "not-checkable", "not-applicable"]>;
919
+ }, "strip", z.ZodTypeAny, {
920
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
921
+ before: "passed" | "suspicious" | "not-checkable" | "not-applicable";
922
+ after: "passed" | "suspicious" | "not-checkable" | "not-applicable";
923
+ }, {
924
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
925
+ before: "passed" | "suspicious" | "not-checkable" | "not-applicable";
926
+ after: "passed" | "suspicious" | "not-checkable" | "not-applicable";
927
+ }>, "many">;
928
+ error: z.ZodOptional<z.ZodString>;
929
+ }, "strip", z.ZodTypeAny, {
930
+ sameTarget: boolean;
931
+ newFindings: {
932
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
933
+ trackerName: string;
934
+ ruleId: string;
935
+ advisory: boolean;
936
+ host: string;
937
+ count: number;
938
+ }[];
939
+ resolvedFindings: {
940
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
941
+ trackerName: string;
942
+ ruleId: string;
943
+ advisory: boolean;
944
+ host: string;
945
+ count: number;
946
+ }[];
947
+ unchangedFindings: number;
948
+ scenarioChanges: {
949
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
950
+ before: "passed" | "suspicious" | "not-checkable" | "not-applicable";
951
+ after: "passed" | "suspicious" | "not-checkable" | "not-applicable";
952
+ }[];
953
+ baselineScannedAt?: string | undefined;
954
+ baselineVersion?: string | undefined;
955
+ sameConfig?: boolean | undefined;
956
+ sameVersion?: boolean | undefined;
957
+ notRechecked?: {
958
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
959
+ trackerName: string;
960
+ ruleId: string;
961
+ advisory: boolean;
962
+ host: string;
963
+ count: number;
964
+ }[] | undefined;
965
+ error?: string | undefined;
966
+ }, {
967
+ sameTarget: boolean;
968
+ newFindings: {
969
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
970
+ trackerName: string;
971
+ ruleId: string;
972
+ advisory: boolean;
973
+ host: string;
974
+ count: number;
975
+ }[];
976
+ resolvedFindings: {
977
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
978
+ trackerName: string;
979
+ ruleId: string;
980
+ advisory: boolean;
981
+ host: string;
982
+ count: number;
983
+ }[];
984
+ unchangedFindings: number;
985
+ scenarioChanges: {
986
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
987
+ before: "passed" | "suspicious" | "not-checkable" | "not-applicable";
988
+ after: "passed" | "suspicious" | "not-checkable" | "not-applicable";
989
+ }[];
990
+ baselineScannedAt?: string | undefined;
991
+ baselineVersion?: string | undefined;
992
+ sameConfig?: boolean | undefined;
993
+ sameVersion?: boolean | undefined;
994
+ notRechecked?: {
995
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
996
+ trackerName: string;
997
+ ruleId: string;
998
+ advisory: boolean;
999
+ host: string;
1000
+ count: number;
1001
+ }[] | undefined;
1002
+ error?: string | undefined;
1003
+ }>>;
755
1004
  /** Scanner: Hinweise zur Reichweite des Scans (ungültige/ungenutzte Override-Selektoren, spät erschienener Banner). */
756
1005
  scannerWarnings: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
757
1006
  /**
@@ -762,20 +1011,102 @@ declare const LeakReportSchema: z.ZodObject<{
762
1011
  checked: z.ZodNumber;
763
1012
  linked: z.ZodNumber;
764
1013
  max: z.ZodNumber;
1014
+ /** Herkunft der Kandidaten: nur Links der Startseite oder Sitemap-Tiefenlauf */
1015
+ source: z.ZodOptional<z.ZodEnum<["links", "sitemap"]>>;
1016
+ /** Tiefenlauf mit Wiederaufnahme: in dieser Runde insgesamt geprüft (frühere Läufe eingeschlossen) */
1017
+ checkedTotal: z.ZodOptional<z.ZodNumber>;
1018
+ /** Tiefenlauf: Runde und Zahl der Läufe in dieser Runde */
1019
+ round: z.ZodOptional<z.ZodNumber>;
1020
+ runs: z.ZodOptional<z.ZodNumber>;
1021
+ /** Tiefenlauf: Zeitbudget erschöpft, bevor alle Kandidaten geprüft waren */
1022
+ budgetExhausted: z.ZodOptional<z.ZodBoolean>;
1023
+ /** Tiefenlauf: Seiten-URLs aus der Sitemap (vor dem Zusammenführen mit den Links) */
1024
+ sitemapUrls: z.ZodOptional<z.ZodNumber>;
1025
+ /** Tiefenlauf: in dieser Runde nicht erreichbare Unterseiten (zählen nicht als geprüft) */
1026
+ failed: z.ZodOptional<z.ZodNumber>;
765
1027
  }, "strip", z.ZodTypeAny, {
766
1028
  checked: number;
767
1029
  linked: number;
768
1030
  max: number;
1031
+ source?: "sitemap" | "links" | undefined;
1032
+ checkedTotal?: number | undefined;
1033
+ round?: number | undefined;
1034
+ runs?: number | undefined;
1035
+ budgetExhausted?: boolean | undefined;
1036
+ sitemapUrls?: number | undefined;
1037
+ failed?: number | undefined;
769
1038
  }, {
770
1039
  checked: number;
771
1040
  linked: number;
772
1041
  max: number;
1042
+ source?: "sitemap" | "links" | undefined;
1043
+ checkedTotal?: number | undefined;
1044
+ round?: number | undefined;
1045
+ runs?: number | undefined;
1046
+ budgetExhausted?: boolean | undefined;
1047
+ sitemapUrls?: number | undefined;
1048
+ failed?: number | undefined;
773
1049
  }>>;
774
1050
  /**
775
1051
  * Warum «kein Banner» nicht belegt ist: `unstable` (Reload-Schleife, Banner nicht auswertbar), `late` (Banner erschien
776
1052
  * nach dem Wartefenster), `inoperable` (Banner vorhanden, aber nicht über Ablehnen/Akzeptieren bedienbar).
777
1053
  */
778
1054
  bannerIssue: z.ZodOptional<z.ZodEnum<["unstable", "late", "inoperable"]>>;
1055
+ /**
1056
+ * Bot-Schutz der Zielseite (Challenge, Sperrseite, Rate-Limit): Der Browser bekam statt des Inhalts eine
1057
+ * Schutzseite. Eigener Befund über die Prüfbarkeit, kein Tracker-Befund.
1058
+ */
1059
+ botProtection: z.ZodOptional<z.ZodObject<{
1060
+ status: z.ZodOptional<z.ZodNumber>;
1061
+ vendor: z.ZodOptional<z.ZodString>;
1062
+ signal: z.ZodString;
1063
+ }, "strip", z.ZodTypeAny, {
1064
+ signal: string;
1065
+ status?: number | undefined;
1066
+ vendor?: string | undefined;
1067
+ }, {
1068
+ signal: string;
1069
+ status?: number | undefined;
1070
+ vendor?: string | undefined;
1071
+ }>>;
1072
+ /**
1073
+ * Drittanbieter-Hosts ohne Zuordnung (weder Tracker noch eigene Seite), häufigste zuerst, höchstens 50. Keine Bewertung:
1074
+ * Grundlage, um die Tracker-Erkennung nachzupflegen.
1075
+ */
1076
+ unassignedHosts: z.ZodOptional<z.ZodArray<z.ZodObject<{
1077
+ host: z.ZodString;
1078
+ count: z.ZodNumber;
1079
+ phases: z.ZodArray<z.ZodString, "many">;
1080
+ }, "strip", z.ZodTypeAny, {
1081
+ host: string;
1082
+ count: number;
1083
+ phases: string[];
1084
+ }, {
1085
+ host: string;
1086
+ count: number;
1087
+ phases: string[];
1088
+ }>, "many">>;
1089
+ /** CNAME-Cloaking: Hosts der Seite, deren CNAME-Kette auf einen Tracker-Host zeigt. */
1090
+ cnameCloaking: z.ZodOptional<z.ZodArray<z.ZodObject<{
1091
+ host: z.ZodString;
1092
+ target: z.ZodString;
1093
+ tracker: z.ZodString;
1094
+ }, "strip", z.ZodTypeAny, {
1095
+ host: string;
1096
+ target: string;
1097
+ tracker: string;
1098
+ }, {
1099
+ host: string;
1100
+ target: string;
1101
+ tracker: string;
1102
+ }>, "many">>;
1103
+ /**
1104
+ * Art des gefundenen Banners: `supported-cmp` (OneTrust, Cookiebot), `unsupported-cmp` (anderes bekanntes CMP),
1105
+ * `custom` (Banner ohne erkanntes CMP), `none` (kein Banner gesehen). Steuert, ob der Auto-Fix Skripte ändern darf.
