keksi 0.1.0 → 0.1.2

package/README.md

@@ -1,17 +1,22 @@
 # keksi
 
-Lean cookie consent for our client sites: Google Analytics 4, Google Ads, Meta Pixel and YouTube embeds, in Finnish,
-Swedish and English.
+Lean cookie consent for Astro, SvelteKit and other server-rendered sites. Built around Finnish and EU law, with
+texts in English, Finnish and Swedish.
 
-keksi loads the trackers itself, and only after consent. You don't add their script tags; you write their ids into
-the config. Nothing has to be blocked or intercepted, because nothing is on the page until keksi adds it.
+keksi loads the trackers itself, and only after consent. You don't add their script tags: you put their ids in the
+config, so there's nothing to block.
 
-- About 5 KB gzipped per page, inline: banner, settings, styles and a 2.4 KB runtime. No requests, no dependencies.
-- Rendered on the server, works with static pages, no layout shift. With no providers configured it renders nothing.
-- The cookie policy table comes from the same data, so it can't drift from what the site loads.
+- Google Analytics 4, Google Ads, Meta Pixel and YouTube. The short list is deliberate.
+- About 5 KB gzipped, inline. No extra requests, no dependencies.
+- Rendered on the server. Works on static pages, with no layout shift.
+- The cookie policy table is generated from the same data.
 
 ## Setup
 
+```sh
+pnpm add keksi
+```
+
 ```ts
 // keksi.config.ts
 import { defineConfig } from 'keksi';
@@ -25,66 +30,78 @@ export default defineConfig({
 });
 ```
 
-Render it right after `<body>`, and give the footer a way to reopen the settings:
+**Astro:** add the component right after `<body>` in your layout.
 
 ```astro
 ---
-// Astro layout
-import { renderKeksi } from 'keksi';
+import { Keksi } from 'keksi/astro';
 import config from '../../keksi.config';
 ---
 <body>
-  <Fragment set:html={renderKeksi(config, { lang: 'fi' })} />
+  <Keksi config={config} />
   ...
-  <button type="button" data-keksi-open>Evästeasetukset</button>
 </body>
 ```
 
+**SvelteKit:** add the hook. It renders keksi outside the Svelte root and keeps it out of the client bundle.
+
 ```ts
-// SvelteKit: src/hooks.server.ts. Keeps keksi out of the client bundle and outside the Svelte root.
-import type { Handle } from '@sveltejs/kit/hooks';
-import { renderKeksi } from 'keksi';
+// src/hooks.server.ts
+import { keksiHandle } from 'keksi/sveltekit';
 import config from '../keksi.config';
 
-const keksi = renderKeksi(config, { lang: 'fi' });
+export const handle = keksiHandle(config);
+```
+
+Any element with `data-keksi-open` reopens the settings. Put one in the footer:
 
-export const handle: Handle = ({ event, resolve }) =>
-  resolve(event, { transformPageChunk: ({ html }) => html.replace(/<body([^>]*)>/, `<body$1>${keksi}`) });
+```html
+<button type="button" data-keksi-open>Evästeasetukset</button>
 ```
 
-Policy page:
+**Necessary cookies** from your framework or own code, such as a session, are listed under "Necessary". Find them
+with the scanner, which visits the site without consent:
 
-```astro
-<Fragment set:html={cookieTable(config, { lang: 'fi' })} />
+```sh
+npx keksi scan https://staging.example.fi
 ```
 
-In SvelteKit, return `cookieTable(...)` from a prerendered `+page.server.ts` and render it with `{@html}`.
+It writes `keksi.cookies.json`, with purposes for common cookies filled in. Write the rest, then import the file:
 
-## Using the trackers
+```ts
+import necessary from './keksi.cookies.json' with { type: 'json' };
+
+export default defineConfig({ ga: 'G-XXXXXXX', necessary });
+```
 
-`gtag()` and `fbq()` exist from the start, so page code can call them at any time:
+Rerunning keeps your purposes. `keksi scan <url> --check` fails when there are new entries, for CI. The scanner only
+lists; it never blocks anything. Cookies set after login aren't visited, so add those by hand.
+
+**Cookie policy page:** `<CookieTable config={config} />` from `keksi/astro`, or `cookieTable(config)` for an HTML
+string.
+
+## Tracking events
+
+`gtag()` and `fbq()` are always defined, so you can call them anytime:
 
 ```ts
 gtag('event', 'generate_lead');
 fbq('track', 'Lead');
 ```
 
-Calls made before consent wait in the queue. If the visitor consents on that page, they're sent after the tags are
-configured. Otherwise they're never sent. Single-page navigation is tracked by GA4 and Meta Pixel themselves.
-
-Google gets Consent Mode v2 signals: everything `denied` by default, updated to match the choice. Only basic mode,
-because gtag.js isn't loaded at all before consent.
+- Calls made before consent are queued. They're sent only if the visitor consents on that page.
+- Google gets Consent Mode v2 signals (basic mode).
+- GA4 and Meta Pixel track single-page navigation themselves.
 
 ## YouTube
 
 ```html
-<keksi-youtube video="aqz-KE-bpKQ" label="Esittelyvideo"></keksi-youtube>
+<keksi-youtube video="aqz-KE-bpKQ" label="Esittelyvideo" poster="/img/poster.jpg"></keksi-youtube>
 ```
 
-The element shows a placeholder with a "Show video" button, plus an "Open on YouTube" link. The click loads that
-one video from `youtube-nocookie.com`. With marketing consent, videos load directly. Add `poster="/img/poster.jpg"`
-for a self-hosted thumbnail. Thumbnails from YouTube are not used, since those requests would go to Google before
-consent.
+- Shows a placeholder until the visitor clicks it, then loads that one video from `youtube-nocookie.com`.
+- With marketing consent, videos load directly.
+- `poster` is optional and should be self-hosted. Thumbnails from YouTube would contact Google before consent.
 
 ## API
 
@@ -97,17 +114,8 @@ window.keksi.rejectAll();
 document.addEventListener('keksi:change', (e) => e.detail);
 ```
 
-## Withdrawal
-
-When a category is withdrawn, keksi deletes that category's cookies and localStorage keys on this site, on every
-parent domain, and then reloads, because tags that are already running can't be unloaded. Cookies set by Google or
-Meta on their own domains (`IDE`, `fr`, YouTube's) can't be deleted from our site. They are listed on the policy page
-as third-party cookies.
-
 ## Testing
 
-The examples use the same helpers you'd use in a client project's Playwright tests:
-
 ```ts
 import { consentCookie, watchTracking } from 'keksi/playwright';
 
@@ -115,46 +123,45 @@ test('nothing tracks before consent', async ({ page }) => {
   const tracking = watchTracking(page, config, { allow: ['session'] });
   await page.goto('/');
   await page.waitForLoadState('networkidle');
-  await tracking.check(); // throws on requests to Google, Meta or YouTube, or on stored data
+  await tracking.check(); // throws on tracker requests or stored data
 });
 
 // Skip the banner in other tests
 await context.addCookies([consentCookie(config, baseURL, { analytics: true })]);
 ```
 
-## Theming and texts
-
-The styles have zero specificity, so any site rule wins. Set `--keksi-bg`, `--keksi-fg`, `--keksi-line`,
-`--keksi-radius` and `--keksi-focus`, or style `.keksi`, `.keksi-dialog` and `.keksi-btn`. Override texts per
-language with `texts: { fi: { intro: '…' } }`. Pass `nonce` to `renderKeksi` for a CSP with nonces.
-
-## Consent record
+## Customizing
 
-The `keksi` cookie holds the version, time, a random id and the choices, for 365 days (`cookie.days`). The version
-changes when a provider is added or removed, so everyone is asked again. Ids and texts can change under the same
-version.
+- **Styles** have zero specificity, so your CSS wins. Variables: `--keksi-bg`, `--keksi-fg`, `--keksi-line`,
+  `--keksi-radius`, `--keksi-focus`.
+- **Language:** follows the page's language, otherwise Finnish. Pass `lang` to set it.
+- **Texts:** `texts: { fi: { intro: '…' } }`.
+- **CSP:** pass `nonce`.
+- **Other frameworks:** `renderKeksi(config, { lang })` returns the HTML to put after `<body>`.
+- **Consent cookie:** `cookie: { name, domain, days }`. Kept for 365 days by default.
 
-## What the law requires and how keksi meets it
+## Legal basis
 
 | Requirement | Basis | keksi |
 |---|---|---|
-| No non-essential storage or access before consent | Act 917/2014 §205 | Trackers aren't loaded until consent |
-| Purpose, duration and third parties disclosed | §205, CJEU *Planet49* | Providers on the first layer, cookies and durations in settings and on the policy page |
-| Separate choices per purpose, rejecting as easy as accepting | GDPR Art. 4(11), 7; Traficom 2024 decisions | One switch per category, "Reject all" on the first layer, same button style |
-| Withdrawal as easy as consent, with real effect | GDPR Art. 7(3) | `data-keksi-open` anywhere, deletes stored data |
-| Able to show consent was given | GDPR Art. 7(1) | Consent cookie with id, time and version |
+| No non-essential storage before consent | Act 917/2014 §205 | Trackers load only after consent |
+| Purpose, duration and third parties disclosed | §205, CJEU *Planet49* | Providers on the banner, cookies and durations in settings and on the policy page |
+| Separate choices, rejecting as easy as accepting | GDPR Art. 4(11), 7; Traficom 2024 | A switch per category, "Reject all" on the banner |
+| Withdrawal is easy and has real effect | GDPR Art. 7(3) | Deletes the category's cookies and localStorage on your domain, then reloads |
+| Consent can be demonstrated | GDPR Art. 7(1) | Consent cookie with id, time and version. Adding or removing a provider asks again |
 | Transfers outside the EU disclosed | GDPR Art. 13(1)(f) | DPF transfer stated per provider |
 
-## Adding a provider
-
-Add its disclosure and cookies to `src/providers.ts`, a config key with the same id to `KeksiConfig`, and its loading
-to `load()` in `src/runtime.ts`.
+Cookies that Google and Meta set on their own domains can't be deleted from your site. The policy page lists them as
+third-party cookies.
 
