privalint 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 JExcellence
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.de.md

@@ -0,0 +1,89 @@
+# privalint
+
+**English:** [README.md](README.md)
+
+privalint prüft Websites auf die Datenschutzfehler, für die es Abmahnungen gibt: Tracker, die vor
+der Einwilligung laden oder nach „Ablehnen“ weiterlaufen, Google Fonts vom Google-Server,
+eingebundene Inhalte wie YouTube oder Google Maps und ein fehlendes Impressum.
+
+privalint öffnet die Seite in einem echten Chromium-Browser ohne Cookies, wie beim ersten Besuch.
+Es zeichnet auf, was geladen wird, bevor jemand das Cookie-Banner bedient, klickt dann auf
+„Ablehnen“ und prüft, was trotzdem noch lädt. Es läuft im Terminal oder als GitHub Action bei
+jedem Pull Request.
+
+```bash
+npx privalint https://ihre-seite.de --lang de
+```
+
+> [!IMPORTANT]
+> privalint führt automatisierte Prüfungen durch. Ein sauberes Ergebnis bedeutet, dass keines der
+> geprüften Probleme gefunden wurde. Es macht eine Website nicht DSGVO-konform und ist keine
+> Rechtsberatung.
+
+## Deutschland, Österreich, Schweiz
+
+Mit `--region` wählen Sie, nach welchem Recht privalint die Befunde einordnet. Jeder Befund nennt
+die Rechtsgrundlage des gewählten Landes.
+
+| Region          | Cookies und Tracking                      | Impressum                                       | Besonderheit                                          |
+| --------------- | ----------------------------------------- | ----------------------------------------------- | ----------------------------------------------------- |
+| `de` (Standard) | Opt-in, § 25 TDDDG                        | § 5 DDG                                         | –                                                     |
+| `at`            | Opt-in, § 165 Abs. 3 TKG 2021             | § 5 ECG, § 25 MedienG                           | –                                                     |
+| `ch`            | Opt-out, Art. 45c FMG                     | Art. 3 Abs. 1 lit. s UWG (bei Online-Angeboten) | Tracker, Einbindungen und Impressum eine Stufe milder |
+| `eu`            | Opt-in, Art. 5 Abs. 3 ePrivacy-Richtlinie | Art. 5 E-Commerce-Richtlinie                    | –                                                     |
+
+Tracker, die nach einem ausdrücklichen „Ablehnen“ weiterlaufen, bleiben überall ein Fehler, auch in
+der Schweiz (Art. 30 Abs. 2 lit. b DSG). Richtet sich eine Schweizer Website auch an Besucher aus
+der EU, prüfen Sie sie zusätzlich mit `--region eu`.
+
+```bash
+npx privalint https://ihre-seite.at --region at --lang de --max-pages 20
+```
+
+## Was geprüft wird
+
+| Regel                   | Was sie findet                                                                                          |
+| ----------------------- | ------------------------------------------------------------------------------------------------------- |
+| `pre-consent-trackers`  | Analyse-, Werbe- und Session-Replay-Tools, die vor der Einwilligung Anfragen senden oder Cookies setzen |
+| `trackers-after-reject` | Tracker, die nach Klick auf „Ablehnen“ und Neuladen weiterlaufen                                        |
+| `reject-option`         | Cookie-Banner mit „Zustimmen“, aber ohne „Ablehnen“ auf der ersten Ebene; Pur-Abo-Modelle als Hinweis   |
+| `google-fonts`          | Schriften von `fonts.googleapis.com` / `fonts.gstatic.com`                                              |
+| `third-party-embeds`    | YouTube, Vimeo, Google Maps, reCAPTCHA, Gravatar und Social-Media-Einbindungen vor der Einwilligung     |
+| `third-party-cdns`      | Skripte und Styles von jsDelivr, unpkg, cdnjs und anderen öffentlichen CDNs (Hinweis)                   |
+| `impressum-link`        | Seiten ohne Link zum Impressum                                                                          |
+| `privacy-policy-link`   | Seiten ohne Link zur Datenschutzerklärung                                                               |
+
+Details, Hintergründe und Lösungen stehen auf Englisch in [`docs/rules`](docs/rules).