1106
+ */
1107
+ bannerKind: z.ZodOptional<z.ZodEnum<["supported-cmp", "unsupported-cmp", "custom", "none"]>>;
1108
+ /** Name des erkannten CMP (z. B. `onetrust`, `usercentrics`), falls ein Banner gesehen und ein CMP erkannt wurde. */
1109
+ bannerCmp: z.ZodOptional<z.ZodString>;
779
1110
  }, "strip", z.ZodTypeAny, {
780
1111
  targetUrl: string;
781
1112
  scannedAt: string;
@@ -783,13 +1114,14 @@ declare const LeakReportSchema: z.ZodObject<{
783
1114
  totalViolations: number;
784
1115
  violations: {
785
1116
  trackerName: string;
786
- trackerCategory: "unknown" | "analytics" | "marketing" | "functional";
787
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
1117
+ trackerCategory: "unknown" | "analytics" | "marketing" | "functional" | "cookieless-analytics";
1118
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
788
1119
  id: string;
789
1120
  requestUrl: string;
790
1121
  method: string;
791
1122
  timestamp: string;
792
1123
  description: string;
1124
+ tcf?: "denied" | "li" | "granted" | undefined;
793
1125
  ruleId?: string | undefined;
794
1126
  advisory?: boolean | undefined;
795
1127
  domContext?: {
@@ -798,21 +1130,22 @@ declare const LeakReportSchema: z.ZodObject<{
798
1130
  scriptsFound?: string[] | undefined;
799
1131
  } | undefined;
800
1132
  }[];
801
- passedScenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability")[];
802
- failedScenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability")[];
1133
+ passedScenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
1134
+ failedScenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
803
1135
  summary: string;
804
1136
  evidence?: {
805
1137
  targetUrl: string;
806
1138
  status: "passed" | "suspicious" | "not-checkable" | "not-applicable";
807
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
1139
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
808
1140
  note: string;
809
1141
  actionSequence: string[];
810
1142
  requestTimeline: {
811
1143
  at: string;
812
1144
  url: string;
813
- phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-reject-restart" | "other";
1145
+ phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-tamper" | "gpc" | "post-reject-restart" | "other";
814
1146
  trackerName?: string | undefined;
815
1147
  trackerCategory?: string | undefined;
1148
+ tcf?: "denied" | "li" | "granted" | undefined;
816
1149
  }[];
817
1150
  storageBefore: {
818
1151
  cookies: string[];
@@ -833,6 +1166,9 @@ declare const LeakReportSchema: z.ZodObject<{
833
1166
  }[] | undefined;
834
1167
  };
835
1168
  checkedAt: string;
1169
+ reason?: string | undefined;
1170
+ findingsOnly?: boolean | undefined;
1171
+ hintFindings?: number | undefined;
836
1172
  actionTimeline?: {
837
1173
  at: string;
838
1174
  action: string;
@@ -857,18 +1193,91 @@ declare const LeakReportSchema: z.ZodObject<{
857
1193
  }[] | undefined;
858
1194
  ignored?: {
859
1195
  trackerName: string;
860
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
1196
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
861
1197
  requestUrl: string;
862
1198
  pattern: string;
863
1199
  }[] | undefined;
864
1200
  bannerObserved?: boolean | undefined;
1201
+ browserVersion?: string | undefined;
1202
+ harFiles?: string[] | undefined;
1203
+ provenance?: {
1204
+ tool: "cpcg";
1205
+ version: string;
1206
+ configHash: string;
1207
+ config: Record<string, unknown>;
1208
+ node: string;
1209
+ platform: string;
1210
+ browser?: string | undefined;
1211
+ } | undefined;
1212
+ comparison?: {
1213
+ sameTarget: boolean;
1214
+ newFindings: {
1215
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
1216
+ trackerName: string;
1217
+ ruleId: string;
1218
+ advisory: boolean;
1219
+ host: string;
1220
+ count: number;
1221
+ }[];
1222
+ resolvedFindings: {
1223
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
1224
+ trackerName: string;
1225
+ ruleId: string;
1226
+ advisory: boolean;
1227
+ host: string;
1228
+ count: number;
1229
+ }[];
1230
+ unchangedFindings: number;
1231
+ scenarioChanges: {
1232
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
1233
+ before: "passed" | "suspicious" | "not-checkable" | "not-applicable";
1234
+ after: "passed" | "suspicious" | "not-checkable" | "not-applicable";
1235
+ }[];
1236
+ baselineScannedAt?: string | undefined;
1237
+ baselineVersion?: string | undefined;
1238
+ sameConfig?: boolean | undefined;
1239
+ sameVersion?: boolean | undefined;
1240
+ notRechecked?: {
1241
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
1242
+ trackerName: string;
1243
+ ruleId: string;
1244
+ advisory: boolean;
1245
+ host: string;
1246
+ count: number;
1247
+ }[] | undefined;
1248
+ error?: string | undefined;
1249
+ } | undefined;
865
1250
  scannerWarnings?: string[] | undefined;
866
1251
  subpageSampling?: {
867
1252
  checked: number;
868
1253
  linked: number;
869
1254
  max: number;
1255
+ source?: "sitemap" | "links" | undefined;
1256
+ checkedTotal?: number | undefined;
1257
+ round?: number | undefined;
1258
+ runs?: number | undefined;
1259
+ budgetExhausted?: boolean | undefined;
1260
+ sitemapUrls?: number | undefined;
1261
+ failed?: number | undefined;
870
1262
  } | undefined;
871
1263
  bannerIssue?: "unstable" | "late" | "inoperable" | undefined;
1264
+ botProtection?: {
1265
+ signal: string;
1266
+ status?: number | undefined;
1267
+ vendor?: string | undefined;
1268
+ } | undefined;
1269
+ unassignedHosts?: {
1270
+ host: string;
1271
+ count: number;
1272
+ phases: string[];
1273
+ }[] | undefined;
1274
+ cnameCloaking?: {
1275
+ host: string;
1276
+ target: string;
1277
+ tracker: string;
1278
+ }[] | undefined;
1279
+ bannerKind?: "custom" | "none" | "supported-cmp" | "unsupported-cmp" | undefined;
1280
+ bannerCmp?: string | undefined;
872
1281
  }, {
873
1282
  targetUrl: string;
874
1283
  scannedAt: string;
@@ -876,12 +1285,13 @@ declare const LeakReportSchema: z.ZodObject<{
876
1285
  totalViolations: number;
877
1286
  violations: {
878
1287
  trackerName: string;
879
- trackerCategory: "unknown" | "analytics" | "marketing" | "functional";
880
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
1288
+ trackerCategory: "unknown" | "analytics" | "marketing" | "functional" | "cookieless-analytics";
1289
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
881
1290
  id: string;
882
1291
  requestUrl: string;
883
1292
  timestamp: string;
884
1293
  description: string;
1294
+ tcf?: "denied" | "li" | "granted" | undefined;
885
1295
  ruleId?: string | undefined;
886
1296
  advisory?: boolean | undefined;
887
1297
  method?: string | undefined;
@@ -891,21 +1301,22 @@ declare const LeakReportSchema: z.ZodObject<{
891
1301
  scriptsFound?: string[] | undefined;
892
1302
  } | undefined;
893
1303
  }[];
894
- passedScenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability")[];
895
- failedScenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability")[];
1304
+ passedScenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
1305
+ failedScenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
896
1306
  summary: string;
897
1307
  evidence?: {
898
1308
  targetUrl: string;
899
1309
  status: "passed" | "suspicious" | "not-checkable" | "not-applicable";
900
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
1310
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
901
1311
  note: string;
902
1312
  actionSequence: string[];
903
1313
  requestTimeline: {
904
1314
  at: string;
905
1315
  url: string;
906
- phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-reject-restart" | "other";
1316
+ phase: "pre-consent" | "post-accept" | "post-reject" | "post-selection" | "post-revoke" | "post-wipe" | "post-tamper" | "gpc" | "post-reject-restart" | "other";
907
1317
  trackerName?: string | undefined;
908
1318
