pixellint 0.34.0 → 0.36.0

package/README.md

@@ -95,3 +95,23 @@ This npm wrapper loads the Node-target WASM build. Its ESM entry uses
 - [Writing a rulepack](https://github.com/aleksUIX/pixellint/blob/main/docs/RULEPACK_SCHEMA.md)
 
 Apache-2.0. Not affiliated with any vendor named in its rulepacks.
+
+## HAR requests use recorded clocks and explicit availability.
+
+```js
+import { importHar, validateHar } from "pixellint";
+const imported = importHar(harText, { headerPolicy: "chrome_sanitized" });
+const report = validateHar(harText, { headerPolicy: "chrome_sanitized" });
+```
+
+HAR input stays offline. Default replay uses each capture's startedDateTime;
+`at` overrides it with safe integer Unix seconds. Missing/invalid capture clocks
+require an explicit override. The default `unknown` header policy treats absent
+Authorization/Cookie as unavailable. `chrome_sanitized` records their omission
+as redaction; `complete` establishes absent headers and enables missing-field
+findings. Observable methods, headers and bodies retain their checks.
+
+Import and replay results preserve original URLs, headers and bodies and can
+contain credentials. They are private capture data, not sanitized output.
+See [the HAR request schema](https://github.com/aleksUIX/pixellint/blob/main/docs/HAR_REQUEST_SCHEMA.md)
+for body encoding, byte limits, deduplication and provenance details.

package/index.cjs

@@ -14,6 +14,18 @@ function validateMany(document) {
   return wasm.validate_many(JSON.stringify(document));
 }
 
+/** Extract local HAR 1.2 requests. Returned captures can contain credentials. */
+function importHar(har, options = {}) {
+  const raw = typeof har === "string" ? har : JSON.stringify(har);
+  return wasm.import_har(raw, options.headerPolicy ?? "unknown");
+}
+
+/** Replay local HAR requests at capture timestamps, or an explicit Unix clock. */
+function validateHar(har, options = {}) {
+  const raw = typeof har === "string" ? har : JSON.stringify(har);
+  return wasm.validate_har(raw, options.headerPolicy ?? "unknown", options.at);
+}
+
 function isOk(summary) {
   return summary.reports.every((report) =>
     report.violations.every((violation) => violation.severity !== "error"),
@@ -23,6 +35,8 @@ function isOk(summary) {
 module.exports = {
   validate,
   validateMany,
+  importHar,
+  validateHar,
   isOk,
   rulepacks: () => wasm.rulepacks(),
   vendors: () => wasm.vendors(),

package/index.d.ts

@@ -17,6 +17,8 @@ export interface HttpRequest {
   method: string;
   headers: Record<string, string> | Array<{ name: string; value: string }>;
   body?: string;
+  /** Omitted capture fields remain unvalidated. Absent metadata retains complete-capture semantics. */
+  capture?: HttpCaptureContext;
 }
 
 export type Severity = "error" | "warning" | "info";
@@ -144,3 +146,69 @@ export function vendorForHost(host: string): VendorEntry | null;
 
