privalint 0.0.0-stage → 0.2.0

package/dist/reporters/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../src/reporters/json.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAkB,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC"}

package/dist/reporters/markdown.d.ts

@@ -0,0 +1,9 @@
+import type { ScanResult } from '../types.js';
+/**
+ * Compact report for GitHub job summaries and PR comments.
+ *
+ * Page URLs come from the scanned site and may contain Markdown such as
+ * `![x](https://evil.example)` in their query string, so they are only ever
+ * rendered inside code spans.
+ */
+export declare function formatMarkdown(result: ScanResult): string;

package/dist/reporters/markdown.js

@@ -0,0 +1,49 @@
+import { messagesFor } from './messages.js';
+import { countBySeverity, groupByPage } from './shared.js';
+const ICONS = { error: '🔴', warning: '🟡', info: '🔵' };
+/**
+ * Compact report for GitHub job summaries and PR comments.
+ *
+ * Page URLs come from the scanned site and may contain Markdown such as
+ * `![x](https://evil.example)` in their query string, so they are only ever
+ * rendered inside code spans.
+ */
+export function formatMarkdown(result) {
+    const m = messagesFor(result.lang);
+    const counts = countBySeverity(result.findings);
+    const lines = [
+        `### privalint: ${code(result.siteUrl)}`,
+        '',
+        `${m.errors(counts.error)} · ${m.warnings(counts.warning)} · ${m.scanned(m.pages(result.pages.length))}`,
+    ];
+    if (result.consent !== undefined) {
+        lines.push('', escapeText(m.consent(result.consent)));
+    }
+    for (const [pageUrl, findings] of groupByPage(result.findings)) {
+        lines.push('', `#### ${code(pageUrl)}`, '', `| | ${m.rule} | ${m.finding} |`, '|---|---|---|');
+        for (const finding of findings) {
+            lines.push(`| ${ICONS[finding.severity]} | \`${finding.ruleId}\` | ${escapeText(finding.message)} |`);
+        }
+    }
+    const failed = result.pages.filter((page) => page.error !== undefined);
+    if (failed.length > 0) {
+        lines.push('', m.couldNotScan(failed.length), '');
+        for (const page of failed) {
+            lines.push(`- ${code(page.url)}: ${escapeText(page.error ?? '')}`);
+        }
+    }
+    const fixes = new Map(result.findings.filter((f) => f.fix !== undefined).map((f) => [f.ruleId, f]));
+    if (fixes.size > 0) {
+        lines.push('', `<details><summary>${m.howToFix}</summary>`, '');
+        for (const [ruleId, { fix, references }] of fixes) {
+            const legal = references?.length ? ` (${m.legalBasis} ${references.join('; ')})` : '';
+            lines.push(`- **${ruleId}**: ${escapeText(`${fix ?? ''}${legal}`)}`);
+        }
+        lines.push('', '</details>');
+    }
+    lines.push('', `<sub>${m.disclaimer}</sub>`);
+    return `${lines.join('\n')}\n`;
+}
+const code = (text) => `\`${text.replaceAll('`', '%60').replaceAll('\n', ' ')}\``;
+const escapeText = (text) => text.replace(/[\\`*_[\]()!<>|#~]/g, '\\$&').replaceAll('\n', ' ');
+//# sourceMappingURL=markdown.js.map

package/dist/reporters/markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.js","sourceRoot":"","sources":["../../src/reporters/markdown.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,KAAK,GAA6B,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG;QACZ,kBAAkB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QACxC,EAAE;QACF,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE;KACzG,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,IAAI,EAAE,eAAe,CAAC,CAAC;QAC/F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CACR,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,OAAO,CAAC,MAAM,QAAQ,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAC7E,CAAC;IACF,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC,QAAQ,YAAY,EAAE,EAAE,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,OAAO,UAAU,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,UAAU,QAAQ,CAAC,CAAC;IAC7C,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;AAE1F,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAClC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC"}