+
+## GitHub Action
+
+```yaml
+- uses: jexcellence/privalint@v0
+  with:
+    url: https://ihre-seite.de
+    max-pages: 20
+    lang: de
+    region: de
+```
+
+Der Bericht erscheint auf Deutsch in der Zusammenfassung des Workflow-Laufs. Alle Eingaben und
+die Anbindung an GitHub Code Scanning beschreibt die [englische README](README.md#github-action).
+
+## Grenzen
+
+- Manche Seiten zeigen ihr Cookie-Banner Headless-Browsern nicht. Dann meldet privalint „kein
+  Banner gefunden“. Lokal hilft `--headed --channel msedge` (oder `chrome`).
+- Viele Consent-Tools entscheiden anhand der IP-Adresse, ob sie ein Banner zeigen. GitHub-Runner
+  haben US-Adressen und sehen deshalb unter Umständen etwas anderes als Besucher aus der EU.
+- Serverseitiges Tracking ist im Browser nicht sichtbar.
+
+## Mitmachen
+
+Fehlalarme, fehlende Tracker, Consent-Tools und neue Regeln sind sehr willkommen. Gerade
+Anbieter aus dem deutschsprachigen Raum fehlen noch. Der Einstieg steht in
+[CONTRIBUTING.md](CONTRIBUTING.md), passende Aufgaben tragen das Label
+[`good first issue`](https://github.com/jexcellence/privalint/labels/good%20first%20issue).
+
+## Lizenz
+
+[MIT](LICENSE)

package/README.md

@@ -1,3 +1,223 @@
-# Temporary Holding Version
+# privalint
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![CI](https://github.com/jexcellence/privalint/actions/workflows/ci.yml/badge.svg)](https://github.com/jexcellence/privalint/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/privalint)](https://www.npmjs.com/package/privalint)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
+**Deutsch:** [README.de.md](README.de.md)
+
+Lint your website for the GDPR mistakes that get people warning letters: trackers that fire before
+consent or keep running after "reject", Google Fonts loaded from Google, embeds and a missing
+Impressum.
+
+privalint opens your site in a real Chromium browser with no cookies or storage, like a first
+visit. It records what loads before anyone touches the consent banner, then clicks "reject" and
+checks what still loads. Run it from your terminal or as a GitHub Action on every pull request.
+
+```bash
+npx privalint https://your-site.de
+```
+
+<p align="center">
+  <img src="docs/demo.svg" alt="privalint output: Google Analytics still runs after clicking reject, Google Fonts are loaded from Google, a YouTube embed loads before consent" width="820">
+</p>
+
+<sub>Output for the demo page in <a href="test/fixtures/demo/index.html"><code>test/fixtures/demo</code></a>, long lines
+shortened. Regenerate it with <code>npm run demo</code>.</sub>
+
+> [!IMPORTANT]
+> privalint runs automated checks. A clean result means it found none of the problems it looks
+> for. It does not make your site GDPR compliant and it is not legal advice.
+
+## What it checks
+
+| Rule                                                           | Severity | What it finds                                                                                                              |
+| -------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------- |
+| [`pre-consent-trackers`](docs/rules/pre-consent-trackers.md)   | error    | Analytics, ads and session-replay tools that send requests or set cookies before consent. A bare tag manager is a warning. |
+| [`trackers-after-reject`](docs/rules/trackers-after-reject.md) | error    | Trackers that still load after clicking "reject" on the consent banner and reloading.                                      |
+| [`reject-option`](docs/rules/reject-option.md)                 | warning  | A banner with "accept" but no "reject" on its first layer. Pay-or-OK banners are noted as info.                            |
+| [`google-fonts`](docs/rules/google-fonts.md)                   | error    | Fonts fetched from `fonts.googleapis.com` / `fonts.gstatic.com`. Leftover preconnects are a warning.                       |
+| [`third-party-embeds`](docs/rules/third-party-embeds.md)       | warning  | YouTube, Vimeo, Google Maps, reCAPTCHA, Gravatar and social embeds loading before consent.                                 |
+| [`third-party-cdns`](docs/rules/third-party-cdns.md)           | info     | Scripts and styles from jsDelivr, unpkg, cdnjs and other public CDNs.                                                      |
+| [`impressum-link`](docs/rules/impressum-link.md)               | warning  | Pages without a link to an Impressum. A contact link alone is noted as info.                                               |
+| [`privacy-policy-link`](docs/rules/privacy-policy-link.md)     | warning  | Pages without a link to a privacy policy.                                                                                  |
+
+More rules are on the [roadmap](#roadmap). Each one is a small file with tests, see
+[CONTRIBUTING.md](CONTRIBUTING.md).
