privalint 0.0.0-stage → 0.2.0

package/dist/consent.js

@@ -0,0 +1,185 @@
+/**
+ * Button selectors of common consent managers. Best effort: vendors change
+ * their markup, so the label heuristic below is the fallback for everything
+ * that isn't listed or no longer matches.
+ */
+const KNOWN_CMPS = [
+    {
+        name: 'Cookiebot',
+        accept: '#CybotCookiebotDialogBodyLevelButtonLevelOptinAllowAll, #CybotCookiebotDialogBodyButtonAccept',
+        reject: '#CybotCookiebotDialogBodyButtonDecline',
+    },
+    {
+        name: 'OneTrust',
+        accept: '#onetrust-accept-btn-handler',
+        reject: '#onetrust-reject-all-handler',
+    },
+    {
+        name: 'Usercentrics',
+        accept: '[data-testid="uc-accept-all-button"]',
+        reject: '[data-testid="uc-deny-all-button"]',
+    },
+    {
+        name: 'Borlabs Cookie',
+        accept: '#BorlabsCookieBox [data-cookie-accept-all]',
+        reject: '#BorlabsCookieBox [data-cookie-refuse]',
+    },
+    {
+        name: 'Complianz',
+        accept: '.cmplz-cookiebanner .cmplz-accept',
+        reject: '.cmplz-cookiebanner .cmplz-deny',
+    },
+    { name: 'CookieYes', accept: '.cky-btn-accept', reject: '.cky-btn-reject' },
+    {
+        name: 'Didomi',
+        accept: '#didomi-notice-agree-button',
+        reject: '#didomi-notice-disagree-button',
+    },
+    { name: 'consentmanager', accept: '.cmpboxbtnyes', reject: '.cmpboxbtnno' },
+    { name: 'iubenda', accept: '.iubenda-cs-accept-btn', reject: '.iubenda-cs-reject-btn' },
+    { name: 'Klaro', accept: '.klaro .cm-btn-success', reject: '.klaro .cm-btn-decline' },
+    {
+        name: 'CookieConsent',
+        accept: '#cc-main [data-role="all"]',
+        reject: '#cc-main [data-role="necessary"]',
+    },
+];
+// Unanchored on purpose: "Alle Cookies akzeptieren" and "Accept all cookies" must both match.
+// Labels that also match REJECT_LABEL ("Nur notwendige akzeptieren") are never treated as accept.
+const ACCEPT_LABEL = /akzeptieren|annehmen|zustimmen|einwilligen|einverstanden|alles? (cookies )?(zulassen|erlauben)|\baccept|\ballow all|\bagree\b|accepter|aceptar|accetta|accepteren|alles toestaan/i;
+const REJECT_LABEL = /ablehnen|verweigern|nur (technisch )?(notwendige|essenzielle|erforderliche)|\breject|\bdecline|\bdeny\b|\brefuse|(only|use) (strictly )?(necessary|essential|required)|refuser|continuer sans accepter|rechazar|rifiuta|weigeren|alleen noodzakelijke/i;
+/** Second option on "pay or OK" banners: accept tracking or take out a subscription. */
+const SUBSCRIBE = /abonn|\babo\b|subscri|werbefrei|ohne werbung|ad-free|without ads|\bpur\b/i;
+/** A frame without any of these words is not showing a consent banner. */
+const CONSENT_CONTEXT = /cookie|consent|einwillig|tracking|datenschutz|privacy/i;
+const CLICKABLE = 'button, [role="button"], a, input[type="button"], input[type="submit"]';
+/**
+ * Looks for a consent banner, clicks its reject button if there is one,
+ * reloads the page and records what still gets loaded. The page must already
+ * be loaded; `requests` is the live array the page's request listener writes to.
+ */
+export async function observeConsent(page, context, requests, options) {
+    const banner = await findBanner(page);
+    if (banner === undefined) {
+        return { bannerFound: false, rejected: false };
+    }
+    const observation = {
+        bannerFound: true,
+        rejected: false,
+        ...(banner.cmp === undefined ? {} : { cmp: banner.cmp }),
+        ...(banner.acceptLabel === undefined ? {} : { acceptLabel: banner.acceptLabel }),
+        ...(banner.rejectLabel === undefined ? {} : { rejectLabel: banner.rejectLabel }),
+        ...(banner.payOrOk ? { payOrOk: true } : {}),
+    };
+    if (banner.reject === undefined) {
+        return observation;
+    }
+    try {
+        const cookiesBefore = new Set((await context.cookies()).map(cookieKey));
+        const firstRequest = requests.length;
+        await banner.reject.click({ timeout: 5_000 });
+        await settle(page, options);
+        await page.reload({ waitUntil: 'load', timeout: options.timeoutMs });
+        await settle(page, options);
+        const cookies = (await context.cookies())
+            .filter((cookie) => !cookiesBefore.has(cookieKey(cookie)))
+            .map(({ name, domain, path, expires }) => ({ name, domain, path, expires }));
+        return {
+            ...observation,
+            rejected: true,
+            afterReject: { requests: requests.slice(firstRequest), cookies },
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { ...observation, error: message.split('\n')[0] ?? message };
+    }
+}
+async function findBanner(page) {
+    for (const cmp of KNOWN_CMPS) {
+        const accept = await firstVisible(page.locator(cmp.accept));
+        if (accept !== undefined) {
+            const reject = await firstVisible(page.locator(cmp.reject));
+            return describe(accept, reject, cmp.name);
+        }
+    }
+    // Unknown or self-built banners: go by button labels, in every frame.
+    for (const frame of page.frames()) {
+        const text = await frame
+            .locator('body')
+            .innerText({ timeout: 2_000 })
+            .catch(() => '');
+        if (!CONSENT_CONTEXT.test(text)) {
+            continue;
+        }
+        const clickable = frame.locator(CLICKABLE);
+        const accept = await firstVisible(clickable.filter({ hasText: ACCEPT_LABEL }).filter({ hasNotText: REJECT_LABEL }));
+        if (accept !== undefined) {
+            const reject = await firstVisible(clickable.filter({ hasText: REJECT_LABEL }));
+            return describe(accept, reject);
+        }
+    }
+    return undefined;
+}
+async function describe(accept, reject, cmp) {
+    const banner = { acceptLabel: await label(accept) };
+    if (reject === undefined && (await offersSubscription(accept))) {
+        banner.payOrOk = true;
+    }
+    if (cmp !== undefined) {
+        banner.cmp = cmp;
+    }
+    if (reject !== undefined) {
+        banner.reject = reject;
+        banner.rejectLabel = await label(reject);
+    }
+    return banner;
+}
+/**
+ * Walks up from the accept button to the banner's outermost container below
+ * <body> and looks for a subscription offer among its buttons and links. The
+ * site's own navigation lives outside that container, so its "Abo" link
+ * doesn't count.
+ */
+async function offersSubscription(accept) {
+    return accept
+        .evaluate((element, source) => {
+        const pattern = new RegExp(source, 'i');
+        const parentOf = (node) => {
+            const root = node.getRootNode();
+            return node.parentElement ?? (root instanceof ShadowRoot ? root.host : null);
+        };
+        let container = element;
+        for (let parent = parentOf(container); parent !== null; parent = parentOf(container)) {
+            if (parent === document.body || parent === document.documentElement) {
+                break;
+            }
+            container = parent;
+        }
+        return [...container.querySelectorAll('a, button, [role="button"]')].some((control) => pattern.test(control.innerText ?? ''));
+    }, SUBSCRIBE.source)
+        .catch(() => false);
+}
+async function firstVisible(locator) {
+    const count = await locator.count().catch(() => 0);
+    for (let i = 0; i < Math.min(count, 10); i++) {
+        const candidate = locator.nth(i);
+        if (await candidate.isVisible().catch(() => false)) {
+            return candidate;
+        }
+    }
+    return undefined;
+}
+async function label(locator) {
+    const text = await locator.innerText({ timeout: 1_000 }).catch(() => '');
+    const value = text.trim() || ((await locator.getAttribute('value').catch(() => null)) ?? '');
+    return value.replace(/\s+/g, ' ').trim().slice(0, 80);
+}
+async function settle(page, options) {
+    await page.waitForLoadState('networkidle', { timeout: options.timeoutMs }).catch(() => {
+        // See capturePage: some pages never go idle.
+    });
+    await page.waitForTimeout(options.settleMs);
+}
+const cookieKey = (cookie) => `${cookie.name}|${cookie.domain}|${cookie.path}`;
+//# sourceMappingURL=consent.js.map