package/dist/reporters/messages.d.ts

@@ -0,0 +1,21 @@
+import type { Lang } from '../i18n.js';
+import type { ConsentSummary } from '../types.js';
+/** Fixed wording of the text and Markdown reports. */
+export interface ReportMessages {
+    errors(count: number): string;
+    warnings(count: number): string;
+    pages(count: number): string;
+    duration(ms: number): string;
+    noProblems(pages: string, duration: string): string;
+    on: string;
+    scanned(pages: string): string;
+    couldNotScan(count: number): string;
+    fix: string;
+    legalBasis: string;
+    rule: string;
+    finding: string;
+    howToFix: string;
+    disclaimer: string;
+    consent(consent: ConsentSummary): string;
+}
+export declare const messagesFor: (lang: Lang) => ReportMessages;

package/dist/reporters/messages.js

@@ -0,0 +1,62 @@
+const count = (n, one, many) => `${n} ${n === 1 ? one : many}`;
+const en = {
+    errors: (n) => count(n, 'error', 'errors'),
+    warnings: (n) => count(n, 'warning', 'warnings'),
+    pages: (n) => count(n, 'page', 'pages'),
+    duration: (ms) => `${(ms / 1000).toFixed(1)}s`,
+    noProblems: (pages, duration) => `No problems found on ${pages} (${duration}).`,
+    on: 'on',
+    scanned: (pages) => `${pages} scanned`,
+    couldNotScan: (n) => `Could not scan ${count(n, 'page', 'pages')}:`,
+    fix: 'fix:',
+    legalBasis: 'legal basis:',
+    rule: 'Rule',
+    finding: 'Finding',
+    howToFix: 'How to fix',
+    disclaimer: 'Automated checks only. A clean result is not proof of GDPR compliance.',
+    consent(consent) {
+        if (!consent.bannerFound) {
+            return 'Consent banner: none found';
+        }
+        const vendor = consent.cmp === undefined ? '' : ` (${consent.cmp})`;
+        if (consent.error !== undefined) {
+            return `Consent banner${vendor}: found, but rejecting failed: ${consent.error}`;
+        }
+        if (consent.rejected) {
+            return `Consent banner${vendor}: clicked "${consent.rejectLabel}" and reloaded`;
+        }
+        return `Consent banner${vendor}: found, no reject button`;
+    },
+};
+const de = {
+    errors: (n) => count(n, 'Fehler', 'Fehler'),
+    warnings: (n) => count(n, 'Warnung', 'Warnungen'),
+    pages: (n) => count(n, 'Seite', 'Seiten'),
+    duration: (ms) => `${(ms / 1000).toFixed(1).replace('.', ',')} s`,
+    noProblems: (pages, duration) => `Keine Probleme auf ${pages} gefunden (${duration}).`,
+    on: 'auf',
+    scanned: (pages) => `${pages} geprüft`,
+    couldNotScan: (n) => `${count(n, 'Seite', 'Seiten')} ${n === 1 ? 'konnte' : 'konnten'} nicht geprüft werden:`,
+    fix: 'Lösung:',
+    legalBasis: 'Rechtsgrundlage:',
+    rule: 'Regel',
+    finding: 'Befund',
+    howToFix: 'So beheben Sie es',
+    disclaimer: 'Nur automatisierte Prüfungen. Ein sauberes Ergebnis ist kein Nachweis der DSGVO-Konformität.',
+    consent(consent) {
+        if (!consent.bannerFound) {
+            return 'Cookie-Banner: keines gefunden';
+        }
+        const vendor = consent.cmp === undefined ? '' : ` (${consent.cmp})`;
+        if (consent.error !== undefined) {
+            return `Cookie-Banner${vendor}: gefunden, aber Ablehnen ist fehlgeschlagen: ${consent.error}`;
+        }
+        if (consent.rejected) {
+            return `Cookie-Banner${vendor}: „${consent.rejectLabel}“ geklickt und neu geladen`;
+        }
+        return `Cookie-Banner${vendor}: gefunden, kein Ablehnen-Button`;
+    },
+};
+const MESSAGES = { en, de };
+export const messagesFor = (lang) => MESSAGES[lang];
+//# sourceMappingURL=messages.js.map

