privalint 0.0.0-stage → 0.2.0

package/dist/rules/pre-consent-trackers.js

@@ -0,0 +1,45 @@
+import { say } from '../i18n.js';
+import { categoryLabel, findTrackerHits } from './tracker-hits.js';
+const ID = 'pre-consent-trackers';
+export const preConsentTrackers = {
+    id: ID,
+    title: 'Trackers run before consent',
+    description: 'Analytics, advertising and session-replay tools must not load or set cookies until the ' +
+        'visitor has opted in. The page is loaded without interacting with any consent banner, so ' +
+        'everything reported here happened before consent.',
+    references: [
+        '§ 25 Abs. 1 TDDDG',
+        'Art. 5(3) ePrivacy Directive',
+        'Art. 6(1)(a) GDPR',
+        'CJEU C-673/17 (Planet49)',
+    ],
+    check({ page, lang }) {
+        const hits = findTrackerHits(page.requests, page.cookies, lang);
+        return hits.map(({ tracker, evidence }) => {
+            const { vendor } = tracker;
+            const isTagManager = tracker.category === 'tag-manager';
+            const category = categoryLabel(tracker.category, lang);
+            return {
+                ruleId: ID,
+                severity: isTagManager ? 'warning' : 'error',
+                message: isTagManager
+                    ? say(lang, {
+                        en: `${vendor} loads before consent and sends the visitor's IP address to a third party.`,
+                        de: `${vendor} wird vor der Einwilligung geladen und überträgt die IP-Adresse an einen Dritten.`,
+                    })
+                    : say(lang, {
+                        en: `${vendor} (${category}) runs before the visitor has given consent.`,
+                        de: `${vendor} (${category}) läuft, bevor eine Einwilligung vorliegt.`,
+                    }),
+                pageUrl: page.finalUrl,
+                subject: vendor,
+                evidence,
+                fix: say(lang, {
+                    en: `Only load ${vendor} after opt-in, for example by letting your consent manager inject it or by using it in a consent mode that sends no requests until consent is given.`,
+                    de: `${vendor} erst nach der Einwilligung laden, zum Beispiel über das Consent-Tool, oder einen Consent-Modus nutzen, der vorher keine Anfragen sendet.`,
+                }),
+            };
+        });
+    },
+};
+//# sourceMappingURL=pre-consent-trackers.js.map

package/dist/rules/pre-consent-trackers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-consent-trackers.js","sourceRoot":"","sources":["../../src/rules/pre-consent-trackers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEnE,MAAM,EAAE,GAAG,sBAAsB,CAAC;AAElC,MAAM,CAAC,MAAM,kBAAkB,GAAS;IACtC,EAAE,EAAE,EAAE;IACN,KAAK,EAAE,6BAA6B;IACpC,WAAW,EACT,yFAAyF;QACzF,2FAA2F;QAC3F,mDAAmD;IACrD,UAAU,EAAE;QACV,mBAAmB;QACnB,8BAA8B;QAC9B,mBAAmB;QACnB,0BAA0B;KAC3B;IACD,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;QAClB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAW,EAAE;YACjD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;YAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,aAAa,CAAC;YACxD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvD,OAAO;gBACL,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;gBAC5C,OAAO,EAAE,YAAY;oBACnB,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;wBACR,EAAE,EAAE,GAAG,MAAM,4EAA4E;wBACzF,EAAE,EAAE,GAAG,MAAM,mFAAmF;qBACjG,CAAC;oBACJ,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;wBACR,EAAE,EAAE,GAAG,MAAM,KAAK,QAAQ,8CAA8C;wBACxE,EAAE,EAAE,GAAG,MAAM,KAAK,QAAQ,4CAA4C;qBACvE,CAAC;gBACN,OAAO,EAAE,IAAI,CAAC,QAAQ;gBACtB,OAAO,EAAE,MAAM;gBACf,QAAQ;gBACR,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE;oBACb,EAAE,EAAE,aAAa,MAAM,sJAAsJ;oBAC7K,EAAE,EAAE,GAAG,MAAM,2IAA2I;iBACzJ,CAAC;aACH,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/rules/privacy-policy-link.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from '../types.js';
+export declare const privacyPolicyLink: Rule;