package/dist/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../src/consent.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,MAAM,UAAU,GAA4B;IAC1C;QACE,IAAI,EAAE,WAAW;QACjB,MAAM,EACJ,+FAA+F;QACjG,MAAM,EAAE,wCAAwC;KACjD;IACD;QACE,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,8BAA8B;QACtC,MAAM,EAAE,8BAA8B;KACvC;IACD;QACE,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,sCAAsC;QAC9C,MAAM,EAAE,oCAAoC;KAC7C;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,4CAA4C;QACpD,MAAM,EAAE,wCAAwC;KACjD;IACD;QACE,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,mCAAmC;QAC3C,MAAM,EAAE,iCAAiC;KAC1C;IACD,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,EAAE;IAC3E;QACE,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,gCAAgC;KACzC;IACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE;IAC3E,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,wBAAwB,EAAE;IACvF,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,wBAAwB,EAAE;IACrF;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,4BAA4B;QACpC,MAAM,EAAE,kCAAkC;KAC3C;CACF,CAAC;AAEF,8FAA8F;AAC9F,kGAAkG;AAClG,MAAM,YAAY,GAChB,mLAAmL,CAAC;AAEtL,MAAM,YAAY,GAChB,wPAAwP,CAAC;AAE3P,wFAAwF;AACxF,MAAM,SAAS,GAAG,2EAA2E,CAAC;AAE9F,0EAA0E;AAC1E,MAAM,eAAe,GAAG,wDAAwD,CAAC;AAEjF,MAAM,SAAS,GAAG,wEAAwE,CAAC;AAO3F;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAU,EACV,OAAuB,EACvB,QAA2B,EAC3B,OAA4B;IAE5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,WAAW,GAAuB;QACtC,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,KAAK;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;QAErC,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE5B,MAAM,OAAO,GAAqB,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;aACxD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;aACzD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE/E,OAAO;YACL,GAAG,WAAW;YACd,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE;SACjE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IACtE,CAAC;AACH,CAAC;AAUD,KAAK,UAAU,UAAU,CAAC,IAAU;IAClC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5D,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,KAAK;aACrB,OAAO,CAAC,MAAM,CAAC;aACf,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;aAC7B,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CACjF,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YAC/E,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAe,EAAE,MAA2B,EAAE,GAAY;IAChF,MAAM,MAAM,GAAW,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAC5D,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,MAAM,CAAC,WAAW,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAAC,MAAe;IAC/C,OAAO,MAAM;SACV,QAAQ,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAkB,EAAE;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,CAAC,CAAC;QACF,IAAI,SAAS,GAAY,OAAO,CAAC;QACjC,KAAK,IAAI,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACrF,IAAI,MAAM,KAAK,QAAQ,CAAC,IAAI,IAAI,MAAM,KAAK,QAAQ,CAAC,eAAe,EAAE,CAAC;gBACpE,MAAM;YACR,CAAC;YACD,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;QACD,OAAO,CAAC,GAAG,SAAS,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACpF,OAAO,CAAC,IAAI,CAAE,OAAuB,CAAC,SAAS,IAAI,EAAE,CAAC,CACvD,CAAC;IACJ,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC;SACnB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAgB;IAC1C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,OAAgB;IACnC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAU,EAAE,OAA4B;IAC5D,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACpF,6CAA6C;IAC/C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,MAAsD,EAAE,EAAE,CAC3E,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC"}