 ## Development
 
 ```sh
 pnpm install
-pnpm build       # dist/, prints the runtime size
-pnpm test        # unit tests
-pnpm test:e2e    # both examples in Chromium
+pnpm build      # prints the runtime size
+pnpm test
+pnpm test:e2e   # Astro and SvelteKit examples
 ```
+
+To add a provider: add its data to `src/providers.ts`, a config key with the same id to `KeksiConfig`, and its
+loading to `load()` in `src/runtime.ts`.

package/astro/CookieTable.astro

@@ -0,0 +1,15 @@
+---
+import { cookieTable, type KeksiConfig, type Locale } from 'keksi';
+
+interface Props {
+  config: KeksiConfig;
+  lang?: Locale;
+  headingLevel?: 2 | 3 | 4;
+}
+
+const { config, headingLevel } = Astro.props;
+const locale = Astro.currentLocale?.slice(0, 2);
+const lang = Astro.props.lang ?? (['fi', 'sv', 'en'].includes(locale!) ? (locale as Locale) : 'fi');
+---
+
+<Fragment set:html={cookieTable(config, { lang, headingLevel })} />

package/astro/Keksi.astro

@@ -0,0 +1,16 @@
+---
+import { renderKeksi, type KeksiConfig, type Locale } from 'keksi';
+
+interface Props {
+  config: KeksiConfig;
+  /** Defaults to Astro's current locale, then `fi`. */
+  lang?: Locale;
+  nonce?: string;
+}
+
+const { config, nonce } = Astro.props;
+const locale = Astro.currentLocale?.slice(0, 2);
+const lang = Astro.props.lang ?? (['fi', 'sv', 'en'].includes(locale!) ? (locale as Locale) : 'fi');
+---
+
+<Fragment set:html={renderKeksi(config, { lang, nonce })} />

package/astro/index.d.ts

@@ -0,0 +1,2 @@
+export { default as Keksi } from './Keksi.astro';
+export { default as CookieTable } from './CookieTable.astro';

package/astro/index.js

@@ -0,0 +1,2 @@
+export { default as Keksi } from './Keksi.astro';
+export { default as CookieTable } from './CookieTable.astro';

package/dist/cli.js

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { parseArgs } from "node:util";
+
+// src/providers.ts
+var GOOGLE = { company: "Google Ireland Limited", privacyPolicy: "https://policies.google.com/privacy", transfer: "dpf" };
+var META = { company: "Meta Platforms Ireland Limited", privacyPolicy: "https://www.facebook.com/privacy/policy/", transfer: "dpf" };
+var providers = [
+  {
+    id: "ga",
+    name: "Google Analytics",
+    ...GOOGLE,
+    category: "analytics",
+    purpose: {
+      fi: "K\xE4vij\xE4tilastot: k\xE4vij\xE4m\xE4\xE4r\xE4t, liikenteen l\xE4hteet ja sivujen k\xE4ytt\xF6.",
+      sv: "Bes\xF6ksstatistik: antal bes\xF6kare, trafikk\xE4llor och hur sidorna anv\xE4nds.",
+      en: "Visitor statistics: visitor numbers, traffic sources and page usage."
+    },
+    cookies: [
+      { name: "_ga", duration: "2y" },
+      { name: "_ga_*", duration: "2y" }
+    ],
+    hosts: ["google-analytics.com", "analytics.google.com", "googletagmanager.com"]
+  },
+  {
+    id: "googleAds",
+    name: "Google Ads",
+    ...GOOGLE,
+    category: "marketing",
+    purpose: {
+      fi: "Mainonnan tehon mittaaminen (konversiot) ja mainosten kohdentaminen sivuston k\xE4vij\xF6ille.",
+      sv: "M\xE4tning av annonsernas effekt (konverteringar) och riktad annonsering till bes\xF6kare.",
+      en: "Measuring ad performance (conversions) and showing ads to site visitors."
+    },
+    cookies: [
+      { name: "_gcl_au", duration: "90d" },
+      { name: "_gcl_aw", duration: "90d" },
+      { name: "_gcl_dc", duration: "90d" },
+      { name: "_gcl_gs", duration: "90d" },
+      { name: "_gac_*", duration: "90d" },
+      { name: "_gcl_ls", duration: "persistent", storage: "localStorage" },
+      { name: "IDE", duration: "13mo", host: "doubleclick.net" },
+      { name: "DSID", duration: "14d", host: "doubleclick.net" },
+      { name: "test_cookie", duration: "15min", host: "doubleclick.net" }
+    ],
+    hosts: ["googletagmanager.com", "googleadservices.com", "doubleclick.net", "googlesyndication.com"]
+  },
+  {
+    id: "meta",
+    name: "Meta Pixel",
+    ...META,
+    category: "marketing",
+    purpose: {
+      fi: "Mainonnan tehon mittaaminen ja mainosten kohdentaminen Facebookissa ja Instagramissa.",
+      sv: "M\xE4tning av annonsernas effekt och riktad annonsering p\xE5 Facebook och Instagram.",
+      en: "Measuring ad performance and targeting ads on Facebook and Instagram."
+    },
+    cookies: [
+      { name: "_fbp", duration: "90d" },
+      { name: "_fbc", duration: "90d" },
+      { name: "fr", duration: "90d", host: "facebook.com" }
+    ],
+    hosts: ["facebook.net", "facebook.com"]
+  },
+  {
+    id: "youtube",
+    name: "YouTube",
+    ...GOOGLE,
+    category: "marketing",
+    purpose: {
+      fi: "Upotettujen videoiden toistaminen. YouTube voi k\xE4ytt\xE4\xE4 tietoja mainontaan.",
+      sv: "Uppspelning av inb\xE4ddade videor. YouTube kan anv\xE4nda uppgifterna f\xF6r annonsering.",
+      en: "Playing embedded videos. YouTube may use the data for advertising."
+    },
+    cookies: [
+      { name: "YSC", duration: "session", host: "youtube.com" },
+      { name: "VISITOR_INFO1_LIVE", duration: "6mo", host: "youtube.com" },
+      { name: "VISITOR_PRIVACY_METADATA", duration: "6mo", host: "youtube.com" },
+      { name: "__Secure-YNID", duration: "6mo", host: "youtube.com" },
+      { name: "__Secure-ROLLOUT_TOKEN", duration: "6mo", host: "youtube.com" },
+      { name: "PREF", duration: "8mo", host: "youtube.com" },
+      { name: "yt-remote-*, ytidb::*, yt-player-*", duration: "persistent", host: "youtube-nocookie.com", storage: "localStorage" }
+    ],
+    hosts: ["youtube.com", "youtube-nocookie.com", "ytimg.com", "googlevideo.com"]
+  }
+];
+
+// src/scan.ts
+var known = (purpose, fi, sv) => ({ en: purpose, fi, sv });
+var SESSION = known("Keeps you signed in.", "Pit\xE4\xE4 sinut kirjautuneena.", "H\xE5ller dig inloggad.");
+var CSRF = known("Protects forms against forgery.", "Suojaa lomakkeita v\xE4\xE4renn\xF6ksilt\xE4.", "Skyddar formul\xE4r mot f\xF6rfalskning.");
+var SECURITY = known(
+  "Protects the site against bots and attacks.",
+  "Suojaa sivustoa boteilta ja hy\xF6kk\xE4yksilt\xE4.",
+  "Skyddar webbplatsen mot botar och attacker."
+);
+var purposes = {
+  NEXT_LOCALE: known("Remembers your language.", "Muistaa valitsemasi kielen.", "Kommer ih\xE5g ditt spr\xE5k."),
+  "next-auth.session-token": SESSION,
+  "__Secure-next-auth.session-token": SESSION,
+  "authjs.session-token": SESSION,
+  "__Secure-authjs.session-token": SESSION,
+  "next-auth.csrf-token": CSRF,
+  "__Host-next-auth.csrf-token": CSRF,
+  "authjs.csrf-token": CSRF,
+  "__Host-authjs.csrf-token": CSRF,
+  "next-auth.callback-url": known("Returns you to the right page after signing in.", "Palauttaa oikealle sivulle kirjautumisen j\xE4lkeen.", "\xC5terf\xF6r dig till r\xE4tt sida efter inloggning."),
+  __cf_bm: SECURITY,
+  cf_clearance: SECURITY,
+  _cfuvid: SECURITY,
+  PHPSESSID: SESSION,
+  "connect.sid": SESSION,
+  session: SESSION,
+  csrftoken: CSRF,
+  _csrf: CSRF,
+  "sveltekit:*": known("Restores scroll position and page state when you navigate back.", "Palauttaa vierityskohdan ja sivun tilan, kun palaat takaisin.", "\xC5terst\xE4ller scrollposition och sidans l\xE4ge n\xE4r du g\xE5r tillbaka.")
+};
+var trackerNames = providers.flatMap((p) => p.cookies.flatMap((c) => c.name.split(", ")));
+var trackerHosts = providers.flatMap((p) => p.hosts);
+var matches = (patterns, name) => patterns.some((p) => p.endsWith("*") ? name.startsWith(p.slice(0, -1)) : name === p);
+function purposeOf(name) {
+  const k = Object.keys(purposes).find((p) => matches([p], name));
+  return k ? purposes[k] : void 0;
+}
+function durationOf(expires, now = Date.now() / 1e3) {
+  if (expires < 0) return "session";
+  const minutes = (expires - now) / 60;
+  const days = minutes / 1440;
+  if (days >= 365) return `${Math.round(days / 365)}y`;
+  if (days >= 30) return `${Math.round(days / 30.4)}mo`;
+  if (days >= 1) return `${Math.round(days)}d`;
+  return `${Math.max(1, Math.round(minutes))}min`;
+}
+async function scan(url2, { pages = 20, cookieName = "keksi" } = {}) {
+  const { chromium } = await import("@playwright/test");
+  const browser = await chromium.launch();
+  const origin = new URL(url2).origin;
+  const host = new URL(url2).hostname;
+  const found2 = /* @__PURE__ */ new Map();
+  try {
+    const context = await browser.newContext();
+    const page = await context.newPage();
+    const queue = [new URL(url2).href];
+    const seen = new Set(queue);
+    for (let i = 0; i < queue.length && i < pages; i++) {
+      await page.goto(queue[i], { waitUntil: "networkidle", timeout: 3e4 }).catch(() => {
+      });
+      const { links, local, session } = await page.evaluate(() => ({
+        links: [...document.querySelectorAll("a[href]")].map((a) => a.href),
+        local: Object.keys(localStorage),
+        session: Object.keys(sessionStorage)
+      }));
+      for (const key2 of local) found2.set(`l:${key2}`, { name: key2, duration: "persistent", storage: "localStorage" });
+      for (const key2 of session) found2.set(`s:${key2}`, { name: key2, duration: "session", storage: "sessionStorage" });
+      for (const link of links) {
+        const u = new URL(link);
+        u.hash = "";
+        if (u.origin === origin && !seen.has(u.href) && !/\.(pdf|zip|jpe?g|png|webp|svg|mp4)$/i.test(u.pathname)) {
+          seen.add(u.href);
+          queue.push(u.href);
+        }
+      }
+    }
+    for (const c of await context.cookies()) {
+      const domain = c.domain.replace(/^\./, "");
+      const own = host === domain || host.endsWith(`.${domain}`);
+      found2.set(`c:${c.name}`, { name: c.name, duration: durationOf(c.expires), ...own ? {} : { host: domain } });
+    }
+  } finally {
+    await browser.close();
+  }
+  return [...found2.values()].filter((c) => c.name !== cookieName && !matches(trackerNames, c.name)).filter((c) => !c.host || !trackerHosts.some((t) => c.host === t || c.host.endsWith(`.${t}`))).map((c) => ({ ...c, purpose: purposeOf(c.name) ?? { en: "", fi: "", sv: "" } }));
+}
+var key = (c) => `${c.storage ?? "cookie"}:${c.name}`;
+function merge(existing2, found2) {
+  const old = new Map(existing2.map((c) => [key(c), c]));
+  const now = new Set(found2.map(key));
+  const added2 = found2.filter((c) => !old.has(key(c)));
+  const missing2 = existing2.filter((c) => !now.has(key(c)));
+  const list2 = [
+    ...existing2.map((c) => {
+      const f = found2.find((x) => key(x) === key(c));
+      return f ? { ...c, duration: f.duration } : c;
+    }),
+    ...added2
+  ];
+  return { list: list2, added: added2, missing: missing2 };
+}
+
+// src/cli.ts
+var HELP = `Usage: keksi scan <url> [options]
+
+Lists the cookies and storage your site sets without consent, for the "Necessary" section.
+
+Options:
+  --out <file>     Output file (default: keksi.cookies.json)
+  --pages <n>      Most pages to visit (default: 20)
+  --cookie <name>  Consent cookie name, if changed (default: keksi)
+  --check          Write nothing; exit 1 if the file is missing entries
+`;
+var { values, positionals } = parseArgs({
+  allowPositionals: true,
+  options: {
+    out: { type: "string", default: "keksi.cookies.json" },
+    pages: { type: "string", default: "20" },
+    cookie: { type: "string", default: "keksi" },
+    check: { type: "boolean", default: false },
+    help: { type: "boolean", short: "h", default: false }
+  }
+});
+var [command, url] = positionals;
+if (values.help || command !== "scan" || !url) {
+  process.stdout.write(HELP);
+  process.exit(values.help ? 0 : 1);
+}
+var existing = existsSync(values.out) ? JSON.parse(readFileSync(values.out, "utf8")) : [];
+var found = await scan(url, { pages: Number(values.pages), cookieName: values.cookie });
+var { list, added, missing } = merge(existing, found);
+var label = (c) => `${c.name}${c.storage ? ` (${c.storage})` : ""}`;
+var blank = (c) => !c.purpose || typeof c.purpose === "object" && !Object.values(c.purpose).some(Boolean);
+for (const c of added) console.log(`+ ${label(c)}`);
+for (const c of missing) console.log(`? ${label(c)}: not seen, remove it unless it's set after login or on unscanned pages`);
+if (values.check) {
+  if (added.length) {
+    console.error(`${values.out} is missing ${added.length} entr${added.length === 1 ? "y" : "ies"}. Run keksi scan ${url}`);
+    process.exit(1);
+  }
+  console.log(`${values.out} is up to date.`);
+} else {
+  writeFileSync(values.out, `${JSON.stringify(list, null, 2)}
+`);
+  const todo = list.filter(blank);
+  console.log(`Wrote ${list.length} entr${list.length === 1 ? "y" : "ies"} to ${values.out}.`);
+  if (todo.length) console.log(`Add a purpose for: ${todo.map(label).join(", ")}`);
+}