package/dist/rules/privacy-policy-link.js

@@ -0,0 +1,33 @@
+import { say } from '../i18n.js';
+import { linkMatches, linksChecked } from './links.js';
+const ID = 'privacy-policy-link';
+const PRIVACY_POLICY = /datenschutz|privacy|data[\s_-]?protection|confidentialit|privacidad|protezione[\s_-]?dei[\s_-]?dati|privacybeleid|polityka[\s_-]?prywatno/i;
+export const privacyPolicyLink = {
+    id: ID,
+    title: 'No link to a privacy policy',
+    description: 'Visitors must be told how their data is processed at the time it is collected. Since every ' +
+        'page view already involves server logs, the privacy policy has to be reachable from every page.',
+    references: ['Art. 12 GDPR', 'Art. 13 GDPR'],
+    check({ page, lang }) {
+        if (page.links.some(linkMatches(PRIVACY_POLICY))) {
+            return [];
+        }
+        return [
+            {
+                ruleId: ID,
+                severity: 'warning',
+                message: say(lang, {
+                    en: 'No link to a privacy policy was found on this page.',
+                    de: 'Auf dieser Seite wurde kein Link zur Datenschutzerklärung gefunden.',
+                }),
+                pageUrl: page.finalUrl,
+                evidence: [linksChecked(page.links.length, lang)],
+                fix: say(lang, {
+                    en: 'Add a link labelled "Datenschutz" or "Datenschutzerklärung" next to the Impressum link in the footer.',
+                    de: 'Einen Link „Datenschutz“ oder „Datenschutzerklärung“ neben dem Impressum-Link in den Footer setzen.',
+                }),
+            },
+        ];
+    },
+};
+//# sourceMappingURL=privacy-policy-link.js.map

package/dist/rules/privacy-policy-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-policy-link.js","sourceRoot":"","sources":["../../src/rules/privacy-policy-link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,EAAE,GAAG,qBAAqB,CAAC;AAEjC,MAAM,cAAc,GAClB,4IAA4I,CAAC;AAE/I,MAAM,CAAC,MAAM,iBAAiB,GAAS;IACrC,EAAE,EAAE,EAAE;IACN,KAAK,EAAE,6BAA6B;IACpC,WAAW,EACT,6FAA6F;QAC7F,iGAAiG;IACnG,UAAU,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;IAC5C,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;QAClB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO;YACL;gBACE,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;oBACjB,EAAE,EAAE,qDAAqD;oBACzD,EAAE,EAAE,qEAAqE;iBAC1E,CAAC;gBACF,OAAO,EAAE,IAAI,CAAC,QAAQ;gBACtB,QAAQ,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACjD,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE;oBACb,EAAE,EAAE,uGAAuG;oBAC3G,EAAE,EAAE,qGAAqG;iBAC1G,CAAC;aACH;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/rules/reject-option.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from '../types.js';
+export declare const rejectOption: Rule;

package/dist/rules/reject-option.js

@@ -0,0 +1,66 @@
+import { say } from '../i18n.js';
+const ID = 'reject-option';
+export const rejectOption = {
+    id: ID,
+    title: 'No way to reject on the first layer of the banner',
+    description: 'Rejecting cookies must be as easy as accepting them. Most European regulators treat a banner ' +
+        'that offers "accept" on its first layer, but hides "reject" in the settings or behind a ' +
+        'link, as invalid consent.',
+    references: [
+        'EDPB Cookie Banner Taskforce report, 17.01.2023',
+        'DSK-Beschluss, 22.03.2023: Bewertung von Pur-Abo-Modellen auf Websites',
+        'EDPB Opinion 08/2024 on consent or pay models',
+        'Art. 4(11) GDPR',
+        'Art. 7(3) GDPR',
+        '§ 25 Abs. 1 TDDDG',
+    ],
+    check({ page, lang }) {
+        const consent = page.consent;
+        if (consent?.bannerFound !== true || consent.rejectLabel !== undefined) {
+            return [];
+        }
+        const vendor = consent.cmp === undefined ? '' : ` (${consent.cmp})`;
+        const accept = consent.acceptLabel ?? say(lang, { en: 'accept', de: 'Zustimmen' });
+        const evidence = [
+            say(lang, {
+                en: `accept button: ${consent.acceptLabel ?? 'unlabelled'}`,
+                de: `Zustimmen-Button: ${consent.acceptLabel ?? 'ohne Beschriftung'}`,
+            }),
+        ];
+        if (consent.payOrOk === true) {
+            return [
+                {
+                    ruleId: ID,
+                    severity: 'info',
+                    message: say(lang, {
+                        en: `The consent banner${vendor} offers "${accept}" or a subscription instead of a reject button ("pay or OK").`,
+                        de: `Das Cookie-Banner${vendor} bietet „${accept}“ oder ein Abo statt eines Ablehnen-Buttons (Pur-Abo-Modell).`,
+                    }),
+                    pageUrl: page.finalUrl,
+                    evidence,
+                    fix: say(lang, {
+                        en: 'German regulators consider pay-or-OK generally permissible if the paid option is an equivalent, fairly priced alternative (DSK, 22.03.2023). For large platforms the EDPB is much stricter (Opinion 08/2024). privalint cannot judge this; have it assessed legally.',
+                        de: 'Deutsche Aufsichtsbehörden halten Pur-Abo-Modelle grundsätzlich für zulässig, wenn das Bezahlangebot eine gleichwertige Alternative zu einem angemessenen Preis ist (DSK, 22.03.2023). Für große Plattformen ist der EDSA deutlich strenger (Stellungnahme 08/2024). privalint kann das nicht beurteilen; bitte rechtlich prüfen lassen.',
+                    }),
+                },
+            ];
+        }
+        return [
+            {
+                ruleId: ID,
+                severity: 'warning',
+                message: say(lang, {
+                    en: `The consent banner${vendor} offers "${accept}" but no reject button next to it.`,
+                    de: `Das Cookie-Banner${vendor} bietet „${accept}“, aber keinen Ablehnen-Button daneben.`,
+                }),
+                pageUrl: page.finalUrl,
+                evidence,
+                fix: say(lang, {
+                    en: 'Add a button such as "Alle ablehnen" or "Nur notwendige" on the first layer, with the same size and prominence as the accept button.',
+                    de: 'Einen Button wie „Alle ablehnen“ oder „Nur notwendige“ auf die erste Ebene setzen, gleich groß und gleich auffällig wie den Zustimmen-Button.',
+                }),
+            },
+        ];
+    },
+};
+//# sourceMappingURL=reject-option.js.map