package/dist/data/third-parties.d.ts

@@ -0,0 +1,13 @@
+import { type HostPattern } from '../url.js';
+export interface ThirdParty extends HostPattern {
+    vendor: string;
+}
+/**
+ * Embedded content that transfers the visitor's IP address (and often sets
+ * cookies) as soon as it loads. Trackers are listed separately in trackers.ts.
+ */
+export declare const embeds: readonly ThirdParty[];
+/** Public CDNs for scripts, styles and icon fonts. */
+export declare const cdns: readonly ThirdParty[];
+export declare const findEmbed: (url: string) => ThirdParty | undefined;
+export declare const findCdn: (url: string) => ThirdParty | undefined;

package/dist/data/third-parties.js

@@ -0,0 +1,42 @@
+import { findByUrl } from '../url.js';
+/**
+ * Embedded content that transfers the visitor's IP address (and often sets
+ * cookies) as soon as it loads. Trackers are listed separately in trackers.ts.
+ */
+export const embeds = [
+    { vendor: 'YouTube', domains: ['youtube.com', 'youtube-nocookie.com', 'ytimg.com'] },
+    { vendor: 'Vimeo', domains: ['player.vimeo.com', 'vimeocdn.com'] },
+    {
+        vendor: 'Google Maps',
+        domains: ['maps.googleapis.com', 'maps.gstatic.com', 'maps.google.com'],
+    },
+    { vendor: 'Google Maps', domains: ['google.com'], paths: ['/maps/'] },
+    { vendor: 'Google reCAPTCHA', domains: ['recaptcha.net'] },
+    { vendor: 'Google reCAPTCHA', domains: ['google.com', 'gstatic.com'], paths: ['/recaptcha/'] },
+    { vendor: 'Gravatar', domains: ['gravatar.com'] },
+    { vendor: 'X (Twitter) embed', domains: ['platform.twitter.com', 'syndication.twitter.com'] },
+    { vendor: 'Instagram embed', domains: ['instagram.com', 'cdninstagram.com'] },
+    { vendor: 'Facebook plugin', domains: ['facebook.com'], paths: ['/plugins/'] },
+    { vendor: 'Spotify embed', domains: ['open.spotify.com'], paths: ['/embed/'] },
+    { vendor: 'Disqus', domains: ['disqus.com', 'disquscdn.com'] },
+];
+/** Public CDNs for scripts, styles and icon fonts. */
+export const cdns = [
+    { vendor: 'jsDelivr', domains: ['cdn.jsdelivr.net'] },
+    { vendor: 'unpkg', domains: ['unpkg.com'] },
+    { vendor: 'cdnjs', domains: ['cdnjs.cloudflare.com'] },
+    { vendor: 'Google Hosted Libraries', domains: ['ajax.googleapis.com'] },
+    { vendor: 'jQuery CDN', domains: ['code.jquery.com'] },
+    {
+        vendor: 'BootstrapCDN',
+        domains: ['stackpath.bootstrapcdn.com', 'maxcdn.bootstrapcdn.com'],
+    },
+    { vendor: 'Tailwind Play CDN', domains: ['cdn.tailwindcss.com'] },
+    {
+        vendor: 'Font Awesome CDN',
+        domains: ['use.fontawesome.com', 'kit.fontawesome.com', 'ka-f.fontawesome.com'],
+    },
+];
+export const findEmbed = (url) => findByUrl(embeds, url);
+export const findCdn = (url) => findByUrl(cdns, url);
+//# sourceMappingURL=third-parties.js.map