package/dist/i18n.d.ts

@@ -24,6 +24,7 @@ declare const fi: {
     dpf: string;
     name: string;
     duration: string;
+    purpose: string;
     setBy: string;
     session: string;
     persistent: string;

package/dist/index.js

@@ -24,6 +24,7 @@ var fi = {
   dpf: "Tietoja voidaan siirt\xE4\xE4 Yhdysvaltoihin EU:n ja Yhdysvaltojen v\xE4lisen tietosuojakehyksen (DPF) perusteella.",
   name: "Nimi",
   duration: "Kesto",
+  purpose: "Tarkoitus",
   setBy: "Asettaja",
   session: "istunto",
   persistent: "kunnes poistetaan",
@@ -60,6 +61,7 @@ var sv = {
   dpf: "Uppgifter kan \xF6verf\xF6ras till USA med st\xF6d av ramverket f\xF6r dataskydd mellan EU och USA (DPF).",
   name: "Namn",
   duration: "Varaktighet",
+  purpose: "Syfte",
   setBy: "S\xE4tts av",
   session: "session",
   persistent: "tills den raderas",
@@ -96,6 +98,7 @@ var en = {
   dpf: "Data may be transferred to the United States under the EU\u2013US Data Privacy Framework (DPF).",
   name: "Name",
   duration: "Duration",
+  purpose: "Purpose",
   setBy: "Set by",
   session: "session",
   persistent: "until deleted",
@@ -288,30 +291,36 @@ function sections(config, lang, h, dialog) {
   const t = textsFor(config, lang);
   const active = activeProviders(config);
   const { name, days } = runtimeData(config, lang);
+  const local = (v) => typeof v === "object" ? v[lang] ?? Object.values(v).find(Boolean) : v;
   const site = {
     name: t.thisSite,
-    purpose: t.consentPurpose,
-    cookies: [{ name, duration: days % 365 ? `${days}d` : `${days / 365}y` }]
+    cookies: [
+      { name, duration: days % 365 ? `${days}d` : `${days / 365}y`, purpose: t.consentPurpose },
+      ...(config.necessary ?? []).map((c) => ({ ...c, purpose: local(c.purpose) }))
+    ]
   };
   return ["necessary", ...categoriesOf(config)].map((c) => {
     const items = c === "necessary" ? [site] : active.filter((p) => p.category === c).map((p) => ({ ...p, purpose: p.purpose[lang] }));
     const head = c === "necessary" ? `<h${h}>${e(t.necessary)}</h${h}><span>${e(t.alwaysOn)}</span>` : dialog ? `<h${h}><label for="keksi-c-${c}">${e(t[c])}</label></h${h}><input type="checkbox" role="switch" id="keksi-c-${c}" name="${c}" aria-describedby="keksi-i-${c}">` : `<h${h}>${e(t[c])}</h${h}>`;
     const list2 = items.map(
-      (p) => `<div class="keksi-provider"><h${h + 1}>${e(p.name)}</h${h + 1}><p>${e(p.purpose)}</p>` + (p.company && p.privacyPolicy ? `<p>${e(p.company)} \xB7 <a href="${e(p.privacyPolicy)}" target="_blank" rel="noopener">${e(t.privacyPolicy)}</a></p>` + (p.transfer ? `<p>${e(t.dpf)}</p>` : "") : "") + table(p.cookies, t) + `</div>`
+      (p) => `<div class="keksi-provider"><h${h + 1}>${e(p.name)}</h${h + 1}>${p.purpose ? `<p>${e(p.purpose)}</p>` : ""}` + (p.company && p.privacyPolicy ? `<p>${e(p.company)} \xB7 <a href="${e(p.privacyPolicy)}" target="_blank" rel="noopener">${e(t.privacyPolicy)}</a></p>` + (p.transfer ? `<p>${e(t.dpf)}</p>` : "") : "") + table(p.cookies, t) + `</div>`
     ).join("");
     const body = dialog ? `<details><summary>${e(t.providers)} (${items.length})</summary>${list2}</details>` : list2;
     return `<section class="keksi-cat"><div class="keksi-cat-head">${head}</div><p id="keksi-i-${c}">${e(t[`${c}Info`])}</p>${body}</section>`;
   }).join("");
 }
 function table(cookies, t) {
+  const purpose = cookies.some((c) => c.purpose);
   const rows = cookies.map(
-    (c) => `<tr><td><code>${e(c.name)}</code>${c.storage ? ` (${c.storage})` : ""}</td><td>${e(duration(c.duration, t))}</td><td>${e(c.host ?? t.thisSite)}</td></tr>`
+    (c) => `<tr><td><code>${e(c.name)}</code>${c.storage ? ` (${c.storage})` : ""}</td>` + (purpose ? `<td>${e(c.purpose ?? "")}</td>` : "") + `<td>${e(duration(c.duration, t))}</td><td>${e(c.host ?? t.thisSite)}</td></tr>`
   ).join("");
-  return `<table><thead><tr><th scope="col">${e(t.name)}</th><th scope="col">${e(t.duration)}</th><th scope="col">${e(t.setBy)}</th></tr></thead><tbody>${rows}</tbody></table>`;
+  return `<table><thead><tr><th scope="col">${e(t.name)}</th>` + (purpose ? `<th scope="col">${e(t.purpose)}</th>` : "") + `<th scope="col">${e(t.duration)}</th><th scope="col">${e(t.setBy)}</th></tr></thead><tbody>${rows}</tbody></table>`;
 }
 function duration(d, t) {
   if (d === "session" || d === "persistent") return t[d];
-  const [, n, unit] = d.match(/^(\d+)(y|mo|d|min)$/);
+  const m = d.match(/^(\d+)(y|mo|d|min)$/);
+  if (!m) return d;
+  const [, n, unit] = m;
   const [one, many] = t[unit].split("|");
   return `${n} ${n === "1" ? one : many}`;
 }

