privalint 0.0.0-stage → 0.2.0

package/dist/types.d.ts

@@ -0,0 +1,105 @@
+import type { Lang } from './i18n.js';
+import type { Region } from './legal.js';
+export type Severity = 'error' | 'warning' | 'info';
+export interface RecordedRequest {
+    url: string;
+    resourceType: string;
+}
+export interface RecordedCookie {
+    name: string;
+    domain: string;
+    path: string;
+    /** Unix time in seconds, -1 for session cookies. */
+    expires: number;
+}
+export interface PageLink {
+    href: string;
+    text: string;
+}
+/** A `<link>` element such as preconnect, dns-prefetch or preload. */
+export interface ResourceHint {
+    rel: string;
+    href: string;
+}
+/** What happened when privalint looked for a consent banner and clicked "reject". */
+export interface ConsentObservation {
+    bannerFound: boolean;
+    /** Name of the consent manager, if it was recognised. */
+    cmp?: string;
+    acceptLabel?: string;
+    rejectLabel?: string;
+    /** The banner offers "accept" or "subscribe" instead of "reject". */
+    payOrOk?: boolean;
+    /** True once the reject button was clicked and the page reloaded. */
+    rejected: boolean;
+    /** Requests made and cookies newly set after rejecting, including the reload. */
+    afterReject?: {
+        requests: RecordedRequest[];
+        cookies: RecordedCookie[];
+    };
+    error?: string;
+}
+/**
+ * Everything observed while loading one page in a fresh browser context,
+ * without touching any consent banner.
+ */
+export interface PageSnapshot {
+    url: string;
+    finalUrl: string;
+    status: number | null;
+    requests: RecordedRequest[];
+    cookies: RecordedCookie[];
+    links: PageLink[];
+    resourceHints: ResourceHint[];
+    /** Only present on the start page, unless the consent check was skipped. */
+    consent?: ConsentObservation;
+    /** Set when the page could not be loaded, e.g. a download or a timeout. */
+    error?: string;
+}
+export interface Finding {
+    ruleId: string;
+    severity: Severity;
+    message: string;
+    pageUrl: string;
+    evidence: string[];
+    fix?: string;
+    /** What the finding is about, e.g. a vendor. Keeps fingerprints stable across runs. */
+    subject?: string;
+    /** Legal basis in the country the scan was run for. */
+    references?: string[];
+}
+export interface RuleContext {
+    siteUrl: URL;
+    page: PageSnapshot;
+    /** Language for messages and fixes. */
+    lang: Lang;
+}
+export interface Rule {
+    id: string;
+    title: string;
+    description: string;
+    /** Laws, rulings or guidelines the rule is based on. */
+    references: string[];
+    check(context: RuleContext): Finding[];
+}
+export interface PageSummary {
+    url: string;
+    finalUrl: string;
+    status: number | null;
+    requestCount: number;
+    cookieCount: number;
+    error?: string;
+}
+export type ConsentSummary = Omit<ConsentObservation, 'afterReject'>;
+export interface ScanResult {
+    siteUrl: string;
+    lang: Lang;
+    region: Region;
+    scannedAt: string;
+    durationMs: number;
+    pages: PageSummary[];
+    /** Outcome of the consent check on the start page. */
+    consent?: ConsentSummary;
+    findings: Finding[];
+    rules: Array<Omit<Rule, 'check'>>;
+}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/url.d.ts

@@ -0,0 +1,26 @@
+export declare function hostMatches(host: string, domain: string): boolean;
+/**
+ * Treats `example.com`, `www.example.com` and `cdn.example.com` as the same site.
+ * This is a simplification: it does not consult the public suffix list, so
+ * sibling subdomains on shared hosts (e.g. `*.github.io`) count as first party.
+ */
+export declare function isFirstParty(url: string, siteUrl: URL): boolean;
+/** Anything listed by host, optionally narrowed to some paths. */
+export interface HostPattern {
+    /** Hostnames; subdomains match too. */
+    domains: string[];
+    /**
+     * If set, only these paths count. A path ending in `/` matches everything below it,
+     * otherwise it must match exactly or be followed by `/`.
+     */
+    paths?: string[];
+}
+/** Returns the first entry whose hosts and paths match the URL. */
+export declare function findByUrl<T extends HostPattern>(entries: readonly T[], url: string): T | undefined;
+export declare function safeHost(url: string): string | undefined;
+export declare function withoutHash(url: string): string;
+/**
+ * Returns a normalized URL to visit next, or `undefined` if the link should not be crawled.
+ * Query strings are dropped so calendars and filter pages don't eat the page budget.
+ */
+export declare function crawlTarget(href: string, siteUrl: URL): string | undefined;