package/dist/data/third-parties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"third-parties.js","sourceRoot":"","sources":["../../src/data/third-parties.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAoB,MAAM,WAAW,CAAC;AAMxD;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAA0B;IAC3C,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,aAAa,EAAE,sBAAsB,EAAE,WAAW,CAAC,EAAE;IACpF,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAAE;IAClE;QACE,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,CAAC,qBAAqB,EAAE,kBAAkB,EAAE,iBAAiB,CAAC;KACxE;IACD,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;IACrE,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE;IAC1D,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE;IAC9F,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE;IACjD,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,EAAE;IAC7F,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,kBAAkB,CAAC,EAAE;IAC7E,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;IAC9E,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;IAC9E,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,eAAe,CAAC,EAAE;CAC/D,CAAC;AAEF,sDAAsD;AACtD,MAAM,CAAC,MAAM,IAAI,GAA0B;IACzC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE;IACrD,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;IAC3C,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE;IACtD,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,CAAC,qBAAqB,CAAC,EAAE;IACvE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE;IACtD;QACE,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,CAAC,4BAA4B,EAAE,yBAAyB,CAAC;KACnE;IACD,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,qBAAqB,CAAC,EAAE;IACjE;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,sBAAsB,CAAC;KAChF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC"}

package/dist/data/trackers.d.ts

@@ -0,0 +1,21 @@
+import { type HostPattern } from '../url.js';
+export type TrackerCategory = 'analytics' | 'advertising' | 'session-replay' | 'social' | 'marketing-automation' | 'tag-manager';
+export interface Tracker extends HostPattern {
+    vendor: string;
+    category: TrackerCategory;
+    /**
+     * Cookies the vendor's script sets, including on the first-party domain.
+     * Strings are name prefixes; use a RegExp where a prefix would be too broad.
+     */
+    cookies?: Array<string | RegExp>;
+}
+/**
+ * Hand-maintained and MIT licensed, so it can ship with the package.
+ * Order matters: the first entry that matches wins, so put path-specific
+ * entries before broader ones on the same domain.
+ *
+ * Adding a vendor? See CONTRIBUTING.md.
+ */
+export declare const trackers: readonly Tracker[];
+export declare function findTrackerByUrl(url: string): Tracker | undefined;
+export declare function findTrackerByCookie(name: string): Tracker | undefined;