+
+## GitHub Action
+
+```yaml
+name: Privacy
+
+on:
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"
+
+jobs:
+  privalint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write # only needed for the SARIF upload
+    steps:
+      - uses: jexcellence/privalint@v0
+        with:
+          url: https://your-site.de
+          max-pages: 20
+
+      - uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: privalint.sarif
+          category: privalint
+```
+
+The report shows up in the job summary. With the SARIF upload, findings also appear under
+**Security → Code scanning**.
+
+Scanning a preview deployment instead of production catches problems before they ship. Pass the
+preview URL from your hosting provider's deployment event or action output as `url`.
+
+| Input         | Default           |                                             |
+| ------------- | ----------------- | ------------------------------------------- |
+| `url`         |                   | Page to scan. Required.                     |
+| `max-pages`   | `1`               | How many pages of the same site to crawl.   |
+| `fail-on`     | `error`           | `error`, `warning` or `never`.              |
+| `disable`     |                   | Comma-separated rule ids to skip.           |
+| `lang`        | `en`              | Language of the report: `en` or `de`.       |
+| `region`      | `de`              | Whose law to cite: `de`, `at`, `ch`, `eu`.  |
+| `sarif-file`  | `privalint.sarif` | Where to write SARIF. Empty to skip.        |
+| `job-summary` | `true`            | Add the Markdown report to the job summary. |
+
+Outputs: `exit-code`, and `sarif-file` when a report was written.
+
+The action uses the runner's Node.js (20.12 or newer) and leaves your job's Node version alone.
+On self-hosted runners without it, add `actions/setup-node` before this step.
+
+> [!NOTE]
+> Code scanning expects each finding to point at a file in your repository, which a live page
+> doesn't have. privalint maps every page to a stable path such as `privalint/your-site.de/kontakt`.
+> Alerts show up with message, evidence and fix, but there is no source file to jump to. The
+> [demo scan](.github/workflows/demo.yml) runs this setup every week.
+
+## CLI
+
+```
+privalint <url> [options]
+
+  -p, --max-pages <n>     Crawl up to n pages of the same site (default 1)
+  -f, --format <format>   text | json | markdown | sarif (default text)
+  -o, --output <file>     Write the report to a file and print a text summary.
+                          Repeatable; .sarif, .json and .md pick their format,
+                          other extensions use --format
+      --fail-on <level>   error | warning | never (default error)
+      --disable <rules>   Comma-separated rule ids to skip
+      --settle <ms>       Wait this long after load for late tags (default 2000)
+      --timeout <ms>      Navigation timeout per page (default 30000)
+      --locale <locale>   Browser locale (default de-DE)
+      --lang <lang>       Language of the report: en | de (default en)
+      --region <region>   Whose law to cite: de | at | ch | eu (default de)
+      --skip-consent      Don't click "reject" on the consent banner
+      --headed            Open a visible browser window instead of running headless
+      --channel <name>    Use an installed browser: chrome or msedge
+      --list-rules        Print the available rules and exit
+```
+
+Exit codes: `0` nothing at or above `--fail-on`, `1` findings, `2` bad arguments or a failed scan.
+
+The first run needs a browser. If Playwright hasn't installed one yet:
+
+```bash
+npx playwright install chromium
+```
+
+## Countries and languages
+
+The same finding can be a clear violation in one country and a hint in another. `--region` picks
+whose law privalint cites and how strictly it judges:
+
+| Region         | Cookies and tracking                 | Imprint                               | Changes                                                                          |
+| -------------- | ------------------------------------ | ------------------------------------- | -------------------------------------------------------------------------------- |
+| `de` (default) | Opt-in, § 25 TDDDG                   | § 5 DDG                               | none                                                                             |
+| `at`           | Opt-in, § 165 Abs. 3 TKG 2021        | § 5 ECG, § 25 MedienG                 | none                                                                             |
+| `ch`           | Opt-out, Art. 45c FMG                | Art. 3 Abs. 1 lit. s UWG (e-commerce) | `pre-consent-trackers`, `third-party-embeds` and `impressum-link` drop one level |
+| `eu`           | Opt-in, Art. 5(3) ePrivacy Directive | Art. 5 Directive 2000/31/EC           | none                                                                             |
+
+Every finding lists its legal basis for the chosen country. Trackers that run after an explicit
+"reject" stay an error everywhere, Switzerland included (Art. 30 Abs. 2 lit. b DSG). If a Swiss
+site also targets visitors in the EU, scan it with `--region eu` as well.