package/dist/playwright.js

@@ -24,6 +24,7 @@ var fi = {
   dpf: "Tietoja voidaan siirt\xE4\xE4 Yhdysvaltoihin EU:n ja Yhdysvaltojen v\xE4lisen tietosuojakehyksen (DPF) perusteella.",
   name: "Nimi",
   duration: "Kesto",
+  purpose: "Tarkoitus",
   setBy: "Asettaja",
   session: "istunto",
   persistent: "kunnes poistetaan",
@@ -60,6 +61,7 @@ var sv = {
   dpf: "Uppgifter kan \xF6verf\xF6ras till USA med st\xF6d av ramverket f\xF6r dataskydd mellan EU och USA (DPF).",
   name: "Namn",
   duration: "Varaktighet",
+  purpose: "Syfte",
   setBy: "S\xE4tts av",
   session: "session",
   persistent: "tills den raderas",
@@ -96,6 +98,7 @@ var en = {
   dpf: "Data may be transferred to the United States under the EU\u2013US Data Privacy Framework (DPF).",
   name: "Name",
   duration: "Duration",
+  purpose: "Purpose",
   setBy: "Set by",
   session: "session",
   persistent: "until deleted",

package/dist/render.d.ts

@@ -13,4 +13,4 @@ export interface CookieTableOptions {
 }
 /** Cookie policy section generated from the same data as the banner. */
 export declare function cookieTable(config: KeksiConfig, { lang, headingLevel }?: CookieTableOptions): string;
-export declare function duration(d: Duration, t: Texts): string;
+export declare function duration(d: Duration | string, t: Texts): string;

package/dist/scan.d.ts

@@ -0,0 +1,18 @@
+import type { NecessaryCookie } from './types.js';
+export interface ScanOptions {
+    /** Most pages to visit, following same-origin links. */
+    pages?: number;
+    /** Consent cookie name, if changed in the config. */
+    cookieName?: string;
+}
+export declare function purposeOf(name: string): NecessaryCookie['purpose'] | undefined;
+/** Rounds a cookie lifetime to the units the policy page shows. */
+export declare function durationOf(expires: number, now?: number): string;
+/** Visits the site without consent and returns what it stores, minus keksi's own and known trackers. */
+export declare function scan(url: string, { pages, cookieName }?: ScanOptions): Promise<NecessaryCookie[]>;
+/** Keeps hand-written purposes, updates durations, adds new entries and reports ones no longer seen. */
+export declare function merge(existing: NecessaryCookie[], found: NecessaryCookie[]): {
+    list: NecessaryCookie[];
+    added: NecessaryCookie[];
+    missing: NecessaryCookie[];
+};