package/dist/data/trackers.js

@@ -0,0 +1,135 @@
+import { findByUrl } from '../url.js';
+/**
+ * Hand-maintained and MIT licensed, so it can ship with the package.
+ * Order matters: the first entry that matches wins, so put path-specific
+ * entries before broader ones on the same domain.
+ *
+ * Adding a vendor? See CONTRIBUTING.md.
+ */
+export const trackers = [
+    {
+        vendor: 'Google Analytics',
+        category: 'analytics',
+        domains: ['google-analytics.com', 'analytics.google.com'],
+        cookies: ['_ga', '_gid', '_gat'],
+    },
+    {
+        vendor: 'Google Analytics',
+        category: 'analytics',
+        domains: ['googletagmanager.com'],
+        paths: ['/gtag/'],
+    },
+    {
+        vendor: 'Google Tag Manager',
+        category: 'tag-manager',
+        domains: ['googletagmanager.com'],
+    },
+    {
+        vendor: 'Google Ads',
+        category: 'advertising',
+        domains: ['googleadservices.com', 'doubleclick.net', 'googlesyndication.com'],
+        cookies: ['_gcl_'],
+    },
+    {
+        vendor: 'Meta Pixel',
+        category: 'advertising',
+        domains: ['connect.facebook.net'],
+        cookies: ['_fbp', '_fbc'],
+    },
+    {
+        vendor: 'Meta Pixel',
+        category: 'advertising',
+        domains: ['facebook.com'],
+        paths: ['/tr'],
+    },
+    {
+        vendor: 'Hotjar',
+        category: 'session-replay',
+        domains: ['hotjar.com', 'hotjar.io'],
+        cookies: ['_hj'],
+    },
+    {
+        vendor: 'Microsoft Clarity',
+        category: 'session-replay',
+        domains: ['clarity.ms'],
+        cookies: ['_clck', '_clsk'],
+    },
+    {
+        vendor: 'Microsoft Advertising',
+        category: 'advertising',
+        domains: ['bat.bing.com'],
+        cookies: ['_uetsid', '_uetvid'],
+    },
+    {
+        vendor: 'LinkedIn Insight',
+        category: 'advertising',
+        domains: ['snap.licdn.com', 'px.ads.linkedin.com'],
+        cookies: ['li_fat_id'],
+    },
+    {
+        vendor: 'TikTok Pixel',
+        category: 'advertising',
+        domains: ['analytics.tiktok.com'],
+        cookies: ['_ttp'],
+    },
+    {
+        vendor: 'X (Twitter) Pixel',
+        category: 'advertising',
+        domains: ['static.ads-twitter.com', 'analytics.twitter.com'],
+    },
+    {
+        vendor: 'Pinterest Tag',
+        category: 'advertising',
+        domains: ['ct.pinterest.com'],
+        cookies: ['_pin_unauth'],
+    },
+    {
+        vendor: 'Snap Pixel',
+        category: 'advertising',
+        domains: ['sc-static.net', 'tr.snapchat.com'],
+        cookies: ['_scid'],
+    },
+    {
+        vendor: 'Yandex Metrica',
+        category: 'analytics',
+        domains: ['mc.yandex.ru', 'mc.yandex.com'],
+        cookies: ['_ym_'],
+    },
+    {
+        vendor: 'HubSpot',
+        category: 'marketing-automation',
+        domains: ['js.hs-scripts.com', 'js.hs-analytics.net', 'track.hubspot.com'],
+        cookies: ['__hstc', 'hubspotutk'],
+    },
+    {
+        vendor: 'Segment',
+        category: 'analytics',
+        domains: ['cdn.segment.com', 'api.segment.io'],
+        cookies: ['ajs_'],
+    },
+    {
+        vendor: 'Mixpanel',
+        category: 'analytics',
+        domains: ['cdn.mxpnl.com', 'api-js.mixpanel.com'],
+        cookies: [/^mp_\w+_mixpanel$/],
+    },
+    {
+        vendor: 'Amplitude',
+        category: 'analytics',
+        domains: ['cdn.amplitude.com', 'api2.amplitude.com'],
+        cookies: ['AMP_'],
+    },
+    {
+        vendor: 'Matomo',
+        category: 'analytics',
+        domains: ['matomo.cloud'],
+        cookies: ['_pk_'],
+    },
+];
+export function findTrackerByUrl(url) {
+    return findByUrl(trackers, url);
+}
+export function findTrackerByCookie(name) {
+    return trackers.find((tracker) => tracker.cookies?.some((pattern) => typeof pattern === 'string' ? name.startsWith(pattern) : pattern.test(name)));
+}
+//# sourceMappingURL=trackers.js.map

package/dist/data/trackers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trackers.js","sourceRoot":"","sources":["../../src/data/trackers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAoB,MAAM,WAAW,CAAC;AAoBxD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAuB;IAC1C;QACE,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;QACzD,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC;KACjC;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,CAAC,sBAAsB,CAAC;QACjC,KAAK,EAAE,CAAC,QAAQ,CAAC;KAClB;IACD;QACE,MAAM,EAAE,oBAAoB;QAC5B,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,CAAC,sBAAsB,CAAC;KAClC;IACD;QACE,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,uBAAuB,CAAC;QAC7E,OAAO,EAAE,CAAC,OAAO,CAAC;KACnB;IACD;QACE,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,CAAC,sBAAsB,CAAC;QACjC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;KAC1B;IACD;QACE,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,CAAC,cAAc,CAAC;QACzB,KAAK,EAAE,CAAC,KAAK,CAAC;KACf;IACD;QACE,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,gBAAgB;QAC1B,OAAO,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;QACpC,OAAO,EAAE,CAAC,KAAK,CAAC;KACjB;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,gBAAgB;QAC1B,OAAO,EAAE,CAAC,YAAY,CAAC;QACvB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;KAC5B;IACD;QACE,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,CAAC,cAAc,CAAC;QACzB,OAAO,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;KAChC;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;QAClD,OAAO,EAAE,CAAC,WAAW,CAAC;KACvB;IACD;QACE,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,CAAC,sBAAsB,CAAC;QACjC,OAAO,EAAE,CAAC,MAAM,CAAC;KAClB;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,CAAC,wBAAwB,EAAE,uBAAuB,CAAC;KAC7D;IACD;QACE,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,CAAC,kBAAkB,CAAC;QAC7B,OAAO,EAAE,CAAC,aAAa,CAAC;KACzB;IACD;QACE,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC7C,OAAO,EAAE,CAAC,OAAO,CAAC;KACnB;IACD;QACE,MAAM,EAAE,gBAAgB;QACxB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;QAC1C,OAAO,EAAE,CAAC,MAAM,CAAC;KAClB;IACD;QACE,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,sBAAsB;QAChC,OAAO,EAAE,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,mBAAmB,CAAC;QAC1E,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;KAClC;IACD;QACE,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;QAC9C,OAAO,EAAE,CAAC,MAAM,CAAC;KAClB;IACD;QACE,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,CAAC,eAAe,EAAE,qBAAqB,CAAC;QACjD,OAAO,EAAE,CAAC,mBAAmB,CAAC;KAC/B;IACD;QACE,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;QACpD,OAAO,EAAE,CAAC,MAAM,CAAC;KAClB;IACD;QACE,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,CAAC,cAAc,CAAC;QACzB,OAAO,EAAE,CAAC,MAAM,CAAC;KAClB;CACF,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC/B,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAChC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5E,CACF,CAAC;AACJ,CAAC"}