  trackerCategory?: string | undefined;
1319
+ tcf?: "denied" | "li" | "granted" | undefined;
909
1320
  }[];
910
1321
  storageBefore: {
911
1322
  cookies: string[];
@@ -926,6 +1337,9 @@ declare const LeakReportSchema: z.ZodObject<{
926
1337
  }[] | undefined;
927
1338
  };
928
1339
  checkedAt: string;
1340
+ reason?: string | undefined;
1341
+ findingsOnly?: boolean | undefined;
1342
+ hintFindings?: number | undefined;
929
1343
  actionTimeline?: {
930
1344
  at: string;
931
1345
  action: string;
@@ -950,20 +1364,94 @@ declare const LeakReportSchema: z.ZodObject<{
950
1364
  }[] | undefined;
951
1365
  ignored?: {
952
1366
  trackerName: string;
953
- scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability";
1367
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
954
1368
  requestUrl: string;
955
1369
  pattern: string;
956
1370
  }[] | undefined;
957
1371
  bannerObserved?: boolean | undefined;
1372
+ browserVersion?: string | undefined;
1373
+ harFiles?: string[] | undefined;
1374
+ provenance?: {
1375
+ tool: "cpcg";
1376
+ version: string;
1377
+ configHash: string;
1378
+ config: Record<string, unknown>;
1379
+ node: string;
1380
+ platform: string;
1381
+ browser?: string | undefined;
1382
+ } | undefined;
1383
+ comparison?: {
1384
+ sameTarget: boolean;
1385
+ newFindings: {
1386
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
1387
+ trackerName: string;
1388
+ ruleId: string;
1389
+ advisory: boolean;
1390
+ host: string;
1391
+ count: number;
1392
+ }[];
1393
+ resolvedFindings: {
1394
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
1395
+ trackerName: string;
1396
+ ruleId: string;
1397
+ advisory: boolean;
1398
+ host: string;
1399
+ count: number;
1400
+ }[];
1401
+ unchangedFindings: number;
1402
+ scenarioChanges: {
1403
+ scenario: "happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal";
1404
+ before: "passed" | "suspicious" | "not-checkable" | "not-applicable";
1405
+ after: "passed" | "suspicious" | "not-checkable" | "not-applicable";
1406
+ }[];
1407
+ baselineScannedAt?: string | undefined;
1408
+ baselineVersion?: string | undefined;
1409
+ sameConfig?: boolean | undefined;
1410
+ sameVersion?: boolean | undefined;
1411
+ notRechecked?: {
1412
+ scenarios: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[];
1413
+ trackerName: string;
1414
+ ruleId: string;
1415
+ advisory: boolean;
1416
+ host: string;
1417
+ count: number;
1418
+ }[] | undefined;
1419
+ error?: string | undefined;
1420
+ } | undefined;
958
1421
  scannerWarnings?: string[] | undefined;
959
1422
  subpageSampling?: {
960
1423
  checked: number;
961
1424
  linked: number;
962
1425
  max: number;
1426
+ source?: "sitemap" | "links" | undefined;
1427
+ checkedTotal?: number | undefined;
1428
+ round?: number | undefined;
1429
+ runs?: number | undefined;
1430
+ budgetExhausted?: boolean | undefined;
1431
+ sitemapUrls?: number | undefined;
1432
+ failed?: number | undefined;
963
1433
  } | undefined;
964
1434
  bannerIssue?: "unstable" | "late" | "inoperable" | undefined;
1435
+ botProtection?: {
1436
+ signal: string;
1437
+ status?: number | undefined;
1438
+ vendor?: string | undefined;
1439
+ } | undefined;
1440
+ unassignedHosts?: {
1441
+ host: string;
1442
+ count: number;
1443
+ phases: string[];
1444
+ }[] | undefined;
1445
+ cnameCloaking?: {
1446
+ host: string;
1447
+ target: string;
1448
+ tracker: string;
1449
+ }[] | undefined;
1450
+ bannerKind?: "custom" | "none" | "supported-cmp" | "unsupported-cmp" | undefined;
1451
+ bannerCmp?: string | undefined;
965
1452
  }>;
966
1453
  type BannerIssue = NonNullable<z.infer<typeof LeakReportSchema>["bannerIssue"]>;
1454
+ type BotProtection = NonNullable<z.infer<typeof LeakReportSchema>["botProtection"]>;
967
1455
  type LeakReport = z.infer<typeof LeakReportSchema>;
968
1456
  type IgnoredFinding = NonNullable<LeakReport["ignored"]>[number];
969
1457
  /**
@@ -1270,6 +1758,7 @@ declare const RemediationResultSchema: z.ZodObject<{
1270
1758
  originalContent?: string | undefined;
1271
1759
  diff?: string | undefined;
1272
1760
  }[];
1761
+ error?: string | undefined;
1273
1762
  reviewVerdict?: {
1274
1763
  passed: boolean;
1275
1764
  score: number;
@@ -1303,7 +1792,6 @@ declare const RemediationResultSchema: z.ZodObject<{
1303
1792
  prNumber?: number | undefined;
1304
1793
  prUrl?: string | undefined;
1305
1794
  } | undefined;
1306
- error?: string | undefined;
1307
1795
  }, {
1308
1796
  success: boolean;
1309
1797
  patches: {
@@ -1313,6 +1801,7 @@ declare const RemediationResultSchema: z.ZodObject<{
1313
1801
  originalContent?: string | undefined;
1314
1802
  diff?: string | undefined;
1315
1803
  }[];
1804
+ error?: string | undefined;
1316
1805
  reviewVerdict?: {
1317
1806
  passed: boolean;
1318
1807
  score: number;
@@ -1346,7 +1835,6 @@ declare const RemediationResultSchema: z.ZodObject<{
1346
1835
  prUrl?: string | undefined;
1347
1836
  simulated?: boolean | undefined;
1348
1837
  } | undefined;
1349
- error?: string | undefined;
1350
1838
  }>;
1351
1839
  type RemediationResult = z.infer<typeof RemediationResultSchema>;
1352
1840
  /**
@@ -1364,6 +1852,11 @@ declare const GateConfigSchema: z.ZodObject<{
1364
1852
  llmModel: z.ZodDefault<z.ZodString>;
1365
1853
  /** Explizites Opt-in: Quellcode darf zur Patch-Erzeugung an den LLM-Anbieter gesendet werden. */
1366
1854
  llmRemediation: z.ZodDefault<z.ZodBoolean>;
1855
+ /**
1856
+ * Auto-Fix darf auch bei eigenem Banner (kein erkanntes CMP) Skripte ändern. Standard aus: dann nur Anleitung,
1857
+ * weil ein Patch ohne Anbindung der Einwilligung die Seite funktional beschädigt.
1858
+ */
1859
+ allowCustomBannerFix: z.ZodDefault<z.ZodBoolean>;
1367
1860
  /** Default aus: Auto-Fix schreibt nur, wenn der Aufrufer ihn ausdrücklich anfordert. */
1368
1861
  autoFix: z.ZodDefault<z.ZodBoolean>;
1369
1862
  failOnLeak: z.ZodDefault<z.ZodBoolean>;
@@ -1377,9 +1870,11 @@ declare const GateConfigSchema: z.ZodObject<{
1377
1870
  baseBranch: z.ZodOptional<z.ZodString>;
1378
1871
  branchPrefix: z.ZodDefault<z.ZodString>;
1379
1872
  /** Optional: nur diese Szenarien ausführen (leer = alle). Für Tests/CI gezielt. */
1380
- scenarios: z.ZodOptional<z.ZodArray<z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability"]>, "many">>;
1381
- /** Rechtsraum, der in Konsole und report.json hervorgehoben wird (der Report führt alle Räume auf). */
1382
- jurisdiction: z.ZodDefault<z.ZodEnum<["CH", "EU", "UK", "US-CA", "BR", "ROW"]>>;
1873
+ scenarios: z.ZodOptional<z.ZodArray<z.ZodEnum<["happy-path-denied", "happy-path-accepted", "fast-click", "state-manipulation", "network-drop", "consent-revoked", "category-selective", "consent-persistence", "banner-ignored", "subpage-spa", "cmp-failure", "embed-leaks", "consent-mode-v2", "duplicate-events", "mobile-usability", "gpc-signal"]>, "many">>;
1874
+ /**
1875
+ * Rechtsräume, komma-getrennt (z. B. "CH,EU"). Der strengste Befund gewinnt; siehe core/legal/jurisdictions.ts.
1876
+ */
1877
+ jurisdiction: z.ZodEffects<z.ZodDefault<z.ZodString>, string, string | undefined>;
1383
1878
  /** Demo-Lauf mit synthetischen Testdaten — Report wird gekennzeichnet */
1384
1879
  demo: z.ZodOptional<z.ZodBoolean>;
1385
1880
  /** Deluxe-PDF (Deckblatt + Evidence) nach dem Scan erzeugen */
@@ -1397,6 +1892,38 @@ declare const GateConfigSchema: z.ZodObject<{
1397
1892
  allowBroadIgnore: z.ZodDefault<z.ZodBoolean>;
1398
1893
  /** Obergrenze der Unterseiten-Stichprobe (Szenario subpage-spa), `--max-subpages` (Standard 12, höchstens 40). */
1399
1894
  maxSubpages: z.ZodDefault<z.ZodNumber>;
1895
+ /**
1896
+ * Sitemap-Tiefenlauf (`--sitemap`): subpage-spa prüft Unterseiten aus robots.txt/sitemap.xml und den Links der
1897
+ * Startseite, bis das Zeitbudget `deepBudgetSeconds` verbraucht ist (statt `maxSubpages`).