package/dist/scan.js

@@ -0,0 +1,190 @@
+// src/providers.ts
+var GOOGLE = { company: "Google Ireland Limited", privacyPolicy: "https://policies.google.com/privacy", transfer: "dpf" };
+var META = { company: "Meta Platforms Ireland Limited", privacyPolicy: "https://www.facebook.com/privacy/policy/", transfer: "dpf" };
+var providers = [
+  {
+    id: "ga",
+    name: "Google Analytics",
+    ...GOOGLE,
+    category: "analytics",
+    purpose: {
+      fi: "K\xE4vij\xE4tilastot: k\xE4vij\xE4m\xE4\xE4r\xE4t, liikenteen l\xE4hteet ja sivujen k\xE4ytt\xF6.",
+      sv: "Bes\xF6ksstatistik: antal bes\xF6kare, trafikk\xE4llor och hur sidorna anv\xE4nds.",
+      en: "Visitor statistics: visitor numbers, traffic sources and page usage."
+    },
+    cookies: [
+      { name: "_ga", duration: "2y" },
+      { name: "_ga_*", duration: "2y" }
+    ],
+    hosts: ["google-analytics.com", "analytics.google.com", "googletagmanager.com"]
+  },
+  {
+    id: "googleAds",
+    name: "Google Ads",
+    ...GOOGLE,
+    category: "marketing",
+    purpose: {
+      fi: "Mainonnan tehon mittaaminen (konversiot) ja mainosten kohdentaminen sivuston k\xE4vij\xF6ille.",
+      sv: "M\xE4tning av annonsernas effekt (konverteringar) och riktad annonsering till bes\xF6kare.",
+      en: "Measuring ad performance (conversions) and showing ads to site visitors."
+    },
+    cookies: [
+      { name: "_gcl_au", duration: "90d" },
+      { name: "_gcl_aw", duration: "90d" },
+      { name: "_gcl_dc", duration: "90d" },
+      { name: "_gcl_gs", duration: "90d" },
+      { name: "_gac_*", duration: "90d" },
+      { name: "_gcl_ls", duration: "persistent", storage: "localStorage" },
+      { name: "IDE", duration: "13mo", host: "doubleclick.net" },
+      { name: "DSID", duration: "14d", host: "doubleclick.net" },
+      { name: "test_cookie", duration: "15min", host: "doubleclick.net" }
+    ],
+    hosts: ["googletagmanager.com", "googleadservices.com", "doubleclick.net", "googlesyndication.com"]
+  },
+  {
+    id: "meta",
+    name: "Meta Pixel",
+    ...META,
+    category: "marketing",
+    purpose: {
+      fi: "Mainonnan tehon mittaaminen ja mainosten kohdentaminen Facebookissa ja Instagramissa.",
+      sv: "M\xE4tning av annonsernas effekt och riktad annonsering p\xE5 Facebook och Instagram.",
+      en: "Measuring ad performance and targeting ads on Facebook and Instagram."
+    },
+    cookies: [
+      { name: "_fbp", duration: "90d" },
+      { name: "_fbc", duration: "90d" },
+      { name: "fr", duration: "90d", host: "facebook.com" }
+    ],
+    hosts: ["facebook.net", "facebook.com"]
+  },
+  {
+    id: "youtube",
+    name: "YouTube",
+    ...GOOGLE,
+    category: "marketing",
+    purpose: {
+      fi: "Upotettujen videoiden toistaminen. YouTube voi k\xE4ytt\xE4\xE4 tietoja mainontaan.",
+      sv: "Uppspelning av inb\xE4ddade videor. YouTube kan anv\xE4nda uppgifterna f\xF6r annonsering.",
+      en: "Playing embedded videos. YouTube may use the data for advertising."
+    },
+    cookies: [
+      { name: "YSC", duration: "session", host: "youtube.com" },
+      { name: "VISITOR_INFO1_LIVE", duration: "6mo", host: "youtube.com" },
+      { name: "VISITOR_PRIVACY_METADATA", duration: "6mo", host: "youtube.com" },
+      { name: "__Secure-YNID", duration: "6mo", host: "youtube.com" },
+      { name: "__Secure-ROLLOUT_TOKEN", duration: "6mo", host: "youtube.com" },
+      { name: "PREF", duration: "8mo", host: "youtube.com" },
+      { name: "yt-remote-*, ytidb::*, yt-player-*", duration: "persistent", host: "youtube-nocookie.com", storage: "localStorage" }
+    ],
+    hosts: ["youtube.com", "youtube-nocookie.com", "ytimg.com", "googlevideo.com"]
+  }
+];
+
+// src/scan.ts
+var known = (purpose, fi, sv) => ({ en: purpose, fi, sv });
+var SESSION = known("Keeps you signed in.", "Pit\xE4\xE4 sinut kirjautuneena.", "H\xE5ller dig inloggad.");
+var CSRF = known("Protects forms against forgery.", "Suojaa lomakkeita v\xE4\xE4renn\xF6ksilt\xE4.", "Skyddar formul\xE4r mot f\xF6rfalskning.");
+var SECURITY = known(
+  "Protects the site against bots and attacks.",
+  "Suojaa sivustoa boteilta ja hy\xF6kk\xE4yksilt\xE4.",
+  "Skyddar webbplatsen mot botar och attacker."
+);
+var purposes = {
+  NEXT_LOCALE: known("Remembers your language.", "Muistaa valitsemasi kielen.", "Kommer ih\xE5g ditt spr\xE5k."),
+  "next-auth.session-token": SESSION,
+  "__Secure-next-auth.session-token": SESSION,
+  "authjs.session-token": SESSION,
+  "__Secure-authjs.session-token": SESSION,
+  "next-auth.csrf-token": CSRF,
+  "__Host-next-auth.csrf-token": CSRF,
+  "authjs.csrf-token": CSRF,
+  "__Host-authjs.csrf-token": CSRF,
+  "next-auth.callback-url": known("Returns you to the right page after signing in.", "Palauttaa oikealle sivulle kirjautumisen j\xE4lkeen.", "\xC5terf\xF6r dig till r\xE4tt sida efter inloggning."),
+  __cf_bm: SECURITY,
+  cf_clearance: SECURITY,
+  _cfuvid: SECURITY,
+  PHPSESSID: SESSION,
+  "connect.sid": SESSION,
+  session: SESSION,
+  csrftoken: CSRF,
+  _csrf: CSRF,
+  "sveltekit:*": known("Restores scroll position and page state when you navigate back.", "Palauttaa vierityskohdan ja sivun tilan, kun palaat takaisin.", "\xC5terst\xE4ller scrollposition och sidans l\xE4ge n\xE4r du g\xE5r tillbaka.")
+};
+var trackerNames = providers.flatMap((p) => p.cookies.flatMap((c) => c.name.split(", ")));
+var trackerHosts = providers.flatMap((p) => p.hosts);
+var matches = (patterns, name) => patterns.some((p) => p.endsWith("*") ? name.startsWith(p.slice(0, -1)) : name === p);
+function purposeOf(name) {
+  const k = Object.keys(purposes).find((p) => matches([p], name));
+  return k ? purposes[k] : void 0;
+}
+function durationOf(expires, now = Date.now() / 1e3) {
+  if (expires < 0) return "session";
+  const minutes = (expires - now) / 60;
+  const days = minutes / 1440;
+  if (days >= 365) return `${Math.round(days / 365)}y`;
+  if (days >= 30) return `${Math.round(days / 30.4)}mo`;
+  if (days >= 1) return `${Math.round(days)}d`;
+  return `${Math.max(1, Math.round(minutes))}min`;
+}
+async function scan(url, { pages = 20, cookieName = "keksi" } = {}) {
+  const { chromium } = await import("@playwright/test");
+  const browser = await chromium.launch();
+  const origin = new URL(url).origin;
+  const host = new URL(url).hostname;
+  const found = /* @__PURE__ */ new Map();
+  try {
+    const context = await browser.newContext();
+    const page = await context.newPage();
+    const queue = [new URL(url).href];
+    const seen = new Set(queue);
+    for (let i = 0; i < queue.length && i < pages; i++) {
+      await page.goto(queue[i], { waitUntil: "networkidle", timeout: 3e4 }).catch(() => {
+      });
+      const { links, local, session } = await page.evaluate(() => ({
+        links: [...document.querySelectorAll("a[href]")].map((a) => a.href),
+        local: Object.keys(localStorage),
+        session: Object.keys(sessionStorage)
+      }));
+      for (const key2 of local) found.set(`l:${key2}`, { name: key2, duration: "persistent", storage: "localStorage" });
+      for (const key2 of session) found.set(`s:${key2}`, { name: key2, duration: "session", storage: "sessionStorage" });
+      for (const link of links) {
+        const u = new URL(link);
+        u.hash = "";
+        if (u.origin === origin && !seen.has(u.href) && !/\.(pdf|zip|jpe?g|png|webp|svg|mp4)$/i.test(u.pathname)) {
+          seen.add(u.href);
+          queue.push(u.href);
+        }
+      }
+    }
+    for (const c of await context.cookies()) {
+      const domain = c.domain.replace(/^\./, "");
+      const own = host === domain || host.endsWith(`.${domain}`);
+      found.set(`c:${c.name}`, { name: c.name, duration: durationOf(c.expires), ...own ? {} : { host: domain } });
+    }
+  } finally {
+    await browser.close();
+  }
+  return [...found.values()].filter((c) => c.name !== cookieName && !matches(trackerNames, c.name)).filter((c) => !c.host || !trackerHosts.some((t) => c.host === t || c.host.endsWith(`.${t}`))).map((c) => ({ ...c, purpose: purposeOf(c.name) ?? { en: "", fi: "", sv: "" } }));
+}
+var key = (c) => `${c.storage ?? "cookie"}:${c.name}`;
+function merge(existing, found) {
+  const old = new Map(existing.map((c) => [key(c), c]));
+  const now = new Set(found.map(key));
+  const added = found.filter((c) => !old.has(key(c)));
+  const missing = existing.filter((c) => !now.has(key(c)));
+  const list = [
+    ...existing.map((c) => {
+      const f = found.find((x) => key(x) === key(c));
+      return f ? { ...c, duration: f.duration } : c;
+    }),
+    ...added
+  ];
+  return { list, added, missing };
+}
+export {
+  durationOf,
+  merge,
+  purposeOf,
+  scan
+};

package/dist/sveltekit.d.ts

@@ -0,0 +1,18 @@
+import type { KeksiConfig, Locale } from './types.js';
+interface Options {
+    /** Defaults to the page's `<html lang>`, then `fi`. */
+    lang?: Locale;
+    nonce?: string;
+}
+type Resolve = (event: any, opts?: {
+    transformPageChunk?: (input: {
+        html: string;
+        done: boolean;
+    }) => string;
+}) => any;
+/** SvelteKit `handle` hook that renders keksi right after `<body>`, outside the Svelte root. */
+export declare function keksiHandle(config: KeksiConfig, { lang, nonce }?: Options): ({ event, resolve }: {
+    event: any;
+    resolve: Resolve;
+}) => any;
+export {};