+
+`--lang de` writes findings, fixes and the report in German:
+
+```bash
+npx privalint https://ihre-seite.ch --region ch --lang de
+```
+
+## Use it from code
+
+```ts
+import { scan } from 'privalint';
+
+const result = await scan('https://your-site.de', { maxPages: 10, region: 'at', lang: 'de' });
+for (const finding of result.findings) {
+  console.log(finding.severity, finding.ruleId, finding.pageUrl);
+}
+```
+
+## How it works
+
+1. Every page is opened in a **fresh browser context**: no cookies and no storage, the same as a
+   first visit.
+2. privalint waits for the network to go idle plus a settle delay (`--settle`), so tags that load
+   late are caught too.
+3. It records every request, the final cookie jar, all links and `<link>` resource hints.
+4. On the start page it looks for the consent banner, either by the selectors of common consent
+   managers (OneTrust, Cookiebot, Usercentrics, Borlabs, Complianz and others) or by button labels
+   in six languages. It clicks "reject", reloads and records what still loads.
+5. Each rule looks at those snapshots and reports findings with evidence and a suggested fix.
+6. With `--max-pages`, links to the same site are followed breadth-first. Query strings are
+   dropped, pages are deduplicated after redirects, and pages that fail to load (downloads,
+   timeouts) are listed but don't stop the crawl.
+
+### Limitations
+
+- Some sites don't show their consent banner to headless browsers. privalint then reports
+  "no banner found" and skips the reject check. Run it locally with `--headed` to scan in a
+  visible window; with `--channel msedge` or `--channel chrome` it uses your installed browser
+  instead of the bundled one. privalint never disguises itself as a different browser.
+- Some sites block automated browsers completely and serve a block page instead. privalint scans
+  what it gets, so check the scanned URL and the page count in the report.
+- Only "reject" is tested. Whether "accept" works, and whether rejecting is as easy as accepting
+  beyond the presence of a button, is not judged.
+- Tracker detection uses a hand-maintained list ([`src/data/trackers.ts`](src/data/trackers.ts)).
+  A vendor missing from the list goes unnoticed. Additions are very welcome.
+- First-party detection compares hostnames and ignores the public suffix list, so sibling
+  subdomains on shared hosts like `*.github.io` count as first party.
+- Server-side tracking can't be seen from the browser.
+- Many consent managers decide by IP address whether to show a banner. GitHub-hosted runners
+  have US addresses, so some sites load trackers there that EU visitors never get, and the
+  result differs from what an EU visitor sees. Use a runner or proxy in the EU for results you
+  want to rely on.
+- Chromium is launched with Playwright's defaults, which turn off the Chromium sandbox. Don't
+  scan sites you don't trust on a machine that holds secrets.
+
+## Roadmap
+
+- PR comments from the Action
+- Config file (`privalint.config.ts`) for allowlists and per-rule severity
+- Check the settings layer of banners and the "accept" path
+- More trackers, embeds and consent managers (see the
+  [`good first issue`](https://github.com/jexcellence/privalint/labels/good%20first%20issue) label)
+- Larger tracker list built from the Apache-licensed
+  [Open Cookie Database](https://github.com/jkwakman/Open-Cookie-Database)
+
+## Contributing
+
+Bug reports, false positives, new trackers and new rules are all welcome. Start with
+[CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+[MIT](LICENSE)

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,183 @@
+#!/usr/bin/env node
+import { writeFile } from 'node:fs/promises';
+import { extname } from 'node:path';
+import { parseArgs } from 'node:util';
+import { LANGS } from './i18n.js';
+import { REGIONS } from './legal.js';
+import { VERSION } from './meta.js';
+import { FORMATS, format, formatText } from './reporters/index.js';
+import { defaultRules } from './rules/index.js';
+import { scan } from './scanner.js';
+const FAIL_LEVELS = ['error', 'warning', 'never'];
+const CHANNELS = ['chrome', 'msedge'];
+const EXIT_OK = 0;
+const EXIT_FINDINGS = 1;
+const EXIT_ERROR = 2;
+const HELP = `privalint ${VERSION}
+Find GDPR problems on a live website: trackers before consent or after
+"reject", Google Fonts, missing Impressum. Runs the site in a real browser.