package/dist/url.js

@@ -0,0 +1,71 @@
+const SKIPPED_EXTENSIONS = /\.(pdf|zip|gz|rar|7z|jpe?g|png|gif|webp|avif|svg|ico|mp4|webm|mp3|wav|docx?|xlsx?|pptx?|csv|xml|json|txt)$/i;
+export function hostMatches(host, domain) {
+    return host === domain || host.endsWith(`.${domain}`);
+}
+/**
+ * Treats `example.com`, `www.example.com` and `cdn.example.com` as the same site.
+ * This is a simplification: it does not consult the public suffix list, so
+ * sibling subdomains on shared hosts (e.g. `*.github.io`) count as first party.
+ */
+export function isFirstParty(url, siteUrl) {
+    const host = safeHost(url);
+    if (host === undefined) {
+        return false;
+    }
+    const siteHost = siteUrl.hostname.replace(/^www\./, '');
+    return hostMatches(host, siteHost) || hostMatches(siteHost, host);
+}
+/** Returns the first entry whose hosts and paths match the URL. */
+export function findByUrl(entries, url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return undefined;
+    }
+    return entries.find((entry) => entry.domains.some((domain) => hostMatches(parsed.hostname, domain)) &&
+        (entry.paths === undefined || entry.paths.some((path) => pathMatches(parsed.pathname, path))));
+}
+function pathMatches(pathname, path) {
+    if (path.endsWith('/')) {
+        return pathname.startsWith(path);
+    }
+    return pathname === path || pathname.startsWith(`${path}/`);
+}
+export function safeHost(url) {
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function withoutHash(url) {
+    const parsed = new URL(url);
+    parsed.hash = '';
+    return parsed.href;
+}
+/**
+ * Returns a normalized URL to visit next, or `undefined` if the link should not be crawled.
+ * Query strings are dropped so calendars and filter pages don't eat the page budget.
+ */
+export function crawlTarget(href, siteUrl) {
+    let url;
+    try {
+        url = new URL(href, siteUrl);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        return undefined;
+    }
+    if (!isFirstParty(url.href, siteUrl) || SKIPPED_EXTENSIONS.test(url.pathname)) {
+        return undefined;
+    }
+    url.hash = '';
+    url.search = '';
+    return url.href;
+}
+//# sourceMappingURL=url.js.map

package/dist/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA,MAAM,kBAAkB,GACtB,6GAA6G,CAAC;AAEhH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAY;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACpE,CAAC;AAaD,mEAAmE;AACnE,MAAM,UAAU,SAAS,CACvB,OAAqB,EACrB,GAAW;IAEX,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CACjB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAChG,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAY;IACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IACjB,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAY;IACpD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,67 @@
 {
   "name": "privalint",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Lint your website for GDPR problems: trackers before consent and after reject, Google Fonts, embeds, missing Impressum. Real browser, CLI and GitHub Action.",
+  "type": "module",
+  "bin": {
+    "privalint": "dist/cli.js"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.de.md"
+  ],
+  "engines": {
+    "node": ">=20.12"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepublishOnly": "npm run build",
+    "lint": "biome check .",
+    "lint:fix": "biome check --write .",
+    "demo": "npm run build && node scripts/render-demo.mjs"
+  },
+  "keywords": [
+    "gdpr",
+    "dsgvo",
+    "privacy",
+    "cookies",
+    "consent",
+    "tracker",
+    "google-fonts",
+    "impressum",
+    "lint",
+    "playwright",
+    "github-action",
+    "tdddg",
+    "dsg",
+    "oesterreich",
+    "schweiz"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "playwright": "^1.64.1"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.6.3",
+    "@types/node": "^20.19.43",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.12"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/JExcellence/privalint.git"
+  },
+  "homepage": "https://github.com/JExcellence/privalint#readme",
+  "bugs": "https://github.com/JExcellence/privalint/issues"
+}