1898
+ */
1899
+ sitemap: z.ZodDefault<z.ZodBoolean>;
1900
+ /** Zeitbudget des Tiefenlaufs für die Unterseiten in Sekunden (`--deep-budget`, 30–3600, Standard 300). */
1901
+ deepBudgetSeconds: z.ZodDefault<z.ZodNumber>;
1902
+ /** Zustandsdatei der Wiederaufnahme (`--deep-state`): der nächste Lauf setzt bei den noch nicht geprüften Unterseiten fort. */
1903
+ deepStateFile: z.ZodOptional<z.ZodString>;
1904
+ /** Vorlauf-Report (JSON) für den Vergleich «neu seit dem letzten Lauf» (`--baseline`). */
1905
+ baselineReport: z.ZodOptional<z.ZodString>;
1906
+ /**
1907
+ * Geschlossener Kreis (`--verify-url`): hat der Scan der Ziel-URL Befunde, prüft CPCG zusätzlich diese URL (z. B. die
1908
+ * Vorschau des Fix-PRs). Nur ein sauberer, vollständiger Scan dort, in dem alle betroffenen Szenarien geprüft wurden,
1909
+ * gilt als «Fix verifiziert».
1910
+ */
1911
+ verifyUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
1912
+ /** So lange (Sekunden, 0–1800) auf die Erreichbarkeit der Verify-URL warten, z. B. bis das Deployment steht. */
1913
+ verifyWaitSeconds: z.ZodDefault<z.ZodNumber>;
1914
+ /**
1915
+ * Freigabe-Header für die eigene Website (`--target-header "Name: Wert"`, Env `CPCG_TARGET_HEADERS`): gehen nur an die
1916
+ * Origins des Ziels (bzw. der Verify-URL), nie an Drittanbieter. Werte sind Geheimnisse und erscheinen in keinem Report.
1917
+ */
1918
+ targetHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
1919
+ /**
1920
+ * Intern (Re-Scan der Verify-URL): Pfade der Ziel-URL, deren Unterseiten erneut zu prüfen sind (subpage-spa besucht sie
1921
+ * zuerst und zusätzlich zur Stichprobe), und Hosts der Ziel-Domain, die für die CNAME-Prüfung als eigene gelten.
1922
+ */
1923
+ recheckPaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
1924
+ extraFirstPartyHosts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
1925
+ /** HAR-Mitschnitt je Browser-Kontext ohne Inhalte (`--har`), im Ordner `evidence/har` neben dem Report. */
1926
+ har: z.ZodDefault<z.ZodBoolean>;
1400
1927
  /**
1401
1928
  * Wartefenster auf einen (spät erscheinenden) Banner in Sekunden, `--banner-wait` (höchstens 60). Ohne Angabe gilt das
1402
1929
  * bisherige Verhalten (8 s, bei Seiten ohne Banner-Hinweis früher beendet); mit Angabe wird das Fenster ausgeschöpft.
@@ -1430,6 +1957,7 @@ declare const GateConfigSchema: z.ZodObject<{
1430
1957
  llmProvider: "openai" | "anthropic" | "gemini";
1431
1958
  llmModel: string;
1432
1959
  llmRemediation: boolean;
1960
+ allowCustomBannerFix: boolean;
1433
1961
  autoFix: boolean;
1434
1962
  failOnLeak: boolean;
1435
1963
  failOnUncheckable: boolean;
@@ -1438,20 +1966,30 @@ declare const GateConfigSchema: z.ZodObject<{
1438
1966
  gitCommit: boolean;
1439
1967
  createPr: boolean;
1440
1968
  branchPrefix: string;
1441
- jurisdiction: "CH" | "EU" | "UK" | "US-CA" | "BR" | "ROW";
1969
+ jurisdiction: string;
1442
1970
  headless: boolean;
1443
1971
  timeoutMs: number;
1444
1972
  strict: boolean;
1445
1973
  ignore: string[];
1446
1974
  allowBroadIgnore: boolean;
1447
1975
  maxSubpages: number;
1976
+ sitemap: boolean;
1977
+ deepBudgetSeconds: number;
1978
+ verifyWaitSeconds: number;
1979
+ har: boolean;
1448
1980
  apiKey?: string | undefined;
1449
1981
  githubToken?: string | undefined;
1450
1982
  baseBranch?: string | undefined;
1451
- scenarios?: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability")[] | undefined;
1983
+ scenarios?: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[] | undefined;
1452
1984
  demo?: boolean | undefined;
1453
1985
  reportPdf?: boolean | undefined;
1454
1986
  clientName?: string | undefined;
1987
+ deepStateFile?: string | undefined;
1988
+ baselineReport?: string | undefined;
1989
+ verifyUrl?: string | undefined;
1990
+ targetHeaders?: Record<string, string> | undefined;
1991
+ recheckPaths?: string[] | undefined;
1992
+ extraFirstPartyHosts?: string[] | undefined;
1455
1993
  bannerWaitSeconds?: number | undefined;
1456
1994
  configWarnings?: string[] | undefined;
1457
1995
  acceptSelectors?: string[] | undefined;
@@ -1468,6 +2006,7 @@ declare const GateConfigSchema: z.ZodObject<{
1468
2006
  llmProvider?: "openai" | "anthropic" | "gemini" | undefined;
1469
2007
  llmModel?: string | undefined;
1470
2008
  llmRemediation?: boolean | undefined;
2009
+ allowCustomBannerFix?: boolean | undefined;
1471
2010
  autoFix?: boolean | undefined;
1472
2011
  failOnLeak?: boolean | undefined;
1473
2012
  failOnUncheckable?: boolean | undefined;
@@ -1478,8 +2017,8 @@ declare const GateConfigSchema: z.ZodObject<{
1478
2017
  githubToken?: string | undefined;
1479
2018
  baseBranch?: string | undefined;
1480
2019
  branchPrefix?: string | undefined;
1481
- scenarios?: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability")[] | undefined;
1482
- jurisdiction?: "CH" | "EU" | "UK" | "US-CA" | "BR" | "ROW" | undefined;
2020
+ scenarios?: ("happy-path-denied" | "happy-path-accepted" | "fast-click" | "state-manipulation" | "network-drop" | "consent-revoked" | "category-selective" | "consent-persistence" | "banner-ignored" | "subpage-spa" | "cmp-failure" | "embed-leaks" | "consent-mode-v2" | "duplicate-events" | "mobile-usability" | "gpc-signal")[] | undefined;
2021
+ jurisdiction?: string | undefined;
1483
2022
  demo?: boolean | undefined;
1484
2023
  reportPdf?: boolean | undefined;
1485
2024
  clientName?: string | undefined;
@@ -1489,6 +2028,16 @@ declare const GateConfigSchema: z.ZodObject<{
1489
2028
  ignore?: string[] | undefined;
1490
2029
  allowBroadIgnore?: boolean | undefined;
1491
2030
  maxSubpages?: number | undefined;
2031
+ sitemap?: boolean | undefined;
2032
+ deepBudgetSeconds?: number | undefined;
2033
+ deepStateFile?: string | undefined;
2034
+ baselineReport?: string | undefined;
2035
+ verifyUrl?: string | undefined;
2036
+ verifyWaitSeconds?: number | undefined;
2037
+ targetHeaders?: Record<string, string> | undefined;
2038
+ recheckPaths?: string[] | undefined;
2039
+ extraFirstPartyHosts?: string[] | undefined;
2040
+ har?: boolean | undefined;
1492
2041
  bannerWaitSeconds?: number | undefined;
1493
2042
  configWarnings?: string[] | undefined;
1494
2043
  acceptSelectors?: string[] | undefined;
@@ -1526,7 +2075,7 @@ interface GateAssessment {
1526
2075
  scenariosTotal: number;
1527
2076
  /** Alle nicht prüfbaren Szenarien (inkl. «auffällig» mit Timeout/Fehler-Aktion) */
1528
2077
  uncheckable: ChaosScenario[];
1529
- /** Davon Kernszenarien (Ablehnen-/Akzeptieren-Pfad, die den Banner bedienen) */
2078
+ /** Davon Pflichtszenarien (PRD): nicht prüfbar = Scan unvollständig, Exit 4 */
1530
2079
  coreUncheckable: ChaosScenario[];
1531
2080
  /** true, wenn kein Szenario nicht prüfbar ist und die Unterseiten-Stichprobe vollständig war */
1532
2081
  complete: boolean;