package/dist/rules/reject-option.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reject-option.js","sourceRoot":"","sources":["../../src/rules/reject-option.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAGjC,MAAM,EAAE,GAAG,eAAe,CAAC;AAE3B,MAAM,CAAC,MAAM,YAAY,GAAS;IAChC,EAAE,EAAE,EAAE;IACN,KAAK,EAAE,mDAAmD;IAC1D,WAAW,EACT,+FAA+F;QAC/F,0FAA0F;QAC1F,2BAA2B;IAC7B,UAAU,EAAE;QACV,iDAAiD;QACjD,wEAAwE;QACxE,+CAA+C;QAC/C,iBAAiB;QACjB,gBAAgB;QAChB,mBAAmB;KACpB;IACD,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,EAAE,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACvE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,GAAG,GAAG,CAAC;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG;YACf,GAAG,CAAC,IAAI,EAAE;gBACR,EAAE,EAAE,kBAAkB,OAAO,CAAC,WAAW,IAAI,YAAY,EAAE;gBAC3D,EAAE,EAAE,qBAAqB,OAAO,CAAC,WAAW,IAAI,mBAAmB,EAAE;aACtE,CAAC;SACH,CAAC;QACF,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO;gBACL;oBACE,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;wBACjB,EAAE,EAAE,qBAAqB,MAAM,YAAY,MAAM,+DAA+D;wBAChH,EAAE,EAAE,oBAAoB,MAAM,YAAY,MAAM,+DAA+D;qBAChH,CAAC;oBACF,OAAO,EAAE,IAAI,CAAC,QAAQ;oBACtB,QAAQ;oBACR,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE;wBACb,EAAE,EAAE,sQAAsQ;wBAC1Q,EAAE,EAAE,0UAA0U;qBAC/U,CAAC;iBACH;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL;gBACE,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;oBACjB,EAAE,EAAE,qBAAqB,MAAM,YAAY,MAAM,oCAAoC;oBACrF,EAAE,EAAE,oBAAoB,MAAM,YAAY,MAAM,yCAAyC;iBAC1F,CAAC;gBACF,OAAO,EAAE,IAAI,CAAC,QAAQ;gBACtB,QAAQ;gBACR,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE;oBACb,EAAE,EAAE,sIAAsI;oBAC1I,EAAE,EAAE,+IAA+I;iBACpJ,CAAC;aACH;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/rules/third-party-cdns.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from '../types.js';
+export declare const thirdPartyCdns: Rule;

package/dist/rules/third-party-cdns.js

@@ -0,0 +1,30 @@
+import { findCdn } from '../data/third-parties.js';
+import { say } from '../i18n.js';
+import { groupRequestsByVendor } from './third-party-hits.js';
+const ID = 'third-party-cdns';
+export const thirdPartyCdns = {
+    id: ID,
+    title: 'Scripts or styles loaded from a public CDN',
+    description: "Every request to a public CDN sends the visitor's IP address to its operator. The same " +
+        'reasoning that made Google Fonts a problem applies, but there is no court ruling on CDNs ' +
+        'specifically, so this is only a hint.',
+    references: ['Art. 6(1) GDPR', 'LG München I, 20.01.2022, Az. 3 O 17493/20 (by analogy)'],
+    check({ page, lang }) {
+        return [...groupRequestsByVendor(page.requests, findCdn)].map(([vendor, evidence]) => ({
+            ruleId: ID,
+            severity: 'info',
+            message: say(lang, {
+                en: `Files are loaded from ${vendor}.`,
+                de: `Dateien werden von ${vendor} geladen.`,
+            }),
+            pageUrl: page.finalUrl,
+            subject: vendor,
+            evidence,
+            fix: say(lang, {
+                en: 'Install the library with your package manager and bundle it, or copy the files to your own server.',
+                de: 'Die Bibliothek über den Paketmanager installieren und mitbündeln oder die Dateien auf den eigenen Server kopieren.',
+            }),
+        }));
+    },
+};
+//# sourceMappingURL=third-party-cdns.js.map