package/dist/i18n.d.ts

@@ -0,0 +1,5 @@
+export declare const LANGS: readonly ['en', 'de'];
+export type Lang = (typeof LANGS)[number];
+/** One string per language. Adding a language makes every missing translation a type error. */
+export type Text = Record<Lang, string>;
+export declare const say: (lang: Lang, text: Text) => string;

package/dist/i18n.js

@@ -0,0 +1,3 @@
+export const LANGS = ['en', 'de'];
+export const say = (lang, text) => text[lang];
+//# sourceMappingURL=i18n.js.map

package/dist/i18n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,IAAI,CAAU,CAAC;AAM3C,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAU,EAAE,IAAU,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { type Tracker, type TrackerCategory, trackers } from './data/trackers.js';
+export { LANGS, type Lang, type Text } from './i18n.js';
+export { legalReferences, REGIONS, type Region } from './legal.js';
+export { defaultRules, googleFonts, impressumLink, preConsentTrackers, privacyPolicyLink, rejectOption, thirdPartyCdns, thirdPartyEmbeds, trackersAfterReject, } from './rules/index.js';
+export { type ScanOptions, scan } from './scanner.js';
+export type * from './types.js';

package/dist/index.js

@@ -0,0 +1,6 @@
+export { trackers } from './data/trackers.js';
+export { LANGS } from './i18n.js';
+export { legalReferences, REGIONS } from './legal.js';
+export { defaultRules, googleFonts, impressumLink, preConsentTrackers, privacyPolicyLink, rejectOption, thirdPartyCdns, thirdPartyEmbeds, trackersAfterReject, } from './rules/index.js';
+export { scan } from './scanner.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,KAAK,EAAwB,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,OAAO,EAAe,MAAM,YAAY,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAoB,IAAI,EAAE,MAAM,cAAc,CAAC"}

package/dist/legal.d.ts

@@ -0,0 +1,10 @@
+import type { Finding } from './types.js';
+export declare const REGIONS: readonly ['de', 'at', 'ch', 'eu'];
+export type Region = (typeof REGIONS)[number];
+export declare const legalReferences: (ruleId: string, region: Region) => string[] | undefined;
+/**
+ * Attaches the legal basis of the chosen country to each finding and adjusts
+ * its severity where that country's law is softer or stricter. Findings of
+ * custom rules without an entry above are left as they are.
+ */
+export declare function applyRegion(findings: readonly Finding[], region: Region): Finding[];