package/dist/reporters/messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../src/reporters/messages.ts"],"names":[],"mappings":"AAsBA,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,GAAW,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAEvF,MAAM,EAAE,GAAmB;IACzB,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC;IACvC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;IAC9C,UAAU,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,wBAAwB,KAAK,KAAK,QAAQ,IAAI;IAC/E,EAAE,EAAE,IAAI;IACR,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU;IACtC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG;IACnE,GAAG,EAAE,MAAM;IACX,UAAU,EAAE,cAAc;IAC1B,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,YAAY;IACtB,UAAU,EAAE,wEAAwE;IACpF,OAAO,CAAC,OAAO;QACb,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,OAAO,4BAA4B,CAAC;QACtC,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,GAAG,GAAG,CAAC;QACpE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,iBAAiB,MAAM,kCAAkC,OAAO,CAAC,KAAK,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO,iBAAiB,MAAM,cAAc,OAAO,CAAC,WAAW,gBAAgB,CAAC;QAClF,CAAC;QACD,OAAO,iBAAiB,MAAM,2BAA2B,CAAC;IAC5D,CAAC;CACF,CAAC;AAEF,MAAM,EAAE,GAAmB;IACzB,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC;IACzC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI;IACjE,UAAU,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,sBAAsB,KAAK,cAAc,QAAQ,IAAI;IACtF,EAAE,EAAE,KAAK;IACT,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU;IACtC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAClB,GAAG,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,wBAAwB;IAC1F,GAAG,EAAE,SAAS;IACd,UAAU,EAAE,kBAAkB;IAC9B,IAAI,EAAE,OAAO;IACb,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,mBAAmB;IAC7B,UAAU,EACR,8FAA8F;IAChG,OAAO,CAAC,OAAO;QACb,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,OAAO,gCAAgC,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,GAAG,GAAG,CAAC;QACpE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,gBAAgB,MAAM,iDAAiD,OAAO,CAAC,KAAK,EAAE,CAAC;QAChG,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO,gBAAgB,MAAM,MAAM,OAAO,CAAC,WAAW,4BAA4B,CAAC;QACrF,CAAC;QACD,OAAO,gBAAgB,MAAM,kCAAkC,CAAC;IAClE,CAAC;CACF,CAAC;AAEF,MAAM,QAAQ,GAAiC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AAE1D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAU,EAAkB,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC"}

package/dist/reporters/sarif.d.ts

@@ -0,0 +1,10 @@
+import type { ScanResult } from '../types.js';
+/**
+ * SARIF 2.1.0 for GitHub code scanning.
+ *
+ * Code scanning expects every result to point at a file in the repository,
+ * which a live website does not have. Each page is mapped to a stable
+ * pseudo path (`privalint/<host>/<path>`) so alerts stay grouped per page
+ * and keep their identity between runs.
+ */
+export declare function formatSarif(result: ScanResult): string;

package/dist/reporters/sarif.js

@@ -0,0 +1,84 @@
+import { createHash } from 'node:crypto';
+import { REPOSITORY_URL, ruleDocsUrl, VERSION } from '../meta.js';
+const LEVELS = {
+    error: 'error',
+    warning: 'warning',
+    info: 'note',
+};
+/**
+ * SARIF 2.1.0 for GitHub code scanning.
+ *
+ * Code scanning expects every result to point at a file in the repository,
+ * which a live website does not have. Each page is mapped to a stable
+ * pseudo path (`privalint/<host>/<path>`) so alerts stay grouped per page
+ * and keep their identity between runs.
+ */
+export function formatSarif(result) {
+    const sarif = {
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        version: '2.1.0',
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'privalint',
+                        semanticVersion: VERSION,
+                        informationUri: REPOSITORY_URL,
+                        rules: result.rules.map((rule) => ({
+                            id: rule.id,
+                            name: rule.id,
+                            shortDescription: { text: rule.title },
+                            fullDescription: { text: rule.description },
+                            help: {
+                                text: `${rule.description}\n\nReferences: ${rule.references.join('; ')}`,
+                                markdown: `${rule.description}\n\n**References:** ${rule.references.join('; ')}`,
+                            },
+                            helpUri: ruleDocsUrl(rule.id),
+                            properties: { tags: ['privacy', 'gdpr'], precision: 'high' },
+                        })),
+                    },
+                },
+                results: result.findings.map(toResult),
+            },
+        ],
+    };
+    return `${JSON.stringify(sarif, null, 2)}\n`;
+}
+function toResult(finding) {
+    const evidence = finding.evidence.map((item) => `- ${item}`).join('\n');
+    return {
+        ruleId: finding.ruleId,
+        level: LEVELS[finding.severity],
+        message: {
+            text: [
+                finding.message,
+                `Page: ${finding.pageUrl}`,
+                evidence,
+                finding.fix,
+                finding.references?.join('; '),
+            ]
+                .filter(Boolean)
+                .join('\n\n'),
+        },
+        locations: [
+            {
+                physicalLocation: {
+                    artifactLocation: { uri: pseudoPath(finding.pageUrl) },
+                    region: { startLine: 1 },
+                },
+            },
+        ],
+        partialFingerprints: {
+            primaryLocationLineHash: createHash('sha256')
+                .update(`${finding.ruleId}\n${finding.pageUrl}\n${finding.subject ?? ''}`)
+                .digest('hex')
+                .slice(0, 32),
+        },
+    };
+}
+function pseudoPath(pageUrl) {
+    const url = new URL(pageUrl);
+    const path = url.pathname.endsWith('/') ? `${url.pathname}index` : url.pathname;
+    return `privalint/${url.host}${path}`.replace(/[^\w./-]/g, '_');
+}
+//# sourceMappingURL=sarif.js.map