+
+Usage
+  privalint <url> [options]
+
+Options
+  -p, --max-pages <n>     Crawl up to n pages of the same site (default 1)
+  -f, --format <format>   ${FORMATS.join(' | ')} (default text)
+  -o, --output <file>     Write the report to a file and print a text summary.
+                          Repeatable; .sarif, .json and .md pick their format,
+                          other extensions use --format
+      --fail-on <level>   error | warning | never (default error)
+      --disable <rules>   Comma-separated rule ids to skip
+      --settle <ms>       Wait this long after load for late tags (default 2000)
+      --timeout <ms>      Navigation timeout per page (default 30000)
+      --locale <locale>   Browser locale (default de-DE)
+      --lang <lang>       Language of the report: en | de (default en)
+      --region <region>   Whose law to cite: de | at | ch | eu (default de)
+      --skip-consent      Don't click "reject" on the consent banner
+      --headed            Open a visible browser window instead of running headless
+      --channel <name>    Use an installed browser: chrome or msedge
+      --list-rules        Print the available rules and exit
+  -h, --help              Show this help
+  -v, --version           Show the version
+
+Exit codes
+  0  no findings at or above --fail-on
+  1  findings at or above --fail-on
+  2  invalid arguments or the scan failed
+`;
+const FORMAT_BY_EXTENSION = {
+    '.sarif': 'sarif',
+    '.json': 'json',
+    '.md': 'markdown',
+};
+async function main(argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        allowPositionals: true,
+        options: {
+            'max-pages': { type: 'string', short: 'p' },
+            format: { type: 'string', short: 'f', default: 'text' },
+            output: { type: 'string', short: 'o', multiple: true },
+            'fail-on': { type: 'string', default: 'error' },
+            disable: { type: 'string' },
+            settle: { type: 'string' },
+            timeout: { type: 'string' },
+            locale: { type: 'string' },
+            lang: { type: 'string', default: 'en' },
+            region: { type: 'string', default: 'de' },
+            'skip-consent': { type: 'boolean' },
+            headed: { type: 'boolean' },
+            channel: { type: 'string' },
+            'list-rules': { type: 'boolean' },
+            help: { type: 'boolean', short: 'h' },
+            version: { type: 'boolean', short: 'v' },
+        },
+    });
+    if (values.help) {
+        process.stdout.write(HELP);
+        return EXIT_OK;
+    }
+    if (values.version) {
+        process.stdout.write(`${VERSION}\n`);
+        return EXIT_OK;
+    }
+    if (values['list-rules']) {
+        for (const rule of defaultRules) {
+            process.stdout.write(`${rule.id.padEnd(22)} ${rule.title}\n`);
+        }
+        return EXIT_OK;
+    }
+    const target = parseTarget(positionals);
+    const reportFormat = oneOf(values.format, FORMATS, '--format');
+    const failOn = oneOf(values['fail-on'], FAIL_LEVELS, '--fail-on');
+    const rules = selectRules(values.disable);
+    const result = await scan(target.href, {
+        rules,
+        maxPages: wholeNumber(values['max-pages'], '--max-pages', 1),
+        settleMs: wholeNumber(values.settle, '--settle', 0),
+        timeoutMs: wholeNumber(values.timeout, '--timeout', 1),
+        locale: values.locale,
+        lang: oneOf(values.lang, LANGS, '--lang'),
+        region: oneOf(values.region, REGIONS, '--region'),
+        consentCheck: values['skip-consent'] !== true,
+        headed: values.headed === true,
+        channel: values.channel === undefined ? undefined : oneOf(values.channel, CHANNELS, '--channel'),
+        onPage: (page) => process.stderr.write(page.error === undefined
+            ? `scanned ${page.finalUrl}\n`
+            : `skipped ${page.url}: ${page.error}\n`),
+    });
+    const outputs = values.output ?? [];
+    for (const file of outputs) {
+        const kind = FORMAT_BY_EXTENSION[extname(file).toLowerCase()] ?? reportFormat;
+        await writeFile(file, format(result, kind));
+    }
+    if (outputs.length > 0) {
+        process.stdout.write(`${formatText(result, process.stdout.isTTY)}\n`);
+        process.stdout.write(`\nReport written to ${outputs.join(', ')}\n`);
+    }
+    else {
+        process.stdout.write(format(result, reportFormat, { color: process.stdout.isTTY }));
+        if (reportFormat === 'text') {
+            process.stdout.write('\n');
+        }
+    }
+    return shouldFail(result.findings, failOn) ? EXIT_FINDINGS : EXIT_OK;
+}
+function parseTarget(positionals) {
+    const [raw, ...rest] = positionals;
+    if (raw === undefined || rest.length > 0) {
+        throw new Error('Expected exactly one URL. Run privalint --help for usage.');
+    }
+    const withScheme = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
+    try {
+        return new URL(withScheme);
+    }
+    catch {
+        throw new Error(`Not a valid URL: ${raw}`);