package/dist/legal.js

@@ -0,0 +1,99 @@
+export const REGIONS = ['de', 'at', 'ch', 'eu'];
+/**
+ * Legal basis per rule and country, cited the way lawyers in that country
+ * would cite it. `eu` is for sites outside Germany, Austria and Switzerland
+ * and refers to the EU instruments directly.
+ */
+const LEGAL = {
+    'pre-consent-trackers': {
+        de: ['§ 25 Abs. 1 TDDDG', 'Art. 6 Abs. 1 lit. a DSGVO', 'EuGH C-673/17 (Planet49)'],
+        at: ['§ 165 Abs. 3 TKG 2021', 'Art. 6 Abs. 1 lit. a DSGVO', 'EuGH C-673/17 (Planet49)'],
+        ch: ['Art. 45c FMG', 'Art. 6 DSG'],
+        eu: ['Art. 5(3) ePrivacy Directive', 'Art. 6(1)(a) GDPR', 'CJEU C-673/17 (Planet49)'],
+    },
+    'trackers-after-reject': {
+        de: ['§ 25 Abs. 1 TDDDG', 'Art. 7 Abs. 3 DSGVO'],
+        at: ['§ 165 Abs. 3 TKG 2021', 'Art. 7 Abs. 3 DSGVO'],
+        ch: ['Art. 45c FMG', 'Art. 30 Abs. 2 lit. b DSG'],
+        eu: ['Art. 5(3) ePrivacy Directive', 'Art. 7(3) GDPR'],
+    },
+    'reject-option': {
+        de: [
+            '§ 25 Abs. 1 TDDDG',
+            'Art. 4 Nr. 11 DSGVO',
+            'EDSA Cookie-Banner-Taskforce, 17.01.2023',
+            'DSK-Beschluss, 22.03.2023 (Pur-Abo-Modelle)',
+        ],
+        at: [
+            '§ 165 Abs. 3 TKG 2021',
+            'Art. 4 Nr. 11 DSGVO',
+            'EDSA Cookie-Banner-Taskforce, 17.01.2023',
+        ],
+        ch: ['Art. 45c FMG', 'EDÖB, Leitfaden zu Cookies (2025)'],
+        eu: ['Art. 4(11) GDPR', 'Art. 7(3) GDPR', 'EDPB Cookie Banner Taskforce report, 17.01.2023'],
+    },
+    'google-fonts': {
+        de: ['Art. 6 Abs. 1 DSGVO', 'LG München I, 20.01.2022, Az. 3 O 17493/20'],
+        at: ['Art. 6 Abs. 1 DSGVO'],
+        ch: ['Art. 6 DSG'],
+        eu: ['Art. 6(1) GDPR'],
+    },
+    'third-party-embeds': {
+        de: ['Art. 6 Abs. 1 DSGVO', '§ 25 Abs. 1 TDDDG'],
+        at: ['Art. 6 Abs. 1 DSGVO', '§ 165 Abs. 3 TKG 2021'],
+        ch: ['Art. 6 DSG', 'Art. 45c FMG'],
+        eu: ['Art. 6(1) GDPR', 'Art. 5(3) ePrivacy Directive'],
+    },
+    'third-party-cdns': {
+        de: ['Art. 6 Abs. 1 DSGVO'],
+        at: ['Art. 6 Abs. 1 DSGVO'],
+        ch: ['Art. 6 DSG'],
+        eu: ['Art. 6(1) GDPR'],
+    },
+    'impressum-link': {
+        de: ['§ 5 DDG', 'BGH, 20.07.2006, Az. I ZR 228/03'],
+        at: ['§ 5 ECG', '§ 25 MedienG'],
+        ch: ['Art. 3 Abs. 1 lit. s UWG'],
+        eu: ['Art. 5 Directive 2000/31/EC (e-commerce)'],
+    },
+    'privacy-policy-link': {
+        de: ['Art. 12 DSGVO', 'Art. 13 DSGVO'],
+        at: ['Art. 12 DSGVO', 'Art. 13 DSGVO'],
+        ch: ['Art. 19 DSG'],
+        eu: ['Art. 12 GDPR', 'Art. 13 GDPR'],
+    },
+};
+export const legalReferences = (ruleId, region) => LEGAL[ruleId]?.[region];
+/**
+ * Attaches the legal basis of the chosen country to each finding and adjusts
+ * its severity where that country's law is softer or stricter. Findings of
+ * custom rules without an entry above are left as they are.
+ */
+export function applyRegion(findings, region) {
+    return findings.map((finding) => {
+        const references = legalReferences(finding.ruleId, region);
+        return {
+            ...finding,
+            severity: severityFor(finding, region),
+            ...(references === undefined ? {} : { references }),
+        };
+    });
+}
+/**
+ * Switzerland uses an opt-out model for cookies and tracking (Art. 45c FMG) and
+ * requires an imprint only for offers in electronic commerce, so those findings
+ * drop one level there. Ignoring an explicit refusal stays as serious as anywhere.
+ */
+const SOFTER_IN_SWITZERLAND = new Set([
+    'pre-consent-trackers',
+    'third-party-embeds',
+    'impressum-link',
+]);
+function severityFor(finding, region) {
+    if (region === 'ch' && SOFTER_IN_SWITZERLAND.has(finding.ruleId)) {
+        return lower(finding.severity);
+    }
+    return finding.severity;
+}
+const lower = (severity) => (severity === 'error' ? 'warning' : 'info');
+//# sourceMappingURL=legal.js.map