package/dist/reporters/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/reporters/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAGlE,MAAM,MAAM,GAAmD;IAC7D,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;CACb,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,MAAkB;IAC5C,MAAM,KAAK,GAAG;QACZ,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,WAAW;wBACjB,eAAe,EAAE,OAAO;wBACxB,cAAc,EAAE,cAAc;wBAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;4BACjC,EAAE,EAAE,IAAI,CAAC,EAAE;4BACX,IAAI,EAAE,IAAI,CAAC,EAAE;4BACb,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;4BACtC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;4BAC3C,IAAI,EAAE;gCACJ,IAAI,EAAE,GAAG,IAAI,CAAC,WAAW,mBAAmB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gCACxE,QAAQ,EAAE,GAAG,IAAI,CAAC,WAAW,uBAAuB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;6BACjF;4BACD,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC7B,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;yBAC7D,CAAC,CAAC;qBACJ;iBACF;gBACD,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;aACvC;SACF;KACF,CAAC;IACF,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgB;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC/B,OAAO,EAAE;YACP,IAAI,EAAE;gBACJ,OAAO,CAAC,OAAO;gBACf,SAAS,OAAO,CAAC,OAAO,EAAE;gBAC1B,QAAQ;gBACR,OAAO,CAAC,GAAG;gBACX,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC;aAC/B;iBACE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,MAAM,CAAC;SAChB;QACD,SAAS,EAAE;YACT;gBACE,gBAAgB,EAAE;oBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;oBACtD,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;iBACzB;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,uBAAuB,EAAE,UAAU,CAAC,QAAQ,CAAC;iBAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;iBACzE,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SAChB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChF,OAAO,aAAa,GAAG,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC"}

package/dist/reporters/shared.d.ts

@@ -0,0 +1,3 @@
+import type { Finding, Severity } from '../types.js';
+export declare function groupByPage(findings: readonly Finding[]): Map<string, Finding[]>;
+export declare function countBySeverity(findings: readonly Finding[]): Record<Severity, number>;

package/dist/reporters/shared.js

@@ -0,0 +1,17 @@
+export function groupByPage(findings) {
+    const pages = new Map();
+    for (const finding of findings) {
+        const list = pages.get(finding.pageUrl) ?? [];
+        list.push(finding);
+        pages.set(finding.pageUrl, list);
+    }
+    return pages;
+}
+export function countBySeverity(findings) {
+    const counts = { error: 0, warning: 0, info: 0 };
+    for (const finding of findings) {
+        counts[finding.severity]++;
+    }
+    return counts;
+}
+//# sourceMappingURL=shared.js.map

package/dist/reporters/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/reporters/shared.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,WAAW,CAAC,QAA4B;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAA4B;IAC1D,MAAM,MAAM,GAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC3E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/reporters/text.d.ts