@@ -1546,6 +2095,13 @@ interface GateAssessment {
1546
2095
  noBannerNoTracker: boolean;
1547
2096
  /** Unterseiten-Stichprobe (Szenario subpage-spa), falls es lief */
1548
2097
  sampling?: SamplingInfo;
2098
+ /** Je nicht prüfbarem Szenario der Grund (gleiche Reihenfolge wie `uncheckable`) */
2099
+ uncheckableReasons: UncheckableReason[];
2100
+ }
2101
+ /** Warum ein Szenario nicht prüfbar ist. */
2102
+ interface UncheckableReason {
2103
+ scenario: ChaosScenario;
2104
+ reason: string;
1549
2105
  }
1550
2106
  /** Unterseiten-Stichprobe: `checked` von `linked` geprüft; `incomplete`, wenn nicht alle verlinkten Unterseiten dran waren. */
1551
2107
  interface SamplingInfo {
@@ -1553,6 +2109,11 @@ interface SamplingInfo {
1553
2109
  linked: number;
1554
2110
  max: number;
1555
2111
  incomplete: boolean;
2112
+ /** Sitemap-Tiefenlauf: Kandidaten aus Sitemap und Links, `checkedTotal` über alle Läufe der Runde */
2113
+ source?: "links" | "sitemap";
2114
+ checkedTotal?: number;
2115
+ runs?: number;
2116
+ budgetExhausted?: boolean;
1556
2117
  }
1557
2118
  /**
1558
2119
  * Gate-Zustand: `clean` = PASS, `remediated` = Fix durch sauberen Re-Scan der Ziel-URL verifiziert,
@@ -1568,6 +2129,8 @@ interface ReportGate {
1568
2129
  coreUncheckable: ChaosScenario[];
1569
2130
  /** `--strict`: Hinweise zählen als Verstoss */
1570
2131
  strict?: boolean;
2132
+ /** Gewählte Rechtsräume, komma-getrennt (z. B. "CH,EU") */
2133
+ jurisdiction?: string;
1571
2134
  noBannerNoTracker?: boolean;
1572
2135
  /** Vom Scanner gemeldet: wurde ein Consent-Banner gesehen? (undefined = unbekannt) */
1573
2136
  bannerObserved?: boolean;
@@ -1581,6 +2144,22 @@ interface ReportGate {
1581
2144
  broadIgnore?: string[];
1582
2145
  /** Teilfix mit Commit/PR: so viele gemeldete Tracker bleiben manuell zu beheben */
1583
2146
  partialManual?: number;
2147
+ /** Je nicht prüfbarem Szenario der Grund */
2148
+ uncheckableReasons?: UncheckableReason[];
2149
+ /** Bot-Schutz der Zielseite (vom Scanner gemeldet) */
2150
+ botProtection?: BotProtection;
2151
+ /** Re-Scan zur Verifikation des Fixes: welche URL, Vorschau-URL (`--verify-url`) oder Ziel-URL, Ergebnis und Grund */
2152
+ verification?: Verification;
2153
+ }
2154
+ interface Verification {
2155
+ url: string;
2156
+ /** `true`: eigene Verify-URL (Vorschau), `false`: Re-Scan der Ziel-URL nach lokalem Patch */
2157
+ preview: boolean;
2158
+ verified: boolean;
2159
+ /** Warum nicht verifiziert (fehlt bei `verified`) */
2160
+ reason?: string;
2161
+ /** Hinweis, z. B. Verify-URL liegt nicht auf der Ziel-Domain */
2162
+ note?: string;
1584
2163
  }
1585
2164
  /**
1586
2165
  * Overall pipeline outcome
@@ -1612,6 +2191,7 @@ interface CliRawOptions {
1612
2191
  llmModel?: string;
1613
2192
  /** Opt-in: Quellcode darf an den LLM-Anbieter gesendet werden */
1614
2193
  llmRemediation?: string | boolean;
2194
+ allowCustomBannerFix?: string | boolean;
1615
2195
  autoFix?: string | boolean;
1616
2196
  failOnLeak?: string | boolean;
1617
2197
  failOnUncheckable?: string | boolean;
@@ -1644,6 +2224,22 @@ interface CliRawOptions {
1644
2224
  bannerFrame?: string;
1645
2225
  /** Obergrenze der Unterseiten-Stichprobe (Standard 12, höchstens 40) */
1646
2226
  maxSubpages?: string | number;
2227
+ /** Sitemap-Tiefenlauf */
2228
+ sitemap?: string | boolean;
2229
+ /** Zeitbudget des Tiefenlaufs in Sekunden (30–3600) */
2230
+ deepBudget?: string | number;
2231
+ /** Zustandsdatei der Wiederaufnahme */
2232
+ deepState?: string;
2233
+ /** Vorlauf-Report für den Vergleich */
2234
+ baseline?: string;
2235
+ /** HAR-Mitschnitt */
2236
+ har?: string | boolean;
2237
+ /** Vorschau-URL zur Verifikation des Fixes */
2238
+ verifyUrl?: string;
2239
+ /** Wartezeit auf die Verify-URL in Sekunden */
2240
+ verifyWait?: string | number;
2241
+ /** Freigabe-Header «Name: Wert» (mehrfach) */
2242
+ targetHeader?: string[] | string;
1647
2243
  /** Wartefenster auf einen spät erscheinenden Banner in Sekunden (höchstens 60) */
1648
2244
  bannerWait?: string | number;
1649
2245
  }
@@ -1655,6 +2251,25 @@ interface ChaosScannerInterface {
1655
2251
  scan(config: GateConfig): Promise<LeakReport>;
1656
2252
  }
1657
2253
 
2254
+ /**
2255
+ * CNAME-Cloaking: Ein Tracker läuft über eine eigene Subdomain der Seite (`metrics.acme.ch`), die per DNS auf den
2256
+ * Tracker-Host zeigt (`acme.sc.omtrdc.net`). Am Request selbst ist nichts zu erkennen; erst die CNAME-Kette verrät ihn.
2257
+ * Geprüft werden nur Hosts der eigenen Seite (gleiche registrierbare Domain wie das Ziel), jeder höchstens einmal je
2258
+ * Lauf, mit Zeitlimit und Obergrenze, damit der Scan nicht an DNS hängt.
2259
+ */
2260
+ type CnameResolver = (host: string) => Promise<string[]>;
2261
+
2262
+ /**
2263
+ * Sitemap-Tiefenlauf (Phase 3, Punkt 7): Unterseiten aus robots.txt/sitemap.xml statt nur aus den Links der Startseite,
2264
+ * Reihenfolge nach Verschiedenheit, Zeitbudget je Lauf und Wiederaufnahme über eine Zustandsdatei.
2265
+ */
2266
+ /** Antwort eines Abrufs; `null`, wenn der Abruf scheiterte oder ausserhalb des Zielbereichs endete. */
2267
+ interface FetchedDoc {
2268
+ status: number;
2269
+ body: Buffer;
2270
+ }
2271
+ type SitemapFetcher = (url: string) => Promise<FetchedDoc | null>;
2272
+
1658
2273
  /** Optionale Vorgaben fuer Seiten mit unbekanntem Banner; werden VOR den Standardlisten ausgewertet. */
1659
2274
  interface ScannerOverrides {
1660
2275
  /** CSS-/Playwright-Selektoren fuer «Alle akzeptieren». */
@@ -1677,9 +2292,27 @@ interface ChaosScannerOptions extends ScannerOverrides {
1677
2292
  evidenceDir?: string;
1678
2293
  /** Obergrenze fuer die Gesamtgroesse der Screenshots eines Laufs in Bytes (Default 100 MB); darueber nur noch verkleinerte. */
1679
2294
  evidenceMaxBytes?: number;
2295
+ /** DNS-Abfrage der CNAME-Kette (Default: System-DNS); Tests geben eine feste Tabelle mit. */
2296
+ cnameResolver?: CnameResolver;
2297
+ /** Abruf der Sitemap-Dateien im Tiefenlauf (Default: HTTP, nur Zielbereich); Tests geben einen eigenen mit. */
2298
+ sitemapFetcher?: SitemapFetcher;
1680
2299
  }
1681
2300
  declare class ChaosScanner implements ChaosScannerInterface {
1682
2301
  private evidenceDir?;
2302
+ /** `--har`: Ordner der HAR-Dateien dieses Laufs */
2303
+ private harDir?;
2304
+ private harCount;
2305
+ /** HAR-Dateien dieses Laufs (absolut) */
2306
+ private harFiles;
2307
+ /** Zielbereich des laufenden Scans und Freigabe-Header */
2308
+ private scope?;
2309
+ private targetHeaders?;
2310
+ /**
2311
+ * Origins, an die Freigabe-Header gehen: fest beim Start (Ziel und, nach dem Preflight, die Origin der Weiterleitung
2312
+ * auf dieselbe Domain). Wächst nicht mit dem Zielbereich (Login-Dienste, Consent-Walls bekommen nie den Header).