package/dist/legal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal.js","sourceRoot":"","sources":["../src/legal.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC;AAGzD;;;;GAIG;AACH,MAAM,KAAK,GAA6C;IACtD,sBAAsB,EAAE;QACtB,EAAE,EAAE,CAAC,mBAAmB,EAAE,4BAA4B,EAAE,0BAA0B,CAAC;QACnF,EAAE,EAAE,CAAC,uBAAuB,EAAE,4BAA4B,EAAE,0BAA0B,CAAC;QACvF,EAAE,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC;QAClC,EAAE,EAAE,CAAC,8BAA8B,EAAE,mBAAmB,EAAE,0BAA0B,CAAC;KACtF;IACD,uBAAuB,EAAE;QACvB,EAAE,EAAE,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QAChD,EAAE,EAAE,CAAC,uBAAuB,EAAE,qBAAqB,CAAC;QACpD,EAAE,EAAE,CAAC,cAAc,EAAE,2BAA2B,CAAC;QACjD,EAAE,EAAE,CAAC,8BAA8B,EAAE,gBAAgB,CAAC;KACvD;IACD,eAAe,EAAE;QACf,EAAE,EAAE;YACF,mBAAmB;YACnB,qBAAqB;YACrB,0CAA0C;YAC1C,6CAA6C;SAC9C;QACD,EAAE,EAAE;YACF,uBAAuB;YACvB,qBAAqB;YACrB,0CAA0C;SAC3C;QACD,EAAE,EAAE,CAAC,cAAc,EAAE,mCAAmC,CAAC;QACzD,EAAE,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,iDAAiD,CAAC;KAC7F;IACD,cAAc,EAAE;QACd,EAAE,EAAE,CAAC,qBAAqB,EAAE,4CAA4C,CAAC;QACzE,EAAE,EAAE,CAAC,qBAAqB,CAAC;QAC3B,EAAE,EAAE,CAAC,YAAY,CAAC;QAClB,EAAE,EAAE,CAAC,gBAAgB,CAAC;KACvB;IACD,oBAAoB,EAAE;QACpB,EAAE,EAAE,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;QAChD,EAAE,EAAE,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;QACpD,EAAE,EAAE,CAAC,YAAY,EAAE,cAAc,CAAC;QAClC,EAAE,EAAE,CAAC,gBAAgB,EAAE,8BAA8B,CAAC;KACvD;IACD,kBAAkB,EAAE;QAClB,EAAE,EAAE,CAAC,qBAAqB,CAAC;QAC3B,EAAE,EAAE,CAAC,qBAAqB,CAAC;QAC3B,EAAE,EAAE,CAAC,YAAY,CAAC;QAClB,EAAE,EAAE,CAAC,gBAAgB,CAAC;KACvB;IACD,gBAAgB,EAAE;QAChB,EAAE,EAAE,CAAC,SAAS,EAAE,kCAAkC,CAAC;QACnD,EAAE,EAAE,CAAC,SAAS,EAAE,cAAc,CAAC;QAC/B,EAAE,EAAE,CAAC,0BAA0B,CAAC;QAChC,EAAE,EAAE,CAAC,0CAA0C,CAAC;KACjD;IACD,qBAAqB,EAAE;QACrB,EAAE,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;QACtC,EAAE,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;QACtC,EAAE,EAAE,CAAC,aAAa,CAAC;QACnB,EAAE,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;KACrC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,MAAc,EAAwB,EAAE,CACtF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;AAE1B;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,QAA4B,EAAE,MAAc;IACtE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO;YACL,GAAG,OAAO;YACV,QAAQ,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,sBAAsB;IACtB,oBAAoB;IACpB,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,OAAgB,EAAE,MAAc;IACnD,IAAI,MAAM,KAAK,IAAI,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,QAAkB,EAAY,EAAE,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/meta.d.ts

@@ -0,0 +1,3 @@
+export declare const VERSION: string;
+export declare const REPOSITORY_URL = "https://github.com/jexcellence/privalint";
+export declare const ruleDocsUrl: (ruleId: string) => string;

package/dist/meta.js

@@ -0,0 +1,6 @@
+import { readFileSync } from 'node:fs';
+const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+export const VERSION = pkg.version;
+export const REPOSITORY_URL = 'https://github.com/jexcellence/privalint';
+export const ruleDocsUrl = (ruleId) => `${REPOSITORY_URL}/blob/main/docs/rules/${ruleId}.md`;
+//# sourceMappingURL=meta.js.map

package/dist/meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.js","sourceRoot":"","sources":["../src/meta.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAEvF,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,0CAA0C,CAAC;AAEzE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,EAAE,CAC5C,GAAG,cAAc,yBAAyB,MAAM,KAAK,CAAC"}

package/dist/reporters/index.d.ts

@@ -0,0 +1,11 @@
+import type { ScanResult } from '../types.js';
+import { formatJson } from './json.js';
+import { formatMarkdown } from './markdown.js';
+import { formatSarif } from './sarif.js';
+import { formatText } from './text.js';
+export declare const FORMATS: readonly ['text', 'json', 'markdown', 'sarif'];
+export type Format = (typeof FORMATS)[number];
+export declare function format(result: ScanResult, kind: Format, options?: {
+    color?: boolean;
+}): string;
+export { formatJson, formatMarkdown, formatSarif, formatText };

package/dist/reporters/index.js

@@ -0,0 +1,19 @@
+import { formatJson } from './json.js';
+import { formatMarkdown } from './markdown.js';
+import { formatSarif } from './sarif.js';
+import { formatText } from './text.js';
+export const FORMATS = ['text', 'json', 'markdown', 'sarif'];
+export function format(result, kind, options = {}) {
+    switch (kind) {
+        case 'json':
+            return formatJson(result);
+        case 'markdown':
+            return formatMarkdown(result);
+        case 'sarif':
+            return formatSarif(result);
+        default:
+            return formatText(result, options.color);
+    }
+}
+export { formatJson, formatMarkdown, formatSarif, formatText };
+//# sourceMappingURL=index.js.map

package/dist/reporters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/reporters/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAU,CAAC;AAGtE,MAAM,UAAU,MAAM,CAAC,MAAkB,EAAE,IAAY,EAAE,OAAO,GAAwB,EAAE;IACxF,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,KAAK,UAAU;YACb,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;QAChC,KAAK,OAAO;YACV,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7B;YACE,OAAO,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC"}

package/dist/reporters/json.d.ts

@@ -0,0 +1,2 @@
+import type { ScanResult } from '../types.js';
+export declare const formatJson: (result: ScanResult) => string;

package/dist/reporters/json.js

@@ -0,0 +1,2 @@
+export const formatJson = (result) => `${JSON.stringify(result, null, 2)}\n`;
+//# sourceMappingURL=json.js.map