package/dist/sveltekit.js

@@ -0,0 +1,339 @@
+// src/i18n.ts
+var fi = {
+  title: "Ev\xE4steet",
+  intro: "K\xE4yt\xE4mme v\xE4ltt\xE4m\xE4tt\xF6mien ev\xE4steiden lis\xE4ksi seuraavia palveluita vain, jos annat siihen luvan:",
+  transfer: "Palveluntarjoajat voivat siirt\xE4\xE4 tietoja Yhdysvaltoihin. Voit muuttaa valintaasi milloin tahansa.",
+  more: "Lue lis\xE4\xE4",
+  accept: "Hyv\xE4ksy kaikki",
+  reject: "Hylk\xE4\xE4 kaikki",
+  settings: "Asetukset",
+  settingsTitle: "Ev\xE4steasetukset",
+  save: "Tallenna valinnat",
+  close: "Sulje",
+  alwaysOn: "Aina k\xE4yt\xF6ss\xE4",
+  necessary: "V\xE4ltt\xE4m\xE4tt\xF6m\xE4t",
+  necessaryInfo: "Sivuston toiminnan kannalta v\xE4ltt\xE4m\xE4tt\xF6m\xE4t, kuten ev\xE4stevalintasi tallentaminen. Eiv\xE4t vaadi suostumusta.",
+  analytics: "Analytiikka",
+  analyticsInfo: "Mittaamme sivuston k\xE4ytt\xF6\xE4, jotta voimme kehitt\xE4\xE4 sit\xE4.",
+  marketing: "Markkinointi",
+  marketingInfo: "Mainonnan kohdentaminen ja tehon mittaaminen sek\xE4 upotetut sis\xE4ll\xF6t, kuten videot.",
+  providers: "Palveluntarjoajat",
+  thisSite: "T\xE4m\xE4 sivusto",
+  consentPurpose: "Tallentaa ev\xE4stevalintasi.",
+  privacyPolicy: "Tietosuojaseloste",
+  dpf: "Tietoja voidaan siirt\xE4\xE4 Yhdysvaltoihin EU:n ja Yhdysvaltojen v\xE4lisen tietosuojakehyksen (DPF) perusteella.",
+  name: "Nimi",
+  duration: "Kesto",
+  purpose: "Tarkoitus",
+  setBy: "Asettaja",
+  session: "istunto",
+  persistent: "kunnes poistetaan",
+  y: "vuosi|vuotta",
+  mo: "kuukausi|kuukautta",
+  d: "p\xE4iv\xE4|p\xE4iv\xE4\xE4",
+  min: "minuutti|minuuttia",
+  ytText: "Video ladataan YouTubesta. YouTube (Google) asettaa ev\xE4steit\xE4 ja voi siirt\xE4\xE4 tietoja Yhdysvaltoihin.",
+  ytButton: "N\xE4yt\xE4 video",
+  ytOpen: "Avaa YouTubessa"
+};
+var sv = {
+  title: "Kakor",
+  intro: "Ut\xF6ver n\xF6dv\xE4ndiga kakor anv\xE4nder vi f\xF6ljande tj\xE4nster endast om du ger ditt samtycke:",
+  transfer: "Tj\xE4nsteleverant\xF6rerna kan \xF6verf\xF6ra uppgifter till USA. Du kan \xE4ndra ditt val n\xE4r som helst.",
+  more: "L\xE4s mer",
+  accept: "Godk\xE4nn alla",
+  reject: "Avvisa alla",
+  settings: "Inst\xE4llningar",
+  settingsTitle: "Inst\xE4llningar f\xF6r kakor",
+  save: "Spara val",
+  close: "St\xE4ng",
+  alwaysOn: "Alltid p\xE5",
+  necessary: "N\xF6dv\xE4ndiga",
+  necessaryInfo: "N\xF6dv\xE4ndiga f\xF6r att webbplatsen ska fungera, till exempel f\xF6r att spara ditt val. Kr\xE4ver inget samtycke.",
+  analytics: "Analys",
+  analyticsInfo: "Vi m\xE4ter hur webbplatsen anv\xE4nds f\xF6r att kunna utveckla den.",
+  marketing: "Marknadsf\xF6ring",
+  marketingInfo: "Riktad annonsering och m\xE4tning av annonsernas effekt samt inb\xE4ddat inneh\xE5ll, till exempel videor.",
+  providers: "Tj\xE4nsteleverant\xF6rer",
+  thisSite: "Denna webbplats",
+  consentPurpose: "Sparar ditt val av kakor.",
+  privacyPolicy: "Dataskyddsbeskrivning",
+  dpf: "Uppgifter kan \xF6verf\xF6ras till USA med st\xF6d av ramverket f\xF6r dataskydd mellan EU och USA (DPF).",
+  name: "Namn",
+  duration: "Varaktighet",
+  purpose: "Syfte",
+  setBy: "S\xE4tts av",
+  session: "session",
+  persistent: "tills den raderas",
+  y: "\xE5r|\xE5r",
+  mo: "m\xE5nad|m\xE5nader",
+  d: "dag|dagar",
+  min: "minut|minuter",
+  ytText: "Videon laddas fr\xE5n YouTube. YouTube (Google) s\xE4tter kakor och kan \xF6verf\xF6ra uppgifter till USA.",
+  ytButton: "Visa video",
+  ytOpen: "\xD6ppna p\xE5 YouTube"
+};
+var en = {
+  title: "Cookies",
+  intro: "Besides necessary cookies, we use the following services only if you allow it:",
+  transfer: "The providers may transfer data to the United States. You can change your choice at any time.",
+  more: "Read more",
+  accept: "Accept all",
+  reject: "Reject all",
+  settings: "Settings",
+  settingsTitle: "Cookie settings",
+  save: "Save choices",
+  close: "Close",
+  alwaysOn: "Always on",
+  necessary: "Necessary",
+  necessaryInfo: "Needed for the site to work, such as storing your cookie choice. No consent needed.",
+  analytics: "Analytics",
+  analyticsInfo: "We measure how the site is used so we can improve it.",
+  marketing: "Marketing",
+  marketingInfo: "Ad targeting and measurement, and embedded content such as videos.",
+  providers: "Providers",
+  thisSite: "This site",
+  consentPurpose: "Stores your cookie choice.",
+  privacyPolicy: "Privacy policy",
+  dpf: "Data may be transferred to the United States under the EU\u2013US Data Privacy Framework (DPF).",
+  name: "Name",
+  duration: "Duration",
+  purpose: "Purpose",
+  setBy: "Set by",
+  session: "session",
+  persistent: "until deleted",
+  y: "year|years",
+  mo: "month|months",
+  d: "day|days",
+  min: "minute|minutes",
+  ytText: "The video loads from YouTube. YouTube (Google) sets cookies and may transfer data to the United States.",
+  ytButton: "Show video",
+  ytOpen: "Open on YouTube"
+};
+var texts = { fi, sv, en };
+
+// src/providers.ts
+var GOOGLE = { company: "Google Ireland Limited", privacyPolicy: "https://policies.google.com/privacy", transfer: "dpf" };
+var META = { company: "Meta Platforms Ireland Limited", privacyPolicy: "https://www.facebook.com/privacy/policy/", transfer: "dpf" };
+var providers = [
+  {
+    id: "ga",
+    name: "Google Analytics",
+    ...GOOGLE,
+    category: "analytics",
+    purpose: {
+      fi: "K\xE4vij\xE4tilastot: k\xE4vij\xE4m\xE4\xE4r\xE4t, liikenteen l\xE4hteet ja sivujen k\xE4ytt\xF6.",
+      sv: "Bes\xF6ksstatistik: antal bes\xF6kare, trafikk\xE4llor och hur sidorna anv\xE4nds.",
+      en: "Visitor statistics: visitor numbers, traffic sources and page usage."
+    },
+    cookies: [
+      { name: "_ga", duration: "2y" },
+      { name: "_ga_*", duration: "2y" }
+    ],
+    hosts: ["google-analytics.com", "analytics.google.com", "googletagmanager.com"]
+  },
+  {
+    id: "googleAds",
+    name: "Google Ads",
+    ...GOOGLE,
+    category: "marketing",
+    purpose: {
+      fi: "Mainonnan tehon mittaaminen (konversiot) ja mainosten kohdentaminen sivuston k\xE4vij\xF6ille.",
+      sv: "M\xE4tning av annonsernas effekt (konverteringar) och riktad annonsering till bes\xF6kare.",
+      en: "Measuring ad performance (conversions) and showing ads to site visitors."
+    },
+    cookies: [
+      { name: "_gcl_au", duration: "90d" },
+      { name: "_gcl_aw", duration: "90d" },
+      { name: "_gcl_dc", duration: "90d" },
+      { name: "_gcl_gs", duration: "90d" },
+      { name: "_gac_*", duration: "90d" },
+      { name: "_gcl_ls", duration: "persistent", storage: "localStorage" },
+      { name: "IDE", duration: "13mo", host: "doubleclick.net" },
+      { name: "DSID", duration: "14d", host: "doubleclick.net" },
+      { name: "test_cookie", duration: "15min", host: "doubleclick.net" }
+    ],
+    hosts: ["googletagmanager.com", "googleadservices.com", "doubleclick.net", "googlesyndication.com"]
+  },
+  {
+    id: "meta",
+    name: "Meta Pixel",
+    ...META,
+    category: "marketing",
+    purpose: {
+      fi: "Mainonnan tehon mittaaminen ja mainosten kohdentaminen Facebookissa ja Instagramissa.",
+      sv: "M\xE4tning av annonsernas effekt och riktad annonsering p\xE5 Facebook och Instagram.",
+      en: "Measuring ad performance and targeting ads on Facebook and Instagram."
+    },
+    cookies: [
+      { name: "_fbp", duration: "90d" },
+      { name: "_fbc", duration: "90d" },
+      { name: "fr", duration: "90d", host: "facebook.com" }
+    ],
+    hosts: ["facebook.net", "facebook.com"]
+  },
+  {
+    id: "youtube",
+    name: "YouTube",
+    ...GOOGLE,
+    category: "marketing",
+    purpose: {
+      fi: "Upotettujen videoiden toistaminen. YouTube voi k\xE4ytt\xE4\xE4 tietoja mainontaan.",
+      sv: "Uppspelning av inb\xE4ddade videor. YouTube kan anv\xE4nda uppgifterna f\xF6r annonsering.",
+      en: "Playing embedded videos. YouTube may use the data for advertising."
+    },
+    cookies: [
+      { name: "YSC", duration: "session", host: "youtube.com" },
+      { name: "VISITOR_INFO1_LIVE", duration: "6mo", host: "youtube.com" },
+      { name: "VISITOR_PRIVACY_METADATA", duration: "6mo", host: "youtube.com" },
+      { name: "__Secure-YNID", duration: "6mo", host: "youtube.com" },
+      { name: "__Secure-ROLLOUT_TOKEN", duration: "6mo", host: "youtube.com" },
+      { name: "PREF", duration: "8mo", host: "youtube.com" },
+      { name: "yt-remote-*, ytidb::*, yt-player-*", duration: "persistent", host: "youtube-nocookie.com", storage: "localStorage" }
+    ],
+    hosts: ["youtube.com", "youtube-nocookie.com", "ytimg.com", "googlevideo.com"]
+  }
+];
+
+// src/config.ts
+var list = (v) => v === void 0 ? [] : Array.isArray(v) ? v : [v];
+function activeProviders(config) {
+  return providers.filter((p) => p.id === "youtube" ? config.youtube : list(config[p.id]).length);
+}
+function categoriesOf(config) {
+  return ["analytics", "marketing"].filter((c) => activeProviders(config).some((p) => p.category === c));
+}
+function textsFor(config, locale) {
+  return { ...texts[locale], ...config.texts?.[locale] };
+}
+function version(config) {
+  let h = 2166136261;
+  for (const ch of activeProviders(config).map((p) => p.id).join()) h = Math.imul(h ^ ch.charCodeAt(0), 16777619);
+  return (h >>> 0).toString(36);
+}
+function runtimeData(config, locale) {
+  const active = activeProviders(config);
+  const del = (c) => active.filter((p) => p.category === c).flatMap((p) => p.cookies.filter((k) => !k.host).map((k) => k.name));
+  const t = textsFor(config, locale);
+  return {
+    v: version(config),
+    name: config.cookie?.name ?? "keksi",
+    domain: config.cookie?.domain,
+    days: config.cookie?.days ?? 365,
+    ga: list(config.ga),
+    ads: list(config.googleAds),
+    meta: list(config.meta),
+    yt: !!config.youtube,
+    del: { analytics: del("analytics"), marketing: del("marketing") },
+    t: { ytText: t.ytText, ytButton: t.ytButton, ytOpen: t.ytOpen }
+  };
+}
+
+// src/styles.ts
+var css = [
+  ":where(.keksi,.keksi-dialog){--_bg:var(--keksi-bg,#fff);--_fg:var(--keksi-fg,#1b1b1b);--_line:var(--keksi-line,#c8c8c8);--_r:var(--keksi-radius,6px);box-sizing:border-box;background:var(--_bg);color:var(--_fg);font:inherit;font-size:15px;line-height:1.5}",
+  ":where(.keksi-policy){--_line:var(--keksi-line,#c8c8c8)}",
+  ":where(.keksi){position:fixed;z-index:2147483000;inset:auto 1rem 1rem;max-width:34rem;max-height:calc(100vh - 2rem);overflow:auto;margin-inline:auto;padding:1.25rem;border:1px solid var(--_line);border-radius:var(--_r);box-shadow:0 4px 24px #0003}",
+  ":where(.keksi,.keksi-dialog) :where(h2){font-size:1.125rem;margin:0 0 .5rem}",
+  ":where(.keksi) :where(p,ul){margin:0 0 .75rem}",
+  ":where(.keksi) :where(ul){padding-left:1.25rem}",
+  ":where(.keksi,.keksi-dialog) :where(a){color:inherit}",
+  ":where(.keksi-actions){display:flex;flex-wrap:wrap;gap:.5rem;margin-top:1rem}",
+  ":where(.keksi-btn){flex:1 1 auto;font:inherit;font-weight:600;padding:.6rem 1rem;border:1px solid var(--_fg);border-radius:var(--_r);background:var(--_bg);color:var(--_fg);cursor:pointer}",
+  ":where(.keksi-btn:hover){background:var(--_fg);color:var(--_bg)}",
+  ":where(.keksi,.keksi-dialog,keksi-youtube) :where(button,a,input,summary):focus-visible{outline:3px solid var(--keksi-focus,#2563eb);outline-offset:2px}",
+  ":where(.keksi-dialog){width:min(40rem,calc(100% - 2rem));max-height:calc(100% - 2rem);padding:0;border:0;border-radius:var(--_r)}",
+  ":where(.keksi-dialog)::backdrop{background:#0009}",
+  ":where(.keksi-dialog form){padding:1.25rem}",
+  ":where(.keksi-head,.keksi-cat-head){display:flex;align-items:center;justify-content:space-between;gap:1rem}",