package/dist/rules/third-party-cdns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"third-party-cdns.js","sourceRoot":"","sources":["../../src/rules/third-party-cdns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAEjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,EAAE,GAAG,kBAAkB,CAAC;AAE9B,MAAM,CAAC,MAAM,cAAc,GAAS;IAClC,EAAE,EAAE,EAAE;IACN,KAAK,EAAE,4CAA4C;IACnD,WAAW,EACT,yFAAyF;QACzF,2FAA2F;QAC3F,uCAAuC;IACzC,UAAU,EAAE,CAAC,gBAAgB,EAAE,yDAAyD,CAAC;IACzF,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;QAClB,OAAO,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAC3D,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAW,EAAE,CAAC,CAAC;YAChC,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;gBACjB,EAAE,EAAE,yBAAyB,MAAM,GAAG;gBACtC,EAAE,EAAE,sBAAsB,MAAM,WAAW;aAC5C,CAAC;YACF,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,OAAO,EAAE,MAAM;YACf,QAAQ;YACR,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE;gBACb,EAAE,EAAE,oGAAoG;gBACxG,EAAE,EAAE,oHAAoH;aACzH,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/rules/third-party-embeds.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from '../types.js';
+export declare const thirdPartyEmbeds: Rule;

package/dist/rules/third-party-embeds.js

@@ -0,0 +1,30 @@
+import { findEmbed } from '../data/third-parties.js';
+import { say } from '../i18n.js';
+import { groupRequestsByVendor } from './third-party-hits.js';
+const ID = 'third-party-embeds';
+export const thirdPartyEmbeds = {
+    id: ID,
+    title: 'Embedded content loads before consent',
+    description: 'Videos, maps, captchas and social embeds contact their provider as soon as the page loads, ' +
+        "which sends the visitor's IP address and often sets cookies. Load them only after the " +
+        'visitor has agreed, typically with a click-to-load placeholder.',
+    references: ['Art. 6(1) GDPR', '§ 25 Abs. 1 TDDDG'],
+    check({ page, lang }) {
+        return [...groupRequestsByVendor(page.requests, findEmbed)].map(([vendor, evidence]) => ({
+            ruleId: ID,
+            severity: 'warning',
+            message: say(lang, {
+                en: `${vendor} loads before the visitor has given consent.`,
+                de: `${vendor} wird geladen, bevor eine Einwilligung vorliegt.`,
+            }),
+            pageUrl: page.finalUrl,
+            subject: vendor,
+            evidence,
+            fix: say(lang, {
+                en: `Show a placeholder and load ${vendor} only after a click or consent. youtube-nocookie.com alone is not enough, it still contacts Google on load.`,
+                de: `Einen Platzhalter zeigen und ${vendor} erst nach Klick oder Einwilligung laden. youtube-nocookie.com allein reicht nicht, es kontaktiert Google trotzdem beim Laden.`,
+            }),
+        }));
+    },
+};
+//# sourceMappingURL=third-party-embeds.js.map

package/dist/rules/third-party-embeds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"third-party-embeds.js","sourceRoot":"","sources":["../../src/rules/third-party-embeds.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAEjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,EAAE,GAAG,oBAAoB,CAAC;AAEhC,MAAM,CAAC,MAAM,gBAAgB,GAAS;IACpC,EAAE,EAAE,EAAE;IACN,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EACT,6FAA6F;QAC7F,wFAAwF;QACxF,iEAAiE;IACnE,UAAU,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;IACnD,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;QAClB,OAAO,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAC7D,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAW,EAAE,CAAC,CAAC;YAChC,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;gBACjB,EAAE,EAAE,GAAG,MAAM,8CAA8C;gBAC3D,EAAE,EAAE,GAAG,MAAM,kDAAkD;aAChE,CAAC;YACF,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,OAAO,EAAE,MAAM;YACf,QAAQ;YACR,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE;gBACb,EAAE,EAAE,+BAA+B,MAAM,6GAA6G;gBACtJ,EAAE,EAAE,gCAAgC,MAAM,gIAAgI;aAC3K,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/rules/third-party-hits.d.ts