+    }
+}
+function oneOf(value, allowed, flag) {
+    if (value !== undefined && allowed.includes(value)) {
+        return value;
+    }
+    throw new Error(`${flag} must be one of: ${allowed.join(', ')}`);
+}
+function wholeNumber(value, flag, min) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < min) {
+        throw new Error(`${flag} must be a whole number of at least ${min}`);
+    }
+    return parsed;
+}
+function selectRules(disable) {
+    const disabled = new Set((disable ?? '')
+        .split(',')
+        .map((id) => id.trim())
+        .filter(Boolean));
+    const unknown = [...disabled].filter((id) => !defaultRules.some((rule) => rule.id === id));
+    if (unknown.length > 0) {
+        throw new Error(`Unknown rule: ${unknown.join(', ')}. See privalint --list-rules.`);
+    }
+    return defaultRules.filter((rule) => !disabled.has(rule.id));
+}
+function shouldFail(findings, failOn) {
+    switch (failOn) {
+        case 'never':
+            return false;
+        case 'warning':
+            return findings.some((f) => f.severity === 'error' || f.severity === 'warning');
+        default:
+            return findings.some((f) => f.severity === 'error');
+    }
+}
+main(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+}, (error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`privalint: ${message}\n`);
+    process.exitCode = EXIT_ERROR;
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAe,MAAM,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAGpC,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AAC3D,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAG/C,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB,MAAM,IAAI,GAAG,aAAa,OAAO;;;;;;;;;4BASL,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;CAsB9C,CAAC;AAEF,MAAM,mBAAmB,GAA2B;IAClD,QAAQ,EAAE,OAAO;IACjB,OAAO,EAAE,MAAM;IACf,KAAK,EAAE,UAAU;CAClB,CAAC;AAEF,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YAC3C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;YACvD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;YACtD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE;YAC/C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;YACvC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;YACzC,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACnC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACjC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACzC;KACF,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QACrC,KAAK;QACL,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QAC5D,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACnD,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QACtD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC;QACjD,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI;QAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI;QAC9B,OAAO,EACL,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC;QACzF,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,KAAK,KAAK,SAAS;YACtB,CAAC,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI;YAC9B,CAAC,CAAC,WAAW,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,IAAI,CAC3C;KACJ,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,YAAY,CAAC;QAC9E,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpF,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;AACvE,CAAC;AAED,SAAS,WAAW,CAAC,WAAqB;IACxC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC;IACtE,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CACZ,KAAyB,EACzB,OAAqB,EACrB,IAAY;IAEZ,IAAI,KAAK,KAAK,SAAS,IAAK,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAU,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,KAAyB,EAAE,IAAY,EAAE,GAAW;IACvE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,OAA2B;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,OAAO,IAAI,EAAE,CAAC;SACZ,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;SACtB,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,UAAU,CAAC,QAAmB,EAAE,MAAiB;IACxD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,KAAK,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;QAClF;YACE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC9B,CAAC,IAAI,EAAE,EAAE;IACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;IACjB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC;AAChC,CAAC,CACF,CAAC"}

package/dist/consent.d.ts

@@ -0,0 +1,12 @@
+import type { BrowserContext, Page } from 'playwright';
+import type { ConsentObservation, RecordedRequest } from './types.js';
+export interface ConsentCheckOptions {
+    settleMs: number;
+    timeoutMs: number;
+}
+/**
+ * Looks for a consent banner, clicks its reject button if there is one,
+ * reloads the page and records what still gets loaded. The page must already
+ * be loaded; `requests` is the live array the page's request listener writes to.
+ */
+export declare function observeConsent(page: Page, context: BrowserContext, requests: RecordedRequest[], options: ConsentCheckOptions): Promise<ConsentObservation>;