+  ":where(.keksi-close){font:inherit;font-size:1.5rem;line-height:1;padding:.25rem .5rem;border:0;background:none;color:inherit;cursor:pointer}",
+  ":where(.keksi-cat){padding:.75rem 0;border-top:1px solid var(--_line)}",
+  ":where(.keksi-cat-head) :where(h2,h3,h4,h5){font-size:1rem;margin:0}",
+  ":where(.keksi-cat) :where(p){margin:.25rem 0}",
+  ":where(.keksi-cat input[role=switch]){appearance:none;position:relative;flex:none;width:2.75rem;height:1.5rem;margin:0;border-radius:1rem;background:var(--_line);cursor:pointer}",
+  ':where(.keksi-cat input[role=switch])::before{content:"";position:absolute;top:.2rem;left:.2rem;width:1.1rem;height:1.1rem;border-radius:50%;background:#fff;transition:transform .15s}',
+  ":where(.keksi-cat input[role=switch]:checked){background:var(--_fg)}",
+  ":where(.keksi-cat input[role=switch]:checked)::before{transform:translateX(1.25rem)}",
+  ":where(.keksi-cat summary){margin-top:.5rem;font-weight:600;cursor:pointer}",
+  ":where(.keksi-provider){margin:.75rem 0}",
+  ":where(.keksi-provider) :where(h3,h4,h5,h6){font-size:.9375rem;margin:0}",
+  ":where(.keksi-cat table){width:100%;border-collapse:collapse;font-size:.875rem;margin-top:.25rem}",
+  ":where(.keksi-cat) :where(th,td){padding:.25rem .75rem .25rem 0;border-bottom:1px solid var(--_line);text-align:left;vertical-align:top}",
+  ":where(keksi-youtube){display:block;aspect-ratio:16/9;background:#111;color:#fff}",
+  ":where(keksi-youtube iframe){display:block;width:100%;height:100%;border:0}",
+  ":where(.keksi-yt){display:flex;flex-direction:column;align-items:center;justify-content:center;gap:.75rem;height:100%;padding:1rem;box-sizing:border-box;text-align:center}",
+  ":where(.keksi-yt) :where(p){max-width:32rem;margin:0}",
+  ":where(.keksi-yt) :where(a){color:inherit}",
+  ":where(.keksi-yt button){font:inherit;font-weight:600;padding:.6rem 1.25rem;border:0;border-radius:6px;background:#fff;color:#111;cursor:pointer}"
+].join("");
+
+// src/render.ts
+var e = (s) => s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+function renderKeksi(config, { lang = "fi", nonce } = {}) {
+  const cats = categoriesOf(config);
+  if (!cats.length) return "";
+  const t = textsFor(config, lang);
+  const active = activeProviders(config);
+  const policy = typeof config.policyUrl === "string" ? config.policyUrl : config.policyUrl?.[lang];
+  const n = nonce ? ` nonce="${e(nonce)}"` : "";
+  const btn = (action, label, type = "button") => `<button type="${type}" class="keksi-btn" data-keksi="${action}">${e(label)}</button>`;
+  const uses = cats.map((c) => `<li><strong>${e(t[c])}:</strong> ${e(active.filter((p) => p.category === c).map((p) => p.name).join(", "))}</li>`).join("");
+  const json = JSON.stringify(runtimeData(config, lang)).replace(/</g, "\\u003c");
+  return `<style${n}>${css}</style><section id="keksi-banner" class="keksi" aria-labelledby="keksi-title" hidden><h2 id="keksi-title">${e(t.title)}</h2><p>${e(t.intro)}</p><ul>${uses}</ul><p>${e(t.transfer)}${policy ? ` <a href="${e(policy)}">${e(t.more)}</a>` : ""}</p><div class="keksi-actions">${btn("accept", t.accept)}${btn("reject", t.reject)}<button type="button" class="keksi-btn" data-keksi-open>${e(t.settings)}</button></div></section><dialog id="keksi-dialog" class="keksi-dialog" aria-labelledby="keksi-dialog-title"><form method="dialog"><div class="keksi-head"><h2 id="keksi-dialog-title">${e(t.settingsTitle)}</h2><button class="keksi-close" aria-label="${e(t.close)}">\xD7</button></div>` + sections(config, lang, 3, true) + `<div class="keksi-actions">${btn("save", t.save, "submit")}${btn("accept", t.accept, "submit")}${btn("reject", t.reject, "submit")}</div></form></dialog><script type="application/json" id="keksi-data">${json}</script><script${n}>${'"use strict";(()=>{var v=["analytics","marketing"],C={analytics:!1,marketing:!1};function g(...a){return arguments}function q(a,o=window){if(typeof o.keksi?.sync=="function")return o.keksi.sync(),o.keksi;let r=o.document,h=e=>r.getElementById(e),l=w(),A=!1,E=!1,b=new Set,$=g("consent","default",{ad_storage:"denied",ad_user_data:"denied",ad_personalization:"denied",analytics_storage:"denied"});if(a.ga.length||a.ads.length){let e=o.dataLayer??(o.dataLayer=[]);o.gtag=function(){e.push(arguments)},e.push($)}if(a.meta.length){let e=function(){e.callMethod?e.callMethod.apply(e,[...arguments]):e.queue.push(arguments)};Object.assign(e,{push:e,loaded:!0,version:"2.0",queue:[]}),o.fbq=o._fbq=e}function w(){let e=r.cookie.split("; ").find(s=>s.startsWith(`${a.name}=`))?.slice(a.name.length+1),[n,,t,i]=e?.split(".")??[];return n!==a.v||!t||!i?null:{id:t,c:{analytics:i.includes("a"),marketing:i.includes("m")}}}function T(e){let n=l?.id??Array.from(o.crypto.getRandomValues(new Uint8Array(8)),i=>i.toString(16).padStart(2,"0")).join(""),t=(e.analytics?"a":"")+(e.marketing?"m":"")||"-";return r.cookie=`${a.name}=${a.v}.${Date.now().toString(36)}.${n}.${t}; Path=/; Max-Age=${a.days*86400}; SameSite=Lax`+(a.domain?`; Domain=${a.domain}`:"")+(o.location.protocol==="https:"?"; Secure":""),{id:n,c:e}}function S(e){let n=r.createElement("script");n.async=!0,n.src=e,r.head.append(n)}function _(e){let n=[...e.analytics?a.ga:[],...e.marketing?a.ads:[]].filter(t=>!b.has(t));if(n.length){let t=e.marketing?"granted":"denied",i=[g("consent","update",{analytics_storage:e.analytics?"granted":"denied",ad_storage:t,ad_user_data:t,ad_personalization:t})];b.size||i.push(g("js",new Date));for(let s of n)i.push(g("config",s)),b.add(s);if(A)for(let s of i)o.dataLayer.push(s);else{let s=o.dataLayer;s.splice(s.indexOf($)+1,0,...i),S(`https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(n[0])}`),A=!0}}if(e.marketing&&a.meta.length&&!E&&(E=!0,o.fbq.queue.unshift(...a.meta.map(t=>g("init",t)),g("track","PageView")),S("https://connect.facebook.net/en_US/fbevents.js")),e.marketing)for(let t of r.querySelectorAll("keksi-youtube"))t.show(!0)}function M(e){let n=e.flatMap(c=>a.del[c]),t=c=>n.some(u=>u.endsWith("*")?c.startsWith(u.slice(0,-1)):c===u),i=o.location.hostname.split("."),s=["",...i.map((c,u)=>`; Domain=${i.slice(u).join(".")}`)];for(let c of r.cookie.split("; ")){let u=c.split("=")[0];if(t(u))for(let y of s)r.cookie=`${u}=; Max-Age=0; Path=/${y}`}try{for(let c of Object.keys(o.localStorage))t(c)&&o.localStorage.removeItem(c)}catch{}}function f(e){let n=l?.c;l=T(e),k(),r.dispatchEvent(new o.CustomEvent("keksi:change",{detail:{...e}})),M(v.filter(t=>!e[t])),v.some(t=>n?.[t]&&!e[t])?o.location.reload():_(e)}function k(){let e=h("keksi-banner");e&&(e.hidden=!!l)}function x(){let e=h("keksi-dialog");if(e){for(let n of v){let t=e.querySelector(`[name=${n}]`);t&&(t.checked=!!l?.c[n])}e.showModal()}}r.addEventListener("click",e=>{let n=e.target.closest?.("[data-keksi],[data-keksi-open]");if(!n)return;if(n.hasAttribute("data-keksi-open"))return e.preventDefault(),x();let t=n.getAttribute("data-keksi");if(t==="accept")f({analytics:!0,marketing:!0});else if(t==="reject")f(C);else if(t==="save"){let i=s=>!!h("keksi-dialog")?.querySelector(`[name=${s}]`)?.checked;f({analytics:i("analytics"),marketing:i("marketing")})}}),r.addEventListener("astro:after-swap",k);class j extends o.HTMLElement{connectedCallback(){this.show(!!l?.c.marketing)}show(n,t=!1){let i=encodeURIComponent(this.getAttribute("video")??""),s=this.getAttribute("label");if(n){if(this.querySelector("iframe"))return;let d=r.createElement("iframe");d.src=`https://www.youtube-nocookie.com/embed/${i}${t?"?autoplay=1":""}`,d.title=s??"YouTube",d.allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share",d.allowFullscreen=!0,d.referrerPolicy="strict-origin-when-cross-origin",this.replaceChildren(d),t&&d.focus();return}let c=r.createElement("div");c.className="keksi-yt";let u=this.getAttribute("poster");u&&(c.style.background=`linear-gradient(#000a,#000a),center/cover url(${JSON.stringify(u)})`);let y=r.createElement("p");y.textContent=a.t.ytText;let m=r.createElement("button");m.type="button",m.textContent=a.t.ytButton,s&&m.setAttribute("aria-label",`${a.t.ytButton}: ${s}`),m.onclick=()=>this.show(!0,!0);let p=r.createElement("a");p.href=`https://www.youtube.com/watch?v=${i}`,p.target="_blank",p.rel="noopener",p.textContent=a.t.ytOpen,c.append(y,m,p),this.replaceChildren(c)}}a.yt&&!o.customElements.get("keksi-youtube")&&o.customElements.define("keksi-youtube",j);let L={get consent(){return l?{...l.c}:null},open:x,save:e=>f({...l?.c??C,...e}),acceptAll:()=>f({analytics:!0,marketing:!0}),rejectAll:()=>f(C),sync:k};return o.keksi=L,k(),l&&_(l.c),L}q(JSON.parse(document.getElementById("keksi-data").textContent));})();'}</script>`;
+}
+function sections(config, lang, h, dialog) {
+  const t = textsFor(config, lang);
+  const active = activeProviders(config);
+  const { name, days } = runtimeData(config, lang);
+  const local = (v) => typeof v === "object" ? v[lang] ?? Object.values(v).find(Boolean) : v;
+  const site = {
+    name: t.thisSite,
+    cookies: [
+      { name, duration: days % 365 ? `${days}d` : `${days / 365}y`, purpose: t.consentPurpose },
+      ...(config.necessary ?? []).map((c) => ({ ...c, purpose: local(c.purpose) }))
+    ]
+  };
+  return ["necessary", ...categoriesOf(config)].map((c) => {
+    const items = c === "necessary" ? [site] : active.filter((p) => p.category === c).map((p) => ({ ...p, purpose: p.purpose[lang] }));
+    const head = c === "necessary" ? `<h${h}>${e(t.necessary)}</h${h}><span>${e(t.alwaysOn)}</span>` : dialog ? `<h${h}><label for="keksi-c-${c}">${e(t[c])}</label></h${h}><input type="checkbox" role="switch" id="keksi-c-${c}" name="${c}" aria-describedby="keksi-i-${c}">` : `<h${h}>${e(t[c])}</h${h}>`;
+    const list2 = items.map(
+      (p) => `<div class="keksi-provider"><h${h + 1}>${e(p.name)}</h${h + 1}>${p.purpose ? `<p>${e(p.purpose)}</p>` : ""}` + (p.company && p.privacyPolicy ? `<p>${e(p.company)} \xB7 <a href="${e(p.privacyPolicy)}" target="_blank" rel="noopener">${e(t.privacyPolicy)}</a></p>` + (p.transfer ? `<p>${e(t.dpf)}</p>` : "") : "") + table(p.cookies, t) + `</div>`
+    ).join("");
+    const body = dialog ? `<details><summary>${e(t.providers)} (${items.length})</summary>${list2}</details>` : list2;
+    return `<section class="keksi-cat"><div class="keksi-cat-head">${head}</div><p id="keksi-i-${c}">${e(t[`${c}Info`])}</p>${body}</section>`;
+  }).join("");
+}
+function table(cookies, t) {
+  const purpose = cookies.some((c) => c.purpose);
+  const rows = cookies.map(
+    (c) => `<tr><td><code>${e(c.name)}</code>${c.storage ? ` (${c.storage})` : ""}</td>` + (purpose ? `<td>${e(c.purpose ?? "")}</td>` : "") + `<td>${e(duration(c.duration, t))}</td><td>${e(c.host ?? t.thisSite)}</td></tr>`
+  ).join("");
+  return `<table><thead><tr><th scope="col">${e(t.name)}</th>` + (purpose ? `<th scope="col">${e(t.purpose)}</th>` : "") + `<th scope="col">${e(t.duration)}</th><th scope="col">${e(t.setBy)}</th></tr></thead><tbody>${rows}</tbody></table>`;
+}
+function duration(d, t) {
+  if (d === "session" || d === "persistent") return t[d];
+  const m = d.match(/^(\d+)(y|mo|d|min)$/);
+  if (!m) return d;
+  const [, n, unit] = m;
+  const [one, many] = t[unit].split("|");
+  return `${n} ${n === "1" ? one : many}`;
+}
+
+// src/sveltekit.ts
+var LOCALES = ["fi", "sv", "en"];
+function keksiHandle(config, { lang, nonce } = {}) {
+  const cache = /* @__PURE__ */ new Map();
+  const render = (l) => cache.get(l) ?? cache.set(l, renderKeksi(config, { lang: l, nonce })).get(l);
+  return ({ event, resolve }) => {
+    let pageLang = lang;
+    return resolve(event, {
+      transformPageChunk: ({ html }) => {
+        pageLang ??= LOCALES.find((l) => new RegExp(`<html[^>]*\\slang="${l}`).test(html));
+        return html.replace(/<body[^>]*>/, (body) => body + render(pageLang ?? "fi"));
+      }
+    });
+  };
+}
+export {
+  keksiHandle
+};