@@ -0,0 +1,4 @@
+import type { ThirdParty } from '../data/third-parties.js';
+import type { RecordedRequest } from '../types.js';
+/** Groups requests by the vendor `find` resolves them to. */
+export declare function groupRequestsByVendor(requests: readonly RecordedRequest[], find: (url: string) => ThirdParty | undefined): Map<string, string[]>;

package/dist/rules/third-party-hits.js

@@ -0,0 +1,13 @@
+const MAX_EVIDENCE = 5;
+/** Groups requests by the vendor `find` resolves them to. */
+export function groupRequestsByVendor(requests, find) {
+    const byVendor = new Map();
+    for (const request of requests) {
+        const vendor = find(request.url)?.vendor;
+        if (vendor !== undefined) {
+            byVendor.set(vendor, (byVendor.get(vendor) ?? new Set()).add(request.url));
+        }
+    }
+    return new Map([...byVendor].map(([vendor, urls]) => [vendor, [...urls].slice(0, MAX_EVIDENCE)]));
+}
+//# sourceMappingURL=third-party-hits.js.map

package/dist/rules/third-party-hits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"third-party-hits.js","sourceRoot":"","sources":["../../src/rules/third-party-hits.ts"],"names":[],"mappings":"AAGA,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB,CACnC,QAAoC,EACpC,IAA6C;IAE7C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC"}

package/dist/rules/tracker-hits.d.ts

@@ -0,0 +1,11 @@
+import { type Tracker, type TrackerCategory } from '../data/trackers.js';
+import { type Lang } from '../i18n.js';
+import type { RecordedCookie, RecordedRequest } from '../types.js';
+export interface TrackerHit {
+    tracker: Tracker;
+    /** Up to five request URLs and cookie names, deduplicated. */
+    evidence: string[];
+}
+/** Matches requests and cookies against the tracker list, grouped by vendor. */
+export declare function findTrackerHits(requests: readonly RecordedRequest[], cookies: readonly RecordedCookie[], lang: Lang): TrackerHit[];
+export declare const categoryLabel: (category: TrackerCategory, lang: Lang) => string;

package/dist/rules/tracker-hits.js

@@ -0,0 +1,40 @@
+import { findTrackerByCookie, findTrackerByUrl, } from '../data/trackers.js';
+import { say } from '../i18n.js';
+const MAX_EVIDENCE = 5;
+/** Matches requests and cookies against the tracker list, grouped by vendor. */
+export function findTrackerHits(requests, cookies, lang) {
+    const requestLabel = say(lang, { en: 'request', de: 'Anfrage' });
+    const hits = new Map();
+    const record = (tracker, evidence) => {
+        const hit = hits.get(tracker.vendor) ?? { tracker, evidence: new Set() };
+        hit.evidence.add(evidence);
+        hits.set(tracker.vendor, hit);
+    };
+    for (const request of requests) {
+        const tracker = findTrackerByUrl(request.url);
+        if (tracker !== undefined) {
+            record(tracker, `${requestLabel} ${request.url}`);
+        }
+    }
+    for (const cookie of cookies) {
+        const tracker = findTrackerByCookie(cookie.name) ??
+            findTrackerByUrl(`https://${cookie.domain.replace(/^\./, '')}/`);
+        if (tracker !== undefined) {
+            record(tracker, `cookie ${cookie.name} (${cookie.domain})`);
+        }
+    }
+    return [...hits.values()].map(({ tracker, evidence }) => ({
+        tracker,
+        evidence: [...evidence].slice(0, MAX_EVIDENCE),
+    }));
+}
+const CATEGORY_LABELS = {
+    analytics: { en: 'analytics', de: 'Analyse' },
+    advertising: { en: 'advertising', de: 'Werbung' },
+    'session-replay': { en: 'session-replay', de: 'Session-Replay' },
+    social: { en: 'social', de: 'Social Media' },
+    'marketing-automation': { en: 'marketing-automation', de: 'Marketing-Automatisierung' },
+    'tag-manager': { en: 'tag-manager', de: 'Tag-Manager' },
+};
+export const categoryLabel = (category, lang) => say(lang, CATEGORY_LABELS[category]);
+//# sourceMappingURL=tracker-hits.js.map

package/dist/rules/tracker-hits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracker-hits.js","sourceRoot":"","sources":["../../src/rules/tracker-hits.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GAGjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAa,GAAG,EAAa,MAAM,YAAY,CAAC;AAGvD,MAAM,YAAY,GAAG,CAAC,CAAC;AAQvB,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAC7B,QAAoC,EACpC,OAAkC,EAClC,IAAU;IAEV,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuD,CAAC;IAC5E,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAE,QAAgB,EAAE,EAAE;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;QACjF,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,OAAO,EAAE,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GACX,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC;YAChC,gBAAgB,CAAC,WAAW,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACnE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,OAAO,EAAE,UAAU,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACxD,OAAO;QACP,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,eAAe,GAAkC;IACrD,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE;IAC7C,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE;IACjD,gBAAgB,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,gBAAgB,EAAE;IAChE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE;IAC5C,sBAAsB,EAAE,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,2BAA2B,EAAE;IACvF,aAAa,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,aAAa,EAAE;CACxD,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAyB,EAAE,IAAU,EAAE,EAAE,CACrE,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC"}

package/dist/rules/trackers-after-reject.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from '../types.js';
+export declare const trackersAfterReject: Rule;