@@ -0,0 +1,2 @@
+import type { ScanResult } from '../types.js';
+export declare function formatText(result: ScanResult, color?: boolean): string;

package/dist/reporters/text.js

@@ -0,0 +1,56 @@
+import { styleText } from 'node:util';
+import { messagesFor } from './messages.js';
+import { countBySeverity, groupByPage } from './shared.js';
+const MARKS = {
+    error: ['✖', 'red'],
+    warning: ['▲', 'yellow'],
+    info: ['ℹ', 'blue'],
+};
+export function formatText(result, color = false) {
+    const paint = (style, text) => (color ? styleText(style, text) : text);
+    const m = messagesFor(result.lang);
+    const lines = [];
+    for (const [pageUrl, findings] of groupByPage(result.findings)) {
+        lines.push('', paint('underline', pageUrl));
+        for (const finding of findings) {
+            lines.push(...formatFinding(finding, paint, m));
+        }
+    }
+    const failed = result.pages.filter((page) => page.error !== undefined);
+    if (failed.length > 0) {
+        lines.push('', paint('yellow', m.couldNotScan(failed.length)));
+        for (const page of failed) {
+            lines.push(`  ${page.url} ${paint('dim', page.error ?? '')}`);
+        }
+    }
+    const counts = countBySeverity(result.findings);
+    const pages = m.pages(result.pages.length);
+    const duration = m.duration(result.durationMs);
+    lines.push('');
+    if (result.consent !== undefined) {
+        lines.push(paint('dim', m.consent(result.consent)));
+    }
+    if (result.findings.length === 0) {
+        lines.push(paint('green', `✔ ${m.noProblems(pages, duration)}`));
+    }
+    else {
+        lines.push(`${paint('red', m.errors(counts.error))}, ${paint('yellow', m.warnings(counts.warning))} ${m.on} ${pages} (${duration}).`);
+    }
+    lines.push(paint('dim', m.disclaimer));
+    return lines.join('\n');
+}
+function formatFinding(finding, paint, m) {
+    const [mark, style] = MARKS[finding.severity];
+    const lines = [`  ${paint(style, mark)} ${finding.message} ${paint('dim', finding.ruleId)}`];
+    for (const item of finding.evidence) {
+        lines.push(paint('dim', `      ${item}`));
+    }
+    if (finding.fix) {
+        lines.push(`      ${paint('cyan', m.fix)} ${finding.fix}`);
+    }
+    if (finding.references !== undefined && finding.references.length > 0) {
+        lines.push(paint('dim', `      ${m.legalBasis} ${finding.references.join('; ')}`));
+    }
+    return lines;
+}
+//# sourceMappingURL=text.js.map

package/dist/reporters/text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.js","sourceRoot":"","sources":["../../src/reporters/text.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAuB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI3D,MAAM,KAAK,GAAsC;IAC/C,KAAK,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC;IACxB,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,KAAK,GAAG,KAAK;IAC1D,MAAM,KAAK,GAAG,CAAC,KAAY,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/D,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAE/C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,KAAK,KAAK,QAAQ,IAAI,CAC1H,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CACpB,OAAgB,EAChB,KAA6C,EAC7C,CAAiB;IAEjB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7F,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/rules/google-fonts.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from '../types.js';
+export declare const googleFonts: Rule;