 /** The pixellint-core version this build wraps. */
 export function version(): string;
+
+export type HarBodyAvailability = "available" | "absent" | "unavailable" | "redacted";
+export type HarHeaderPolicy = "unknown" | "complete" | "chrome_sanitized";
+
+export interface HttpCaptureContext {
+  headers_unavailable?: boolean;
+  unavailable_headers?: string[];
+  redacted_headers?: string[];
+  body?: HarBodyAvailability;
+}
+
+export interface HarOptions {
+  /** unknown assumes omitted Authorization/Cookie may have been removed by the exporter. */
+  headerPolicy?: HarHeaderPolicy;
+}
+
+export interface HarValidateOptions extends HarOptions {
+  /** Safe integer Unix seconds. Overrides every HAR capture timestamp. */
+  at?: number;
+}
+
+export interface DocumentArtifactInput {
+  artifact_kind?: ArtifactKind;
+  artifact: string;
+  claimed_vendor?: string | null;
+  expansion_state?: ExpansionState;
+  occurrences?: ArtifactOccurrence[];
+}
+
+export interface DocumentRequest {
+  document_kind: string;
+  extractor?: { id: string; version?: string | null };
+  artifacts: DocumentArtifactInput[];
+}
+
+export interface HarEntryMetadata {
+  entry_index: number;
+  occurrence_id: string;
+  path: string;
+  started_date_time: string | null;
+  reference_time_unix_seconds: number | null;
+  page_ref: string | null;
+  body_size: number | null;
+  body_availability: HarBodyAvailability;
+  body_reason: string | null;
+  post_data: object | null;
+  capture: HttpCaptureContext;
+}
+
+export interface HarImport {
+  document: DocumentRequest;
+  header_policy: HarHeaderPolicy;
+  entries: HarEntryMetadata[];
+}
+
+export interface HarReport extends DocumentReport {
+  header_policy: HarHeaderPolicy;
+  reference_time_override: number | null;
+  captures: HarEntryMetadata[];
+}
+
+/** Import local HAR requests. This does not fetch URLs or sanitize the returned private captures. */
+export function importHar(har: string | object, options?: HarOptions): HarImport;
+
+/** Validate local HAR requests at their recorded clocks. Missing clocks require an explicit at override. */
+export function validateHar(har: string | object, options?: HarValidateOptions): HarReport;

package/index.mjs

@@ -30,6 +30,18 @@ export function validateMany(document) {
   return wasm.validate_many(JSON.stringify(document));
 }
 
+/** Extract local HAR 1.2 requests. Returned captures can contain credentials. */
+export function importHar(har, options = {}) {
+  const raw = typeof har === "string" ? har : JSON.stringify(har);
+  return wasm.import_har(raw, options.headerPolicy ?? "unknown");
+}
+
+/** Replay local HAR requests at capture timestamps, or an explicit Unix clock. */
+export function validateHar(har, options = {}) {
+  const raw = typeof har === "string" ? har : JSON.stringify(har);
+  return wasm.validate_har(raw, options.headerPolicy ?? "unknown", options.at);
+}
+
 /** Rulepacks this build ships, with their evidence levels. */
 export function rulepacks() {
   return wasm.rulepacks();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pixellint",
-  "version": "0.34.0",
+  "version": "0.36.0",
   "description": "Validator for pixels, postbacks, conversion API payloads, and tracking URLs: Meta CAPI, Facebook pixel, GTM, and vendor rulepacks",
   "license": "Apache-2.0",
   "author": "Aleks <aleks@vastlint.org>",

package/wasm/pixellint.d.ts

@@ -1,6 +1,11 @@
 /* tslint:disable */
 /* eslint-disable */
 
+/**
+ * Extracts local HAR 1.2 requests and records unavailable capture fields.
+ */
+export function import_har(har_json: string, header_policy: string): any;
+
 /**
  * Every rulepack the engine ships, with its evidence level.
  */
@@ -12,6 +17,11 @@ export function rulepacks(): any;
  */
 export function validate(artifact_kind: string, artifact: string, expansion_state?: string | null, claimed_vendor?: string | null): any;
 
+/**
+ * Validates offline at each capture timestamp, or one caller-supplied override.
+ */
+export function validate_har(har_json: string, header_policy: string, reference_time?: number | null): any;
+
 /**
  * Validates extracted artifacts as one document. The caller already pulled
  * tracking URLs out. A JSON array of URL strings is a list of `url` artifacts.

package/wasm/pixellint.js

@@ -1,5 +1,24 @@
 /* @ts-self-types="./pixellint.d.ts" */
 
+/**
+ * Extracts local HAR 1.2 requests and records unavailable capture fields.
+ * @param {string} har_json
+ * @param {string} header_policy
+ * @returns {any}
+ */
+function import_har(har_json, header_policy) {
+    const ptr0 = passStringToWasm0(har_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len0 = WASM_VECTOR_LEN;
+    const ptr1 = passStringToWasm0(header_policy, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len1 = WASM_VECTOR_LEN;
+    const ret = wasm.import_har(ptr0, len0, ptr1, len1);
+    if (ret[2]) {
+        throw takeFromExternrefTable0(ret[1]);
+    }
+    return takeFromExternrefTable0(ret[0]);
+}
+exports.import_har = import_har;
+
 /**
  * Every rulepack the engine ships, with its evidence level.
  * @returns {any}
@@ -39,6 +58,26 @@ function validate(artifact_kind, artifact, expansion_state, claimed_vendor) {
 }
 exports.validate = validate;
 