2313
+ */
2314
+ private headerOrigins;
2315
+ private browserVersion?;
1683
2316
  private readonly overrides;
1684
2317
  /** Bannersuche des laufenden Scans (Selektoren inkl. Overrides, «kein Banner» gemerkt). */
1685
2318
  private session;
@@ -1697,6 +2330,16 @@ declare class ChaosScanner implements ChaosScannerInterface {
1697
2330
  /** Ergebnis der Schlusspruefung: nur `completed` belegt «kein Banner». */
1698
2331
  private bannerProbe;
1699
2332
  private bannerIssue?;
2333
+ /** Erster erkannter Bot-Schutz der Hauptseite (Challenge, Sperre, Rate-Limit) in diesem Lauf. */
2334
+ private botProtection?;
2335
+ /** Eine Challenge hat sich innerhalb der Wartezeit nicht gelöst: in diesem Lauf nicht mehr warten. */
2336
+ private challengeUnsolved;
2337
+ /** CNAME-Cloaking: je Lauf neu, damit die Obergrenze und der Cache je Ziel gelten. */
2338
+ private readonly cnameResolver?;
2339
+ private readonly sitemapFetcher?;
2340
+ private cname;
2341
+ /** CMP-Erkennung aus dem DOM, sobald ein Banner gesehen wurde (für `bannerKind`). */
2342
+ private bannerCmp?;
1700
2343
  private subpageSampling?;
1701
2344
  /** Bytes der in diesem Lauf geschriebenen Screenshots und deren Obergrenze. */
1702
2345
  private evidenceBytes;
@@ -1713,11 +2356,30 @@ declare class ChaosScanner implements ChaosScannerInterface {
1713
2356
  private trackerVerdict;
1714
2357
  /** `{ advisory: true }` fuer rein funktionale Treffer (Hinweis ohne Gate-Wirkung). */
1715
2358
  private advisoryFlag;
1716
- /** Zaehlt ein Timeline-Ereignis als belastbarer Tracker-Befund (nicht advisory, nicht exempt). */
2359
+ /** Zaehlt ein Timeline-Ereignis als belastbarer Tracker-Befund (nicht advisory, nicht exempt, keine TCF-Ablehnung). */
1717
2360
  private isBlocking;
1718
2361
  scan(config: GateConfig): Promise<LeakReport>;
1719
2362
  /** Browser-Kontext mit blockierten Service Workern (deren Requests waeren unsichtbar) und Registrierungs-Beobachtung. */
2363
+ /**
2364
+ * Tiefenlauf vorbereiten: Sitemap lesen (nur Zielbereich), mit den Links der Startseite zusammenführen, nach
2365
+ * Verschiedenheit ordnen, mit der Zustandsdatei die schon besuchten Unterseiten dieser Runde abziehen.
2366
+ */
2367
+ private prepareDeepRun;
2368
+ /** Tiefenlauf abschliessen: Besuche in die Zustandsdatei (falls angegeben und nicht fremd). */
2369
+ private finishDeepRun;
2370
+ /** Seite ohne Banner-Klick beobachten: warten, Scroll/Klick-Ereignisse auslösen (Tracker, die auf Interaktion warten). */
2371
+ private observeUntouched;
2372
+ /**
2373
+ * Vergleichslauf zu gpc-signal: derselbe Ablauf ohne GPC in frischem Kontext. Zählt Werbe-Tracker-Requests und
2374
+ * -Cookies (keine Befunde, nur Referenz). `null`, wenn die Seite dabei nicht ladbar war.
2375
+ */
2376
+ private countMarketingWithoutGpc;
1720
2377
  private newContext;
2378
+ /**
2379
+ * Steht ein Banner-Bedienelement schon im Dokument, wenn kein Skript der Seite läuft? Dann ist das Banner eingebettet
2380
+ * und kann nicht separat ausfallen (network-drop nicht anwendbar). Fehler zählen als «nein» (bleibt nicht prüfbar).
2381
+ */
2382
+ private bannerWithoutScripts;
1721
2383
  /** Ungueltige Override-Selektoren (CSS-Syntaxfehler) werden gemeldet statt still verschluckt. */
1722
2384
  private checkOverrideSelectors;
1723
2385
  /**
@@ -1736,6 +2398,15 @@ declare class ChaosScanner implements ChaosScannerInterface {
1736
2398
  * Fehlermeldungen nennen die konfigurierte Ursprungs-URL, nicht nur das Weiterleitungsziel.
1737
2399
  */
1738
2400
  private gotoTarget;
2401
+ /**
2402
+ * Bricht ab, wenn die Hauptseite eine Challenge-, Sperr- oder Rate-Limit-Seite ist (`BotProtectionError`): Das
2403
+ * Szenario wird «nicht prüfbar» mit Grund, und der Report führt den Bot-Schutz als eigenen Befund.
2404
+ * - Eine Cloudflare-Challenge, die sich im Browser selbst löst, wird bis zu 8 s abgewartet (bis sich eine als ungelöst
2405
+ * erweist). «Gelöst» heisst: das Dokument ließ sich lesen und ist keine Challenge mehr.
2406
+ * - Vorabprüfungen (`probe`) brechen ab, setzen den Bot-Schutz des Laufs aber nicht.
2407
+ * - Fast-Click (`commit`): das Dokument ist noch leer; abgebrochen wird nur, wenn der Lauf bereits als gesperrt gilt.
2408
+ */
2409
+ private checkBotProtection;
1739
2410
  /**
1740
2411
  * Scanner-Navigation zu einer verlinkten Unterseite: deren Weiterleitungen erweitern den Zielbereich nicht.
1741
2412
  * Laufende Navigationen der vorigen Seite werden abgewartet; leitet die Unterseite selbst clientseitig weiter
@@ -1752,6 +2423,11 @@ declare class ChaosScanner implements ChaosScannerInterface {
1752
2423
  private annotateAdvisory;
1753
2424
  /** Steht (jetzt) irgendein Consent-Banner im DOM der Zielseite? Merkt es fuer `bannerObserved`. */
1754
2425
  private noteBannerHints;
2426
+ /**
2427
+ * CMP aus dem DOM bestimmen, sobald ein Banner gesehen wurde. Ein fehlgeschlagenes Lesen wird nicht gemerkt,
2428
+ * damit ein späterer Aufruf es erneut versucht (sonst bliebe die Art dauerhaft falsch).
2429
+ */
2430
+ private classifyBannerCmp;
1755
2431
  /**
1756
2432
  * Fail-open-Schutz: Lief ein Szenario ganz oder teilweise auf einer fremden Seite (Requests wurden
1757
2433
  * dem Ziel nicht zugerechnet), ist ein «bestanden» nicht belastbar — dann «nicht prüfbar» mit Begruendung.
@@ -1763,6 +2439,22 @@ declare class ChaosScanner implements ChaosScannerInterface {
1763
2439
  * Ergebnis: passed nur bei ausgeführter Aktion und null Illegal-Funden.
1764
2440
  */
1765
2441
  private runScenario;
2442
+ /**
2443
+ * CNAME-Cloaking nachtragen: Hosts der eigenen Seite aus der Zeitlinie, die kein Tracker sind, per DNS prüfen. Zeigt die
2444
+ * CNAME-Kette auf einen Tracker-Host, wird der Request mit seiner ursprünglichen Phase als Tracker-Befund eingetragen.
2445
+ */
2446
+ private applyCnameCloaking;
2447
+ /** Gefundene CNAME-Umwege für den Report (leer, wenn keine). */
2448
+ private cnameReport;
2449
+ /**
2450
+ * Ablehnen über die zweite Ebene: die Einstellungen desselben Banners öffnen und dort ein eindeutiges «Alle ablehnen»
2451
+ * klicken oder alle Kategorie-Schalter ausschalten und «Auswahl speichern». Als Ablehnung zählt das nur mit Nachweis
2452
+ * (danach ist «Akzeptieren» nicht mehr sichtbar, die Seite dieselbe); sonst werden die Requests seit dem Klick wieder
2453
+ * «vor der Entscheidung». Die Szenarien geben ihre Phasenlogik über `hooks` mit.
2454
+ * `no-settings`: keine Einstellungen im Banner; `opened`: geöffnet, aber kein Ablehnen-Weg; `save-only`: nur
2455
+ * «Auswahl speichern», der Klick gelang nicht; `unknown`: abgebrochen, mit Grund.
2456
+ */
2457
+ private rejectViaSettings;
1766
2458
  /**
1767
2459
  * Kein Ablehnen-Button gefunden: ist das ein Dark Pattern oder nur ein nicht erkannter Banner?
1768
2460
  * Sehr konservativ — «Banner nicht erkannt» wird nie als Dark Pattern gemeldet. Ein Befund
@@ -1939,7 +2631,37 @@ declare class RemediationEngine implements RemediationEngineInterface {
1939
2631
  }
1940
2632
 
1941
2633
  /**
1942
- * Kernszenarien: Ablehnen- und Akzeptieren-Pfad bedienen den Banner.
2634
+ * Jurisdiktions-Profile für CPCG.
2635
+ * Das Tool bewertet Pre-Consent-Tracking je Rechtsraum — KEINE Rechtsberatung.
2636
+ */
2637
+ type Jurisdiction = "CH" | "EU" | "UK" | "US-CA" | "BR" | "ROW";
2638
+ /**
2639
+ * Einwilligungsmodell je Rechtsraum:
2640
+ * - `opt-in`: vor Einwilligung blockierend (nicht-essenzielle Tracker). EU, UK, BR.