package/dist/types.d.ts

@@ -20,8 +20,19 @@ export interface KeksiConfig {
         domain?: string;
         days?: number;
     };
+    /** Cookies your site or framework sets without consent, usually from `keksi scan`. Listed under "Necessary". */
+    necessary?: NecessaryCookie[];
     texts?: Partial<Record<Locale, Partial<Texts>>>;
 }
+export interface NecessaryCookie {
+    name: string;
+    /** A `Duration`; plain string so JSON imports type-check. */
+    duration: string;
+    purpose?: string | Partial<Record<Locale, string>>;
+    host?: string;
+    /** `localStorage` or `sessionStorage`; omitted for cookies. */
+    storage?: string;
+}
 /** `session`, `persistent`, or a number with unit: `2y`, `13mo`, `90d`, `15min`. */
 export type Duration = 'session' | 'persistent' | `${number}${'y' | 'mo' | 'd' | 'min'}`;
 export interface CookieInfo {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keksi",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Lean cookie consent for Google and Meta trackers",
   "license": "MIT",
   "type": "module",
@@ -9,7 +9,8 @@
     "node": ">=22.12"
   },
   "files": [
-    "dist"
+    "dist",
+    "astro"
   ],
   "exports": {
     ".": {
@@ -19,6 +20,18 @@
     "./playwright": {
       "types": "./dist/playwright.d.ts",
       "default": "./dist/playwright.js"
+    },
+    "./astro": {
+      "types": "./astro/index.d.ts",
+      "default": "./astro/index.js"
+    },
+    "./sveltekit": {
+      "types": "./dist/sveltekit.d.ts",
+      "default": "./dist/sveltekit.js"
+    },
+    "./scan": {
+      "types": "./dist/scan.d.ts",
+      "default": "./dist/scan.js"
     }
   },
   "peerDependencies": {
@@ -37,6 +50,9 @@
     "typescript": "^6.0.3",
     "vitest": "^5.0.5"
   },
+  "bin": {
+    "keksi": "./dist/cli.js"
+  },
   "scripts": {
     "build": "node scripts/build.mjs",
     "test": "vitest run",