package/dist/rules/google-fonts.js

@@ -0,0 +1,68 @@
+import { say } from '../i18n.js';
+import { hostMatches, safeHost } from '../url.js';
+const ID = 'google-fonts';
+const GOOGLE_FONT_HOSTS = ['fonts.googleapis.com', 'fonts.gstatic.com'];
+/** dns-prefetch only resolves the name; these hints open a real connection. */
+const CONNECTING_HINTS = new Set(['preconnect', 'preload', 'prefetch', 'stylesheet']);
+const FIX = {
+    en: 'Self-host the font files. In Next.js, next/font/google downloads fonts at build time and ' +
+        'serves them from your own domain. Elsewhere, install the family from @fontsource or download ' +
+        'it via google-webfonts-helper, then remove every reference to fonts.googleapis.com and ' +
+        'fonts.gstatic.com.',
+    de: 'Die Schriftdateien selbst hosten. In Next.js lädt next/font/google die Schriften beim Build ' +
+        'herunter und liefert sie von der eigenen Domain aus. Sonst die Schrift über @fontsource ' +
+        'installieren oder mit dem google-webfonts-helper herunterladen und danach alle Verweise auf ' +
+        'fonts.googleapis.com und fonts.gstatic.com entfernen.',
+};
+const isGoogleFontUrl = (url) => {
+    const host = safeHost(url);
+    return host !== undefined && GOOGLE_FONT_HOSTS.some((domain) => hostMatches(host, domain));
+};
+export const googleFonts = {
+    id: ID,
+    title: 'Google Fonts loaded from Google servers',
+    description: "Loading fonts from Google's CDN sends every visitor's IP address to Google without " +
+        'consent. LG München I awarded a visitor damages for this in 2022.',
+    references: ['Art. 6(1) GDPR', 'LG München I, 20.01.2022, Az. 3 O 17493/20'],
+    check({ page, lang }) {
+        const requests = page.requests.filter((request) => isGoogleFontUrl(request.url));
+        if (requests.length > 0) {
+            const count = requests.length;
+            return [
+                {
+                    ruleId: ID,
+                    severity: 'error',
+                    message: say(lang, {
+                        en: `Fonts are loaded from Google (${count} request${count === 1 ? '' : 's'}).`,
+                        de: `Schriften werden von Google geladen (${count} ${count === 1 ? 'Anfrage' : 'Anfragen'}).`,
+                    }),
+                    pageUrl: page.finalUrl,
+                    evidence: [...new Set(requests.map((request) => request.url))].slice(0, 5),
+                    fix: say(lang, FIX),
+                },
+            ];
+        }
+        const hints = page.resourceHints.filter((hint) => isGoogleFontUrl(hint.href) &&
+            hint.rel.split(/\s+/).some((rel) => CONNECTING_HINTS.has(rel)));
+        if (hints.length > 0) {
+            return [
+                {
+                    ruleId: ID,
+                    severity: 'warning',
+                    message: say(lang, {
+                        en: 'The page preconnects to Google Fonts. No font was fetched, but the browser still opens a connection and transmits the IP address.',
+                        de: 'Die Seite baut vorab eine Verbindung zu Google Fonts auf. Es wurde keine Schrift geladen, aber der Browser öffnet trotzdem eine Verbindung und überträgt die IP-Adresse.',
+                    }),
+                    pageUrl: page.finalUrl,
+                    evidence: hints.map((hint) => `<link rel="${hint.rel}" href="${hint.href}">`),
+                    fix: say(lang, {
+                        en: 'Remove the leftover <link> tags pointing to Google Fonts.',
+                        de: 'Die übrig gebliebenen <link>-Tags zu Google Fonts entfernen.',
+                    }),
+                },
+            ];
+        }
+        return [];
+    },
+};
+//# sourceMappingURL=google-fonts.js.map

package/dist/rules/google-fonts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-fonts.js","sourceRoot":"","sources":["../../src/rules/google-fonts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAa,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAElD,MAAM,EAAE,GAAG,cAAc,CAAC;AAC1B,MAAM,iBAAiB,GAAG,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC;AAExE,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;AAEtF,MAAM,GAAG,GAAS;IAChB,EAAE,EACA,2FAA2F;QAC3F,+FAA+F;QAC/F,yFAAyF;QACzF,oBAAoB;IACtB,EAAE,EACA,8FAA8F;QAC9F,0FAA0F;QAC1F,8FAA8F;QAC9F,uDAAuD;CAC1D,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,GAAW,EAAW,EAAE;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,IAAI,KAAK,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7F,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAS;IAC/B,EAAE,EAAE,EAAE;IACN,KAAK,EAAE,yCAAyC;IAChD,WAAW,EACT,qFAAqF;QACrF,mEAAmE;IACrE,UAAU,EAAE,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;IAC5E,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC9B,OAAO;gBACL;oBACE,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;wBACjB,EAAE,EAAE,iCAAiC,KAAK,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;wBAC/E,EAAE,EAAE,wCAAwC,KAAK,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI;qBAC9F,CAAC;oBACF,OAAO,EAAE,IAAI,CAAC,QAAQ;oBACtB,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC1E,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC;iBACpB;aACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CACrC,CAAC,IAAI,EAAE,EAAE,CACP,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CACjE,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL;oBACE,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;wBACjB,EAAE,EAAE,mIAAmI;wBACvI,EAAE,EAAE,0KAA0K;qBAC/K,CAAC;oBACF,OAAO,EAAE,IAAI,CAAC,QAAQ;oBACtB,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,IAAI,IAAI,CAAC;oBAC7E,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE;wBACb,EAAE,EAAE,2DAA2D;wBAC/D,EAAE,EAAE,8DAA8D;qBACnE,CAAC;iBACe;aACpB,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC"}

package/dist/rules/impressum-link.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from '../types.js';
+export declare const impressumLink: Rule;