2641
+ * - `opt-out`: Information und wirksame Ablehnen-Möglichkeit genügen; ein Befund vor Einwilligung ist Hinweis,
2642
+ * blockierend wird erst, was nach Ablehnen weiterläuft oder wo keine Ablehnen-Möglichkeit besteht. CH, US-CA.
2643
+ * - `notice-only`: nie blockierend, nur Bericht (strikte Prüfung nur mit `--strict`). ROW.
2644
+ */
2645
+ type ConsentModel = "opt-in" | "opt-out" | "notice-only";
2646
+ interface JurisdictionProfile {
2647
+ code: Jurisdiction;
2648
+ label: string;
2649
+ /** Kerndokumente / Frameworks im Report */
2650
+ frameworks: string[];
2651
+ /** Einwilligungsmodell für die Gate-Wirkung (siehe `verdictFor`) */
2652
+ consentModel: ConsentModel;
2653
+ /** Ist vorheriges Opt-In für nicht-essenzielles Tracking erforderlich? (Report-Einordnung) */
2654
+ priorOptInRequired: boolean;
2655
+ /** Google Consent Mode v2 erforderlich / empfohlen? */
2656
+ consentModeV2: "required" | "recommended" | "optional";
2657
+ /** Kurztext für den Kunden-Report */
2658
+ summary: string;
2659
+ /** Formulierung ohne Rechtsberatung zu sein */
2660
+ note: string;
2661
+ }
2662
+
2663
+ /**
2664
+ * Banner-Kernszenarien: Ablehnen- und Akzeptieren-Pfad bedienen den Banner.
1943
2665
  * Sind sie nicht prüfbar, sagt der Scan über Consent nichts aus — das Gate darf dann nicht PASS melden.
1944
2666
  */
1945
2667
  declare const CORE_SCENARIOS: readonly ChaosScenario[];
@@ -1956,27 +2678,50 @@ declare function groupFindings(violations: {
1956
2678
  /** Bewertet die Vollständigkeit des Scans. */
1957
2679
  declare function assessReport(report: LeakReport, scenarios?: ChaosScenario[], options?: {
1958
2680
  strict?: boolean;
2681
+ jurisdictions?: JurisdictionProfile[];
1959
2682
  }): GateAssessment;
1960
2683
 
1961
2684
  /** Prüft, ob die Zielseite antwortet und nicht mit 4xx/5xx; wirft sonst einen neutralen Fehler. */
1962
- declare function checkTargetReachable(url: string, timeoutMs: number, fetchImpl?: typeof fetch): Promise<number>;
2685
+ declare function checkTargetReachable(url: string, timeoutMs: number, fetchImpl?: typeof fetch, headers?: Record<string, string>): Promise<number>;
1963
2686
  type Preflight = (config: GateConfig) => Promise<unknown>;
1964
2687
  /** Lizenzpflichtige Funktionen, die in diesem Lauf angefordert wurden (Bezeichnung für Konsole/Summary). */
1965
2688
  declare function requestedLicensedFeatures(config: GateConfig): string[];
1966
2689
  /** Hinweistext, warum lizenzpflichtige Funktionen nicht liefen; nennt die konkret übersprungene Funktion. */
1967
2690
  declare function licenseSkipText(config: GateConfig, skipped: string[]): string;
1968
- /**
1969
- * Gründe, warum Szenarien nicht prüfbar sind, aus deren Notiz («Nicht prüfbar: <Grund> (zuvor: …)» bzw.
1970
- * «Szenario nicht prüfbar — <Grund> (kein grünes Häkchen)»); identische Gründe stehen einmal mit allen Szenarien.
1971
- */
2691
+ /** Gründe, warum Szenarien nicht prüfbar sind (siehe `uncheckableReasonsOf`); identische Gründe stehen einmal mit allen Szenarien. */
1972
2692
  declare function uncheckableReasons(report: LeakReport, scenarios: ChaosScenario[]): {
1973
2693
  reason: string;
1974
2694
  scenarios: ChaosScenario[];
1975
2695
  }[];
2696
+ type Analysis = {
2697
+ report: LeakReport;
2698
+ blocking: TrackerViolation[];
2699
+ assessment: GateAssessment;
2700
+ };
2701
+ /** Unterseiten mit Befund im Scan der Ziel-URL (Pfade aus `leak:subpage …`). */
2702
+ declare function leakSubpagePaths(report: LeakReport): string[];
2703
+ /**
2704
+ * Re-Scan bewerten: verifiziert ist der Fix nur, wenn (1) dort nichts blockiert, (2) kein Bot-Schutz greift, (3) die
2705
+ * Kernszenarien und jedes Szenario mit Befund geprüft wurden, (4) die Unterseiten mit Befund dort erreicht wurden und
2706
+ * (5) bei einer Verify-URL die Gegenprobe gelingt: die Tracker der Befunde laden dort nach dem Akzeptieren. Ohne (5)
2707
+ * wäre eine Vorschau ganz ohne Tracking (fehlende Mess-ID, Tracking entfernt) «verifiziert».
2708
+ */
2709
+ declare function judgeRescan(target: Analysis, again: Analysis, preview: boolean): {
2710
+ clean: boolean;
2711
+ reason?: string;
2712
+ unchecked: ChaosScenario[];
2713
+ };
2714
+ /**
2715
+ * Verify-URL erreichbar? Wartet bis zu `seconds` (alle 10 s ein Versuch), z. B. bis ein Vorschau-Deployment steht.
2716
+ * Rückgabe: Fehlertext, wenn sie in der Zeit nicht mit HTTP < 400 antwortet.
2717
+ */
2718
+ declare function waitForVerifyUrl(url: string, seconds: number, timeoutMs: number, fetchImpl?: typeof fetch, sleep?: (ms: number) => Promise<void>, headers?: Record<string, string>): Promise<string | undefined>;
1976
2719
  declare class PrivacyChaosGate {
1977
2720
  private scanner?;
1978
2721
  private remediationEngine;
1979
2722
  private preflight?;
2723
+ /** HTTP-Abruf für die Wartezeit auf die Verify-URL (Tests ersetzen ihn). */
2724
+ verifyFetch: typeof fetch;
1980
2725
  /**
1981
2726
  * @param preflight Erreichbarkeits-Check vor dem Scan. Default: HTTP-Check (nur mit dem Standard-Scanner);
1982
2727
  * wer einen eigenen Scanner injiziert, ist selbst für die Zielseite zuständig.
@@ -1997,6 +2742,13 @@ declare class PrivacyChaosGate {
1997
2742
  private writeGitHubSummary;
1998
2743
  }
1999
2744
 
2745
+ interface SignalTally {
2746
+ phase: string;
2747
+ granted: number;
2748
+ denied: number;
2749
+ none: number;
2750
+ }
2751
+
2000
2752
  /**
2001
2753
  * Kunden-Report aus LeakReport + Evidence.
2002
2754
  * Status-Tabelle je Szenario: bestanden / auffällig / nicht prüfbar.
@@ -2008,6 +2760,8 @@ interface EvidenceMarkdownOptions {
2008
2760
  gate?: ReportGate;
2009
2761
  /** Kundenname (Kundenreport) */
2010
2762
  client?: string;
2763
+ /** Dateiname des Hash-Manifests (`*-manifest.sha256`) für den Abschnitt «Herkunft und Prüfbarkeit» */
2764
+ manifestName?: string;
2011
2765
  }
2012
2766
 
2013
2767
  /** Status-Lesart für beide Renderer — eine Quelle, kein Drift. */
@@ -2024,6 +2778,7 @@ interface ReportFacts {
2024
2778
  incomplete: number;
2025
2779
  /** Gate-blockierende Befunde (Request-Zeilen); Hinweise stehen in `advisory` */
2026
2780
  findings: number;
2781
+ /** Hinweise: funktionale Drittanbieter und Befunde, die nach den gewählten Rechtsräumen nicht blockieren */
2027
2782
  advisory: number;
2028
2783
  ignored: number;
2029
2784
  observedCount: number;
@@ -2049,9 +2804,14 @@ interface CodeSolution {
2049
2804
  title: string;
2050
2805
  lang: "html" | "js";
2051
2806
  code: string;
2807
+ /** Platzhalter im Code (`{{NAME}}`) und was dort hingehört; das Muster läuft erst, wenn alle ersetzt sind. */
2808
+ placeholders: {
2809
+ name: string;
2810
+ meaning: string;
2811
+ }[];
2052
2812
  }
2053
2813
  /** Nur Regeln mit belegtem Befund bekommen eine Code-Lösung. */
2054
- declare function codeSolutionsFor(report: LeakReport, strict?: boolean): CodeSolution[];
2814
+ declare function codeSolutionsFor(report: LeakReport, strict?: boolean, jurisdiction?: string): CodeSolution[];
2055
2815
  declare function deriveReportFacts(report: LeakReport, gate?: ReportGate): ReportFacts;
2056
2816
  /** Gate-Zustand für Deckblatt/PDF: dieselbe Ableitung wie im Report. */
2057
2817
  declare function resolveReportGate(report: LeakReport, gate?: ReportGate): ReportFacts;
@@ -2059,10 +2819,24 @@ declare function resolveReportGate(report: LeakReport, gate?: ReportGate): Repor
2059
2819
  * Zusatzhinweise zum Gate-Zustand (Banner nicht erkannt, Teilfix, Scanner-Warnungen, breites Ignore-Muster).