package/dist/rules/trackers-after-reject.js

@@ -0,0 +1,39 @@
+import { say } from '../i18n.js';
+import { categoryLabel, findTrackerHits } from './tracker-hits.js';
+const ID = 'trackers-after-reject';
+export const trackersAfterReject = {
+    id: ID,
+    title: 'Trackers run after the visitor rejected them',
+    description: 'privalint clicks the reject button of the consent banner on the start page, reloads the ' +
+        'page and records what still loads. Anything on the tracker list that loads or sets new ' +
+        'cookies after that ignores the visitor’s explicit refusal.',
+    references: ['§ 25 Abs. 1 TDDDG', 'Art. 6(1)(a) GDPR', 'Art. 7(3) GDPR'],
+    check({ page, lang }) {
+        const after = page.consent?.afterReject;
+        if (after === undefined) {
+            return [];
+        }
+        const button = page.consent?.rejectLabel ?? say(lang, { en: 'reject', de: 'Ablehnen' });
+        return findTrackerHits(after.requests, after.cookies, lang).map(({ tracker, evidence }) => {
+            const { vendor } = tracker;
+            const category = categoryLabel(tracker.category, lang);
+            return {
+                ruleId: ID,
+                // Same reasoning as pre-consent-trackers: the container alone may be configured correctly.
+                severity: tracker.category === 'tag-manager' ? 'warning' : 'error',
+                message: say(lang, {
+                    en: `${vendor} (${category}) still runs after clicking "${button}".`,
+                    de: `${vendor} (${category}) läuft weiter, obwohl „${button}“ geklickt wurde.`,
+                }),
+                pageUrl: page.finalUrl,
+                subject: vendor,
+                evidence,
+                fix: say(lang, {
+                    en: `Check that ${vendor} is assigned to a consent category in your consent manager and that the category is blocked when the visitor rejects.`,
+                    de: `Prüfen, ob ${vendor} im Consent-Tool einer Kategorie zugeordnet ist und diese Kategorie beim Ablehnen blockiert wird.`,
+                }),
+            };
+        });
+    },
+};
+//# sourceMappingURL=trackers-after-reject.js.map

package/dist/rules/trackers-after-reject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trackers-after-reject.js","sourceRoot":"","sources":["../../src/rules/trackers-after-reject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEnE,MAAM,EAAE,GAAG,uBAAuB,CAAC;AAEnC,MAAM,CAAC,MAAM,mBAAmB,GAAS;IACvC,EAAE,EAAE,EAAE;IACN,KAAK,EAAE,8CAA8C;IACrD,WAAW,EACT,0FAA0F;QAC1F,yFAAyF;QACzF,4DAA4D;IAC9D,UAAU,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;IACxE,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QACxF,OAAO,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAC7D,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAW,EAAE;YACjC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;YAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvD,OAAO;gBACL,MAAM,EAAE,EAAE;gBACV,2FAA2F;gBAC3F,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;gBAClE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;oBACjB,EAAE,EAAE,GAAG,MAAM,KAAK,QAAQ,gCAAgC,MAAM,IAAI;oBACpE,EAAE,EAAE,GAAG,MAAM,KAAK,QAAQ,2BAA2B,MAAM,mBAAmB;iBAC/E,CAAC;gBACF,OAAO,EAAE,IAAI,CAAC,QAAQ;gBACtB,OAAO,EAAE,MAAM;gBACf,QAAQ;gBACR,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE;oBACb,EAAE,EAAE,cAAc,MAAM,uHAAuH;oBAC/I,EAAE,EAAE,cAAc,MAAM,mGAAmG;iBAC5H,CAAC;aACH,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/scanner.d.ts

@@ -0,0 +1,39 @@
+import type { Lang } from './i18n.js';
+import { type Region } from './legal.js';
+import type { PageSnapshot, Rule, ScanResult } from './types.js';
+export interface ScanOptions {
+    /** Maximum number of pages on the same site to visit, starting with the given URL. */
+    maxPages?: number | undefined;
+    /** Extra time to wait after the network is idle, to catch delayed tags. */
+    settleMs?: number | undefined;
+    /** Navigation timeout per page. */
+    timeoutMs?: number | undefined;
+    locale?: string | undefined;
+    /** Language of messages and fixes in the findings. */
+    lang?: Lang | undefined;
+    /** Country whose law the findings are judged by. */
+    region?: Region | undefined;
+    rules?: readonly Rule[];
+    /**
+     * Answer every third-party request with an empty response instead of fetching it.
+     * Requests are still recorded. Used by the test suite to stay off the network.
+     */
+    offline?: boolean;
+    /**
+     * Click "reject" on the start page's consent banner and record what still loads.
+     * On by default.
+     */
+    consentCheck?: boolean | undefined;
+    /**
+     * Open a visible browser window instead of running headless. Some sites only show their
+     * consent banner to regular browsers. Needs a display, so it doesn't work on CI runners.
+     */
+    headed?: boolean | undefined;
+    /**
+     * Use an installed browser instead of Playwright's bundled Chromium,
+     * e.g. `chrome` or `msedge`.
+     */
+    channel?: string | undefined;
+    onPage?: (snapshot: PageSnapshot) => void;
+}
+export declare function scan(target: string, options?: ScanOptions): Promise<ScanResult>;