package/dist/rules/impressum-link.js

@@ -0,0 +1,59 @@
+import { say } from '../i18n.js';
+import { linkMatches, linksChecked } from './links.js';
+const ID = 'impressum-link';
+/**
+ * Link texts and URL slugs used for a legal notice across the EU.
+ * Matched against the visible text and the URL path, so `/impressum`
+ * behind an icon-only link is still found.
+ */
+const LEGAL_NOTICE = /impressum|imprint|legal[\s_-]?notice|site[\s_-]?notice|anbieterkennzeichnung|mentions[\s_-]?l[eé]gales|aviso[\s_-]?legal|note[\s_-]?legali|colofon|informacje[\s_-]?prawne/i;
+const CONTACT = /kontakt|contact/i;
+export const impressumLink = {
+    id: ID,
+    title: 'No link to an Impressum',
+    description: 'Commercial websites in Germany must provide a legal notice that is easy to recognise, ' +
+        'directly reachable and always available, which in practice means a link on every page. ' +
+        'Disable this rule for purely private sites or sites outside its scope.',
+    references: ['§ 5 DDG', 'BGH, 20.07.2006, Az. I ZR 228/03'],
+    check({ page, lang }) {
+        if (page.links.some(linkMatches(LEGAL_NOTICE))) {
+            return [];
+        }
+        const contact = page.links.find(linkMatches(CONTACT));
+        if (contact !== undefined) {
+            return [
+                {
+                    ruleId: ID,
+                    severity: 'info',
+                    message: say(lang, {
+                        en: 'No direct Impressum link, only a contact link.',
+                        de: 'Kein direkter Impressum-Link, nur ein Kontakt-Link.',
+                    }),
+                    pageUrl: page.finalUrl,
+                    evidence: [say(lang, { en: 'contact link: ', de: 'Kontakt-Link: ' }) + contact.href],
+                    fix: say(lang, {
+                        en: 'Two clicks via "Kontakt" can be enough if the Impressum is clearly linked from there (BGH I ZR 228/03), but a direct "Impressum" link next to it is safer.',
+                        de: 'Zwei Klicks über „Kontakt“ können reichen, wenn das Impressum dort klar verlinkt ist (BGH I ZR 228/03). Sicherer ist ein direkter Link „Impressum“ daneben.',
+                    }),
+                },
+            ];
+        }
+        return [
+            {
+                ruleId: ID,
+                severity: 'warning',
+                message: say(lang, {
+                    en: 'No link to an Impressum or legal notice was found on this page.',
+                    de: 'Auf dieser Seite wurde kein Link zu einem Impressum gefunden.',
+                }),
+                pageUrl: page.finalUrl,
+                evidence: [linksChecked(page.links.length, lang)],
+                fix: say(lang, {
+                    en: 'Add a link labelled "Impressum" to a part of the layout that appears on every page, usually the footer.',
+                    de: 'Einen Link „Impressum“ in einen Bereich einbauen, der auf jeder Seite erscheint, meist den Footer.',
+                }),
+            },
+        ];
+    },
+};
+//# sourceMappingURL=impressum-link.js.map

package/dist/rules/impressum-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"impressum-link.js","sourceRoot":"","sources":["../../src/rules/impressum-link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,YAAY,GAChB,6KAA6K,CAAC;AAEhL,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAEnC,MAAM,CAAC,MAAM,aAAa,GAAS;IACjC,EAAE,EAAE,EAAE;IACN,KAAK,EAAE,yBAAyB;IAChC,WAAW,EACT,wFAAwF;QACxF,yFAAyF;QACzF,wEAAwE;IAC1E,UAAU,EAAE,CAAC,SAAS,EAAE,kCAAkC,CAAC;IAC3D,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;QAClB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO;gBACL;oBACE,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;wBACjB,EAAE,EAAE,gDAAgD;wBACpD,EAAE,EAAE,qDAAqD;qBAC1D,CAAC;oBACF,OAAO,EAAE,IAAI,CAAC,QAAQ;oBACtB,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;oBACpF,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE;wBACb,EAAE,EAAE,4JAA4J;wBAChK,EAAE,EAAE,6JAA6J;qBAClK,CAAC;iBACH;aACF,CAAC;QACJ,CAAC;QAED,OAAO;YACL;gBACE,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;oBACjB,EAAE,EAAE,iEAAiE;oBACrE,EAAE,EAAE,+DAA+D;iBACpE,CAAC;gBACF,OAAO,EAAE,IAAI,CAAC,QAAQ;gBACtB,QAAQ,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACjD,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE;oBACb,EAAE,EAAE,yGAAyG;oBAC7G,EAAE,EAAE,oGAAoG;iBACzG,CAAC;aACH;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/rules/index.d.ts