+/**
+ * Validates offline at each capture timestamp, or one caller-supplied override.
+ * @param {string} har_json
+ * @param {string} header_policy
+ * @param {number | null} [reference_time]
+ * @returns {any}
+ */
+function validate_har(har_json, header_policy, reference_time) {
+    const ptr0 = passStringToWasm0(har_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len0 = WASM_VECTOR_LEN;
+    const ptr1 = passStringToWasm0(header_policy, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len1 = WASM_VECTOR_LEN;
+    const ret = wasm.validate_har(ptr0, len0, ptr1, len1, !isLikeNone(reference_time), isLikeNone(reference_time) ? 0 : reference_time);
+    if (ret[2]) {
+        throw takeFromExternrefTable0(ret[1]);
+    }
+    return takeFromExternrefTable0(ret[0]);
+}
+exports.validate_har = validate_har;
+
 /**
  * Validates extracted artifacts as one document. The caller already pulled
  * tracking URLs out. A JSON array of URL strings is a list of `url` artifacts.
@@ -132,6 +171,10 @@ function __wbg_get_imports() {
             getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
             getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
         },
+        __wbg___wbindgen_is_string_ea5e6cc2e4141dfe: function(arg0) {
+            const ret = typeof(arg0) === 'string';
+            return ret;
+        },
         __wbg___wbindgen_throw_344f42d3211c4765: function(arg0, arg1) {
             throw new Error(getStringFromWasm0(arg0, arg1));
         },
@@ -139,14 +182,22 @@ function __wbg_get_imports() {
             const ret = new Array();
             return ret;
         },
+        __wbg_new_7796ffc7ed656783: function() {
+            const ret = new Map();
+            return ret;
+        },
         __wbg_new_da52cf8fe3429cb2: function() {
             const ret = new Object();
             return ret;
         },
-        __wbg_now_1e2da45fa673f925: function() {
+        __wbg_now_18ba40740da8f711: function() {
             const ret = Date.now();
             return ret;
         },
+        __wbg_set_575dd786d51585f8: function(arg0, arg1, arg2) {
+            const ret = arg0.set(arg1, arg2);
+            return ret;
+        },
         __wbg_set_6be42768c690e380: function(arg0, arg1, arg2) {
             arg0[arg1] = arg2;
         },
@@ -158,12 +209,17 @@ function __wbg_get_imports() {
             const ret = arg0;
             return ret;
         },
-        __wbindgen_cast_0000000000000002: function(arg0, arg1) {
+        __wbindgen_cast_0000000000000002: function(arg0) {
+            // Cast intrinsic for `I64 -> Externref`.
+            const ret = arg0;
+            return ret;
+        },
+        __wbindgen_cast_0000000000000003: function(arg0, arg1) {
             // Cast intrinsic for `Ref(String) -> Externref`.
             const ret = getStringFromWasm0(arg0, arg1);
             return ret;
         },
-        __wbindgen_cast_0000000000000003: function(arg0) {
+        __wbindgen_cast_0000000000000004: function(arg0) {
             // Cast intrinsic for `U64 -> Externref`.
             const ret = BigInt.asUintN(64, arg0);
             return ret;

package/wasm/pixellint_bg.wasm.d.ts

@@ -1,8 +1,10 @@
 /* tslint:disable */
 /* eslint-disable */
 export const memory: WebAssembly.Memory;
+export const import_har: (a: number, b: number, c: number, d: number) => [number, number, number];
 export const rulepacks: () => [number, number, number];
 export const validate: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number) => [number, number, number];
+export const validate_har: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number, number];
 export const validate_many: (a: number, b: number) => [number, number, number];
 export const validate_url: (a: number, b: number) => [number, number, number];
 export const vendor_for_host: (a: number, b: number) => [number, number, number];