package/dist/scanner.js

@@ -0,0 +1,175 @@
+import { chromium } from 'playwright';
+import { observeConsent } from './consent.js';
+import { applyRegion } from './legal.js';
+import { defaultRules } from './rules/index.js';
+import { crawlTarget, isFirstParty, withoutHash } from './url.js';
+const DEFAULTS = {
+    maxPages: 1,
+    settleMs: 2_000,
+    timeoutMs: 30_000,
+    locale: 'de-DE',
+    lang: 'en',
+    region: 'de',
+};
+export async function scan(target, options = {}) {
+    const startedAt = Date.now();
+    const rules = options.rules ?? defaultRules;
+    const maxPages = Math.max(1, options.maxPages ?? DEFAULTS.maxPages);
+    const lang = options.lang ?? DEFAULTS.lang;
+    const region = options.region ?? DEFAULTS.region;
+    let siteUrl = new URL(target);
+    const browser = await chromium.launch({
+        headless: options.headed !== true,
+        ...(options.channel === undefined ? {} : { channel: options.channel }),
+    });
+    try {
+        const snapshots = [];
+        const queue = [siteUrl.href];
+        const seen = new Set(queue);
+        const captured = new Set();
+        let url = queue.shift();
+        while (url !== undefined && snapshots.length < maxPages) {
+            const isStart = snapshots.length === 0;
+            const snapshot = await capturePage(browser, url, siteUrl, options, isStart);
+            if (isStart) {
+                if (snapshot.error !== undefined) {
+                    throw new Error(`Could not load ${url}: ${snapshot.error}`);
+                }
+                // Follow redirects like http -> https or apex -> www for the rest of the crawl.
+                siteUrl = new URL(snapshot.finalUrl);
+            }
+            // Several links can redirect to the same page; only lint it once.
+            const finalUrl = withoutHash(snapshot.finalUrl);
+            if (!captured.has(finalUrl)) {
+                captured.add(finalUrl);
+                seen.add(finalUrl);
+                snapshots.push(snapshot);
+                options.onPage?.(snapshot);
+                for (const link of snapshot.links) {
+                    const next = crawlTarget(link.href, siteUrl);
+                    if (next !== undefined && !seen.has(next)) {
+                        seen.add(next);
+                        queue.push(next);
+                    }
+                }
+            }
+            url = queue.shift();
+        }
+        // Pages that failed, returned an error status or redirected off-site are listed but not linted.
+        const observed = snapshots
+            .filter((page) => page.error === undefined &&
+            (page.status === null || page.status < 400) &&
+            isFirstParty(page.finalUrl, siteUrl))
+            .flatMap((page) => rules.flatMap((rule) => rule.check({ siteUrl, page, lang })));
+        const findings = applyRegion(observed, region);
+        return {
+            siteUrl: siteUrl.href,
+            lang,
+            region,
+            scannedAt: new Date(startedAt).toISOString(),
+            durationMs: Date.now() - startedAt,
+            pages: snapshots.map((page) => ({
+                url: page.url,
+                finalUrl: page.finalUrl,
+                status: page.status,
+                requestCount: page.requests.length,
+                cookieCount: page.cookies.length,
+                ...(page.error === undefined ? {} : { error: page.error }),
+            })),
+            ...consentSummary(snapshots[0]),
+            findings,
+            rules: rules.map(({ check: _check, ...meta }) => meta),
+        };
+    }
+    finally {
+        await browser.close();
+    }
+}
+function consentSummary(start) {
+    if (start?.consent === undefined) {
+        return {};
+    }
+    const { afterReject: _afterReject, ...summary } = start.consent;
+    return { consent: summary };
+}
+async function capturePage(browser, url, siteUrl, options, checkConsent) {
+    // A fresh context per page means no cookies or storage carry over:
+    // every page is seen the way a first-time visitor sees it.
+    const context = await browser.newContext({ locale: options.locale ?? DEFAULTS.locale });
+    const requests = [];
+    try {
+        if (options.offline) {
+            await context.route('**/*', (route) => isFirstParty(route.request().url(), siteUrl)
+                ? route.continue()
+                : route.fulfill({ status: 200, body: '' }));
+        }
+        const page = await context.newPage();
+        page.on('request', (request) => {
+            requests.push({ url: request.url(), resourceType: request.resourceType() });
+        });
+        const response = await page.goto(url, {
+            waitUntil: 'load',
+            timeout: options.timeoutMs ?? DEFAULTS.timeoutMs,
+        });
+        await page
+            .waitForLoadState('networkidle', { timeout: options.timeoutMs ?? DEFAULTS.timeoutMs })
+            .catch(() => {
+            // Long-polling or streaming pages never go idle; carry on with what we have.
+        });
+        await page.waitForTimeout(options.settleMs ?? DEFAULTS.settleMs);
+        const links = await page.$$eval('a[href]', (anchors) => anchors.map((a) => ({
+            href: a.href,
+            text: [a.textContent, a.getAttribute('aria-label'), a.getAttribute('title')]
+                .filter(Boolean)
+                .join(' ')
+                .replace(/\s+/g, ' ')
+                .trim()
+                .slice(0, 200),
+        })));
+        const resourceHints = await page.$$eval('link[rel][href]', (elements) => elements.map((link) => ({
+            rel: (link.getAttribute('rel') ?? '').toLowerCase(),
+            href: link.href,
+        })));
+        const cookies = (await context.cookies()).map(({ name, domain, path, expires }) => ({
+            name,
+            domain,
+            path,
+            expires,
+        }));
+        const snapshot = {
+            url,
+            finalUrl: page.url(),
+            status: response?.status() ?? null,
+            // Copy: the listener keeps writing to `requests` during the consent check.
+            requests: [...requests],
+            cookies,
+            links,
+            resourceHints,
+        };
+        if (checkConsent && options.consentCheck !== false) {
+            snapshot.consent = await observeConsent(page, context, requests, {
+                settleMs: options.settleMs ?? DEFAULTS.settleMs,
+                timeoutMs: options.timeoutMs ?? DEFAULTS.timeoutMs,
+            });
+        }
+        return snapshot;
+    }
+    catch (error) {
+        // Downloads, timeouts and crashed pages should not end the whole crawl.
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            url,
+            finalUrl: url,
+            status: null,
+            requests,
+            cookies: [],
+            links: [],
+            resourceHints: [],
+            error: message.split('\n')[0] ?? message,
+        };
+    }
+    finally {
+        await context.close();
+    }
+}
+//# sourceMappingURL=scanner.js.map