@@ -0,0 +1,11 @@
+import type { Rule } from '../types.js';
+import { googleFonts } from './google-fonts.js';
+import { impressumLink } from './impressum-link.js';
+import { preConsentTrackers } from './pre-consent-trackers.js';
+import { privacyPolicyLink } from './privacy-policy-link.js';
+import { rejectOption } from './reject-option.js';
+import { thirdPartyCdns } from './third-party-cdns.js';
+import { thirdPartyEmbeds } from './third-party-embeds.js';
+import { trackersAfterReject } from './trackers-after-reject.js';
+export declare const defaultRules: readonly Rule[];
+export { googleFonts, impressumLink, preConsentTrackers, privacyPolicyLink, rejectOption, thirdPartyCdns, thirdPartyEmbeds, trackersAfterReject, };

package/dist/rules/index.js

@@ -0,0 +1,20 @@
+import { googleFonts } from './google-fonts.js';
+import { impressumLink } from './impressum-link.js';
+import { preConsentTrackers } from './pre-consent-trackers.js';
+import { privacyPolicyLink } from './privacy-policy-link.js';
+import { rejectOption } from './reject-option.js';
+import { thirdPartyCdns } from './third-party-cdns.js';
+import { thirdPartyEmbeds } from './third-party-embeds.js';
+import { trackersAfterReject } from './trackers-after-reject.js';
+export const defaultRules = [
+    preConsentTrackers,
+    trackersAfterReject,
+    rejectOption,
+    googleFonts,
+    thirdPartyEmbeds,
+    thirdPartyCdns,
+    impressumLink,
+    privacyPolicyLink,
+];
+export { googleFonts, impressumLink, preConsentTrackers, privacyPolicyLink, rejectOption, thirdPartyCdns, thirdPartyEmbeds, trackersAfterReject, };
+//# sourceMappingURL=index.js.map

package/dist/rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,CAAC,MAAM,YAAY,GAAoB;IAC3C,kBAAkB;IAClB,mBAAmB;IACnB,YAAY;IACZ,WAAW;IACX,gBAAgB;IAChB,cAAc;IACd,aAAa;IACb,iBAAiB;CAClB,CAAC;AAEF,OAAO,EACL,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,CAAC"}

package/dist/rules/links.d.ts

@@ -0,0 +1,8 @@
+import { type Lang } from '../i18n.js';
+import type { PageLink } from '../types.js';
+/**
+ * Matches a link by its visible text or its URL path. Only the path counts,
+ * so a domain like impressum-example.de doesn't satisfy every page.
+ */
+export declare const linkMatches: (pattern: RegExp) => (link: PageLink) => boolean;
+export declare const linksChecked: (count: number, lang: Lang) => string;

package/dist/rules/links.js

@@ -0,0 +1,16 @@
+import { say } from '../i18n.js';
+/**
+ * Matches a link by its visible text or its URL path. Only the path counts,
+ * so a domain like impressum-example.de doesn't satisfy every page.
+ */
+export const linkMatches = (pattern) => (link) => pattern.test(link.text) || pattern.test(pathOf(link.href));
+export const linksChecked = (count, lang) => say(lang, { en: `${count} links checked`, de: `${count} Links geprüft` });
+function pathOf(href) {
+    try {
+        return decodeURIComponent(new URL(href).pathname);
+    }
+    catch {
+        return '';
+    }
+}
+//# sourceMappingURL=links.js.map

package/dist/rules/links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"links.js","sourceRoot":"","sources":["../../src/rules/links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,GAAG,EAAE,MAAM,YAAY,CAAC;AAG5C;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,IAAc,EAAE,EAAE,CACjE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,IAAU,EAAE,EAAE,CACxD,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,gBAAgB,EAAE,EAAE,EAAE,GAAG,KAAK,gBAAgB,EAAE,CAAC,CAAC;AAE5E,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/rules/pre-consent-trackers.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from '../types.js';
+export declare const preConsentTrackers: Rule;