2060
2820
  * Eine Quelle für Markdown, HTML und Deckblatt.
2061
2821
  */
2062
- declare function gateNotesOf(gate: ReportGate | undefined): {
2822
+ declare function gateNotesOf(gate: ReportGate | undefined, report?: LeakReport): {
2063
2823
  state: string;
2064
2824
  warnings: string[];
2065
2825
  };
2826
+ /**
2827
+ * Gründe je nicht prüfbarem Szenario: vom Orchestrator (`gate.uncheckableReasons`), sonst aus den Nachweisen
2828
+ * des Scans abgeleitet (Report ohne Gate-Angabe).
2829
+ */
2830
+ declare function uncheckableReasonsForReport(report: LeakReport, gate?: ReportGate): UncheckableReason[];
2831
+ /**
2832
+ * Google-Consent-Mode-Signale aller Szenarien je Phase (gcs/gcd der Google-Mess-Requests). Leer ohne Google-Requests.
2833
+ * Gezählt wird, was der Tag sendet, nicht was Google verarbeitet.
2834
+ */
2835
+ declare function consentSignalTable(report: LeakReport): (SignalTally & {
2836
+ label: string;
2837
+ })[];
2838
+ /** «Platzhalter: {{X}} = …; {{Y}} = ….» unter einem Code-Muster (leer ohne Platzhalter). */
2839
+ declare function placeholderLegend(s: CodeSolution): string;
2066
2840
  /** 1 Befund-Zeile / N Befund-Zeilen — nie «Befund-Zeile(n)». */
2067
2841
  declare function findingsCountText(n: number): string;
2068
2842
  /** Kundennutzen: Befundgruppen statt Request-Zeilen. */
@@ -2070,6 +2844,10 @@ declare function problemsTextOf(n: number): string;
2070
2844
  /** Zähltext: Requests, nicht vage «×». */
2071
2845
  declare function reproductionText(count: number): string;
2072
2846
  declare function buildEvidenceMarkdown(report: LeakReport, title?: string, options?: EvidenceMarkdownOptions): string;
2847
+ /** «Vergleich zum Vorlauf»: Kopfsatz (Datum, Abweichungen bei Ziel-URL oder Konfiguration). */
2848
+ declare function comparisonIntro(c: NonNullable<LeakReport["comparison"]>): string;
2849
+ /** Herkunft des Laufs in einem Satz für den Report. */
2850
+ declare function provenanceText(report: LeakReport, manifestName?: string): string;
2073
2851
  interface EvidenceHtmlOptions {
2074
2852
  /** Demo-Lauf mit synthetischen Testdaten klar kennzeichnen */
2075
2853
  demo?: boolean;
@@ -2079,6 +2857,8 @@ interface EvidenceHtmlOptions {
2079
2857
  client?: string;
2080
2858
  /** Komprimierte Fassungen der Screenshots (Originalpfad → data-URI), siehe `compressScreenshots` */
2081
2859
  shotSources?: ReadonlyMap<string, string>;
2860
+ /** Dateiname des Hash-Manifests (`*-manifest.sha256`) */
2861
+ manifestName?: string;
2082
2862
  }
2083
2863
  /**
2084
2864
  * HTML-Beweisreport im offiziellen CuonzTech-Brand (Terminal-Schwarz, Gold,
@@ -2108,6 +2888,11 @@ interface CoverOptions {
2108
2888
  /** Gate-Zustand aus dem Orchestrator; ohne Angabe wird er nur aus den Befunden abgeleitet. */
2109
2889
  gate?: ReportGate;
2110
2890
  }
2891
+ /**
2892
+ * Einleitung des Deckblatts: nennt nur, was in diesem Lauf tatsächlich geprüft wurde (bestanden oder auffällig),
2893
+ * nie Themen, deren Szenarien nicht prüfbar waren oder nicht liefen.
2894
+ */
2895
+ declare function coverLede(report: LeakReport, checked: number, uncheckable: number): string;
2111
2896
  declare function buildCoverHtml(report: LeakReport, options?: CoverOptions): string;
2112
2897
  /**
2113
2898
  * Bevorzugter Weg: Deckblatt und Evidence in einem HTML zusammenführen und
@@ -2164,4 +2949,4 @@ declare function isLoopbackTarget(url: string): boolean;
2164
2949
  */
2165
2950
  declare function runGate(optionsOrConfig: CliRawOptions | GateConfigInput): Promise<GateExecutionResult>;
2166
2951
 
2167
- export { type BannerIssue, CORE_SCENARIOS, ChaosScanner, type ChaosScannerInterface, type ChaosScenario, ChaosScenarioSchema, type CliRawOptions, type CodeSolution, type CoverOptions, ENV_FILE_KEYS_HELP, EXIT, type Entitlement, type EntitlementInput, type EvidenceHtmlOptions, type EvidenceMarkdownOptions, type EvidenceRecord, EvidenceRecordSchema, type EvidenceStatus, EvidenceStatusSchema, type FilePatch, FilePatchSchema, type GateAssessment, type GateConfig, type GateConfigInput, GateConfigSchema, type GateExecutionResult, type GateState, type IgnoredFinding, JurisdictionCodeSchema, LICENSE_CONTACT, type LeakReport, LeakReportSchema, PrivacyChaosGate, type PullRequestResult, PullRequestResultSchema, RemediationEngine, type RemediationEngineInterface, type RemediationResult, RemediationResultSchema, type ReportFacts, type ReportGate, type RequestEvent, RequestEventSchema, type ReviewVerdict, ReviewVerdictSchema, type SamplingInfo, type StorageSnapshot, StorageSnapshotSchema, type TrackerCategory, TrackerCategorySchema, type TrackerViolation, TrackerViolationSchema, assessReport, buildCoverHtml, buildEvidenceHtml, buildEvidenceMarkdown, checkTargetReachable, codeSolutionsFor, deriveReportFacts, evidenceLabelOf, findingsCountText, gateNotesOf, groupFindings, isEnvKeyAllowedFromFile, isLoopbackTarget, licenseSkipText, loadProjectEnv, parseGateConfig, problemsTextOf, renderDeluxeCombined, renderDeluxePdf, reproductionText, requestedLicensedFeatures, resolveEntitlement, resolveGateConfig, resolveReportGate, runGate, statusLabelOf, uncheckableReasons };
2952
+ export { type BannerIssue, type BannerKind, BannerKindSchema, type BotProtection, CORE_SCENARIOS, ChaosScanner, type ChaosScannerInterface, type ChaosScenario, ChaosScenarioSchema, type CliRawOptions, type CodeSolution, type CoverOptions, ENV_FILE_KEYS_HELP, EXIT, type Entitlement, type EntitlementInput, type EvidenceHtmlOptions, type EvidenceMarkdownOptions, type EvidenceRecord, EvidenceRecordSchema, type EvidenceStatus, EvidenceStatusSchema, type FilePatch, FilePatchSchema, type GateAssessment, type GateConfig, type GateConfigInput, GateConfigSchema, type GateExecutionResult, type GateState, type IgnoredFinding, JurisdictionCodeSchema, LICENSE_CONTACT, type LeakReport, LeakReportSchema, PrivacyChaosGate, type PullRequestResult, PullRequestResultSchema, RemediationEngine, type RemediationEngineInterface, type RemediationResult, RemediationResultSchema, type ReportFacts, type ReportGate, type RequestEvent, RequestEventSchema, type ReviewVerdict, ReviewVerdictSchema, type SamplingInfo, type StorageSnapshot, StorageSnapshotSchema, type TrackerCategory, TrackerCategorySchema, type TrackerViolation, TrackerViolationSchema, type UncheckableReason, type Verification, assessReport, buildCoverHtml, buildEvidenceHtml, buildEvidenceMarkdown, checkTargetReachable, codeSolutionsFor, comparisonIntro, consentSignalTable, coverLede, deriveReportFacts, evidenceLabelOf, findingsCountText, gateNotesOf, groupFindings, isEnvKeyAllowedFromFile, isLoopbackTarget, judgeRescan, leakSubpagePaths, licenseSkipText, loadProjectEnv, parseGateConfig, placeholderLegend, problemsTextOf, provenanceText, renderDeluxeCombined, renderDeluxePdf, reproductionText, requestedLicensedFeatures, resolveEntitlement, resolveGateConfig, resolveReportGate, runGate, statusLabelOf, uncheckableReasons, uncheckableReasonsForReport, waitForVerifyUrl };