package/dist/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,QAAQ,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAe,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAsClE,MAAM,QAAQ,GAAG;IACf,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,MAAM;IACjB,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;CACS,CAAC;AAExB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,OAAO,GAAgB,EAAE;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;IACjD,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAE9B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACpC,QAAQ,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI;QACjC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;KACvE,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,SAAS,GAAmB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QAEnC,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5E,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBACD,gFAAgF;gBAChF,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC;YAED,kEAAkE;YAClE,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;gBAC3B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBAClC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACnB,CAAC;gBACH,CAAC;YACH,CAAC;YACD,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QAED,gGAAgG;QAChG,MAAM,QAAQ,GAAc,SAAS;aAClC,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,KAAK,KAAK,SAAS;YACxB,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;YAC3C,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CACvC;aACA,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE/C,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,IAAI;YACJ,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAC5C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC9B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAClC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAChC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;aAC3D,CAAC,CAAC;YACH,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC/B,QAAQ;YACR,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC;SACvD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAA+B;IACrD,IAAI,KAAK,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IAChE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAgB,EAChB,GAAW,EACX,OAAY,EACZ,OAAoB,EACpB,YAAqB;IAErB,mEAAmE;IACnE,2DAA2D;IAC3D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CACpC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC;gBAC1C,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAClB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAC7C,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;YAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YACpC,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;SACjD,CAAC,CAAC;QACH,MAAM,IAAI;aACP,gBAAgB,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;aACrF,KAAK,CAAC,GAAG,EAAE;YACV,6EAA6E;QAC/E,CAAC,CAAC,CAAC;QACL,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CACrD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClB,IAAI,EAAG,CAAuB,CAAC,IAAI;YACnC,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;iBACzE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,GAAG,CAAC;iBACT,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;iBACpB,IAAI,EAAE;iBACN,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACjB,CAAC,CAAC,CACJ,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,EAAE,CACtE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;YACnD,IAAI,EAAG,IAAwB,CAAC,IAAI;SACrC,CAAC,CAAC,CACJ,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YAClF,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,OAAO;SACR,CAAC,CAAC,CAAC;QAEJ,MAAM,QAAQ,GAAiB;YAC7B,GAAG;YACH,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,IAAI;YAClC,2EAA2E;YAC3E,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC;YACvB,OAAO;YACP,KAAK;YACL,aAAa;SACd,CAAC;QACF,IAAI,YAAY,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YACnD,QAAQ,CAAC,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE;gBAC/D,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;gBAC/C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO;YACL,GAAG;YACH,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,IAAI;YACZ,QAAQ;YACR,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,EAAE;YACT,aAAa,EAAE,EAAE;YACjB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO;SACzC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}